Control systems and business systems under attack at utilities.

Summary

By the CyberWire staff

At a glance.

Qlik Sense installations hit with Cactus ransomware.
Report: Google Workspace vulnerability discovered.
CISA and the WaterISAC respond to the Aliquippa cyberattack.
Attacks against infrastructure operators hit business systems.
Major ransomware gang taken down in international sweep.
Hacktivist auxiliary compromises Russian media site.

Qlik Sense installations hit with Cactus ransomware.

Arctic Wolf is tracking a Cactus ransomware campaign that’s exploiting publicly exposed installations of cloud analytics and business intelligence platform Qlik Sense. Qlik issued patches for the vulnerabilities (CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365) earlier this year. The researchers note, “This campaign marks the first documented instance Arctic Wolf is aware of where threat actors deploying Cactus ransomware have exploited vulnerabilities in Qlik Sense for initial access.”

Report: Google Workspace vulnerability discovered.

Researchers at Hunters have discovered a design flaw in Google Workspace's Domain-Wide delegation feature that can lead to “misuse of existing delegations, potentially enabling privilege escalation and unauthorized access to Workspace APIs without Super Admin privileges.”

The researchers say the flaw, which they call “DeleFriend,” “could result in theft of emails from Gmail, data exfiltration from Google Drive, or other unauthorized actions within Google Workspace APIs on all of the identities in the target domain.”

Hunters disclosed the flaw to Google, and says it's working with Google's security and product teams to develop mitigations. A Google spokesperson told Dark Reading, “This report does not identify an underlying security issue in our products. As a best practice, we encourage users to make sure all accounts have the least amount of privilege possible (see guidance here). Doing so is key to combating these types of attacks.”

Uplevel your cloud security posture with CSPM

Is cloud security posture management (CSPM) right for your organization? Watch the webinar to learn about the four generations of CSPMs and building versus buying CSPM tools as well as use cases and real-world CSPM examples. Register today.

CISA and the WaterISAC respond to the Aliquippa cyberattack.

The US Cybersecurity and Infrastructure Security Agency (CISA) confirms that the systems exploited in the weekend attack on the Municipal Water Authority of Aliquippa were Unitronics programmable logic controllers (PLCs). In general, CISA explains, PLCs are used in the water and wastewater sector to "control and monitor various stages and processes of water and wastewater treatment, including turning on and off pumps at a pump station to fill tanks and reservoirs, flow pacing chemicals to meet regulations, gathering compliance data for monthly regulation reports, and announcing critical alarms to operations." CISA urges water utilities using Unitronics PLCs to take the following protective measures:

"Change the Unitronics PLC default password—validate that the default password “1111” is not in use.
"Require multifactor authentication for all remote access to the OT network, including from the IT network and external networks.
"Disconnect the PLC from the open internet. If remote access is necessary, implement a Firewall/VPN in front of the PLC to control network access to the remote PLC. A VPN or gateway device can enable multifactor authentication for remote access even if the PLC does not support multifactor authentication. Unitronics also has a secure cellular based longhaul transport device that is secure to their cloud services.
"Back up the logic and configurations on any Unitronics PLCs to enable fast recovery. Become familiar with the process for factory resetting and deploying configurations to a device in the event of being hit by ransomware.
"If possible, utilize a TCP port that is different than the default port TCP 20256. Cyber actors are actively targeting TCP 20256 after identifying it through network probing as a port associated to Unitronics PLC. Once identified, they leverage scripts specific to PCOM/TCP to query and validate the system, allowing for further probing and connection. If available, use PCOM/TCP filters to parse out the packets.
"Update PLC/HMI to the latest version provided by Unitronics."

The WaterISAC's public discussion of the incident is based on open-source news reports, which they summarize with due concern and without much elaboration. The ISAC does express one animadversion: "Of note, the news site has posted an image stating it was submitted by the water authority. The image suggests the attacker’s message is displayed on the system that was compromised with the Unitronics device and model (V570). While there’s generally nothing wrong with providing attackers messages to the media, perhaps better operational security should be maintained by cropping the image to omit the device and model or other key data."

Attacks against infrastructure operators hit business systems.

Ransomware attacks have continued to hit infrastructure operators. The most recent incidents, unlike the attack on the Municipal Water Authority of Aliquippa, which affected control systems, have been directed against utility business systems. So far their core operations remain unaffected.

The North Texas Municipal Water District (NTMWD) was hit by a cyberattack that affected its business systems, the Record reports. Alex Johnson, director of communications for NTMWD, told Recorded Future News, “Most of our business network has been restored. Our core water, wastewater, and solid waste services to our Member Cities and Customers have not been impacted by this incident, and we continue to provide those services as usual. Our phone system was also affected by this incident, and we hope to have it back online this week. NTMWD has engaged third-party forensic specialists who are actively investigating the extent of any unauthorized activity. The investigation is ongoing at this time and includes a review of any potentially impacted District data.”

Security Affairs reports that the Daixin Team cybercriminal group has added NTMWD to the list of victims on its leak site, claiming to have stolen “board meeting minutes, internal project documentation, personnel details, audit reports, and more.”

