Account restoration fraud. Workforce and resilience. Post-exploitation techniques. Cloud threats. Updates from the hybrid war.

Announcement

Join our upcoming webinar with co-host Dragos on OT Cyber Innovation and Resilience.

As business and innovation come together, digital transformation isn’t a future concept - it’s happening right now. Join Dave Bittner and our friends from AWS, Splunk and Dragos on August 3rd @ 2pm EST for a live panel on “Securing Digital Transformation: OT Cybersecurity Innovation and Resilience” where we’ll dive into secure digital transformation, managing OT/IT cyber risk and the value and vision of Cloud resources. For more information and to register, visit thecyberwire.com/dragos.

Summary

By the CyberWire staff

At a glance.

An illicit market in account restoration.
Resilience and the cyber workforce: a snapshot.
New post-exploitation technique in Amazon Web Services.
A look at cloud threats.
Incursion into Norwegian government networks went on for four months.
Russian legislation seeks to reduce or eliminate online privacy.

An illicit market in account restoration.

Being banned from any platform is unpleasant. It can seem arbitrary or unfair, and it's often either beyond the possibility of appeal or can be appealed only at considerable cost in time and expense. It's a particularly troublesome experience for third-party sellers in the Amazon marketplace, who face a loss of income in addition to simple inconvenience. A market has grown up in which brokers offer assistance in restoring banned sellers' accounts. They often do so, however, illicitly. CNBC reports that the brokers frequently work by offering kickbacks to Amazon insiders who take advantage of their position to override bans. Amazon isn't alone--other large third-party markets are facing similar problems--but Amazon's size makes the problem particularly evident. “There is no place for fraud at Amazon and we will continue to pursue all measures to protect our store and hold bad actors accountable,” Christy Distefano, an Amazon spokesperson, told CNBC.

In addition to account restoration services, company insiders have also been found selling internal data, the better to help third-party sellers game the company's system to better position themselves for success in the online market.

First look: mWISE 2023 session catalog

Check out the topics, meet the speakers, and sign up for discount registration.

Resilience and the cyber workforce: a snapshot.

Immersive Labs has released its Cyber Workforce Benchmark Report, noting significant improvements in response time to cyber incidents. The report notes “Organizations’ median response time to emerging threats improved by one-third, indicating a significant increase in the speed of response and continued progress compared to the year prior. Enterprises have enhanced their knowledge about newly discovered threats and vulnerabilities, enabling them to respond more rapidly than ever before. The Log4j crisis, for example, was a watershed moment that could well have been a catalyst for this urgency given its catastrophic impact on organizations around the world.”

Wish you had a cheat sheet for AWS investigations? Expel created one!

We remediate loads of cyber incidents in Amazon Web Services (AWS), and some common themes have emerged re: attacker use of APIs. We’ve noticed they map nicely to MITRE ATT&CK tactics.

So we captured them in a mind map of possible attack paths once hackers are inside an AWS environment. This resource should be helpful if you ever find yourself chasing a baddie through the cloud and want to catch them sooner than later.

New post-exploitation technique in Amazon Web Services.

Mitiga has published a report looking at a new potential post-exploitation technique in AWS. The technique involves “running AWS’s Systems Manager (SSM) agent as a Remote Access Trojan (RAT) on both Linux and Windows machines, controlling the endpoint using another AWS account.”

The researchers write, “[T]he SSM agent, a legitimate tool used by admins to manage their instances, can be re-purposed by an attacker who has achieved high privilege access on an endpoint with SSM agent installed, to carry out malicious activities on an ongoing basis. This allows an attacker who has compromised a machine, hosted on AWS or anywhere else, to maintain access to it and perform various malicious activities. Unlike using common malware types, which are often flagged by antivirus software, using [an] SSM agent in this malicious manner allows the attacker to benefit from the reputation and legitimacy of this binary to cover his tracks.” For more on Mitiga's study of post-exploitation activities, including defense against them, see CyberWire Pro.

Recover from ransomware and disasters the indisputable way. Backup Better.

