US, Australia, issue joint advisory on IDOR. IcedID's evolution. Ransomware and extortion. DDoS for influence.

Announcement

Join our upcoming webinar with co-host Dragos on OT Cyber Innovation and Resilience.

As business and innovation come together, digital transformation isn’t a future concept - it’s happening right now. Join Dave Bittner and our friends from AWS, Splunk and Dragos on August 3rd @ 2pm EST for a live panel on “Securing Digital Transformation: OT Cybersecurity Innovation and Resilience” where we’ll dive into secure digital transformation, managing OT/IT cyber risk and the value and vision of Cloud resources. For more information and to register, visit thecyberwire.com/dragos.

Summary

By the CyberWire staff

At a glance.

Joint warning on insecure direct object reference.
IcedID’s BackConnect protocol evolves over one year.
Cl0p claims to have accessed data from a third Big Four accounting firm.
Report: Ransomware victims increased by 66% from Q1 to Q2 2023.
Cyberattacks support influence operations.

Joint warning on insecure direct object reference.

The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), the US Cybersecurity and Infrastructure Security Agency (CISA), and the US National Security Agency (NSA) have issued a joint advisory “to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities.”

The advisory states, “These vulnerabilities are common and hard to prevent outside the development process since each use case is unique and cannot be mitigated with a simple library or security function. Additionally, malicious actors can detect and exploit them at scale using automated tools. These factors place end-user organizations at risk of data leaks (where information is unintentionally exposed) or large-scale data breaches (where a malicious actor obtains exposed sensitive information).”

The ACSC, CISA, and NSA point to three instances in which IDOR vulnerabilities were used to facilitate data breaches:

“An October 2021 global data leak incident where mobile phone data, including text messages, call records, photos, and geolocation from hundreds of thousands of devices was exposed by insecure ‘stalkerware’ apps. The apps collected and relayed data from the phones to the same foreign server infrastructure, which contained an IDOR vulnerability, CVE-2022-0732. This led to exposure of the collected app data.
“A 2019 data breach incident where more than 800 million personal financial files, including bank statements, bank account numbers, and mortgage payment documents, from a U.S. Financial Services Sector organization were exposed.
“A 2012 data breach incident where a malicious cyber actor obtained the personal data of more than 100,000 mobile device owners from a U.S. Communications Sector organization’s publicly accessible website.”

First look: mWISE 2023 session catalog

Check out the topics, meet the speakers, and sign up for discount registration.

IcedID’s BackConnect protocol evolves over one year.

Team Cymru has released part 2 of their “Inside the IcedID BackConnect Protocol” series, in which they take a closer look into BackConnect (BC). BC is a protocol used transmit IcedID infection. “IcedID (also known as BokBot) started life in early 2017 as a banking trojan that later evolved to include dropper malware capabilities. These capabilities enable IcedID to download and deploy additional malware like Cobalt Strike, with recent infections leading to Quantum ransomware,” Team Cymru writes.

The researchers explain, “The use of the BC protocol is of particular interest to us, and remains a priority for our overall tracking of IcedID. Analyzing activity related to BC infrastructure provides a strategic view into threat actor activity and interests, as it is a window into what occurs after a successful infection and the victim was deemed valuable for their use.”

Since the release of part 1, the threat actors have updated BC to use TCP/443 instead of the previously reported TCP/8080. Additionally, the total number of command and control (C2) servers has tripled from July of 2022, and the lifecycle of said C2 servers has shortened from 28 days to just eight, and also identified German, Latvian and Russian VPN nodes connected to BC C2 servers. The researchers at Team Cymru note that they have identified a possible connection between infected machines and a spamming campaign which represents “a potential double blow for victims, [as] not only are they compromised and incurring data / financial loss, but they are also further exploited for the purposes of spreading further IcedID campaigns.” For previous reporting regarding IcedID from CyberWire see: Cyberwire’s Research Briefing Volume 5: Issue one, and Daily Podcast episode 1788.

The key to beating ransomware? Use a solution built to defeat ransomware.

Halcyon is the first dedicated, adaptive solution that combines multiple advanced proprietary prevention engines focused specifically on detecting and stopping ransomware. With the fastest endpoint recovery capabilities, multiple layers of resiliency, bypass and evasion protection, automated key capture for swift decryption and data exfiltration prevention, the Halcyon Anti-Ransomware and Resilience Platform reverses the impact of ransomware attacks in just minutes. This is why Halcyon is the resilience platform Global 2000 companies rely on to defeat ransomware.

