Cyberespionage updates. Notes on the cyber underworld. Claims of a compromise at Sony. DDoS and API attacks hit the financial sector. FCC plans to restore net neutrality.

Announcement

A note to our valued CyberWire Pro Subscribers.

N2K Cyber has changed its CyberWire Pro offering to better serve you. We’re now offering a single weekly digest of the news and analysis previously covered in our Pro Research, Policy, Privacy, and Disinformation Briefings. This new newsletter debuted last Thursday, and shares the Caveat name along with our existing cyber policy-and-privacy-focused podcast show. This will allow us to continue providing you the content you want, but with fewer emails from us hitting your in-box every day. You can subscribe to the Caveat briefing here.

Summary

By the CyberWire staff

At a glance.

Beijing's "BlackTech" threat activity.
ShadowSyndicate's RaaS operation.
Openfire flaw actively exploited against servers.
Smishing Triad in the UAE.
Claims of a compromise at Sony are investigated.
AtlasCross is capable and cautious.
Xenomorph malware in the wild.
DDoS and API attacks hit the financial sector.
FCC chair announces plans to restore net neutrality.
Cyberwar against Ukraine.

Joint advisory warns of Beijing's "BlackTech" threat activity.

A Joint Cybersecurity Advisory was issued this morning by US and Japanese security and intelligence agencies warning of BlackTech, an industrial espionage activity cluster operated by China. BlackTech has shown the ability to modify router firmware undetected, and to "exploit routers’ domain-trust relationships." The campaign has begun by compromising routers in subsidiary companies and then pivoting from the subsidiaries to corporate headquarters in the US and Japan. The goal of BlackTech's collection has for the most part been the acquisition of intellectual property.

ShadowSyndicate is a new RaaS operation.

Group-IB describes a new ransomware-as-a-service (RaaS) affiliate called “ShadowSyndicate.” The researchers state, “[I]t’s incredibly rare for one Secure Shell (SSH) fingerprint to have such a complex web of connections with a large number of malicious servers. In total, we found ShadowSyndicate’s SSH fingerprint on 85 servers since July 2022. Additionally, we can say with various degrees of confidence that the group has used seven different ransomware families over the course of the past year, making ShadowSyndicate notable for their versatility.”

Openfire flaw actively exploited against servers.

BleepingComputer reports that threat actors are exploiting a vulnerability (CVE-2023-32315) in Openfire messaging servers to deploy ransomware and cryptominers. Openfire released a patch for the flaw in May 2023, but as of last month more than 3,000 servers were still vulnerable. Doctor Web warns that the ongoing campaign has been active since at least June: “This exploit performs a directory traversal attack and allows unauthorized access to the administrative interface of the Openfire software, which is used by attackers to create a new user with administrative privileges.”

The Journey to a Secure Software Supply Chain - Free eBook

These days, everyone is at risk of a software supply chain attack. Traditionally, security has focused on vulnerabilities in the codebase, but the supply chain problem is far broader and deeper.

Get this eBook to learn:

Threats throughout the SDLC, spanning Import, Build and Usage
The 5 stage journey from Complete Anarchy to Nirvana
Gaining open source observability, scalability and remediation

Download the free eBook and get informed guidance on your supply chain security journey!

Smishing Triad in the UAE.

Resecurity warns that the Smishing Triad threat actor has “vastly expanded its attack footprint” in the United Arab Emirates (UAE). The researchers believe the goal of the campaign is to steal personal and financial data from Emirati citizens: “The group typically sends out malicious text messages from iCloud accounts they have previously hijacked, while masquerading as reputable organizations like government agencies, financial institutions (FIs), and shipping firms.”

Smishing Triad is also offering its smishing kits for sale on Telegram to other cybercriminals.

Claims of a compromise at Sony are investigated with cautious skepticism.

CyberSecurity Connect has reported that a ransomware gang, Ransomed.vc, claimed to have successfully hacked into Sony, gaining access to sensitive information the company holds. Sony has said very little about the incident. The company did offer a terse statement to IGN, which reads in full, “We are currently investigating the situation, and we have no further comment at this time.”

Outsiders who've seen the proof-of-hack Ransomed.vc offer are skeptical: it seems far short of what one would expect from a compromise of the claimed magnitude, and it's also consistent with being information culled from a variety of third-party sources. CyberSecurity Connect says it consists of "screenshots of an internal log-in page, an internal PowerPoint presentation outlining test bench details, and a number of Java files."

Ransomed.vc is thought to be a new group, active only over the past month or so, although some of its members may be alumni of other gangs. It appears to operate mostly from Russia and Ukraine, and seems to be both a direct ransomware operator and a player in the ransomware-as-a-service market, where it recruits criminal affiliates. BleepingComputer notes that another criminal actor, "MajorNelson" disputes Ransomed.vc's claims, saying that it's the actor who's in fact responsible. For more on the reported Sony compromise, see CyberWire Pro.

