Iranian cyberespionage campaign: "Peach Sandstorm." Cyberattack against Colombian telco. Python NodeStealer takes credentials. Update on MGM, Caesars incidents.

Summary

By the CyberWire staff

At a glance.

Iranian cyberespionage campaign: "Peach Sandstorm."
Cyberattack against telecom provider affects Colombian government, corporate online operations.
Python NodeStealer takes browser credentials.
Caesars Entertainment files its 8-K.
Some MGM Entertainment systems remain down.
Considering Internet autarky for information control.
Starlink service in the Black Sea.
Third-party incident affects Manchester police.

Iranian cyberespionage campaign: "Peach Sandstorm."

Microsoft warns that the Iranian state-sponsored actor Peach Sandstorm (which Microsoft formerly tracked as “HOLMIUM”) has been launching password-spraying campaigns against thousands of organizations since February 2023, with a particular focus on the satellite, defense, and pharmaceutical sectors. The goal of the campaign appears to be espionage. In a small number of cases, the threat actor succeeded in breaching organizations and exfiltrating data. Microsoft says, “The capabilities observed in this campaign are concerning as Microsoft saw Peach Sandstorm use legitimate credentials (gleaned from password spray attacks) to authenticate to targets’ systems, persist in targets’ environments, and deploy a range of tools to carry out additional activity. Peach Sandstorm also created new Azure subscriptions and leveraged the access these subscriptions provided to conduct additional attacks in other organizations’ environments.”

Cyberattack against telecom provider affects Colombian government, corporate online operations.

An incident broadly characterized as a cyberattack that began Tuesday hit Colombian telco IFX Networks and has affected the company's customers. These include, according to statements by Colombia's ICT Ministry cited by Bnamerica's, some seven-hundred-sixty companies in Latin America as well as at least twenty Colombian government agencies. The agencies include the health ministry, the health regulator, and the superior council of the judiciary. Colombia's cybersecurity unit, PMU Ciber, has established a command post to cope with the emergency. The judiciary seems to have been particularly hard-hit, and many courts will suspend operations until September 20th. Colombia Reports says that early indications are that IFX Networks was the target of a ransomware attack, obviously criminal and presumably financially motivated.

Earn your cybersecurity master’s from an NSA-recognized institution.

Further your career and secure your future with an advanced degree from the George Washington University — choose from 100% online master’s in cybersecurity analytics or in cybersecurity policy & compliance. Designed by D.C. experts and taught by cybersecurity leaders, these programs integrate computer science and engineering courses to give you the well-rounded expertise you need for leadership roles and professional advancement. Discover how you can get a world-class education made for working professionals.

Python NodeStealer takes browser credentials.

Netskope describes a campaign that’s using Python scripts to steal Facebook business account credentials, along with all available cookies and credentials stored by the browser. The malware is a new version of NodeStealer, distributed via Facebook Messenger: “The new NodeStealer variant we detected was hosted on the Facebook CDN and was sent to victims as an attachment in Facebook messages. Images of defective products were used as bait to convince owners or admins of Facebook business pages to download the malware payload. Unlike previous NodeStealer campaigns, this one uses a batch file instead of an executable as the initial payload.”

Caesars Entertainment files its 8-K.

As expected, Caesars Entertainment filed its 8-K with the SEC on Thursday, at roughly noon Eastern Time. The company said that its "customer-facing operations, including our physical properties and our online and mobile gaming applications," were unaffected. But "customer-facing operations" don't extend to all customer data. In particular, Caesar's loyalty program database was compromised. The information acquired by "an unauthorized actor" includes "driver’s license numbers and/or social security numbers for a significant number of members in the database." The company is continuing to investigate, but so far has found no signs that member credentials, bank account information, or paycard data were exposed. Despite that preliminary finding, Caesars is extending credit monitoring and identity theft protection to affected customers, whom it will be notifying over coming weeks.

Caesars said, "We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result." This has been widely interpreted as an acknowledgement that the company negotiated a ransom payment with the criminals who took its data. The Wall Street Journal put the amount of ransom paid at $15 million, half the $30 million the attackers demanded. In addition to hardening its own systems, the company said it had "taken steps to ensure that the specific outsourced IT support vendor involved in this matter has implemented corrective measures to protect against future attacks that could pose a threat to our systems." Caesars said it had incurred some expenses due to the attack, and might incur others as investigation and remediation proceed. It also acknowledged the difficulty of predicting the incident's effect on guest behavior. Nonetheless, "we currently do not expect that [the incident] will have a material effect on the Company’s financial condition and results of operations." So Caesars has made its assessment of materiality and decided that, for now, the incident is unlikely to have a material impact.

Why AI Is at Risk for Supply Chain Attacks and How You Can Address It.

