A look at the cyber underworld, and some developments in the C2C markets. A hybrid war makes a hacker diaspora.

Summary

By the CyberWire staff

At a glance.

UK's NCA and NCSC release a study of the cybercriminal underworld.
HijackLoader's growing share of the C2C market.
WinRAR vulnerability explained. Spyware in malicious Telegram apps.
Russia's hacker diaspora in Turkey.
Russian cyber diplomat warns against US escalation in cyberspace.
Update on Starlink's availability in the Black Sea.

UK's NCA and NCSC release a study of the cybercriminal underworld.

The UK’s National Cyber Security Centre (NCSC) and National Crime Agency (NCA) have published a report looking at ransomware’s place in the cybercrime ecosystem, outlining the attack chain used by ransomware actors. The agencies believe a broad view of the ransomware landscape is necessary to address the problem more effectively. “While on the surface, an attack can be attributed to a piece of ransomware (such as Lockbit), the reality is more nuanced, with a number of cyber criminal actors involved throughout the process. Tackling individual ransomware variants – something which the NCSC and NCA are frequently challenged on – is akin to treating the symptoms of an illness, and is of limited use unless the underlying disease is addressed. Taking a more holistic view by understanding the elements of the wider ecosystem allows us to better target the threat actors further upstream, in addition to playing ‘whack-a-mole’ with the ransomware groups.” For more on the NCA and NCSC report, see CyberWire Pro.

Earn your cybersecurity master’s from an NSA-recognized institution.

Further your career and secure your future with an advanced degree from the George Washington University — choose from 100% online master’s in cybersecurity analytics or in cybersecurity policy & compliance. Designed by D.C. experts and taught by cybersecurity leaders, these programs integrate computer science and engineering courses to give you the well-rounded expertise you need for leadership roles and professional advancement. Discover how you can get a world-class education made for working professionals.

HijackLoader's growing share of the C2C market.

Zscaler warns that the malware loader HijackLoader has spiked in popularity over the past few months. The loader first emerged in July 2023, and is being used to deliver several malware families, including Danabot, SystemBC, and RedLine Stealer. Zscaler notes, “Even though HijackLoader does not contain advanced features, it is capable of using a variety of modules for code injection and execution since it uses a modular architecture, a feature that most loaders do not have.” The researchers add, “We expect code improvements and further usage from more threat actors, especially to fill the void left by Emotet and Qakbot.”

Why AI Is at Risk for Supply Chain Attacks and How You Can Address It.

As companies rush AI applications to market, pre-built open source binaries such as Python wheels have become widely adopted, even as they pose an increasing risk for supply chain attacks.

This webinar covers:

What are pre-built binaries and Python wheels
The state of open source software supply chain risks
How organizations can ensure secure, scalable use of open source for AI, even in the cloud

Register today and join us on Sep. 21.

WinRAR vulnerability explained.

Researchers at Uptycs have published an analysis of a WinRAR vulnerability (CVE-2023-38831) that was disclosed two weeks ago. The flaw, which is under active exploitation, can be used to distribute malicious code within ZIP files. The researchers explain, “This deceptive technique enables them to embed malicious code in an archive disguised as a benign ‘.jpg’, ‘.txt’, or other commonly recognized file types. They package both benign and malicious files within a single ZIP archive. When victims open this malicious package, they see what seems like an image file and a folder with the same name as the image.”

Fortra Discusses Developing the Framework for a Culture of Security Awareness.

From gaining buy-in to staying engaged during leadership churn, Fortra walks you through the ins-and-outs of bringing a culture of cybersecurity to your company. With over two decades of security awareness training expertise, we know the pitfalls and can prepare you for persistent success. Learn from our experience how to:

Communicate a cybersecurity framework
Increase engagement
Plan for leadership turnover
Leverage safety net technology
And more

Read Now.

Spyware in malicious Telegram apps.

Kaspersky discovered several malicious Telegram replicates in the Google Play Store that appear to be designed to target Chinese-speaking users, particularly China’s Uighur population. The apps purport to be faster versions of the legitimate Telegram app, and are “capable of stealing the victim’s entire correspondence, personal data, and contacts.” BleepingComputer notes that the apps have been downloaded more than 60,000 times. Google has since removed the apps from its Play Store.

SlashNext Complete™ AI Security for Email, Mobile and Browser

At SlashNext, we know the demands of a changing and growing threat landscape increase the need to protect people where they work in real time. That’s why SlashNext Complete delivers zero-hour protection for how people work today across email, mobile, and browser apps. With SlashNext’s generative AI to defend against advanced business email compromise, smishing, spear phishing, executive impersonation, and financial fraud, your people are always protected anywhere they work. Request a demo today.

Russia's hacker diaspora in Turkey.

The Financial Times reports that among the many thousands of young, military-aged men who skipped from Russia last Fall to evade increased conscription, including the recall of former conscripts who'd finished their military service. were a large number of hackers, IT workers, and, most significantly, cybercriminals. Turkey received several thousand such emigrants, and many of them have either connected with local Turkish gangs or formed small criminal groups themselves. Conditions for cybercriminals in Turkey are not as easy as they are in Russia, where cyber gangs operate with the connivance of the government. They enjoy no such official protection in Turkey, but hope to stay at large by keeping their crimes petty, by avoiding hitting targets in Turkey (where victims are likely to complain to the authorities), and by keeping their trade as unobtrusive and evasive as possible.