State-owned Slovenian power generation company Holding Slovenske Elektrarne (HSE) was hit by a ransomware attack that affected the company’s communication and information infrastructure, Help Net Security reports. HSE General Director Dr. Tomaž Štokelj stated, “We would like to emphasize that the HSE had control over the power plants of the HSE group at all times, safety was also properly taken care of, and the high water alarm system also worked smoothly. Electricity trading has not been interrupted and is being carried out, but out of caution we have somewhat limited the execution of individual transactions.”

Major ransomware gang taken down in international sweep.

Law enforcement entities from seven countries, supported by Eurojust and Europol, have taken action against a criminal network believed to have launched ransomware attacks against more than 1,800 victims in 71 countries, BleepingComputer reports. Eurojust says the operation “led to the arrest of the ringleader and the detention of four suspects in Ukraine. A total of 30 places were searched and over a hundred digital equipment tools were seized.”

Eurojust adds, “The perpetrators are believed to have played different roles in the criminal network. Some were involved in the infiltration attempts, using multiple mechanisms to compromise IT networks, including brute force attacks, so-called SQL injection techniques to attack data applications, stolen credentials, and phishing emails with malicious attachments. Once inside the network, some of these cyber actors used malware such as Trickbot, or post-exploitation frameworks such as Cobalt Strike or PowerShell Empire to remain undetected and gain further access. After remaining undetected in the compromised systems, sometimes for months, the criminals would deploy different types of ransomware, such as LockerGoga, MegaCortex, HIVE, or Dharma. A ransom note was then presented to the victim to pay the attackers in bitcoin in exchange for decryption keys.”

The operation was carried out by law enforcement agencies in France, Germany, the Netherlands, Norway, Switzerland, Ukraine, and the United States.

Hacktivist auxiliary compromises Russian media site.

InformNapalm reports that hacktivists of Ukraine's Cyber Resistance have succeeded in penetrating networks belonging to the Department of Information and Mass Communications (DIMC) at the Russian Defense Ministry. They've made off with internal files that show how the Department monitors international media coverage of Russia's war, summarizes it for internal Ministry consumption, and then selectively repurposes its take to support disinformation campaigns. The general tenor of the Department's information operations is to represent the war as going well, according to plan, and to depict Russian forces as capable and effective.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+683: Disinformation operations. (CyberWire) Russian leaders advance an expansive and ethnocentric narrative of the Russian world to justify Russian expansion.

Hamas and Israel exchange more hostages for prisoners on fifth day of temporary cease-fire (AP News) Hamas released 12 hostages and Israel released 30 Palestinian prisoners on the fifth day of a fragile cease-fire in the Gaza war that mediators hope to extend even as Israel has pledged to resume its offensive.

Fake babies, real horror: Deepfakes from the Gaza war increase fears about AI's power to mislead (AP News) The war in Gaza is highlighting the latest advances in artificial intelligence as a way to spread fake images and disinformation.

Federal officials investigating after pro-Iran group claims to have hacked water authority in Pennsylvania (CNN) Federal officials are investigating after a pro-Iran hacking group claimed to have committed a cyberattack at a water authority in Pennsylvania, according to a state congressman and water authority officials.

Ukraine strikes Russian aircraft factory 200 miles behind enemy lines (The Telegraph) Attack appears to have been part of a wave of 35 drones Ukraine launched in retaliation to a Russian strike over the weekend

Putin debunks his own propaganda by disarming Russia’s NATO borders (Atlantic Council) For the past twenty-one months, Vladimir Putin has consistently blamed NATO for provoking the invasion of Ukraine. According to the Kremlin dictator, years of NATO expansion posed an escalating security threat to Russia that eventually left the country with no choice but to defend itself. This NATO narrative has proven far more persuasive among international audiences than Russia’s more outlandish propaganda about “Ukrainian Nazis” and “Western Satanists.” However, it is now being debunked by Russia’s own actions.

Russia-Ukraine war live: Nato chief warns west not to underestimate Putin (the Guardian) Jens Stoltenberg says Putin’s invasion was a ‘strategic mistake’ but that does not mean Russia should be underestimated

Finland To Close Entire Border With Russia To Stem Flow Of Asylum Seekers (RadioFreeEurope/RadioLiberty) Finland will close its entire border with Russia to travelers for the next two weeks in a bid to halt a flow of asylum seekers to the Nordic nation, the government said.

Many Ukrainians see Putin’s invasion as a continuation of Stalin’s genocide (Atlantic Council) Many Ukrainians see today's ongoing Russian invasion as a continuation of the Stalin regime's genocidal attempts to eradicate Ukrainian national identity and destroy the Ukrainian nation, writes Kristina Hook .

Expert panel: How will Russia’s invasion of Ukraine develop in 2024? (Atlantic Council) How will Russia's invasion of Ukraine develop during 2024? The Atlantic Council hosted a panel of experts to explore the key issues that will likely shape Russia's war in Ukraine during the coming year.

