Malware mealkits, and other commodity criminal tools.

Summary

By the CyberWire staff

At a glance.

Malicious packages found attached to NuGet.
Russia will establish an autarkic substitute for VirusTotal.
Commodity tools empower low-grade Russian cybercriminals.
Malware mealkits, and other notes from the cyber underground.
Cybersecurity workforce study.
Full text of US Executive Order now available.

Malicious packages found attached to NuGet.

Researchers at ReversingLabs have discovered “several hundred malicious packages published to the NuGet package manager since the beginning of August.” The researchers note, “[T]hese packages employed an unusual code execution technique that is worth mentioning. Most of the malware published to the NuGet repository places malicious code inside the initialization and post installation PowerShell scripts. These packages use a different approach, with the malicious functionality placed inside the <packageID>.targets file in the ‘build’ directory.” ReversingLabs adds, “Based on our research, this is the first known example of malware published to the NuGet repository exploiting this inline tasks feature to execute malware.”

The NuGet security team has since removed the malicious packages.

Russia will establish an autarkic substitute for VirusTotal.

The Record reports, citing an account in Rosiskaya Gazeta, that Russia is in the process of establishing a free security package for Internet users. Called "Multiscanner," the project will be prototyped this year, further developed in 2024, and released in finished form during 2025. It will perform, Deputy Minister of Digital Development, Communications and Mass Communications Alexander Shoitov says, all the functions of VirusTotal, and then some. Replacement of VirusTotal, however, is a principal goal of the program: Russian authorities regard VirusTotal as a security risk. The Record explains, "Similarly to VirusTotal, the service would ultimately not only remotely check files and links using static analysis, but also conduct behavioral analysis on the suspected malware in virtual controlled sandbox environments."

Join the Lacework CISO book club!

Get a copy of the classic novel, The Phoenix Project, and join quarterly interactive discussions with cybersecurity leaders. Sign up here.

Commodity tools empower low-grade Russian cybercriminals.

"Kopeechka" ('Little Penny," in the familiar diminutive form with which Slavic languages are so rich) is a commodity tool that enables criminals to create large numbers of fake social media accounts by enabling its users to bypass requirements that accounts be associated with unique email addresses and phone numbers. Active since 2019, Kopeechka, the Record reports, has enabled creation of fraudulent accounts in Facebook, X (formerly Twitter), Discord, Telegram, and Roblox.

Trend Micro, whose researchers have investigated the criminal service, says, "Kopeechka does not provide access to email inboxes, but it provides access to emails received from social media platforms. The service has been designed so that the mailbox account is still controlled by Kopeechka and not by any third-party user." The study adds, "We suspect that these email addresses are either created by Kopeechka actors themselves or possibly compromised email inboxes, as we’ve previously seen these actors post messages in underground communities’ compromised email threads. Kopeechka also purchases email accounts."

The service is actively hawked in criminal-to-criminal (C2C) online souks, and it's supported with user-friendly training and customer service. It's also cheap, with bogus email addresses available for pennies, not dollars. Trend Micro concludes its report with an appraisal of the service's value proposition. "Kopeechka’s services can facilitate an easy and affordable way to mass-create accounts online, which could be helpful to cybercriminals. Kopeechka customers use the service to easily create a large number of accounts without the hassle of SMS and email verification. While Kopeechka is mainly used for multiple accounts creation, it can also be used by cybercriminals who want to add a degree of anonymity to their activities, as they do not need to use any of their own email addresses to create accounts on social media platforms."

Given Russophone criminal gangs' closeness to Russian intelligence and security services, Kopeechka can be expected to turn up in state-sponsored attacks.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Malware mealkits, and other notes from the cyber underground.

Other commodity criminal tools offer turnkey malware to the unskilled bad actor (or to more businesslike operators interested in saving through outsourcing). HP’s Wolf Security Threat Insights Report for Q3 2023 looks at trends in cybercriminal marketplaces, finding that crooks are peddling pre-packaged “malware mealkits” that allow unskilled criminals to carry out sophisticated attacks. Alex Holland, Senior Malware Analyst in the HP Wolf Security threat research team, explained, “Instead of creating their own tools, low-level cybercriminals can access kits that use living-off-the-land tactics. These stealthy in-memory attacks are often harder to detect due to security tool exclusions for admin use, like automation.”