The expatriate criminals' preferred tool is Redline, commodity malware that nonetheless seems to evade widely used defensive software. It's "most often downloaded inadvertently by people using illegal websites to play video games or pirated versions of popular software." The criminal take is retail-level stuff: passwords and other login credentials as well as credit card data. It also includes stolen cookies, possession of which makes it easier to use the other data the thieves hold. The information is traded in an underground souk researchers call "the Underground Cloud of Logs."

The newly arrived Russians are said to have taught the existing Turkish cybercriminals how to make better use of their tools, and in particular how to organize their stolen data in ways that render them more attractive in the C2C markets.

Russian cyber diplomat warns against US escalation in cyberspace.

In an interview with Newsweek, Artur Lyukmanov, director of the Russian Foreign Ministry's International Information Security Department and special representative to President Vladimir Putin on international cooperation on information security, reiterated familiar Russian non-denial denials of Moscow's offensive cyber operations--US allegations are accompanied by a "lack of hard evidence," he said. Thus, it's not so much "we didn't do it," as, "where's your evidence?" and besides, you're the guilty ones here." He described the US National Cybersecurity Strategy as an inherently escalatory document that deeply implicates the US government and US corporations in "preparations for 'cognitive warfare.'" He said, "We want to halt further deterioration. A mistake in the use of ICTs may lead to a direct conflict, an all-out war, especially as that the White House is aware that Russia has all the necessary capabilities to defend itself. A devastative computer attack against our critical information infrastructure will not be left without response."

One of the principal lessons the US has drawn from Russia's war is that effective cyber defense depends upon international cooperation, and specifically upon cooperation among the public and private sectors of democracies. Breaking Defense reports that Ambassador-at-Large Nate Fick told the Billington Cybersecurity Summit last week that a new strategy for promoting such cooperation was under preparation, and that it would be circulated this Fall.

Update on Starlink's availability in the Black Sea.

Starlink indeed wasn't available for Ukrainian forces to use in an attack against the Black Sea Fleet, but it may not have been a service interruption. Walter Isaacson, Elon Musk's biographer and the writer who broke the story, tweeted, "To clarify on the Starlink issue: the Ukrainians THOUGHT coverage was enabled all the way to Crimea, but it was not. They asked Musk to enable it for their drone sub attack on the Russian fleet. Musk did not enable it, because he thought, probably correctly, that would cause a major war." Russia's war can already reasonably be characterized as "major," so this must mean escalation to include other countries.

This is essentially what Elon Musk said in his own response to the Washington Post story: "The Starlink regions in question were not activated. SpaceX did not deactivate anything. There was an emergency request from government authorities to activate Starlink all the way to Sevastopol. The obvious intent being to sink most of the Russian fleet at anchor. If I had agreed to their request, then SpaceX would be explicitly complicit in a major act of war and conflict escalation."

US Secretary of State Blinken said Sunday of Starlink that “What we would hope and expect is that the technology will remain fully available to the Ukrainians.” He declined to comment on Mr. Musk's decision to withhold service in the vicinity of Sevastopol, but the Secretary did say, “Here’s what I can tell you: Starlink has been a vital tool for the Ukrainians to be able to communicate with each other, and particularly for the military to communicate in their effort to defend all of Ukraine’s territory.”

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+564: Mobilization drives a hacker diaspora. (CyberWire) Ukraine's deliberate advance in the South continues, as do drone strikes by both sides. Russian cyber criminals and IT workers who fled mobilization amount to a hacker diaspora.

Russia-Ukraine war: List of key events, day 565 (Al Jazeera) As the war enters if 565th day, these are the main developments.

Russia-Ukraine war at a glance: what we know on day 565 of the invasion (the Guardian) German foreign minister says EU enlargement to include Ukraine is ‘necessary geopolitical consequence of Russia’s war’; Putin visits Vladivostok where he may meet Kim Jong-un

UN atomic watchdog warns of threat to nuclear safety as fighting spikes near a plant in Ukraine (AP News) The United Nations atomic watchdog has warned of a potential threat to nuclear safety from a spike in fighting near Europe’s largest nuclear power plant in Ukraine, whose forces continued pressing their counteroffensive.

Russia-Ukraine war at a glance: what we know on day 564 of the invasion (the Guardian) G20 declaration ‘nothing to be proud of’, says Kyiv; Ukraine warns against lifting sanctions as Russia pushes grain deal; Ukraine condemns lack of progress for a tribunal to prosecute Russian leaders

Russia Launches Two-Hour Drone Attack Over Kyiv (VOA) Russia launches about three dozen drones over Kyiv, with debris falling over the city

Russia-Ukraine war at a glance: what we know on day 563 of the invasion (the Guardian) Russian attack on Ukrainian police building kills one and wounds dozens; Zelenskiy says Putin ‘killed Prigozhin’; British military to monitor Black Sea

What an S-400 kill and a spec ops raid reveal about Ukraine's ability to hit Russia (Breaking Defense) According to Secretary of the National Security and Defense Council Oleksiy Danilov, the Neptune preformed “flawlessly” during the Aug. 23 attack on a Russian Almaz-Antei S-400 “Triumf” air and missile defense complex.