Russia is poised to take advantage of political splits in Ukraine (The Economist) Politics has returned, but the fighting has gone nowhere

In Ukraine, Peace Now Means War Later (Bulwark) Ukraine's war aims are designed to guarantee a lasting peace, not a reprieve before another Russian attack.

Most Russians back war in Ukraine and buy Putin’s case for it, report says (Washington Post) Russians are growing weary of the war against Ukraine but are divided about how much harm it has done and how to end it, according to a report based on polling and focus groups by the Carnegie Russia Eurasia Center and the Levada Center, an independent polling group.

Ukraine to change conscription policies in drive to sustain fighting capacity (the Guardian) Changes to include use of commercial recruitment firms to carry out more targeted conscription, say officials

Stoltenberg Sees U.S. Support For Ukraine Continuing Despite Republican Impasse (RadioFreeEurope/RadioLiberty) NATO Secretary-General Jens Stoltenberg said he expects the United States to continue its support of Ukraine in its fight to repel invading Russian forces despite opposition from some Republican lawmakers who have cast doubt on Washington's aid to Kyiv.

Beyond the SCIF with House Permanent Select Committee on Intelligence Chairman Mike Turner on Ukraine (Atlantic Council) Chairman Michael Turner of the House Intelligence Committee moderates an event highlighting Ukraine’s priorities and needs in the fight, and the role the US and the West play in providing support.

American tanks are fighting Russia. It’s time to see how they perform (The Telegraph) The US Abrams tank is facing off against its Russian equivalents. The gulf in class will soon be clear to all

US Air Force Secretly Deploys Cybersecurity Tech to Safeguard Ukraine's Power Grid Amid Conflict (SOFREP) In a covert yet potent gesture of solidarity, the US has stealthily bolstered Ukraine's defense against cyber threats, marrying technological prowess with a humanitarian spirit in the shadow of conflict.

Ukraine hacks into Russian media database (Cybernews) Ukrainian hacktivists have exposed what appears to be a Russian military propaganda website that cherry-picks Western media sources to make it look like the Kremlin’s war is going well.

Hacking the Infocomms Department of the Russian Ministry of Defense. Katyusha and the secrets of General Konashenkov (InformNapalm) Ukrainian hacktivists of the Cyber Resistance group penetrated the Department of Information and Mass Communications of the Russian Ministry of Defense (DIMC) and handed over unique internal documentation and provided access to the software used by Russian military propagandists to InformNapalm volunteer intelligence community.

Stickers Demanding Return Of Husbands From War In Ukraine Pop Up On Vehicles Across Russia (RadioFreeEurope/RadioLiberty) Stickers demanding Russian husbands be returned from fighting in the Kremlin's war against Ukraine appeared on cars across Russia on November 28.

Officials Confirm Wife Of Ukrainian Military Intelligence Chief Budanov, Others Poisoned (RadioFreeEurope/RadioLiberty) Marianna Budanova, the wife of the chief of Ukraine's military intelligence, Kyrylo Budanov, has been poisoned with heavy metals and is currently in hospital, media reported.

Attacks, Threats, and Vulnerabilities

Emerging MaaS Operator Sordeal Releases Nova Infostealer (CYFIRMA) EXECUTIVE SUMMARY The report highlights a surge in malicious activities by Malware-as-a-service (MaaS) operators Sordeal – particularly with their new...

DJVU Ransomware's Latest Variant 'Xaro' Disguised as Cracked Software (The Hacker News) Beware of Xaro! This DJVU ransomware variant spreads through cracked software, endangering users who download from untrusted sources.

Japan’s space agency suffers cyber attack (Register) JAXA is having a tough time in cyberspace and outer space, the latter thanks to an electrical glitch

200+ Malicious Android Apps Targeting Iranian Banks: Experts Warn (The Hacker News) A new report reveals an ongoing Android malware campaign targeting Iranian banks with over 200 malicious apps.

GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ (Fortinet) This past October, Apache issued a critical advisory addressing CVE-2023-46604, a vulnerability involving the deserialization of untrusted data in Apache.

CVE-2023-46214: the Splunk Remote Code Execution (RCE) Vulnerability (Uptycs) Take a deep dive into the critical CVE-2023-46214 RCE vulnerability in Splunk, learn about its exploitation & find out how to stay secure.

Qlik Sense Exploited in Cactus Ransomware Campaign (Arctic Wolf) Arctic Wolf Labs has observed a new Cactus ransomware campaign which exploits publicly-exposed Qlik Sense installations.

Hackers Can Exploit 'Forced Authentication' to Steal Windows NTLM Tokens (The Hacker News) A vulnerability in Microsoft Access that could be exploited to leak a Windows user’s NTLM tokens.

Exploitation of Critical ownCloud Vulnerability Begins (SecurityWeek) Threat actors have started exploiting a critical ownCloud vulnerability leading to sensitive information disclosure.

Critical Vulnerability Found in Ray AI Framework (SecurityWeek) A critical issue in open source AI framework Ray could provide attackers with operating system access to all nodes.