As companies rush AI applications to market, pre-built open source binaries such as Python wheels have become widely adopted, even as they pose an increasing risk for supply chain attacks.

This webinar covers:

What are pre-built binaries and Python wheels
The state of open source software supply chain risks
How organizations can ensure secure, scalable use of open source for AI, even in the cloud

Some MGM Entertainment systems remain down.

Cyber criminals appear to have stolen six terabytes of data from MGM Resorts and Caesars Entertainment, Reuters reports. Scattered Spider, an anglophone affiliate of ALPHV, has been talking up its attack against MGM Resorts in particular. Members of the group have been boasting in their Telegram channels that their original plan was to rig slot machines and use money mules to drain them, but, when that didn't work out, they fell back on traditional social engineering to gain access to the company's systems in a ransomware operation. The Financial Times writes that the Spiders "evaded detection from the company’s security team by using common remote login software, and access to MGM’s corporate VPN to impersonate an employee’s digital footprint. They ran their malware remotely and claim to have penetrated the system within five hours of starting the attack, and evaded detection for eight days." A principal key to the gang's social engineering success is native proficiency in English and good idiomatic control, which rendered their approach more plausible that the usual "Hello Dear One" phishing emails so many non-native-speaking gangs use.

The AP reports that some MGM Entertainment systems remain unavailable in the aftermath of the attack. According to BleepingComputer, there was more to the attack than data theft. The attackers claim they also encrypted more than 100 ESXi hypervisors. A statement by ALPHV (also known as BlackCat) said, “After waiting a day, we successfully launched ransomware attacks against more than 100 ESXi hypervisors in their environment on September 11th after trying to get in touch but failing. This was after they brought in external firms for assistance in containing the incident.” BleepingComputer also cites researchers at Mandiant who see a possible overlap between Scattered Spider and the Lapsu$ Group. In addition to overlapping tactics, there's an unusual demographic similarity that circumstantially suggests a connection: both groups are largely composed of English-speaking teenagers and young adults. For more on the casino cyber incidents, see CyberWire Pro, here and here.

Considering Internet autarky for information control.

Cybernews reports a growing mood in Russia's Duma that favors tighter control over online information. Virtual private networks (VPNs) would be restricted or banned under measures being discussed by lawmakers. Sentiment in favor of giving Roskomnadzor, the nation's Internet governance agency, tighter control over information is growing but not yet unanimous. The model for the restrictions under consideration is China's Great Firewall, a restrictive but imperfect and to a degree porous system of information control.

Fortra Discusses Developing the Framework for a Culture of Security Awareness.

From gaining buy-in to staying engaged during leadership churn, Fortra walks you through the ins-and-outs of bringing a culture of cybersecurity to your company. With over two decades of security awareness training expertise, we know the pitfalls and can prepare you for persistent success. Learn from our experience how to:

Communicate a cybersecurity framework
Increase engagement
Plan for leadership turnover
Leverage safety net technology
And more

Read Now.

Starlink service in the Black Sea.

US Senator Elizabeth Warren (Democrat of Massachusetts) wants, Axios reports, a Congressional investigation into Starlink's decision to decline providing service in the vicinity of Sevastopol last year. The absence of Starlink connectivity interfered with Ukrainian plans for a drone strike against units of Russia's Black Sea Fleet. She's particularly concerned about the specifics of contracts the US might have with SpaceX, and the vulnerability of purchased services to corporate decisions. "We need to investigate how this happened, what's in those contracts that permits him to have this kind of power," she said. She also called for a Defense Department investigation: "That kind of activity poses a danger to the United States, to Ukraine and to the rest of the world."

Secretary of the Air Force Frank Kendall took a more relaxed view of Starlink's decision. In an interview with CNBC at this week's Air Force Association’s annual Air, Space & Cyber conference, Secretary Kendall said, “At the time, SpaceX made some unilateral decisions about what to do for Ukraine. They were not on contract to the U.S. ... I think they were definitely donating their services essentially, so they had discretion." He doesn't believe Defense Department contracting has loopholes that would enable contractors to make operational decisions. “We write our contracts to basically ensure that we can get the services we need, as expected from them, and those are enforceable contracts, whatever the business arrangement may be — whether it’s individual ownership or a publicly held company. We write agreements with those businesses, they get us what we need at a reasonable cost,” he added. Those contracts, he said, are enforceable.

Starlink connectivity, or any absence thereof, has not seemed to be an operational issue for Ukrainian forces in the region since last year.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

SlashNext Complete™ AI Security for Email, Mobile and Browser

At SlashNext, we know the demands of a changing and growing threat landscape increase the need to protect people where they work in real time. That’s why SlashNext Complete delivers zero-hour protection for how people work today across email, mobile, and browser apps. With SlashNext’s generative AI to defend against advanced business email compromise, smishing, spear phishing, executive impersonation, and financial fraud, your people are always protected anywhere they work. Request a demo today.