Be ready for the inevitable with CrashPlan endpoint backup. With 256-bit AES encryption in transit and at rest running automatically every 15 minutes, you can work without friction or fear.

Trusted by organizations worldwide with less than 100 endpoints to more than 100,000, CrashPlan is the undeniable solution to recover all your work and intellectual property at the endpoints from any data calamity. And, see what exactly was compromised to fully understand the risk.

A look at cloud threats.

Cado Security has published its 2023 Cloud Threat Findings Report, finding that SSH is by far the most commonly targeted service by cloud-focused threat actors: “Since SSH is a protocol used across the internet, not just in cloud infrastructure, this statistic is unsurprising. SSH allows secure communication between clients and servers, and is typically used for server administration. This often means that SSH servers are internet facing and can pose an easy target if inadequately secured.”

The researchers also found that botnet agents are the most common form of malware targeting cloud services:

“The vast majority of observed traffic is dedicated to spreading common botnet families, these include Mirai, XorDDoS and IRCbot - a generic name for botnets making use of the IRC protocol. It’s worth noting that samples categorized as Mirai may actually be one of the many existing variants of this malware.”

Incursion into Norwegian government networks went on for four months.

Investigators have concluded that a cyberespionage campaign against Norwegian government networks lasted four months before it was detected and action taken to stop it, Bloomberg reports. The effort, generally attributed to Russian intelligence services, exploited a now-patched vulnerability in Ivanti Endpoint Manager Mobile. Yesterday the US Cybersecurity and Infrastructure Security Agency (CISA) and the Norwegian National Cyber Security Centre (NCSC-NO) released a joint Cybersecurity Advisory (CSA) on the incident, Threat Actors Exploiting Ivanti EPMM Vulnerabilities.

The CSA, which includes extensive advice on detection, remediation, and prevention, says, "Mobile device management (MDM) systems are attractive targets for threat actors because they provide elevated access to thousands of mobile devices, and APT actors have exploited a previous MobileIron vulnerability. Consequently, CISA and NCSC-NO are concerned about the potential for widespread exploitation in government and private sector networks."

Russian legislation seeks to reduce or eliminate online privacy.

TorrentFreak, writing with outrage, describes a bill signed into law by President Putin on Monday. Federal Law No. 406-FZ (On Amendments to the Federal Law ‘On Information, Information Technologies and Information Protection’ and the Federal Law “On Communications”) will prohibit foreign email systems, and it will require all domestic platforms to verify the identity of all users by government-approved methods. VPNs aren't banned outright, but the VPN services remaining in operation in Russia are compliant with state regulations and afford little if any anonymity or privacy. Attempting to evade identity verification requirements will be risky, as the new laws criminalize preparation to make such attempts. "Posting information online that amounts to advice on how to use VPNs, Tor, and similar tools, for circumvention purposes, will be considered a crime. On top, regular hosting providers will be subjected to state registration and new obligations along similar lines to those imposed on VPN providers."

The law is an example of what Foreign Policy calls Russia's return to its totalitarian past. Information control, censorship, and draconian suppression of dissent are becoming the norm.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Notes.

Today's issue includes events affecting Australia, Canada, China, the European Union, Iran, Italy, Kazakhstan, Russia, Ukraine, the United Kingdom, and the United States.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+524: Targeting grain and dissent. (CyberWire) Russian missile strikes against civilian targets remain a defining feature of Moscow's war. New legislation foreshadows a crackdown on domestic dissent in Russia.

Russia-Ukraine war: List of key events, day 525 (Al Jazeera) These are the main developments as the Russian invasion of Ukraine enters its 525th day.

Russia-Ukraine war live: Russian strikes cause fire at grain store in Odesa after drones shot down over Kyiv (the Guardian) Russia attacks port and grain storage facilities in Izmail after drones downed during an overnight attack on Kyiv

Russia accuses Ukraine of a drone attack on Moscow that hit a building already struck just days ago (AP News) Russian authorities have accused Kyiv of yet another attack on Moscow and its surroundings with drones.