Exploitation of Unitronics PLCs used in Water and Wastewater Systems (Cybersecurity and Infrastructure Security Agency | CISA) CISA is responding to active exploitation of Unitronics programmable logic controllers (PLCs) used in the Water and Wastewater Systems (WWS) Sector. Cyber threat actors are targeting PLCs associated with WWS facilities, including an identified Unitronics PLC, at a U.S. water facility.

(TLP:CLEAR) Water Utility Control System Cyber Incident Advisory: ICS/SCADA Incident at Municipal Water Authority of Aliquippa (WaterISAC) While few details are currently known, according to open-source reporting, on Saturday the Municipal Water Authority of Aliquippa in western Pennsylvania was attacked by an Iranian-backed cyber group known as CyberAv3ngers. The authority reported the actors were able to gain control of a remote booster station serving two townships, but stressed there is no known risk to the drinking water or water supply. CyberAv3ngers claims to be an active group focused on targeting Israeli water and energy sites – including ten water treatment stations in Israel as of Oct.

Pennsylvania water facility hit by Iran-linked hackers (CyberScoop) An anti-Israel hacking group with links to Iran forced a water facility in Pennsylvania to go into manual operations.

Daixin Team group claimed the hack of North Texas Municipal Water District (Security Affairs) The Daixin Team group claims to have hacked the North Texas Municipal Water District (US) and threatened to leak the stolen data.

North Texas water utility serving 2 million hit with cyberattack (Record) A water utility serving two million people in North Texas is dealing with a cybersecurity incident that caused operational issues.

North Texas Municipal Water District hit by 'cybersecurity incident,' officials say (WFAA) Water, wastewater, and solid waste services for customers and cities have not been affected by the incident.

Slovenian power company hit by ransomware (Help Net Security) Slovenian power company Holding Slovenske Elektrarne (HSE) has been hit by ransomware and has had some of its data encrypted.

DP World confirms data stolen in cyberattack, no ransomware used (BleepingComputer) International logistics giant DP World has confirmed that data was stolen during a cyber attack that disrupted its operations in Australia earlier this month. However, no ransomware payloads or encryption was used in the attack.

Okta Says Hackers Stole Data for All Customer Support Users (Bloomberg) Okta had earlier said breach affected about 1% of customers. Company said some Okta employee information was also stolen.

Line operator says 440,000 personal records leaked in data breach (Kyodo News+) Some 400,000 items of personal data, including some linked to the Line messaging app, may have been leaked by its operator Japanese tech giant LY Corp., according to a company official

Cyber-attack closes hospital emergency rooms in three US states (the Guardian) Ardent Health, which oversees hospitals in states including Texas, New Mexico and Oklahoma said it was targeted over Thanksgiving

Hospitals in at least 4 states diverting patients from emergency rooms after ransomware attack (USA TODAY) Hospitals run by Ardent Health Services in at least four states were diverting patients from their emergency rooms after the health care company was hit by a ransomware attack.

Sexual health and fertility details leaked in ACL data breach (Australian Financial Review) ASX-listed pathology provider Australian Clinical Labs faces potentially millions of dollars in fines for failing to protect sensitive financial and health data.

US healthcare giant Henry Schein hit by second major cyberattack (TechRadar) After a successful attack in October, BlackCat decided to come back for more

Healthcare giant Henry Schein hit twice by BlackCat ransomware (BleepingComputer) American healthcare company Henry Schein has reported a second cyberattack this month by the BlackCat/ALPHV ransomware gang, who also breached their network in October.

N.Y. Attorney General: Syracuse Crouse Health Affected by Data Breach (WKTV NewsChannel2) Over four million New Yorkers, including patients of Crouse Health in Syracuse, were impacted by a recent data breach.

Egyptian E-Payment Vendor Recovering From LockBit Ransomware Attack (Dark Reading) Fawry confirms addresses, phone numbers, and dates of birth, leaked online.

Ethyrial: Echoes of Yore Hit by Ransomware, Player Accounts Deleted (Hackread - Latest Cybersecurity News, Press Releases & Technology Today) The victim company, Gellyberry Studios, an independent game studio, developed Ethyrial: Echoes of Yore.

November 2023 Security Update: LockBit claims responsibility for Canadian Government Employee Data Breach (DevPro Journal) Security updates for November include action items for people impacted by the Canadian employee data breach and a study that shows email inboxes sustain attacks even when SEG security is implemented.

Google Drive users angry over losing months of stored data (BleepingComputer) Google Drive users are reporting that recent files stored in the cloud have suddenly disappeared, with the cloud service reverting to a storage snapshot as it was around April-May 2023.

Google search ads spotted in compromising placements (TechCrunch) Research delving into a less visible component of Google's search ads business -- a network of third-party sites called Google Search Partners (also known Research delving into a less visible component of Google's search ads business -- a network of third party sites it calls Google Search Partners (or the GSP network) -- has documented scores of instances of Google search ads being served on non-Google websites the media buyers paying for the marketing campaigns probably weren't bargaining for...

