Cyberespionage services sort themselves out during a time of hybrid war.

Summary

By the CyberWire staff

At a glance.

The Molerats have some new tools.
Israel turns to NSO Group's Pegasus to search for hostages taken by Hamas.
BlackCat uses malicious Google ads.
Social engineering in Q3 2023.
Are small businesses in denial about ransomware?
A look back at Patch Tuesday.
Cyberespionage campaign attributed to Russia's SVR.

The Molerats have some new tools (but stick to their familiar targets).

Proofpoint researchers yesterday described some new activity by TA402, the Palestinian-aligned threat actor better known as the Molerats, and sometimes called the Gaza Cybergang, Frankenstein, or WIRTE. Between July and October TA402 has used a new downloader, IronWind, which they've used to install shellcode in victim systems. The group has also shifted away from using malicious Dropbox links and toward deploying XLL and RAR file attachments, presumably the better to evade detection. TA402's targeting has continued to follow its historical pattern of prospecting Arabic-speaking governmental organizations in the Middle East and North Africa. It hasn't so far shown a shift toward direct support of the war between Hamas and Israel.

Israel turns to NSO Group's Pegasus to search for hostages taken by Hamas.

Israeli authorities are said, Axios reports, to be using NSO's Pegasus zero-click intercept tool to track cellphones belonging to hostages, murdered civilians, and Hamas terrorists in their effort to locate surviving hostages. NSO Group is said to be approaching US officials to ask for relaxation of strictures against its tools, which it argues have become vital to collection against terrorist organizations. There are so far few signs that the US is moving toward such relaxation, imposed after many reports that Pegasus was widely abused by repressive governments, but there do appear to have been some approaches by European governments advocating for NSO Group's restoration to American good graces.

BlackCat uses malicious Google ads.

Researchers at eSentire warn that an ALPHV/BlackCat ransomware affiliate is using malware-laden Google ads to target entities in the Americas and Europe: “This affiliate is taking out Google ads promoting popular software, such as Advanced IP Scanner, Slack, WinSCP, and Cisco AnyConnect, to lure business professionals to attacker-controlled websites. Thinking they are downloading legitimate software, the business professionals are actually downloading the Nitrogen malware. Nitrogen is initial-access malware that leverages Python libraries for stealth. This foothold provides intruders with an initial entry into the target organization’s IT environment.”

Real time cloud security powered by runtime insights. Secure every second.

In the cloud, every second counts. Attacks move at warp speed; security teams must protect the business without slowing it down. Sysdig stops cloud attacks in real time, instantly detecting changes in risk with runtime insights and open source Falco. We correlate signals across cloud workloads, identities, and services to uncover hidden attack paths and prioritize real risk. From prevention to defense, Sysdig helps enterprises focus on what matters: innovation. Visit our website to learn more.

Social engineering in Q3 2023.

Kroll has published its Threat Landscape Report for Q3 2023, finding that social engineering dominated the field last quarter: “This was evidenced by our observations of the dramatic escalation of social engineering tactics, with significant increases in phishing, smishing, valid accounts, voice phishing and other tactics—adding up to the highest volume of incidents we have seen in 2023.” Business email compromise (BEC) attacks rose 13% in Q3 compared to the previous quarter.

The researchers note, “The increasing volume of social engineering attacks is matched by a broadening range of approaches, whether that is via phone and SMS as the group K2A243 (SCATTERED SPIDER) is known to abuse novel email phishing scams, or directly via Microsoft Teams using DARKGATE malware. As part of the rise in social engineering, business email compromise (BEC) continues to grow steadily in popularity, with both established and newer threat actor groups using a range of tactics to access data and, in some cases, ransom the information.”

Are small businesses in denial about ransomware?

A survey by OpenText Cybersecurity has found that a majority (65%) of small-to-medium-sized businesses don’t believe they’ll be targeted by ransomware attacks: “Findings show a similarity in how small-to-medium sized businesses (SMBs) and enterprises (more than 1,000 employees) think about ransomware attacks, including a disconnect about who is a target and growing concern about the use of artificial intelligence (AI) by threat actors. While the majority of organizations don't believe they will be attacked, they do understand the business risks as evidenced by increased security spending and plans to expand security teams.”

In spite of this, 46% of SMBs and enterprises said they were hit by a ransomware attack in the past year.

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. CyberVista’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

A look back at Patch Tuesday.

Microsoft on Tuesday issued patches for fifty-eight vulnerabilities, including five zero-days, BleepingComputer reports. Three of the zero-days (CVE-2023-36036, CVE-2023-36033, and CVE-2023-36025) have been exploited in the wild. The two other zero-days were publicly disclosed before patches were available, but Microsoft says it hasn’t seen evidence of exploitation.

VMware has addressed a critical authentication bypass vulnerability in VMWare Cloud Director Appliance.