The report makes particular note of two campaigns. One, a Vjw0rm campaign that executes multistage attacks, employs "a 10-year-old Houdini worm and 'living off the land tactics' to remain hidden." The other is a Parallax remote access Trojan (RAT) campaign that runs two threads when a user opens the bait: one thread opens the file, and the other runs the malware. Wolf Security calls this a "Jekyll and Hyde attack"--the connection between the threads may not be obvious, and the victims may not recognize that they're under attack at all.

The report also found that criminals frequently scam each other, offering fake, malicious versions of popular commodity malware strains. For a sense for what the malware costs in the C2C market, note that a Parallax mealkit can be rented for just $65 a month. It's not a single-score, big payoff trade. The proprietors' secret would seem to be the proverbial "volume."

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. CyberVista’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

Cybersecurity workforce study.

ISC2 has published its Cyber Workforce Study 2023, finding that “the global cybersecurity workforce has reached 5.5 million people, an 8.7% increase from 2022, representing 440,000 new jobs.” Despite this increase, “[t]he cybersecurity workforce gap has reached a record high, with 4 million professionals needed to adequately safeguard digital assets.”

92% of respondents said their organizations have cybersecurity skills gaps, particularly in cloud computing security, artificial intelligence/machine learning, and zero trust implementation.

Full text of US Executive Order now available.

The White House has made the full text of President Biden's "Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence" available. It's a long document, rich in taskings and deadlines that the previously released Fact Sheet gives summary treatment. For commentary on the Executive Order, see CyberWire Pro here, here, and here.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+614: Riots and disinformation. (CyberWire) Internal Russian problems, including dissent and interethnic conflict, entirely produced by Western and Ukrainian intelligence services. They're provocations, not riots or atrocities, and, above all, they're not Russia's fault.

Israel pushes deeper into Gaza and frees Hamas captive; Netanyahu rejects calls for cease-fire (AP News) Israeli ground forces pushed deeper into Gaza, advancing in tanks and other armored vehicles on the territory’s main city and freeing a soldier held captive by Hamas militants.

Israel targets Hamas tunnels amid hopes more aid will reach civilians in Gaza (the Guardian) IDF says it struck 300 targets this week and killed ‘numerous’ militants, including Hamas commander

Israel Will Press On in Gaza, Netanyahu Says, as Troops Advance (New York Times) In a news conference, Israel’s prime minister said that “calls for a cease-fire are calls for Israel to surrender to Hamas.” He asked nations to back Israel in its fight.

Israel’s ‘step-by-step’ push into Gaza so far and what could come next (The Telegraph) Analysts describe IDF tactics not in terms of shock and awe but as a ‘cautious’ approach which balances competing pressures and priorities

Netanyahu Rejects Calls for a Cease-fire — and for His Resignation. (New York Times) Israel’s prime minister adopted a defiant tone in a rare news briefing, saying that the country would not agree to a halt in attacks because, he argued, doing so would strengthen Hamas.

Where Israeli troops are encircling Gaza City (New York Times) Israel’s military appears to be approaching Gaza City from at least three sides. Photos, videos and satellite imagery show lines of armored vehicles advancing from Gaza’s northern border and taking up positions near a major road farther south.

What is a human shield and how has Hamas been accused of using them? (the Guardian) Israel claims group has placed command centre under hospital and is deliberately shielding behind Palestinian civilians

Israel-Hamas War: Conditions Worsen in Gaza as Israeli Troops Advance (New York Times) Israeli ground troops are edging closer to densely populated Gaza City in an apparent attempt to cut off the northern part of the enclave, Gazan officials said.

Israeli Soldier Rescued After Hamas Abduction (New York Times) The 19-year-old soldier was taken after Hamas gunmen overran and briefly captured a military base in Nahal Oz, just east of the northern Gaza Strip.

