Cyber phases of the Hamas-Israel war remain murky.

Announcement

N2K offers a new, on-demand course.

Based on our CSO's latest book, Cybersecurity First Principles: A Reboot of Strategy & Tactics, N2K has launched an on-demand course, featuring Rick “The Toolman” Howard himself as the instructor. Get a high-level overview of the strategies to pursue the absolute cybersecurity first principle: Reduce the probability of material impact due to a cyber attack. It’s the perfect quick-hitting content for busy security professionals, and it’s available now. Learn more here.

Summary

By the CyberWire staff

At a glance.

The Hamas-Israel war continues to be marked by hacktivism.
Arid Viper's exploitation of Arabic speaker's Android devices.
Iran shows improved cyberespionage capabilities.
A URL shortener in the C2C market.
Taking down the Mozi botnet.
Ransomware in healthcare.
Two Russians arrested on treason charges, accused of hacking for Ukraine.
Ukrainian hacktivist auxiliaries deface Russian payments website.

The Hamas-Israel war continues to be marked by hacktivism.

Hacktivists on both sides continue nuisance-level engagement with targets in Israel and Gaza. C4ISRNet writes, "Such attacks are relatively unsophisticated and have little consequence on national security operations, experts said. While a vandalized website can disconcert the public, it likely does not sidetrack military operations." The outlines of the cyber phases of the current war remain unclear, but IT-Online has a useful table of known hacktivist groups on both sides, with their allegiance and specialties listed.

Arid Viper's exploitation of Arabic speaker's Android devices.

Cisco Talso yesterday published a report on recent activity by Arid Viper, the espionage group based in Gaza and generally held to be affiliated with Hamas. The campaign socially engineers its targets to install malicious software masquerading as an update for the otherwise legitimate dating app Skipped. There's enough overlap in code with Skipped to suggest, Cisco Talos says, "the Arid Viper operators are either linked to Skipped’s developer or somehow gained illicit access to the shared project’s database." Once installed the spyware disables security notifications, collects and exfiltrates a wide range of sensitive information, and establishes a backdoor for installation of other malware on the device.

Despite Arid Viper's association with Hamas, Cisco Talos is agnostic as to whether the cyberespionage campaign is related to the current war with Israel. The operation seems to antedate last month's Hamas attack by some months--the researchers say it was active during 2022.

Iran shows improved cyberespionage capabilities.

A sponsor and ally of Hamas, Iran has shown a recent increase in its cyberespionage capabilities. The New York Times reports that Tehran has mounted ongoing cyberespionage campaigns against regional rivals, especially Israel, but also Saudi Arabia, and Jordan. The campaigns' primary goal, according to Check Point research the Times cites, appears to be espionage, with the secondary purpose of battlespace preparation for possible future disabling cyberattacks.

Join the Lacework CISO book club!

Get a copy of the classic novel, The Phoenix Project, and join quarterly interactive discussions with cybersecurity leaders. Sign up here.

A URL shortener in the C2C market.

Infoblox describes “Prolific Puma,” a threat actor that provides a URL shortening service to cybercriminals: “They create domain names with an RDGA and use these domains to provide a link shortening service to other malicious actors, helping them evade detection while they distribute phishing, scams, and malware.”

The researchers note, “Prolific Puma has registered thousands of domains in the usTLD since May 2023. This is remarkable because, according to the usTLD Nexus Requirements Policy, only U.S. citizens, or U.S.-affiliated businesses are eligible to register domains in it. Moreover, the usTLD requires transparency; no domain names may be registered privately. As a result, the email address, name, street address, and phone number associated with the domain are publicly available. While this might seem a likely deterrent to crime, it has not been effective; the usTLD is well-known for abuse.”

Taking down the Mozi botnet.

ESET has published an analysis of the August 2023 disruption of the Mozi botnet, noting that the botnet contained a kill switch that was targeted by an unknown operator: “We spotted the control payload (configuration file) inside a user datagram protocol (UDP) message that was missing the typical encapsulation of BitTorrent’s distributed sloppy hash table (BT-DHT) protocol. The person behind the takedown sent the control payload eight times, each time instructing the bot to download and install an update of itself via HTTP.”

The researchers add that the kill switch was likely added by Mozi’s developers themselves: “This leads us to the hypothesis suggesting two potential originators of this takedown: the Mozi botnet creators, or Chinese law enforcement forcing the cooperation of the creators. The sequential targeting of bots in India and then in China suggests that the takedown was carried out deliberately, with one country targeted first and the other a week later.”

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. CyberVista’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

Ransomware in healthcare.

Sophos has published a report looking at ransomware in the healthcare industry, finding that attackers succeeded in encrypting data in nearly three-quarters of attacks: “This is the highest rate of encryption in the past three years and a significant increase from the 61% of healthcare organizations that reported having their data encrypted last year.” In 37% of successful attacks, the criminals also stole data. Compromised credentials were the most common root cause of ransomware attacks in the sector.

