China penetrated classified Japanese networks in 2020. State of MOVEit exploitation. Ransomware notes. Shadow access. Cyber phase of the hybrid war.

Summary

By the CyberWire staff

At a glance.

2020 Chinese penetration of Japan's defense networks reported.
MOVEit-connected supply chain issues aren't over.
Akamai looks at the current state of ransomware.
Mallox ransomware continues its evolution.
Machine identities and shadow access.
Ukrainian hacktivist auxiliaries hit Russian websites.
Unidentified threat group deploys an open-source RAT against Ukrainian government sites.
Radiation sensor reports from Chernobyl may have been manipulated.

2020 Chinese penetration of Japan's defense networks reported.

The Washington Post reports, on the basis of recently obtained information from US and Japanese sources, that in the fall of 2020 the US NSA discovered a major Chinese penetration of classified Japanese defense networks. "The hackers had deep, persistent access and appeared to be after anything they could get their hands on — plans, capabilities, assessments of military shortcomings, according to three former senior U.S. officials, who were among a dozen current and former U.S. and Japanese officials interviewed, who spoke on the condition of anonymity because of the matter’s sensitivity." Reuters says that Japan was unable or unwilling to confirm whether information had been compromised. The incident complicated US-Japanese defense cooperation, especially intelligence-sharing, which has grown closer as China adopts an increasingly assertive policy in East Asia.

Protect Your Business’s Valuable IT Assets With Risk Quantification.

Get ready for the SEC's new Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure mandate. The "Scaling ITRM: The Promise and Challenges of Risk Quantification” ebook explores the existing barriers to risk quantification and the myths surrounding them. It also explains why every moment without risk quantification is a missed opportunity to safeguard your organization's future — and highlights steps InfoSec professionals can take to get started.

MOVEit-connected supply chain issues aren't over.

Reuters puts the tally of organizations breached in ways traceable to MOVEit vulnerability exploitation at six-hundred and counting, and cites experts who say that many more breaches, possibly thousands more, are likely in the future. The Cl0p gang began exploiting Progress Software's MOVEit on May 27th. Progress realized something was amiss and began investigating on May 28th. On May 30th it had learned enough to issue a warning, and on May 31st Progress made a patch available. That exploitation continues illustrates the complexity and interdependence of software supply chains, and of the difficulty of getting users to patch promptly and effectively.

The Journey to a Secure Software Supply Chain - Get the Free eBook.

These days, everyone is at risk of a software supply chain attack. Now is the time for Dev and Security to work together to keep your pipelines secure. In this eBook, discover how to go from Complete Anarchy to Nirvana in 5 stages, eliminate implicit trust in open source components and implement scalable processes to verify their origins. Download the free eBook and get informed guidance to help on your software supply chain security journey!

Akamai looks at the current state of ransomware.

Akamai has published a report looking at the ransomware landscape in 2023. The researchers found that the “rampant abuse of zero-day and one-day vulnerabilities in the past six months led to a 143% increase in victims when comparing Q1 2022 with Q1 2023.” Akamai also notes, “Ransomware groups now increasingly target the exfiltration of files, which has become the primary source of extortion, as seen with the recent exploitation of GoAnywhere and MOVEit. This underscores the fact that file backup solutions, though effective against file encryption, are no longer a sufficient strategy.”

The future of security is identity and with CyberArk, the future of identity is secure.

With 84% of organizations experiencing an identity-related breach, identity is the new battlefield. As the pioneers of privileged access management, we started by protecting the most privileged users and most critical data. With intelligent privilege controls, today we’re applying the same levels of security and protection to every identity – both human and machine. CyberArk offers the most advanced identity security platform in the world, surrounding every identity with a powerful force field of continuous protection.

Mallox ransomware continues its evolution.

Trend Micro warns that the TargetCompany ransomware (also known as “Mallox”) is using the fully undetectable (FUD) obfuscator engine BatCloak. The threat actors use vulnerable SQL servers to deliver the Remcos RAT, which is then used to deploy TargetCompany: “Since the initial efforts were terminated and blocked by the existing solutions, the attackers opted to use the FUD-wrapped version of their binaries. The FUD packer used by Remcos and the one used by the TargetCompany ransomware has a style of packaging that closely resembles the style used by BatCloak: Using a batch file as an outer layer and afterward, decoding and loading using PowerShell to make a LOLBins execution.”

Machine identities and shadow access.