Drone hits tower housing Russian ministries for second time in three days (Reuters) A high-rise building in Moscow's business district that houses three Russian government ministries was struck by a drone for the second time in three days on Tuesday, in what Russia called an attempted Ukrainian "terrorist attack".

Drone attacks in Moscow’s glittering business district leave residents on edge (AP News) The glittering towers of the Moscow City business district were once symbols of the Russian capital's economic boom in the early 2000s.

Russia strikes Ukraine's Danube port, sending global grain prices higher (Reuters) Russia attacked Ukraine's main inland port across the Danube River from Romania on Wednesday, sending global food prices higher as it ramps up its use of force to reimpose a blockade.

Russia Strikes Ukrainian Port That’s Been Lifeline for Shipping (New York Times) Moscow hit Izmail, one of the small ports on the Danube River that are the only outlets for exporting grain by sea since Russia pulled out of the Black Sea deal.

'Nowhere to hide': The question troubling Ukrainian troops amid a grinding counteroffensive (CNN) The four roads of Staromaiorske appear almost ground to dust in the drone footage. It’s a tiny village, but as the latest gain of Ukraine’s renewed counteroffensive in the direction of Mariupol, Staromaiorske’s symbolism far outweighs its size.

Arsonists Attack 12 Military Consciption Centers Across Russia In One Day (RadioFreeEurope/RadioLiberty) Twelve arson attacks or attempted arson attacks on military conscription centers were registered across Russia in the last 24 hours, media reports said on August 1.

China restricts civilian drone exports, citing Ukraine and concern about military use (AP News) China has imposed restrictions on exports of long-range civilian drones, citing Russia’s war on Ukraine and concern drones might be converted to military use.

China bans export of drones rated too risky to fly (Register) Some say retaliation for sanctions, but Beijing says it just wants world peace

US Army readies new artillery strategy spurred by war in Ukraine (Defense News) The US Army will deliver a strategy for conventional fires on the battlefield by the end of the year.

()

Putin Outlaws Anonymity: Identity Verification For Online Services, VPN Bypass Advice a Crime (TorrentFreak) Putin has signed new laws that will decimate online anonymity by denying access to online services pending state-approved user ID checks.

Cyberattack on Norway Ministries Lasted at Least Four Months (Bloomberg) A cyberattack on Norway’s government ministries uncovered last week had exploited a vulnerability linked to mobile device management and lasted at least four months, according to Norwegian and US cybersecurity agencies.

Space Pirates Turn Cyber Sabers on Russian, Serbian Organizations (Dark Reading) The attackers have expanded beyond backdoors and recently started using Deed RAT to step up their attacks.

Kazakhstan Refuses To Extradite Russian IT Expert To U.S., Russian Diplomat Says (RadioFreeEurope/RadioLiberty) An official at the Russian General Consulate in Kazakhstan’s largest city, Almaty, said on August 1 that Kazakh authorities have decided not to extradite Russian IT expert Nikita Kislitsin to the United States.

Russia Is Returning to Its Totalitarian Past (Foreign Policy) A forever war in Ukraine comes with almost limitless possibilities to stifle dissent.

Zelenskyy advisor: Defeat in Ukraine will spark collapse of Putin regime (Atlantic Council) Ukrainian presidential advisor Mykhailo Podolyak says the Wagner mutiny has exposed Russia's internal weakness and predicts battlefield defeats in Ukraine will spark the collapse of the Putin regime, writes Peter Dickinson.

Ukraine is finally freeing itself from centuries of Russian imperialism (Atlantic Council) Vladimir Putin hoped his full-scale invasion of Ukraine would mark the dawn of a new Russian Empire. Instead, it has strengthened Ukraine's resolve to free itself from centuries of Russian imperialism, writes Taras Kuzio.

Ukraine’s plan if Russia assassinates Zelenskyy (POLITICO) A Russian assassination would deprive Ukraine’s war effort of one of its most valuable assets.