German woman whose naked body was paraded around Gaza is dead, say family (The Telegraph) Shani Louk was beheaded, president suggests, after she was abducted by Hamas terrorists during massacre at a music festival

Have war crimes been committed in Israel and Gaza and what international laws apply? (the Guardian) The UN has said there is evidence that international humanitarian laws may have been breached by both sides in the conflict

How internet disruptions caused problems in Gaza over the weekend (Washington Post) How internet disruptions caused problems in Gaza over the weekend

The problem with Starlink in Gaza (POLITICO) Internet connectivity for more than two million people in Gaza has been partially restored after being blacked out by Israeli airstrikes on Friday, but is still far below pre-conflict levels.

Generative AI Is Playing a Surprising Role in Israel-Hamas Disinformation (WIRED) Even as some feared the war would be the first in history to be flooded with machine-made fake images, that hasn’t happened. The technology’s impact on the conflict is far more subtle.

Hamas Is Not ISIS. Here's Why That Matters (TIME) Both groups have committed horrific acts of violence but equating them could lead to bad policy decisions.

India takes strong pro-Israel stance under Modi in a departure from the past (the Guardian) While previous governments kept dealings with Israel largely quiet, the ruling BJP has different priorities

What Russia Hopes to Gain From the Israel-Hamas Conflict (TIME) What to know about Russia’s relationship with Hamas—and what Russia stands to gain from unrest in the Middle East.

Russia-Ukraine war: List of key events, day 615 (Al Jazeera) As the war enters its 615th day, these are the main developments.

Russia-Ukraine war live: UN human rights group believes missile strike that killed 59 in Hroza launched by Russia (the Guardian) UN human rights office report says there was ‘no indication of legitimate military targets’ at or near the cafe at the time of the attack

Not Your Great-Grandmother’s Pogrom: Modern Russia’s Attacks on Jews Are Carried Out by Muslims (The New York Sun) The violence over the weekend spanned across an arc of 400 miles, and more is being incited for Thursday of this week.

US dismisses Putin’s claim that west was behind Dagestan antisemitic riots (the Guardian) US National Security Council spokesman John Kirby denies any role, saying airport mob was display of ‘hate, bigotry and intimidation, pure and simple’

What are the takeaways from Ukraine’s fight in the Black Sea? (Defense News) Opinion: Today’s struggles in the Black Sea may herald a changing face of naval warfare, in which large warships are increasingly vulnerable.

Russia to launch its own version of VirusTotal due to US snooping fears (Record) The repository, to be called “Multiscanner,” would mimic the Google-owned platform, which allows organizations to share suspected malware.

Russian hacking tool floods social networks with bots, researchers say (Record) Low-skill cybercriminals are using a new tool to create hundreds of fake social media accounts in just a few seconds.

How Kopeechka, an Automated Social Media Accounts Creation Service, Can Facilitate Cybercrime (Trend Micro) This report explores the Kopeechka service and gives a detailed technical analysis of the service’s features and capabilities and how it can help cybercriminals to achieve their goals.

Eurozone economy shrinks amid German slump - latest updates (The Telegraph) The eurozone economy shrank for the first time since the first Covid lockdowns, official figures show, as it was weighed down by a slump in Germany.

New Unilever boss is still getting it wrong on Russia | Nils Pratley (the Guardian) The Dove and Magnum maker says it wants to make a ‘positive impact’ but pays taxes to a state waging an illegal war in Ukraine

Is Belarus the Real Beneficiary of Putin’s War? (Foreign Affairs) The stalemate in Ukraine has quietly revived Lukashenko's autocracy.

Attacks, Threats, and Vulnerabilities

IAmReboot: Malicious NuGet packages exploit loophole in MSBuild integrations (ReversingLabs) RL has highlighted threats in npm, PyPI and RubyGEMS in recent years. This finding shows NuGet is equally exposed to malicious activities by threat actors.

Malvertising via Dynamic Search Ads delivers malware bonanza (Malwarebytes) Most, if not all malvertising incidents result from a threat actor either injecting code within an existing ad, or intentionally creating...

Hackers Accessed 632,000 Email Addresses at US Justice, Defense Departments (Bloomberg) A Russian-speaking hacking group obtained access to the email addresses of about 632,000 US federal employees at the departments of Defense and Justice as part of the sprawling MOVEit hack last summer, according to a report on the wide-ranging attack obtained through a Freedom of Information Act request.