Ukraine’s Strikes Behind Enemy Lines Are Paying Off (New Lines Magazine) The attacks deep into Russia are bolder and more frequent

Russia-Ukraine war live: ‘too early to say’ whether Ukraine’s summer offensive has failed – as it happened (the Guardian) Gen Mark Milley, head of the US military, says offensive has gone ‘slower than anticipated’ but battle isn’t done

The Three Roadblocks Keeping Ukraine Mired in War (Wall Street Journal) Slow gains on the battlefield, a cautious West and Putin’s record of breaking deals have contributed to a deadlock that Kyiv fears plays in Russia’s favor.

‘The war had come to us too’: how Ukraine’s Danube ports became vital hubs – and targets (the Guardian) With Odesa out of action, Izmail and Reni are now the only places grain can reliably be exported

Casualty Toll From Kryviy Rih Missile Strike Rises; G20 Issues Declaration On Ukraine War (RadioFreeEurope/RadioLiberty) The toll of those wounded from a Russian missile strike on the Ukrainian city of Kryviy Rih has risen to 74, as Ukrainian forces pressed their slow counteroffensive against Russian forces in southern and eastern regions.

Inside the G20’s scramble to get consensus on the war in Ukraine (POLITICO) The G20 removed its accusations against Russia in order to maintain unity on broader concepts of war and peace.

Russia-Ukraine war live: G20 declares members have ‘different views and assessments’ on the conflict (the Guardian) Leaders also state they do not believe G20 is the platform to resolve geopolitical and security issues

G20 leaders agree on declaration after softening Ukraine language (Nikkei Asia) India communique rejects nuclear threats but omits Bali's strongest condemnations

Israeli Spy Chief Says Iran's Attempts To Supply Russia With Missiles 'Foiled' (RadioFreeEurope/RadioLiberty) The head of Israel's intelligence agency said on September 10 that Iran's attempts to supply Russia with missiles had been foiled, The Times of Israel reported.

Russia turning to North Korea to resupply arsenal for war in Ukraine (Military Times) U.S. officials expect North Korean leader Kim Jong Un to visit Russia in the coming days to seal a possible deal on munitions transfer.

Putin’s collection of oddball allies grows by the day. It’s time the west got tougher (the Guardian) Russia’s isolated war-criminal president is seeking out useful idiots like North Korea’s Kim Jong-un to bolster his military rampage against Ukraine, writes Simon Tisdall

Opinion | Station U.S. Troops in Poland, Not Germany (Wall Street Journal) Warsaw and other allies on NATO’s eastern flank are vital to deterrence and are pulling their weight.

Ukraine’s counter-offensive is stalling. The West must prepare for humiliation (The Telegraph) We cannot have a repeat of the foreign-policy errors that followed Putin’s 2014 Crimean land grab

Russia's Regions Boost Spending By Half On Security Services, Police Amid Growing Repression (RadioFreeEurope/RadioLiberty) Russia's regions have ramped up spending this year on national security and law enforcement as the state intensifies its crackdown on any form of dissent amid a failing war, according to a new report.

Putin's Party, Candidates Seen Winning Tightly Controlled Regional Elections (RadioFreeEurope/RadioLiberty) Russia’s ruling party and candidates backed by the Kremlin were expected to win elections held in 85 regions across the country as well as parts of occupied Ukraine, preliminary results showed.

What Russia’s Regional Elections Mean for Putin—and Ukraine (Time) Here's what to know about the biggest elections in Russia since Vladimir Putin's decision to invade Ukraine.

Ukraine criticises Russian ‘fake elections’ in occupied regions (the Guardian) Voting taking place in Donetsk, Luhansk, Kherson and Zaporizhzhia as well as 54 Russian regions

Russia warns "all-out war" with US could erupt over worsening cyber clashes (Newsweek) "A devastative computer attack against our critical information infrastructure will not be left without response," Putin's cybersecurity envoy told Newsweek.

Influx of Russian fraudsters gives Turkish cyber crime hub new lease of life (Financial Times) Émigré hackers fleeing Putin’s military conscription prompts surge in activity involving stolen financial data

Elon Musk is Vladimir Putin’s unwitting weapon (The Telegraph) It’s a classic case of too little information proving extremely dangerous

Elon Musk ‘committed evil’ with Starlink order, says Ukrainian official (the Guardian) Ukrainian presidential adviser says deaths of civilians ‘the price of a cocktail of ignorance and big ego’

Wider Europe Briefing: Russia Sanctions Survive A Key Legal Challenge And Georgia's EU Bid Hangs By A Thread (RadioFreeEurope/RadioLiberty) I'm RFE/RL Europe Editor Rikard Jozwiak and this week I'm drilling down on two issues: How the EU sanctions on Russia survived a big legal hurdle and whether Georgia's EU dreams are slipping away.

Russian Trade Said To Be Surging, Approaching Prewar Levels, Despite Sweeping Sanctions (RadioFreeEurope/RadioLiberty) Trade at Russia’s three largest ports has been surging and is approaching prewar levels despite sweeping sanctions by the Group of Seven (G7) leading economies, according to a new report.

If Unilever truly wants ‘a world with more joy’, why is it filling Putin’s war chest? | Catherine Bennett (the Guardian) Its Russian taxes pay for 39 bullets every second but still it boasts how ethical its products are

Opinion | Corruption Is an Existential Threat to Ukraine, and Ukrainians Know It (New York Times) The fight against it amounts to a second front in Ukraine’s existential war against Russia.

