International law enforcement hits Qakbot. Developments in the cybercriminal underworld. Cyberespionage and notes on a hybrid war.

Summary

By the CyberWire staff

At a glance.

International operation takes down Qakbot.
Chinese threat actor anticipated Barracuda remediations.
“Prolific” threat actor targets the crypto sector.
Criminals are selling a dataset allegedly stolen from China's Ministry of State Security.
Adversary-in-the-middle attacks.
Making phishbait more effective.
New malware exploits OpenFire vulnerability.
The emergence of a new ransomware threat.
UK air travel disruption was a malfunction, and not an attack.
Narrative themes in Russian influence operations.

International operation takes down Qakbot.

Yesterday the US Justice Department announced the takedown of the Qakbot botnet. Led by the US FBI, it was a multinational action with participation by France, Germany, the Netherlands, Romania, Latvia, and the United Kingdom. The basic approach the agencies followed was first, to obtain lawful access to the infrastructure and redirect traffic to servers the Bureau controlled. Any computer redirected to the server received an uninstaller file that removed the Qakbot malware. The US Attorney for the Central District of California explained Qakbot's place in the criminal economy. "According to court documents, Qakbot, also known by various other names, including 'Qbot' and 'Pinkslipbot,' is controlled by a cybercriminal organization and used to target critical industries worldwide. The Qakbot malware primarily infects victim computers through spam email messages containing malicious attachments or hyperlinks. Once it has infected a victim computer, Qakbot can deliver additional malware, including ransomware, to the infected computer. Qakbot has been used as an initial means of infection by many prolific ransomware groups in recent years, including Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta. The ransomware actors then extort their victims, seeking ransom payments in bitcoin before returning access to the victim computer networks."

Qakbot's operators are based in Russia. That explains the lack of arrests in this case, and it also explains why Qakbot was able to operate with impunity. It was tolerated and probably enabled by the Russian authorities. Cooperation with criminal organizations is commonplace among Russian security and intelligence services. They're left free to operate as long as the victims aren't Russian, or as long as their crimes abroad don't harm Russian interests.

SecureWorks researchers call the group that operated Qakbot "the financially motivated GOLD LAGOON threat group." As is often the case, the threat group is tracked under several names. Symantec, part of Broadcom, calls it "Batbug." The botnet malware itself has been in action since 2007. It has a modular structure that supports a variety of activities, but it's been especially useful for ransomware attacks. Secureworks also emailed an overview of what they've observed with respect to Qakbot recently, while the botnet was in its salad days. It was global in scope. "We observed 10,000 infected machines in 153 countries connecting to the C2 server over a 4-month period," Secureworks wrote. About 5000 of the infected machines were connected to a domain, and thus can be inferred to have resided in business environments. The business infestations were probably of greater interest to the criminals. The US, Germany, and China represented the three most targeted countries. Symantec reports that Qakbot was especially active between January and June of this year, when it relied principally upon spam for its distribution. For more on Operation Duck Hunt, see CyberWire Pro.

Firing Up Your Open Source Supply Chain Security With SLSA - Webinar On-Demand

Despite the ongoing wave of software supply chain attacks, most tools still only address stage-specific or downstream threats. SLSA has emerged as a cross-industry framework introduced by Google, setting out standards and controls to secure your entire supply chain. Hear from ActiveState’s CPO, Loreli Cadapan, and Kusari’s Co-Founder and CTO, Michael Lieberman, on how you can make SLSA a reality with actionable advice and real world examples. Watch the webinar recording today.

Chinese threat actor anticipated Barracuda remediations.

Last week the US Federal Bureau of Investigation (FBI) has released an alert warning that Barracuda’s Email Security Gateway (ESG) appliances remain vulnerable to compromise by suspected Chinese government threat actors. Yesterday Mandiant described how that exploitation was proceeding. The threat group responsible, UNC4841, is both adaptable and responsive to defensive measures, readily altering its tactics, techniques, and procedures to maintain persistence in the face of defenders' attempts to expel it. In this case UNC4841 anticipated remediations in advance. Mandiant expects the group to continue to seek ways of compromising edge devices.

How the White House’s 2023 National Cybersecurity Strategy Will Affect You.

In response to cybersecurity threats against U.S. companies and critical infrastructure, the White House issued the 2023 National Cybersecurity Strategy in March. Now, CNI sectors across the board have a unified standard by which to digitally secure key national interests.

Join this webinar to learn:

Goals of the White House’s 2023 National Cybersecurity Strategy
A breakdown of its five cybersecurity pillars
How Fortra can help you achieve these objectives and modernize IT/OT infrastructure

“Prolific” threat actor targets the crypto sector.

Checkmarx describes an ongoing campaign that’s been targeting cryptocurrency developers since at least 2021. The threat actor behind the campaign “has been publishing malicious NPM packages with the purpose of exfiltrating sensitive data such as source code and configuration files from the victim’s machines.” The researchers note, “The packages are tied to the cryptocurrency domain further solidifying their financial motives, with clear references to entities like CryptoRocket and Binarium.”