The researchers also found that “[h]ealthcare organizations are now taking longer to recover, with 47% recovering in a week, compared to 54% last year.” Additionally, the report notes, “The number of healthcare organizations surveyed that paid ransom payments declined from 61% last year to 42% this year. This is lower than the cross-sector average of 46%.”

Two Russians arrested on treason charges, accused of hacking for Ukraine.

Two men in Russia have been arrested on charges of treason in connection with hacking incidents. They're accused of participating in cyberattacks against Russian targets Both men were computer scientists, and both were arrested in Siberia (they're from Tomsk and Kuzbass). The FSB, which has them in custody, hasn't said whether the two men's activities were related. Both are charged under Article 275 of the Criminal Code of the Russian Federation (that is, with "high treason in the form of providing assistance to a foreign state or foreign organization") and face sentences upon conviction of twenty years to life. Kommersant reports that the FSB says both men were working under the direction of Ukrainian intelligence services.

Ukrainian hacktivist auxiliaries deface Russian payments website.

The Record reports that Ukrainian hacktivist auxiliaries associated with DumpForums and the Ukrainian Cyber Alliance defaced the website of NSPK, the Russian-government-operated paycard system. They also claim to have taken some 30 Gigabytes of data from the system, and have posted a screenshot of a folder as evidence of their success. That, of course, is far from a conclusive proof-of-hack.

NSPK confirmed to TASS that its website had been defaced, but denied that any data had been compromised. The bank said that the "Mir" payment system itself was uncompromised, All user data, says NSPK, are safe. The defaced website was run, NSPK explains, by a third-party contractor, and that therefore the attackers had no ability to pivot into sensitive data. Maybe, but third-party responsibility is no more proof-of-security than a screenshot of a folder is proof-of-hack.

Mir, whose name has the double meaning of "world" and "peace," was established to bucket along as a domestic alternative to Western payment systems like Visa and Mastercard. Since the invasion of Ukraine sanctions have left Russians on thin financial services ice, and Mir is intended to give them a reliably accessible payment method. It's not much good for foreign travel, unless you're traveling to Belarus, Cuba, or Venezuela.

The message DumpForums put on the NSPK site announces that Russia has left the Ruble zone, and has adopted cowrie shells as its currency, provisionally, until it can upgrade its currency with sea snails from the Arctic Ocean.. The authors are satirists.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+615: Russian payment system hacked. (CyberWire) Russia detains soldiers accused of atrocity in occupied Ukraine as it tunes its influence campaign. Ukrainian hacktivist auxiliaries deface the website of Russia's payment processing system Mir.

Israel-Hamas War: Conditions Worsen in Gaza as Israeli Troops Advance (New York Times) Israeli ground troops are edging closer to densely populated Gaza City in an apparent attempt to cut off the northern part of the enclave, Gazan officials said.

How Telegram Became a Terrifying Weapon in the Israel-Hamas War (WIRED) Hamas posted gruesome images and videos that were designed to go viral. Sources argue that Telegram’s lax moderation ensured they were seen around the world.

Emotive Deepfakes in Israel-Hamas War Further Cloud What’s Real (Bloomberg) Bogus images include destroyed buildings, children in rubble

The Decolonization Narrative Is Dangerous and False (The Atlantic) It does not accurately describe either the foundation of Israel or the tragedy of the Palestinians.

In Cyberattacks, Iran Shows Signs of Improved Hacking Capabilities (New York Times) A monthslong hacking campaign targeted the governments of regional rivals, including Israel, and marked a turn, a new report says, as the attacks were used to collect intelligence, not just disrupt services.

FBI ‘keeping a close eye’ on Iranian hackers as Israel-Hamas war intensifies (Record) Digital attacks against the U.S. by Iran and non-state actors could worsen if the conflict between Israel and Hamas grows, FBI Director Christopher Wray warned on Tuesday.

Why Iran Is Gambling on Hamas (Foreign Affairs) Tehran’s strategy to weaken Israel and divide the region.

Arid Viper disguising mobile spyware as updates for non-malicious Android applications (Cisco Talos Blog) Since April 2022, Cisco Talos has been tracking a malicious campaign operated by the espionage-motivated Arid Viper advanced persistent threat (APT) group targeting Arabic-speaking Android users.

Arid Viper Targeting Arabic Android Users with Spyware Disguised as Dating App (The Hacker News) Arid Viper, a cyber espionage group linked to Hamas, has been exposed for its Android spyware campaign disguised as a dating app.

‘Hacktivists’ join the front lines in Israel-Hamas war (C4ISRNet) “Attacks are increasing daily, with hundreds of attacks we’ve monitored so far,” said Gil Messing, the chief of staff at Check Point Software Technologies.