Stack Identity has published a report looking at identity and access management (IAM) trends, finding that “Shadow Access, the invisible and unmonitored identity and access, increases the risk of breaches, malware, ransomware, and data theft that current IAM tools are not built to mitigate.”

The proliferation of shadow access is caused by two factors: “First, visibility to who is accessing your data and who has access to data is scattered across Cloud IAM, Cloud IDP, Infrastructure as Code, data stores, and HR systems. Second, visibility to who is authorized to access your data is scattered across ticketing systems, emails, spreadsheets, and screenshots.”

The report also found that only 4% of identities in enterprise cloud environments are human, while the rest are non-human identities.

Ukrainian hacktivist auxiliaries hit Russian websites.

Radio Free Europe | Radio Liberty reports that a Ukrainian hacktivist group calling itself "sudo RM-RF" claimed in its Telegram channel to have compromised the site of MosgorBTI, Moscow's property registration bureau. sudo RM-RF has been heard from before, surfacing in reports of a cyberattack against the Skolkovo Foundation in 2022. The group said that its goal was collection, specifically "information about state officials, politicians, military, and special services officers who support the Ukraine war." That information, sudo RM-RF said, "had been handed to Ukraine's defense forces." They also claimed to have destroyed data and "infrastructure." Their claims were made not only in Telegram, but on the MosgorBTI website sudo RM-RF defaced. (Some reports called the compromised site an "engineering service website," probably because the data MosgorBTI holds includes building plans and technical diagrams.)

Unidentified threat group deploys an open-source RAT against Ukrainian government sites.

UAC-0154, a threat group whose provenance and allegiance is unclear, the Record reports, has used the open source tool MerlinAgent as the phish hook in a campaign against Ukrainian government sites. MerlinAgent is a post-exploit command-and-control tool, that is, a remote-access Trojan (RAT), intended for use in legitimate research and testing, but like many such products, it's a dual-use item. CERT-UA says that the typical phishbait in the current campaign has been a document named "INTERNAL CYBER THREAT.chm." The sender misrepresents itself as acting on behalf of CERT-UA, and uses the email address cert-ua@ukr [dot] net. The campaign seems to be cyberespionage, but attribution is unclear. MerlinAgent is widely available, and the threat actor, UAC-0154, hasn't been clearly associated with any government.

Radiation sensor reports from Chernobyl may have been manipulated.

Citing research by Ruben Santamarta, scheduled to be presented in full at Black Hat this Thursday, WIRED reports that radiation sensor data from the Chernobyl exclusion area may have been manipulated during the Russian Army's brief occupation of Chernobyl during February and March of 2022. The sensors showed troubling but inexplicable spikes in radiation levels. Those reports appear to have been bogus, the data possibly manipulated by a cyberattack. The published abstract of Santamarta's talk says, "Evidence confirms that the radiation levels depicted by a very specific set of real-time radiation maps, which during those days were consulted by millions of people and also consumed as a single source of information by media outlets and official entities, did not correspond to the actual physical conditions of the Chernobyl Exclusion Zone." If the data were indeed manipulated in a cyberattack, that's troubling: corruption of sensor data in industrial systems would represent a major safety issue for many sectors, and for the public at large.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+530: Both sides in the war look for internal threats. (CyberWire) A missile and artillery war continues across a slowly changing front. Ukrainian hacktivist auxiliaries hit a Moscow bureau. An open-source RAT is deployed against Ukrainian government agencies by unknown actors. And sensor data from Chernobyl appears to have been manipulated, possibly in a cyber operation, last year.

Russia-Ukraine war: List of key events, day 531 (Al Jazeera) Here is the situation on Tuesday, August 8, 2023.

Belarus begins military drills near its border with Poland and Lithuania as tensions heighten (AP News) Belarus has begun military exercises near its border with Poland and Lithuania. The drills Monday come with tensions already heightened with the two NATO members over the influx of Russia-linked Wagner mercenaries into Belarus after their short-lived mutiny in Russia.

Chilling footage shows aftermath of 'double-tap' Russian missile strike that killed eight (The Telegraph) Nineteen police officers and a child are among the dozens of civilians wounded

Ukraine is finally attacking Putin’s weakest spot. It could break him (The Telegraph) The greater strategic prize for Kyiv could well be found in the war at sea

‘It’s Not a Sprint,’ Ukraine’s Marines Insist. ‘It’s a Marathon.’ (New York Times) Journalists from The Times spent two weeks with troops from brigades trained and supplied by NATO to get their take on how, and where, the counteroffensive is going.