The future of security is identity and with CyberArk, the future of identity is secure.

With 84% of organizations experiencing an identity-related breach, identity is the new battlefield. As the pioneers of privileged access management, we started by protecting the most privileged users and most critical data. With intelligent privilege controls, today we’re applying the same levels of security and protection to every identity – both human and machine. CyberArk offers the most advanced identity security platform in the world, surrounding every identity with a powerful force field of continuous protection.

Criminals are selling a dataset allegedly stolen from China's Ministry of State Security.

Cybersixgill has found that cybercriminals are selling a large dataset purportedly stolen from China’s Ministry of State Security. In a study shared with the CyberWire, the researchers said:

“The Cybersixgill Investigative Portal collected the post advertising the MSS data on a major cybercrime forum, in addition to other recent posts offering allegedly stolen Chinese data. In the post...a recently registered forum member advertised the MSS data, claiming that the full data set covers close to half a billion Chinese citizens. According to the poster, the stolen data include individuals’ names, dates of birth, phone numbers, email addresses, and mailing addresses, which could be used for spearphishing and identity fraud. The poster also referenced unspecified ‘classified document[s],’ in an apparent attempt to portray the content as possessing intelligence value for foreign entities. This is consistent with the overall tone of the post, which presents the data as the product of a breach of China’s secret police.”

Cybersixgill adds that there’s no evidence yet that any of the data were classified. The researchers note, however, that the leaked personal data “could be used in cyber attacks, social engineering campaigns, and other malicious activities.

Adversary-in-the-middle attacks.

The Microsoft Threat Intelligence team has warned of a rise in adversary-in-the-middle (AiTM) phishing attacks, The Hacker News reports. These attacks are launched via phishing-as-a-service (PhaaS) offerings. Microsoft said in a post on X (formerly known as Twitter), “This development in the PhaaS ecosystem enables attackers to conduct high-volume phishing campaigns that attempt to circumvent MFA protections at scale.” The researchers add, “Circumventing MFA is the objective that motivated attackers to develop AiTM session cookie theft techniques. Unlike traditional phishing attacks, incident response procedures for AiTM require revocation of stolen session cookies.” For more on this sector of the C2C market, see CyberWire Pro.

Making phishbait more effective.

Cofense warns that users should be wary of emails that have dates in their subject lines, especially if the emails reference “late faxes, missed voicemails, overdue invoices, payroll, and other themes generally involving the need for immediate interaction.”

The researchers explain, “[I]n over 2/3rds of the emails with dates in their subject line, the listed dates are before the email is accessed. This is not surprising as it has long been assumed that threat actors are doing this to create a false sense of urgency. The dates in email subjects can now be added as a suspicious indicator. If the date in a subject line is before the date the email is accessed, then the email should be examined with additional scrutiny and time should be taken rather than allowing the threat actor to take the initiative and pressure victims into quickly interacting.”

New malware exploits OpenFire vulnerability.

Researchers at Aqua have discovered a new malware campaign exploiting an Openfire vulnerability (CVE-2023-32315) that was disclosed in May 2023. The attackers are using the vulnerability to deliver the Kinsing malware, as well as a cryptominer: “This vulnerability leads to a path traversal attack, which grants an unauthenticated user access to the Openfire setup environment. This then allows the threat actor to create a new admin user and upload malicious plugins.”

The researchers note that there are still 984 vulnerable OpenFire servers connected to the internet, most of which are located in the US, China, and Brazil.

The emergence of a new ransomware threat.

Flashpoint is tracking a new threat actor called “Ransomed” that conducts data theft and uses a new tactic to coerce victims into paying the ransom: “Ransomed is leveraging an extortion tactic that has not been observed before—according to communications from the group, they use data protection laws like the EU’s GDPR to threaten victims with fines if they do not pay the ransom. This tactic marks a departure from typical extortionist operations by twisting protective laws against victims to justify their illegal attacks.”

The group sets ransom demands between €50,000 and €200,000—relatively low compared to the fines typically imposed under GDPR. It’s worth noting that this tactic depends on the victim concealing the breach, which could lead to even heftier fines if this comes to light later on.

UK air travel disruption was a malfunction, and not an attack.

Whatever caused the UK's Nats air traffic management system's problems earlier this week, the BBC reports that the government's preliminary investigation has effectively ruled out a cyberattack.

Narrative themes in Russian influence operations.

Russian propaganda in the active theater has taken a tactical turn, apparently aimed at undermining Ukrainian morale while simultaneously shoring up Russian domestic resolve. The Institute for the Study of War confirms five themes the Ukrainian Main Military Intelligence Directorate (GUR) is pursuing.

Ukraine is "conducting mass mobilization regardless of age, gender, or health."
The West is losing faith in Ukraine.
The Ukrainian counteroffensive is failing.
The Ukrainian government is utterly corrupt.
Russia has improved standards of living in the territories it's occupied.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Notes.