Belarus's Lukashenka Sets Passport Trap To Lure Opponents Back Home (RadioFreeEurope/RadioLiberty) Belarusians living abroad will have to come home to renew or receive passports, according to a new edict by Alyaksandr Lukashenka. Opponents say it's just the latest attempt by the country's de facto ruler to round up some of the tens of thousands of critics who have fled the country since 2020.

Geolocating Russia’s Disgraced General Surovikin (Bellingcat) After his mysterious disappearance, a photo has surfaced appearing to show the general ‘alive and well’. Here’s how we geolocated it outside an elite Moscow restaurant.

Guard At One Of Putin's Palaces Flees To Ecuador, Criticizes War And Kremlin Leader (RadioFreeEurope/RadioLiberty) A guard at one of Russian President Vladimir Putin's residences in occupied Crimea has fled to Ecuador, calling the Kremlin leader a war criminal.

'Moscow Is Not Russia': A Schoolteacher Reflects On Her Year Living In Siberia (RadioFreeEurope/RadioLiberty) Nastya Subbotina, a young woman from Moscow, spent a year teaching in Siberia, where she photographed her students and the austere landscapes of Evsino, a place that resonated deeply with her.

Survivor Of Russian Air Strike Returns To Ukrainian Hometown Near Front (RadioFreeEurope/RadioLiberty) A Ukrainian woman, and the dog she credits with saving her life, visit her devastated frontline town of Orikhiv, in the country's Zaporizhzhya region. Lubov Jarova helps distribute humanitarian aid to the few holdouts who refuse to leave despite enduring near-daily attacks.

Hunting For Artyom: One Russian Family's Search For A Soldier's Body (RadioFreeEurope/RadioLiberty) Since they learned of his death in May, Artyom Ponomaryov's widow and mother-in-law have been hunting for information of where his remains are kept and often joined forces with other families from their home village that are also trying to locate their loved ones' bodies.

Pentagon IG to examine how DoD discovered billions more for Ukraine after 'valuation errors' (Breaking Defense) “The objective of this audit is to determine the extent and impact of the March 2023 estimation change for valuing assets provided under Presidential Drawdown Authority,” the Defense Department Inspector General's office wrote in a memo.

Attacks, Threats, and Vulnerabilities

Ransomware Attack Wipes Out Four Months of Sri Lankan Government Data (Infosecurity Magazine) The government’s email system has suffered from a massive ransomware attack in August

Ransomware, extortion and the cyber crime ecosystem (NCSC) The UK is a high value target for cyber criminals. Our businesses and institutions are among the foremost in the world, meaning they have three things that hostile cyber actors crave – money, information and the potential to cause widespread disruption if things go wrong.

Don’t focus on ransomware variants, say UK’s national cyber and crime agencies (Record) Trying to fight ransomware variants one at a time “is akin to treating the symptoms of an illness, and is of limited use unless the underlying disease is addressed,” say the NCSC and NCA.

Cyber sleuths thwart bids to hack Portals (The Times of India) Indian cyber security establishment is learnt to have successfully fended off multiple cyberattack attempts on Saturday as notorious hacker groups tri

Decoding Pak-based cyberattacks that targeted government sites ahead of G20 (India Today) A slew of cyberattacks was launched by a Pakistan-based hacktivist group on government websites on the eve of the G20 Summit. India Today’s OSINT team traced the root of the group and the threat actors who launched the coordinated attack.

Hacktivist Groups from Pakistan, Indonesia plans Cyber Attack on Govt's Digital Infra During G20 Summit; Reports CloudSEK (Prag News) CloudSEK's contextual AI digital risk platform, XVigil, discovered that hackers' major target is the government's digital infra...

Iranian hackers breach US aviation org via Zoho, Fortinet bugs (BleepingComputer) State-backed hacking groups have breached a U.S. aeronautical organization using exploits targeting critical Zoho and Fortinet vulnerabilities, a joint advisory published by CISA, the FBI, and the United States Cyber Command (USCYBERCOM) revealed on Thursday.

CISA and the FBI warn of ‘multiple nation-state APT actors’ targeting US aeronautical sector (CyberSecurity Connect) Three US government agencies have warned of the activities of multiple threat groups targeting an organisation in the aeronautical industry.

Aviation sector organization hit by exploit of CVE duo (Cybersecurity Dive) Cybersecurity authorities investigated the attack by multiple threat actors who exploited known CVEs in Zoho and Fortinet products.

Multiple nation-state hackers targeted aerospace company, CISA says (Record) One vulnerability involved Zoho ManageEngine ServiceDesk Plus, and the other was in a Fortinet device, CISA and other agencies said.

Cisco ASA Zero-Day Exploited in Akira Ransomware Attacks (SecurityWeek) Cisco is warning of CVE-2023-20269, a zero-day that can be exploited remotely, without authentication, in brute force attacks

Microsoft Teams phishing attack pushes DarkGate malware (BleepingComputer) A new phishing campaign is abusing Microsoft Teams messages to send malicious attachments that install the DarkGate Loader malware.

New Phishing Campaign Launched via Google Looker Studio (SecurityWeek) Check Point has observed a wave of phishing attacks launched via Google Looker Studio to steal credentials and funds from intended victims.