For these young soldiers, Ukraine has been at war for half their lives (Washington Post) The young drone squad barged into the base camp near here, boots thumping across the floor where other Ukrainian soldiers slept, as smartphones sounded a 3 a.m. wake-up call.

Ukraine’s Male-Only Travel Ban Is Also a Women’s Issue (World Politics Review) Ukraine’s martial law restrictions include a travel ban on most men. A new report shows Ukrainian women are most keen to see it lifted.

Danube Ports, a Lifeline for Ukraine, Come Under Russian Threat (New York Times) Since the collapse of the Black Sea grain deal two weeks ago, small ports on the Danube River are the only shipping outlet for millions of tons of grain.

Did Russia commit a war crime in leaving the Ukraine grain deal? (Atlantic Council) Read how Russian officials’ actions in withdrawing and enforcing the withdrawal from the Black Sea Grain Initiative might constitute a war crime or crime against humanity under international criminal law.

Attacks, Threats, and Vulnerabilities

China's APT31 Suspected in Attacks on Air-Gapped Systems in Eastern Europe (The Hacker News) China-linked cyber threat group APT31 strikes again! Last year, they targeted Eastern European industrial organizations to steal data from air-gapped

CISA and International Partner NCSC-NO Release Joint Cybersecurity Advisory on Threat Actors Exploiting Ivanti EPMM Vulnerabilities (Cybersecurity and Infrastructure Security Agency CISA) CISA and NCSC-NO warn organizations of active exploitation of vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2023-35078 and CVE-2023-35081. Read our joint advisory for details on threat and how you can protect your organization.

CISA issues new warning on actively exploited Ivanti MobileIron bugs (BleepingComputer) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today of state hackers exploiting two flaws in Ivanti's Endpoint Manager Mobile (EPMM), formerly MobileIron Core, since April.

EyeSpy Proof-of-Concept (HYAS) HYAS Labs releases EyeSpy, a proof-of-concept that introduces an entirely new type of fully autonomous, AI-synthesized, polymorphic malware.

Emerging Attacker Exploit: Microsoft Cross-Tenant Synchronization by Arpan Sarkar (Vectra) Vectra Research recently discovered a method for leveraging functionality newly-released by Microsoft to perform lateral movement to another Microsoft tenant. Vectra Research recently discovered a method for leveraging functionality newly-released by Microsoft to perform lateral movement to another Microsoft tenant.

European Bank Customers Targeted in SpyNote Android Trojan Campaign (The Hacker News) European banks and customers are under attack! The SpyNote Android banking trojan is on the loose, executing aggressive campaigns through phishing.

Researchers claim US-registered cloud host facilitated state-backed cyberattacks (TechCrunch) Researchers say a Tehran-linked cloud host provides service to dozens of state-sponsored hacking groups and commercial spyware operators.

US internet hosting company appears to facilitate global cybercrime, researchers say (CyberScoop) Cloudzy, an internet hosting company with a New York phone number, may aiding hackers from Iran, Russia and North Korea.

New WikiLoader malware targets Italian organizations (Record) Researchers at Proofpoint say the WikiLoader downloader has been aimed at organizations in Italy, to spread Ursnif malware and other malicious code.

2023 Not (Cyber) Safe For Work Report (Agency | Executive Cybersecurity) Learn How Executives’ Personal Devices Are Leaving Businesses Open to Cyber Attack. Agency has conducted a nationwide survey of executives about their experiences using personal devices for work and how their digital lives affect their company’s cybersecurity.

Threat actors abuse Google AMP for evasive phishing attacks (BleepingComputer) Security researchers are warning of increased phishing activity that abuses Google Accelerated Mobile Pages (AMP) to bypass email security measures and get to inboxes of enterprise employees.

Cybercriminals train AI chatbots for phishing, malware attacks (BleepingComputer) In the wake of WormGPT, a ChatGPT clone trained on malware-focused data, a new generative artificial intelligence hacking tool called FraudGPT has emerged, and at least another one is under development that is allegedly based on Google's AI experiment, Bard.