Today's issue includes events affecting Argentina, Bangladesh, Brazil, China, Colombia, France, Germany, India, Latvia, Mexico, the Netherlands, Pakistan, Peru, Romania, Russia, Singapore, Thailand, Ukraine, the United Kingdom. the United States, and Vietnam.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+552: Five tactical narratives. (CyberWire) Russia and Ukraine exchange drone strikes as Ukrainian forces continue their incremental push through Russian prepared lines.

Ukrainian drones strike deep in Russian territory, Moscow says, while a barrage in Kyiv kills 2 (AP News) Russian officials and news reports say Ukraine sent waves of drones deep into western Russia in nighttime attacks that struck military assets.

Russia-Ukraine war: List of key events, day 553 (Al Jazeera) As the war enters its 553rd day, these are the main developments.

Russia-Ukraine war at a glance: what we know on day 553 of the invasion (the Guardian) Two dead in Kyiv following ‘most powerful’ barrage since the spring; six regions of Russia targeted by drones; ‘Farewell ceremony’ for Prigozhin

'We're All On The Front': Inside The Russian Military Town Struck By A Drone (RadioFreeEurope/RadioLiberty) In the western Russian town of Soltsy, home to an air base where at least one of Russia's Tu-22M bombers was destroyed by an apparent drone strike, our reporter found a heightened military presence, and unsurprised locals.

Ukraine: civilian casualty update 28 August 2023 (OHCHR) Date: 28 August 20231 Civilian casualties from 1 to 27 August 2023 From 1 to 27 August 2023, Office of the UN High Commissioner for Human Rights (OHCHR) recorded 585 civilian casualties in Ukraine: 108 killed (65 men, 34 women, 3 girls, 2 boys, as well as 4 adults whose sex is not yet known), and 477 injured (196 men, 148 women, 9 boys, 7 girls, as well as 3 children and 114 adults whose sex is not yet known). This included:

Ukraine's remarkable resilience may prove decisive in long war with Russia (Atlantic Council) With hopes of a decisive Russian military victory fading fast, Vladimir Putin is pinning his hopes on outlasting the West and breaking Ukraine's will to resist. However, he may have fatally underestimated Ukrainian resilience, writes Peter Dickinson.

Opinion Ukraine is crossing Russia’s ‘red lines’ with impunity. It’s a lesson for Biden. (Washington Post) Ukrainian drone strikes on Moscow, once unthinkable, have now become routine. The Russian capital region was targeted for six straight days recently, and while the drones haven’t caused much damage, they disrupted flight operations at airports and have helped to bring the war home. Also this month, other suspected Ukrainian drones destroyed a Russian bomber at an air base south of St. Petersburg and struck a railway station in the Kursk region of western Russia. The Kremlin’s response appeared to be limited to expressions of outrage.

How Ukraine Can Win a Long War (Foreign Affairs) The West needs a strategy for after the counteroffensive.

Biden Administration Announces Additional Security Assistance for Ukraine (U.S. Department of Defense) The DOD announced additional security assistance to meet Ukraine's critical security and defense needs.

The Dutch are leading the way on military aid to Ukraine. Here’s why. (Atlantic Council) The Netherlands is punching above its weight in terms of military aid to Ukraine, in part because the Dutch have felt first-hand the threat Putin poses.

‘That’s our guy’: how UK military chief became key Nato liaison in Ukraine (the Guardian) Adm Sir Tony Radakin recognised in Washington and Kyiv as an increasingly important actor

Yevgeny Prigozhin’s ‘farewell ceremony’ takes place in private (The Telegraph) Kremlin said Vladimir Putin would not attend funeral service for the mercenary boss who died in a plane crash last week

Interview: Prigozhin's Demise And Russia's 'Gangster Rules' (RadioFreeEurope/RadioLiberty) Soviet-born cybersecurity expert, author, and think-tank founder Dmitri Alperovitch talks to RFE/RL's Georgian Service about Wagner chief Yevgeny Prigozhin's presumed death and what it says about Vladimir Putin's Russia and the ongoing war in Ukraine.

'It's Very Clear What Happened': White House Suggests Kremlin Behind Prigozhin's Death (RadioFreeEurope/RadioLiberty) The White House on August 29 came close to declaring that the Kremlin was responsible for the death of Wagner mercenary group chief Yevgeny Prigozhin, who was killed in a mysterious plane crash last week.

After Prigozhin’s Death, Russia Is Nearing a Point of No Return (World Politics Review) After Yevgeny Prigozhin’s death, Russia's long-term trajectory under Putin looks increasingly dire.

Meta reckons China's troll farms can learn from Russia's (Register) Claims to have taken down two colossal networks, with 'Secondary Infektion' schooling 'Spamouflage'

Cybersecurity experts say the west has failed to learn lessons from Ukraine (Ars Technica) US and its allies struggle to copy Kyiv’s collaborative efforts.