Washington DC-based group targeted in apparent Pegasus hack (the Guardian) Citizen Lab discovers alleged attack using ‘zero-click exploit’ on individual employed by DC organization

HijackLoader (Zscaler) HijackLoader | Learn its tactics, evasion techniques, and modular architecture in our in-depth analysis.

New HijackLoader malware is rapidly growing in popularity (Security Affairs) Zscaler ThreatLabz detailed a new malware loader, named HijackLoader, which has grown in popularity over the past few months.

New HijackLoader Modular Malware Loader Making Waves in the Cybercrime World (Hacker News) A new malware loader called HijackLoader is gaining traction among the cybercriminal community to deliver various payloads such as DanaBot, SystemBC, and RedLine Stealer.

Emsisoft Tells Users to Update Products, Reboot Systems Due to Certificate Mishap (SecurityWeek) Emsisoft urges its users to update anti-malware and other security products after signing them with an improperly issued digital certificate.

WinRAR Vulnerability Exploitation: Decode & Bolster Protection (Uptycs) CVE-2023-38831: the WinRAR vulnerability, study its impact on digital security & learn how cybercriminals exploit file extension spoofing in popular tools

Spyware Telegram mod distributed via Google Play (Secure List) Spyware Telegram mod in Uighur and Chinese spreads through Google Play stealing messages and other user data.

Millions Infected by Spyware Hidden in Fake Telegram Apps on Google Play (The Hacker News) Beware of impostor apps in the Google Play Store. Fake Telegram apps have been stealing data from millions of Android users.

'Evil Telegram' Android apps on Google Play infected 60K with spyware (BleepingComputer) Several malicious Telegram clones for Android on Google Play were installed over 60,000 times, infecting people with spyware that steals user messages, contacts lists, and other data.

Cybercriminals Weaponizing Legitimate Advanced Installer Tool in Crypto-Mining Attacks (The Hacker News) Discover how cybercriminals are abusing Advanced Installer, a popular software installation packaging tool, to deploy cryptocurrency mining malware.

Massive DDoS attack on U.S. financial company thwarted by cyber firm (Record) The thwarted distributed denial-of-service attack against the unnamed financial giant peaked at an astonishing 633.7 gigabits of traffic per second.

Hackers Use Solana Discord to Pull Off Another Vile Attack (Coin Republic) Hackers targeted Solana’s Discord channel to dupe its users in a recent attack. The attack drew attention to the network’s vulnerable mechanism that has been compromised before. Experts have highlighted some useful tips on how to secure Discord from such happenstances.

Akamai Prevents the Largest DDoS Attack on a U.S. Financial Company (Akamai) On September 5, 2023, at approximately 19:31 UTC, Akamai Prolexic, our distributed denial-of-service (DDoS) defense platform, successfully detected and prevented the largest DDoS attack directed at one of the biggest and most influential U.S. financial institutions on the Prolexic platform.

Your Wyze webcam might have let other owners peek into your house (The Verge) Wyze’s web viewer was showing unexpected feeds.

Carmakers can collect — and sell — too much data about you, watchdog says (Washington Post) Car companies are collecting “too much personal data” from drivers, who have little freedom to opt out, researchers wrote in a report assessing the data privacy policies of 25 automobile brands.

Ragnar Locker gang leaks data stolen from the Israel's Mayanei Hayeshua hospital (Security Affairs) The Ragnar Locker ransomware gang added Israel's Mayanei Hayeshua hospital to the list of victims on its Tor leak site

Associated Press warns that AP Stylebook data breach led to phishing attack (BleepingComputer) The Associated Press is warning of a data breach impacting AP Stylebook customers where the attackers used the stolen data to conduct targeted phishing attacks.

Ransomware gang steals 1.3TB of data from Sabre (Cyber Security Hub) The data stolen allegedly includes corporate financial information, passenger turnover and ticket sales data and personal employee information

CT hospital cyberattack may have breached patient data (CT Mirror) Over a month after three CT hospitals suffered a cyberattack, some systems are offline and some outpatient services are not available.

IT Systems Encrypted After UK School Hit By Ransomware (Infosecurity Magazine) Maidstone’s St Augustine Academy is latest victim

Maidstone: Secondary school hit by cyber attack (BBC News) The head of St Augustine Academy in Maidstone says it has fallen victim to "a serious IT breach".

Cape Cod Boat Captain Falls in Love With a Ghost (AARP) A man finds romance with a woman online who claims to be in Hong Kong. Her offer of "foreign investment opportunities" is actually a crypto scam.

The Initial Access Broker Economy: A Deep Dive into Dark Web Hacking Forums (BleepingComputer) Initial access brokers (IAB) are cybercriminals that focus on gaining access to corporate environments, which they then auction off to other hackers. Learn more from Flare about the IAB economy and how it affects your business.

Security Patches, Mitigations, and Software Updates

CISA Adds Critical RocketMQ Bug to Must-Patch List (Infosecurity Magazine) Apache flaw can enable remote command execution

Trends

Singapore and Southeast Asia: Threat Landscape (Cyfirma) EXECUTIVE SUMMARY This data-driven report examines the cybersecurity dynamics of the region, with a specific focus on Singapore. It examines...