'DarkBERT' GPT-Based Malware Trains Up on the Entire Dark Web (Dark Reading) The DarkBART and DarkBERT cybercriminal chatbots, based on Google Bard, represent a major leap ahead for adversarial AI, including Google Lens integration for images and instant access to the whole of the cyber-underground knowledge base.

Amazon employees leak secret info that marketplace sellers can buy on Telegram (CNBC) Third-party merchants who have been suspended by Amazon can pay for confidential data to potentially help them get their accounts back up and running.

Thousands of B.C. health-care workers’ information exposed in data breach (Global News) Health officials say hackers accessed a server hosting thousands of people's sensitive data from several programs operated by the Health Employers Association of B.C. this month.

Cyberattack on B.C. health employer websites may have taken personal information (CBC News) Cyberattack targeted three websites recruiting health professionals to B.C.: Health Match B.C., Locums for Rural B.C. and the B.C. Care Aide & Community Health Worker Registry.

A bankrupt crypto firm tried to return funds — but customer data might’ve been stolen instead (The Verge) Voyager Digital may have suffered a hack.

Security Patches, Mitigations, and Software Updates

CISA Releases One Industrial Control Systems Advisory (Cybersecurity and Infrastructure Security Agency CISA) CISA released one Industrial Control Systems (ICS) advisory on August 1, 2023. This advisory provides timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-213-01 APSystems Altenergy Power Control

Trends

Quantum Tech Will Transform National Security. It’s Testing U.S. Alliances Now. (New York Times) A global race to harness the power of atoms for navigation, computing and encryption is pitting concerns over protectionism against the spirit of cooperation.

BlackBerry Global Threat Intelligence Report — August 2023 Edition (BlackBerry) This report by the BlackBerry Threat Research and Intelligence team provides the latest actionable and contextualized cyber intelligence to increase cyber resilience.

2023 TotalCloud Security Insights (Qualys) Download the 2023 TotalCloud Security Insights to better understand your organization’s needs for cloud security.

6th State of CCPA and CPRA Data Privacy Compliance Report Shows Companies’ Slow Positive Movement toward Compliance (CYTRIO) Only 13% of non-compliant companies in Q1 2022 moved to manual compliance status by Q2 2023 despite stringent CPRA enforcement beginning on July 1, 2023 BOSTON — Aug. 2, 2023 — CYTRIO, a next-generation data privacy compliance company, released its 6th State of CCPA & CPRA Privacy Rights Compliance report to understand how well U.S. […]

Cado Security Labs 2023 Threat Findings Report (Cado Security) The cloud has become an integral part of modern business, but with its increased adoption comes an increased risk of cyber attacks and breaches. Cado experts continuously track emerging cloud trends and this report delves deep into the noteworthy discoveries unveiled during the past year. The report covers:

Cyber Workforce Benchmark Report (Immersive Labs) Thank you for downloading the Cyber Workforce Benchmark Report! Download

New Abnormal Research Shows Increase in Apps Integrated with Email (Abnormal) Average organization integrates 379 third-party applications into email environment, while social engineering attacks like BEC also continue to grow

Sonar’s New Powerful Deep-Analysis Capability Finds Hidden Code Level Security Issues (Sonar) New innovation discovers vulnerabilities created by the interaction of source code with third-party libraries

Marketplace

DataTribe Insights - Q2 2023: Every Cyber Maverick Will Have Their Very Own Cyber Goose (DataTribe) It was quite an interesting quarter as the gloom wasn't as gloomy as many feared, but headwinds and disruption continue to test business models and entrepreneurial agility. The economy showed signs of inflation cooling, continued strong labor markets, and other positive trends.

T-Rex Acquires Cyber Cloud Technologies (Washington Executive) T-Rex Solutions announced its acquisition of Cyber Cloud Technologies, an IT services firm that provides enterprise IT services to the federal government.