Ukrainian commander admits 'a lot' of men lost early in counter-offensive (The Telegraph) Heavy Ukrainian losses have sparked public criticism of Kyiv’s military leadership

Zelenskiy's Chief Of Staff Says Ukraine's Peace Proposal Only One Discussed At Saudi Talks (RadioFreeEurope/RadioLiberty) Ukrainian President Volodymyr Zelenskiy’s chief of staff said on August 7 that talks over the weekend in Saudi Arabia discussed no other peace initiative than the one put forth by Ukraine and that the participants agreed to hold another meeting within about six weeks.

China’s support for Putin may be fading (The Telegraph) If Beijing thinks its interests can be advanced by forcing Russia to the negotiating table on Kyiv’s terms, Russia may run into difficulties

It’s almost 18 months since Russia invaded Ukraine, and peace seems no closer | Rajan Menon (the Guardian) Both countries still believe they can prevail, and that belief is more powerful than any evidence suggesting that neither side can truly win

A look at the amount of U.S. spending powering Ukraine’s defense (Washington Post) The United States is the biggest financial supporter of Kyiv’s fight against Russia.

Putin has debased and exiled Russia’s own geniuses (The Telegraph) Technical brains are being devoted to death and destruction

Putin’s Age of Chaos (Foreign Affairs) The dangers of Russian disorder.

The Georgian Fighters Who Went To Ukraine To Finish Their Own War (RadioFreeEurope/RadioLiberty) Fifteen years since the start of the 2008 war between Georgia and Russia, many Georgian soldiers are fighting in Ukraine against Russian forces. For many of them -- and for those who lost their lives -- Russia's invasion is part of their own "unfinished battle."

‘Ruzzki not welcome’: the Russian exiles getting a hostile reception in Georgia (the Guardian) The long read: After the invasion of Ukraine, thousands of Russians fled to Tbilisi. But the graffiti that has sprung up across the city suggests not everyone is pleased to see them

Ukraine-Linked Group Claims It Hacked Website Of Moscow Property Registration Bureau (RadioFreeEurope/RadioLiberty) A Ukraine-linked hacker group said on Telegram on August 7 that it had hacked the website of Moscow's municipal property registration bureau (MosgorBTI) overnight.

Ukraine-linked group claims it hacked Moscow property registration bureau website – RFE/RL (Euromaidan Press) On August 7th, a hacker group associated with Ukraine claimed it had breached the website of Moscow’s municipal property registration bureau, which contained data about real estate and its owners in Moscow and the Moscow Oblast, according to RFE/RL.

Pro-Ukrainian hackers breach Moscow engineering service website (New Voice of Ukraine) A group of pro-Ukrainian hackers has compromised the website of the Moscow Technical Inventory Bureau, transferring some of the retrieved information to the Ukrainian Armed Forces and making a portion of the database public, RFE/RL reported on Aug. 7.

Ukrainian state agencies targeted with open-source malware MerlinAgent (Record) Hackers targeted Ukrainian government agencies with a phishing campaign using an open-source program called MerlinAgent, according to the latest research.

The Mystery of Chernobyl’s Post-Invasion Radiation Spikes (WIRED) Soon after Russian troops invaded Ukraine in February 2022, sensors in the Chernobyl Exclusion Zone reported radiation spikes. A researcher now believes he’s found evidence the data was manipulated.

Why dozens of Russian enterprises are bankrupt, or heading that way (Defense News) Years worth of sanctions have partly contributed to the current state of Russia’s defense-industrial base, but there's more to it than that.

How U.S. microchips are fueling Russia's military — despite sanctions (CNBC) Moscow is sourcing a growing number of advanced microchips from the West through intermediary countries such as China, analysis by CNBC shows.

Woman arrested in plot to kill Ukrainian President Volodymyr Zelensky (Washington Post) Ukrainian security officials said Wednesday that they had arrested a Ukrainian woman “red-handed” on suspicion of helping Russian intelligence services, including preparations for an assassination attempt on President Volodymyr Zelensky last month.

Ukraine's SBU Detained Woman Who Allegedly Gathered Info Ahead Of Zelenskiy Trip (RadioFreeEurope/RadioLiberty) Ukraine's security service (SBU) says it has detained an alleged Russian informant who was allegedly gathering intelligence on the eve of a working trip by President Volodymyr Zelenskiy to the Mykolayiv region.