2023 State of API Security Report: Global Findings (Traceable API Security) Download and Stay Ahead: Equip your enterprise with the cutting-edge knowledge required to fortify your API security strategy for 2023 and beyond.

Three trends to watch in the growing threat landscape (CXOToday) By Augusto Barros It’s no secret that the threat landscape is rapidly changing. Securonix Autonomous Threat Sweeper (ATS), for example, observed 1,588 global cyber threats over the past year. With new threats on the horizon daily, industries around the world are scrambling to protect their businesses. The good news is that the cybersecurity industry has

Australian Data Breach Costs are Rising — What Can IT Leaders Do? (Tech Republic) Australian data breach costs have jumped over the last five years to $2.57 million USD, according to IBM. Prioritizing DevSecOps and incident response planning can help IT leaders minimize the financial risk.

Marketplace

One of the most successful VCs in cybersecurity, Ted Schlein, names 3 new trends to watch (Business Insider) After quietly leaving Kleiner Perkins nearly two years ago, Schlein sees three new cybersecurity trends he's ready to fund.

Layoffs hit the once-immune cyber industry (Axios) Hundreds of cybersecurity workers have received pink slips in the last few months, despite early expectations that the industry would be spared the tech sector's wave of layoffs.

‘No lasting impact’: cyber events don’t dictate stock market (Insurance News) Insurance-linked securities (ILS) are a key source of potential new cyber reinsurance capacity, and issuers should put aside concern over a "perceived correlation” between cyber events and stock market performance, Guy Carpenter says.

0xPass raises $1.8M from Balaji Srinivasan and others to build secure login systems for web3 (TechCrunch) 0xPass is among the many startups trying to make crypto wallets secure and convenient for mass adoption. Specifically, it's solving the login piece of

Cybersecurity is a complex challenge. Here are companies looking to provide innovative solutions (SiliconANGLE) There’s no question that organizations are facing challenges in cybersecurity that are more complex and more pressing than ever before.

Golling: Munich Re prepared to give up cyber business over accumulation concerns (The Insurer) Munich Re management board member Stefan Golling has warned that the carrier – the industry’s largest cyber reinsurer – is prepared to exit business within the class...

SentinelOne Earnings: Execution Appears To Be Improving as Macro Conditions Stabilize (Morningstar, Inc.) Morningstar is an investment research company offering mutual fund, ETF, and stock analysis, ratings, and data, and portfolio tools. Discover actionable insights today.

CyberArk Named a Leader in 2023 Gartner Magic Quadrant for Privileged Access Management (Business Wire) CyberArk (NASDAQ: CYBR), the identity security company, today announced it has been named a Leader in the 2023 Gartner® Magic Quadrant™ for Privileged Access Management.1 CyberArk is recognized in this report for the fifth consecutive time. Additionally, CyberArk is the only vendor positioned as a Leader in both Gartner Magic Quadrant Privileged Access Management (PAM) and Access Management2 reports.

Maryland cybersecurity firm expands into Port San Antonio (San Antonio Report) An executive with IntelliGenesis said the company expanded into Port San Antonio because the port is becoming the "epicenter" of the cybersecurity industry.

Products, Services, and Solutions

New infosec products of the week: September 8, 2023 (Help Net Security) The featured infosec products this week are from: CyberSaint, Ghost Security, Hornetsecurity, NTT Security Holdings, and TXOne Networks.

Panorays Teams Up with HALOCK Security Labs to Launch Streamlined Third-Party Supplier Management Solution (GlobeNewswire News Room) The new solution prioritizes comprehensive third party supplier monitoring and assessments...

QED to Extend Cybersecurity Monitoring for US Air Force (The Defense Post) QED Secure Solutions has received a contract to continue supporting the cybersecurity of weapons and other vital assets in the US Air Force.

KATI signs accord with global cyber security giant (Brecorder) KARACHI: In a significant move to bolster the Information Technology (IT) sector in Pakistan, the Korangi ...

Cyber Criminals, The Silent Brand Assassins Lurking in the Shadows (Digital Journal) As companies rely more & more on technology, a new threat has emerged that can tarnish even the most pristine of brand images: cyber threats. Recent revelations from trusted sources have unveiled the profound impact that cybersecurity incidents can have on a company's public image and branding.

Arqit and Exclusive Networks announce US distribution partnership (GlobeNewswire News Room) Arqit Quantum Inc. (Nasdaq: ARQQ, ARQQW) (Arqit), a leader in quantum-safe encryption, and Exclusive Networks...

Fortinet and Wiz Team Up to Protect Enterprise Cloud Workload Environments (Financial Post) Technology alliance partnership between industry leaders aims to deliver cloud-native security protections for joint customers

iLobby Announces SecurityOS – A PIAM Solution for Visitors, Contractors, and Temporary Employees (GlobeNewswire News Room) iLobby, the global leader in enterprise facility and visitor management solutions, today announced the...

Technologies, Techniques, and Standards

Building a Resilient Digital Future: NIST’s Impact on Cybersecurity (SecurityHQ) The significance of NIST in the cybersecurity landscape, with a particular emphasis on NIST 830 and SP 853, and how to stay cyber resilient.

Nothing from the government comes without gobs of documentation (Federal News Network) The Cybersecurity Maturity Model Certification program has been in gestation at the Defense Department longer than a baby elephant. CMMC is still not operational, but, boy, has it produced documents.

