Updates on two hybrid wars. Ransomware gang claims attack against IT firm. Social engineering in a data breach. Coinming as battlespace prep.

Summary

By the CyberWire staff

At a glance.

Hacktivism and the war between Hamas and Israel.
Disinformation and the war between Hamas and Israel.
LockBit claims attack on CDW.
Shadow PC's breach.
Void Rabisu deploys lightweight RomCom backdoor against Brussels conference.
Coinmining as an (alleged, potential) front for espionage or a staging area for sabotage.

Hacktivism and the war between Hamas and Israel.

Pro-Hamas hacktivism, mostly at a low-grade, and to a significant extent overstated to the point of fiction, continues to be the most prominent cyber feature of the war between Hamas and Israel, POLITICO reports. Confirmed cyberattacks have for the most part been distributed denial-of-service activity. One organization, Medical Aid for Palestine, says that its website had been disrupted by unspecified cyberattacks that have impeded its delivery of humanitarian aid to Gaza.

Disinformation and the war between Hamas and Israel.

A great deal of disinformation in the present war has involved over-promising and under-delivery. Last Friday, for example, was supposed to have been a day of global protest in support of Palestinians throughout the Islamic and Arab worlds. This was quickly glossed as a "day of global jihad," which didn't materialize.

There have also been some attempts to walk back Hamas inspriational content--Hamas fighters holding captured Israeli babies, Hamas fighters spitting on desecrated civilian corpses, civilians being dragged into captivity--that on reflection Hamas thinks may not be polling well. Basim Naim, the Hamas head of international relations, said in an English-language press conference that Hamas fighters were under instruction not to target civilians, and were "keen" to avoid doing so. Other Hamas officials said their attack “targeted only Israeli military bases and compounds that were suffocating the people of Gaza for more than 17 years.” The massacre at the Supernova music festival? An unfortunate but understandable mishap. Hamas officials suggested that their fighters probably mistook the roughly two-hundred-sixty concert-goers they murdered for "resting Israeli soldiers."

Where are false or dubious claims concentrated? The DFR Lab reports that pro-Israeli accounts (especially in English) have tended to show a preference for X (the platform formerly known as Twitter) despite X's recent difficulties with its hosting of pro-Hamas posts. The Hamas-lnked accounts have gravitated to Telegram. Much amplification of disinformation is achieved through the use of accounts that impersonate trusted sources.

Real time cloud security powered by runtime insights. Secure every second.

In the cloud, every second counts. Attacks move at warp speed; security teams must protect the business without slowing it down. Sysdig stops cloud attacks in real time, instantly detecting changes in risk with runtime insights and open source Falco. We correlate signals across cloud workloads, identities, and services to uncover hidden attack paths and prioritize real risk. From prevention to defense, Sysdig helps enterprises focus on what matters: innovation. Visit our website to learn more.

LockBit claims attack on CDW.

Technology services giant CDW is investigating claims of data theft made by the LockBit ransomware gang, the Record reports. A CDW spokesperson said the company is “addressing an isolated IT security matter associated with data on a few servers dedicated solely to the internal support of Sirius Federal, a small U.S. subsidiary of CDW-G.” CDW added, “We are aware that a third party has made data available on the dark web which it claims to have taken from this environment. As part of the ongoing investigation, we are reviewing this data and will take appropriate action in response – including directly notifying anyone affected, as appropriate.”

The LockBit gang said it demanded $80 million in exchange for not publishing the stolen data, but was offered only $1.1 million.

Shadow PC's breach.

Cloud-based gaming company Shadow has confirmed a data breach in which attackers were able to obtain customers’ “full names, email addresses, dates of birth, billing addresses and credit card expiry dates,” TechCrunch reports.

Shadow CEO Eric Sèle said in an email, “At the end of September, we were the victim of a social engineering attack targeting one of our employees. This highly sophisticated attack began on the Discord platform with the downloading of malware under cover of a game on the Steam platform, proposed by an acquaintance of our employee, himself a victim of the same attack.”

An individual who has claimed responsibility for the attack is selling the data on an underground forum, alleging that the database contains the information of more than 530,000 Shadow customers. For more on the Shadow PC incident, see CyberWire Pro.

CNAPP for Dummies

A clear, friendly guide to mastering the hot new category in cloud-native security that's taking the industry by storm. Wiz partnered with Wiley to create the Cloud Native Application Protection Platform (CNAPP) for Dummies eBook. This free 48-page PDF includes everything you *need* to know to secure the changing landscape of cloud-native applications and protect your cloud environment today. Get your free guide here.

Void Rabisu deploys lightweight RomCom backdoor against Brussels conference.