Ukraine upgrades digital education efforts (Atlantic Council) The full-scale Russian invasion has thrust Ukraine’s vibrant tech sector into the limelight and led to an upgrade of the country's flagship digital education and training initiative, writes Valeriya Ionan.

Moscow will help cybercriminals operate with 'near impunity': federal report predicts (Canada's National Observer) Russian intelligence services and police will help cybercriminals operate with "near impunity" against their targets — including Canadians — in coming months, a new federal report predicts.

Did Russia Hack Poland’s Trains? MSM Says Yes, but … Well, You Decide (Security Boulevard) Train Phreaking: It depends what you mean by “hack” (and by “Russia”).

Russian hackers attack Polish websites, try to influence elections: gov’t official (TVP world) “Through cyber attacks, Russia aims to influence the pre-election mood in Poland,” Żaryn mentioned in the InfoAlert post on X.

Vatican seeks to tamp down outrage over pope's words of praise for Russian imperial past (AP News) The Vatican is seeking to tamp down an uproar that erupted after Pope Francis praised Russia’s imperialist past.

Russia is ramping up its CBDC. Will Putin’s ‘robot ruble’ work? (Atlantic Council) Given the extent of financial sanctions following its full-scale invasion of Ukraine, Russia is trying to open alternative channels for cross-border payments.

Russia earns less from oil and spends more on war. So far, sanctions are working like a slow poison (AP News) The Russian currency has stabilized after dipping below 100 rubles to the U.S. dollar — but that doesn't mean the pressure is off Russia's economy.

Documents show Putin’s order to move superyacht before Ukraine invasion (the Guardian) Russian president ordered urgent removal of Graceful from Hamburg shipyard, investigation claims

Germany Arrests Man Accused Of Exporting Electronic Components For Drones To Russia (RadioFreeEurope/RadioLiberty) A German-Russian dual citizen has been arrested in Germany on allegations of violating the country's foreign trade law multiple times by exporting electronic components to a company in Russia involved in the production of military materiel and accessories/

Russia Extends Pretrial Detention For Former Worker At U.S. Consulate (RadioFreeEurope/RadioLiberty) A Moscow court has extended for three months the pretrial detention of a former employee of a U.S. consulate in Russia who is being held on charges of illegally collaborating with foreigners in an action condemned by the United States.

Rare video shows American Paul Whelan inside Russian prison (ABC News) U.S. efforts to free the jailed Marine veteran remain at an impasse.

Attacks, Threats, and Vulnerabilities

DreamBus Botnet Resurfaces, Targets RocketMQ vulnerability (Official Juniper Networks Blogs) In May 2023, a vulnerability affecting RocketMQ servers (CVE-2023-33246), which allows remote code execution, was publicly disclosed. In a recent blog post, Juniper Threat Labs provided a detailed explanation of

DreamBus malware exploits RocketMQ flaw to infect servers (BleepingComputer) A new version of the DreamBus botnet malware exploits a critical-severity remote code execution vulnerability in RocketMQ servers to infect devices.

Chinese Hacking Group Exploits Barracuda Zero-Day to Target Government, Military, and Telecom (The Hacker News) Suspected Chinese hacking group UNC4841 exploited zero-day flaw in Barracuda ESG appliances to target government, military, and tech companies.

Chinese APT Was Prepared for Remediation Efforts in Barracuda ESG Zero-Day Attack (SecurityWeek) Chinese threat actor exploiting Barracuda ESG appliances deployed persistence mechanisms in preparation for remediation efforts.

Adversarial Threat Report (Meta) Our public threat reporting began about six years ago when we first shared our findings about coordinated inauthentic behavior (CIB) by a Russian covert influence operation.

Meta’s ‘Biggest Single Takedown’ Removes Chinese Influence Campaign (New York Times) The campaign began at least four years ago and spanned thousands of accounts on Facebook, Instagram, TikTok, X, Substack and Chinese websites, Meta said.

Meta: Pro-Chinese influence operation was the largest in history (CyberScoop) Meta researchers said the operation relied on thousands of accounts to spread pro-Chinese messages and attack critics of Beijing.

Meta Fights Sprawling Chinese 'Spamouflage' Operation (SecurityWeek) Meta has purged thousands of Facebook accounts that were part of a widespread online Chinese spam operation

An Ongoing Open Source Attack Reveals Roots Dating Back To 2021 (Checkmarx.com) Developers in the cryptocurrency sphere are being targeted once again, as yet another threat actor has been exposed. This user has been publishing malicious NPM packages with the purpose of exfiltrating sensitive data such as source code and configuration files from the victim’s machines. The threat actor behind this campaign has been linked to malicious activity dating back to 2021. Since then, they have continuously published malicious code.

Citrix NetScaler Alert: Ransomware Hackers Exploiting Critical Vulnerability (The Hacker News) Unpatched Citrix systems under attack! Unknown threat actors are exploiting a critical vulnerability (CVE-2023-3519) for ransomware attacks.