Why Cybersecurity Is Indispensable In Online Gaming Industry (ABP Live) With cyber threats sitting at the back of every industry, it’s extremely important to adopt proactive measures to safeguard themselves and their users.

Design and Innovation

Your Gmail and Instagram are training AI. There’s little you can do about it. (Washington Post) It’s your data. Do you know what Big Tech is doing with it? Our tech columnist found Google, Meta and Microsoft are taking your conversations, photos or documents to teach their their AI.

Facebook Trains Its AI on Your Data. Opting Out May Be Futile (WIRED) Here's how to request that your personal information not be used to train Meta's AI model. "Request" is the operative word here.

Academia

Hands-On Learning Experiences Encourage Cybersecurity Career Discovery (NIST) With a mention in the new National Cyber Workforce and Education Strategy and even a dedicated state law, K–12 cybersecurity education clearly has the eye of policymakers.

Legislation, Policy, and Regulation

Re-Envisioning the Cyber Domain for Deterrence (The Strategy Bridge) By adjusting our paradigm for understanding the threats and opportunities in cyberspace, the United States can incrementally build cyber deterrence to shift the balance toward stability. States will still develop and exploit vulnerabilities. However, the proliferation of simple cyber tools for crimi

Polish Senate says use of government spyware is illegal in the country (TechCrunch) A Polish Senate commission concluded that Poland government's use of spyware made by NSO Group was illegal and influenced the 2019 elections.

As China steps up cybersecurity enforcement, smaller businesses feel the heat (South China Morning Post) Authorities have begun warning small business owners to improve their data security measures, or face penalties.

Sleight of hand: How China weaponizes software vulnerabilities (Atlantic Council) China's new vulnerability management system mandates reporting to MIIT within 48 hours, restricting pre-patch publication and POC code. This centralized approach contrasts with the US voluntary system, potentially aiding Chinese intelligence. MIIT shares data with the MSS, affecting voluntary databases as well. MSS also fund firms to provide vulnerabilities for their offensive potential.

Meet the Facebook lobbyist-turned-lord fighting Britain’s encryption crackdown (POLITICO) Richard Allan — and a host of tech execs — are working to thwart rules that could see encrypted messenger apps monitored.

New strategy for global cybersecurity cooperation coming soon: State cyber ambassador (Breaking Defense) “The war in Ukraine has cast a very dark shadow,” ambassador-at-large Nate Fick said – but the “silver lining” is a new seriousness about public-private cooperation against global cyber threats.

Achieving the National Cyber Strategy hinges on joint collaboration (Federal Times) Recent research shows a 37% increase in global ransomware attacks, with the U.S. as the most affected country.

Amid shutdown anxiety, federal agencies are running up against an IT security deadline (Nextgov.com) While budget negotiations play out on Capitol Hill, federal agency CIOs are also on the clock to ensure the bulk of their information technology is reported through the CDM program.

HHS looks to improve cybersecurity coordination (Nextgov.com) The agency is utilizing a relaunched cybersecurity coordination center and additional programs to significantly ramp up interactions with key partners, a top official said.

Senators want a special government unit to help small businesses with cyberattacks (SC Media) A quartet of senators introduced The Small Business Cyber Resiliency Act that would establish a new Central Small Business Cybersecurity Unit within the Small Business Administration.

White House Privately Rejects Congress’s Demand for New Crisis Plan for US Economy (Exclusive) (The Messenger) Lawmakers wanted a single comprehensive blueprint for stabilizing daily life amid a massive cyberattack or other emergency. The Biden administration says that’s unnecessary

Don’t buy intel community spin on Section 702 (The Hill) Former attorneys for the National Security Agency and other parts of the federal intelligence community are busy warning members of Congress about the grave dangers of surveillance reform.

House Lawmakers Raise Concerns on SEC's New Cybersecurity Disclosure Rules (Executive Gov) Looking for the latest Government Contracting News? Read about House Lawmakers Raise Concerns on SEC's New Cybersecurity Disclosure Rules.

New SEC Rules Push Cybersecurity to the Top of the Inbox (Nasdaq) If you had the U.S. Securities and Exchange Commission on your bingo card for shaking up the cybersecurity sector this year, congratulations!

Ohio Air National Guard’s 179th Airlift Wing Redesignated as Cyberspace Wing (The 1014) Ohio Air National Guard’s 179th Airlift Wing Redesignated as Cyberspace Wing - The 1014

Litigation, Investigation, and Law Enforcement

The Hague to Probe Cyberwarfare Under Existing International Law (CircleID) In a recent article published by WIRED Magazine, a significant shift in international law regarding cyberwarfare has been brought to light. The International Criminal Court (ICC) at the Hague has signaled its intention to investigate and prosecute hacking crimes that breach existing international law without the need for new regulations.

French lawmaker challenges transatlantic data deal before EU court (POLITICO) MP Philippe Latombe launches the latest round of legal fighting.

What a new ruling in a social media case means for cyber agencies (Washington Post) Court ruling frees CISA, but leaves FBI with restrictions on countering misinformation and disinformation

South Africa’s privacy watchdog investigating data breaches at credit bureaus (My Broadband) The Information Regulator of South Africa says it is close to revealing the outcome of its investigation into the much-reported TransUnion data breach in 2022. However, the probe into a major 2020 Experian breach could still take some time.