Trend Micro describes the recent activities of Void Rabisu, which it describes as "an intrusion set associated with both financially motivated ransomware attacks and targeted campaigns on Ukraine and countries supporting Ukraine." In this case the intrusion was directed against the Women Political Leaders (WPL) Summit that convened in Brussels between June 7th and 8th of this year. The Summit's goal was to increase the participation of women in politics, and while that may not have been something the threat actors necessarily approved of, it seems likelier that the conference was simply a target of opportunity, a occasion to prospect and compromise devices and systems belonging to political leaders. The ultimate payload Void Rabisu delivered was "a new version of ROMCOM backdoor that we have dubbed as “ROMCOM 4.0” (also known as PEAPOD)."

Void Rabisu is an interesting mixed case of a organization (or, if you will an intrusion set) that has been financially motivated, that trades in the criminal-to-criminal market, but which engages in espionage and, once it's on its target, acts like an advanced persistent threat (APT). "Void Rabisu also acts like an advanced persistent threat (APT) actor when it targets governments and military. In June 2023, Void Rabisu exploited the vulnerability CVE-2023-36884 — still a zero-day vulnerability then — in campaigns using the Ukrainian World Congress and the July 2023 NATO summit as lures. The extraordinary geopolitical circumstances surrounding the war in Ukraine drives some of the financial-seeking threat actors (including Void Rabisu) toward campaigns motivated by espionage." Some of its earlier, more clearly financially motivated actions have been thought to be associated with a Cuba ransomware affiliate, BleepingComputer notes, but the activity now seems focused on zero-day exploitation for the purposes of espionage.

There's no attribution of the activity so far. "While we have no evidence that Void Rabisu is nation-state-sponsored," Trend Micro writes, "it’s possible that it is one of the financially motivated threat actors from the criminal underground that got pulled into cyberespionage activities due to the extraordinary geopolitical circumstances caused by the war in Ukraine." And in general Void Rabisu has consistently acted against Ukrainian interests.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Join the Lacework CISO book club!

Get a copy of the classic novel, The Phoenix Project, and join quarterly interactive discussions with cybersecurity leaders. Sign up here.

Coinmining as an (alleged, potential) front for espionage or a staging area for sabotage.

Coinmining is famously electrical-and-computational-power-hungy. It's now far advanced from the days when it might have been possible for some regular Joe to make some money on his laptop. Coinmining operations are now, effectively, large, powerful, single-purpose data centers. Some of the mines are owned, sometimes via a series of cutouts, by the Chinese government or Chinese corporations, and US has begun taking note. The New York Times reports, "In at least 12 states, including Arkansas, Ohio, Oklahoma, Tennessee, Texas and Wyoming, The Times identified Chinese-owned or -operated Bitcoin mines that together use as much energy as 1.5 million homes. At full capacity, the Cheyenne, Wyo., mine alone would require enough electricity to power 55,000 houses." The Wyoming mine is particularly interesting. It's situated between a big Microsoft data center that supports the US Department of Defense and F.E. Warren Air Force Base, a command center for US intercontinental ballistic missiles.

Microsoft warned the US Treasury Department's Committee on Foreign Investment in the United States last year of the threat such installations could pose. The mines are positioned to be able to collect intelligence on sensitive activity, and their consumption of electrical power is so high that they can stress the power grid, or, by cycling that consumption, upset the balance on which a reliable grid depends. The prospect of destabilizing the grid is probably the more serious of the risks. Coin mines are largely unregulated, and US agencies are considering the possibility of prescribing how rapidly they can start and stop their active mining operations.

Notes.

Today's issue includes events affecting Australia, China, the European Union, Gaza, India, Iran, Israel, Malaysia, the Philippines, Russia, Ukraine, the United Kingdom, the United States, and Vietnam.

Where to find N2K (including N2K Cyber and its CyberWire products) in places other than X.

We're pausing our engagement with X, the plaform formerly known as Twitter. N2K Cyber may return there at some point, but for now we'll be posting on Mastodon (here and here) and on LinkedIn (here, here, and here). We hope to see you there.

Dateline: Russia's hybrid war against Ukraine.

Ukraine at D+599: Stalled offensives and a complex cyber threat. (CyberWire) With slow Ukrainian advances in the south and apparent Russian failure, so far, at Avdiivka, the front has grown more static. Russia's Blac

Russia-Ukraine war: List of key events, day 600 (Al Jazeera) As the war enters its 600th day, these are the main developments.