The global cyber divide between Gaza and Israel - IT-Online (IT-Online) The conflict between Gaza and Israel has intensified to new heights over the past few weeks, gaining global attention unlike any other. This escalation of tensions has brought about a new battle line, one that only in recent years has become a pillar to modern-day warfare. By Patrick McAteer, cyber threat intelligence analyst at SecurityHQ […]

Austin, Blinken Ask for Funds to Defend Embattled Democracies (U.S. Department of Defense) Secretary of Defense Lloyd J. Austin III and Secretary of State Antony Blinken made the case for funding to aid two democracies fighting for survival: Israel and Ukraine.

Stem Ukraine spending now and Putin wins, Austin warns Congress - Breaking Defense (Breaking Defense) "It's hard to put an exact timeline on how long it would take… [but] I can guarantee you without our support, Putin will be successful,” Secretary of Defense Lloyd Austin told lawmakers.

Russia-Ukraine war: List of key events, day 616 (Al Jazeera) As the war enters its 616th day, these are the main developments.

Russia-Ukraine war live: North Korea has sent a million artillery shells to Russia, says South Korea (the Guardian) Seoul says more than 10 shipments of ammunition sent from North Korea to Russia for use in Ukraine war

Ukraine war: Russian attacks force evacuations of children (BBC News) Mandatory evacuations from the frontlines are swelling the ranks of Ukraine's displaced millions.

What I learnt touring Ukraine’s 400-mile front line (The Telegraph) Three weeks visiting counter-offensive positions reveals brutal attritional fighting and fading hope for early breakthrough

More than 40% of Ukrainians need humanitarian help under horrendous war conditions, UN says (AP News) A senior U.N. official says Russian strikes are inflicting unimaginable suffering on the people of Ukraine and that more than 40% of them need humanitarian assistance.

Most Russians against ending Ukraine war if captured land returned (Euronews) Support for the Kremlin's war aims endures, despite mounting losses and the continued economic fallout of the invasion, according to a poll.

Attempted airport pogrom highlights rising antisemitism in Putin’s Russia (Atlantic Council) An attempted pogrom in southern Russia's Republic of Dagestan has sent shock waves around the world and raised serious questions about the rising tide of antisemitism in Putin’s Russia, writes Joshua Stein.

Russian security service detains two hackers allegedly working for Ukraine (Record) Russia's security service detained two hackers suspected of carrying out cyberattacks on Russian networks on behalf of Ukraine.

Хакеры пошли под следствие (Коммерсантъ) В Томской области и Кузбассе задержаны компьютерщики, обвиняемые в госизмене

Pro-Ukraine group says it breached Russian card payment system (Record) Russia's government-run National Payment Card System (NSPK) and its Mir consumer payment network both were targets, according to a pro-Ukrainian group known as DumpForums and hackers with the Ukrainian Cyber Alliance.

Why Vladimir Putin Is Embracing Germany’s Far Right (The Atlantic) Frustrated by Berlin’s robust response to his invasion of Ukraine, the Russian leader is seeking allies who could disrupt the consensus.

Attacks, Threats, and Vulnerabilities

Apple warns Indian opposition leaders of state-sponsored iPhone attacks (TechCrunch) Apple has warned over a half dozen Indian lawmakers from Prime Minister Narendra Modi's main opposition of their iPhones being targets of state-sponsored Apple has alerted several Indian politicians, party members, and journalists about state-sponsored attempts to target their iPhones.

Apple warns Indian opposition and journalists of state-backed hacking (Washington Post) Apple has warned at least 20 prominent Indians, including opposition politicians and journalists, that they were the target of state-sponsored cyberattacks, in a development that has revived allegations that the government is using electronic surveillance against its domestic political rivals and critics.

NodeStealer attacks on Facebook take a provocative turn – threat actors deploy malvertising campaigns to hijack users’ accounts (Bitdefender Labs) Social media platforms offer immense opportunities for financially motivated threat actors to conduct large-scale attacks against unsuspecting Internet users.

Hunting Vulnerable Kernel Drivers (VMware) In information security, even seemingly insignificant issues could pose a significant threat. One notable vector of attack is through device drivers used by legitimate software developers. There are numerous available drivers to support legacy hardware in every industry, some of which are from businesses that have long stopped supporting the device. To continue operations, organizations rely upon these deprecated device drivers.

Security researchers observed 'deliberate' takedown of notorious Mozi botnet (TechCrunch) Security researchers say the botnet's sudden demise may have been carried out by the original Mozi botnet creator or Chinese law enforcement.

Atlassian Warns of New Critical Confluence Vulnerability Threatening Data Loss (The Hacker News) Atlassian issues a critical warning about a severe flaw in Confluence Data Center and Server

To Aid and Abet: Prolific Puma Helps Cybercriminals Evade Detection (Infoblox Blog) Learn how a link shortening service that supports cybercrime remained undetected for years and was discovered via Domain Name Service (DNS) analytics.

Massive cybercrime URL shortening service uncovered via DNS data (BleepingComputer) A threat actor that security researchers call Prolific Puma has been providing link shortening services to cybercriminals for at least four years while keeping a sufficiently low profile to operate undetected.

