Unattributed cyberespionage campaigns, and notes on the C2C underground market.

Announcement

Listen to our Q4 Cybersecurity Analyst Call

Did you miss our recent Q4 Analyst Call? It’s not too late to listen to the dynamic conversation between N2K’s resident expert, Rick Howard, Merritt Baer, Field CISO at Lacework, and Caroline Wong, CSO at Cobalt, on the new SEC rule about material reporting, the SEC’s civil fraud charges against SolarWinds and CISO Tim Brown, and the books that should be on your 2024 reading list. Take a listen.

Cybersecurity and IT practice tests - now just $39 each.

Make 2024 the year you earn a new professional certification. For a limited time, N2K is offering our full catalog of certification practice tests for just $39 each. Choose from our extensive library of certification titles from leading vendors like AWS, CompTIA, Microsoft, CISCO, and more. Visit n2k.com/certify to view our practice test catalog and get started today.

Summary

By the CyberWire staff

At a glance.

DarkGate RAT's propagation.
The evolution of Bandook.
8220 gang's cryptojacking.
BidenCash's loss-leaders.
A continuing cyberespionage campaign against Ukrainian targets.
A continuing cyberespionage campaign against Russian targets.
Update on the Kyivstar attack.

DarkGate RAT's propagation.

Proofpoint is tracking a DarkGate malware operator it’s calling “BattleRoyal” that began exploiting a Windows SmartScreen vulnerability before the flaw was disclosed by Microsoft: “On October 2, 2023, Proofpoint identified one of the first campaigns in this cluster. It was notable due to the use of more than one traffic delivery system (TDS), specifically 404 TDS and Keitaro TDS. Additionally, the .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen. While other parts of the attack chain from this actor changed or varied, .URL files were involved in every campaign.”

The evolution of Bandook.

Fortinet describes a new variant of the Bandook remote access Trojan that surfaced in October. The malware is being distributed via shortened URLs in PDF files. The researchers note, “A large number of commands for C2 communication can be found in this malware. However, the tasks performed by its payload are fewer than the number in the command. This is because multiple commands are used for a single action, some commands call functions in other modules, and some are only used to respond to the server.

Build an Effective Endpoint Detection and Response Strategy

Are you ready to simplify your endpoint security? Join the live virtual event to discover how you can safeguard your AWS environment with tools available in AWS Marketplace. Register now.

8220 gang's cryptojacking.

Researchers at Imperva say the 8220 gang, a cybercriminal group believed to be based in China, is attempting to exploit CVE-2020-14883 in Oracle WebLogic Server to install cryptojacking malware: “This vulnerability allows remote authenticated attackers to execute code using a gadget chain and is commonly chained with CVE-2020-14882 (an authentication bypass vulnerability also affecting Oracle Weblogic Server) or the use of leaked, stolen, or weak credentials. Exploitation of these vulnerabilities is well documented. Therefore, it is easy to modify for the purposes of malware deployment. The 8220 gang uses two different gadget chains: one enables the loading of an XML file, which then contains a call to the other and enables execution of commands on the OS.”

The gang is opportunistically targeting “healthcare, telecommunications, and financial services targets in the United States, South Africa, Spain, Columbia, and Mexico.”

BidenCash's loss-leaders.

The BidenCash criminal marketplace is giving away 1.9 million stolen credit cards for free, as a marketing ploy, BleepingComputer reports. The cards include numbers, expiration dates (mostly between 2025 and 2029), and CVVs. While the validity of the dataset is unconfirmed, BleepingComputer notes that “[g]iven the platform's history of providing genuine data in previous releases, it seems improbable that the shop would risk tarnishing its reputation with a fake pack.”

BidenCash, despite its name and the smiling face of Joe Biden it displays on its page, is not related to the US President. According to Searchlight Cyber, the name is a jokey riff on a predecessor criminal souk that called itself “Trump’s Dumps,” which went offline after it was raided in early February 2022. As Flashpoint reported at the time, the illicit service was taken down by (of all people) Russian law enforcement authorities. January and early February of 2022 saw a false dawn of Russian gestures toward legality in cyberspace. Those gestures ended on February 24th when Russia invaded Ukraine. Since then it's been all privateering, all the time.

Trump's Dumps had, of course, no more to do with Mr. Trump than BidenCash does with Mr. Biden. BidenCash launched shortly after Trump’s Dumps hit the law enforcement bumps. So not a Joe, nary even a Hunter; just sleazy carders shilling fullz to some punter.