Russia-Ukraine war at a glance: what we know on day 600 of the invasion (the Guardian) Russia’s biggest offensive in months is failing, says Ukrainian commander; at least six people killed in Russian strikes

What happened in the Russia-Ukraine war this week? Catch up with the must-read news and analysis (the Guardian) Treason and grief in the town of Hroza after a deadly Russian missile attack; Kyiv makes remarkable progress in Black Sea

Russia-Ukraine war at a glance: what we know on day 598 of the invasion (the Guardian) Russian authorities detain lawyers for Navalny; US says North Korea delivered 1,000 containers of military equipment to Russia

US says North Korea delivered 1,000 containers of equipment and munitions to Russia for Ukraine war (AP News) The White House says that North Korea has delivered more than 1,000 containers of military equipment and munitions to Russia for its ongoing war in Ukraine. Speculation about a possible North Korean plan to refill Russia’s munition stores drained in its protracted war with Ukraine flared last month, when North Korean leader Kim Jong Un traveled to Russia to meet President Vladimir Putin and visit key military sites.

Russia, North Korea expanding military partnership, White House says (Defense News) Russia and North Korea are building a military partnership amid heavy U.S. sanctions and support for Ukraine, according to the National Security Council.

Treason, betrayal and grief in Ukrainian village devastated by Russian missile strike (the Guardian) Two brothers who grew up in village of Hroza have been charged with treason in wake of attack that killed 59 people

British howitzers fall silent in Ukraine because of ‘catastrophic’ shortage of shells (The Telegraph) Soldiers have been reduced to firing weapons less than once a day and some are resorting to using Second World War-era field guns instead

Ukrainian pilots expected to start F-16 training in Arizona next week (POLITICO) News comes after Washington announced it will lead a coalition of countries training Ukrainian pilots.

Void Rabisu Targets Female Political Leaders with New Slimmed-Down ROMCOM Variant (Trend Micro) Almost a year after Void Rabisu shifted its targeting from opportunistic ransomware attacks with an emphasis on cyberespionage, the threat actor is still developing its main malware, the ROMCOM backdoor.

Women Political Leaders Summit targeted in RomCom malware phishing (BleepingComputer) A new, lightweight variant of the RomCom backdoor was deployed against participants of the Women Political Leaders (WPL) Summit in Brussels, a summit focusing on gender equality and women in politics.

The Crypto Exchange Moving Money for Criminal Gangs, Rich Russians and a Hamas-Linked Terror Group (Wall Street Journal) Garantex’s international pipeline helps defy Treasury sanctions by channeling rubles to crypto to dollars. Customers line up with bags of cash.

Attacks, Threats, and Vulnerabilities

How to Understand the Israeli-Palestinian Conflict (Foreign Affairs) Why Israel and Hamas are at war again.

It doesn’t matter whether Iran planned the Hamas attack—Tehran is still to blame (Atlantic Council) For years, Tehran has provided Hamas the overwhelming majority of its funding, weapons, and training—all of which were leveraged for this attack.

How hackers piled onto the Israeli-Hamas conflict (POLITICO) Lower-level cyberattacks are becoming a major feature of the war between Israel and Hamas, and the attacks could ramp up in intensity.

Israel-Gaza War Now Includes Accompanying Cyber Warfare (Channel Futures) Widespread attacks by Hamas across Israel and the ensuing Israel-Gaza war have now extended beyond physical warfare into cyber warfare.

How Cyberattacks Could Affect the Israel-Hamas War (Bank Info Security) It could be weeks or months before outsiders have a clear picture of the cyber dimension of the conflict between Hamas and Israel, a cyber expert said. "As

Rumors of a ‘Global Day of Jihad’ Have Unleashed a Dangerous Wave of Disinformation (WIRED) The rapid spread of violent videos and photos, combined with a toxic stew of mis- and disinformation, now threatens to spill over into real-world violence.

Medical aid for Palestinians website under cyber attack affecting relief efforts (mint) Medical aid for Palestinians website under cyber attack hindering relief efforts for Gaza. Hamas pleads for international aid as Gaza faces starvation and fuel depletion

Hamas flaunt Israeli babies and children in chilling video (The Telegraph) Footage includes clip of a gunman holding a crying child placed on top of his rifle

Hamas in rare English ‘press conference’ as it tries to counter global condemnation (The Telegraph) The terror group claimed its gunmen were ‘keen to avoid harming civilians’ and blamed the Israeli military for the deaths of its citizens

Hamas Has Fractured the Arab World (Foreign Affairs) America must help prevent a wider conflict—in the West Bank and beyond

Israel shouldn’t have had to prove that Hamas slaughtered babies (The Telegraph) No one who has seen the other images that have emerged from Saturday’s attacks should have doubted that Hamas were capable of such a thing

In Israel-Hamas conflict, social media become tools of propaganda and disinformation (DFRLab) Endless flood of false, misleading, and unverified information risks inflaming the conflict

A flood of misinformation is shaping how panicked citizens, global public view the war (Washington Post) A flood of misinformation is shaping how panicked citizens and a global public view the Israel-Gaza conflict

How Israel-Hamas War Misinformation Is Spreading Online (TIME) Experts say social media platforms have been flooded with false claims, adding to the confusion about what is happening on the ground.