Cisco IOS XE CVE-2023-20198: Deep Dive and POC (Horizon3.ai) Introduction This post is a follow up to https://www.horizon3.ai/cisco-ios-xe-cve-2023-20198-theory-crafting/. Previously, we explored the patch for CVE-2023-20273 and CVE-2023-20198 affecting Cisco IOS XE and identified some likely vectors an attacker might […]

Hackers Are Weaponizing AI To Improve Phishing Attacks (The Messenger) Phishing attacks are already devastatingly successful, and artificial intelligence is making them even harder to spot.

Cyber terror group "Play" says it stole thousands of files from Dallas County (CBS News) Dallas County employees are bracing for the impact of another reported cyber attack months after a crippling data theft in May.

Dallas County targeted in cyber attack, forensic investigation underway (NBC 5 Dallas-Fort Worth) Dallas County is the latest government entity to be targeted in a cyber attack.

Toronto Public Library facing disruptions due to cyberattack (Record) Canada’s largest public library system said it is dealing with a cyberattack that brought down its website, member services pages and limited access to its digital collections.

Matthew Perry Deserved Better Than #DiedSuddenly (WIRED) Immediately after news of the "Friends" actor’s death broke, conspiracy theorists tried to hijack his legacy.

Vulnerability Summary for the Week of October 23, 2023 | CISA (Cybersecurity and Infrastructure Security Agency CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Security Patches, Mitigations, and Software Updates

VMware Releases Advisory for VMware Tools Vulnerabilities (Cybersecurity and Infrastructure Security Agency CISA) VMware released a security advisory addressing multiple vulnerabilities (CVE-2023-34057, CVE-2023-34058) in VMware Tools. A cyber actor could exploit one of these vulnerabilities to take control of an affected system.

Trends

HP Wolf Security Threat Insights Report Q3 2023 (HP Wolf Security) Welcome to the Q3 2023 edition of the HP Wolf Security Threat Insights Report. In the report, we review notable malware campaigns, trends and techniques identified from HP Wolf Security’s cus…

Proprietary Research from Quantum Xchange Shows the Dreadful State of Enterprise Cryptography (Business Wire) More than Half of All Network Traffic is Unencrypted and Up to 80 Percent Has Some Hackable Flaw in Its Encryption

SlashNext's 2023 State of Phishing Report Reveals a 1,265% Increase in Phishing Emails Since the Launch of ChatGPT in November 2022, Signaling a New Era of Cybercrime Fueled by Generative AI (PR Newswire) SlashNext, the leader in SaaS-based Integrated Cloud Messaging Security across email, web, and mobile, today released the SlashNext State of...

CYFIRMA Industry Report : ENERGY (CYFIRMA) EXECUTIVE SUMMARY The CYFIRMA Industry Report delivers original cybersecurity insights and telemetry – driven statistics of global industries, covering one...

Marketplace

Broadcom hoped to close VMware deal Oct. 30. Here's why that's not happening. (Silicon Valley Business Journal) The merger agreement between the two Silicon Valley companies expires in less than a month.

Snyk welcomes Reviewpad: Code, commit, celebrate! (Snyk) We're excited to announce that Reviewpad is now joining Snyk to help developers code, commit, and stay secure without slowing down.

Proofpoint to Acquire Tessian for AI-Powered Email Security Tech (SecurityWeek) Proofpoint removes a formidable competitor from the crowded email security market and adds technology to address risk from misdirected emails.

Graylog Secures $39 Million Investment to Accelerate Growth and Security Product Line Expansion (Business Wire) Graylog, the Security Information and Event Management (SIEM) and log management company, today announced that it has secured $39 million in funding to help continue its significant growth momentum. New investor Silver Lake Waterman and existing investors Piper Sandler Merchant Banking and Harbert Growth Partners led the funding.

HUB Cyber Security Signs an LOI to Acquire a Strategic Product Developer Cyber Security Company (GlobeNewswire News Room) The potential acquisition is expected to boost HUB’s revenue for Confidential Computing, to improve the company's profit margins while adding multiple...

SolarWinds may be looking to go private again: report (CRN Australia) Observability and IT service management platform developer SolarWinds may be looking to go private in a deal next year.