Cl0p claims to have accessed data from a third Big Four accounting firm.

Cl0p has posted data it claims to have hacked from Big Five accounting firm Deloitte, Cybernews and other outlets report. The gang says it exploited vulnerabilities in MOVEit to accomplish the data theft. It had earlier this month counted coup against PricewaterhouseCoopers (PWC) and Ernst & Young (EY). Deloitte acknowledged receiving Cl0p's attentions, but discounted the effect as negligible. “Our analysis determined that our global network use of the vulnerable MOVEit Transfer software is limited. Having conducted our analysis, we have seen no evidence of impact on client data,” Cybernews quotes a Deloitte Global spokesperson as saying.

Recover from ransomware and disasters the indisputable way. Backup Better.

Be ready for the inevitable with CrashPlan endpoint backup. With 256-bit AES encryption in transit and at rest running automatically every 15 minutes, you can work without friction or fear.

Trusted by organizations worldwide with less than 100 endpoints to more than 100,000, CrashPlan is the undeniable solution to recover all your work and intellectual property at the endpoints from any data calamity. And, see what exactly was compromised to fully understand the risk.

Report: Ransomware victims increased by 66% from Q1 to Q2 2023.

ReliaQuest has released a report on ransomware trends for the second quarter (Q2) of 2023. The study concludes that victim counts for Q2 have skyrocketed. “In the second quarter of 2023, close to 1,400 organizations were named on ransomware and data-extortion websites. This marked a substantial increase (66%) from Q1 2023, which saw close to 850 affected organizations. What makes this increase even more impressive is that Q1 2023 had set the record for the most victims we ever recorded, but Q2 2023 shattered that record with 500 more. The number of organizations being named on ransomware websites has more than doubled over the past two quarters, highlighting a sudden growth in ransomware operations.”

ReliaQuest finds that Cl0p’s MOVEIt campaign was the most impactful of the campaigns in Q2, but they note that it’s technically an extortion campaign as opposed to a ransomware effort strictly speaking: Cl0p has yet to encrypt the files they’re taking. The cybercriminals with the highest victim count belong to LockBit, with close to 250 organizations being named in their ransom requests. The US continues to be the main target for cybercrime campaigns, with the UK, Germany, Canada, and France trailing by large margins. The sectors most heavily hit were science and technology (20.2%), manufacturing (19.6), and finance and insurance (10.5%).

Cyberattacks support influence operations.

Anonymous Sudan (a front for Russian intelligence services) has claimed responsibility for a cyberattack against Kenya's eCitizen portal. The East African reports that Kenya's ICT minister acknowledged an attack on the system, a place where Kenyans access government services online, but said that no data had been lost. The government was working to secure eCitizen and restore it to full operation. TechCabal has an account of the extent of the disruptions, which it characterizes as distributed denial-of-service (DDoS) attacks. The outlet also quotes the rationale Anonymous Sudan offered for the campaign: Kenya has “released statements doubting the sovereignty of [the Sudanese] government.” Here's a more likely explanation: Kenya's President William Ruto declined to attend the Russo-African summit, and gave as his reason the impropriety of appearing to support one side in Russia's war.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Notes.

Today's issue includes events affecting Australia, Belarus, Burkina Faso, the Central African Republic, Eritrea, Germany, Kenya, Mali, Russia, Somalia, Ukraine, the United Kingdom, the United States, and Zimbabwe.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+519: Fighting in the Zaporizhzhia Oblast. (CyberWire) Ukraine makes gains in the southeastern sector, and Russia offers carrots (free grain) and applies sticks (DDoS attacks) in its quest to influence African governments.

Russia-Ukraine war: List of key events, day 520 (Al Jazeera) These are the main developments as the Russian invasion of Ukraine enters its 520th day.

Russia-Ukraine war at a glance: what we know on day 520 of the invasion (the Guardian) Ukrainian soldiers say they have recpatured village of Staromaiorske; Yevgeny Prigozhin appeared to attend the Russia-Africa summit in St Petersburg

Live Briefing: Russia Invades Ukraine (RadioFreeEurope/RadioLiberty) RFE/RL's Ukraine Live Briefing gives you the latest developments on Russia's ongoing invasion, Western military aid, global reaction, and the plight of civilians. The Live Briefing presents the latest developments and analysis, updated throughout the day.

