Security-by-design and software supply chains.

Announcement

Cybersecurity and IT practice tests - now just $39 each.

Make 2024 the year you earn a new professional certification. For a limited time, N2K is offering our full catalog of certification practice tests for just $39 each. Choose from our extensive library of certification titles from leading vendors like AWS, CompTIA, Microsoft, CISCO, and more. Visit n2k.com/certify to view our practice test catalog and get started today.

Quarterly Industry Insights Analyst Call - open to the public.

This quarter’s analyst call is open to the public, so join us on Tuesday, December 19, 2023 at 2pm EST for this live and interactive event. N2K’s resident expert, Rick Howard, will be joined by Merritt Baer, Field CISO at Lacework, and Caroline Wong, CSO at Cobalt, to break down the most impactful news and events from the last 90 days, and dive into why it matters to organizations and our industry. Register now.

Summary

By the CyberWire staff

At a glance.

MongoDB warns customers of a breach.
BlackCat/ALPHV: still a C2C market leader, but feeling competitive pressure.
Reassessing the effects of Log4shell.
Security-by-design, and the reduction of risk associated with default passwords.
CISA on healthcare and public health cyber risk.
The UK removes components supplied by a China-backed vendor from its national grid.
ICRC calls for restraint in cyber war.
An assessment of the Kyivstar cyberattack.
Ukraine hits Russian military contractors with a defacement attack.
A missing Crossfire Hurricane binder.

MongoDB warns customers of a breach.

BleepingComputer reports that MongoDB detected a breach of its systems on Wednesday, and is actively investigating. "MongoDB is investigating a security incident involving unauthorized access to certain MongoDB corporate systems," an email from the database management company to its customers said. "This includes exposure of customer account metadata and contact information. At this time, we are NOT aware of any exposure to the data that customers store in MongoDB Atlas." The investigation remains in progress.

BlackCat/ALPHV: still a C2C market leader, but feeling competitive pressure.

ZeroFox has published a report on the BlackCat/ALPHV, noting that the gang was responsible for around ten percent of all observed ransomware and data extortion attacks between January 2022 and October 2023. The researchers state, “Though ALPHV has conducted significantly more attacks so far in 2023 than it did during 2022, attacks have been slightly decreasing overall since Q2—both in the number of total attacks and as a proportion of activity across the threat landscape. This is very likely contributed to by an increase throughout 2023 in new, highly-active threat collectives.”

ALPHV/BlackCat’s servers and website have been dark for the past week, leading to rumors that its operation may have been disrupted by law enforcement. Daniel Curtis, Senior Intelligence Analyst at ZeroFox, believes such a disruption, even if it were confirmed, would be unlikely to have a lasting effect on the criminal landscape. “Any disruption will very likely only result in a temporary suppression of the threat from its operatives,” Curtis said. “If unable to continue deploying the strain, ALPHV affiliates will very likely quickly pivot to other R&DE offerings and continue targeting victims at scale and at pace.”

Build an Effective Endpoint Detection and Response Strategy

Are you ready to simplify your endpoint security? Join the live virtual event to discover how you can safeguard your AWS environment with tools available in AWS Marketplace. Register now.

Reassessing the effects of Log4shell.

Researchers at VulnCheck have concluded that the effects of the Log4Shell vulnerability were exaggerated. “At the time Log4Shell emerged, only a small subset of software that used the vulnerable log4j libraries were vulnerable to remote code execution.” The researchers add, “VulnCheck currently associates Log4Shell exploitation with 40 APT, ransomware groups, and/or botnets, but only four of 12 products are associated with those attacks: MobileIron, Ubiquiti UniFi Controller, VMware Horizon, and VMware vCenter.”

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

Security-by-design, and the reduction of risk associated with default passwords.

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert urging technology manufacturers to eliminate default passwords in their products. The agency recommends the following alternatives to default passwords:

“Provide instance-unique setup passwords with the product;
“Provide time-limited setup passwords that disable themselves when a setup process is complete and require activation of more secure authentication approaches, such as phishing-resistant MFA;
“Require physical access for initial setup and the specification of instance-unique credentials.”

CISA on healthcare and public health risk.

CISA has published a detailed Cybersecurity Advisory outlining the results of a risk and vulnerability assessment the agency conducted for a healthcare and public health organization in January 2023. CISA says, “As part of the RVA, the CISA assessment team conducted web application, phishing, penetration, database, and wireless assessments. The assessed organization was a large organization deploying on-premises software.”