Under Siege: Rapid7-Observed Exploitation of Cisco ASA SSL VPNs (Rapid7) Rapid7’s managed detection and response (MDR) teams have observed increased threat activity targeting Cisco ASA SSL VPN appliances (physical and virtual) dating back to at least March 2023.

Adversary-Sponsored Research Contests on Cybercriminal Forums Focus on New Methods of Attack and Evasion, Sophos Research Reveals (GlobeNewswire News Room) Criminal Community-Sponsored Contests Mirror Cybercrime Trends, Such as Disabling AV/EDR, Cryptocurrency Fraud, and C2 Frameworks...

The Weird, Big-Money World of Cybercrime Writing Contests (WIRED) The competitions, which are held on Russian-language cybercrime forums, offer prize money of up to $80,000 for the winners.

Phishing-as-a-Service Gets Smarter: Microsoft Sounds Alarm on AiTM Attacks (The Hacker News) Microsoft warns about a surge in AiTM phishing attacks. Hackers are using smart phishing-as-a-service (PhaaS) platforms to scale up their campaigns an

The Lure of Subject Lines in Phishing Emails - How Threat Actors Utilize Dates to Trick Victims (Cofense) Discover how threat actors use deceptive dates in phishing email subject lines to trick victims and create a false sense of urgency. Dive into the data from July 2023 uncovered by Cofense Intelligence and learn best practices for avoiding these malicious tactics.

Kinsing Malware Exploits Novel Openfire Vulnerability (Aquasec) A new attack exploits the novel Openfire vulnerability (CVE-2023-32315) to deploy Kinsing malware and crypto miners to gain full control over the server.

MA Eversource Customers Exposed To Data Breach: Utility (Across Massachusetts, MA Patch) Eversource vendor CLEAResult was hacked, exposing data like energy usage and addresses.

Cancelled flights: Air traffic disruption caused by flight data issue (BBC News) Passengers are warned to expect knock-on disruption in the days ahead after the Bank Holiday Monday issue.

Air traffic control: French airline error not ruled out as cause of flight chaos, suggests No 10 (The Telegraph) Dozens of flights were cancelled or delayed at airports including Heathrow, Gatwick and Manchester on Tuesday, as a widespread technical fault impacting air traffic control continued to cause chaos.

Exposed Database Shows Billions of Cigna Health Documents Containing Provider Information and Negotiated Rates for Medical Procedures (Website Planet) Recently, security researcher Jeremiah Fowler discovered and reported to Website Planet a non-password protected database containing over 17 billion

Updates (Prevea) This webpage will provide current updates regarding the temporary system outage for Prevea Health, Hospital Sisters Health System (HSHS) and HSHS hospitals in Wisconsin (including: HSHS St. Vincent Hospital and HSHS St. Mary's Hospital Medical Center in Green Bay; HSHS St. Nicholas Hospital in Sheboygan; HSHS St. Clare Memorial Hospital in Oconto Falls; HSHS Sacred Heart Hospital in Eau Claire; and HSHS St. Joseph's Hospital in Chippewa Falls) as they are available.

UPDATE: Temporary Internet Outage on All U-M Campuses (University of Michigan) Thank you for your continued patience during our ongoing online service disruption. Our team of IT and cybersecurity experts has made significant progress over the past 24 hours.

Security Patches, Mitigations, and Software Updates

CISA Releases One Industrial Control Systems Advisory (Cybersecurity and Infrastructure Security Agency CISA) CISA released one Industrial Control Systems (ICS) advisory on August 29, 2023. This advisory provides timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-241-01 PTC CodeBeamer

Mozilla Releases Security Updates for Firefox and Firefox ESR (Cybersecurity and Infrastructure Security Agency CISA) Mozilla has released security updates to address vulnerabilities for Firefox 117, Firefox ESR 115.2, and Firefox ESR 102.5. A cyber threat actor can exploit some of these vulnerabilities to take control of an affected system.

Trends

Cyberattacks Targeting Government Agencies on the Rise (Hackread) A concerning trend is emerging on the global stage: a rise in cyberattacks targeting government agencies.

Quarterly Threat Report Q2 2023 (Expel) Welcome to the latest installment of the Expel Quarterly Threat Report (QTR). If you’re new here, our QTRs provide data and insights on the attacks we’re seeing, how to spot them, and the ways you can protect your organization.

Biometric data collection by country: What's collected, how is it used? (Comparitech) This study looks at the type of biometric data collected by 96 countries and how it is used. We've scored and ranked countries to see which are the most invasive of visitors' or citizens' privacy.

The BreachLock Penetration Testing Intelligence Report 2023 (BreachLock) Over the past five years, BreachLock has emerged as a global leader in Cyber Security Validation. We have successfully aided numerous clients in their pursuit of ongoing attack surface management and continuous security validation.