Russian Writer Sentenced In Absentia For Anti-War Statements (RadioFreeEurope/RadioLiberty) A court in Moscow on August 7 sentenced writer Dmitry Glukhovsky to eight years in prison on a charge of discrediting the Russian military in his online posts condemning Moscow's unprovoked invasion of Ukraine.

Justice Department Helping Kyiv In War Crimes Probes, U.S. Attorney General Says (RadioFreeEurope/RadioLiberty) The U.S. Justice Department is cooperating with the International Criminal Court and supporting Ukrainian prosecutors carrying out war crime investigations, Attorney General Merrick Garland said on August 7.

Attacks, Threats, and Vulnerabilities

China hacked Japan’s sensitive defense networks, officials say (Washington Post) Tokyo has strengthened its defenses after a major cybersecurity breach, but gaps remain that could slow information-sharing with the Pentagon

Japan says cannot confirm leakage after report says China hacked defence networks (Reuters) Japan cannot confirm if any security information has been leaked, the top government spokesperson said on Tuesday when asked about a Washington Post report on Chinese hacking into its defence cyber networks.

MOVEit hack spawned around 600 breaches but isn't done yet - cyber analysts (Reuters) A hydra-headed breach centered on a single American software maker has compromised data at about 600 organizations worldwide, according to cyber analyst tallies corroborated by Reuters.

Sophos Uncovers New Connections Between Hive, Royal, and Black Basta Ransomware (GlobeNewswire News Room) Recent Attacks Suggest the Three Ransomware Groups Are Sharing Playbooks or Affiliates...

Report: New ransomware gang emerges in Vietnam (CyberScoop) Researchers discovered a new ransomware gang that appears to be in the early stages of their extortion campaigns.

Mallox Ransomware Group Revamps Malware Variants, Evasion Tactics (Dark Reading) The group continues to target SQL servers, adding the Remcos RAT, BatCloak, and Metasploit in an attack that shows advance obfuscation methods.

TargetCompany Ransomware Abuses FUD Obfuscator Packers (Trend Micro) In this entry, we detail our analysis of how the TargetCompany ransomware abused an iteration of fully undetectable (FUD) obfuscator engine BatCloak to infect vulnerable systems.

Ransomware on the Move: Evolving Exploitation Techniques and the Active Pursuit of Zero-Days (Akamai) New State of the Internet report examines the ransomware landscape, which demonstrates a concerning shift in tactics to maximize their damage to enterprises.

Clustering attacker behavior reveals hidden patterns (Sophos News) A series of ransomware attacks made by different groups share curiously similar characteristics

Aqua Nautilus Researchers Find Kubernetes Clusters Under Attack in Hundreds of Organizations (GlobeNewswire News Room) Malware and backdoors used in attacks affecting many Fortune 500 companies...

Visualizing Qakbot Infrastructure Part II: Uncharted Territory (Team Cymru) A Data-Driven Approach Based on Analysis of Network Telemetry In this blog post, we will provide an update on our high-level analysis of QakBot infrastructure, following on from our previous blog post. We will pick up the timeline from where we left it, basing our findings on data collected between 1 May and 20 July 2023. We have continued to focus on elements and trends for which we do not observe in regular commentary; specifically the relationship between victim-facing command and control (C2

Six New Vulnerabilities Affect Axis Camera Software (Nozomi Networks) Newly discovered vulnerabilities affect the License Plate Verifier application on Axis Communications cameras.

Government watchdog finds U.S. embassies running software vulnerable to attacks (POLITICO Pro) The findings comes amid recent revelations that Chinese hackers breached State Department email accounts.

Indiana University Health Reports Data Breach Stemming from Incident at TMG Health (JD Supra) On August 4, 2023, Indiana University Health (“IU Health”) posted a notice on its website announcing a data breach that occurred as a result of a...

All versions of Ivanti product affected by vulnerability used in Norway gov’t attack (Record) IT giant Ivanti said on Monday that several recently-discovered vulnerabilities affect all versions of their Endpoint Manager Mobile (EPMM) tool.

None of the constant cyberattacks on Mississippi’s election system have gotten in, Watson says (WAPT) Mississippi polls are open 7 a.m. to 7 p.m. for Tuesday's primary election.