AtlasCross is technically capable and, above all, "cautious."

NSFOCUS Security Labs reports tracking a patient, persistent, low-profile APT that's impersonating the Red Cross to prospect its victims. The researchers call the threat group "AtlasCross." The researchers believe that AtlasCross shares no significant "attribution indicators" with other known threat groups. None of the usual markers, which NSFOCUS lists as "execution flow, attack technology stack, attack tools, implementation details, attack objectives, [and] behavior tendency," show any similarity to those employed by other actors, and the researchers offer no speculation about AtlasCross's allegiance.

The initial approach is phishing. An email with American Red Cross blood donation information in its subject line carries an attachment, “Blood Drive September 2023.docm.” For the phishbait document to be displayed, the victim is prompted to enable macros: the preliminary screen carries a reassuring note "This document is protected by McAfee DLP. Click 'Enable Content' to view." Once the target does so, the document displays a promotional flier for an American Red Cross blood drive. It also initiates communication with the attacker and installs a loader Trojan. That loader detects the host environment and executes shellcode that subsequently loads the final payload, AtlasAgent, which collects information about the host, executes shellcode, and carries out further actions against the target.

AtlasCross has compromised twelve servers, all of them in the United States, and all of them hosted in an Amazon cloud. The hosts are otherwise clean, and are unlikely to trip warnings or otherwise arouse suspicion. For more on the campaign, see CyberWire Pro.

Join us for the 2023 Gone Phishing Tournament.

To coincide with Cybersecurity Awareness Month, Fortra’s Terranova Security is proud to host a new edition of the Gone Phishing Tournament.

Co-sponsored by Microsoft, the event uses real-world simulations to establish accurate phishing benchmarking statistics to help you drastically reduce your cyber security risk levels. 

In 2022, over 1.2 million participating end users tested their cyber knowledge during the Gone Phishing Tournament. Can your team outsmart this year’s simulation? Register for free.

Xenomorph malware in the wild.

A new version of the Xenomorph Android banking Trojan is targeting customers of more than thirty-five US financial institutions, according to researchers at ThreatFabric. The threat actors also continue to target users in Spain and Canada. The researchers note, “From a purely technical point of view, this new campaign of Xenomorph does not feature major modifications from its previous iteration. This is a testament to the maturity of this Android Banker. Most of the work from the Threat Actors operating Xenomorph is going into developing additional ATS modules, and most importantly distributing their product.”

DDoS and API attacks hit the financial sector.

Akamai outlines trends on DDoS and API-based attacks in the financial sector: “Web application and API attacks in the financial services industry grew by 65% when comparing Q2 2022 with Q2 2023, accounting for 9 billion attacks in 18 months. This was driven in part by cybercriminal groups' active pursuit of zero-day and one-day vulnerabilities as pathways for initial intrusion.”

Additionally, the report found that “banks are bearing the brunt of web attacks (58%), followed by other financial services companies, such as fintech, capital markets, property and casualty insurance, and payment and lending companies (28%).”

Rampant cloud activity?

Cloud risk can grow faster than your AWS bill (true story).

That’s why Wiz partnered with Wiley to create the AWS Security for Dummies eBook. This free pdf contains 46 pages of expert tips to harden your AWS environment, including:

How to get the basics right to help scale security
How to secure specific resources based on your usage
Which critical weaknesses to prioritize

Grab your free digital copy now and boost your AWS security posture.

FCC chair announces plans to restore net neutrality.

Jessica Rosenworcel, chair of the US Federal Communications Commission (FCC) announced plans this week to restore net neutrality rules that were established in 2015 but rescinded during the Trump Administration. Net neutrality would, the FCC said in a factsheet, "establish basic rules for Internet Service Providers that prevent them from blocking legal content, throttling your speeds, and creating fast lanes that favor those who can pay for access."

In cyberwar, the FSB is more active, but the GRU does more damage.

The State Service of Special Communications and Information Protection of Ukraine (SSSCIP) has issued its report on the cyber phases of Russia's war for the first half of 2023. This assessment of Russian cyber activity in the wake of reports that Moscow's intelligence services are taking a close and focused interest in Ukrainian investigations of Russian war crimes, the FSB (notably its Gamaredon actor) has been the most prolific attacker of Ukrainian networks. Hacktivist auxiliaries acting under Russian government direction have also been active. But the most successful and damaging Russian actor in cyberspace has been the GRU, in the form of its Sandworm organization.

Ukraine continues to show considerable resilience in the face of Russian cyberattacks, and the devastating attacks against the country's infrastructure widely anticipated at the time of the invasion have fallen short of expectations. But as winter approaches, and as Russian state propagandists call for as much suffering as possible to be inflicted on Ukraine's civilian population, Bank Info Security reports that Kyiv's cyber defense efforts are turning to protection of critical infrastructure, especially energy infrastructure, during the coming months.