Kyiv launches a major push against Russian forces, officials and analysts say (AP News) Ukraine has launched a major push to dislodge Russian forces from the country's southeast as part of its weekslong counteroffensive, committing thousands of troops to the battle.

Ukrainian counter-offensive breaks through Russian defences in major push (The Telegraph) Massive Himars strike and push through village signal new phase in fightback against Putin's forces

On southern front, Ukrainian forces aim to smash through Russian defenses (Washington Post) Intense fighting raged along Ukraine’s front lines Thursday, according to officials in Kyiv, as Ukrainian troops made slow but steady gains in their ongoing counteroffensive to drive a wedge through the Russian-occupied south.

Ukraine’s Stepped-Up Assault Grinds Forward, but Scale Is Unclear (New York Times) Kyiv has intensified its counteroffensive against the Russian invasion, but has kept things murky on the size of the assault, the casualties and what forces it still has in reserve.

Ukraine war: Kyiv claims success as southern fighting intensifies (BBC News) Ukraine's armed forces say they are solidifying positions after an advance east of Zaporizhzhia.

With Wagner in Belarus, tension grows on northern Ukraine border (Washington Post) Fears have grown along Ukraine’s northern border about the potential for new military attacks since Yevgeniy Prigozhin’s Wagner mercenaries relocated to Belarus after last month’s short-lived mutiny against Moscow’s military leadership, with Ukraine — and even Poland — tightening security and stepping up defenses.

SBU detains Russian spy helping enemy prepare another air strike on Kharkiv (Ukrinform) Counter-intelligence operatives with the Security Service of Ukraine (SBU) detained an enemy agent involved in the preparation of another air strike on Kharkiv. — Ukrinform.

US intel report details increasing importance of Chinese technology to Russia's war in Ukraine (CNN) China is providing technology and equipment to Russia that is increasingly important to Moscow’s war in Ukraine, according to a newly released report compiled by the Office of the Director of National Intelligence.

U.S. expects to begin delivering Abrams tanks to Ukraine in September (POLITICO) The news, provided by six people familiar with discussions, marks the most specific information to date on Washington's plans.

Zelenskiy adviser calls for big increase in air defence systems for Ukraine (the Guardian) It makes moral and economic sense for west to help more as Kyiv cannot protect all main cities, aide says

NATO has a new plan to ramp up defense production. Is it enough? (Atlantic Council) Underreported coming out of the Vilnius Summit, the Alliance's new Defense Production Action Plan has the potential to transform how allies acquire what they need to defend themselves.

How Does the War in Ukraine End? (Foreign Affairs) A Conversation With Fiona Hill, Samuel Charap, and Andriy Zagorodnyuk

The War That Defied Expectations (Foreign Affairs) What Ukraine revealed about military power.

Ukraine’s digital revolution is proving vital for the country’s war effort (Atlantic Council) Ukraine's remarkable resilience amid the biggest European war since World War II owes much to the country's ongoing digital revolution, writes Ukrainian Minister for Digital Transformation Mykhailo Fedorov.

The war in Ukraine is spurring a revolution in drone warfare using AI (Washington Post) The advent of AI-enabled drones holds huge promise for Ukraine’s military but may also be exploited by nefarious non-state actors

Russia’s mass abduction of Ukrainian children may qualify as genocide (Atlantic Council) Vladimir Putin has already been charged with war crimes by the International Criminal Court over the mass abduction of Ukrainian children. Many believe the deportations quality as genocide, writes Vladyslav Havrylov.

Prigozhin Apparently Spotted In St. Petersburg On The Sidelines Of Russia-Africa Summit (RadioFreeEurope/RadioLiberty) Yevgeny Prigozhin, the Wagner mercenary chief who led a short-lived insurrection in Russia last month, is reportedly in St. Petersburg where a Russia-Africa summit is taking place.

Russian War Report: Kremlin seeks stronger ties in Africa as Wagner eyes Niger coup (Atlantic Council) As Russian President Vladimir Putin attends the Russia-Africa Summit, he and his government are making moves to solidify regional cooperation. Amid this, Wagner seeks to capitalize on the coup in Niger.