Third-party incident affects Manchester police.

A ransomware attack against a third-party vendor led to the theft of personal data belonging to Manchester police officers, BleepingComputer reports. Greater Manchester Police (GMP) Assistant Chief Constable Colin McFarlane said in a statement, “We are aware of a ransomware attack affecting a third-party supplier of various UK organisations, including GMP, which holds some information on those employed by GMP. At this stage, it’s not believed this data includes financial information.” The Record notes that the UK’s National Crime Agency is assisting in the investigation.

Notes.

Today's issue includes events affecting Belarus, China, Colombia, the European Union, Georgia, Iran, Israel, Japan, the Democratic People's Republic of Korea, New Zealand, Russia, Slovakia, Turkey, Ukraine, the United Arab Emirates, the United Kingdom, and the United States.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+568: Anti-shipping strikes assessed. (CyberWire) An increasingly isolated President Putin holds summits with North Korean and Belarusian leaders.

Russia-Ukraine war: List of key events, day 569 (Al Jazeera) As the war enters its 569th day, these are the main developments.

Ukraine hits Russian naval vessels and an air defence system in Crimea strikes (the Guardian) Satellite footage shows damage to landing ship and submarine in Sevastopol while large explosions seen near Yevpatoriya

Ukraine-Russia war: Russia's most advanced air defence system destroyed in Crimea (The Telegraph) Ukraine destroyed one of Russia’s most sophisticated air defence systems in a complex missile and drone strike in occupied Crimea on Thursday, leaving Moscow’s Black Sea Fleet “almost completely defenceless”.

Ukrainian forces reclaim a village in the east as part of counteroffensive (AP News) Ukrainian forces say they have recaptured a village in the country’s east after intense battles with Russian troops.

Russian pilot tried to shoot down a British spy plane last fall–BBC (Military Times) Intercepted communications suggest the pilot of a Russian Su-27 fighter jet fired on the unarmed U.K. plane in September 2022.

Russian Air Force Trades Efficacy for Survival Over Ukraine, USAFE Boss Says (Air & Space Forces Magazine) The Russian Air Force has substantially revised its tactics in Ukraine and has limited its losses, Gen. James B. Hecker said Sept. 13.

The triumph of British Storm Shadow missiles in Ukraine shames Joe Biden (The Telegraph) If Kyiv is unable to penetrate Russian defensive lines, the only other realistic option is a peace agreement on favourable terms to Putin

Why There Are No Game-Changing Weapons for Ukraine (Foreign Policy) There is no alternative to slowly and methodically reducing Russian forces in Ukraine.

Ukraine’s drone strikes are a window into the future of warfare (Atlantic Council) Kyiv’s innovations will usher in a new generation of do-it-yourself drone technology, making their use a routine feature of warfare.

Zelenskyy is expected to visit Washington as Congress is debating $24 billion in aid for Ukraine (AP News) Ukrainian President Volodymyr Zelenskyy is expected on Capitol Hill and at the White House next week.

Volodymyr Zelensky to visit Washington next week. (New York Times) The Ukrainian leader will go from an appearance at the United Nations General Assembly to the capital to meet with President Biden and members of Congress.

Biden asks Congress for $40 billion to support Ukraine, replenish US disaster aid and bolster border (AP News) The Biden administration is asking Congress to provide more than $13 billion in emergency defense aid to Ukraine and an additional $8 billion for humanitarian support through the end of the year.

Mitt Romney exclusive: Damage caused to Russia makes Ukraine investment worth it (The Telegraph) Departing senator for Utah hits out at critics of funding for Kyiv and laments state of his party under sway of Donald Trump

Putin 'Gratefully' Accepts Kim Invite To Visit North Korea (RadioFreeEurope/RadioLiberty) Russian President Vladimir Putin has accepted Kim Jong Un's invitation to visit North Korea, stoking U.S. concerns that a revived Moscow-Pyongyang axis could bolster Russia's military in Ukraine and provide Kim sensitive missile technology.

Putin gives Kim Jong-un parting gifts as tour ends early (The Telegraph) Russian president flies off to meet with Belarusian leader after further scheduled meetings appear to have been cancelled

Putin's North Korean “pariah summit” underlines his international isolation (Atlantic Council) Vladimir Putin's recent meeting with North Korean dictator Kim Jong Un was a "Pariah Summit" that underlined the scale of Russia's international isolation as a result of the country's criminal Ukraine invasion, writes Peter Dickinson.

Putin may just have made his greatest blunder yet (The Telegraph) The Russian president is playing with fire by seeking a closer relationship with the unstable Kim regime

Japan’s new foreign minister condemns Russian aggression against Ukraine (Ukrinform) Newly appointed Foreign Minister of Japan Yoko Kamikawa has condemned Russia's invasion of Ukraine and promised to maintain severe economic sanctions against the Russian Federation. — Ukrinform.