CISA summarized its conclusions and recommendations as follows: “The CISA assessments team identified several findings as potentially exploitable vulnerabilities that could compromise the confidentiality, integrity, and availability of the tested environment. Tailored for HPH organizations of all sizes as well as for all critical infrastructure organizations, the advisory provides several recommended mitigations mapped to 16 specific cybersecurity weaknesses identified during the RVA. Also, the advisory provides three mitigation strategies that all organizations should implement: (1) Asset management and security, (2) Identity management and device security, and (3) Vulnerability, patch, and configuration management. Each strategy has specific focus areas with details and steps on how HPH entities can implement them to strengthen their cybersecurity posture.”

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. CyberVista’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

The UK removes components supplied by a China-backed vendor from its national grid.

Acting in accordance with NCSC recommendations, Britain's National Grid has begun pulling components supplied by Chinese-controlled Nari Technology from its electrical power transmission network, the Financial Times reports. The removal of Nari products is motivated by concerns over the cybersecurity risk Chinese-manufactured components carry.

The International Committee of the Red Cross calls for restraint in cyber warfare.

The International Committee of the Red Cross (ICRC) has called upon states to take two measures that would bring cyber warfare into line with international norms of arms conflict. First, it asked that states observe proper discrimination in their cyber operations, and avoid hitting protected targets, and civilian targets generally. The prohibited targets specifically named are hospitals, power grids, and "data collected by humanitarian organizations and used exclusively for humanitarian ends." Second, it asked that governments control and restrain the participation of civilians--"individuals, hacker groups, and companies"--in cyber warfare. Such participation, the ICRC fears, will blur the vital distinction between combatants and noncombatants, and expose prohibited targets to greater risk of attack.

An assessment of the Kyivstar cyberattack.

The UK's Ministry of Defence described the effect of the cyberattack (almost certainly a GRU operation) against mobile and Internet provider Kyivstar last week. "On 12 December 2023, Kyivstar, Ukraine’s largest mobile network operator, suffered a cyber attack. Effects continued for at least 48 hours, impacting the company’s mobile and data services. Kyivstar supplies over half of Ukraine’s population with mobile and home internet services. The cyber attack reportedly left users without mobile signal or the ability to use the internet. Kyivstar reported that no personal data was compromised during the attack. The cyber attack also reportedly disrupted air raid sirens, some banks, ATMs, and point-of-sale terminals. At the same time, the Ukrainian bank Monobank, was targeted with a Distributed Denial of Service (DDoS) attack, disrupting access to the bank’s website. With Ukraine’s government resources and emergency services affected, this incident is likely one of the highest-impact disruptive cyber attacks on Ukrainian networks since the start of Russia’s full-scale invasion." Kyivstar's recovery continues, with SMS-text-messaging services expected to be restored today.

Ukraine hits Russian military contractors with a defacement attack.

Ukrinform reports that a cyberattack by Ukrainian military operators on Sunday defaced fifteen Russian military contractors with the message, "Aiming at NATO, but hitting Moscow." December 17th is observed in Russia as the Day of the Strategic Missile Forces of the Russian Federation. The nuisance attack was meant to tweak Russian pride over the recent failed tests of the Yars and Bulava missiles.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Share your message with our audience of security leaders.

N2K Cyber’s 2024 sponsorship packages are now available. If you're looking to reach the eyes and ears of our influential security professionals, let's talk and see how we can build a program that meets your goals.

A missing Crossfire Hurricane binder.

A binder containing unredacted classified information pertaining to the Crossfire Hurricane investigation into Russian interference with the 20216 US election went missing from the White House, CNN reports, as the Trump Administration left office in January of 2021. "The binder contained raw intelligence the US and its NATO allies collected on Russians and Russian agents, including sources and methods that informed the US government’s assessment that Russian President Vladimir Putin sought to help Trump win the 2016 election," CNN said sources told its reporters. The New York Times describes the contents of the binder as "a hodgepodge of materials related to the origins and early stages of the Russia investigation that were collected by Trump administration officials. They included copies of botched F.B.I. applications for national-security surveillance warrants to wiretap a former Trump campaign adviser as well as text messages between two F.B.I. officials involved in the inquiry, Peter Strzok and Lisa Page, expressing animus toward Mr. Trump." The contents of the binder are domestically contentious, allegedly reflecting discredit on either or both major political parties, but the more serious issue is the possibility that intelligence sources and methods have been compromised. In any case, the missing binder remains in the wind. Stories and rumors about its putative contents can be expected to circulate throughout the upcoming US election cycle, and will probably form a touchstone of disinformation campaigns and viral misinformation.

Notes.

Today's issue includes events affecting Australia, China, the European Union, Gaza, Hungary, India, Iran, Israel, Russia, Ukraine, the United Kingdom, and the United States.

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+662: Russia's expansive war aims. (CyberWire) Russia and Ukraine exchange missile, drone, and cyberattacks, as Mr. Putin says that Russia wishes for good relations with NATO members (except for Finland).