Don’t avoid discussing Hamas-Israel conflict with children, say experts (the Guardian) Ignoring tricky questions could drive young people on to the internet, where disinformation proliferates

What are the rules of war – and how do they apply to the Israel-Gaza conflict? (the Guardian) International humanitarian law dictates the rules combatants should follow – with a central tenet that ‘civilians should not be targeted’

Misinformation Is Warfare (TIME) Joan Donovan explores how misinformation had become a tactic in the Israel-Hamas war.

Meta responds to EU misinformation concerns regarding Israel-Hamas conflict (Engadget) The company has created a new operations center with experts fluent in Hebrew and Arabic.

Briefing: Meta Details Efforts to Remove War-Related Disinformation (The Information) Meta has released details about its efforts to remove disinformation related to the Hamas-Israel war following warnings from the European Union. In a blog post Friday, the social media company said it had set up a “special operations center” staffed with Hebrew and Arabic speakers to monitor Meta’s apps and had so far removed or flagged 795,000 pieces of violating content. The company noted

BBC reporters in the Middle East appear to justify killing of civilians by Hamas (The Telegraph) Corporation is 'urgently investigating' anti-Israel bias displayed by several of its taxpayer-funded journalists in the Middle East

Why Israel’s Pegasus spyware was not enough to stop Hamas (Fox News) Although Israel has been on the forefront of advance technology that includes softwares like Pegasus, it was caught off guard by Hamas' surprising attack.

Israel-Hamas war live: Gaza witnessing ‘unprecedented human catastrophe’ amid water shortage (the Guardian) Benjamin Netanyahu, prime minister, says Israel will ‘dismantle’ Hamas in first meeting of new national emergency government

'You've been hacked': House website defaced, goes offline (ABS CBN News) The House of Representatives website was breached and defaced on Sunday in the latest cybersecurity incident involving a government entity.

APT Group DarkPink Exploits WinRAR 0-Day to Target Multiple Entities in Vietnam and Malaysia - NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. (NSFOCUS, Inc.) NSFOCUS Security Labs detected DarkPink has begun exploiting the WinRAR 0-Day vulnerability to target entities in Vietnam and Malaysia.

DarkGate Opens Organizations for Attack via Skype, Teams (Trend Micro) We detail an ongoing campaign abusing messaging platforms Skype and Teams to distribute the DarkGate malware to targeted organizations. We also discovered that once DarkGate is installed on the victim’s system, additional payloads were introduced to the environment.

DarkGate malware spreads through compromised Skype accounts (BleepingComputer) Between July and September, DarkGate malware attacks have used compromised Skype accounts to infect targets through messages containing VBA loader script attachments.

Kaspersky identifies phishing websites offering fake WormGPT tool (Back End News) Kaspersky identified fraudulent websites offering counterfeit access to the artificial intelligence (AI) malicious tool, WormGPT.

Chinese APT group ToddyCat launches new cyber-espionage campaigns (CSO Online) The new campaigns target Asian and European organizations using refined tools and tactics to improve persistence.

A New Protocol Vulnerability Will Haunt the Web for Years (WIRED) Dubbed “HTTP/2 Rapid Reset,” the flaw requires issuing patches to virtually every web server around the world before the problem can be eradicated.

Dozens of Squid Proxy Vulnerabilities Remain Unpatched 2 Years After Disclosure (SecurityWeek) Dozens of Squid caching proxy vulnerabilities remain unpatched two years after a researcher reported them to developers.

What is a Multi-Vector Attack? (Check Point Software) Multi-vector attacks are sophisticated cyberattacks that use multiple methods to gain access to an organization’s systems. For example, an attacker may perform a distributed denial-of-service (DDoS) attack using multiple techniques or types at once. A multi-vector DDoS attack might combine application-level attacks with a TCP flood to increase the probability of overloading the target system.

Across U.S., Chinese Bitcoin Mines Draw National Security Scrutiny (New York Times) Microsoft reported one site in Wyoming because of its proximity to a data center and nuclear missile base. Records show other cryptocurrency facilities have ties to the Chinese state.

Bitcoin, Ethereum worth $1.8 million stolen in a phishing incident on a fake search website (FXStreet) Phishing has become a tempestuous topic in the cryptocurrency industry, with numerous reports of attacks on different ecosystems. Seemingly, the issue

Cloud gaming firm Shadow says hackers stole customers' personal data (TechCrunch) The stolen data includes customers' full names, email addresses, dates of birth, billing addresses and credit card expiry dates, Shadow says.

PC streaming service Shadow discloses security breach (The Verge) Shadow says no passwords or banking data was compromised.

Shadow silent on data breach as hacked data appears genuine (TechCrunch) The hacker claims to be selling data on more than 530,000 Shadow customers. TechCrunch has verified a sample of the data appears authentic.