Fortinet issued patches for several flaws affecting FortiClient and FortiGate.

SAP has received patches for six flaws, including an improper access control vulnerability with a CVSS score of 9.6, caused by the SAP Business One installation process.

Cyberespionage campaign attributed to Russia's SVR.

Ukraine’s National Cyber Security Coordination Center (NCSCC) has published its analysis of a widespread cyberespionage campaign that, this past September, hit diplomatic targets in Azerbaijan, Greece, Romania and Italy. The foreign ministries of Azerbaijan and Italy were particularly hard hit. The campaign was widely regarded at the time as a Russian intelligence operation, and the NCSCC attributes it directly to APT29, Cozy Bear, a unit of Russia's SVR foreign intelligence service.

The phishbait was familiar: a BMW was offered for sale. The NCSCC gives the enemy service due props for intelligent social engineering: "APT29 ingeniously employed benign-looking lures in the form of enticing BMW car sale photos and documents, expertly crafted to draw in unsuspecting victims." And while the bait may have been old (still, however, effective), the phish hook was new. "The lure documents contained hidden, malicious content that exploited the WinRAR vulnerability, granting attackers access to the compromised systems." The SVR also made creative use of the legitimate Ngrok tool, which is used to provide temporary, public URLs during web development and testing. In this case it enabled them to communicate with infected targets in ways that can be difficult to detect.

In this case the intelligence goal seems only tangentially related to Russia's invasion of Ukraine, except insofar as trouble in the Near Abroad inevitably has repercussions for that war. The SVR appears to have been interested in Azerbaijan's intentions with respect to Nagorno-Karabakh, the province Azerbaijan has disputed with Armenia, and which Azerbaijan seized on September 19th and 20th of this year.

Cozy Bear has been implicated in several other high-profile incidents, including Russian intrusion into US targets related to the 2016 US elections, and the 2020 supply chain attack against SolarWinds users.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+269: Cyberespionage, and a tech exit. (CyberWire) Russian cyberespionage operations are exposed and described. Yandex prepares to sell its assets in Russia as that country's tech sector continues to be sorted out over the war.

IDF says it has entered Gaza’s al-Shifa hospital in ‘targeted operation’ against Hamas (the Guardian) Gaza health ministry says tanks and ‘dozens of soldiers’ inside complex where more than a thousand Palestinian patients, doctors and displaced people are believed to be sheltering

U.S. Says Hamas Operates Out of Gaza Hospitals, Endorsing Israel’s Allegations (New York Times) John Kirby, a spokesman for the National Security Council, said that intelligence from U.S.-generated sources supported Israel’s claim that Hamas has tunnels under Al-Shifa and other hospitals.

Israel missed 'obvious' signs ahead of Oct. 7 Hamas attack, top intel lawmaker says (POLITICO) Rep. Mike Turner is pushing the White House to share more intelligence with Israel.

TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities (Proofpoint) Key takeaways From July through October 2023, Proofpoint researchers observed TA402 engage in phishing campaigns that delivered a new initial access downloader dubbed IronWind.

Pro-Palestinian hacking group evolves tactics amid war (CyberScoop) A long-running espionage campaign shows signs of iteration and development amid Gaza fighting, researchers say.

Pro-Palestine APT Group Uses Novel Downloader in New Campaign (Infosecurity Magazine) TA402 launches new targeted phishing campaigns

Molerats Group Wields Custom Cybertool to Steal Secrets in the Middle East (Dark Reading) The so-called TA402 group continues to focus on cyber espionage against government agencies with the "IronWInd" malware.

Palestinian Hackers Are Getting Smarter. When Will They Enter the War With Israel? (The Messenger) A group of Palestinian hackers have demonstrated increasingly sophisticated attacks but haven't yet jumped into the Gaza conflict.

Israel's NSO unleashes controversial spyware in Gaza conflict (Axios) The Israeli government appears to be turning to controversial spyware maker NSO Group to help track those kidnapped and murdered by Hamas in the last month, according to a source with direct knowledge of NSO's operations.

Russia and Israel lead global surge in attacks on civilian water supplies (the Guardian) Exclusive: at least 228 water conflicts were recorded in 2022 – an 87% rise on the year before, Pacific Institute database shows

Viral Video Of Billboard Replacing Ukraine With Israel Support Is Fake (Forbes) Have you seen video of a digital billboard that appears to show a message of support for Ukraine getting squeezed out by support for Israel? It’s completely fake.