Israel-Gaza war live: Four Palestinians killed in West Bank in Israeli raid, says Gaza health ministry (the Guardian) Hamas-run Gaza health ministry says four people killed in Faraa refugee camp and 90 in Jabalia camp as Israel launches attacks up and down territory

Israel-Hamas War: Israeli Troops Accidentally Kill Three Hostages (New York Times) Israeli forces mistakenly identified three Israeli hostages as a threat during a battle in Shejaiye, a Hamas stronghold in northern Gaza, the military said.

Killing of USAID contractor in Gaza fuels internal protest (Washington Post) The death of Hani Jnena and his young family has intensified calls within the Biden administration to hold Israel’s military accountable for the war’s toll on humanitarian workers

In Israel, the US defense secretary is expected to press for a more targeted approach in Gaza (AP News) U.S. Defense Secretary Lloyd Austin is expected to press Israel to wind down major combat operations in Gaza on a visit to the region Monday.

Netanyahu’s tactics are weakening Israel (The Telegraph) Hamas’s jihadist ideology must be defeated – but Israel’s methods will only boost that hate-filled creed

Opinion In the West Bank, I saw how peace will require confrontation with Israel (Washington Post) Ekram Quran stands on the roof of her house on the edge of Al-Bireh in the West Bank, pointing to the hill 100 yards away where she used to roam as a girl among fig and olive trees.

Inside the Hamas tunnel network (The Telegraph) Anyone moving in from the light becomes a perfect silhouette – a single combatant with a rifle could hold off a commando unit for hours

Israel-linked hackers claim to paralyze gas stations across Iran (Times of Israel) A hacking group previously linked to Israel claims to have paralyzed gas stations across Iran in a cyber attack.

Hacktivist group claims to take out gas stations across Iran (The Jerusalem Post) Iranian media reported disruptions at 60% of gas stations across the country on Monday.

Iran, Israeli media say cyber attack disrupts petrol stations across Iran (Reuters) A hacking group that Iran accuses of having links to Israel claimed it carried out cyberattacks that disrupted services at petrol stations across Iran on Monday, Iranian state TV and Israeli local media reported.

Russia-Ukraine war: List of key events, day 663 (Al Jazeera) As the war enters its 663rd day, these are the main developments.

Pro-Ukrainian Fighters Infiltrate Belgorod Region, Ukraine's Intel Confirms to Kyiv Post (Kyiv Post) Sources in the Ukrainian intelligence community have confirmed that a shooting battle is currently underway on the border of Terebreno village in the Krasnoyaruzhsky district.

Ukraine's Defense Forces Successfully Counter Russian Drone Attacks (The 1014) Ukraine's Defense Forces Successfully Counter Russian Drone Attacks - The 1014

Volodymyr Zelenskyy’s bitter week of disappointment (Financial Times) Ukrainian leader fails to secure long-term financial aid from US and EU

Russian 'conquest' of Ukraine on the table if US, allied military aid falters: Study - Breaking Defense (Breaking Defense) The report offers up a detailed account of the high cost the US is likely to pay for “allowing Russia to win” in Ukraine, largely based around the Pentagon forced into bolstering defense and deterrence against a “renewed” Russian threat.

The West can’t give up on Ukraine now (The Telegraph) A Russian victory over Ukraine is unconscionable. The rules-based international order must be worth defended

Victor Orban got exactly what he wanted from crunch EU summit (The Telegraph) Putin ally’s long-term animosity towards Ukraine saw him veto a €50 billion package of support – and walk away with €10 billion

G7 Said To Be 'Moving Closer' To Seizing $300 Billion In Russian Assets For Ukraine (RadioFreeEurope/RadioLiberty) Group of Seven member states have intensified efforts to agree on funneling some of the $300 billion in "immobilized" Russian central bank and other sovereign assets to Ukraine just as massive U.S. and EU support proposals have run into resistance, the Financial Times reports.

Ukraine mobile operator Kyivstar says services being restored (Reuters) Ukraine's biggest mobile operator, hit by a mass cyberattack this week, said on Friday that it had restored mobile internet throughout Ukraine and restored international roaming.

Kyivstar resumes access to SMS text messaging from 11:00 on Mon. (UAZMI) As of 11:00 am on Monday, December 18, the largest Ukrainian telecom operator Kyivstar resumed access to SMS text messaging, including international roaming, the company's press service reported.

Ukraine telecom cyberattack one of ‘highest-impact’ hacks of the war (Record) The attack on Kyivstar last week left more than half the country's population without mobile signal and internet for two days.