But concerns about cyberattacks against critical energy infrastructure are prospective. At present, as has been seen in Russian attempts to penetrate Ukrainian law enforcement and other investigative agencies, the focus of Moscow's organs seems to be on collection and influence as opposed to kinetic disruption. Computing notes a combination of advanced approaches and primitive, spray-and-pray tactics, in current Russian campaigns.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Security isn’t M365’s strongest suite.

The most popular email app is also the most targeted one. Out-of-the-box M365 security may leave your inbox vulnerable to attacks. Mimecastis optimized for M365 so that you can install the best email security in minutes and neutralize threats. Start a free trial today to fill the gaps in email security and help your employees and business Work Protected.

Notes.

Today's issue includes events affecting Canada, China, the European Union, India, Japan, Kuwait, the Philippines, Russia, Spain, Ukraine, the United Arab Emirates, the United Kingdom, and the United States.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+580: A turn in Russian cyberespionage. (CyberWire) Ukraine receives its first M1 Abrams tanks from the US, and ATACMS missiles are on the way. Russia appears to have committed its reserves as Ukraine continues its slow advance. The SSSCIP offers an assessment of Russian cyber operations that confirms a shift toward cyberespionage and suggests a guilty mind with respect to Russian atrocities.

Russia-Ukraine war: List of key events, day 581 (Al Jazeera) As the war enters its 581st day, these are the main developments.

Live Briefing: Russia Invades Ukraine (RadioFreeEurope/RadioLiberty) RFE/RL's Ukraine Live Briefing gives you the latest developments on Russia's ongoing invasion, Western military aid, global reaction, and the plight of civilians. The Live Briefing presents the latest developments and analysis, updated throughout the day.

Russia says naval commander alive despite Ukraine’s claims (The Hill) Russia is disputing a claim that a top naval commander was killed during a massive Ukrainian strike last week in the Black Sea, broadcasting video Tuesday that featured an appearance by the admiral…

Rush to boost Ukraine’s air defence as Russia prepares to unleash stockpiled missiles (The Telegraph) Military intelligence warns Kremlin is preparing for a campaign against Kyiv's energy infrastructure

Ukraine-Russia war: New US Abrams tanks will 'burn', says Kremlin (The Telegraph) Moscow has vowed to “burn” the US Abrams tanks that arrived in Ukraine yesterday as it downplayed their significance on the battlefield.

Ukraine’s drone army is bringing Putin’s invasion home to Russia (Atlantic Council) Ukraine's increasingly formidable drone army is enabling Kyiv to bring Vladimir Putin's invasion home to Russia and strike strategic targets throughout the Russian Federation, writes Mykola Bielieskov.

Ukraine: The soldiers who can’t leave the front line until the war is over (BBC News) For Ukrainian troops, life on the front line is far from easy, as the BBC's Mark Urban witnessed up close.

Ukraine Can Turn Human Rights Criticisms to Its Advantage (World Politics Review) Ukraine is often defensive about critiques of its human rights shortcomings in the war with Russia. It doesn’t need to be.

Ukraine: Russian hackers infiltrating software supply chains (Computing) Russian hacking groups are working for military intelligence and using advanced tactics to spot vulnerabilities in target systems, says Ukraine's security agency.

Russian hacking operations target Ukrainian law enforcement (CyberScoop) Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year.

Ukraine accuses Russian spies of hacking law enforcement (Register) Russian have shifted tactics in the first half of 2023, with mixed results

Russian hackers target Ukrainian government systems involved in war crimes investigations (Record) Russia is stepping up cyberattacks on Ukraine's law enforcement agencies in an effort to uncover what they know about war crimes committed by Russian soldiers in the country, according to Ukrainian cybersecurity officials.

Ukraine Cyber Defenders Prepare for Winter (Bank Info Security) Ukrainian cyber defenders are girding for an onslaught of cyberattacks against the energy sector as cold weather returns. That warning comes as Kyiv has observed

The Future of Cyberwar is being Shaped in Ukraine (The Cipher Brief) Cipher Brief Senior National Security Columnist Walter Pincus writes that the future of cyberwar is being shaped in Ukraine

Russian Media Rhetoric Could Be 'Incitement to Genocide' – UN (The Moscow Times) UN investigators probing violations in Ukraine since Moscow's invasion warned on Monday that rhetoric broadcasted by Russian state media could amount to incitement to genocide.

Suspected spy ring accused of plot to abduct Russian targets (The Telegraph) Five Bulgarian nationals charged with espionage appear at Westminster Magistrates’ Court via video link

Attacks, Threats, and Vulnerabilities

Surprise: When Dependabot Contributes Malicious Code (Checkmarx) In July 2023, our scanners detected nontypical commits to hundreds of GitHub repositories appear to be contributed by Dependabot and carrying malicious code.