Russia-Ukraine war live: Russia confirms Ukrainian troops have crossed Dnipro River (the Guardian) Ukraine announces ‘foothold’ on left bank of Dnipro River in Kherson region

Ukraine: The Latest (ART19) Russia's full-scale invasion of Ukraine has dominated world news since tanks, jets and troops first crossed Ukraine's borders in February 2022. Every weekday, the Telegraph's top journalists analyse the conflict from all angles. The team consider military strategy, history, economics, the refugee crisis, Ukrainian culture, and daily life in Vladimir Putin's autocratic Russia and Volodymyr Zelensky's democratic Ukraine. On 'Ukraine: The Latest', our correspondents on the ground talk to experts and civilians to cover every aspect of Russia's brutal invasion.

Ukraine’s top general believes technology can defeat Putin’s Russia (Atlantic Council) Ukrainian commander-in-chief Valery Zaluzhny believes technology holds the key to defeating Russia's invasion and argues that drones and electronic warfare can help secure Ukrainian victory, writes Mykola Bielieskov.

Russia Seeks To Send 500 Residents Of Siberian Region To War Weekly (RadioFreeEurope/RadioLiberty) A Russian defense official has requested that Yakutia, an ethnic region in northeastern Siberia, send 500 men to the Ukrainian front on a weekly basis to improve its ranking.

Ukraine war: Russian state media retract report of retreat (BBC News) The Russian defence ministry has blamed the report's publication on a "fake account" linked to Ukraine.

Exclusive: Yandex NV could sell Russian assets all at once (Reuters) Yandex's Dutch holding company is considering selling all its Russian assets at once, rather than just a controlling stake, three people close to the matter told Reuters, as the parties race to finalise a deal before the end of the year.

Yandex to Fully Divest Russian Assets and Distribute Proceeds (Bloomberg) Deal to sell Russian unit may be announced in December. Dutch-registered Yandex previously planned to sell a 51% stake.

Cyber-espionage operation on embassies linked to Russia’s Cozy Bear hackers (Record) Targets in Azerbaijan and Italy bore the brunt of the operation by the Kremlin-backed hackers of APT29, also known as Cozy Bear, according to Ukraine's National Cyber Security Coordination Center.

Could Russia’s Ukraine Cyberattacks Clue Global Threat? (MSSP Alert) Mandiant reports that Russian military-backed operatives attacked Ukraine’s power grid last year.

Ukraine braces for another winter of Russian attacks on power grid (Atlantic Council) While the Ukrainian authorities have had over half a year to prepare for a new wave of Russian air strikes, the country’s civilian energy infrastructure remains vulnerable, writes Aura Sabadus.

Discovery of NTC Vulkan Infrastructure (Censys) Censys researchers discovered six hosts belonging to NTC Vulkan and were able to currently and historically profile the tools and software they hosted, providing a baseline profile of the company.

What’s next for Ukraine’s bid to join the European Union (Atlantic Council) Opening accession negotiations in December would be a boost to Ukraine going into what is shaping up to be a pivotal 2024.

America should look to its own past in supporting Ukraine’s naval battle (Financial Times) The ‘mosquito navy’ is successfully punching above its weight in the Black Sea

Ukraine charges Rudy Giuliani’s top local ally with Moscow-linked treason (POLITICO) Ukraine’s security service says MP was undermining Kyiv-Washington relations under Russian military intelligence orders.

Ukraine Indicts Officials Linked to Efforts to Investigate the Bidens (New York Times) Three officials were accused of operating at the behest of Russian intelligence when they aligned with efforts by Rudolph W. Giuliani to tie the Biden family to corruption in Ukraine.

Finland, Estonia send legal letter to China over Baltic Sea drama (POLITICO) Estonia’s foreign minister says the length of the probe will depend on ‘how cooperative China is.’

Attacks, Threats, and Vulnerabilities

CISA, FBI, and MS-ISAC Release Advisory on Rhysida Ransomware (Cybersecurity and Infrastructure Security Agency | CISA) Today, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA), #StopRansomware: Rhysida Ransomware, to disseminate known Rhysida ransomware indicators of compromise (IOCs), detection methods, and tactics, techniques, and procedures (TTPs) identified through investigations as recently as September 2023.

The attack against Danish critical infrastructure (SektorCERT) In the month of May 2023, Danish, critical infrastructure was exposed to the most extensive cyber-related attack we have experienced in Denmark to date.

Danish energy sector hit by a wave of coordinated cyberattacks (Help Net Security) In May 2023, Danish energy sector has suffered what is believed to be the largest cyberattack in Danish history.

Denmark Hit With Largest Cyberattack on Record (Bank Info Security) Critical infrastructure operators across Denmark experienced the most extensive cybersecurity incident in Danish history earlier this year when hackers exploited

22 Energy Firms Hacked in Largest Coordinated Attack on Denmark's Critical Infrastructure (SecurityWeek) Denmark’s SektorCERT shares details on a coordinated attack against the country’s energy sector.

Danish critical infrastructure hit by the largest cyber attack in Denmark's history (Security Affairs) Danish critical infrastructure was hit by the largest cyber attack on record that hit the country, according to Denmark's SektorCERT.