Ukrainian cyber experts attack 15 websites of Russian enterprises (Ukrinform) Cyber security experts of the Ukrainian Armed Forces, on the Day of the Strategic Missile Forces of the Russian Federation, attacked 15 websites of companies involved in engineering support for Russian troops. — Ukrinform.

Cyber Chaos in Ukraine: NoName Ransomware Strikes Prominent Targets (The Cyber Express) Ukraine has become the battleground for a cyber onslaught, with the NoName ransomware attack claiming responsibility for a series of

Putin has ‘no interest’ in attacking NATO, calls Biden’s warning ‘nonsense’ (POLITICO) In interview with Russian state television, Russian president warns of ‘problems’ with Finland now that the Nordic country has joined NATO.

Finland seeks jailing, probe of Russian man wanted in Ukraine over alleged war crimes in 2014-2015 (AP News) Finnish police are seeking a court order to imprison a Russian man who had been living under an alias in the Nordic country and is accused of committing war crimes against wounded or surrendered soldiers in eastern Ukraine in 2014 and 2015.

Kremlin has ‘no information’ on missing Putin critic Alexey Navalny (Al Jazeera) Russian opposition figure has been moved from penal colony and lawyers say they haven’t seen him since last week.

Russians carved swastikas into foreheads of Ukrainian captives (The Telegraph) Tens of thousands of Ukrainians are facing the future with life-altering injuries from torture, explosions and active fighting

Attacks, Threats, and Vulnerabilities

Qakbot is back and targets the Hospitality industry (Security Affairs) Experts warn of a new phishing campaign distributing the QakBot malware, months after law enforcement dismantled its infrastructure.

Shadow Play: A pro-China technology and anti-US influence operation thrives on YouTube (Australian Strategic Policy Institute) ASPI has recently observed a coordinated inauthentic influence campaign originating on YouTube that’s promoting pro-China and anti-US narratives in an apparent effort to shift English-speaking audiences’ views of those countries’ roles in international politics, the global economy and strategic technology competition.

Pro-China influence operation gained YouTube following, researchers find (Record) The YouTube campaign has used artificially generated people and voices in its videos and has managed to get more than 700,000 subscribers.

Water warning: America’s systems are ‘especially vulnerable’ to cyberattack, Microsoft says (The Washington Times) Microsoft is warning that America’s water systems are easy targets for cyberattackers, putting safe drinking at the mercy of foreign hackers and ransomware gangs.

Cyber watchdog CERT-In issues hack alert on Apple, Samsung products (Times of India) CERT-In warns of security-related vulnerabilities in Apple devices...

Government Reports Multiple Vulnerabilities in Apple, Samsung Devices (Gadgets 360) The reported vulnerabilities could put users’ sensitive information at risk.

From Macro to Payload: Decrypting the Sidewinder Cyber Intrusion Tactics (CYFIRMA) EXECUTIVE SUMMARY At CYFIRMA, our mission is to empower you with the latest insights into the dynamic landscape of cybersecurity...

Hackers are Actively Exploiting Apache Struts 2 Vulnerability (Cyber Security News) Hackers are taking advantage of a Critical Apache Struts Bug’s initial activity with limited IP addresses engaged in exploitation attempts.

ALPHV Targeting: Ransomware & Digital Extortion (ZeroFox) Read ZeroFox Intelligence’s ALPHV Targeting Report for a full overview of staring activity in the past 7 quarters

“Inter-cartel” strife and affiliate poaching could hamstring ALPHV in 2024 (ITPro) Attacks by ALPHV are up in 2023, but competition from other major gangs could impact its effectiveness next year

A Log4Shell Retrospective - Overblown and Exaggerated (VulnCheck) Log4Shell was proclaimed one of the most critical vulnerabilities, but in this blog, VulnCheck challenges that perspective, revealing the limited number of vulnerable systems still present two years after the initial disclosure.

InfectedSlurs botnet targets QNAP VioStor NVR vulnerability (Security Affairs) The Mirai-based botnet InfectedSlurs was spotted targeting QNAP VioStor NVR (Network Video Recorder) devices.

Hackers Actively Exploiting QNAP VioStor NVR Vulnerability to Deploy Mirai Malware (Cyber Security News) Recently, cybersecurity researchers at Akamai during InfectedSlurs research identified that hackers are actively exploiting Mirai" malware.

New Rhadamanthys stealer version enhances features, evasion (BleepingComputer) The developers of the Rhadamanthys information-stealing malware have recently released two major versions to add improvements and enhancements across the board, including new stealing capabilities and enhanced evasion.

Hackers Access Customer Info, Corporate Systems in MongoDB Data Breach (Hackread) The latest cybersecurity incident to impact a large-scale and highly popular company is the MongoDB Data Breach.