Experts released PoC exploit code for Cisco IOS XE flaw CVE-2023-20198 (Security Affairs) Researchers publicly released the exploit code for the critical Cisco IOS XE vulnerability tracked as CVE-2023-20198.

“This vulnerability is now under mass exploitation.” Citrix Bleed bug bites hard (Ars Technica) By some estimates, 20,000 devices have already been hacked.

Hackers Deliver Remcos RAT As Weaponized PDF Payslip Document (GBHackers) AhnLab Security Emergency Response Center (ASEC) has recently revealed a disturbing case of Remcos RAT, a malicious software that can remotely access and manipulate infected machines.

Hackers Are Weaponizing AI To Improve Phishing Attacks (The Messenger) Phishing attacks are already devastatingly successful, and artificial intelligence is making them even harder to spot.

Could a threat actor socially engineer ChatGPT? (Security Intelligence) Large language models have safeguards to prevent misuse. However prompt injections may allow attackers to circumvent those guardrails entirely.

Avast confirms it tagged Google app as malware on Android phones (BleepingComputer) Czech cybersecurity company Avast confirmed that its antivirus SDK has been flagging a Google Android app as malware on Huawei, Vivo, and Honor smartphones since Saturday.

Aadhaar details of 81.5 cr people leaked in India's ‘biggest’ data breach (Hindustan Times) The hacker claims to have extracted the information from the Covid-19 test details of the citizens registered with ICMR.

Aadhaar data leak: Massive data breach exposes personal info of 81.5 cr Indians (mint) Data including names, phone numbers, addresses, Aadhaar, passport info for sale. Investigation underway into breach of database.

Aadhaar Data Leak: Info of 81.5 crore Indians on dark web. Top 7 things to know (mint) The leaked information includes names, phone numbers, addresses, Aadhaar, and passport details of Aadhaar registered users, which are available for sale online.

British Library confirms IT outage caused by infosec issue (Register) Internet, phone lines, websites, and more went down on Saturday morning

United Medical Centers Posts Notice of Data Breach Affecting Patients’ SSNs and Protected Health Information (JD Supra) On October 30, 2023, United Medical Centers (“UMC”) filed a notice of data breach with the Attorney General of Texas after discovering that an...

Caesars Hackers Accessed Customer Data and Costs Not Yet Clear (Bloomberg) Caesars Entertainment Inc. said hackers accessed its customer loyalty program database earlier this year, and the costs of the incident cannot yet be determined.

Ace Hardware hit in cyberattack, CEO confirms (Register) US outfit scrambles to repair operations, restore processing of online orders

CISA Adds Two Known Exploited Vulnerabilities to Catalog (Cybersecurity and Infrastructure Security Agency | CISA) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-46747 F5 BIG-IP Authentication Bypass Vulnerability CVE-2023-46748 F5 BIG-IP SQL Injection Vulnerability

Security Patches, Mitigations, and Software Updates

CISA Releases Three Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency | CISA) CISA released three Industrial Control Systems (ICS) advisories on October 31, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

20 Years Later, Is Patch Tuesday Enough? (Dark Reading) Microsoft's longstanding practice isn't enough to handle its vulnerability problem.

Trends

Credential Phishing IOCs Jump 45% in Q3 | Cofense (Cofense) Find out how malicious actors stayed active and invaded secure environments in the third quarter of 2023. Get insight on credential phishing from Cofense.

TCS announces 2024 cybersecurity trends (TCS) 1. Generative AI Creates Security Opportunities and Pronounces Threats

2022 RTF Global Ransomware Incident Map: Attacks continue worldwide, groups splinter, education sector hit hard (Institute for Security and Technology) According to ecrime.ch data, confirmed ransomware incidents occurred in 105 countries, originating from 58 ransomware groups. This number is relatively consistent with last year’s data, in which we calculated that incidents impacted organizations in 109 countries and documented at least 60 distinct ransomware families. Though the overall statistics remain relatively consistent from last year to this year, there is more to the story: new trends in the ecosystem include the shifting dynamics of ransomware groups, the rise of the education sector as a key target, and the trends in geographic distribution of attacks.

Cybercriminals Successfully Encrypted Data in Ransomware Attacks on Nearly 75% of Healthcare Organizations That Sophos Surveyed (GlobeNewswire News Room) Only 24% of Healthcare Organizations Were Able to Disrupt a Ransomware Attack Before Attackers Encrypted Their Data This is the Lowest Rate of Disruption...

Marketplace

WSJ News Exclusive | Chainguard, an Open-Source Security Firm, Raises $61 Million (Wall Street Journal) The Series B round brings total funding to over $116 million and comes amid rising awareness of the flaws in open-source software.

FusionAuth Secures $65 Million Growth Equity Investment from Updata Partners (GlobeNewswire News Room) With more than 450 customers, FusionAuth will use funding to meet increasing demand for its modern, developer-centric approach to customer identity...