Billionaire CEO of military technology supplier Palantir advocates for AI weapons: 'We must not grow complacent' (Business Insider) Alex Karp, the billionaire CEO of Palantir, wrote a New York Times op-ed advocating for deeper integration between AI and military systems.

Coalition hires Kyle Bryant from Resilience as head of international (The Insurer) Coalition has hired cyber executive Kyle Bryant from rival insurtech MGA Resilience as its new head of international, as the Joshua Motta-led firm plots further inte...

Cybersecurity Expert Jason Keirstead Joins Cyware as Vice President of Collective Threat Defense (Business Wire) Cyware, the leading provider of threat intelligence management, security collaboration, and cyber fusion solutions, is pleased to welcome security expert and industry leader Jason Keirstead as its new Vice President of Collective Threat Defense.

Products, Services, and Solutions

Infosec products of the month: July 2023 (Help Net Security) The featured infosec products this month are from: BreachRx, Code42, ComplyAdvantage, Darktrace, Dig Security, Diligent, and more.

DroneShield Launches Area-Specific Satellite Denial Systems (ASX release via Motley Fool Australia) DroneShield Ltd (ASX:DRO) (DroneShield or the Company) is pleased to announce launch and initial order from a Defence customer for its target area-specific Satellite Denial Systems.

Xtract One Technologies Selected by U.S. Department of Veteran Affairs to Secure All Entrances at Richmond VA Medical Center (GlobeNewswire News Room) Xtract One’s SmartGateway Solution Seeks to Optimize Security and Efficiency for Select VA Hospitals...

SSH Communications Security and Beyond Identity Announce Partnership to Improve Endpoint and Session Control Security (GlobeNewswire News Room) Helsinki, Finland – August 2, 2023 – SSH Communications Security and Beyond Identity have partnered to significantly enhance the security of the new...

Veridas Facial Biometrics Receives LenelS2 Factory Certification under the LenelS2 OpenAccess Alliance Program • Veridas (Veridas) Veridas Facial Biometrics Access Control interfaces with LenelS2’s OnGuard access control security system

ReliaQuest Advances Cybersecurity Capabilities for Global Enterprises through partnership with Google Cloud (Business Wire) ReliaQuest, the force multiplier for security operations, today announced it is partnering with Google Cloud to enhance cybersecurity for global enterprises.

Torq Hyperautomation Platform Transforms SecOps  With Torq Socrates, the Generative AI Agent  Designed to Close 90% of Tier-1 Tickets Autonomously (Torq) Torq Socrates delivers automated contextual alert triaging, incident investigation, and response, enabling security staff to focus on urgent matters and mitigating burnout New York, NY, August 2, 2023—Torq today announced...

Tanium Selected by DHS CISA to Join the Joint Cyber Defense Collaborative (Business Wire) Converged Endpoint Management leader joins technology collective in fight against national cybersecurity threats

Traceable AI Introduces Revolutionary Digital Fraud Prevention (Business Wire) Advanced API Security Solution Pioneers an Adaptive Approach to Combat Digital Fraud and API Abuse

The first risk-ranking solution to meet OWASP standards for API security (Wib) Wib announce launch of its a high-definition API risk management module that enables organizations to manage API risks with greater certainty

Technologies, Techniques, and Standards

US military targets deepfakes, misinformation with AI-powered tool (C4ISRNet) Discerning fact from fiction is vital to military operations. The task is increasingly complex as bad information floods social media and other channels.

Design and Innovation

Hacking group plans system to encrypt social media and other apps (Washington Post) Cult of the Dead Cow is a hacker collective whose members at one time included Texas politician Beto O’Rourke

The Ugly Honesty of Elon Musk’s Twitter Rebrand (The Atlantic) The platform’s new logo seems a little juvenile. So does the internet.

Academia

Pearson Offers New AI Study Tools in Time for Back-to-School (Bloomberg) ChatGPT-style features will be added to Pearson+ and Mastering. New AI tools will not give students a ‘shortcut to an answer’.