Putin promises free grain to six African nations after collapse of Black Sea deal (the Guardian) President says Russia will replace blocked Ukrainian exports after it abandoned pact on passage of ships

Kenya ICT minister admits cyber-attack on eCitizen portal, insists data secure (The East African) The attack was by hackers who identified themselves as Anonymous Sudan.

Anonymous Sudan: the group behind recent anti-Kenya cyberattacks (TechCabal) Since Sunday, websites belonging to government agencies, media, hospitals and banks have been targeted by hackers claiming to be exacting revenge on behalf of the Sudanese regime.

Kenya President Ruto to skip Russia-Africa Summit (The East African) His spokesman said he will instead be represented by African Union.

Cyber training, drills and cyber defense capacity building — SSSCIP and CYBER RANGES sign a Memorandum of Cooperation (EIN News) The SSSCIP has hosted a delegation of CYBER RANGES Corp., a leading global company specializing in technology solutions development and cyber defense training.

Putin has opened a sinister new front in his war against Britain (The Telegraph) If London hopes to defuse the Kremlin’s information operations, it must start by giving Moscow a taste of its own medicine

Attacks, Threats, and Vulnerabilities

Preventing Web Application Access Control Abuse (Joint Cybersecurity Advisory: ACSC, NSA, CISA) The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities. IDOR vulnerabilities are access control vulnerabilities enabling malicious actors to modify or delete data or access sensitive data by issuing requests to a website or a web application programming interface (API) specifying the user identifier of other, valid users. These requests succeed where there is a failure to perform adequate authentication and authorization checks.

Preventing Web Application Access Control Abuse (ACSC) The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities.

New Cybersecurity Advisory Warns About Web Application Vulnerabilities (NSA) The National Security Agency (NSA) has partnered with U.S. and international cyber agencies to release the Cybersecurity Advisory (CSA), “Preventing Web Application Access Control Abuse,” warning that vulnerabilities in web applications, including application programming interfaces (APIs), can allow malicious actors to manipulate and access sensitive data.

Preventing Web Application Access Control Abuse | CISA (Cybersecurity and Infrastructure Security Agency CISA) The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), U.S. Cybersecurity and Infrastructure Security Agency (CISA), and U.S. National Security Agency (NSA) are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and organizations using web applications about insecure direct object reference (IDOR) vulnerabilities.

US, Australia cyber agencies warn IDOR security flaws can be exploited 'at scale' (TechCrunch) A new government joint advisory says IDOR vulnerabilities have resulted in major data breaches in the U.S. and overseas.

US, Australia Cyber Agencies Warn of Exploitable ‘At Scale’ IDOR Security Flaws (Global Village Space | Technology) <p>Learn how common website vulnerabilities, known as insecure direct object references (IDORs), can lead to large-scale data breaches and how to protect against them.</p>

China’s Wuhan Earthquake Center Suffers Cyber-Attack (Infosecurity Magazine) Responding to the news, a Chinese Foreign Ministry Spokesperson claimed the US is engaging in malicious cyber operations across the world

US government contractor says MOVEit hackers accessed health data of 'at least' 8 million individuals (TechCrunch) Maximus, a U.S. government services company, says MOVEit hackers accessed the personal information of as many as 11 million individuals

8 million people hit by data breach at US govt contractor Maximus (BleepingComputer) U.S. government services contractor Maximus has disclosed a data breach warning that hackers stole the personal data of 8 to 11 million people during the recent MOVEit Transfer data-theft attacks.

Abusing the Ad Network – Threat Actors Now Hacking into Companies via Search (Bitdefender) For the past few years, hackers have increasingly targeted customers and businesses with tainted software boosted via ads. The recipe is simple – cyber-criminal groups set up fake websites for high-interest software and promote them on top of the results page through advertisements.

New ‘Nitrogen’ malvertising campaign leverages search ads to target enterprise networks (teiss) An insidious malvertising campaign known as "Nitrogen" has been discovered, leveraging ads on Google Search and Bing to target users seeking IT tools such as AnyDesk, Cisco AnyConnect VPN, and WinSCP.

New Malvertising Campaign Distributing Trojanized IT Tools via Google and Bing Search Ads (The Hacker News) Researchers warn of Nitrogen, a malvertising campaign infecting enterprise networks via Google Search and Bing ads. Targets users seeking IT tools.