NCSC: Critical infrastructure security not keeping up with threats (Computing) The UK's National Cyber Security Centre (NCSC) has once again voiced concerns over the rising threat to the UK's critical national infrastructure (CNI) in a report published on Monday.

UK faces “enduring and significant” cyber threats (Cyber Security Hub) UK must accelerate work to keep pace with the evolving CNI threat landscape

The ALPHV/BlackCat Ransomware Gang is Using Google Ads to Conduct… (eSentire) Learn how the ALPHV/BlackCat ransomware gang is using Google Ads to distribute Nitrogen malware and how to protect your organization against this threat.

Protected Virtual Machines Exposed to New 'CacheWarp' AMD CPU Attack (SecurityWeek) CacheWarp is a new attack method affecting a security feature present in AMD processors that can pose a risk to virtual machines.

All the Small Things: Azure CLI Leakage and Problematic Usage Patterns (Palo Alto Networks Blog) Developer usage patterns with Azure CLI may leak sensitive data in CI/CD logs when used in public repositories, potentially exposing critical information.

Microsoft guidance regarding credentials leaked to GitHub Actions Logs through Azure CLI (Microsoft Security Response Center) Microsoft guidance regarding credentials leaked to GitHub Actions Logs through Azure CLI

Microsoft Warns of Critical Bugs Being Exploited in the Wild (SecurityWeek) Redmond’s security response team flags two vulnerabilities -- CVE-2023-36033 and CVE-2023-36036 -- already being exploited in the wild.

Ransomware Roundup – NoEscape (Fortinet Blog) Learn more about the NoEscape ransomware group, a potential successor to Avaddon, which emerged in May 2023, targeting organizations in various industries for financial gain.…

Executing from Memory Using ActiveMQ CVE-2023-46604 (VulnCheck) VulnCheck finds a new way to exploit ActiveMQ CVE-2023-46604 that allows the attacker to hide in memory and avoid process-based detections.

ICBC Flies Top Executives to US in Race to Contain Hack Fallout (Bloomberg) Bank officials arrive in US over weekend after cyberattack. Hard to predict when systems will resume service, people say.

Brazen ransomware attack on US unit of Chinese banking giant has financial sector on alert (CNN Business) A ransomware attack on a US unit of the powerful Industrial and Commercial Bank of China that may have contributed to a brief market sell-off on Thursday was a significant escalation for cybercriminals that underscored how big hacks can disrupt business for even the best-resourced companies, experts told CNN.

Cyberattack cancels online classes at NCCU, disrupts other services (Spectrum News 1) The university did not say when online classes would resume.

Identity of ‘third party’ that brought down Optus network revealed (The Sydney Morning Herald) An executive from the company that contributed to the Optus outage left a Canadian telco less than two weeks after it suffered an almost identical outage last year.

Some Huber Heights data systems remain shut down following cyber attack (Dayton Daily News) A cyber attack leaves the city of Huber Heights without access to critical system databases

Johnson Controls warns of earnings report delay due to cyberattack (Reuters) Building solutions provider Johnson Controls warned of a delay in reporting its fourth-quarter results due to a previously disclosed cybersecurity incident, sending its shares down 1.3% after the bell.

Tom Tugendhat criticizes fake AI attempts to ‘besmirch’ Keir Starmer and Sadiq Khan (Record) Tom Tugendhat, Britain’s minister of state for security — and a Conservative Party politician — decried on Tuesday AI-generated fake audio clips that intended to damage the reputations of high-profile opposition politicians in the United Kingdom.

Team Cymru Releases Comprehensive Report on Banking Digital Risk Landscape, Illuminating Third-Party Risk (Team Cymru) Team Cymru, a global leader in external threat intelligence and digital risk management solutions, today announced the release of its "Digital Ri ...

The Digital Risk Landscape: A Report on Top Financial Institutions & Third Party Risk (Team Cymru) Today, banks and financial institutions are using more technology than ever to offer their customers and shareholders more value, streamline their internal processes, and stay at the forefront of their industry.

Confluence backdoor ‘Effluence’ persists even after patching (Register) Got a Confluence server? Listen up. Malware said to have wide-ranging capabilities

Keeper Security Provides Cybersecurity Warning for Retailers This Holiday Shopping Season (PR Newswire) It's a lucrative time of year, and not just for retail businesses. Cyber criminals also look to take advantage of the increased traffic and...

CISA Adds Three Known Exploited Vulnerabilities to Catalog (Cybersecurity and Infrastructure Security Agency | CISA) CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-36033 Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability CVE-2023-36025 Microsoft Windows SmartScreen Security Feature Bypass Vulnerability CVE-2023-36036 Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability

Security Patches, Mitigations, and Software Updates

Rivian Pushes Broken Software Update That Will Require Physical Repair (404 Media) An over-the-air software update breaks the truck's infotainment system in a way that will require an in-shop repair.