MongoDB says customer data was exposed in a cyberattack (BleepingComputer) MongoDB is warning that its corporate systems were breached and that customer data was exposed in a cyberattack that was detected by the company earlier this week.

New 'NKAbuse' Linux Malware Uses Blockchain Technology to Spread (Hackread) The malware, dubbed NKAbuse, uses New Kind of Network (NKN) technology, a blockchain-powered peer-to-peer network protocol to spread its infection.

Microsoft disrupts credentials marketplace, warns of gift card fraud, OAuth abuse (Record) The tech giant published two warnings about threats from hackers and described how it took down a Vietnam-based marketplace for fraudulent credentials.

Crypto catfishers ditch fake exchanges for approval phishing scams (Cointelegraph) Romance scammers are using targeted approval phishing techniques to trick victims into signing spurious transaction approvals.

Mallox Resurrected | Ransomware Attacks Exploiting MS-SQL Continue to Burden Enterprises (SentinelOne) Learn about the Mallox RaaS and how operators are continuing to compromise enterprises and demand ransoms for stolen data.

Snatch ransomware gang claims the hack of food giant Kraft Heinz (Security Affairs) The Snatch ransomware group announced it had hacked the food giant Kraft Heinz, the company is investigating the claims.

Kraft Heinz downplays Snatch ransomware crew's claims (Register) Ah, beans

Qbot malware returns in campaign targeting hospitality industry (BleepingComputer) The QakBot malware is once again being distributed in phishing campaigns after the botnet was disrupted by law enforcement over the summer.

Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 1 (Akamai) Akamai researcher Ben Barnea found two vulnerabilities in Microsoft Windows, which were assigned CVE-2023-35384 and CVE-2023-36710.

Mute the Sound: Chaining Vulnerabilities to Achieve RCE on Outlook: Pt 2 (Akamaia) Using the vulnerability we described in part 1 of this blog series, we once again have the ability to play a custom sound file on the target, abusing Outlook’s reminder sound feature.

The anatomy of a scam: ‘Like YouTube Videos and Get Paid’ schemes (Bitdefender Labs) Have you ever considered a remote job that only requires you to click the like or subscribe button on YouTube videos? If you have, we’re sorry to say it’s a scam.

Warning As 1Password, DashLane, LastPass And 3 Others Leak Passwords (Forbes) Six of the most popular password managers have been called out by security researchers who uncovered a major vulnerability that impacts the Android autofill function.

North Face Owner VF Corp. Says a Hack Is Disrupting Its Ability to Fill Orders (Bloomberg) Hacks surged in 2023 with Clorox, Boeing among those hit. Timberland parent is executing a business transformation plan.

Mr. Cooper's cyberattack impacted past customers too (National Mortgage News) To make amends to former and current borrowers, Mr. Cooper is footing the bill for two years of complimentary identity protection services.

October cyberattack leaked data of 14.7 million people, mortgage giant Mr. Cooper says (Record) The mortgage loan servicer file data breach notifications with regulators in Maine and Californnia.

Supply chain attack on crypto hw wallet Ledger led to the theft of $600K (Security Affairs) A supply chain attack against Crypto hardware wallet maker Ledger resulted in the theft of $600,000 in virtual assets.

Central Bank of Lesotho facing outages after cyberattack (Record) Outages at the financial institution have disrupted transactions all week in the southern African nation.

Seattle cancer center confirms cyberattack after ransomware gang threats (Record) A cybercrime group has listed the Fred Hutchinson Cancer Center on its data leak site. Local news reports said individual patients were being extorted.

Kansas courts' computer systems are starting to come back online, 2 months after cyberattack (KAKE) The courts also have restored systems that allow people to apply for marriage licenses online and file electronic requests for orders to protect them from abuse, stalking and human trafficking.

Ontario public library shuts down most services due to cyberattack (Record) The cyberattack on London Public Library is the latest in a string of incidents targeting municipal centers of learning.

Security Patches, Mitigations, and Software Updates

Microsoft unveils new, more secure Windows Protected Print Mode (BleepingComputer) Microsoft announced a new Windows Protected Print Mode (WPP), introducing significant security enhancements to the Windows print system.

Google Confirms Massive Gmail Update—Here’s What It Means For You (Forbes) Google has quietly introduced what it says is the largest security upgrade in years for Gmail users. Here’s what the AI-powered update will do.

Trends

How ransomware extortion is evolving (Cyber Security Hub) Dr Jason Nurse reflects on the changing ransomware extortion landscape and the threat it poses to businesses

Why are hackers targeting healthcare providers? (TechRadar) A deep dive into cyber attacks against healthcare providers

The paradox of the web: cybercriminals are better than arms dealers (Breaking Latest News) “Cybercrime now earns more than the arms trade.” She explains it Giampaolo Dedolahead of the team Kaspersky…

Another Record-Breaking Month for Ransomware: November Up 110% YoY (Corvus) Yet another record-shattering month for the number of ransomware victims on leak sites. Here’s what you need to know.