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

A continuing cyberespionage campaign against Ukrainian targets.

Deep Instinct reports on the continuing activity of "UAC-0099," a threat actor of uncertain provenance that's been conducting cyberespionage against Ukraine since the middle of 2022. It's been seen exploiting CVE-2023-38831. This is a vulnerability in earlier versions of RARLAB WinRAR archive management software that, as NIST's National Vulnerability Database explains, "allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive." The phishbait has typically been a bogus court document, usually a summons, and the hook it carries is an unobtrusive exploit unlikely to be noticed by the victim.

"The tactics used by 'UAC-0099' are simple, yet effective. Despite the different initial infection vectors, the core infection is the same — they rely on PowerShell and the creation of a scheduled task that executes a VBS file," Deep Instinct writes. "Monitoring and limiting the functionality of those components can reduce the risk of 'UAC-0099' attacks — and/or identify them quickly in the event of compromise." The most recent version of WinRAR isn't vulnerable to this exploitation.

Circumstantially UAC-00099 looks like a Russian operation. The victimology is consistent with Russian intelligence service targeting, and Google has seen similar exploitation of CVE-2023-38831 by known Russian threat actors, notably the GRU's Sandworm. But Deep Instinct offers no attribution, nor, interestingly, did CERT-UA in a May 6th, 2023, advisory about UAC-0099.

And a continuing cyberespionage campaign against Russian targets.

Another threat actor of uncertain origin and allegiance is spying on targets in Russia. The group, Cloud Atlas, has been seen before, and it's known to have cultivated targets in Azerbaijan, Belarus, Russia, Slovenia, and Turkey, a politically heterogeneous set of countries in loose geographical proximity. Consensus regards it as a state-directed group, but it's not clear which state Cloud Atlas is working for.

Citing a report earlier this week from Russian cybersecurity firm F.A.C.C.T., the Record describes a recent phishing effort that prospected "a Russian agro-industrial enterprise and a state-owned research company." Two phishing emails were observed, one baited with an offer to send postcards to soldiers fighting in Ukraine and to their family members, the other with an account of changes to laws governing military reserves. Malicious attachments in the emails exploited CVE-2017-11882, a Microsoft Office vulnerability patched in 2017 but still undergoing active exploitation in the wild. It's an arbitrary code execution vulnerability, and the emails containing the payload are preceded by reconnaissance emails containing no malware.

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. CyberVista’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

An update on the Kyivstar attack.

The Kyiv Post reports that Kyivstar has fully restored its services, quoting the telco as saying, “The company’s specialists worked non-stop to swiftly restore subscribers’ ability to use all communication services throughout Ukraine and abroad after the largest hacker attack in the history of the global telecommunications market.” Kyivstar thanked its customers for sticking with it, said it would be waiving many fees, and announced that it was making a substantial donation "for the needs of the Armed Forces of Ukraine."

The Russian hacktivist auxiliary Solntsepek has claimed responsibility, apparently credibly. “We, the Solntsepek hackers, take full responsibility for the cyber-attack on Kyivstar," the group said in its Telegram channel. “We attacked Kyivstar because the company provides communications to the Armed Forces of Ukraine, as well as government agencies and law enforcement agencies of Ukraine.”

An analysis by the Atlantic Council considers the possibility that the attack on Kyivstar--a rare, large-scale success in the cyber phase of the hybrid war, and the most consequential Russian cyberattack since the takedown of Viasat ground stations in the hours after the invasion--may foreshadow an intensification of Russian efforts. Ukrainian defenses have proven formidable, but it would be unwise to conclude that Russian offensive capabilities might not respond by evolving into more effective forms.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Share your message with our audience of security leaders.

N2K Cyber’s 2024 sponsorship packages are now available. If you're looking to reach the eyes and ears of our influential security professionals, let's talk and see how we can build a program that meets your goals.

Notes.

Today's issue includes events affecting Azerbaijan, Belarus, the European Union, Gaza, Hungary, Iran, Israel, Kazakhstan, NATO/OTAN, Russia, Slovenia, Turkey, Ukraine, the United Kingdom, the United States, and Uzbekistan.

N2K Cyber goes to its holiday schedule this Saturday evening.