CISA Adds One Known Exploited Vulnerability to Catalog (Cybersecurity and Infrastructure Security Agency CISA) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2017-18368 Zyxel P660HN-T1A Routers Command Injection Vulnerability

Vulnerability Summary for the Week of July 31, 2023 | CISA (Cybersecurity and Infrastructure Security Agency CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Security Patches, Mitigations, and Software Updates

Microsoft hits back at Tenable’s criticism of its infosec (Register) 'Not all fixes are equal,' argues Redmond, and this one for the Power Platform didn't need to be rushed

Trends

75% of Organizations Worldwide Set to Ban ChatGPT and Generative AI Apps on Work Devices (PR Newswire) BlackBerry Limited (NYSE: BB; TSX: BB) today released new research revealing that 75% of organizations worldwide are currently implementing or...

BlackBerry Global Threat Intelligence Report — August 2023 Edition (BlackBerry) This report by the BlackBerry Threat Research and Intelligence team provides the latest actionable and contextualized cyber intelligence to increase cyber resilience.

New IAM Research by Stack Identity Finds Machine Identities Dominate Shadow Access in the Cloud, Revealing Easy Attack Vector for Hackers (Business Wire) Identity and Access trend report data highlights different types of Shadow Access; provides best practices on how to reduce cloud breaches and data exfiltration

'Sudden surge' in cyberattacks on government: report (Defense One) Blackberry's quarterly threat report said attacks on government agencies and the public sector rose 40% since last year.

Hospitals' risk of data breach doubles just before, after a merger deal, research shows (Fierce Healthcare) Between 2010 and 2022, U.S. hospitals on either side of a merger deal were twice as likely to report a data breach in the year before and after close, according to a recent analysis of government and proprietary data.

Marketplace

Rubrik Acquires DSPM Leader Laminar to Accelerate Cloud Data Security (GlobeNewswire News Room) Will unify data security posture across enterprise, cloud, and SaaS to deliver cyber resilienceAnnounces intent to open new research and development...

Horizon3.ai Raises $40M Series C to Confront Attackers with Proactive, Continuous Security Testing (Business Wire) The company behind pentesting solution NodeZero, Horizon3.ai now scaling R&D to deliver unmatched, enterprise-wide security platform

Theta buys Tauranga-based security consultancy Cybersmart (Reseller News) New Zealand-owned and operated technology solutions provider Theta has bought Cybersmart, a Tauranga-based cyber security consultancy.

CISO Global Receives $49 Million Valuation for Argo Edge Cloud Security Platform (CISO Global) AI-Powered Security Solution Enhances Cybersecurity Effectiveness Through Coordination, Integration and Automation Scottsdale, Ariz. August 3, 2023 – CISO Global (NASDAQ: CISO), an industry leader as a managed cybersecurity and compliance provider, has strengthened its security management platform Argo to increase the effectiveness of security teams who now can access real-time data across tool sets to […]

Egyptian cybersecurity startup Buguard raises $500,000 Seed (Bendada.com) Buguard has raised a $500,000 Seed to offer offensive security against dark web cyber attacks to its client across the world. The round was led by A15.

Coro Named to Prestigious MES Midmarket 100 - Coro Cybersecurity (Coro Cybersecurity) Coro, the modern cybersecurity platform for mid-market organizations, announced today that Midsize Enterprise

ESET named among the overall leaders in Managed Detection and Response (ACE Times) In the latest KuppingerCole Leadership Compass

Rubrik Ranks #9 on the 2023 Forbes Cloud 100 List (GlobeNewswire News Room) This Marks the Seventh Consecutive Year of Rubrik being Named to List of World’s Top Private Cloud Companies...

Arctic Wolf Named to the 2023 Forbes Cloud 100 (GlobeNewswire News Room) Cybersecurity leader climbs to coveted spot amidst continued global expansion and delivery of security operations worldwide...

Lantronix Appoints Philip Brace to Its Board of Directors (GlobeNewswire News Room) Lantronix Inc. (the “Company”) (NASDAQ: LTRX), a global provider of secure turnkey solutions for the...

Cohesity Appoints Eric Brown as Chief Financial Officer and Srinivasan Murari as Chief Development Officer (Business Wire) Leadership Additions to Fuel Next Stage of Growth and Public Company Readiness, as Company Executes Plan Towards Reaching Positive Quarterly Cash Flow in Fiscal Year 2024

Former FBI Assistant Director in Charge and Cybersecurity Expert Michael J. Driscoll Joins FTI Consulting (GlobeNewswire News Room) FTI Consulting, Inc. (NYSE: FCN) today announced the appointment of Michael J. Driscoll as a Senior...