Vercara Research: 75% of U.S. Consumers Would Stop Purchasing from a Brand if it Suffered a Cyber Incident (Business Wire) Findings underscore the pivotal role brand trust plays in the digital landscape.

Marketplace

In Appreciation: ESET Founder Rudolf Hruby Passes Away (Dark Reading) Cybersecurity pioneer and soccer fan Rudolf Hruby was a prominent business figure in post-independence Slovakia.

Airbus in talks to buy Atos cybersecurity business BDS -source (Reuters) Airbus is in talks with Atos to buy its cybersecurity division BDS, a person familiar with the matter said, rekindling interest in one of France's prized security assets after opposition from the aerospace group's own investors earlier this year.

BlueVoyant Raises $140M+ and Acquires Conquest Cyber to Bolster its Cyber Defense Capabilities (AlleyWatch) Like sports, a good defense is the best offense when it comes to cybersecurity. According to Booz Allen, the average dwell time is 200-250 before discovery for an adversarial component used in cyberattacks.

Verizon Ventures-backed Origin AI Raises $15.9 Million in Extended Series B (citybiz) Origin AI has announced the close of an extended Series B round worth $15.9 million, with Verisure, a Swiss maker... Read More

Accenture acquires British data and AI consultancy Redkite (CRN) The acquisition expands Accenture's data and AI capabilities to accelerate enterprise transformation

WSJ News Exclusive | E-Signature Company DocuSign Explores a Deal (Wall Street Journal) Suitors for the $11 billion company could include private equity and technology firms.

Bill Passes That Could Block Kaspersky Lab From Selling To U.S. Department Of Defense (CRN) The bill passed by Senate Armed Services Committee Wednesday cites concerns that the Moscow-based company 'might be vulnerable to Russian government influence.'

NSO Group May Be On Its Way Out But There’s No Shortage Of Competitors To Take Its Place (Techdirt) The Italians are the new Israelis… at least in terms of hawking phone exploits and other spyware. NSO Group crashed hard following leaks showing its customers (many of which were, shall we sa…

Cymulate Adds Cybersecurity Industry Veteran to Board of Directors (CIO News) Bangalore, December 2023: Cymulate, the leader in exposure management and security validation, announced today that Lee Weiner, former Chief Innovation

LastPass Names Don MacLennan Chief Product Officer (LastPass) Cybersecurity industry veteran to lead all facets of LastPass product strategy, experience design, management and operations

Products, Services, and Solutions

New infosec products of the week: December 15, 2023 (Help Net Security) The featured infosec products this week are from: Censys, Confirm, Drata, Safe Security, and SpecterOps.

Cobalt named PtaaS Outperformer by GigaOm Radar report for second year in a row (PR Newswire) Cobalt, the leading Pentest as a Service (PtaaS) company modernizing the traditional pentesting model, has been named the only...

Forcepoint-Microsoft Team to Develop New Cloud Offerings for Defense & Intelligence Customers; Sean Berg, Zach Kramer Quoted (Executive Gov) Looking for the latest Government Contracting News? Read about Forcepoint-Microsoft Team to Develop New Cloud Offerings for Defense & Intelligence

Introducing NordVPN for tvOS (NordVPN) We have just launched our NordVPN app for tvOS. Download it from the App Store and enjoy more privacy with the click of a button.

Stellar Cyber partners with BlackBerry to help users detect and respond to cyber threats (Help Net Security) Stellar Cyber and BlackBerry continue to drive joint development to help customers optimize their security posture.

Technologies, Techniques, and Standards

CISA Releases Key Risk and Vulnerability Findings for Healthcare and Public Health Sector (Cybersecurity and Infrastructure Security Agency) Report provides recommended actions and mitigation strategies for HPH sector, critical infrastructure and software manufacturers

Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment (Cybersecurity and Infrastructure Security Agency | CISA) In January 2023, the Cybersecurity and Infrastructure Security Agency (CISA) conducted a Risk and Vulnerability Assessment (RVA) at the request of a Healthcare and Public Health (HPH) sector organization to identify vulnerabilities and areas for improvement. An RVA is a two-week penetration test of an entire organization, with one week spent on external testing and one week spent assessing the internal network. As part of the RVA, the CISA assessment team conducted web application, phishing, penetration, database, and wireless assessments. The assessed organization was a large organization deploying on-premises software.