RapidFort Joins Microsoft for Startups Pegasus Program (Business Wire) The program helps RapidFort drive growth and customer value

Israel's Check Point says cyberattacks rising, sees higher profit (Reuters) Israel has seen a jump in cyberattacks since the Oct. 7 raids by Hamas, but Check Point Software Technologies has continued to operate as planned despite the ensuing war and expects higher annual profits than previously thought, it said on Monday.

How the Economy, Skills Gap and Artificial Intelligence are Challenging the Global Cybersecurity Workforce (ISC2) Cybersecurity professionals are facing greater pressures than ever that diminish their ability to defend institutions and organizations around the world from ever-increasing threats.

UK cyber skills gap grows 29% despite record hiring (Computing) A new report by ISC2 has found that the UK cybersecurity workforce is still falling far short of demand, with a record gap of 73,439, up 29.3% year-on-year.

Exabeam Layoffs Hitting 20% of Workers Amid Restructuring (Channel Futures) Exabeam layoffs are impacting 20% of its workforce amid continuing and challenging macroeconomic conditions.

Verizon has axed another 6,600 jobs so far this year (Urgent Comms) Vonage CEO and Moe Greene lookalike Rory Read was made an offer he couldn’t refuse in late 2021 when Ericsson offered to buy the company he ran for $6.2 billion. Subsequent disclosures by the Swedish vendor showed Read was paid $32.76 million last year, possibly making him the top earner in telecom. The runners-up would likely include […]

TCS Posts Strong Earnings Growth and Large Order Book in Q2 (TCS) Tata Consultancy Services reported its consolidated financial results according to Ind AS and IFRS, for the quarter ending September 30, 2023

Secure Digital Communications Specialist Zivver Makes Moves into US Market (Zivver) Secure Digital Communications Specialist Zivver Makes Moves into US Market. The expansion follows a successful period of growth for Zivver

OPSWAT opens regional office in Dubai to support industrial sector fight against cyberthreats (Zawya) The company’s Middle East, Turkey, and Africa office will feature a state-of-the-art Critical Infrastructure Protection lab

LogRhythm hires Ivanti's Matthew Lowe as A/NZ head (ARN) Security intelligence vendor LogRhythm has hired former Australian and New Zealand vice president Matthew Lowe to lead its business across the A/NZ region.

BlackBerry Taps Richard Lynch as Interim CEO (Wall Street Journal) The cybersecurity company said the move comes after a review of its business which led the company to decide to split into two separate units.

Next DLP appoints Sheena Blanco as its first Head of Customer Experience (PR Newswire) Next DLP ("Next"), a leader in insider risk and data protection, has appointed Sheena Blanco as its first Head of Customer Experience....

Products, Services, and Solutions

Cymulate Recognized for Demonstrating Innovation and Leadership in Breach and Attack Simulation (BAS) (Business Wire) Exposure Management Leader Selected by Cyber Defense Magazine for Exceptional Security and Validation Solutions

TransUnion Introduces TruEmpower™ Scam Blocker to Help Insurers Protect Policyholders from Cyber Threats (GlobeNewswire News Room) Leading edge solution creates safer online experiences for individuals, families, and small businesses...

Dragos and Rockwell Automation Strengthen Industrial Control System Cybersecurity for Manufacturers with Expanded Capabilities (Business Wire) Rockwell Automation will provide ICS/OT Cybersecurity Threat Detection Services, leveraging the Dragos Platform to help Industrial Manufacturers Secure their Environments

Third Wave Innovations Launches Groundbreaking Cyber Network Operations Center (cNOC) to Unite Network and Security Operations (PR Newswire) Third Wave Innovations, a leading integrated risk solutions provider for network and security operations, today announced the launch of a...

Data Theorem Named an Industry Leader in API Security and Management by Industry Analyst Firm KuppingerCole (Business Wire) API Secure Product Earns Highest Possible Scores for Security, Functionality, Deployment, Usability, Innovativeness, and Ecosystem

BCR Cyber Launches FedRAMP Assessor Database (PR Newswire) BCR Cyber, a leading provider of comprehensive cybersecurity training, certification, and job placement services, announces the on-line...