CISA, NSA, FBI and Japan Release Advisory Warning of BlackTech, PRC-Linked Cyber Activity (Cybersecurity and Infrastructure Security Agency) Advisory helps organizations protect against PRC-linked actors hiding in router firmware

GPUs from all major suppliers are vulnerable to new pixel-stealing attack (Ars Technica) A previously unknown compression side channel in GPUs can expose images thought to be private.

Kuwait isolates some government systems following attack on its Finance Ministry (Record) The government of Kuwait is in the process of recovering from a ransomware attack that affected its Ministry of Finance.

Xenomorph Malware Strikes Again: Over 30+ US Banks Now Targeted (Threat Fabric) Xenomorph Malware Resurfaces with Expanded Targets - Insights from ThreatFabric

Xenomorph Banking Trojan: A New Variant Targeting 35+ U.S. Financial Institutions (The Hacker News) A new variant of the Xenomorph Banking Trojan has been uncovered, targeting 35+ U.S. financial institutions.

Xenomorph is back after months of hiatus and expands the list of targets (Security Affairs) A new campaign is spreading Xenomorph malware to Android users in the United States, Spain, Portugal, Italy, Canada, and Belgium.

Dusting for fingerprints: ShadowSyndicate, a new RaaS player? (Group-IB) No sleep until the Cybercrime Fighters Club is done with finding the answer as to who is behind this new ransomware-as-a-service affiliate.

Researchers Uncover RaaS Affiliate Distributing Multiple Ransomware Strains (Dark Reading) Ransomware-as-a-service affiliate ShadowSyndicate is unusual for the size of its malicious infrastructure and the fact that it's distributing seven different ransomware strains.

ShadowSyndicate hackers linked to multiple ransomware ops, 85 servers (BleepingComputer) Security researchers have identified infrastructure belonging to a threat actor now tracked as ShadowSyndicate, who likely deployed seven different ransomware families in attacks over the past year.

ShadowSyndicate: A New Cybercrime Group Linked to 7 Ransomware Families (The Hacker News) Cyber experts uncover a new threat: ShadowSyndicate. Explore their connections to ransomware and the latest findings from cybersecurity experts.

ShadowSyndicate Investigation Reveals RaaS Ties (Infosecurity Magazine) The investigation was conducted by Group-IB, Bridewell and threat researcher Michael Koczwara

Hackers actively exploiting Openfire flaw to encrypt servers (BleepingComputer) Hackers are actively exploiting a high-severity vulnerability in Openfire messaging servers to encrypt servers with ransomware and deploy cryptominers.

Vulnerability in Openfire messaging software allows unauthorized access to compromised servers (Dr.Web) Doctor Web is notifying users about the spread of malicious plugins for the Openfire messaging server. To date, more than 3,000 servers worldwide that have Openfire software installed on them have been affected by a vulnerability that lets hackers gain access to the file system and use the infected servers as part of a botnet.

Smishing Triad Stretches Its Tentacles into the United Arab Emirates (Security Affairs) Resecurity research found that the 'Smishing Triad' cybercrime group has expanded its phishing campaign into the United Arab Emirates (UAE).

Suspicious New Ransomware Group Claims Sony Hack (Dark Reading) A deceitful threat actor claims its biggest haul yet. But what, if any, Sony data does it actually have?

Sony investigates cyberattack as hackers fight over who's responsible (BleepingComputer) Sony says that it is investigating allegations of a cyberattack this week as different hackers have stepped up to claim responsibility for the purported hack. Thus far, over 3.14 GB of uncompressed data, allegedly belonging to Sony, has been dumped on hacker forums.

Sony Investigating After Hackers Offer to Sell Stolen Data (SecurityWeek) Sony has launched an investigation after a ransomware group claimed to have compromised all systems and offered to sell stolen data.

Philippines state health org struggling to recover from ransomware attack (Record) The government organization that manages the universal healthcare system of the Philippines has struggled to recover from a ransomware incident that forced it to take several websites and portals offline.

College kids should review passwords and credit amid massive Progress software data breach (USA Today) A data breach affecting nearly 200 colleges and universities is causing some students to feel uneasy as the semester starts and experts urge them to safeguard their information and credit.

Cl0p's MOVEit attack tally surpasses 2,000 victim organizations (Help Net Security) The number of victim organizations hit by Cl0p via MOVEit has surpassed 2,000, and the number of affected individuals is over 60 million.

Clop MoveIt Transfer attacks affect over 2,000 organizations (Security | TechTarget) More than 2,000 organizations and 62 million individuals have been affected by the Clop ransomware gang's attacks on MoveIt Transfer customers.

Amidst MGM, Caesar's Incidents, Attackers Focus on Luxury Hotels (Dark Reading) A fast-growing cyber campaign solely takes aim at luxury hotel and resort chains, using security-disruptive tactics to spread info-stealing malware.