CISA Releases Advisory on Cyber Resilience for the HPH Sector (Cybersecurity and Infrastructure Security Agency | CISA) Today, CISA released a Cybersecurity Advisory, Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment, that details findings from our risk and vulnerability assessments of a Health and Public Health (HPH) Sector organization.

CISA Secure by Design Alert Urges Manufacturers to Eliminate Default Passwords (Cybersecurity and Infrastructure Security Agency | CISA) Today, CISA published guidance on How Manufacturers Can Protect Customers by Eliminating Default Passwords as a part of our new Secure by Design (SbD) Alert series.

Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords (Cybersecurity and Infrastructure Security Agency | CISA) CISA created this guidance to urge technology manufacturers to proactively eliminate the risk of default password exploitation by implementing Principles 1 and 3 of the joint guidance, Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software:

CISA urges vendors to get rid of default passwords (CyberScoop) Cybersecurity officials also issued new guidance on open source software through secure-by-design practices.

ITI: Stakeholder Collaboration is Crucial to Improve CISA’s Software Self-Attestation Form - Information Technology Industry Council (ITI) Today, global tech trade association ITI provided feedback to the White House Office of Management and Budget (OMB) and Cybersecurity and Infrastructure Security Agency’s (CISA) open Request for Comment on Secure Software Self-Attestation Form. CISA developed the draft common form in partnership with OMB to provide federal agencies with a standardized way to implement the requirements that aim to ensure the security of federally used software.

What to do when receiving unprompted MFA OTP codes (BleepingComputer) Receiving an unprompted one-time passcode (OTP) sent as an email or text should be a cause for concern as it likely means your credentials have been stolen.

Defence against the dark web: how to thread cybersecurity into the fabric of your business (iTWire) GUEST OPINION: The dark web has long loomed as a danger to businesses of all sizes. While the dark web itself is not a threat, its role as a hidden segment of the internet where anonymity thrives is what makes it a risk. Anonymity creates a hotbed for threat actors, as the dark web plays host to a m...

Why a Deep Dive into Cybersecurity Training is Worth Your Time (Robots.net) With more cyberattacks and greater need for competent cybersecurity professionals, learn why it's important to invest time in cybersecurity training to stay ahead of attackers.

Conscious Uncoupling: How Cleared Employers and Employees Can Best Part Ways (ClearanceJobs) With a bit of self-control and some common sense, both cleared employers and employees can often minimize separation headaches.

Design and Innovation

OpenAI Overhauls Content Moderation Efforts as Elections Loom (The Information) OpenAI has overhauled how it handles the task of rooting out disinformation and offensive content from ChatGPT and its other products, as worries about the spread of disinformation intensify ahead of next year’s elections. In the weeks since Sam Altman’s reinstatement as CEO, the company appears ...

Research and Development

Microsoft Israel R&D Center engineers lead development of AI platform that stops cyberattacks (CTech) Dozens of engineers, researchers and machine learning experts across security teams at Microsoft Israel R&D led the 2-year long research and development process, analyzing various cyberattacks using information accumulated by Microsoft's security products

HellasQCI and Nokia lead way to the future of Quantum-Safe Networks (GlobeNewswire News Room) Press Release HellasQCI and Nokia lead way to the future of Quantum-Safe Networks Trial showcases hybrid approach with both classic and quantum physics...

Academia

Opinion AI is forcing teachers to confront an existential question (Washington Post) “Remember what I told you last week? Forget it.” This is how Marc Watkins starts many a faculty meeting in the University of Mississippi’s department of writing and rhetoric. The self-fashioned AI guru has been tracking the capabilities of the large language models, such as ChatGPT, that are already transforming how his students write and read — in some cases, by doing both for them.

ESET & Big Smoke announce winners of Australian children's cyber safety writing contest (SecurityBrief Australia) ESET and The Big Smoke Media Group crown winners of an Aussie children's writing contest focusing on cyber safety.

Legislation, Policy, and Regulation

SEC Cyber 8-K Rules Effective Today (Privacy and Information Security Law Blog) As we previously reported, the U.S. Securities and Exchange Commission’s (“SEC”) new Form 8-K rules for reporting material cybersecurity incidents take effect today, December 18, for filers other than smaller reporting companies.

We call on States to stop turning a blind eye to the participation of civilian hackers in armed conflict (International Committee of the Red Cross) Ambassador Gafoor, excellencies, dear colleagues,The International Committee of the Red Cross (ICRC) is grateful for the opportunity to address this sixth session of the Open-Ended Working Group.We commend States for adopting an annual progress report earlier this year, which recommends States to continue to engage in focused discussions on how international law applies in the use of ICTs.