Palo Alto Networks to Acquire Cloud Security Start-Up Dig Security (SecurityWeek) Palo Alto Networks agreed to acquire Dig Security, a provider of Data Security Posture Management (DSPM) technology.

Why there are so many cybersecurity vendors, what it leads to and where do we go from here (Venture in Security) Looking at some of the most prominent reasons why there are thousands of cybersecurity vendors, and why saying “we don’t need 200+ products in the same category doing the same thing” doesn't help.

Budget Cuts, Layoffs Add to Pressure on Cyber Teams (Wall Street Journal) In a new survey, almost half of cybersecurity professionals say their teams have had cutbacks in spending or personnel in the past year.

Security Chiefs Trim the Fat as Budgets Bite (Wall Street Journal) Cyber teams are looking to do more with less in an uncertain economy.

Illumio Appoints Todd Palmer as Senior Vice President of Global Partner Sales and Alliances (GlobeNewswire News Room) 20+ year channel executive to boost global partner sales and foster stronger alliances...

Altiam Digital Announces Security Expert and Industry Veteran Wayne White as CEO (GlobeNewswire News Room) DAVIE, Fla., Nov. 01, 2023 (GLOBE NEWSWIRE) -- Altiam Digital, a provider of security, automation, and technology services, is proud to announce the...

Radiant Logic Upgrades Partner Program Driven by Newly Appointed VP of Global Partners & Alliances (Business Wire) RadiantOne Now Available in AWS Marketplace

Products, Services, and Solutions

Mend.io Announces Mend Renovate Enterprise Edition to Support Dependency Management with Unlimited Scalability (Yahoo Finance) Mend.io, a leader in application security, today launched Mend Renovate Enterprise Edition. Mend Renovate Enterprise Edition adds unlimited server scalability, dedicated support, and premium features to Renovate, the world's leading dependency management tool.

OTORIO Named "Cutting Edge in OT Security Solution" in 11th Annual Top InfoSec Innovator Awards (PR Newswire) OTORIO, the leading provider of OT cyber risk management solutions, today announced it has been named "Cutting Edge in OT Security Solution" in...

Claroty and Rockwell Automation Expand Capabilities to Include SaaS-powered OT Security Solution xDome (Claroty) Partners combine deep threat detection expertise to help manufacturers secure operations

Parallels Expands its Focus on Securing the Remote Access Experience, Rebrands Awingu to Parallels Secure Workspace (Alludo) The new name reflects the product’s fundamental role as a secure remote access solution making it an integral part of the Parallels family

AU10TIX ID Document & Biometric Verification Platform and Reusable ID Solution Now Available in the Microsoft Azure Marketplace (PR Newswire) AU10TIX, a global technology leader in identity verification and management, today announced the availability of its ID Document & Biometric...

ExtraHop® Launches Zero Trust Extension for Netskope (Business Wire) Introduces security service edge (SSE) integration to expand visibility across remote and distributed environments amid zero trust transformations

authID Continues to Innovate its Patented Identity Verification Platform with the Launch of Verified 3.8 (GlobeNewswire News Room) Best-in-class identity security delivers the fast, frictionless, and precise user experience that secures digital ecosystems from fraud and ensures they...

Meta offers an ad-free experience in Europe – for a price (Register) If you're in the EU, EEA, or Switzerland

SecureAuth and BeyondTrust Enhance Technology Partnership with Arculix Integration and BeyondTrust Intelligent Identity & Access Security for Digital Identity Protection (SecureAuth) Passwordless Access Control, Improved Workflows and Continuous Authentication to Access Resources across the Network IRVINE, Calif. – Nov. 1, 2023 – SecureAuth, a leader in access management and authentication, today announced its expanded technology partnership with BeyondTrust, the worldwide leader in intelligent identity and access security. This strategic alliance takes the form of a deeper […]

Alkira Named a 'Leader' and 'Fast Mover' in GigaOm Radar Report for Network as a Service (NaaS) (PR Newswire) Alkira®, the pioneer in agentless, multi-cloud networking, today announced that it has been named a "Leader" and "Fast Mover" in the GigaOm...

EnGenius Releases SecuPoint to Simplify VPN Client Challenges for IT Professionals (PR Newswire) EnGenius Technologies Inc., a global leader in connectivity, is proud to introduce the EnGenius Cloud SecuPoint VPN Client, a groundbreaking...

Arctic Wolf Selected as Trusted Security Operations Partner of the Minnesota Vikings (GlobeNewswire News Room) Security Operations leader helps end cyber risk for over 50 professional sports teams around the world...

Orca Security Announces Generative AI Integration With Amazon Bedrock (Business Wire) Generative AI-Driven Cloud Security Accelerates Risk Remediation and Boosts Security Posture

GTT and Zoom Phone Join to Deliver Resilient, Global Voice Solutions (GlobeNewswire News Room) GTT and Zoom Phone join to deliver resilient, global voice solutions accelerating enterprises to cloud-based telephony, for a better user experience ...