Telegram’s Bans on Extremist Channels Aren't Really Bans (WIRED) A WIRED analysis of more than 100 restricted channels shows these communities remain active, and content shared within them often spreads to channels accessible to the public.

Elon Musk Is Giving QAnon Believers Hope Just in Time for the 2024 Elections (WIRED) Musk’s recent use of the term “Q*Anon” is his most explicit endorsement of the movement to date. Conspiracists have since spent days dissecting its meaning and cheering on his apparent support.

Elon Musk boosts Pizzagate conspiracy theory that led to D.C. gunfire (Washington Post) The far-right theory motivated a gunman to fire multiple rounds inside the Comet Ping Pong pizzeria in Northwest Washington in 2016. Musk boosted the theory to his 164 million followers anyway.

Substack Has a Nazi Problem (The Atlantic) The newsletter platform’s lax content moderation creates an opening for white nationalists eager to get their message out.

SMBs face surge in "malware free" attacks (Help Net Security) In Q3 2023, attacks targeting SMBs increasingly relied on legitimate tools and scripting frameworks instead of malware.

Whitepaper: IT Threats Impacting OT Infrastructure (Dragos) Download this whitepaper to gain greater insight into how IT threats can impact OT operations for better IT/OT cybersecurity alignment.

This Job Post Will Get You Kidnapped: A Deadly Cycle of Crime, Cyberscams, and Civil War in Myanmar (DFRLab) In Myanmar, cybercrime has become an effective vehicle through which nonstate actors can fund and perpetuate conflict.

How Your Child’s Online Mistake Can Ruin Your Digital Life (New York Times) Google has a zero-tolerance policy for child abuse content. The scanning process can sometimes go awry and tar innocent individuals as abusers.

Security Patches, Mitigations, and Software Updates

Google Chrome emergency update fixes 6th zero-day exploited in 2023 (BleepingComputer) Google has fixed the sixth Chrome zero-day vulnerability this year in an emergency security update released today to counter ongoing exploitation in attacks.

Microsoft shares temp fix for Outlook crashes when sending emails (BleepingComputer) Today, Microsoft shared a temporary fix for a known issue causing Outlook Desktop to crash when sending emails from Outlook.com accounts.

Tails 5.2.0 comes with several improvements, updated Tor Browser (Help Net Security) Tails 5.2.0 is a portable operating system that protects against surveillance and censorship, and is available as a free download.

CISA Releases Four Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency | CISA) CISA released four Industrial Control Systems (ICS) advisories on November 28, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-331-01 Delta Electronics InfraSuite Device Master ICSA-23-331-02 Franklin Electric Fueling Systems Colibri ICSA-23-331-03 Mitsubishi Electric GX Works2 ICSMA-23-331-01 BD FACSChorus

Trends

Global Threat Intelligence Report (Mimecast) Because email is the channel through which most cyber threats launch, Mimecast sees many new threats before they become widely known.

New Betterworks Study Reveals AI Use and Workforce Views One Year After ChatGPT’s Launch (Business Wire) The report shows AI has generated excitement, experimentation, innovation, fear, and uncertainty among employees and organizations

Cassie study finds 82% of connected car drivers are unaware of the extent of data their vehicle collects (PR Newswire) Today Cassie, the consent and preference management platform serving Fortune 500 companies globally, unveiled a new research report breaking...

2023 AT&T Cybersecurity Insights Report: Focus on Transportation (AT&T Cybersecurity) Based on the 2023 AT&T Cybersecurity Insights Report: Edge Ecosystem, this report focuses on transportation companies worldwide. It explains how edge computing is changing transportation to solve operational issues and reduce costs. Our 2023 report reveals what your peers are planning and doing to embrace edge computing.

So, You Think of Cybersecurity Only as a Cost Center? Think Again. (Foley & Lardner LLP) U.S. manufacturers face a multitude of cybersecurity challenges that threaten their operations, reduce productivity, and jeopardize their intellectual property and data.

Marketplace

The big lie of millions of information security jobs (Medium) How can you know how many security jobs there are if there’s no real statistical data available?

BlueVoyant Acquires Conquest Cyber to Meet Market Need for Comprehensive Managed Detection and Response and Cyber Risk Posture Solutions (PR Newswire) BlueVoyant, a cybersecurity company that illuminates, validates, and mitigates internal and external risks, today announced the acquisition of...

Ahead of IPO, Rubrik’s Revenue Growth Slows as It Targets Long-Term Customers (The Information) Microsoft-backed cloud startup Rubrik, which has been preparing for an initial public offering, may have the same problem that complicated the recent IPOs of Instacart and Arm: unusually slow revenue growth. Rubrik’s revenue grew about 8% year over year during the six months that ended in July, ...

Uncertainty lingers with Broadcom’s VMware acquisition (Computer Weekly) Large enterprises with complex VMware environments are looking to de-risk their businesses from potential changes resulting from the Broadcom-VMware deal

OpenAI Isn’t Expected to Offer Microsoft, Other Investors a Board Seat (The Information) OpenAI’s revamped board of directors doesn’t plan to include representatives from outside investors, according to a person familiar with the situation. It’s a sign that the board will prioritize safety practices ahead of investor returns. The new board hasn’t been officially seated and things ...