New U.S. Sanctions Target Workarounds That Let Russia Get Western Tech For War (RadioFreeEurope/RadioLiberty) The United States says that it's placing sanctions on more than 150 businesses and people from Russia to Turkey, the United Arab Emirates, and Georgia to try to crack down on evasion and deny the Kremlin access to technology, money, and financial channels that fuel its war in Ukraine.

New US sanctions target workarounds that let Russia get Western tech for war (Federal News Network) The United States is sanctioning more than 150 businesses and individuals as it tries to crack down on evasion and deny Russia access to technology, money and financial channels that fuel Moscow'

U.S. Sanctions More Than 150 Entities Accused of Aiding Russia (Wall Street Journal) The U.S. issues sanctions to more than 150 foreign companies and individuals allegedly shipping American technology to Russia.

Labeled An 'Accomplice' To Russian Crimes In Ukraine, Lukashenka To Meet Putin (RadioFreeEurope/RadioLiberty) Authoritarian Belarusian ruler Alyaksandr Lukashenka will meet with his Russian counterpart, Vladimir Putin, on September 15 in the resort city of Sochi for talks on closer economic cooperation, as the two countries become further isolated internationally over the Kremlin's invasion of Ukraine.

Images Show Wagner Camp In Belarus Continues To Shrink (RadioFreeEurope/RadioLiberty) The first images since the confirmation of the death of Yevgeny Prigozhin show that a suspected tent camp thought to be occupied by troops from Russia's Wagner mercenary group near the Belarusian village of Tsel, has been further dismantled.

Slovakia Expels Russian Embassy Employee (RadioFreeEurope/RadioLiberty) Slovakia said on September 14 it was expelling an employee of the Russian Embassy in Bratislava for activities in "direct violation" of the Vienna Convention on Diplomatic Relations.

Russia expels 2 US diplomats, accusing them of ‘illegal activity’ (Federal News Network) Russia’s Foreign Ministry has declared two U.S. diplomats “persona non grata” and is ordering them to leave the country within seven days for alleged involvement in “illegal activity.” In a statement…

U.S. Will 'Respond Appropriately' To Russian Expulsion Of Diplomats (RadioFreeEurope/RadioLiberty) The U.S. Embassy in Moscow has rejected the "unprovoked expulsion" by Russia of two diplomats, saying that the United States "will respond appropriately."

Putin’s Useful Priests (Foreign Affairs) The Russian Orthodox Church and the Kremlin’s hidden influence campaign in the West.

Russia inches closer to Chinese-style great firewall (Cybernews) Digital rights advocates warn that Russian authorities are advancing rapidly in their efforts to achieve total control of the internet, as attempts to outlaw VPN services gain traction.

US Cyber Warfare Team Conducts ‘Defensive Hunt’ Near Russia (The Defense Post) The US Cyber Command deployed a team of cyber experts near Russia to conduct a “defensive hunt operation” amid the ongoing war in Ukraine.

US names former commerce secretary, big Democrat donor to coordinate private sector aid for Ukraine (Federal News Network) The Biden administration has tapped former Commerce Secretary and major Democratic donor Penny Pritzker to coordinate U.S. efforts to channel private sector reconstruction assistance to Ukraine.

Now is the time for businesses to look at Ukraine (Atlantic Council) Ukraine's reconstruction promises to be the largest national recovery project in Europe since World War II and will create unique business opportunities, writes AmCham Ukraine's Andy Hunder.

CRDF Global’s Consortium Facilitates Public-Private Partnership to Boost Ukraine’s Cyber Defense; Tina Dolph Quoted (Executive Biz) CRDF Global and its consortium of industry partners have mobilized support from the private sector to help the Ukrainian government build up its cyber defense and infrastructure in the wake of the Russian invasion.

Former lawyer who called to seize power in Ukraine exposed (Yahoo News) The Security Service of Ukraine (SSU) reports about having exposed a former lawyer, who contributed to the work of Wagner PMC Telegram channel, calling to seize power in Ukraine, in the city of Kyiv. Source: SSU; the Kyiv City Prosecutor's Office; sources of Ukrainska Pravda in law enforcement agencies Quote by SSU: "Cyber specialists of the SSU have exposed a former lawyer, who publicly called for forceful seizure of state power in Ukraine, in Kyiv.

Miami-Based Businessman Pleads Guilty to Conspiracy to Violate Russia-Ukraine Sanctions and to Commit International Money Laundering (U.S. Department of Justice) Sergey Karpushkin Agrees to Forfeit Over $4.7 Million in Criminal Proceeds

Warren: Congress should investigate Musk over hindered Russian navy attack (Axios) Sen. Elizabeth Warren said on Wednesday Congress should investigate Elon Musk's role in preventing a Ukrainian drone attack on Russian military ships in the Black Sea.