Versa Networks Achieves IPv6 Certification, Ensuring Readiness for Next-Generation Connectivity, Interoperability and Security (Versa Networks) Versa Operating System (VOS) Earns IPv6 Ready “Gold” Logo and USGv6r1 Certifications for Versa SASE and Secure SD-WAN Solutions

Data Theorem Named an Industry Leader in API Security and Management by Industry Analyst Firm KuppingerCole (Data Theorem) API Secure Product Earns Highest Possible Scores for Security, Functionality, Deployment, Usability, Innovativeness, and Ecosystem

DoControl Launches Salesforce Integration Extending Its Comprehensive SaaS Security Platform To All Prominent SaaS Ecosystems (PR Newswire) DoControl, the leading SaaS Security Platform (SSP), today announced the launch of its integration with Salesforce to provide a modern security...

Backslash Security Launches Application Security Posture Management (ASPM) Platform to Fuse In-Depth Reachability Analysis with Cloud-Native Context (GlobeNewswire News Room) By bringing Package Reachability, SCA, SAST, SBOM and other core AppSec capabilities together in a single, visualized ASPM platform, Backslash cuts 99% of...

Technologies, Techniques, and Standards

Complete Communicator: Artificial Intelligence vs. genuine wisdom: Why lawyers remain necessary and continue to add value (Business of Law Digest) Complete Communicator: Artificial Intelligence vs. genuine wisdom: Why lawyers remain necessary and continue to add value By Jay Sullivan AI looms over ev

Mi-Seg: How to protect information assets in the Zero Trust era (Akamai) Amidst multicloud expanses, Mi-Seg shines. Dive into our manga with the cyber ninja, unveiling microsegmentation and clarifying today’s digital labyrinths.

An Introduction to Secure Boot (PRPL) This paper introduces the subject of Secure Boot as a companion to the prpl Secure Boot Requirements document [REF].

Design and Innovation

Microsoft accused of damaging Guardian’s reputation with AI-generated poll (Guardian) Publisher says poll speculating on cause of woman’s death that appeared next to Guardian article caused ‘significant reputational damage’

Research and Development

New Index Finds AI Models Are Murky, Not Transparent At All (Dark Reading) Despite the growing demand for AI transparency, 10 of the better-known models did not score very highly on Stanford's new Foundation Model Transparency Index.

Aqua Security Granted Patent for Innovative Technology to Secure Serverless Container Environments (GlobeNewswire News Room) Patented Aqua MicroEnforcer provides lightweight runtime security where underlying operation system is inaccessible...

Academia

National Security Veteran Andrea Thompson Named CEO of Dakota State University Applied Research Corporation (PR Newswire) Today, Dakota State University announced the appointment of Andrea Thompson as Chief Executive Officer of Dakota State University Applied...

Legislation, Policy, and Regulation

Cyber War: Power, Prestige, International Governance, and Strategy in the Age of Global Polycrisis (OODA Loop) Competing cyber capabilities (on a spectrum from nation-state to non-state actors alike) and cyber-based conflict will continue to restructructure, reformulate, discombobulate, and transform the very essence of what power, prestige, international governance, and geopolitical strategy are in the 21st century. Fueled by the Global Polycrisis, Cyberwars will continue to take center stage. Further jagged transitions, strategies, binaries fractures, major developments, and crucial events in the ongoing cyberwars are compiled here.

China removes anonymity of bloggers' accounts with more than 500,000 followers (Reuters) China's most popular social media platforms on Tuesday announced that "self-media" accounts with more than 500,000 followers will be asked to display real-name information, a controversial measure that has prompted concerns over doxxing and privacy among some users.

World leaders are gathering at the U.K.’s AI Summit. Doom is on the agenda. (Washington Post) Vice President Harris, Tesla CEO Elon Musk and other top executives are heading to the United Kingdom’s Bletchley Park, as Prime Minister Rishi Sunak warns AI could pose catastrophic risks to humanity.

Rishi Sunak’s AI safety summit appears slick – but look closer and alarm bells start ringing | Chris Stokel-Walker (the Guardian) The prime minister wants progress on this tech to be his legacy, but in truth he is failing to equip us for the challenges it brings, says writer Chris Stokel-Walker

With Executive Order, White House Tries to Balance A.I.’s Potential and Peril (New York Times) President Biden announced regulations on Monday that seemed to have a little bit for everyone.

Google Brain founder says big tech is lying about AI extinction danger (Australian Financial Review) The notion that artificial intelligence could lead to the extinction of humanity is a “bad idea” being promulgated by big tech in the hope of triggering heavy regulation that would shut down competition in the AI market, one of the world’s top AI experts warned.

Google DeepMind boss hits back at Meta AI chief over ‘fearmongering’ claim (CNBC) Demis Hassabis said that Google DeepMind wasn't trying to achieve "regulatory capture" when it came to the discussion on how best to approach AI.