Legislation, Policy, and Regulation

Senegal shuts off mobile internet after arrest of opposition leader (Record) The government of Senegal shut off mobile internet across the country on Monday following the arrest of opposition leader Ousmane Sonko.

UK intelligence agencies lobbying the government to weaken surveillance laws for AI, report (Computing) UK intelligence agencies, including GCHQ, MI5 and MI6, are seeking changes to surveillance laws that they feel restrict their ability to train AI models using extensive sets of personal data.

Australian Senate committee recommends government ban on TikTok be extended to WeChat (AP News) An Australian Senate committee has recommended a ban on the Chinese-owned video-sharing app TikTok from federal government devices be extended to China’s most popular social media platform, WeChat.

White House Cyber Workforce Strategy: No Quick Fix for Skills Shortage (Dark Reading) A lot of what the strategy proposes is well-intentioned but somewhat aspirational at the moment, industry experts say.

Cyber workforce strategy requires buy-in across sectors, experts say (Nextgov.com) The new strategy released this week looks to address longstanding challenges in the cyber workforce – but it will require extensive cooperation from the private sector and academia to be successful, experts told Nextgov/FCW.

Biden Cracks Down on the Spyware Scourge (Foreign Policy) But Europe and Israel have yet to take surveillance abuses seriously.

Materiality Definition Seen as Tough Task in New SEC Cyber Rules (Wall Street Journal) Companies must have clearly defined processes for evaluating the impact of a cyberattack.

Why the California Delete Act Matters (Dark Reading) Bill 362 is a perfect template for a nationwide win against data brokers and the privacy infringements they cause.

Coast Guard 2003 Cyber Protection Team establishes new command (United States Coast Guard News) The 2003 Cyber Protection Team (CPT) was established, Tuesday, at Coast Guard Island as the third CPT command and unit in an ceremony held by Coast Guard Cyber Command (CGCYBER). Vice

Litigation, Investigation, and Law Enforcement

Meta starts blocking news in Canada over law on paying publishers (Reuters) Meta Platforms has begun the process to end access to news on Facebook and Instagram for all users in Canada, it said on Tuesday, in response to law requiring internet giants to pay news publishers.

WSJ News Exclusive | Meta Offers to Seek Consent for Highly Personalized Ads in Europe (Wall Street Journal) Under pressure from privacy regulators, Meta Platforms has proposed asking all users in Europe to decide whether they would like to see ads targeted based on how they interact with its apps.

Data breach at Department of Education traced back to now-resigned employee - The Daily Independent at YourValley.net (The Daily Independent at YourValley.net) A data breach that allowed a parent to see information about other parents getting vouchers can be traced back to the actions of a now-resigned employee of the state Department of Education, according to a new report.

SolarWinds’ $26 Million Deal in Russian-Hack Suit Gets Final Nod (Bloomberg Law) SolarWinds Corp. will pay $26 million to settle an investor suit alleging it failed to disclose security vulnerabilities before a massive cyberattack, under an agreement given final approval by a federal court.

Lawsuit: ByteDance’s CapCut app secretly reaps massive amounts of user data (Record) CapCut, a sister app of TikTok, does not properly notify its users of its data practices and does not ask them for consent, according to a class action lawsuit filed under Illinois' BIPA law.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cyber Ireland National Conference 2023 - Galway (Galway, Ireland, Sep 27, 2023) This year’s theme is ‘Securing our resilient digital future’. It will examine what Ireland’s cyber security ecosystem, which contributes over €1 billion to the Irish economy annually, must do today to ensure a safe, democratic cyberspace in ten years’ time. The conference theme & topics have been selected from our members’ survey. This year’s theme is ‘Securing our resilient digital future’. It will examine what Ireland’s cyber security ecosystem must do today to ensure a safe, democratic cyberspace in ten years’ time. Conference topics selected by the members include: International Cyber Security and preventing future conflicts Cyber Threat Landscape 2030 AI and Cyber Security Cyber Workforce of the Future

ISACA Digital Trust World in Dublin (Dublin, Ireland, Oct 17 - 19, 2023) At ISACA Europe Conference 2023: Digital Trust World, you will expand your knowledge in the hottest IS/IT topics. You will also have the opportunity to connect and engage in lively discussions with industry leaders and fellow professionals. Plus, you can earn up to 26.25 CPE credits toward maintaining your certifications along with enjoying a variety of other conference benefits.