530K people's info stolen from cloud PC gaming's Shadow (Register) Will players press start to continue with this outfit?

Reports of second cyberattack on Colonial Pipeline false, company says (FOX 5 Atlanta) Colonial Pipeline, the nation’s largest fuel pipeline, says reports of another ransomware attack are not true.

Colonial Pipeline attributes ransomware claims to ‘unrelated’ third-party data breach (Record) Colonial Pipeline said there has been no disruption to pipeline operations or their systems after a ransomware gang made several threats on Friday afternoon.

CDW investigating ransomware gang claims of data theft (Record) The multibillion-dollar technology services firm CDW said it is investigating claims made by a ransomware gang that data was stolen during a cyberattack.

Lockbit ransomware gang demanded an 80 million ransom to CDW (Security Affairs) The Lockbit ransomware gang claims to have hacked the technology services giant CDW and threatens to leak the stolen data.

Hacker Claims to Have Published St. Louis Transit Data (GovTech) The hacker behind a recent cyber attack against St. Louis’ Metro Transit claims to have published the data. It is unclear what data was published or whether it included sensitive personal information.

Encore Pharmacy Files Notice of Data Breach Impacting the Personal Information of Over 30k People (JD Supra) On September 15, 2023, Encore Pharmacy, formerly known as Founder Project Rx, Inc., and before that, as Recept Group (“Encore,” “Founders”), filed a...

Alphv gang stole 5TB of data from Morrison Community Hospital (Security Affairs) The Alphv ransomware group added the Morrison Community Hospital to its dark web leak site. Threat actors continue to target hospitals.

Ashkenazi Jews targeted in 23andMe data breach. What now? (NewsNation) Users should also change passwords on other sites if they reused the same ones as on 23andMe.

Security Patches, Mitigations, and Software Updates

Juniper Networks Patches Over 30 Vulnerabilities in Junos OS (SecurityWeek) Juniper Networks patches over 30 vulnerabilities in Junos OS and Junos OS Evolved, including nine high-severity bugs.

Microsoft: October Windows 10 security updates fail to install (BleepingComputer) Microsoft says Windows 10 security updates released during this month's Patch Tuesday may fail to install with 0x8007000d errors, although initially displaying progress.

Steam enforces SMS verification to curb malware-ridden updates (BleepingComputer) Valve has announced implementing additional security measures for developers publishing games on Steam, including SMS-based confirmation codes. This is to deal with a recent outbreak of malicious updates pushing malware from compromised publisher accounts.

Microsoft Set to Retire Grunge-Era VBScript, to Cybercrime's Chagrin (Dark Reading) Popular malware like QakBot and DarkGate rely on VBScript, which dates back to 1996 — but their days are numbered now that Microsoft is finally deprecating the Windows programming language.

Microsoft to Phase Out NTLM in Favor of Kerberos for Stronger Authentication (The Hacker News) Microsoft plans to phase out the '90s NT LAN Manager (NTLM) in favor of a stronger focus on Kerberos for authentication in Windows 11.

Ubuntu discovers 'hate speech' in release 23.10 — how to upgrade? (BleepingComputer) Ubuntu, the most popular Linux distribution, has pulled its Desktop release 23.10 after its Ukrainian translations were discovered to contain hate speech. According to the Ubuntu project, a malicious contributor is behind anti-Semitic, homophobic, and xenophobic slurs that were injected into the distro via a "third party tool."

YouTube Takes on Ad Blockers with Warning Pop-Ups (Hackread - Latest Cybersecurity News, Press Releases & Technology Today) YouTube has been actively displaying pop-up warnings to users who have ad blockers installed on their browsers, urging them to disable them.

Trends

Many of us are giving up on cybersecurity best practices (TechRadar) Cybersecurity overwhelms consumers, report claims

Greed and folly feeding cyber fraud (The New Indian Express) As the ease of transaction increases, vulnerability to exploitation increases manifold.

Cyber Insecurity: Report Finds Majority of Enterprises Expect an Imminent Cyber Attack (Commvault) Commvault and IDC explore Cyber Resilience in new report. Findings cover C-level involvement, fears around data loss, and the need for automation.

Marketplace

Sandvine Scraps Plan to Market Tool in US That Tracks Encrypted Messages (Bloomberg) Computer networking company lays off 50 employees, including many of those working on ‘Digital Witness’

Big layoffs in IT industry: 23 techies being sacked every hour for past 2 years (ET CIO) Layoffs In IT Industry: In India, edtech major Byju's has announced to lay off 4,000-5,000 employees in a "business restructuring exercise". The startup has eliminated more than 10,000 positions in the past two years.

Cybersecurity company founded by ex-NSA director files for bankruptcy (Reuters) Cybersecurity company IronNet, founded by a former director of the U.S. National Security Agency, has filed for bankruptcy protection in Delaware, seeking to sell its assets.