Adobe Releases Security Updates for Multiple Products | CISA (Cybersecurity and Infrastructure Security Agency CISA) Adobe has released security updates to address vulnerabilities affecting multiple Adobe products. A cyber threat actor could exploit some of these vulnerabilities to take control of affected system. CISA encourages users and administrators to review the following advisories and apply the necessary updates.

Fortinet Releases Security Updates for FortiClient and FortiGate (Cybersecurity and Infrastructure Security Agency | CISA) Fortinet has released security advisories addressing vulnerabilities in FortiClient and FortiGate. Cyber threat actors may exploit some of these vulnerabilities to take control of an affected system.

VMware Releases Security Update for Cloud Director Appliance (Cybersecurity and Infrastructure Security Agency | CISA) VMware has released a security advisory addressing a vulnerability in VMWare Cloud Director Appliance. Cyber threat actors may exploit this vulnerability to take control of an affected system.

CISA Releases Two Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency | CISA) CISA released two Industrial Control Systems (ICS) advisories on November 14, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-318-01 AVEVA Operations Control Logger ICSA-23-318-02 Rockwell Automation SIS Workstation and ISaGRAF Workbench

Microsoft Releases October 2023 Security Updates (Cybersecurity and Infrastructure Security Agency | CISA) Microsoft has released updates addressing multiple vulnerabilities in Microsoft software. A cyber threat actor can exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Microsoft’s November 2023 Security Update Guide and apply the necessary updates.

Microsoft's Patch Tuesday fixes five zero-days (Computing) Microsoft has released its November 2023 Patch Tuesday updates, addressing 58 vulnerabilities in its products.

Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws (BleepingComputer) Today is Microsoft's November 2023 Patch Tuesday, which includes security updates for a total of 58 flaws and five zero-day vulnerabilities.

SAP Security Patch Day for November 2023 (Onapsis) SAP released new and updated security patches for its November 2023 SAP Patch Day. Discover key updates, expert insights and how Onapsis contributed.

Intel fixes high-severity CPU bug that causes “very strange behavior” (Ars Technica) Among other things, bug allows code running inside a VM to crash hypervisors.

Trends

Trustwave SpiderLabs Research: Cybersecurity in the Retail Industry (Trustwave SpiderLabs) Download the new Trustwave SpiderLabs report on a months-long investigation into the cyber threats facing the retail industry.

Threat Labs Report — RETAIL 2023 (Netskope) Gain insights into the threats targeting the retail industry. Learn how organizations can defend against these threats.

Q3 2023 Threat Landscape Report: Social Engineering Takes Center Stage (Kroll) In Q3 2023 Kroll observed social engineering evolving from a long-standing security challenge to threat actors’ method of choice. Read more.

OpenText Cybersecurity 2023 Global Ransomware Survey: Companies Still Don't Believe They are Targets for Ransomware Attacks (PR Newswire) OpenText™ (NASDAQ: OTEX), (TSX: OTEX), today released results of its annual 2023 OpenText Cybersecurity Global Ransomware Survey. Findings show...

OpenText Cybersecurity 2023 Global Ransomware Survey: The risk perception gap (OpenText Blogs) The cyber landscape continues to evolve at lightning speed; attacks are more frequent and increasingly sophisticated. And while the use of large language models and generative AI in cybersecurity are still in the early stages, they open the door for attackers with lower skillsets to achieve new capabilities through the generation of malicious code, as …

2023 State of Threat Intelligence (Recorded Future) Dive into the '2023 State of Threat Intelligence' report by Recorded Future. Uncover emerging cyber threats and bolster your defense strategy. Download your free copy now.

The Race to Adapt: Fastly research reveals businesses lost almost 10% of their revenue from cyber attacks in the last year (Fastly) Organizations take an average of up to eight months to recover from the negative effects of security breaches, which include customer account compromises, and large-scale data loss.

CYFIRMA Industry Report : Manufacturing (CYFIRMA) EXECUTIVE SUMMARY The CYFIRMA Industry Report delivers original cybersecurity insights and telemetry-driven statistics of global industries, covering one sector each...

Consumers Are Increasingly Wary of Online Fraud, Yet Half Fail to Take Action (Yahoo Finance) Telesign Trust Index reveals that only 55% of consumers actively protect themselves against cybercrime, underscoring the need for businesses to prioritize fraud management

IANS Research and Artico Search Unveil Annual Security Organization and Compensation Report (PR Newswire) Today, IANS Research and Artico Search released their 2023 Security Organization and Compensation Benchmark Report, an annual research study...