The CyberWire will publish on its winter holiday schedule beginning Sunday and continuing through next week. We'll depart from our regular daily and weekly news briefings and podcasts to bring you a selection of special coverage instead. Visit N2K Cyber, and listen to the CyberWire Daily over the break for discussion of some of the cybersecurity sector's most interesting topics from across the N2K Network. This is the last of our regular Daily News Briefings for 2023, but we'll resume regular publication on January 2nd, in the new year. Until then, please accept our best holiday wishes, and, as always, thank you for reading.

Selected Reading

Dateline: Hybrid wars in Ukraine, Russia, Israel, and Gaza.

Ukraine at D+666: Kyivstar attack may represent a new cyber phase of the hybrid war. (CyberWire) Unattributed cyberespionage campaigns afflict both sides. The Kyivstar cyberattack is now regarded as the most effective Russian cyber operation since its attack against Viasat ground stations in the opening hours of the invasion.

The case of al-Shifa: Investigating the assault on Gaza’s largest hospital (Washington Post) Weeks before Israel sent troops into al-Shifa Hospital, its spokesman began building a public case.

Hamas leader says hostage deal is ‘all or nothing’ (The Telegraph) Yahya Sinwar has reportedly insisted on a lasting ceasefire and the release of all Palestinian prisoners, including high-profile figures

Israel Mostly Excluded From Talks as America Signals Support for UN Resolution Seeking Increase in Gaza Humanitarian Aid (The New York Sun) The scheme being considered has been tried before — under the now-infamous name of oil-for-food.

Israel’s Muddled Strategy in Gaza (Foreign Affairs) Time to make hard choices.

Opposition to Israel’s war for survival fails to understand Hamas’s goals (Atlantic Council) Calls for an immediate and permanent ceasefire, beyond humanitarian pauses, are implicitly advocating for a Hamas victory.

In Dealing With the Israeli-Palestinian Conflict, America Has No Easy Way Out (Foreign Affairs) Biden must take risks, talk straight, and act boldly.

Distortion by design (Atlantic Council) Almost as soon as the Israel-Hamas war began, it collided with the engineering and policy decisions of social media companies. On Telegram, terrorist content spread mostly uncontested; on X, false claims proliferated. Accusations of anti-Palestinian bias at Meta and pro-Palestinian bias at TikTok added to the confusion. Can the platforms thread this needle?

Opinion How the battle for democracy will be fought — and won (Washington Post) In September last year, three days after widespread protests broke out across Iran over the death of a young woman detained for not fully covering her hair with a hijab, the authorities blocked the internet.

Kyiv Targeted By Mass Russian Drone Attack (RadioFreeEurope/RadioLiberty) The Ukrainian capital, Kyiv, was targeted by more than two dozen drones launched by Russia early on December 22, injuring two people.

Analysts say Ukraine's forces are pivoting to defense after Russia held off their counteroffensive (AP News) A British military analysis says Ukraine’s armed forces are taking up a more defensive posture, after their summer counteroffensive failed to achieve a major breakthrough against Russia’s army and as winter weather sets in after almost 22 months of war.

Ukrainian spies vow to stab Russia ‘with a needle in the heart’ (POLITICO) Chief of SBU intelligence service warns Putin to expect ‘surprises’ in 2024.

Ukraine in Europe: One Hard-Earned Step Closer (Wilson Center) On December 14, 2023, the European Council adopted an historic decision to open membership negotiations with Ukraine and Moldova, and to grant candidate status to Georgia.

Orban acknowledges EU can provide aid to Ukraine without Hungary’s (EMEA Tribune) Hungarian Prime Minister Viktor Orban has acknowledged that European Union member states have the autonomy to provide assistance to Ukraine independently, bypassing the need for consensus within the

Orban Says He Accepted Zelenskiy's Invitation To Discuss Ukraine's EU Membership Hopes (RadioFreeEurope/RadioLiberty) Hungarian Prime Minister Viktor Orban says he has accepted an invitation from Ukrainian President Volodymyr Zelenskiy to hold a bilateral meeting, which would be the first between the two leaders since Russia launched its full-scale invasion of Ukraine.

Putin scents historic victory amid growing signs of Western weakness (Atlantic Council) Recent indications of growing Russian confidence in victory over Ukraine owe much more to Western weakness than to the Kremlin’s own military might, writes Peter Dickinson.