Phosphorus Cybersecurity Appoints Sonu Shankar to Chief Strategy Officer (GlobeNewswire News Room) Phosphorus, the leading provider of unified security management and breach prevention for the xTended...

Products, Services, and Solutions

NetSPI Debuts ML/AI Pentesting (NetSPI) Read about NetSPI’s new ML/AI Penetration Testing solution and learn how partnering with the leader in offensive security can help you build more secure and robust models.

SecurityScorecard Launches Managed Cyber Risk Services to Mitigate Zero-Day and Critical Supply Chain Vulnerabilities (Business Wire) Cybersecurity experts operationalize third- and fourth-party cyber risk management, drive action with security ratings, and mitigate global supply chain risk

KnowBe4's New PhishER Plus Uses Crowdsourced Human Intelligence and AI to Help Thwart Phishing Attacks (KnowBe4) KnowBe4's New PhishER Plus Uses Crowdsourced Human Intelligence and AI to Help Thwart Phishing Attacks

AttackIQ Expands Security Testing with SMB-Centric Solutions (MSSP Alert) AttackIQ has introduced AttackIQ Flex and AttackIQ Ready! to go along with its Attack IQ Enterprise offering.

ThreatConnect empowers security teams to operationalize intelligence requirements (Help Net Security) Intelligence Requirement capability strengthens ThreatConnect's TI Ops Platform by allowing users to manag their intelligence requirements.

Fasoo Announces Fasoo Edrm For Source Code Security To Protect Source Codes Throughout Development Lifecycle (MENAFN) Fasoo - a leader in data-centric security This enhanced capability allows customers to protect their source code persistently from extern

Vectra AI Introduces the Industry’s First AI-Driven, Fully Integrated Hybrid Attack Detection and Response Platform with Real-Time Attack Signal Intelligence (GlobeNewswire News Room) Vectra AI Platform arms security operations centers (SOC) with the integrated signal to deliver extended detection and response (XDR) for hybrid attacks at...

Media Alert: Sophos X-Ops Showcases Managed Detection and Response (MDR) and Threat Intelligence at Black Hat and DEF CON (GlobeNewswire News Room) Sophos, a global leader in innovating and delivering cybersecurity as a service, today announced that Sophos...

Three New Solutions from Black Kite Automate Compliance of Third-Party Cyber Assessments with Industry's First Cyber-Aware AI Engine (GlobeNewswire News Room) New capabilities transform third-party compliance assessments with automation, saving companies days’ worth of manual effort...

Leading Government Defense Ministry Triples Scale of BIO-key Biometric Deployment (GlobeNewswire News Room) BIO-key Establishes Three-year Purchasing Agreement...

Silobreaker Introduces Innovative Risk Scoring Features to Help Threat Intel Teams Assess and Prioritise Threats Faster (Business Wire) Silobreaker, a leading security and threat intelligence technology company, today announced innovative new risk scoring capabilities to help threat intel teams better understand, categorise and prioritise the cybersecurity risks facing their organisations.

Hunters Enters a Strategic Partnership with Kudelski Security to revolutionize Security Operations (PR Newswire) To help companies strengthen their cyber resilience and revolutionize their security operations, Hunters and Kudelski Security have entered a...

DirectDefense Offers to Protect Businesses from Ransomware for 60 Days Free of Charge (Business Wire) Via its strategic partnership with Halcyon, DirectDefense will manage proven tools to stop ransomware in its tracks

Code42 Enhances Source Code Exfiltration Detection (Business Wire) Provides full visibility & prevents critical business intellectual property from leaving the organization

Barracuda partners with Cork to offer cyber warranty created exclusively for customers of MSPs (PR Newswire) Barracuda Networks, Inc., a leading provider of cloud-first security solutions, today announced that it is teaming with Cork, the purpose-built...

Cymulate Pushes New Boundaries for a Threat-Informed Defense for Cloud (Business Wire) Critical capabilities for cloud address challenges faced by security teams looking to validate container and identity and access management controls

AttackIQ Flex Gains Over 10,000 New Users Within Days of Launch (AttackIQ) Flex launch highlights significant momentum for the new agentless test as-a-service solution that enables anyone in an organization to intuitively implement security control validation.