2023 Security Organization & Compensation Benchmark Report (IANS) Download a summary version of IANS’ 2023 Security Budget Benchmark Report to find cross-industry key compensation information for CISOs.

One in Four Gen Z and Millennial Consumers Buy with Bots (EIN News) Research from Netacea reveals that 26% of under-35s are using bots to buy in-demand goods and tickets

Top 200 most common passwords of the year 2020 (NordPass) Here are the worst 200 passwords of 2020. The list details how many times a password has been exposed, used, and how much time it would take to crack it. We also compare the worst passwords of 2019 and 2020, highlighting how their positions have changed. The green arrows indicate a rise in the position while the red ones - a fall off. Check if your password is on the list and strengthen it if it is.

Marketplace

RADICL Raises $12 Million to Deliver Enterprise-Grade Cybersecurity to Underserved SMBs in America’s Critical Infrastructure and Defense Industrial Base (DIB) (Digital Journal) AI-Augmented Xtended Threat Protection (XTP) Platform Built to Fill Critical Cybersecurity Gaps in U.S. Innovation Supply Chain.

RKVST Rebrands as DataTrails (Business Wire) New name highlights company’s unique ability to help customers build immutable audit trails

40 Under 40: Robert M. Lee, Dragos (Baltimore Business Journal) What is a quote or saying that is meaningful to you? Michael Assante was my mentor and while he was here with us, he always focused me on the mission.

1touch.io Appoints Ashish Gupta as CEO and President (PR Newswire) 1touch.io, a pioneer in sensitive data intelligence, today announced Ashish Gupta as its new Chief Executive Officer and President. Gupta will...

Securonix Hires Ivanti Vet as Channel Leader (ChannelFutures) Securonix has hired Ivanti Vet Mark Stevens to lead its partner program.

Adlumin Appoints Jessvin Thomas as Chief Product Officer (Business Wire) Cybersecurity Leader from Barracuda Networks, Blackstone Group and Optiv Steers Product and Service Development for Burgeoning Security Operations Platform and MDR Provider

Products, Services, and Solutions

SecureAuth Arculix Delivers Tailored Digital User Journeys with its Powerful Orchestration Engine (SecureAuth) Companies gain customized end-user experiences while continually managing risk with enhanced orchestration and integrations with Microsoft and Citrix IRVINE, Calif. – November 15, 2023 – SecureAuth, a leader in access management and authentication, today unveiled the latest release of Arculix™, its next-gen access management and authentication platform. Today’s release includes an enhanced Orchestration Engine and […]

Bacula Announces Version 18 of its Backup and Recovery Software for HPC and Large Enterprises (Yahoo Finance) Broad new feature-set facilitates backup for mission-critical, HPC and high-workload IT departments via automation, specialized security tools, storage flexibility and high levels of customizability.

Varonis Adds Generative AI Capabilities to Leading Data Security Platform With Launch of Athena AI (Varonis) Data security leader unveils new AI-powered security analyst and natural language search to transform cybersecurity efficiency

Beyond Identity Releases New Assessment to Guide Companies Toward Zero Trust (Business Wire) Tool helps organizations progress to optimal zero trust maturity by providing a 10,000-foot view of their security environments

KnowBe4 Releases 2023 Holiday Kit to Help People Stay Cyber Safe (KnowBe4) KnowBe4 Releases 2023 Holiday Kit to Help People Stay Cyber Safe

Checkmk announces the ability to monitor GKE Autopilot out of the box (GlobeNewswire News Room) Checkmk is one of a handful of Google Cloud partners that can collect detailed performance and health insights of GKE Autopilot clusters....

LDI Connect Selects HYAS Advanced Threat Intelligence and Protective DNS to Add to Its Managed Security Services Portfolio (Business Wire) HYAS Advanced Threat Intelligence, Detection and Response Lets LDI Connect Identify and Neutralize Adversary Infrastructures Before Attacks Can Occur

Living Security Announces Partnership With Zscaler To Manage Human Risk (Living Security) Living Security announced today a new partnership and technology integration with Zscaler, the leader in cloud security.

Eclypsium and Intel partner to enhance supply chain security (SiliconANGLE) Firmware and hardware security startup Eclypsium Inc. today announced a new collaboration with Intel Corp. to provide enhanced visibility into supply chains with the Eclypsium Supply Chain Security Platform.

Egress and KnowBe4 extend partnership to offer AI-based adaptive email security and training (GlobeNewswire News Room) Seamless bi-directional API integration between Egress and KnowBe4 delivers dynamic threat detection and response combined with fully automated...

Cloud Security Alliance Launches the Industry’s First Authoritative Zero Trust Training and Credential, the Certificate of Competence in Zero Trust (CCZT) (Business Wire) Uniquely positions CSA as the authoritative source to deliver the industry’s first holistic benchmark for measuring Zero Trust knowledge

Cobalt Releases New Enterprise Security Features, Bolsters Large Scale Security Postures (PR Newswire) Cobalt, the leading Pentest as a Service (PtaaS) company modernizing the traditional pentesting model, announced new enterprise offerings...