Russia Struggles to Contain Resurgent Inflation (Wall Street Journal) The return of fast-rising prices is a worry for the government, which has sought to shield the domestic population from the impact of the war and sanctions.

Attacks, Threats, and Vulnerabilities

BNamericas - Colombia cyberattack hits government, corpor... (BNamericas.com) Telecommunications company IFX suffered a ransomware attack.

Colombia's judicial branch thrown offline in major cyber attack (Colombia Reports) Colombia’s President Gustavo Petro held an emergency meeting with the security forces after a cyber attack took down more than two dozen government websites. The attack targeted one of the…

Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets (Microsoft) Since February 2023, Microsoft has observed password spray activity against thousands of organizations carried out by an actor we track as Peach Sandstorm (HOLMIUM). Peach Sandstorm is an Iranian nation-state threat actor who has recently pursued organizations in the satellite, defense, and pharmaceutical sectors around the globe. Based upon the profile of victim organizations targeted and the observed follow-on intrusion activity, Microsoft assesses that this initial access campaign is likely used to facilitate intelligence collection in support of Iranian state interests.

Hackers Backed by Iran Caught in Apparent Global Spy Campaign (The Messenger) A new report from Microsoft also suggests that Iranian hackers are getting better at breaching their targets

New Python NodeStealer Goes Beyond Facebook Credentials, Now Stealing All Browser Cookies and Login Credentials (Netskope) Summary Netskope Threat Labs is tracking a campaign that uses malicious Python scripts to steal Facebook users’ credentials and browser data. This

Microsoft Teams Hacks Are Back, As Storm-0324 Embraces TeamsPhisher (Dark Reading) Collaboration apps are a boost to business productivity, but also a uniquely attractive target for cyberattackers.

Cuba Ransomware Gang Continues to Evolve With Dangerous Backdoor (Dark Reading) The Russian-speaking ransomware gang continues to update its tactics while managing to steal highly sensitive information from its victims.

Shell says Australian unit BG Group hit by MOVEit cybersecurity breach (Reuters) Shell Plc said on Friday that it has identified a cybersecurity incident involving some employees who worked with the company's unit BG Group in Australia before the merger, becoming the latest victim of the MOVEit hack.

Casino giant Caesars Entertainment reports cyberattack; MGM Resorts says some systems still down (AP News) Casino company Caesars Entertainment has joined Las Vegas gambling rival MGM Resorts International in reporting a recent cyberattack.

Casino Operators Caesars and MGM Still Reeling From Cyber Attacks (Kiplinger.com) Caesars confirms breach of its loyalty program database; MGM website and operations at many properties remain down.

Groups linked to Las Vegas cyber attacks are prolific criminal hacking gangs (CyberScoop) A breach of two Las Vegas casino operators is shining a spotlight on the Scattered Spider and ALPHV hacking groups.

MGM still responding to wide-ranging cyberattack as rumors run rampant (Record) The hospitality giant, facing serious disruptions to its businesses in Las Vegas, says it is continuing to "work diligently to resolve our cybersecurity issue while addressing individual guest needs promptly."

MGM Resorts ESXi servers allegedly encrypted in ransomware attack (BleepingComputer) An affiliate of the BlackCat ransomware group, also known as APLHV, is behind the attack that disrupted MGM Resorts' operations, forcing the company to shut down IT systems.

MGM hack followed failed bid to rig slot machines, ‘Scattered Spider’ group claims (Financial Times) Person claiming to represent cybercriminals explains techniques used to evade detection by casino resort company

Hackers say they stole 6 terabytes of data from casino giants MGM, Caesars (Reuters) The Scattered Spider hacking group said on Thursday it took six terabytes of data from the systems of multi-billion-dollar casino operators MGM Resorts International and Caesars Entertainment as both companies probed the breaches.

Caesars Entertainment says customer data stolen in cyberattack (TechCrunch) The hotel and casino giant said hackers stole driver’s license numbers and Social Security numbers for a "significant number of members."

Caesars Paid Ransom After Suffering Cyberattack (Wall Street Journal) Caesars is second major casino operator hit by hackers in recent weeks.

Casino giant Caesars Entertainment confirms data breach (STLtoday.com) The company owns Horseshoe St. Louis.

Caesars Confirms Ransomware Hack, Stolen Loyalty Program Database (SecurityWeek) The hijacked data includes driver’s license numbers and/or social security numbers from a Caesars Entertainment loyalty database.

Ransomware Gang Takes Credit for Disruptive MGM Resorts Cyberattack (SecurityWeek) A known ransomware gang has taken credit for the highly disruptive attack on MGM Resorts, and the company has yet to restore impacted systems

Auckland Transport's HOP card system down after cyber attack (Newshub) "At this point in time, we believe the incident is isolated to one part of our system and that no personal or financial data has been compromised."