WVU Medicine Patients Exposed To Data Breach Through Third-Party Vendor (Intelligencer) WVU Medicine patients who received radiology services through its group of hospitals were exposed to a data breach earlier this year through a third-party vendor WVU Medicine contracts with. The health system is just one part of the breach that, according to reports, has affected more than 1.2 million individuals nationwide. A letter sent to […]

Campbell Soup says summer cyberattack caused limited business impact (Cybersecurity Dive) The company will incur some costs, but it considers the disruption nonmaterial.

Kettering logistics firm enters administration with 730 jobs lost (BBC News) Administrators say the company was financially crippled by a cyber attack in June.

UK logistics firm blames ransomware attack for insolvency, 730 redundancies (Record) KNP Logistics was listed earlier this year by the Akira ransomware group.

CISA Adds Three Known Exploited Vulnerabilities to Catalog (Cybersecurity and Infrastructure Security Agency CISA) CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-41991 Apple Multiple Products Improper Certificate Validation Vulnerability CVE-2023-41992 Apple Multiple Products Kernel Privilege Escalation Vulnerability CVE-2023-41993 Apple Multiple Products WebKit Code Execution Vulnerability

Security Patches, Mitigations, and Software Updates

Microsoft Adding New Security Features to Windows 11 (SecurityWeek) Microsoft announced that the latest Windows 11 update (23H2) will bring more support for passkeys and several new security features.

Trends

Data Extortion Ransomware & The Cybercrime Supply Chain: Key Trends in 2023 (Flare) Introduction In 2019, the nature of ransomware fundamentally changed. Ransomware operators are traditionally associated with denying the availability of IT infrastructure by encrypting systems and then extorting the victim. 2019 saw the advent of a new tactic; the ransomware group Maze began stealing data prior to encryption and then blackmailing victims by threatening to release […]

Half of Organizations with Cyber Insurance Implemented Additional Security Measures to Qualify for the Policy or Reduce Its Cost (Netwrix) 28% of organizations made changes in order to reduce their premium — and 22% had to improve their security posture to simply be eligible for the policy.

Keeper Security Releases Cybersecurity Disasters Survey: Incident Reporting & Disclosure (EIN News) Research finds 40% of organisations have experienced a cybersecurity incident, yet 48% did not disclose those incidents to the appropriate authorities

75% who didn't report cyber attack to leadership, felt guilty about it (Security Magazine) Research finds 40% of organizations have experienced a cybersecurity incident, yet 48% didn't disclose those incidents to the appropriate authorities.

The hidden threat: unveiling employee-caused cybersecurity risks in SMEs (Business Leader) Employees are behind a widening gap in the cybersecurity of small and medium-sized enterprises (SMEs) a new survey released recently reveals.

Mobile privacy: What do your apps want to know? (NordVPN) NordVPN researchers analyzed the permission requests of the top 5 iOS and Android apps in popular categories. How much do these apps want to know about you?

Marketplace

Senser Launches with $9.5M to Disrupt Legacy Observability Technology (PR Newswire) Senser, the pioneer of zero-instrumentation production intelligence, emerged from stealth with $9.5 million in seed funding to launch an AIOps...

ProofID acquires Texas-based Regatta Solutions Group to broaden its identity security capabilities. (PR Newswire) Identity and Access Management (IAM) specialist ProofID has today announced that it has acquired Identity Governance and Administration (IGA)...

Cybersecurity firm Xage gets $17 million contract to protect Space Force networks (SpaceNews) Cybersecurity firm Xage gets $17 million contract to protect Space Force networks

CrowdStrike Launches Startup Accelerator with AWS (CrowdStrike) CrowdStrike is launching a startup accelerator with AWS to support the next generation of cloud-native cybersecurity companies. Learn more.

Corero Announces Partner-First Go-to-Market Strategy (Corero) Corero Network Security (LON: CNS), the specialists in distributed denial of service (DDoS) protection solutions, today unveiled its “partner-first” go-to-market strategy and enhanced partner program. Effective October 1, all new Corero business globally will be sold in collaboration with its channel partners.

China’s Business Environment Is Deteriorating, U.S. Companies Say (Wall Street Journal) More than one-third of companies surveyed say they have reduced or paused Chinese investment in the past year.

The World’s Biggest Crypto Firm Is Melting Down (Wall Street Journal) "Every battle is a do-or-die situation," Binance co-founder Yi He writes.

Progress Software stock struggles as data breach updates sour promising results (Proactiveinvestors NA) Progress Software (NASDAQ:PRGS) Corp shares slid 1.5% after hours Tuesday even the business software giant posted fiscal third quarter results that...

Fortinet Announces Formation of Veterans Program Advisory Council to Narrow the Cybersecurity Skills Gap with Military Veteran Talent (Fortinet) Council Members from Five Eyes Nations Will Help Advance the Fortinet Veterans Program's Impact on Supporting Military Veterans in Transitioning to Careers in Cybersecurity

Products, Services, and Solutions

IonQ Unveils Forte Enterprise and Tempo, Rack-Mounted Enterprise-Grade Quantum Computers for Today’s Data Center Environments (Business Wire) IonQ provides the most viable, practical, and fastest path to commercial advantage with IonQ Forte Enterprise, an #AQ 35 quantum computer, and IonQ Tempo expected to demonstrate record-breaking #AQ 64

Tines Expands Platform Focus To Transform the Way Organizations Operate (PR Newswire) Tines, the trusted leader in smart, secure workflows, today announced the company has expanded its platform's focus to include teams throughout...