Living Security Announces Industry’s First Human Risk Operations Center (HROC) (Business Wire) Extends SOC Visibility Beyond Infrastructure and Data by Providing a Comprehensive View of Employee Behavior and Attack Surface

Washington Technology Solutions Partners with Cloud Range to Strengthen Cybersecurity Readiness Across State of Washington (Business Wire) State and local agencies join forces with leading cyber range provider to train and enhance incident response capabilities and bridge the cyber skills gap

CrowdStrike Revolutionizes Security for Small and Medium Businesses (CrowdStrike) CrowdStrike announced a new release of CrowdStrike Falcon® Go, delivering the cybersecurity protection that small and medium businesses need.

Next DLP and Torq Announce New Integration to Hyperautomate Insider Risk Detection and Response (Business Wire) Electric carmaker Rivian, will utilize the joint solution to further harden their defenses against today’s complex threats

Corelight to Participate in Microsoft Security Copilot Preview (Corelight) Corelight is a proud participant in the Microsoft Security Copilot Partner Private Preview.

Chargeflow Launches First Fully Automated Chargeback Solution on the Stripe App Marketplace (GlobeNewswire News Room) Chargeflow launches first fully automated chargeback solution on the Stripe App Marketplace along with a new Chargeflow Alerts feature...

Ground-Truth™, seQure's Flagship Product, Launches as an Unparalleled Cyber-Security and Data Observability Service Capable of Reducing Event Alerts by 90%; First Customer Sees 118x Reduction in False Positive and Alerts (PR Newswire) Ground-Truth™, the flagship product of seQure – the first spin-out of Entanglement, Inc–, launches for commercial and government clients today....

Distology becomes first UK distributor for cyber-sec specialist OPSWAT (CRN) The deal follows signings with MSP Harbor and Drata earlier in the year

Technologies, Techniques, and Standards

DHS Cybersecurity and Infrastructure Security Agency Releases Roadmap for Artificial Intelligence (Cybersecurity and Infrastructure Security Agency) Roadmap Will Guide CISA’s Efforts to Manage the Risks and Harness the Opportunities Posed by Artificial Intelligence to Cybersecurity

Roadmap for AI (Cybersecurity and Infrastructure Security Agency | CISA) CISA has developed a whole-of-agency plan to address the benefits and potential risks of advances in Artificial Intelligence.

CISA roadmap seeks to protect critical infrastructure from AI (CyberScoop) A new strategy document underscores the importance of “secure by design” principles in AI systems and boosting the agency’s AI talent.

CDAO Releases Responsible AI (RAI) Toolkit for Ensuring Alignment With RAI Best Practices (U.S. Department of Defense) The Defense Department Chief Digital and Artificial Intelligence Office publicly released the Responsible Artificial Intelligence Toolkit, a key deliverable of the DOD RAI Strategy and Implementation

Design and Innovation

OpenAI's November 23' Releases Are a Watershed Moment for Human Creativity—and Prompt Injection (Unsupervised Learning) Making it trivial to create and share AI Agents that connect to real-word APIs will have a drastic impact on Information Security

Our approach to responsible AI innovation (blog.youtube) Generative AI has the potential to unlock massive creativity. Learn how YouTube is ensuring these opportunities are balanced with our responsibility to protect our community.

YouTube To Require Disclosure When Videos Include Generative AI (Bloomberg) Site’s creators who repeatedly fail to disclose AI use will face penalties

Academia

UWF Center for Cybersecurity awarded $1.5 million CISA Contract to provide critical cybersecurity training through CyberSkills2Work program (University of West Florida Newsroom) The University of West Florida Center for Cybersecurity received a $1.5 million contract from the Cybersecurity and Infrastructure Security Agency, known as CISA, to expand the CyberSkills2Work program, an intensive cybersecurity training program designed to help individuals launch or advance cybersecurity careers. The training will focus on critical infrastructure security and industrial control systems security. […]

How to Manage Unmanaged Devices in Higher Ed (Ed Tech Magazine) Personally owned and Internet of Things devices can leave university networks vulnerable to cyberthreats.

Schools 'Can't Sit Out' AI, Top U.S. Education Department Official Argues (Education Week) School districts that choose not to engage with AI put their students at a disadvantage, the Ed. Dept. official said.

Legislation, Policy, and Regulation

Senate Urged Not to Extend Surveillance Authority in Stopgap (1) (Bloomberg Law) More than 30 civil liberties and privacy groups wrote to Senate Majority Leader Chuck Schumer (D-N.Y.) on Monday urging him to exclude language reauthorizing a controversial federal electronic surveillance program from a must-pass government spending bill.