Why IronNet Ran Out of Cash, Filed For Chapter 11 Bankruptcy (Bank Info Security) Firm Seeks 60-Day Marketing, Sale Process to Test Value of Assets, Equity in Market

CEO Sean Berg Discusses Future of Forcepoint G2CI Following TPG Acquisition (ExecutiveBiz) Forcepoint's Global Governments and Critical Infrastructure cybersecurity business will focus on insider risk and behavior analytics and increase investment in cyber defense technologies against insider threats after being acquired by asset management firm TPG, Forcepoint G2CI CEO Sean Berg told GovInfoSecurity in a recent interview. Berg commented that the divestiture is beneficial for the firm and Forcepoint's commercial business, but the two will continue to collaborate on certain endeavors.

Nutanix, Cisco say buyers will get the best of them both (Register) There's enough overlap that the deal works already. Next: cloud networks and maybe a storage push

Kyndryl’s SD-WAN path now paved with Palo Alto Networks potential (SDxCentral) Kyndryl tapped Palo Alto Networks for a new SD-WAN service that integrates network management with security components.

J3 Consulting Secures Contract with IRS to Enhance Cybersecurity Division - J3 Consulting (J3 Consulting) [Washington, DC, October 13, 2023] — J3 Consulting, a leading provider of comprehensive consulting and cybersecurity services, is pleased to announce that it has been contracted to provide comprehensive acquisition support services for the Internal Revenue Service (IRS) Cybersecurity Security Services & Investment Office. Jeannie Jones-Ledford, J3 President & CEO, noted that the primary

Ex-Deloitte director Ferry Noordzij to help S-RM drive growth in Europe (Consultancy) Global cyber security consultancy S-RM has appointed Ferry Noordzij as its director for Europe.

Entrust Names John Sorensen as Americas Sales Leader for Digital Security Solutions (Yahoo Finance) Entrust, a global leader in trusted payments, identities, and data, today announced that it has named John Sorensen as Regional Vice President (RVP), Sales – Americas, for its Digital Security Solutions portfolio. In this role, he will focus on growing successful customer relationships, opening cross-sales opportunities, expanding our channel presence, and establishing Entrust as a leading provider of cybersecurity solutions.

Former Cyber Command Official Candice Frost Lands at Raytheon (Meritalk) Retired U.S. Army Col. Candice Frost has joined Raytheon as the company’s director of Integrated Department of Defense Account Cybersecurity, Intelligence and Services.

Commvault Appoints Former DOD CNO Analyst and Master Operator Alex Janas as Field Chief Technology Officer, Security (Commvault) Commvault expands cyber resilience leadership with hire of Alex Janas, new Field Chief Technology Officer for Security and Former Department of Defense Computer Network Operations Analyst and Master Operator.

Products, Services, and Solutions

New infosec products of the week: October 13, 2023 (Help Net Security) The featured infosec products this week are from: Appdome, Flexxon, Fortanix, Fortinet, SailPoint, and Vanta.

Next Partners with Brigantia to Tackle Insider Risk (Next) Award winning cybersecurity distributor, Brigantia, is tackling insider risk and data protection head-on with their latest partnership with Next DLP.

Microsoft Defender for Endpoint now stops human-operated attacks on its own (Microsoft) Defenders need every edge they can get in the fight against ransomware. Today, we’re pleased to announce that Microsoft Defender for Endpoint customers will now be able automatically to disrupt human-operated attacks like ransomware early in the kill chain without needing to deploy any other capabilities.

Kaspersky, TSplus sign agreement to create Cyber Immune solutions for remote workers (Manila Standard) Global cybersecurity company Kaspersky and TSplus, a leading provider of Remote Access solutions, today signed a Memorandum of Understanding (MoU)

Cuentas to Introduce Proprietary Mobile Security Technology to the U.S. Market (GlobeNewswire News Room) Cuentas’ Proposed Acquisition of a 75% Equity Stake in World Health Energy Holdings, Inc. (OTC Pink:WHEN) is intended to Expand Cuentas’ Mobile business...

Descope Launches Identity Federation Broker (Descope) Customers can use Descope as an Identity Federation Broker to connect SAML / OIDC applications and IdPs to unify identities across all customer-facing applications.

Fortinet Expands Its Global SASE Points-of-Presence with Google Cloud (Fortinet) Google Cloud Network’s Global Network Edge Locations Will Expand Fortinet’s POP Coverage for Universal SASE Customers

Technologies, Techniques, and Standards

CERT-In issues malware warning, offers free bot-removal tools for Windows and Android (India Today) The Indian Computer Emergency Response Team (CERT-In) has launched an awareness campaign under the Government of India's Digital India initiative to combat rising cases of hacking and malware attack .sa

GitHub - nsacyber/ELITEWOLF: OT security monitoring #nsacyber (GitHub) OT security monitoring #nsacyber. Contribute to nsacyber/ELITEWOLF development by creating an account on GitHub.