OTORIO and HSB Launch Warranty That Leverages Risk Management Strategies to Enhance Insurability and Protect Operational Efficiency (PR Newswire) OTORIO, the leading provider of operational technology (OT) cyber and digital risk management solutions, and HSB, a specialty insurer, today...

Update on Naked Security (Sophos News) To consolidate all of our security intelligence and news in one location, we have migrated Naked Security to the Sophos News platform.

Appdome Releases New Defenses to Combat Accessibility Malware (PR Newswire) Appdome, the one-stop shop for mobile app defense, today announced new mobile anti-malware protections that detect Android Accessibility...

Qumulo Expands Strategic Relationship with Fujitsu to Help EMEA Customers Scale Anywhere (Business Wire) Fujitsu’s PRIMERGY M7 Platform Now Certified by Qumulo, Provides Companies with More Options to Cost Efficiently Manage Unstructured Data

stackArmor Launches ATO for AI™ Governance Model To Help Public Sector Organizations Safely and Securely Accelerate AI Adoption (Business Wire) Solution receives industry backing with newly established AI Risk Management Center of Excellence (CoE)

KuppingerCole: Zero Trust Network Access for OT Environments (Cyolo) This KuppingerCole paper explores the cybersecurity threat landscape for OT, the tool types needed for OT, and key requirements of the German KRITIS regulation.

TrustCloud Business Intelligence Dashboards Empower CISOs to Present Financial Impact of Risk, Security, and Compliance Program to Board of Directors (TrustCloud) TrustCloud business Intelligence empowers CISOs to share the ROI of their security and privacy investments and prove that GRC is a profit center.

Permiso Offers Complimentary Threat Briefings on Scattered Spider (Permiso) Cloud security company has tracked the threat actor group for the past year and supported several organizations that have been targeted and impacted by recent attacks.

SeeMetrics Launches Customizable Cybersecurity Performance Boards (SeeMetrics) The newly launched customizable Cybersecurity Performance Boards empower security leaders to manage their own metrics by leveraging a foundation of out-of-the-box metrics and offering room for tailored boards.

Cohesity Expands Data Security Alliance with Global Technology Leader Tata Consultancy Services (Cohesity) Welcomes First GSI Partner To Improve Customers Cyber Resilience

CISO Global Launches Channel Program to Extend Reach Through Value Added Resellers, Managed Service Providers, and Strategic Partners (CISO Global) Global cybersecurity provider to offer three levels of engagement to aid partners in supporting their end-user clients Scottsdale, Ariz. September 27, 2023 – CISO Global (NASDAQ: CISO), an industry leader as a managed cybersecurity and compliance provider, has launched a channel sales partnership program to extend its reach through value added resellers (VARs), managed services […]

Radiant Logic Announces Expanded Identity Analytics and Data Management Platform Capabilities (Business Wire) Radiant Logic Completes Integration of Brainwave GRC; Combined Product Platform Paves the Road to Identity-First Security, and Improved Governance and Compliance

Global 500 Energy Company Repsol Selects CardinalOps to Enhance Detection Posture and Reduce Risk of Breaches (PR Newswire) CardinalOps, the detection posture management company, today announced that global multi-energy company Repsol has deployed the CardinalOps...

Versa Networks and Infinigate Partner to Bring Unified SASE to EMEA Enterprises (Business Wire) New Partnership Agreement Enhances Infinigate Security Portfolio and Supports Versa’s Expansion into EMEA Markets

6clicks Joins Hands with Tata Consultancy Services to Help Enterprises Strengthen Their Cyber Defense, Governance, Risk and Compliance (PR Newswire) 6clicks, the leading AI-powered governance, risk and compliance platform for businesses and advisors, today announced that it has partnered...

Concentric AI Showcasing Generative AI-Driven DSPM Platform at FS-ISAC’s 2023 FinCyber Today Summit (Concentric AI) Concentric AI, a leading vendor of intelligent AI-based solutions for autonomous data security posture management (DSPM), announced today it will demonstrate the latest in autonomous data security at FS-ISAC’s 2023 FinCyber Today Summit.

Technologies, Techniques, and Standards

U.S. Counterintel Buys Access to the Backbone of the Internet to Hunt Foreign Hackers (404 Media) Getting information from the NSA would take too long, according to internal documents from a counterintelligence agency. So it turned to Team Cymru to buy netflow data that can allow analysts to track activity through virtual private networks.