Foreign student arrested in Norway on suspicion of espionage including electronic eavesdropping (ABC News) A 25-year-old foreign student has been arrested in Norway on suspicion of espionage including illegal eavesdropping through various technical devices

Intelligence services set to unmask China spies (The Telegraph) Suspected agents working in House of Commons could face espionage charges

China’s military seeks to exploit U.S. troops, veterans, general warns (Washington Post) A memo obtained by The Post says Beijing is working to enhance its armed forces by targeting Americans with specialized skills and training

Trickbot, Conti Sanctions Affect Top Cybercrime Brass (Dark Reading) US Treasury officials said the sanctions move is part of its effort to combat Russian state-sponsored cybercrime.

Dallas Delays Release of Ransomware Response Report (GovTech) An internal report reviewing Dallas’ response to a ransomware attack that was planned to be published Wednesday could now have its public release delayed up to two weeks, city officials say.

Willis asks court to protect jurors after doxing in Trump's Georgia case (Axios) Fulton County District Attorney Fani Willis asked a judge on Wednesday to take steps to protect jurors who indicted former President Trump and over a dozen of his allies for their alleged attempts to flip Georgia's election results in 2020.

Russian infosec boss gets nine years for hack-and-trade op (Register) Confidential figures for Tesla, Snap, Roku, Avnet, others swiped and used to rack up millions in ill-gotten gains

How the largest U.S. crypto exchange is brawling with the SEC (Axios) When the Securities and Exchange Commission comes knocking, most companies clam up and hunker down, but that's not the way Coinbase Global is doing it.

Meta Platforms must face medical privacy class action (Reuters) A U.S. federal judge said Meta Platforms must face a lawsuit claiming that it violated the medical privacy of patients who were treated by hospitals and other healthcare providers that used its Meta Pixel tracking tool.

Swatting started in the gaming world and it’s coming for the rest of us (Record) The prank of choice among the young cyber set is swatting: calling in a hoax report that sends police, guns drawn, to the dwelling of an unsuspecting victim. The Click Here podcast team talks with an expert about what can be done to track and deter swatting.

CFTC Cracks Down on DeFi Firms Over Crypto Derivatives Trading (Wall Street Journal) Opyn, ZeroEx and Deridex agreed to fines to settle charges that they illegally offered derivatives trading in cryptocurrency.

Boss of Failed Crypto Exchange Gets 11,196-Year Sentence (Wall Street Journal) The founder of a collapsed cryptocurrency exchange has been sentenced to more than 11 millennia in jail. The 11,196-year sentence was handed down late Thursday by a panel of judges in Turkey to Faruk Fatih Özer, Turkey’s state-run Anadolu Agency [reported](https://www.aa.com.tr/tr/gundem/thodexin-k

Bankrupt AI Startup Vesttoo Accuses Founders of Forgery, Impersonation (Wall Street Journal) The co-founders of Israeli artificial intelligence startup Vesttoo ran a forgery scheme that included a fake bank employee persona to obtain billions of dollars in bogus letters of credit for insurance deals, the now-bankrupt company said.

Pretrial-palooza underway for Trump (Washington Post) Welcome to The Trump Trials, our newest effort to keep readers up to date on the many criminal cases the 45th president is fighting in federal and state courts.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

ISSA Central Maryland Membership Meeting (Columbia, Maryland, USA, Sep 27, 2023) We have all seen Crime Lab technicians on television shows such as NCIS and CSI analyzing evidence to try solve crimes. How accurate is television’s portrayal? Hear from experts who work for the Baltimore City Police Department about what they do to analyze and assess evidence. Learn about what tools and techniques are being used to fight crime. What training does it take to do this type of work? Be able to tell your friends if what they are watching on television is the way it really is!

Events

SANS Network Security 2023 (Las Vegas, Nevada, USA, Sep 6 - 11, 2023) At SANS Network Security 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Borderless Cyber: Cybersecurity Meets Privacy (Egham, Surrey, UK, Sep 11 - 12, 2023) 'Cybersecurity Meets Privacy' Royal Holloway, University of London 11-12 September 2023 Egham, Surrey, UK Borderless Cyber is unique, focusing on the convergence of the cybersecurity and privacy disciplines and addressing new technologies, research, operationalization realities, risks, and solutions. It brings together international experts and offers opportunities for networking, good dialogue, and future collaboration. It promises to be illuminating and challenging! Speakers from Uber, Meta, Vodafone, NATO NCI, Intel, CISA, Infosys, ITU, the UK Home Office, and other organizations are included in the recently released program.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Sep 11 - 15, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

Insider Threat Program Development - Management Training Course (Tysons Corner, Virginia, USA, Sep 12 - 13, 2023) The training course will be taught on September 12-13, 2023. This highly sought after and very comprehensive 2 day training course will ensure that the ITP Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. This training will also provide students with an in depth view of how to obtain visibility of potential or malicious employee actions on computer systems and networks, using Insider Threat Detection software. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

2023 PCI SSC North America Community Meeting (Portland, Oregon, USA, Sep 12 - 14, 2023) Join your global payment security peers at the 2023 PCI SSC Community Meetings! PCI SSC Community Meetings bring together the brightest minds in payment security. Don’t miss the opportunity to collaborate and learn about the latest developments in global payment security and in the PCI Security Standards.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.