Panorays Introduces New Smart Match AI Capability, Reducing Questionnaire Response Time and Accelerating Vendor Evaluations (GlobeNewswire News Room) New feature complements company’s groundbreaking AI-powered Third-Party Security Risk Platform...

eSentire's New MDR Agent Brings Unmatched Cybersecurity Value to Small and Medium Businesses (eSentire) eSentire, Inc., the Authority in Managed Detection and Response (MDR), today announced the expansion of its proprietary software and services portfolio with the introduction of its new MDR Agent.

Synopsys Partners with NowSecure and Secure Code Warrior to Expand Industry-Leading Application Security Testing Solutions Portfolio (PR Newswire) Synopsys, Inc. (Nasdaq: SNPS) today announced the details around two new collaboration agreements with NowSecure, recognized experts in mobile...

ThreatX Extends API Protection With Sensitive Data Detection and Visualizations (Business Wire) New capabilities enable security teams to detect and boost protection of high-risk APIs containing sensitive user and authentication data; support PCI DSS, GDPR requirements

Technologies, Techniques, and Standards

New CLTC White Paper: A Template for Voluntary Corporate Reporting on Data Governance, Cybersecurity, and AI - CLTC UC Berkeley Center for Long-Term Cybersecurity (CLTC) Corporations are increasingly called upon to disclose their practices around technology, including how they manage data, cybersecurity, and artificial intelligence. Yet no clear standard prescribes what such reporting…

Selling Software to the US Government? Know Security Attestation First (Dark Reading) Challenging new safety requirements are needed to improve security and work toward a more secure future.

SEC controversial cybersecurity disclosure warning: What enterprises need to do now (VentureBeat) What does the SEC cybersecurity warning really mean? And how can public companies prepare? Experts respond, offer critical insights.

The evolution of security analyst experience (Security Intelligence) Today's security analysts are overworked and overwhelmed. The solution lies in breaking down siloed security to embrace a unified security environment.

Cyberspace reservists lead New Mexico Innovative Readiness Training (DVIDS) A team of Air Force Reserve Command (AFRC) cyberspace Airmen, chiefly comprised of members of the 960th Cyberspace Wing, AFRC’s premier cyberspace wing, were joined by Air Force Active Duty, New Mexico Air National Guardsmen (NMANG), Space Force Active-Duty members, and Marine Reservists to execute the 2023 New Mexico Innovative Readiness Training (IRT) event in support of Central New Mexico (CNM) Community College, Luna Community College (LCC), and the Indian Pueblo Cultural Center (IPCC) from July 10-21, 2023 across select college locations.

Legislation, Policy, and Regulation

China's plan to rule the world through its smart devices, FCC urged to act (Newsweek) Chinese-made modules in various devices could be quietly gathering data for their creators in Beijing, and lawmakers want the FCC to act.

DHS grants $375 million to state and local government cyber-resilience efforts (Record) The Department of Homeland Security (DHS) will pump nearly $375 million into state and local government coffers in a bid to increase cyber resilience in a sector that has been pummeled by ransomware attacks in recent months.

DHS grants $375 million to boost state and local government cyber resilience (Cybenews) The US Department of Homeland Security has announced that it will inject around $375 million into state and local government coffers in order to increase cyber resilience. The sector has been pummeled by ransomware attacks in recent months.

States try to control flood of AI tech (Arkansas Online) As state lawmakers rush to get a handle on fast-evolving artificial intelligence technology, they're often focusing first on their own state governments before imposing restrictions on the private sector.

CISA Executive Assistant Director for Cybersecurity Eric Goldstein Discusses Cybersecurity Strategic Plan for 2024-2026 (Executive Gov) Looking for the latest Government Contracting News? Read about CISA Executive Assistant Director for Cybersecurity Eric Goldstein Discusses Cybersecurity

White House Launches New Efforts to Strengthen K-12 Cyber (MeriTalk) Faced with increasing cyberattacks on K-12 schools, the Biden-Harris administration today unveiled several government actions to help bolster their cyber defenses, along with numerous commitments from private-sector organizations that aim for the same result.

White House Wants to Bolster School District Cybersecurity (Decipher) According to the White House, in last year’s academic year at least eight K-12 school districts in the U.S. were impacted by significant cyberattacks, and four of those caused schools to cancel classes or close completely.

Biden administration owns cyber-workforce crisis (American Thinker) Although the current administration has always attempted to put a good face on their efforts to combat the nation's ongoing cyber-crisis, like trotting out First Lady Dr. Jill Biden this week to kick off the White House's back-to-school cyber-safety summit, the truth is, cyber-security has been another key issue where America has lagged under the stewardship of President Joe Biden.