Cyber Ireland Cyber Security Summit 2023 - Dublin (Dublin, Ireland, Oct 19, 2023) The Cyber Security Summit 2023 will bring together thought leaders from across government, industry and academia to discuss cyber strategy and how to secure your organisation’s critical assets in an evolving cyber threat landscape where no organisation or individual is immune from attack particularly in these turbulent geo-political times. Equipping yourself and your business with the correct cybersecurity knowledge and tools has never been more important.

Cybersecurity & Ransomware Live! – Part of Live! 360 (Orlando, Florida, USA, Nov 12 - 17, 2023) Are you ready to fortify your organization's cybersecurity and protect it from the ever-evolving threats of the digital world? If so, join us for Cybersecurity & Ransomware Live! (Part of Live! 360) taking place this November 12-17 at the Royal Pacific Resort, Universal Orlando. You will embark on an immersive journey into the world of cybersecurity and learn invaluable strategies to safeguard your digital assets.

itag Cyber Research Conference Ireland (Letterkenny, Ireland, Nov 24, 2023) itag’s Cyber Research Conference Ireland (CRCI) acts as a meeting point where researchers from academia, industry, research groups/centres, companies and public authorities working in the field of cybersecurity and related areas can exchange knowledge and experience with the shared goal of strengthening research in the field across the island of Ireland.

Events

2023 International Cybersecurity Championship and Conference (IC3) (San Diego, California, USA, Aug 1 - 4, 2023) The International Cybersecurity Championship and Conference (IC3) event is designed to attract top talent and raise global awareness of the power of games to upskill the cybersecurity industry. Through its exciting, competition-based forum, the IC3 helps individuals...

Insider Threat Program Development / Management - Insider Threat Detection & Data Analysis Training Course (NASA Kennedy Space Center, Florida, USA, Aug 3 - 4, 2023) The training course will be taught at the NASA Kennedy Space Center in Florida on August 3-4, 2023. This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CIO / IT Network Security, CISO, Human Resources, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. This training will also provide students with an in depth view of how to obtain visibility of potential or malicious employee actions on computer systems and networks, using Insider Threat Detection software. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

Black Hat USA (Las Vegas, Nevada, USA, Aug 5 - 10, 2023) Founded in 1997, Black Hat is an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Grown from a single annual conference to the most respected information security event series internationally, these multi-day events provide the security community with the latest cutting-edge research, developments, and trends.

Hacker Summer Camp 2023 (Las Vegas, Nevada, USA, Aug 5 - 16, 2023) Meet us at Hacker Summer Camp 2023, which is just around the corner, as we are excited to announce our partnerships with Black Hat and Defcon there! Join us from 5th-16th August 2023 at Summer Camp. Drop us a line to arrange a private meeting with our tech & sales teams. Please see below our schedule for the Summer Camp 2023.

Girls Hack Village presents SquadCon (Las Vegas, Nevada, USA, Aug 10 - 12, 2023) Girls Hack Village presents SquadCon is a three-day conference that seeks to bring gender diverse perspectives of the contributions, experiences, and issues facing the industry's other. Hackers that are new or from underrepresented communities may not often feel comfortable in existing conferences. SquadCon is a forum for conversations about topics that impact girls, women, and LGBTQ+ individuals, including mental health and all the factors that shape the experiences of marginalized groups in the industry. SquadCon is a cybersecurity conference that will include talks, labs, workshops, discussions, CTFs and panels to move towards our mission of improving diversity in ethical hacking. SquadCon is an independent conference event in Las Vegas during Hacker Summer Camp scheduled for August 10-12th. It is run by the makers of Girls Hack Village and exists to help foster diversity and inclusion in cybersecurity.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.