EU earmarks €763m for digital transformation, cybersecurity (Punch Newspapers) As part of its Digital Europe work programmes for 2024, the European Commission has assigned €762.7m in funds for Digital transformation, AI

National Grid drops Beijing-backed supplier over UK power network fears (Financial Times) Move to end contract and start removing parts comes as west rethinks Chinese involvement in critical infrastructure

National Grid drops Chinese supplier over security fears (The Telegraph) FTSE 100 company is also thought to be stripping out components supplied by NR Electric

CISA’s Deputy Chief Learning Officer Antonio Scurlock on the National Initiative for Cybersecurity Careers and Studies (ClearanceJobs) This episode focuses on the National Initiative for Cybersecurity Careers and Studies, commonly referred to as NICCS.

The Path to Banning Ransomware PaymentsThe Path to Banning Ransomware Payments (Center for Cybersecurity Policy and Law) The average ransomware payment in 2023 is $1.5 million, up from $812,000 a year prior. Organizations attacked by a ransomware gang face a stark choice of whether to pay or not.

Eric Schmidt has a 6-point plan for fighting election misinformation (MIT Technology Review) The former Google CEO hopes that companies, Congress, and regulators will take his advice on board—before it’s too late.

Litigation, Investigation, and Law Enforcement

7 Months Inside an Online Scam Labor Camp (New York Times) A man was abducted by a Chinese gang and forced to work in a scam operation. He gathered financial information, photos and videos and shared the material with The New York Times.

The mystery of the missing binder: How a collection of raw Russian intelligence disappeared under Trump (CNN) A binder containing highly classified information related to Russian election interference went missing at the end of Donald Trump’s presidency, raising alarms among intelligence officials.

Material From Russia Investigation Went Missing as Trump Left Office (New York Times) A binder given to the Trump White House contained details that intelligence agencies believe could reveal secret sources and methods.

Alarm over binder on highly classified Russian intel that went missing in Trump’s final days: report (Salon) “I am almost positive it went home with Mr. Meadows,” former aide Cassidy Hutchinson testified to Congress.

Ex-FBI official raises specter missing intel file under Trump was handed to Russia (Raw Story) During an appearance on MSNBC on Sunday afternoon, a former assistant director for counterintelligence at the FBI suggested there is a real possibility that a Russian intelligence file that went missing near the end of Donald Trump's presidency could have ended up in Russian hands.Speaking with host...

Why Wasn't Trump Quickly Arrested in Classified Docs Case? (Spy Talk) We catalog the swift justice meted out to others caught hoarding secret documents, showing Trump's unprecedented kindly treatment by the feds.

Alleged Russian-Canadian hacker with Simcoe County ties charged while out on bail (CTV News Barrie) Alleged Russian-Canadian hacker Mikhail Vasiliev faces new charges in connection to a three-year-long global ransomware investigation.

A former White House scientist was scammed out of $655,000. Then came the IRS. (Washington Post) The government that Frances Sharples served for more than four decades considers the money to be income, compounding her pain

Putative class actions filed against Acrisure over data breach (Business Insurance) Two plaintiffs are suing Acrisure LLC in putative class-action lawsuits in connection with a data breach that occurred over a nearly two-month period beginning in December 2022.

Ex-Amazon engineer pleads guilty to hacking crypto exchanges (BleepingComputer) Former Amazon security engineer Shakeeb Ahmed pleaded guilty this week to hacking and stealing over $12.3 million from two cryptocurrency exchanges in July 2022.

NY engineer pleads guilty to stealing millions from two crypto exchanges (Record) Shakeeb Ahmed, 34, faces up to five years in federal prison for two separate multimillion-dollar hacks in July 2022 of decentralized cryptocurrency exchanges.

Sellafield boss hits back at safety failure claims (BBC) Speaking to the BBC, the nuclear site's boss rejects hacking claims and accusations of safety failings.

Former IT manager pleads guilty to attacking high school network (BleepingComputer) Conor LaHiff, a former IT manager for a New Jersey public high school, has admitted to committing a cyberattack against his former employer following the termination of his employment in June 2023.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

The International Conference on Cyber Security 2024 (New York, New York, USA, Jan 8 - 10, 2024) The International Conference on Cyber Security (ICCS) is the premier global cybersecurity event spanning three days, with over 50 distinguished speakers from the government, the private sector, and academia. It is an unparalleled opportunity for global cyber threat analysis, operations, research, and law enforcement leaders to coordinate and share their efforts to create a more secure world.

SANS Cloud Defender 2024 (Virtual, Jan 8 - 13, 2024) At SANS Cloud Defender 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Classic 2024 (Virtual, Jan 15 - 20, 2024) At SANS Classic 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Live Web Based Training Course (Virtual, Jan 17 - 18, 2024) This highly sought after and very comprehensive 1 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.