Your Complete Guide to the New SEC Cybersecurity Rules (AuditBoard) Are You Ready for the Cyber Disclosure Requirements?

Republicans want to reverse an SEC cybersecurity rule. Here’s why. (Washington Post) Capitol Hill Republicans intensely opposed to a Securities and Exchange Commission cybersecurity rule are using a rare congressional procedure to try to reverse it, with industry groups cheering the lawmakers’ maneuver.

House Intel's plans for controversial surveillance program run into privacy hawk backlash (POLITICO) The talking points from the panel provide previously unreported details on what a forthcoming bill to reauthorize and reform Section 702 will look like.

Governor Hochul Announces Proposed Cybersecurity Regulations for Hospitals Throughout New York State (Governor Kathy Hochul) Governor Hochul announced the proposed regulations, which will help establish policies and procedures to safeguard health care systems.

New York proposes cybersecurity regulations for state's hospitals (StateScoop) Gov. Kathy Hochul proposed rules that include a mandate for hospitals to develop their own cybersecurity programs and incident response plans.

Litigation, Investigation, and Law Enforcement

FBI struggled to disrupt dangerous casino hacking gang, cyber responders say (Reuters) The U.S. Federal Bureau of Investigation (FBI) has struggled to stop a hyper-aggressive cybercrime gang that's been tormenting corporate America over the last two years, according to nine cybersecurity responders, digital crime experts and victims.

FBI takes down IPStorm malware botnet as hacker behind it pleads guilty (Record) The FBI dismantled the IPStorm botnet proxy network and its infrastructure this week following a September plea deal with the hacker behind the operation.

ICE, CBP, Secret Service All Illegally Used Smartphone Location Data (404 Media) A bombshell government report also found that a CBP official used the data to track coworkers with no investigative purpose.

Google Sues Men Who Weaponized DMCA Notices to Crush Competition (TorrentFreak) Two men who allegedly bombarded Google with fraudulent DMCA takedown notices targeting up to 620,000 URLs are being sued by Google.

Google's witness accidentally reveals important detail in antitrust trial (Computing) Google pays Apple 36% of its revenue generated from search advertising through the Safari browser, Google’s source accidentally revealed during the antitrust trial on Monday.

New York proposes cybersecurity regulations for state's hospitals (StateScoop) Gov. Kathy Hochul proposed rules that include a mandate for hospitals to develop their own cybersecurity programs and incident response plans.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Cybersecurity & Ransomware Live! – Part of Live! 360 (Orlando, Florida, USA, Nov 12 - 17, 2023) Are you ready to fortify your organization's cybersecurity and protect it from the ever-evolving threats of the digital world? If so, join us for Cybersecurity & Ransomware Live! (Part of Live! 360) taking place this November 12-17 at the Royal Pacific Resort, Universal Orlando. You will embark on an immersive journey into the world of cybersecurity and learn invaluable strategies to safeguard your digital assets.

SANS Stay Sharp November 2023 (Virtual, Nov 13 - 15, 2023) Hands-on cyber security training taught by world-renowned practitioners. Attend live online. At SANS Stay Sharp November 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Nov 13 - 17, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps.

MILIPOL Paris2023 (Paris Nord Villepinte, France, Nov 14 - 17, 2023) During 4 days, Milipol Paris 2023, organised under the auspices of the French Ministry of Interior and in partnership with several governmental bodies, will be the epicentre of all security-related innovations. For this new edition, Milipol will gather over 1,000 exhibitors, 65% of whom are from outside-France, 30,000 attendants from more than 150 countries, and 150 official delegations.

Aspen Cyber Summit (New York, and virtual, New York, USA, Nov 15, 2023) The Aspen Cyber Summit is a unique, annual gathering that brings together top leaders from business, government, academia, and civil society to discuss the world’s urgent cyber issues and drive action to help secure our digital future. This nonpartisan summit is one of the most significant stages for cyber policy discussion, and spurs dialogue and momentum to act on today’s challenges. The event will feature in-person keynotes, panels, and roundtable lunch discussions. A free live stream will be made available to viewers around the world.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Cyberespionage services sort themselves out during a time of hybrid war.

At a glance.

The Molerats have some new tools (but stick to their familiar targets).

Israel turns to NSO Group's Pegasus to search for hostages taken by Hamas.

BlackCat uses malicious Google ads.

Social engineering in Q3 2023.

Are small businesses in denial about ransomware?

A look back at Patch Tuesday.

Cyberespionage campaign attributed to Russia's SVR.

Notes.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Trends

Marketplace

Products, Services, and Solutions

Technologies, Techniques, and Standards

Design and Innovation

Academia

Legislation, Policy, and Regulation

Litigation, Investigation, and Law Enforcement

Events