DHS Calls for Critical Harmonization of Cyber Incident Reporting (Wiley) On September 19, 2023, the Department of Homeland Security (DHS) released a Report to Congress (Report) on the Harmonization of Cyber Incident Reporting to the Federal Government. The Report reflects on the 52 in-effect or proposed federal cyber incident reporting requirements that contribute to an inefficient patchwork of cybersecurity rules and proposals. A flurry of cyber activity has increased the urgency to harmonize and address the potential for duplicative regulations arising from current and future incident reporting regimes.

CISA Launches National Public Service Announcement Campaign Encouraging Americans to Take Steps to Keep Themselves and Their Families Safe Online (Cybersecurity and Infrastructure Security Agency) Secure Our World Cybersecurity Awareness Program Provides Resources and Tools to Keep Individuals, Businesses and Organizations Safe from Cyber Attacks

CISA launches campaign to teach Americans to be safe online (CyberScoop) The program is starting with a new commercial that will encourage viewers to adopt basic cyber hygiene.

What it will actually take to reduce human error in cyber security (Canadian Underwriter) Preventing human error in cyber security means creating a workplace culture where employees are comfortable raising their security concerns.

Top 5 Problems Solved by Data Lineage (Security Affairs) Data lineage is the visualization and tracking of data as it moves through various stages of its lifecycle.

What’s a cyber incident response retainer and why do you need one? (CSO Online) Whether you need to hire a team to respond to any and all cyberattacks or just some hired guns to boost your capabilities, incident response retainers can ensure you’re covered.

Design and Innovation

Post-Quantum Cryptography Initiative (Cybersecurity and Infrastructure Security Agency CISA) CISA's Post-Quantum Cryptography (PQC) Initiative will unify and drive efforts with interagency and industry partners to address threats posed by quantum computing and to support critical infrastructure and government network owners and operators during the transition to post-qua

OpenAI's GPT-4 with vision still has flaws, paper reveals (TechCrunch) OpenAI has released a technical paper revealing some of the flaws with GPT-4V, the version of GPT-4 with image-analyzing capabilities.

Research and Development

Space Force selects university partner to evaluate classified ground systems software (SpaceNews) Space Force selects university partner to evaluate classified ground systems software

CIA Builds Its Own Artificial Intelligence Tool in Rivalry With China (Bloomberg) Intelligence agency looking for ‘needles in the needle field’. Program will help sift through huge amounts of available data.

US government snoops building AI chatbot, report says (Register) CIA, FBI and friends using AI to uncover threats? What could possibly go wrong?

Legislation, Policy, and Regulation

Resist Russian disinformation as elections loom, EU tells Big Tech (Reuters) European Commission Vice President Vera Jourova on Tuesday urged Alphabet's Google, Microsoft , Meta Platforms and TikTok to do more to tackle what she called Russia's "multi-million euro weapon of mass manipulation" ahead of elections in Europe.

Big-tech must up fight against Russian disinformation, says EU values chief (Computing) It's not business as usual, says EU VP with childhood memories of Russian tanks rolling into Czechoslovakia: it's a war to defend democracy.

DHS to host Latin American cyber summit as region faces an onslaught of digital attacks (Record) The U.S.Homeland Security Department this week will convene the first-of-its-kind cybersecurity summit with leaders from Latin America, which has increasingly become a hotbed for criminal digital activity and influence efforts by China.

Cyber dangers threaten China’s infrastructure, state security chief warns (South China Morning Post) The risks are growing and their effects could be dire for transport, energy, finance and communication, Chen Yixin says.

Under India’s pressure, Facebook let propaganda and hate speech thrive (Washington Post) Nearly three years ago, Facebook’s propaganda hunters uncovered a vast social media influence operation that used hundreds of fake accounts to praise the Indian army’s crackdown in the restive border region of Kashmir and accuse Kashmiri journalists of separatism and sedition.

FACT SHEET: FCC Chairwoman Rosenworcel Proposes to Restore Net Neutrality Rules (Federal Communications Commission) Proposes to Re-Establish FCC’s Authority Over Broadband Providers Under Title II

FCC announces plans to reinstate net neutrality (TechCrunch) After a long battle and eventual defeat, the FCC is set to reinstate rules that broadband providers must treat all internet traffic equally.

White House panel recommends public-private task force to protect domestic infrastructure (Nextgov) Some of the recommended approaches are “immediately actionable,” according to a member of the committe

Addressing the Abuse of Domestic Infrastructure by Foreign Malicious Actors (NSTAC) In December 2022, the Executive Office of the President (EOP) tasked the National Security Telecommunications Advisory Committee (NSTAC) with a new study on “Addressing the Abuse of Domestic Infrastructure by Foreign Malicious Actors.”

Tech Industry Slams US Government’s Plan For Keeping Hackers Away From the Cloud (The Messenger) An influential group of tech executives hopes the White House will block a pending plan to impose new rules on U.S. cloud platforms.