NSA Releases EliteWolf GitHub Repository for Securing OT Environments (Security Boulevard) The National Security Agency released a code repository in GitHub to make it easier for critical infrastructure organizations and similar entities to

NSA Creates GitHub Repository of Operational Technology Cyber Threat Detection Signatures (Executive Gov) Looking for the latest Government Contracting News? Read about NSA Creates GitHub Repository of Operational Technology Cyber Threat Detection Signatures.

How to Use MITRE ATT&CK in 2023: A Must-Read Guide (IT Security News) Introduction In 2023, cybersecurity remains a pressing concern for businesses big and small. At the heart of this ever-evolving landscape is the MITRE ATT&CK framework. Designed to arm IT professionals with actionable insights, this framework is more relevant than ever. MITRE ATT&CK serves as a comprehensive guide for understanding the complex tactics and techniques employed

Design and Innovation

Found in Translation: AI Lip-Synch Apps Have Arrived (The Information) Growing up in New Delhi, Gaurav Misra found himself surrounded by a cacophony of languages. On any given day, the software engineer, who speaks fluent English, Hindi and French, would hear a variety of dialects in Hindi, English, Punjabi and Urdu. Misra spent years learning French, which helped ...

Research and Development

New AI algorithm promises defense against cyberattacks on robots (Interesting Engineering) The researchers tested their algorithm on a replica of a US Army combat ground vehicle and found it was 99% effective in preventing a malicious attack.

Academia

Partnership centered in Springfield Union Station lab takes aim at cybercriminals (masslive) The Cybersecurity Center of Excellence in Springfield will be open in mid-2024.

Legislation, Policy, and Regulation

The Path to AI Arms Control (Foreign Affairs) America and China must work together to avert catastrophe.

Australia passes leadership of Five Eyes Law Enforcement Group to the US (ICE) ICE formally assumed chair of the FELEG, on Oct. 14, during a ceremony at the IACP Annual Conference and Exposition in San Diego, California.

Code of practice for app store operators and app developers (new updated version) (GOV.UK) This voluntary Code of Practice sets out practical steps for App Store Operators and App Developers to protect users. The eight principles within the Code refer to globally recognised security and privacy practices. They are not written in a priority order as they are each important in helping to protect users’ security and privacy.

The data dilemma: Companies find India's privacy law a tricky maze to traverse (The Economic Times) The implementation of India’s privacy law is keeping organisations from varied sectors — technology, banking, telecom, medicine, etc — on their toes.

New UK Guidance on Workplace Monitoring (cyber/data/privacy insights) On 3 October 2023, the UK’s Information Commissioner’s Office (ICO) published new guidance on workplace monitoring. The previous guidance was issued in 2011, as part of the ICO’s Employment Practices Code, and was badly in need of updating, given both the development of new monitoring technologies o

Tribal Cybersecurity Grant Program (FEMA) The Tribal Cybersecurity Grant Program provides funding to eligible entities to address cybersecurity risks and threats to information systems owned or operated by, or on behalf of tribal governments.

Biden administration goes back to the drawing board on water cybersecurity (Washington Post) With EPA water cyber rule revoked, the administration still has plans to bolster water cybersecurity

EPA withdraws cyber audit requirement for water systems (Nextgov) The agency asserted that it still “remains committed” to helping states protect their water systems, despite legal challenges to its formal mandate.

EPA says litigation from Republicans, water companies forced withdrawal of cybersecurity memo (Record) The U.S. Environmental Protection Agency (EPA) has decided to rescind a memorandum establishing new cybersecurity guidelines for water systems across the country after Republican lawmakers and water companies filed a lawsuit against the measure.

Is Your Local Water System Vulnerable to Cyberattacks? We May Never Know (PCMAG) The EPA has canceled an effort to require cybersecurity inspections and upgrades at local water systems after a GOP lawsuit argued that the effort was an overreach and too expensive.

Many companies far from ready for fast-approaching SEC cybersecurity deadline (BenefitsPRO) Companies will have to report cyber incidents within four days of determining they're material, a tight timeframe that requires cooperation from third-party service providers that most firms have not yet secured.

Can federal agencies meet the 2024 zero trust deadline? (Federal News Network) In the realm of federal cybersecurity, change is both inevitable and necessary. The urgency of President Biden's 2021 Executive Order to implement a zero trust architecture by September 2024 has set…

Litigation, Investigation, and Law Enforcement

How Ads on Your Phone Can Aid Government Surveillance (Wall Street Journal) Technology embedded in our devices to serve up ads can end up aiding federal agencies that buy the data in bulk.