The OpenAI saga isn’t over just yet (Platformer) A new board and a promised investigation could threaten Altman’s happy ending

Proofpoint Appoints Sumit Dhawan as Chief Executive Officer (Proofpoint) Former VMware President brings over 25 years of experience in building category-leading, scaled enterprise software companies and businesses

Products, Services, and Solutions

WSJ News Exclusive | Amazon Debuts Cyber Insurance Program for Speedy Policy Estimates (Wall Street Journal) AWS customers will be able to receive quotes from cyber insurers within two days, the cloud provider says.

SentinelOne® and Pax8 Double Down on Partnership to Secure SMBs (Business Wire) Long-time partners expand relationship to deliver more market-leading, enterprise-class AI security solutions to large and fast-growing segment more quickly

Trend Micro First to Integrate Cloud Risk Management and XDR Across Customers' Entire Attack Surface (Trend Micro | Newsroom) Security teams proactively eliminate threats with new automated risk prioritization DALLAS, Nov. 28, 2023 /PRNewswire/ -- Global cloud security leader Trend Micro Incorporated (TYO: 4704; TSE:...

Egress enhances cloud email security offering with advanced graymail detection to improve employee productivity and reduce admin overhead (Yahoo Finance) November 29, 2023 – Boston, US – Leading cybersecurity provider Egress has launched a highly accurate graymail solution, with full end-user control, dedicated to improving employee productivity and reducing the time administrators spend reviewing incorrectly reported phishing emails. The graymail feature is architected into Egress’ inbound threat detection product, Egress Defend, and integrates seamlessly into customers’ Microsoft 365 environments. Graymail is bulk solicited emails which are gen

XM Cyber unveils advanced Kubernetes exposure management for hybrid cloud environments (SiliconANGLE) XM Cyber unveils advanced Kubernetes exposure management for hybrid cloud environments - SiliconANGLE

Novel Code Scanner by Piiano Helps Enterprises Prevent Data Leaks Proactively (GlobeNewswire News Room) Newly launched Flows offers complete visibility of sensitive data usage leveraging AI powered static code analysis...

MM-ISAC and AttackIQ Join Forces to Improve Cybersecurity Resiliency in the Mining and Metals Industry (Business Wire) Partnership empowers mining and metals organizations of all sizes to proactively test their security

FileCloud Partners with Votiro to Offer Next-Gen File Security (PR Newswire) FileCloud, a preeminent secure enterprise file-sharing and content collaboration provider, is pleased to announce a partnership with Votiro,...

ManageEngine Enhances Its SIEM With Industry-First, Dual-Layered System for Precise and Accurate Threat Detection | ManageEngine (ManageEngine) ManageEngine Enhances Its SIEM With Industry-First, Dual-Layered System for Precise and Accurate Threat DetectionSOCs Can Leverage the Dynamic Learning Capabilities of the Company's Reinforced TDIR Module, Vigil IQ, To Optimize Threat Detection and InvestigationAdopt dual-layer ML for improved automation, correctness and reliability in threat detectionSmart and dynamic learning enhances threat detection precision by spotting overlooked threats due to manual configurationsExplore Log360's TDIR module, Vigil IQ:

Pension Benefit Guaranty Corporation Renews Comprehensive Risk Management Services Contract with CISO Global (GlobeNewswire News Room) The Pension Benefit Guaranty Corporation (PBGC), a federal agency tasked with protecting the...

MetTel and Sotera Team Up to Bring the Highest Security Standard to Mobile Communications (Mettel) MetTel will introduce the ultra-secure Sotera SecurePhone from Sotera Digital Security to government and commercial enterprise customers.

Securin Joins the Ranks of the Joint Cyber Defense Collaborative (PR Newswire) Securin, the industry's leading proactive security solutions provider, announced today that it has joined the Joint Cyber Defense...

Free Whitepaper - How Dragos Activity Groups Obtain Initial Access Into Industrial Environments (Dragos) This white paper steps through the most common initial access techniques Dragos observes being utilized by activity groups.

Tigera, the Creator of Calico, Achieves AWS Security Competency Status (Tigera) November 29, 2023– Tigera, provider of the industry’s only active security platform for containers and Kubernetes, announced today that it has achieved Amazon Web Services (AWS) Security Competency status. This designation recognizes the security capabilities...

Announcing Fortanix Key Insight – An Industry-First Solution to Discover and Remediate Data Security Risks in Hybrid Multicloud Environments (Business Wire) Key Insight introduces data-driven insights to assess the risk posture of encryption keys and cloud data services, fortifying data security and compliance with policies and regulations

Cowbell Partners with Microsoft and Ingram Micro Inc. to Provide Enhanced Policyholder Security and Reduce Cyber Risk (Cowbell) Collaboration connects Cowbell with Microsoft and Ingram Micro

Technologies, Techniques, and Standards

CISA Announces Secure by Design Alert Series: How Vendor Decisions Can Reduce Harm at a Global Scale (Cybersecurity and Infrastructure Security Agency | CISA) CISA leads the national effort to understand, manage, and reduce risk to our cyber and physical infrastructure. We continuously we publish alerts and advisories to help defenders prioritize their work based on the current threats and software vulnerabilities. We additionally provide defenders with ongoing help prioritizing their scarce resources; for example, our Known Exploited Vulnerabilities (KEV) program identifies the common vulnerabilities and exposures (CVEs) that malicious actors are actively exploiting in the wild.