What AI.Gov Means For Security (Pelican Zero) A look at the possible impact of the latest Biden EO on AI in the security industry.

At the Direction of President Biden, Department of Commerce to Establish U.S. Artificial Intelligence Safety Institute to Lead Efforts on AI Safety (U.S. Department of Commerce) Today, the Biden-Harris Administration announced that the U.S. Department of Commerce, through the National Institute of Standards and Technology (NIST), will establish the U.S. Artificial Intelligence Safety Institute (USAISI) to lead the U.S. government’s efforts on AI safety and trust, particularly for evaluating the most advanced AI models.

AI threats are here. Are Biden and the energy industry ready? (R Street Institute) Privacy experts say authorities available to a president are limited, arguing that new legislation on Capitol Hill is necessary to protect Americans from AI-caused data breaches. The privacy risk in the energy sector comes from potentially faulty AI products that disseminate data, including from Chinese malware projects that use AI, according to experts. “There are...

Alliance of 40 countries to vow not to pay ransom to cybercriminals, US says (Reuters) Forty countries in a U.S.-led alliance plan to sign a pledge never to pay ransom to cybercriminals and to work toward eliminating the hackers' funding mechanism, a senior White House official said on Tuesday.

US-led cybersecurity coalition vows to not pay hackers' ransom demands (TechCrunch) The first-of-its-kind pledge has seen dozens of governments sign agree not to pay hackers' ransom demands.

Four dozen countries declare they won't pay ransomware ransoms (CyberScoop) The coalition aims to encourage members to no longer pay ransoms demanded by criminal hacking groups to discourage attacks from taking place.

US-led effort edges closer to ransomware payment ban pact (Register) 'We're still in the final throes of getting every last member to sign'

Why ransomware victims can't stop paying off hackers (TechCrunch) As seen by the MGM and Caesars cyberattacks, paying is often the easiest option, but don't expect to get let off the hook so easily.

Inquiry launched into cyber security of UK’s Critical National Infrastructure (Innovation News Network) The UK Government’s Science and Technology Committee has launched an inquiry into the resilience of the UK’s Critical National Infrastructure.

ONCD Can Streamline Cyber Regulatory Landscape Through Public Collaboration - Information Technology Industry Council (ITI) Today, global tech trade association ITI encouraged the Office of the National Cyber Director (ONCD) to harmonize cyber regulations by fostering greater public-private collaboration, involving global partners, and helping build the cyber workforce to fight growing digital threats.

CISA cybersecurity plan offers possibility of real results (C4ISRNet) Opinion: These objectives commit CISA to partnering with the private sector to protect America’s critical infrastructure, the author argues.

Two former cyber officials have advice for the national cyber director nominee (Washington Post) Ingis, Todt talk national cyber director, feds’ unfinished tasks, industry-government collaboration

The FISA Reauthorization Should Codify Safeguards for Non-U.S. Persons (Default) Here’s how the U.S. should codify protections of foreign nationals’ data in the reauthorization of the FISA.

Litigation, Investigation, and Law Enforcement

US SEC sues SolarWinds for concealing cyber risks before massive hacking (Reuters) The U.S. Securities and Exchange Commission on Monday sued software company SolarWinds Corp and its top information security executive, saying they defrauded investors by hiding cybersecurity weaknesses during a massive hack targeting the U.S. government.

SEC Charges SolarWinds and Its CISO With Fraud and Cybersecurity Failures (SecurityWeek) The SEC filed charges against SolarWinds and its CISO Timothy Brown, over misleading investors about its cybersecurity practices and known risks.

SolarWinds and CISO accused of fraud, control failures (Help Net Security) The SEC announced charges against SolarWinds and its CISO, Timothy G. Brown, for fraud and internal control failures.

SEC accuses SolarWinds CISO of misleading investors before Russian cyberattack (TechCrunch) The U.S. Securities and Exchange Commission has charged SolarWinds and its top cybersecurity executive Timothy Brown with fraud and internal control

Cybersecurity Leaders Spooked by SEC Lawsuit Against SolarWinds CISO (SecurityWeek) The SEC's lawsuit against the CISO of SolarWinds is leaving CISOs across the industry spooked and reevaluating their roles.

X Banned the Account of a Major Critic. Now He’s Taking It to Court (WIRED) Software developer Travis Brown’s X account was banned after his research alleged far-right influencers were becoming more prominent on the platform. He’s taking X to court in a bid to reverse the decision.

HHS’ Office for Civil Rights Settles Ransomware Cyber-Attack Investigation (HHS.gov) Press release for cyber attack investigation

SBF Shifts Blame to His Inner Circle (The Information) Former FTX CEO Sam Bankman-Fried wrapped up testimony in his criminal case on Tuesday, capping off four days on the stand by downplaying his role in the misuse of billions in customer funds. In his testimony, Bankman-Fried emphasized his hands-off management style and at times deflected blame to ...