Phishing Attack on Cloud Provider With Fortune 500 Clients Led to $15M Crypto Theft From Fortress Trust (CoinDesk) CoinDesk has identified the vendor, previously blamed but not named by Fortress for the theft that helped spur the trust company's deal to sell itself to Ripple.

Manchester Police officers' data exposed in ransomware attack (BleepingComputer) United Kingdom's Greater Manchester Police (GMP) said earlier today that some of its employees' personal information was impacted by a ransomware attack that hit a third-party supplier.

Manchester police officers’ data stolen following ransomware attack on supplier (Record) Greater Manchester Police (GMP) said that neither financial information nor home addresses were exposed in the incident, but there is concern about organized crime groups acquiring personal details about officers.

Contractor Data Breach Impacts 8k Greater Manchester Police Officers (Hackread) The data breach affected over 8,000 Greater Manchester Police officers.

A Second Major British Police Force Suffers a Cyberattack in Less Than a Month (SecurityWeek) Personal details of thousands of police officers and staff from Greater Manchester Police have been hacked from a company that makes ID cards

Who is behind the latest wave of UK ransomware attacks? (the Guardian) Greater Manchester police becomes latest entity to fall victim to this kind of hack

McAlester Regional Health Center Files Notice of Data Breach with HHS-OCR Following Apparent Cyberattack (JD Supra) On August 21, 2023, McAlester Regional Health Center (“McAlester Regional”) filed a notice of data breach with the U.S. Department of Health and Human...

St. Paul school district discloses February data hack (Sahan Journal) The data breach is the sixth at a Minnesota educational institution in the last year. More than 43,000 student email addresses were exposed. But cybersecurity experts tell Sahan Journal the hack was “relatively minor.”

Upstate New York nonprofit hospitals still facing issues after LockBit ransomware attack (Record) Carthage Area Hospital and Claxton-Hepburn Medical Center, which serve an area with more than 200,000 people,

Private information of AFP officers is breached by Russian hackers (Mail Online) AFP officers' identities and email addresses have been uploaded on the dark web after Russian hackers launched a cyber attack on law firm HWL Ebsworth in April this year.

Microsoft Australian East Data Center control system cyber incident – unintentional or malicious? (Control Global) Operators of data centers have been primarily concerned about the cybersecurity of the IT data and networks rather than OT and control systems used to monitor and control the ...

AHA warns 'deepfakes' could impersonate hospital execs (Becker's Hospital Review) The AHA is warning of an increasing threat to hospitals from deepfakes: AI-generated synthetic audio, video or image media used by cyber actors for deceptive purposes.

Revealed: Israeli cyber firms developed an 'insane' new spyware tool. No defense exists (Haaretz.com) A Haaretz investigation reveals that Israeli cyber companies developed technology that exploits the advertising system at the heart of the online economy to monitor civilians, hack into their phones and computers, and spy on them. This terrifying capability, against which no defense currently exists, has already been sold to a nondemocratic country.

CISA Adds One Known Vulnerability to Catalog | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-26369 Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability

Security Patches, Mitigations, and Software Updates

CISA Releases Seven Industrial Control Systems Advisories | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA released seven Industrial Control Systems (ICS) advisories on September 14, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

BLASTPASS: Government agencies told to secure iPhones against spyware attacks (Tripwire) The United States's Cybersecurity and Infrastructure Security Agency, has ordered federal agencies to patch their iPhones against vulnerabilities that can be used as part of a zero-click attack.

WSJ News Exclusive | Google Extends Lifespan of Chromebooks With 10-Year Update Policy (Wall Street Journal) With the change, no existing Chromebook will expire within the next two years.

Marketplace

Netcraft Acquires FraudWatch to Reinforce Online Brand Protection (ReadITQuik) By bolstering online security measures against threats and fraud, Netcraft enhances its brand protection capabilities by acquiring Fraudwatch.

Digital forensics firm Binalyze raises $19M for enhanced cybersecurity (Tech.eu) Binalyze, a Tallinn-based cybersecurity firm, raises $19 million in Series A funding to expand its digital forensics and incident response solutions in the market.

Palo Alto Networks to expand Israel center by 250 employees (CTech) Palo Alto's Israeli R&D center is its second largest outside of its California headquarters, employing around 1,000 people

Absolute Software Recognized in 2023 Gartner® Market Guide for Zero Trust Network Access as Representative Vendor (Absolute Software) Absolute Software today announced that it has been recognized for the second year in a row as a Representative Vendor in the 2023 Gartner Market Guide for Zero Trust Network Access (ZTNA).

The Next Phase of Armis (Armis) Learn how Armis is evolving our story to become Armis, the Asset Intelligence Cybersecurity Company with our AI Powered Platform Armis Centrix™.