Qualys Announces TruRisk, FixIT and ProtectIT Packages in AWS Marketplace (PR Newswire) Qualys, Inc. (NASDAQ: QLYS), a pioneer and leading provider of disruptive cloud-based IT, security, and compliance solutions, today announced...

Parallels Expands its Focus on Securing the Remote Access Experience, Rebrands Awingu to Parallels Secure Workspace (GlobeNewswire News Room) The new name reflects the product’s fundamental role as a secure remote access solution making it an integral part of the Parallels family....

Cohesity Launches Cohesity SmartFiles Integration on the Snowflake Data Cloud (Business Wire) Integration Maximizes Data Insights with Flexibility for On-Premises and Cloud Analytics While Meeting Data Sovereignty and Compliance Requirements

GCA Launches a User-friendly Cybersecurity Tools Wiki (Global Cyber Alliance) Actionable Cybersecurity Tools (ACT), an initiative by the Global Cyber Alliance (GCA) in partnership with Cyber Civil Defense (CCD) stakeholders, is now available to help individuals and underserved communities find the right solutions for their online protection needs.

StackHawk Offers Developers and Security Teams Modernized API Security with GitHub Insights (PR Newswire) StackHawk, the company making web application and API security testing part of software delivery, announced today the release of a new...

Technologies, Techniques, and Standards

WinMagic Writes Open Letter on New NSA and CISA IAM Guidance (Yahoo Finance) WinMagic Inc. (the “Company” or “WinMagic”) a leading innovator in data security solutions, enthusiastically commends the joint efforts of the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) in creating their groundbreaking document, "Developer and Vendor Challenges: Identity and Access Management." This document provides invaluable assistance to vendors and developers within the cybersecurity

KnowBe4 Analysis Finds Security Awareness Training and Simulated Phishing Effective in Reducing Cybersecurity Risk (Business Wire) New KnowBe4 “Data Confirms Value of Security Awareness Training and Simulated Phishing” white paper now available

Data Confirms Value of Security Awareness Training and Simulated Phishing (KnowBe4) A common question we get from potential customers is if security awareness training and simulated phishing tests have proven tangible value in reducing cybersecurity risk. It does. Our data confirms this.

AI Is Already at War (Foreign Affairs) Artificial intelligence will transform the military.

Design and Innovation

Cyber Innovation Center Awarded $129M in Federal Funding to Boost Louisiana’s Cybersecurity Leadership (Business Wire) CISA Invests $34M in CYBER.ORG, Air Force Global Strike Command Receives $95.6M for STRIKEWERX, Advancing the State’s Position as a Cybersecurity Innovation Hub

Legislation, Policy, and Regulation

Canada bans WeChat, Kaspersky applications on government devices (Reuters) Canada on Monday banned Chinese messaging application WeChat and Russian antivirus program Kaspersky on government-issued mobile devices due to privacy and security risks, but said government information had not been compromised.

Iran’s Regime Moves to Bolster its Cyber Capabilities - Iran News Update (Iran News Update) Iran's regime is rapidly expanding its cyber capabilities, emerging as a potent and multifaceted cyber threat on the global stage.

Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (The White House) By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered as follows: Section 1. Purpose. Artificial intelligence (AI) holds extraordinary potential for both promise and peril. Responsible AI use has the potential to help solve urgent challenges…

ITI: AI Executive Order Can Advance Safe and Secure AI With Industry Collaboration (Information Technology Industry Council) Today, global tech trade association ITI issued the following statement from its Executive Vice President of Policy Rob Strayer in response to President Biden’s Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence...

GSA Administrator praises Executive Order on Artificial Intelligence (GSA) U.S. General Services Administration (GSA) Administrator Robin Carnahan issued the following statement in support of the executive order signed by President Biden on Artificial Intelligen

Three things to know about the White House’s executive order on AI (MIT Technology Review) Experts say its emphasis on content labeling, watermarking, and transparency represents important steps forward.

Biden releases AI executive order directing agencies to develop safety guidelines (The Verge) The executive order comes after a series of non-binding agreements with AI companies.

White House prepares broad AI order including security and safety rules (Record) “The actions that President Biden directed today are vital steps forward in the U.S.’s approach on safe, secure, and trustworthy AI,” the White House said.