Litigation, Investigation, and Law Enforcement

Disinformation most active on X, formerly known as Twitter, EU says (BBC News) A European Commission report says the network has the most disinformation of six large social networks.

Musk's X disabled feature for reporting electoral misinformation - researcher (Reuters) Elon Musk's X, formerly called Twitter, disabled a feature that let users report misinformation about elections, a research organisation said on Wednesday, throwing fresh concern about false claims spreading just before major U.S. and Australian votes.

Justice Dept.’s Monaco talks about the teen hacker phenomenon (Washington Post) Teenage hackers like those who may have been behind recent cyberattacks on casinos are being “radicalized” online in a way similar to people who once turned to terrorism and they benefit from a digital economy that enables them to get into the field quickly and easily, a top Justice Department official said Tuesday.

Hack of Egyptian Politician’s iPhone Tied to Tech Firm Sandvine (Bloomberg) Company equipment has previously been used to censor internet. Sandvine says it doesn’t collaborate with spyware vendors.

Gensler testimony — Crypto enforcement actions driven by “wide-ranging noncompliance” (Cointelegraph) SEC chair Gary Gensler will highlight efforts to update rules regulation the cryptocurrency sector as well as predictive data analytics and AI

Key Considerations for Form 8-K Cybersecurity Materiality Determinations (cyber/data/privacy insights) With 8-K reporting obligations for “material” cybersecurity incidents under the new Securities and Exchange Commission (SEC) rules becoming effective as of December 18, 2023, most companies will soon be tasked with making “real-time” materiality determinations following a cybersecurity incident.1 Wh

U.S. Accuses Amazon of Illegally Protecting Monopoly in Online Retail (New York Times) The Federal Trade Commission and 17 states sued Amazon, saying its conduct in its online store and services to merchants illegally stifled competition.

FTC Sues Amazon, Alleging Illegal Online-Marketplace Monopoly (Wall Street Journal) High-stakes case pits the e-commerce giant against agency chair Lina Khan’s aggressive antitrust stance.

FTC and 17 states sue Amazon on antitrust charges (CNBC) The lawsuit is a major milestone for FTC Chair Lina Khan, who rose to prominence for her 2017 Yale Law Journal note, "Amazon's Antitrust Paradox."

Hunter Biden sues Rudy Giuliani over laptop privacy breach (Scripps News) Hunter Biden filed a lawsuit against Rudy Giuliani and Giuliani's former lawyer Bob Costello, claiming the two men misused data from his personal computer.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Secureworks Global Threat Intelligence Summit 2023 (Virtual, Oct 4, 2023) Join us as we discuss emerging threats and provide the latest insight into how to combat today’s adversaries. Plus, get exclusive access to Secureworks 2023 State of the Threat Annual Report.

Events

Women4Cyber Conference “Hacking Gender Barriers” (Madrid, Spain, Sep 26 - 27, 2023) The Women4Cyber Conference “Hacking Gender Barriers” will take place in September 2023 in Madrid. It will be the very first conference in Europe organised by Women4Cyber bringing women and men together to collaborate on building diversity in our field.

ISSA Central Maryland Membership Meeting (Columbia, Maryland, USA, Sep 27, 2023) We have all seen Crime Lab technicians on television shows such as NCIS and CSI analyzing evidence to try solve crimes. How accurate is television’s portrayal? Hear from experts who work for the Baltimore City Police Department about what they do to analyze and assess evidence. Learn about what tools and techniques are being used to fight crime. What training does it take to do this type of work? Be able to tell your friends if what they are watching on television is the way it really is!

Cyber Ireland National Conference 2023 - Galway (Galway, Ireland, Sep 27, 2023) This year’s theme is ‘Securing our resilient digital future’. It will examine what Ireland’s cyber security ecosystem, which contributes over €1 billion to the Irish economy annually, must do today to ensure a safe, democratic cyberspace in ten years’ time. The conference theme & topics have been selected from our members’ survey. This year’s theme is ‘Securing our resilient digital future’. It will examine what Ireland’s cyber security ecosystem must do today to ensure a safe, democratic cyberspace in ten years’ time. Conference topics selected by the members include: International Cyber Security and preventing future conflicts Cyber Threat Landscape 2030 AI and Cyber Security Cyber Workforce of the Future

Innovate Cybersecurity Summit (Scottsdale, Arizona, USA, Oct 1 - 3, 2023) Innovate Cybersecurity Summit is a highly anticipated summit that brings together Cybersecurity Executives and CISOs from all corners of the country to the tranquil Arizona desert, assembling a national community of professionals for three days of exclusive, invite-only discussion and learning. Attendees can expect a world-class experience with access to insightful CISO panels and education sessions that explore best practices and real-world challenges, unparalleled networking opportunities, and unique engagement with the industry’s latest cybersecurity technology solutions and vendors. A must-attend event for CISOs and leading Cybersecurity Practitioners looking to stay ahead of the game!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.