Hackers Distribute PurpleFox Malware Using Vulnerable MS-SQL Servers (Cyber Security News) The purple fox malware has been active since 2018, adopting a new technique to deliver its payload through MS SQL servers.

Deloitte denies Cl0p data breach impacted client data in wake of MOVEit attack (ITPro) Deloitte was the third of the 'Big Four' professional services firms to have appeared on the ransomware group's 'wall of shame' victim blog

Cl0p Ransomware Strikes Deloitte, Company Refutes Breach (HackRead) In a message on its dark web breach blog, Cl0p Ransomware claims that The company (Deloitte) doesn’t care about its customers; it ignored their security.

Deloitte joins fellow Big Four MOVEit victims PWC, EY (Cybernews) Big Four financial services firm Deloitte confirms to Cybernews that it's part of the latest round of victims claimed in the MOVEit attacks.

Inside the IcedID BackConnect Protocol (Part 2) (Team Cymru) Introduction In this blog post, we will provide an update on our continued analysis and tracking of infrastructure associated with IcedID’s BackConnect (BC) protocol; a continuation of the analysis we shared in late-December 2022, which you can read here, in addition to our campaign metrics and infrastructure tracking blog posts. Note: whilst the same BC protocol is utilized by several other threat operations, including Bazar and QakBot, this blog post focuses specifically on IcedID infrastructu

Hackers are infecting Call of Duty players with a self-spreading malware (TechCrunch) Activision said it brought the 2009-released game offline while it investigates "an issue."

More patients hit by Beverly Hills plastic surgeon data breach, exposing sensitive photos, private information (NBC Los Angeles) The data of thousands of patients of Dr. Motykie are in danger of being exposed by criminal hackers. Already, some patients’ topless photos and private information has been posted online.

A Tale of Two Cities' water attacks (Control Global) Cyber attacks on water and wastewater facilities in Discovery Bay, California, and Oldsmar, Florida, highlight the industry's vulnerability

Evotec provides update on financial impact of cyber-attack - Evotec (Evotec) Evotec SE (Frankfurt Stock Exchange: EVT, MDAX/TecDAX, ISIN: DE0005664809; NASDAQ: EVO) today announced that it is adjusting its guidance for the fiscal year 2023 due to the impact of the cyber-attack.

Security Patches, Mitigations, and Software Updates

CISA Releases Five Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency CISA) CISA released five Industrial Control Systems (ICS) advisories on July 27, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Microsoft fixes bug that breaks video recording in Windows apps (BleepingComputer) Microsoft has fixed a known issue causing video recording and playing failures in some apps on Windows 10 and Windows 11 systems.

Trends

SMEs Are Underestimating Their Cybersecurity Risks (CDOTrends) A shocking 60% of small and medium-sized enterprises (SMEs) worldwide are unprotected and susceptible to potentially devastating ransomware attacks.

Healthcare Threat Landscape 2022-2023: Common TTPs Used by Top Ransomware Groups Targeting the Healthcare Sector (Trustwave) The healthcare sector has been under constant threat from cybercriminals due to the sensitive nature of patient data and the valuable information held by healthcare providers. This blog analyzes the ransomware landscape for the healthcare sector for the years 2022-2023.

Trustwave SpiderLabs Research: Cybersecurity in the Healthcare Industry (Trustwave) Download the new Trustwave SpiderLabs report on a months-long investigation into the cyber threats facing the healthcare industry.

Alarming Cybersecurity Statistics That Will Keep You up at Night (Bankless Times) The latest cybersecurity statistics providing insights into how often companies get hacked, who is the main target, how much they get extorted, and more.

Futuriom SD-WAN and SASE Research Reveals 98 Percent of Organizations Feel Hybrid Work has Increased Demand for SASE and ZTNA Solutions (Business Wire) According to the Futuriom Study, 94 Percent of Organizations Prefer a Single-Pass Architecture When Evaluating and Deploying SASE Solutions

Marketplace

Cybersecurity startup Deep Instinct laying off 15% of team (CTech) The company will be parting ways with 46 of around 300 employees, including 19 in Israel

Funding for Cybersecurity Startups Plunges (eSecurityPlanet) VC funding for cybersecurity startups has been strong - until now. What does it take to win as a cyber startup in the current market?