Feds Levy First-Ever HIPAA Fine for Ransomware Data Breach (BankInfo Security) A Massachusetts-based medical management firm holds the dubious honor of being the first ransomware victim fined for a data breach by the Department of Health and

Attorney General Tong Issues Inquiry Letter to 23andMe Following Data Breach (CT.gov - Connecticut's Official State Website) Attorney General William Tong issued an inquiry letter to genetic testing and ancestry company 23andMe, Inc. seeking details of a data breach that reportedly exposed sensitive records for over five million users, including specifically those of Ashkenazi Jewish and Chinese heritage.

Two Russians indicted for hacking JFK taxi dispatch system (Register) Big Apple unlikely to get a bite out of them at this rate, though

Colorado Calls for Inquiry Into Delayed Data Breach Reporting (Governing) The Department of Higher Education waited eight weeks to notify the attorney general’s office of a data breach that affected thousands of personal records from the last two decades, despite state law requiring a 30-day notice.

Artists Lose First Round of Copyright Infringement Case Against AI Art Generators (The Hollywood Reporter) While a federal judge advanced an infringement claim against Stability AI, he dismissed the rest of the lawsuit.

Jury finds Coast Guard vet, wife guilty in identity theft case (Navy Times) A jury convicted the couple of conspiracy, passport fraud and identity theft for stealing identities and living for decades under the names of dead babies.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cybersecurity Career Panel Discussion (Columbia, Maryland, USA, Nov 2, 2023) Do you know a mIddle school, high school or college student interested in cybersecurity? This is the event for them. They will hear what a cybersecurity professional really does and why they should join the Field.. A great learning and networking opportunity. Light refreshments will be served.

AWS re:Invent 2023 (Las Vegas and Virtual, Nevada, USA, Nov 27 - Dec 1, 2023) Come together with cloud enthusiasts from around the world to hear the latest cloud industry innovations, meet with AWS experts, have fun, and build connections. You’ll gain skills and expertise that would take weeks or months to learn at home.

SANS Stay Sharp: May 2024 (Virtual, May 29 - 31, 2024) At SANS Stay Sharp: May 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Rocky Mountain Summer 2024 (Denver (and virtual), Colorado, USA, Jun 17 - 22, 2024) At SANS Rocky Mountain Summer 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANSFIRE Washington, DC 2024 (Washington (or virtual), DC, USA, Jul 15 - 20, 2024) At SANSFIRE Washington, DC 2024, choose from 48 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Network Security Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Sep 4 - 9, 2024) At SANS Network Security 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Events

Hardwear.io Security Trainings and Conference (The Hague, Netherlands, Oct 30 - Nov 3, 2023) Learn from leading hardware security researchers & professionals and discuss the latest & most innovative research on attacking and and defending hardware. Connect with industry peers. Join us for a bigger, bolder, and better hardwear.io.

2023 Virtual CMMC Summit (Virtual, Nov 1, 2023) For those just embarking on CMMC to those who are compliance experts, PreVeil’s Virtual CMMC Summit will provide you with the opportunity to learn from CMMC experts.

Cybersecurity Career Panel Discussion (Columbia, Maryland, USA, Nov 2, 2023) Do you know a mIddle school, high school or college student interested in cybersecurity? This is the event for them. They will hear what a cybersecurity professional really does and why they should join the Field.. A great learning and networking opportunity. Light refreshments will be served.

Schellmancon 2023 (Virtual, Nov 3, 2023) This event is intended for our clients, compliance experts, and all with a passion for cybersecurity to share relevant and impactful information in the cybersecurity and compliance space. And it is completely free, including the CPE! Prepare to unite with the foremost thought leaders in the world of compliance, where we discuss the emerging trends in compliance, cybersecurity, threat management, artificial intelligence and more. Industry expert panelists will explore best practice approaches to cybersecurity assessments, and share their winning strategies through networking and knowledge cafes. Participants are automatically enrolled for complimentary training and other prizes. Extend your invitations to your teams and partake in an action-packed, day-long agenda that promises to be truly enriching.

CyberSatGov (Reston, Virginia, USA, Nov 6 - 8, 2023) Join like-minded colleagues, high ranking intelligence and DoD officials, cybersecurity professionals, satellite industry providers and integrators in dynamic, high-level discussion, one-on-one networking, and informative, solution-oriented sessions.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Cyber phases of the Hamas-Israel war remain murky.

N2K offers a new, on-demand course.

At a glance.

The Hamas-Israel war continues to be marked by hacktivism.

Arid Viper's exploitation of Arabic speaker's Android devices.

Iran shows improved cyberespionage capabilities.

A URL shortener in the C2C market.

Taking down the Mozi botnet.

Ransomware in healthcare.

Two Russians arrested on treason charges, accused of hacking for Ukraine.

Ukrainian hacktivist auxiliaries deface Russian payments website.

Notes.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Trends

Marketplace

Products, Services, and Solutions

Technologies, Techniques, and Standards

Design and Innovation

Research and Development

Academia

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Newly Noted Events

Events