Europe Must Ramp Up Its Support for Ukraine (Foreign Affairs) Abandoning Kyiv would embolden Russia—and lead only to more war.

Ukraine Should Take a Page out of Finland’s Fight With Stalin (Real Clear Defense) Helsinki had to sacrifice territory for autonomy, but its pride and prosperity soared.

A majority of Congressmen want more military aid for Ukraine (The Economist) They are being prevented from voting for it in the name of phoney populism

Threat Actor 'UAC-0099' Continues to Target Ukraine (Deep Instinct) Deep Instinct’s Threat Research team explores recent activities by threat actor "UAC-0099," including recent attacks on Ukrainian targets. It also examines common tactics, techniques, and procedures (TTPs), including the use of fabricated court summons to bait targets in Ukraine into executing malicious files.

Ukrainian remote workers targeted in new espionage campaign (Record) A group tracked as UAC-0099 exploited a high-severity vulnerability in WinRAR software to target Ukrainians outside the country, researchers at Deep Instinct said.

Cyber-espionage group Cloud Atlas targets Russian companies with war-related phishing attacks (Record) The hacker group known as Cloud Atlas targeted a Russian agro-industrial enterprise and a state-owned research company in a new espionage campaign, researchers have found.

Fog of cyber war: spies from Cloud Atlas attack Russian companies under the guise of supporting SVO participants (FACCT) FACCT experts analyzed new attacks by the Cloud Atlas spy group

Kyivstar Restores Full Services After Massive Hacker Attack (KyivPost) Ukraine’s largest mobile telephone operator is running again after a huge cyber-attack. Kyivstar will also cancel the plan fee for its users and allocate millions of dollars for the AFU.

Ukrainian telecoms hack highlights cyber dangers of Russia's invasion (Atlantic Council) An unprecedented December 12 cyber attack on Ukraine's largest telecoms operator Kyivstar left tens of millions of Ukrainians without mobile services and underlined the cyber warfare potential of Russia's ongoing invasion, writes Mercedes Sapuppo.

U.S. and Europe Eye Russian Assets to Aid Ukraine as Funding Dries Up (New York Times) Despite legal reservations, policymakers are weighing the consequences of using $300 billion in Russian assets to help Kyiv’s war effort.

The pitfalls of seizing Russian assets to fund Ukraine (Financial Times) Moscow must be made to pay, but without risking harm to global financial stability

Russia Adds Two Of Navalny's Self-Exiled Associates To Its Wanted List (RadioFreeEurope/RadioLiberty) The Russian Interior Ministry on December 21 added two self-exiled associates of imprisoned opposition politician Aleksei Navalny to its wanted list on unspecified charges.

Russia Launches Probe Against Self-Exiled Opposition Politician Leonid Gozman (RadioFreeEurope/RadioLiberty) Sources in Russian law enforcement on December 22 said a probe had been launched against self-exiled opposition politician Leonid Gozman on charge of spreading "fake" information about Russia's armed forces involved in Moscow’s ongoing invasion of Ukraine.

Kazakhstan To Extradite U.S.-Wanted Russian Cybersecurity Expert To Moscow (RadioFreeEurope/RadioLiberty) Russia's Prosecutor-General's Office said on December 21 that the Kazakh authorities would extradite Russian cybersecurity expert Nikita Kislitsin to Moscow, although he is also wanted in the United States for allegedly buying illegally obtained personal data.

Attacks, Threats, and Vulnerabilities

Microsoft Warns of New 'FalseFont' Backdoor Targeting the Defense Sector (The Hacker News) Iranian threat actor targets Defense Industrial Base sector with a new backdoor called FalseFont.

‘Today FBI Got Him, Tomorrow They Will Get Me’: LockBit, BlackCat Unite to Form Cyber Cartel (The Cyber Express) In the aftermath of a successful takedown of Alphv ransomware infrastructure, an unexpected alliance has emerged. LockBit and BlackCat/APLHV, two

Bandook - A Persistent Threat That Keeps Evolving (Fortinet Blog) FortiGuard Labs has uncovered a fresh threat - the latest generation of Bandook is being distributed via a Spanish PDF file. Learn more.…

BattleRoyal, DarkGate Cluster Spreads via Email and Fake Browser Updates (Proofpoint) Overview Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybe...