Diverse Perspectives, Stronger Defenses: Growing the Cyber Workforce Through Diversity (Center for Cybersecurity Policy and Law) In an increasingly interconnected world, cybersecurity is a critical field safeguarding the digital and physical infrastructure that underpins our daily lives.

The honourees: Canada’s Top Women in Cybersecurity (IT World Canada) On Jul. 26, 20 women were honoured at the IT World Canada Top Women in Cybersecurity celebration, Surpassing Expectations. The event hosted a group of women who excel in the various cybersecurity disciplines. Join us in congratulating the 2023 Top Women in Cybersecurity. Kirsten Turnbull Kirsten Turnbull is a senior technical specialist at Microsoft Canada.

Salt Security Appoints Ori Bach as EVP of Product (DataCentreNews UK) Salt Security appoints Ori Bach as EVP of Product to drive product vision and meet growing demand for API security platform.

Products, Services, and Solutions

Senhasegura Opens North American Center of Excellence to Support Next Generation PAM (Business Wire) New Technical Support Hub Delivers Senhasegura’s 5-Star Service to Channel Partners and End Users

ESET Partners with Patriot Growth Insurance Services to Offer Best-in-Class Cyber Insurance to Companies Across the US (Yahoo Finance) ESET, a global leader in cybersecurity, today announced that it has partnered with Patriot Growth Insurance Services (Patriot), one of the largest US insurance services firms specializing in cyber insurance, to close the gap between cyber insurance requirements and applicants' cybersecurity technology and processes. The newly launched platform allows ESET and Patriot to proactively assess companies' security postures so they know what they should do to qualify for cyber insurance coverage before

Palo Alto Networks Introduces CI/CD Security, Becoming the First CNAPP to Extend Security into the Software Delivery Pipeline (Palo Alto Networks) With the integration of Cider Security, Prisma Cloud bolsters risk prevention in the engineering ecosystem with centralized visibility, pipeline posture management and OWASP CI/CD protection SANTA...

Cequence Named “Best-in-Class” in Datos Insights API Security Solutions (Cequence Security) Cequence Security has been recognized as a “best-in-class” solution in the Datos Insights Vendor Evaluation: API Security Solutions report.

Aware's AI Data Platform Dominates in Head-to-Head Showdown Against Meta's Llama-2 (PR Newswire) Aware, the AI Data Platform for workplace conversations, today unveiled its performance against Meta's latest release, Llama-2. As the tech...

Darktrace HEAL provides security teams with abilities to simulate real-world cyber incidents (Help Net Security) HEAL works with DETECT and Darktrace PREVENT to build a live picture of the environment and attack, and integrates with Darktrace RESPOND.

Egnyte Announces Generative AI Solutions for Secure Content Collaboration (Business Wire) The new solutions enable companies to search and summarize documents and media files while maintaining privacy, security, and compliance

Fortinet Recognized as the Sole Leader in the Westlands Advisory 2023 IT/OT Network Protection Platforms Navigator™ (Fortinet) As one of the top and fastest growing OT security vendors, Fortinet is increasing market share with its integrated OT-Aware Security Fabric platform

Technologies, Techniques, and Standards

Cybersecurity Performance Goals: Sector-Specific Goals (Cybersecurity and Infrastructure Security Agency CISA) Now that the cross-sector CPGs have been published, CISA is working to develop Sector-Specific Goals (SSGs) for each of the 16 Critical Infrastructure sectors.

Setting up a cybersecurity squad from scratch (Thales Group) Thales Cyber Defense Solutions aims to raise the digital resilience of critical infrastructures. A growing number of utilities, maritime companies and chemical factories are having their crucial control systems scrutinized by Roel van Rijsewijk and his team of threat hunters.

Best practices on cybersecurity budget allocation: a research-based guide (NordLayer) Building a cybersecurity strategy is challenging. It requires more than just technical knowledge and managerial skills but also demands financial resources.

Design and Innovation

Researchers Poke Holes in Safety Controls of ChatGPT and Other Chatbots (New York Times) A new report indicates that the guardrails for widely used chatbots can be thwarted, leading to an increasingly unpredictable environment for the technology.

Why Elon Musk’s Plan for a Super App Won’t Be Easy in America (Wall Street Journal) Lots of U.S. companies have talked about a super app, including PayPal, Snap and Block.

Legislation, Policy, and Regulation

Pakistan needs to press pause on its data overhaul (Atlantic Council) Islamabad appears poised to push through onerous data regulations that will put the country's tech industry under strain—and raise concerns for consumers.