Products, Services, and Solutions

Socure Announces Partnership with Public to Launch Investment Service in the United Kingdom with Seamless Identity Verification (PR Newswire) Socure, the leading provider of digital identity verification and fraud solutions, announced its partnership with Public, a New York-based...

MetaGeek, an Auvik Company, Partners with Oscium to Deliver the Industry’s First Affordable, Portable Wi-Fi and Spectrum Diagnostic Tool for Wi-Fi 6E (Auvik) MetaGeek Chanalyzer and WiPry Clarity bring together the best of breed in both software and hardware to provide customers with the first affordable and portable spectrum analyzer for 6 GHz.

ThreatModeler Transforms Automotive Security by Bringing Free, Industry-Specific Threat Models to its Growing Marketplace (PR Newswire) ThreatModeler, a leader in threat modeling from design to code to cloud, today announced an expansion of its Threat Model Marketplace with the...

OTORIO Achieves ISO 27001 and IEC 62443-4-1 Certifications for Critical Infrastructure (PR Newswire) OTORIO, the leading provider of OT cyber risk management solutions, announced today its ISO 27001 certification for information security...

Trua Announces Integration With Apple Wallet That Will Lead to Secure, Seamless Identity Sharing (PR Newswire) Trua, the leader in reusable verified digital identity and screening, is integrating its Smart Wallet with the Apple Wallet, providing users an...

Estonian firm develops virtual ‘shooting range’ to test cyber defenses (C4ISRNet) CybExer Technologies works with Estonian Defence Forces, as well as the armed forces of a number of European countries including Ukraine.

Bitwarden adds passwordless SSO to make enterprise customer lives easier (ZDNET) Bitwarden is one of the more reliable and flexible password managers on the market and it just made things even easier for enterprise customers with SSO for trusted devices.

Claroty’s VRM enhancements empower security teams to quantify CPS risk posture (Help Net Security) Claroty’s newly enhanced VRM solution further empowers CISOs to efficiently prioritize vulnerabilities affecting their CPS environments.

CertiK launches SkyInsights to simplify crypto compliance and risk management (Help Net Security) Leveraging CertiK’s extensive and real-time databases, SkyInsights risk insights are enriched with more than two billion wallet address.

CompTIA Introduces Emergency Response Team for Cybersecurity Assistance (ChannelE2E) CompTIA, a nonprofit association for the IT sector, has unveiled a new Emergency Response Team (ERT) to support businesses encountering cybersecurity disruptions or incidents.

Rackspace Technology Taps Palo Alto Networks for Comprehensive Cybersecurity Solutions (GlobeNewswire News Room) Strengthening customers’ ability to stay ahead of evolving cyber threats...

Incode Technologies and MaxBet Transform Player Onboarding with AI Identity Verification (PR Newswire) Incode Technologies Inc., the global leader in next-generation identity solutions, today announced a game-changing partnership with MaxBet, a...

Technologies, Techniques, and Standards

How the State Dept discovered that Chinese hackers were reading its emails (POLITICO) The State Department relied on a clever alert system to uncover and unravel an advanced Chinese spying campaign that involved breaches of officials’ emails.

Spies working from home despite fears they could be hacked by foreign states (The Telegraph) Ministers insist that intelligence officials will be able to continue with flexible working

CISA panel pitches idea of a National Cybersecurity Alert System (Record) Without specifying what such a system would look like or how it would behave, members of the Cybersecurity Advisory Committee said the federal government should work toward "the 24/7 consideration and provisioning of cyber alerts."

Academia

UWF Center for Cybersecurity awarded $8.3 million grant to launch cybersecurity training program for Florida state and local government personnel (University of West Florida Newsroom) The University of West Florida Center for Cybersecurity received an $8.3 million grant to launch the UWF Florida Cybersecurity Training Program to provide free cybersecurity training for state and local government personnel. “We are honored to strengthen Florida’s cyber-ready workforce by equipping public sector personnel with up-to-date industry certifications, knowledge and skills,” said Dr. Eman […]

Legislation, Policy, and Regulation

The false promise of cyber conventions: Why the West is losing and what to do about it (Bulletin of the Atomic Scientists) To safeguard accountability and liberal values in cyberspace, the U.S. and Europe must refocus and strengthen their cyber diplomacy efforts.

British Military Hit by Six Million Cyber Attacks in 2022 (The Defense Post) The UK military was hit by more than six million cyber attacks last year amid the ongoing conflict in Europe and escalating tensions in Asia.

DHS warns of malicious AI use against critical infrastructure (CyberScoop) The DHS report warns of state-backed hackers using AI for both malware development and election interference.