1H 2023 Ransomware Landscape Overview | Arctic Wolf (Arctic Wolf) Arctic Wolf Incident Response explores the ransomware landscape in the first half of 2023.

Putting the Blueprint for Ransomware Defense to the Test (Institute for Security and Technology) One year after the release of the Blueprint for Ransomware Defense, IST has partnered with cyber insurance company Resilience to test the framework’s effectiveness in protecting enterprises against ransomware attacks. In a review of 38 attacks, IST’s Zoë Brammer found that 68% could have been prevented by proper implementation of the Blueprint’s Safeguards.

Marketplace

Alarum Announces $4.25 Million Private Placement Financing; Senior Management to Participate with More Than $1 Million (GlobeNewswire News Room) The Company provided notice of termination of its ATM equity offering program...

NetSPI Moves to New Minneapolis Headquarters to Accommodate Growth (PR Newswire) NetSPI, the global leader in offensive security, today announced its new headquarters location in the Steelman Exchange building in...

Contrast Security Appoints Julie Giannini as Chief Customer Officer (Contrast Security) Industry veteran will lead the code security leader’s global customer success team through next phase of growth

Leaseweb Builds Significant Momentum in Singapore With Continued Asia Pacific Expansion (Leaseweb) Leaseweb has announced a 300% growth in revenue and a 200% growth in employee headcount in the last 24 months in Singapore.

Products, Services, and Solutions

U.S. Army Selects BackBox to Automate Multi-Vendor Network Environment (BackBox Software) The U.S. Army has selected the BackBox automation platform to automate DISA STIG compliance, saving network administrators from more than 90 manual configuration steps.

Joyn Insurance Chooses Quorum Cyber for Robust Cybersecurity Amid Rapid Expansion (PR Newswire) For a deeper dive into how Joyn Insurance achieves compliance and secures its networks, please visit Supporting Joyn Insurance in their...

Incode and Simpello Set a New Standard for Frictionless Data Interaction, Privacy, and Protection for Travelers (PR Newswire) Incode Technologies and Simpello, global data security leaders, announced today a strategic alliance, integrating Incode's biometric identity...

Workspot Client is now “Chrome Enterprise Recommended” (Business Wire) Workspot’s Enterprise VDI platform along with Workspot Client on Google ChromeOS delivers the most secure solution for end-user computing in large enterprises

comforte AG Joins the AWS Partner Network Member, Provides Joint Customers with Data-Centric Security (comforte AG) comforte AG, a leading data-centric security provider, has formed a strategic partnership with Amazon Web Services (AWS)

SPHERE Appoints Former Johnson & Johnson CISO Marene Allison to Board of Directors (PR Newswire) SPHERE, an award-winning provider of innovative solutions for identity hygiene and access governance, announced the appointment of former...

Axio and Cyentia Institute Partner to Enhance Data-Driven Cyber Risk Quantification for Organizations Across the Globe (Axio) Innovative Solution Drives Increased Confidence in Cyber Decision-Making for Information Security Professionals, C-Suite Executives, and Board of Directors

OpenAI Turns to Security to Sell ChatGPT Enterprise (SecurityWeek) ChatGPT Enterprise promises “enterprise-grade security” and a commitment not to use prompts and company data to train AI models.

LogRhythm Announces Partnership with Cimcor for Enhanced Cybersecurity Capabilities (LogRhythm) This partnership leverages LogRhythm's comprehensive security information and event management (SIEM) platform and Cimcor's file integrity monitoring (FIM) solution, CimTrak.

NinjaOne Delivers Automation Innovations to its Cloud-Native IT Management Platform with its Summer 2023 Release (ACCESSWIRE News Room) Company updates its platform with significant automation and visibility enhancements to simplify remote monitoring and endpoint management AUSTIN, TX / ACCESSWIRE / August 30, 2023 / NinjaOne, a modern, cloud-native IT management platform for managed service providers (MSPs) and IT departments, today announced the company is advancing its platform with new automation capabilities as well as providing more visibility into over five million

Laminar Expands Data Security Platform with Support for Microsoft OneDrive and Google Drive (Rubrik) New capabilities allow customers to discover, classify, and secure sensitive data across two of the most widely used cloud file-sharing services.

SentinelOne® Launches on Google Cloud Marketplace (Business Wire) Customers using Google Cloud can now purchase SentinelOne’s autonomous cybersecurity solutions with simplicity and speed to improve enterprise protection

Fortinet boosts secure networking to advance network-security convergence (TimesTech) This new addition to Fortinet’s Secure Networking portfolio expands the company’s ability to deliver consistent security, unified management

Group-IB wins prestigious Red Dot Design Award with innovative Managed XDR solution (Group-IB) Group-IB, a global cybersecurity leader headquartered in Singapore, is proud to announce that the company’s Managed XDR solution has won the Red Dot Design Award for Interface & User Experience Design – Brands & Communication Design 2023.