Report: Biden should prioritize cyber capacity building for allies (CyberScoop) A report from the Foundation for the Defense of Democracies lays out how the White House can help allies defend against cyberattacks.

Senate panel advances bills to childproof the internet (The Verge) President Joe Biden has made child safety a top administration priority.

Sweeping and controversial children’s digital privacy bills head to full Senate (Record) The two measures, known as KOSA and COPPA 2.0, are aimed at helping families navigate the “the complexities of online content that is manipulated and targeted" at children.

Privacy debate takes center stage in kids’ online safety legislation (Washington Post) Privacy figures big into pros and cons of COPPA 2.0, KOSA

Opinion | Lindsey Graham and Elizabeth Warren: When It Comes to Big Tech, Enough Is Enough (New York Times) We need a nimble, adaptable new agency with the expertise, resources and authority to rein in the tech giants that control our digital lives.

Generative AI’s ‘Industry Standards’ for Cybersecurity and Data Privacy Could be Here Sooner Rather than Later (The National Law Review) AI may be both the most "powerful capability of our time" and the "most powerful weapon of our time." That's according to Jen Easterly, Director of the Cybersecurity a

SEC, FTC Headline A Rise In U.S. Privacy And Cybersecurity Efforts - Privacy Protection - United States (Mondaq) 2023 so far has seen the FTC address data privacy matters with vigour, issuing a series of policy statements bolstered by several enforcement actions.

Final Rule: SEC to Require Companies to Report Breaches in 4 Days (Black Kite) The SEC finalized new cybersecurity rules, requiring companies to report breaches within a matter of days. Discover what it all means here.

SEC requires reporting cyberattacks within 4 days, but not everyone may like it. (Tripwire) New rules requiring publicly-listed firms to disclose serious cybersecurity incidents within four days have been adopted by the US Securities and Exchange Commission (SEC).

Cyber Experience on Boards Still Seen as Critical in New SEC Rules (Wall Street Journal) Companies will no longer need to say if their boards have cybersecurity experts under new rules from U.S. financial regulators, but that hasn’t diminished the importance of having them available, company directors say.

US Spies Are Lobbying Congress to Save a Phone Surveillance 'Loophole' (WIRED) The National Security Agency has urged top lawmakers to resist demands that it obtain warrants for sensitive data sold by data brokers.

U.S. House rejects bid to curb spy agency data collection (Reuters) A U.S. spy program that sweeps up vast amounts of electronic communications survived a legislative challenge in the House of Representatives on Wednesday, the first attempt to curb the data gathering since former NSA contractor Edward Snowden revealed details of its scope.

Cyber Command, NSA pick advances to Senate floor, but path to confirmation remains blocked (Record) The Senate Armed Services Committee has approved President Joe Biden's nominee to be U.S. Cyber Command and National Security Agency chief, sending it to the chamber floor where an impasse over military promotions drags on.

Six ways that AI could change politics (MIT Technology Review) A new era of AI-powered domestic politics may be coming. Watch for these milestones to know when it’s arrived.

Litigation, Investigation, and Law Enforcement

US Senator Wyden asks FTC, CISA, DOJ to 'take action' against Microsoft following hack (Reuters) Oregon Senator Ron Wyden has asked the Federal Trade Commission, the Cybersecurity and Infrastructure Security Agency and the Justice Department to 'take action' against Microsoft following a China-linked hack that reportedly resulted in the theft of thousands of government emails from top U.S. officials.

US senator blasts Microsoft for “negligent cybersecurity practices” (Ars Technica) Rebuke follows recent breach that exposed email accounts of US federal officials.

WSJ News Exclusive | Microsoft Faces Mounting Scrutiny Over China-Linked Email Hack (Wall Street Journal) A leading lawmaker on cybersecurity issues accused the tech giant of negligence that enabled the spying campaign.

Senator calls on DOJ to investigate alleged China hack of Microsoft cloud tools (Register) A leading U.S. senator asked the Justice Department and several other agencies to investigate a recent hack of Microsoft-provided email accounts used by top government officials.

US Senator Wyden Accuses Microsoft of ‘Cybersecurity Negligence’ (SecurityWeek) Redmond is accused of “negligent cybersecurity practices” that enabled a successful Chinese hack of the United States government.