Star Witness Caroline Ellison Says Sam Bankman-Fried Made ‘Terrible Mistakes’ (New York Times) Mr. Bankman-Fried’s lawyers sought to poke holes in Ms. Ellison’s testimony, but her account remained largely consistent.

Equifax fined £11.1M for 'entirely preventable' mega breach (Register) Not quite a pound for every one of the 13.8 million affected UK citizens, and it could have been more

US Supreme Court temporarily blocks order curbing Biden social media contacts (Reuters) The U.S. Supreme Court on Friday maintained a block on restrictions imposed by lower courts on the ability of President Joe Biden's administration to encourage social media companies to remove content deemed misinformation, including about elections and COVID-19.

23andMe Faces Class Action Lawsuit Following Data Breach (Tech Times) The accounts of celebrities are said to be compromised as well.

FBI arrests and extradites wanted Nigerian cybercriminal to America (Businessday NG) A Nigerian man has been extradited to Nebraska by the FBI for a $6 million fraud. He tricked business employees into wire transfers and preyed on others

A teen's death in a small Michigan town led the FBI and police to an online sexual extortion scheme (AP News) FBI Director Christopher Wray has spoken to one of the nation's largest police groups about how his agency works with police around the United States in tackling violent crime, fentanyl and gangs.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SecurityWeek's Industrial Control Systems (ICS) Cyber Security Conference (Atlanta, Georgia, USA, Oct 23 - 26, 2023) SecurityWeek’s Industrial Control Systems (ICS) Cyber Security Conference is the largest and longest-running event series focused on industrial cybersecurity. Since 2002, the conference has gathered ICS cyber security stakeholders across various industries and attracts operations and control engineers, IT, government, vendors and academics.

CyberTunity Meet Up (Fairfax, Virginia, USA, Oct 26, 2023) Are you an entrepreneur, business owner or investor involved in the cybersecurity field? This is the event for you! Connect and mingle with peers and like minded individuals who share a passion for building a diverse and sustainable cybersecurity ecosystem. Powered by The CyberGuild, CyberTunity is a unique network of entrepreneurs, influencers, business leaders and investors from emerging and growing cyber technology businesses.

2023 Virtual CMMC Summit (Virtual, Nov 1, 2023) For those just embarking on CMMC to those who are compliance experts, PreVeil’s Virtual CMMC Summit will provide you with the opportunity to learn from CMMC experts.

Events

2nd Annual Small Business Cyber Summit (Virtual, Oct 4 - 25, 2023) The Summit, sponsored by the US Small Business Administration, will meet each Wednesday in October. Administrator Isabella Casillas Guzman, head of the U.S. Small Business Administration (SBA) and voice for America's 33 million small businesses in President Biden's Cabinet, announced that the agency will host a free, virtual National Cyber Summit held throughout October 2023. This second annual cybersecurity forum will help introduce American small businesses to tools, tips, and resources to bolster their cybersecurity infrastructure in addition to exploring new trends and challenges entrepreneurs are increasingly facing.

Join us for the 2023 Gone Phishing Tournament. (Virtual, Oct 9 - 27, 2023) The annual Gone Phishing TournamentTM allows you to benchmark your organization's phishing resilience against true global standards. It's not just an exciting event but also a proven way to build a robust cyber-aware culture within your organization.

RhythmWorld (Denver, Colorado, USA, Oct 16 - 18, 2023) RhythmWorld is the premier cybersecurity conference for the latest security insights, perspectives on emerging threats, and support in achieving your security goals. This year, we are happy to announce that we will return to the Mile High City for two full days of interactive peer-to-peer learning, networking, and an unforgettable experience. RhythmWorld attendees gain access to best practices, comprehensive training sessions featuring cybersecurity leaders from across the industry, connections to technical LogRhythm experts, and the chance to compete in a LogWars Capture the Flag (CTF) event.

Authenticate 2023 (Carlsbad, and virtual, California, USA, Oct 16 - 18, 2023) It’s time to modernize your authentication! Organizations around the globe are embracing a new way to authenticate with FIDO standards, moving past passwords and legacy forms of multifactor authentication to provide users with passkeys for phishing-resistant sign-ins. Their results? Strong security, lessened data breach risk, improved user experiences, faster sign-in rates, and reduced costs. Join these industry leaders as they come together at Authenticate 2023, and get the latest tools and insights to get your organization on the path to strong, modern passwordless authentication. Hosted by the FIDO Alliance, Authenticate is the industry’s only conference dedicated to all aspects of user authentication – including a focus on FIDO-based sign-ins. It is the place for CISOs, business leaders, product managers, security strategists and identity architects to get all of the education, tools and best practices to roll out modern authentication across web, enterprise and government applications.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Oct 16 - 20, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry's largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust N2K CyberWire to get the message out. Learn more.