AMD Shares The Technical Details of Technology Powering Innovative Confidential Computing Leadership Cloud Offerings (Advanced Micro Devices, Inc.) Browse AMD’s company-wide and financial press releases.

CISO Global Expands Portfolio with Integration of CHECKLIGHT™ Endpoint Protection Technology (CISO Global) Global cybersecurity provider backs threat protection platform with $250,000 service level guarantee Scottsdale, Ariz. August 30, 2023 – CISO Global (NASDAQ: CISO), an industry leader as a managed cybersecurity and compliance provider, has expanded its product portfolio to include the assets of its recent acquisition of SB Cyber. The company is backing the solution with […]

Netskope Delivers the Next Evolution in Digital Experience Management for SASE with Proactive DEM (PR Newswire) Netskope, a leader in Secure Access Service Edge (SASE), today announced the launch of Proactive Digital Experience Management (DEM) for SASE,...

Exabeam Partners with Google Cloud on New Generative AI Features For Improving Security Operations (Business Wire) Building on a mature portfolio of machine-learning (ML) and AI capabilities, Exabeam New-Scale SIEM products add new generative AI experiences using Google Cloud technologies

QuSecure Named Commercial Capabilities Showcase Winner by Air Force Global Strike Command and Small Business Consulting Corporation (Business Wire) QuSecure Recognized as Industry’s Only Fully Orchestrated Solution Delivering Validated Post-Quantum Cryptography with Managed Deployment that is Monitored for Attack and Actively Defended

Noname Security Announces Comprehensive Support for New OWASP API Security Top 10 (Noname Security) Latest integration enables customers to strengthen vulnerability detection and bolster API security San Jose, CA – August 30, 2023 – Noname Security, the

ZeroFox Enhances Physical Security Intelligence with Powerful Interactive Mapping Capabilities and Comprehensive Threat Research (GlobeNewswire News Room) New features give security teams greater visibility into types of threats and geographic locations, allowing them to research, track, and assess physical...

Absolute Software Expands Application Resilience Ecosystem (Absolute Software) Absolute Software today announced the continued expansion of its Absolute Application Resilience™ ecosystem.

Technologies, Techniques, and Standards

National Grid plots ‘honeypots’ to catch hackers as cyber attacks ramp up (The Telegraph) Infrastructure provider advertises contract of more than a million pounds for advanced technology

New Report Finds Cybersecurity Threats to National Security Result from Outdated Approach to Securing Software (GlobeNewswire News Room) Cybersecurity analyst Dawn Blizard visited with subject matter experts from Rise8 and the Department of Defense to outline U.S. government agencies’...

Is the cybersecurity community’s obsession with compliance counter-productive? (Help Net Security) How many would determine that the best use of their resources would be to attain or retain compliance with cybersecurity standards?

Council Post: Five Ways Strong Cybersecurity Culture Can Thwart Human Errors (Forbes) Here are some actionable steps you can take to initiate the process of nurturing a security culture at your company.

11 search engines for cybersecurity research you can use right now (Help Net Security) Staying ahead in cybersecurity requires constant learning and adaptation. If you're interested in cybersecurity research, explore the resources outlined

Four common password mistakes hackers love to exploit (BleepingComputer) Threat actors take advantage of common password mistakes to breach corporate networks. Learn more from Specops Software on the four most common mistakes and how to strengthen your Active Directory against these risks.

Design and Innovation

Large language models aren’t people. Let’s stop testing them as if they were. (MIT Technology Review) With hopes and fears about this technology running wild, it's time to agree on what it can and can't do.

Regulatory uncertainty overshadows gen AI despite pace of adoption (CIO) Enterprises—and their technology vendors—continue to fall over themselves to add gen AI capabilities to tools and platforms. But moving too fast can expose companies to present and future compliance risks, as well as potential legal liabilities.

Legislation, Policy, and Regulation

A Victim’s Perspective on International Law in Cyberspace (Default) Costa Rica’s recent position paper improves transparency on the country’s legal views and provides a framework for future dialogue with other states.

National Grid seeks 'honeypot' expert to stop hackers (Computing) National Grid, the utilities provider running the UK's gas and electricity networks, is looking for a security expert who can set "honeypots" to catch hackers and improve its defences.

Cybersecurity Resiliency Funding for U.S. States and Territories (National Law Review) The Department of Homeland Security has announced a Notice of Funding Opportunity (“NOFO”) for the fiscal year (“FY”) 2023 State and Local Cybersecurity Grant Program (“SLCGP”). This program makes approximately $374.9 million available in funding available to help state, local and territorial governments manage and reduce systemic cyber risks through focused investments.

Litigation, Investigation, and Law Enforcement

FBI, Partners Dismantle Qakbot Infrastructure in Multinational Cyber Takedown (Federal Bureau of Investigation) The FBI and the Justice Department announced a multinational operation to disrupt and dismantle the malware and botnet known as Qakbot.