US Senator: It's Time to Investigate Microsoft for 'Negligent Cybersecurity' (PCMAG) Sen. Ron Wyden wants the FTC and DOJ to investigate Microsoft for its role in the 2020 SolarWinds hack and a recent breach of US government email accounts.

Will S.B.F. Cut a Deal? (Puck) A close reading of the latest developments and looming mysteries: Can S.B.F. flip on a politician? Is Ryan Salame the next FTX insider to plead guilty? What will happen to the parents, Barbara and Joe, and to the brother, G.B.F? And will the case even make it to trial?

Sam Bankman-Fried Won't Face Campaign Finance Charge, U.S. DOJ Says (CoinDesk) The Justice Department said late Wednesday that the campaign finance charge was not included in an extradition document with The Bahamas, and so it would not proceed on the charge.

Why paying a cyber ransom could land you with a big fine (NZ Herald) PLUS: A visiting security expert's contrary view on AI.

Trump Faces Major New Charges in Documents Case (New York Times) The office of the special counsel accused the former president of seeking to delete security camera footage at Mar-a-Lago. The manager of the property, Carlos De Oliveira, was also named as a new defendant.

Ex-Trump lawyer says evidence against him ‘overwhelming’ in Mar-a-Lago case (the Guardian) Ty Cobb, who represented Trump in Mueller investigation, says classified documents case is ‘tight’ after new charges filed

Hunter Biden Can't Turn the Page (Time) Hunter Biden's plea deal falling apart is the latest reminder that he can't move beyond his past.

The Hunter problem simply isn't going away for Biden (The Telegraph) Hunter has made millions because he is the President's son. People want to know more

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

RhythmWorld (Denver, Colorado, USA, Oct 16 - 18, 2023) RhythmWorld is the premier cybersecurity conference for the latest security insights, perspectives on emerging threats, and support in achieving your security goals. This year, we are happy to announce that we will return to the Mile High City for two full days of interactive peer-to-peer learning, networking, and an unforgettable experience. RhythmWorld attendees gain access to best practices, comprehensive training sessions featuring cybersecurity leaders from across the industry, connections to technical LogRhythm experts, and the chance to compete in a LogWars Capture the Flag (CTF) event.

Events

2023 International Cybersecurity Championship and Conference (IC3) (San Diego, California, USA, Aug 1 - 4, 2023) The International Cybersecurity Championship and Conference (IC3) event is designed to attract top talent and raise global awareness of the power of games to upskill the cybersecurity industry. Through its exciting, competition-based forum, the IC3 helps individuals...

Insider Threat Program Development / Management - Insider Threat Detection & Data Analysis Training Course (NASA Kennedy Space Center, Florida, USA, Aug 3 - 4, 2023) The training course will be taught at the NASA Kennedy Space Center in Florida on August 3-4, 2023. This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CIO / IT Network Security, CISO, Human Resources, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. This training will also provide students with an in depth view of how to obtain visibility of potential or malicious employee actions on computer systems and networks, using Insider Threat Detection software. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

Black Hat USA (Las Vegas, Nevada, USA, Aug 5 - 10, 2023) Founded in 1997, Black Hat is an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Grown from a single annual conference to the most respected information security event series internationally, these multi-day events provide the security community with the latest cutting-edge research, developments, and trends.

Girls Hack Village presents SquadCon (Las Vegas, Nevada, USA, Aug 10 - 12, 2023) Girls Hack Village presents SquadCon is a three-day conference that seeks to bring gender diverse perspectives of the contributions, experiences, and issues facing the industry's other. Hackers that are new or from underrepresented communities may not often feel comfortable in existing conferences. SquadCon is a forum for conversations about topics that impact girls, women, and LGBTQ+ individuals, including mental health and all the factors that shape the experiences of marginalized groups in the industry. SquadCon is a cybersecurity conference that will include talks, labs, workshops, discussions, CTFs and panels to move towards our mission of improving diversity in ethical hacking. SquadCon is an independent conference event in Las Vegas during Hacker Summer Camp scheduled for August 10-12th. It is run by the makers of Girls Hack Village and exists to help foster diversity and inclusion in cybersecurity.

SecureWorld Manufacturing Virtual Conference (Virtual, Aug 23, 2023) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 5 CPE credits learning from nationally recognized industry leaders. The agenda offers 15+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.