Briefing: Biden’s AI Executive Order Requires Google, OpenAI and Others to Share Data (The Information) The Biden administration on Monday issued a far-reaching executive order that gives the federal government the authority to vet the most advanced artificial intelligence software developed by companies such as OpenAI and Google before they release it publicly. Under the order, companies are required to provide federal officials with detailed information about how and where they are developing

Biden’s New Executive Order Will Regulate AI Models That Could Threaten National Security (Forbes) Tech companies are largely applauding the new regulation, which seeks to govern how the federal government will use AI and establish guidelines for companies building new models.

White House AI exec order raises questions on future of DoD innovation (Breaking Defense) "What's really going to matter is how these various departments and agencies actually start building the rules and interpreting the guidance that they received in the executive order," Klon Kitchen of Beacon Global Strategies told Breaking Defense.

ITI Welcomes Industry Engagement in UK Global AI Safety Summit and G7 Hiroshima AI Process - Information Technology Industry Council (ITI) Ahead of the United Kingdom’s Global AI Safety Summit on November 1, global tech trade association ITI’s Executive Vice President of Policy Rob Strayer commended the Summit’s engagement between governments and the technology sector and commitment to the safe and responsible deployment of AI. The summit will highlight AI principles and a code of conduct that are a product of the G7 countries’ Hiroshima AI process, which incorporated industry’s feedback.

FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches (Federal Trade Commission) The Federal Trade Commission has approved an amendment to the Safeguards Rule that would require non-banking institutions to report certain data bre

Expanding CISA’s Zero Trust Role Is Smart: Here’s Why (Booz Allen Hamilton) An independent CSIS report on CISA’s evolving mission proposes ways to strengthen federal cybersecurity.

Republican Senator Calls on CYBERCOM to go on Offense Against Chinese Hackers (Meritalk) Sen. Eric Schmitt, R-Mo., is urging the Pentagon’s Cyber Command (CYBERCOM) unit to take an offensive stance against the Chinese hacking group who breached the State Department, Commerce Department, and House of Representatives emails earlier this year.

House Dems seek guardrails for law enforcement’s use of facial recognition (Nextgov.com) The bill would require agencies to obtain a warrant showing probable cause that an individual has committed “a serious violent felony” before facial recognition can be used.

TikTok, Snapchat and others sign pledge to tackle AI-generated child sex abuse images (Reuters) Tech firms including TikTok, Snapchat and Stability AI have signed a joint statement pledging to work together to counter child sex abuse images generated by artificial intelligence.

The US And Its Allies Are Pledging Never to Pay Hacker Ransoms (The Messenger) Officials from nearly 50 countries will meet in Washington this week to plan the next phase of their war against digital extortion attacks.

Navy’s principal cyber advisor’s 3-year term to end in November | Federal News Network (Federal News Network) Chris Cleary, the Department of the Navy’s principal cyber advisor, is most proud of his work around the Navy’s cyberspace superiority vision and work to better protect operational technology.

Litigation, Investigation, and Law Enforcement

US regulators sue SolarWinds and its security chief for alleged cyber neglect ahead of Russian hack (AP News) U.S. regulators have sued SolarWinds and its top security executive for fraud for allegedly concealing poor cybersecurity practices ahead of the Texas-based technology company's stunning hack by Russian spies.

SEC Sues SolarWinds Over 2020 Hack Attributed to Russians (Wall Street Journal) Regulator says the software company defrauded investors by misleading them about its cyber vulnerabilities.

What to know about the SEC’s case against SolarWinds (Washington Post) The SEC did some new things in its SolarWinds enforcement case

International regulators ask US, Norway to 'immediately disable' Starlink service in Iran (Space Intel Report) International regulators asked the United States and Norway to take “immediate action…

Here's what happened today in Sam Bankman-Fried's trial (CNN) Former crypto billionaire Sam Bankman-Fried, 31, took the witness stand again Monday as his criminal fraud trial continues in Manhattan. He faces life in prison if found guilty of all seven counts of federal fraud and conspiracy.

Sam Bankman-Fried Built a Crypto Paradise in the Bahamas—Now He's a Bad Memory (WIRED) FTX staff lived the high life in the Bahamas. Following the exchange's high-profile collapse, the country is trying to rebuild its reputation.