North Korean hackers continue to attack critical US infrastructure: Pentagon (North Korea News) North Korea continues to increase cyber attacks on U.S. government departments, critical infrastructure and private businesses, according to a report from the U.S. Department of Defense (DOD), an assessment that one expert said reflects increasing recognition of the importance of cyberspace since Russia’s invasion of Ukraine. The DPRK is behind “a range of espionage and […]

DoD Turns to Stronger Alliances to Combat Cyberthreats (Security Boulevard) The Pentagon is undertaking a much more proactive approach to cybersecurity, with plans to more closely partner with the private sector and ally nations

White House Calls for Stronger Open-Source Security (Wall Street Journal) The Biden administration pushed for stronger security standards in open-source software development at a two-day summit which included technology companies, banks and industry groups.

Deputy Secretary Graves to Lead Cybersecurity Trade Mission to the Republic of Korea and Japan (U.S. Department of Commerce) U.S. Deputy Secretary of Commerce Don Graves will lead 15 American companies on a Cybersecurity Trade Mission to the Republic of Korea and Japan, from September 20 – 26, 2023. Deputy Secretary Graves’ travel follows President Biden’s Trilateral Summit with President Yoon of Korea and Prime Minister Kishida of Japan.

Michael Casey Confirmed as Director of National Counterintelligence & Security Center (Executive Gov) Looking for the latest Government Contracting News? Read about Michael Casey Confirmed as Director of National Counterintelligence & Security Center.

California enacts first-of-its-kind bill targeting data brokers (Record) California lawmakers enacted unprecedented legislation late Wednesday allowing state residents to compel data brokers to delete their personal information with the push of a button.

Litigation, Investigation, and Law Enforcement

Supreme Court Pauses Curbs on Biden Social Media Contacts (Bloomberg) Administrative stay lets government keep communicating freely. Alito order comes hours after Justice Department filed request.

Police officer to front Penrith court over alleged data breach (The Western Weekender) A police officer has been charged following an investigation into an alleged data breach.

Co Derry man facing charges over PSNI data breach refused to have electronic tag fitted (The Irish News) An IT expert granted bail on terror charges linked to a major PSNI data breach was “stupefied” on medication when he allegedly refused to have an electronic tag fitted, the High Court has heard.

US-Canada water commission investigating cyberattack (Record) The organization tasked with managing the lake and river systems along the border between the U.S. and Canada for the last hundred years announced Wednesday that it experienced a cyberattack following reports that ransomware hackers claimed to have stolen reams of data.

Feds hit Penn State University with false claims lawsuit over cyber compliance (SC Media) According to a relator and the federal government, Penn State has been falsely claiming their adherence to NIST cybersecurity standards for years.

Mom’s Meals Hit With Suit Over Data Breach Affecting 1.2 Million (Bloomberg Law) PurFoods LLC failed to protect the personal and health information of more than 1.2 million customers, employees, and contractors that was exposed in a February data breach, a proposed federal class action said.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Sep 11 - 15, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

National Insider Threat Special Interest Group - Melbourne, Florida Chapter Kickoff Meeting (Melbourne, Florida, USA, Sep 18, 2023) The National Insider Threat Special Interest Group (NITSIG) is excited to announce the establishment of a Melbourne, Florida Chapter. The meeting will focus on; Going Beyond Traditional Definitions Of Insider Threats, Eye Opening Damages And The Many Different Types Of Organizations Impacted From Insider Threats, Employee Motivations + Contributing Organizational Factors That Turn Trusted Employees' Into Malicious Employees, Insider Threat Mitigation Guidance, Question / Answer Session.

Immersive Tech Panel Series: Vehicles (Virtual, Sep 18, 2023) The Future of Privacy Forum has kicked off its Immersive Tech Panel Series, examining the new privacy risks and policy questions that arise when immersive technologies are integrated into domains like health, advertising, transportation, AI, and education. Join us for a forward-looking conversation on the issues raised by the use of immersive technologies like extended reality (XR) in cars, both for safety and convenience. What kinds of data are collected through sensors, cameras, and user input? What are the relevant privacy laws, policies, and ethical considerations organizations should be mindful of? This event will provide valuable insights and guidance to professionals, researchers, and enthusiasts interested in exploring the intersection of immersive technology and vehicles.

Venafi Machine Identity Management Summit 2023 (Las Vegas, Nevada, USA, Sep 18 - 19, 2023) Join future-focused peers, practitioners and industry influencers LIVE in Las Vegas as we explore groundbreaking security trends in modern machine identity management, zero trust, AI, cloud native and more.

mWISE™–Mandiant Worldwide Information Security Exchange (Washington, DC, USA, Sep 18 - 20, 2023) The global community of security practitioners comes together at mWISE to share unique knowledge for strengthening their defenses, individually and together. Featuring frontline experts, critical insights and cutting edge trends, mWISE is for practitioners who want to uplevel their excellence together with the industry’s best.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.