New AI Guidelines Focus on Safety and Security of Models, Data (Decipher) New AI guidelines authored by CISA and the UK’s NCSC stress the importance of secure design, development, deployment, and operation of AI models and tools.

TIA's New SCS 9001™ 2.0 Supply Chain Security Management System Helps Improve Global Organizations' Security Posture (Yahoo Finance) The Telecommunications Industry Association—the trusted industry association for the connected world— today announced the release of SCS 9001™ 2.0 Supply Chain Security Management System. SCS 9001 Release 2.0 is a certifiable standard designed to help organizations operationalize the National Institution of Standards and Technology (NIST) and other government guidelines and frameworks. The SCS 9001 2.0 standard builds on its predecessor by providing a more comprehensive global cybersecurity and

Stop panic buying your security products and start prioritizing (Help Net Security) It is crucial that before purchasing a new cybersecurity tool or hiring specialists, you understand their functionality and purpose.

2023 Authenticate Pulse Report: Two-Thirds of Organizations Moving to Passwordless Authentication (SecureAuth) Majority of companies are not confident about traditional MFAs protecting against cyberattacks

'Central to everything we do': Army unveils first-ever doctrine for 'information' (Breaking Defense) “We no longer regard information as a separate consideration or the sole purview of technical specialists,” the new ADP 3-13 says. “Instead, we view information as a resource that is integrated into operations” — from cyberwar to psyops, reconnaissance to deterrence, social media to camouflage.

More than you want to know about gift cards (Bits about Money) Gift cards are a loosely-regulated quasi-financial product and frequently misunderstood. Here's how they operate under the hood.

Design and Innovation

My techno-optimism (Vitalik) Last month, Marc Andreessen published his "techno-optimist manifesto", arguing for a renewed enthusiasm about technology, and for markets and capitalism as a means of building that technology and propelling humanity toward a much brighter future.

Academia

Pentagon Opens Scholarship for US Navy Cybersecurity Specialists (The Defense Post) The US Department of Defense has launched a project offering professional development opportunities to US Navy cybersecurity personnel.

Legislation, Policy, and Regulation

UK government rings the death knell for SIM farms (Register) Acts under the guise of protecting the public from fraud, yet history suggests Home Office has other motives

A key senator has a proposal to reauthorize controversial spy powers. Will it become law? (Washington Post) A major player in the delicate debate over renewal of surveillance powers that national security officials have touted as vital to cybersecurity has put forward their first legislative proposal within weeks of the expiration data of the spy powers.

Senate proposes surveillance bill without FBI warrant requirement (Record) The bipartisan Senate legislation would not require the FBI to obtain a warrant before searching the NSA’s massive data trove for information related to Americans.

US used its Section 702 spy tool to disrupt Iran’s weapons program (POLITICO) The disclosure is the administration’s latest argument that the Section 702 tool is essential as it pushes for renewal ahead of a year-end expiry.

DHS aims to lead in defense against ‘adversarial’ AI (Nextgov.com) The agency’s secretary noted artificial intelligence has proven useful for DHS operations in many ways, but also cautioned that the technology can be used for more nefarious purposes.

Expanding CISA’s Zero Trust Role Is Smart: Here’s Why (Booz Allen Hamilton) An independent CSIS report on CISA’s evolving mission proposes ways to strengthen federal cybersecurity.

Litigation, Investigation, and Law Enforcement

Ransomware group dismantled in Ukraine in a major international operation supported by Eurojust and Europol (Eurojust) Judicial and law enforcement authorities from seven different countries have joined forces in an action against a criminal network responsible for significant ransomware attacks across the world. These attacks are believed to have affected over 1,800 victims in 71 countries. The perpetrators targeted large corporations, effectively bringing their business to a standstill and causing losses of at least several hundred millions of euros. A recent operation supported by Eurojust and Europol led to the arrest of the ringleader and the detention of four suspects in Ukraine. A total of 30 places were searched and over a hundred digital equipment tools were seized.

International collaboration leads to dismantlement of ransomware group in Ukraine amidst ongoing war (Europol) On 21 November, 30 properties were searched in the regions of Kyiv, Cherkasy, Rivne and Vinnytsia, resulting in the arrest of the 32-year-old ringleader. Four of the ringleader's most active accomplices were also detained.More than 20 investigators from Norway, France, Germany and the United States were deployed to Kyiv to assist the Ukrainian National Police with their investigative measures. This...

Ransomware hackers 'wreaking havoc' arrested in Ukraine (BBC) Cyber police carry out raids to dismantle gang responsible for hacking hundreds of organisations.