[Analysis] Saving the news from Big Tech (EUobserver) Big Tech steals money from media, not content. Moving towards policy that addresses this fact can be one way to support the struggling news industry, shifting value to the press. Also, take on the apps.

Preparing for the tricky task of regulating online safety (Computing) Computing is the leading information resource for UK technology decision makers, providing the latest market news and hard-hitting opinion.

Litigation, Investigation, and Law Enforcement

Breached the GDPR? Calculate your own fine! (cyber/data/privacy insights) The General Data Protection Regulation (GDPR) is a difficult piece of legislation to comply with, and not meeting some of its requirements may lead to hefty fines of up to 4% of global annual revenues of the preceding year or 20 million euros, whichever is highest. Organisations may find it difficul

Ex-FBI agent accused of working for Russian oligarch may change plea (Reuters) A former FBI agent accused by U.S. prosecutors of working for sanctioned Russian oligarch Oleg Deripaska may change his plea in relation to criminal charges of evading U.S. sanctions and money laundering, court records showed on Monday.

Ex-FBI counterintelligence chief in talks to plead guilty over work he did for Russian oligarch (CNN) The former head of counterintelligence at the FBI’s New York office is in talks to plead guilty to charges relating to work he allegedly did for a sanctioned Russian oligarch after leaving the government, according to a court order.

FBI official who worked Trump-Russia probe, later accused of conspiring with Russia to plead guilty (The Washington Times) An ex-FBI official who was part of the bureau’s Trump-Russian collusion probe into former President Donald Trump’s campaign will plead guilty to charges of colluding with Russia himself, a federal judge suggested on Monday.

Innocent pregnant woman jailed amid faulty facial recognition trend (Ars Technica) US police departments continue to use the tech despite low accuracy and obvious mismatches.

'This isn't some random dude with a duffel bag': To catch fentanyl traffickers, feds dig into crypto markets | CNN Politics (CNN) The Biden administration has intensified its focus on tracing cryptocurrency payments that some of the most dangerous Mexican drug cartels use to buy fentanyl ingredients from Chinese chemical companies, the latest step in a renewed attempt to crack down on the multibillion-dollar fentanyl trade that kills thousands of Americans each year.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Black Hat USA (Las Vegas, Nevada, USA, Aug 5 - 10, 2023) Founded in 1997, Black Hat is an internationally recognized cybersecurity event series providing the most technical and relevant information security research. Grown from a single annual conference to the most respected information security event series internationally, these multi-day events provide the security community with the latest cutting-edge research, developments, and trends.

Hacker Summer Camp 2023 (Las Vegas, Nevada, USA, Aug 5 - 16, 2023) Meet us at Hacker Summer Camp 2023, which is just around the corner, as we are excited to announce our partnerships with Black Hat and Defcon there! Join us from 5th-16th August 2023 at Summer Camp. Drop us a line to arrange a private meeting with our tech & sales teams. Please see below our schedule for the Summer Camp 2023.

Girls Hack Village presents SquadCon (Las Vegas, Nevada, USA, Aug 10 - 12, 2023) Girls Hack Village presents SquadCon is a three-day conference that seeks to bring gender diverse perspectives of the contributions, experiences, and issues facing the industry's other. Hackers that are new or from underrepresented communities may not often feel comfortable in existing conferences. SquadCon is a forum for conversations about topics that impact girls, women, and LGBTQ+ individuals, including mental health and all the factors that shape the experiences of marginalized groups in the industry. SquadCon is a cybersecurity conference that will include talks, labs, workshops, discussions, CTFs and panels to move towards our mission of improving diversity in ethical hacking. SquadCon is an independent conference event in Las Vegas during Hacker Summer Camp scheduled for August 10-12th. It is run by the makers of Girls Hack Village and exists to help foster diversity and inclusion in cybersecurity.

SecureWorld Manufacturing Virtual Conference (Virtual, Aug 23, 2023) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 5 CPE credits learning from nationally recognized industry leaders. The agenda offers 15+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Hybrid Identity Protection Conference (New York, New York, USA, Aug 23 - 24, 2023) Organized by Semperis, this conference takes up the challenges of hybrid identity protection. Mobile workforces, cloud applications and digitalisation are changing every aspect of the modern enterprise. And with radical transformation come new business risks. Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric practitioners. Whatever industry sector or job function, HIP strives to provide its community with the insights and relationships needed to enable and protect today’s digitally driven organisations.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.