Briefing: SBF’s Pre-Trial Comments Come Back to Bite Him (The Information) Media interviews, Congressional testimony and tweets came back to bite Sam Bankman-Fried on Monday as he underwent hours of intense questioning from prosecutor Danielle Sassoon in his Manhattan criminal trial. Bankman-Fried repeatedly said he could not recall certain things he said about FTX’s risk management and its relationship with trading firm Alameda. But in many cases, Sassoon pulled up

Alleged sex abuse victims win settlement in data mishandling case (Record) The 129 alleged clergy sex abuse victims whose identities were made public during Chapter 11 proceedings for the Catholic Diocese of Norwich will receive $50,000 apiece.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

2023 Cyversity Annual Conference - Power Up (Orlando, Florida, USA, Oct 29 - 31, 2023) Join us at the 2023 Cyversity Annual Conference - Power Up, October 29-31, 2023, at the Renaissance Orlando at SeaWorld. This conference is perfect for cybersecurity professionals at all levels, whether you're a beginner or a seasoned expert in the field. You’ll experience insightful keynotes, thought-provoking panel discussions, and interactive workshops delivered by the brightest minds in the industry. You'll have the opportunity to connect with like-minded professionals, share your experiences and ideas, and learn about the latest trends and techniques in cybersecurity.

Cybersecurity Career Panel Discussion (Columbia, Maryland, USA, Nov 2, 2023) Do you know a mIddle school, high school or college student interested in cybersecurity? This is the event for them. They will hear what a cybersecurity professional really does and why they should join the Field.. A great learning and networking opportunity. Light refreshments will be served.

Events

2023 Cyversity Annual Conference - Power Up (Orlando, Florida, USA, Oct 29 - 31, 2023) Join us at the 2023 Cyversity Annual Conference - Power Up, October 29-31, 2023, at the Renaissance Orlando at SeaWorld. This conference is perfect for cybersecurity professionals at all levels, whether you're a beginner or a seasoned expert in the field. You’ll experience insightful keynotes, thought-provoking panel discussions, and interactive workshops delivered by the brightest minds in the industry. You'll have the opportunity to connect with like-minded professionals, share your experiences and ideas, and learn about the latest trends and techniques in cybersecurity.

Hardwear.io Security Trainings and Conference (The Hague, Netherlands, Oct 30 - Nov 3, 2023) Learn from leading hardware security researchers & professionals and discuss the latest & most innovative research on attacking and and defending hardware. Connect with industry peers. Join us for a bigger, bolder, and better hardwear.io.

2023 Virtual CMMC Summit (Virtual, Nov 1, 2023) For those just embarking on CMMC to those who are compliance experts, PreVeil’s Virtual CMMC Summit will provide you with the opportunity to learn from CMMC experts.

Cybersecurity Career Panel Discussion (Columbia, Maryland, USA, Nov 2, 2023) Do you know a mIddle school, high school or college student interested in cybersecurity? This is the event for them. They will hear what a cybersecurity professional really does and why they should join the Field.. A great learning and networking opportunity. Light refreshments will be served.

Schellmancon 2023 (Virtual, Nov 3, 2023) This event is intended for our clients, compliance experts, and all with a passion for cybersecurity to share relevant and impactful information in the cybersecurity and compliance space. And it is completely free, including the CPE! Prepare to unite with the foremost thought leaders in the world of compliance, where we discuss the emerging trends in compliance, cybersecurity, threat management, artificial intelligence and more. Industry expert panelists will explore best practice approaches to cybersecurity assessments, and share their winning strategies through networking and knowledge cafes. Participants are automatically enrolled for complimentary training and other prizes. Extend your invitations to your teams and partake in an action-packed, day-long agenda that promises to be truly enriching.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Malware mealkits, and other commodity criminal tools.

At a glance.

Malicious packages found attached to NuGet.

Russia will establish an autarkic substitute for VirusTotal.

Commodity tools empower low-grade Russian cybercriminals.

Malware mealkits, and other notes from the cyber underground.

Cybersecurity workforce study.

Full text of US Executive Order now available.

Notes.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Trends

Marketplace

Products, Services, and Solutions

Technologies, Techniques, and Standards

Design and Innovation

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events