High-profile ransomware gang suspects arrested in Ukraine (Record) The international operation, centered on Kyiv, essentially neutralized a group known for deploying variants of LockerGoga, MegaCortex, Hive and Dharma ransomware, authorities said.

Europol arrest hackers allegedly behind string of ransomware attacks (TechCrunch) An international law enforcement operation has arrested five individuals said to be behind ransomware attacks on more than 1,800 victims.

Ukraine Police Dismantle Major Ransomware Group (Infosecurity Magazine) Affiliate deployed LockerGoga, MegaCortex, Hive and Dharma

Police bust ransomware ring behind attacks in 71 countries (Cybernews) Law enforcement agencies from seven countries have busted “key figures” behind an international ransomware operation operating from several locations inside Ukraine.

Ukrainian ransomware gang behind high-profile attacks dismantled (Help Net Security) Law enforcement dismantled and apprehended key figures in a Ukrainian gang behind significant global ransomware operations.

Principal Associate Deputy Attorney General Marshall Miller Delivers Remarks at the New York Bar Association’s International White Collar Crime Symposium (U.S. Department of Justice) Good morning. Thank you for that warm welcome. It is a true pleasure to discuss the Justice Department’s corporate criminal enforcement work with such a knowledgeable, experienced, and international group of subject matter experts.

Los Angeles SIM Swapper Sentenced to 8 Years in Prison (SecurityWeek) Amir Golshan of Los Angeles was sentenced to 96 months in prison for perpetrating multiple cybercrime schemes.

'Serial cybercriminal and scammer' jailed for 8 years (Register) Crook did everything from SIM swaps to fake verified badge scams

Hospitals urged to review their security policies after bizarre data breach at Scottish hospital (ITPro) An ICO investigation found that serious security failings led to an unauthorized individual gaining access to a ward and patient data

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Russia’s Cyber War Against Ukraine: Lessons and Policy Challenges (Virtual, Dec 5, 2023) Ukraine has become a crucible for a new breed of warfare—one fought not only with traditional battlefield weapons but also with lines of code and keystrokes. The country has faced for almost a decade an unrelenting wave of cyberattacks, with this invisible front blurring the line between state and nonstate actors, and introducing hackers, volunteers, and private companies to the fight. Ukraine’s experience has implications that go beyond national security to include the future of international cyber policy, the role of technology giants in warfare, and the rights and responsibilities of civilians in a conflict. This event will discuss the various questions of cyber warfare that Russia’s war on Ukraine has brought to the fore: How has the conflict influenced Ukrainian cyber policy and where is it headed? What role do citizens and other nonstate actors play in developing digital resilience? How can legal and policy challenges relevant to “cyber troops” be addressed? How should international humanitarian law treat evolving cyber warfare?

The International Conference on Cyber Security 2024 (New York, New York, USA, Jan 8 - 10, 2024) The International Conference on Cyber Security (ICCS) is the premier global cybersecurity event spanning three days, with over 50 distinguished speakers from the government, the private sector, and academia. It is an unparalleled opportunity for global cyber threat analysis, operations, research, and law enforcement leaders to coordinate and share their efforts to create a more secure world.

Events

AWS re:Invent 2023 (Las Vegas and Virtual, Nevada, USA, Nov 27 - Dec 1, 2023) Come together with cloud enthusiasts from around the world to hear the latest cloud industry innovations, meet with AWS experts, have fun, and build connections. You’ll gain skills and expertise that would take weeks or months to learn at home.

SANS Austin Fall 2023 (Austin, Texas, USA, Nov 27 - Dec 2, 2023) At SANS Austin Fall 2023, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

TRUSTECH 2023 (Paris, France, Nov 28 - 30, 2023) During this new edition, TRUSTECH 2023 will welcome professionals from the cards, payments and identification solutions markets from all over the world. The outlook for the event should be at its best, since the number of exhibitors (85% of whom are from outside-France) is already superior to 2022. International speakers, opinion leaders and experts from the payments, financial services and identification ecosystems will be leading a high-level programme of keynotes, conferences and roundtables throughout the three-day event.

Online safety and digital content oversight (Washington (and virtual), DC, USA, Nov 30, 2023) As the United States wrestles with the impact of online content — from children’s safety to AI deepfakes — the United Kingdom has passed a sweeping Online Safety Bill, delegating implementation to the Office of Communications (Ofcom). On November 9, Ofcom released the draft of its approach to balancing protections with free speech rights. It is the most comprehensive effort undertaken by any Western government to date. On November 30, join the Center for Technology Innovation at Brookings for an event with Ofcom Chief Executive Dame Melanie Dawes to discuss the challenges faced by liberal democracies in dealing with online content.

Insider Threat Program Development - Management Training Course (Washington, DC, USA, Dec 4 - 5, 2023) The training course will be taught on December 4-5, 2023. This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. This training will also provide students with an in depth view of how to obtain visibility of potential or malicious employee actions on computer systems and networks, using Insider Threat Detection software. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.