Qakbot Malware Disrupted in International Cyber Takedown (US Department of Justice) Qakbot Malware Infected More Than 700,000 Victim Computers, Facilitated Ransomware Deployments, and Caused Hundreds of Millions of Dollars in Damage

Law Enforcement Takes Down Qakbot (Secureworks) Distribution of a DLL to neutralize infections and changes to Qakbot infrastructure suggested technical efforts to take down GOLD LAGOON's Qakbot botnet.

Qakbot: Takedown Operation Dismantles Botnet Infrastructure (Symantec) Botnet was one of the most prolific malware distribution networks.

International Operation Disrupts ‘Botnet’ Army Behind Damaging Cyberattacks (Wall Street Journal) U.S. officials said the Qakbot malware had enabled hundreds of millions in damages by supporting crime like ransomware.

FBI Dismantles a Malware System That Took Millions in Ransom (Bloomberg) Tens of millions of dollars were lost through Qakbot attacks. Emergency rooms, sheriff’s departments were crippled by Qakbot.

Operation 'Duck Hunt' Dismantles Qakbot (Bank Info Security) U.S. authorities Tuesday said they permanently dismantled the notorious Qakbot botnet in an international operation that seized 52 servers and nearly $9 million

University of Minnesota data breach: Class action lawsuit filed (FOX 9 Minneapolis-St. Paul) A class action lawsuit has been filed against the University of Minnesota in federal court over a massive data breach that was made public last week.

SEC Must Review Grayscale's Bitcoin ETF Bid After Previous Rejection, Appeals Court Rules (CoinDesk) A federal appeals court ordered the SEC to "vacate" its rejection of the trust issuer's bid to convert the Grayscale Bitcoin Trust into an exchange-traded fund.

Texas National Guard disbanded intelligence wing after members used WhatsApp to spy on migrants (ABC13 Houston) Four members of the unit working on Gov. Abbott's border mission have been punished after whistleblowers reported the surveillance operation violated long-standing rules against state-run spy operations.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Navigate 2023: Identity Security Accelerated (Austin, Texas, USA, Oct 9 - 12, 2023) Join us for Navigate, where you’ll explore the next frontier in identity security: Cutting-edge. Dynamic. Accelerated. Endless possibilities. Widely recognized as the industry event exclusively focused on bringing the deepest level of identity security knowledge, expertise and perspective to the market – Navigate is the “can’t miss” identity event of the year. Navigate is the forum for identity practitioners and senior decision-makers alike to get first-hand insight into “what’s next” in identity security. Now is the time to immerse yourself in the modern approach to identity security – the secure path forward to fully protect your business amid the velocity of changes happening across your business.

Events

Voice & AI (Washington, DC, USA, Sep 5 - 7, 2023) VOICE & AI 2023 is the world's largest generative and conversational AI event dedicated to developers, designers, product leaders, marketers, and more. The initial program has been revealed for the conference, which will be held Sept. 5-7 2023 at the Washington Hilton in Washington, D.C. Many more talks will be added to the program in the weeks ahead. Workshops on strategy and open-source code will kick off the event on Sept. 5, with leading companies including NVIDIA, Microsoft, GM, Capital One, Google, Apple, and Github providing detailed insights on how they approach the AI revolution. In all, more than 100 speakers will deliver panel discussions, tactical breakout sessions, keynotes, and lightning talks. Additional sessions on AI policy, regulations, and procurements will be presented by federal agencies.

14th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 5 - 8, 2023) The 14th Annual Billington Cybersecurity Summit will take place September 5–8, 2023, at the Ronald Reagan Building and International Trade Center in Washington, D.C. With the unique educational mission of convening the who’s who in cybersecurity, this annual event brings together senior leadership from the U.S. government and our allied partners along with their industry and academic partners.

SANS Network Security 2023 (Las Vegas, Nevada, USA, Sep 6 - 11, 2023) At SANS Network Security 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Setting Better Cyber Job Expectations To Attract And Retain Talent (Virtual, Sep 7, 2023) Could your cybersecurity job descriptions (JDs) use a refresh? Many JDs are overgeneralized or suggest only unicorns need apply, slowing the hiring process and action on critical initiatives. N2K's Dr. Sasha Vanterpool shares how to update your JDs and improve hiring and retention by setting better cyber role expectations.

Borderless Cyber: Cybersecurity Meets Privacy (Egham, Surrey, UK, Sep 11 - 12, 2023) 'Cybersecurity Meets Privacy' Royal Holloway, University of London 11-12 September 2023 Egham, Surrey, UK Borderless Cyber is unique, focusing on the convergence of the cybersecurity and privacy disciplines and addressing new technologies, research, operationalization realities, risks, and solutions. It brings together international experts and offers opportunities for networking, good dialogue, and future collaboration. It promises to be illuminating and challenging! Speakers from Uber, Meta, Vodafone, NATO NCI, Intel, CISA, Infosys, ITU, the UK Home Office, and other organizations are included in the recently released program.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.