8220 Gang Targets Telecom and Healthcare in Global Cryptojacking Attack (Hackread) The 8220 gang, believed to be of Chinese origins, was first identified in 2017 by Cisco Talos when they targeted Drupal, Hadoop YARN, and Apache Struts2 applications for propagating cryptojacking malware.

BidenCash darkweb market gives 1.9 million credit cards for free (BleepingComputer) The BidenCash stolen credit card marketplace is giving away 1.9 million credit cards for free via its store to promote itself among cybercriminals.

Android malware Chameleon disables Fingerprint Unlock to steal PINs (BleepingComputer) The Chameleon Android banking trojan has re-emerged with a new version that uses a tricky technique to take over devices — disable fingerprint and face unlock to steal device PINs.

Instagram users targeted in elaborate backup code phishing scheme (9to5Mac) A new strain of Instagram phishing emails has been detected, in which attackers attempt to trick victims into forking over...

An iPhone Thief Explains How He Steals Your Passcode and Bank Account (Wall Street Journal) Thieves are stealing iPhones, passcodes and thousands of dollars from their victims’ bank accounts. WSJ’s Joanna Stern sat down with a convicted thief in a high-security prison to find how—and how you can protect yourself. Photo illustration: The Wall Street Journal

Patient data stolen in ransomware attack affecting millions of healthcare victims (TechRadar) Supply chain attack resulted in the theft of sensitive patient data

Kansas City-area hospital transfers patients, reschedules appointments after cyberattack (Register) "We expect this process to take time," Missouri's Liberty Hospital said earlier this week as it began responding to a disruption to its systems.

Data stolen in cyber attack on St Vincent's Health network (ABC) St Vincent's Health says there is evidence that "some data" has been removed from its system, but it is still working to determine what information had been stolen.

Title insurance giant First American offline after cyberattack (BleepingComputer) First American Financial Corporation, the second-largest title insurance company in the United States, took some of its systems offline today to contain the impact of a cyberattack.

First American is the latest cybersecurity attack victim (HousingWire) First American suffers cybersecurity attack less than a month after the firm agreed to pay New York $1 million in cybersecurity settlement.

Breach exposed data of more than 1,400 detainees and 400 staff members, Wyatt detention facility says (Boston Globe) The Wyatt detention facility in Central Falls said it discovered a data breach on Nov. 2, and that personal data has been posted on the dark web, including financial and medical information.

What Hacked Files Tell Us About The Studio Behind Spider-Man 2 (Kotaku) Internal documents show how a big PlayStation studio plans its future

CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-49897 FXC AE1021, AE1021PE OS Command Injection Vulnerability CVE-2023-47565 QNAP VioStor NVR OS Command Injection Vulnerability

Security Patches, Mitigations, and Software Updates

OpenAI rolls out imperfect fix for ChatGPT data leak flaw (BleepingComputer) OpenAI has mitigated a data exfiltration bug in ChatGPT that could potentially leak conversation details to an external URL.

Google Rushes to Patch Eighth Chrome Zero-Day This Year (SecurityWeek) Google warns of in-the-wild exploitation of CVE-2023-7024, a new Chrome vulnerability, the eighth documented this year.

ESET Patches High-Severity Vulnerability in Secure Traffic Scanning Feature (SecurityWeek) ESET has patched CVE-2023-5594, a high-severity vulnerability that can cause a browser to trust websites that should not be trusted.

ESET fixed a high-severity bug in the Secure Traffic Scanning Feature of several products (Security Affairs) ESET fixes flaw in Secure Traffic Scanning Feature that could have been exploited to cause web browsers to trust untrustworthy sites

Microsoft deprecates Defender Application Guard for some Edge users (BleepingComputer) Microsoft is deprecating Defender Application Guard (including the Windows Isolated App Launcher APIs) for Edge for Business users.

CISA Releases Microsoft 365 Secure Configuration Baselines and SCuBAGear Tool (Cybersecurity and Infrastructure Security Agency | CISA) CISA has published the finalized Microsoft 365 Secure Configuration Baselines, designed to bolster the security and resilience of organizations’ Microsoft 365 (M365) cloud services. This guidance release is accompanied by the updated SCuBAGear tool that assesses organizations’ M365 cloud services per CISA’s recommended baselines.

CISA Releases Two Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency | CISA) CISA released two Industrial Control Systems (ICS) advisories on December 21, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Trends

NCC Group Monthly Threat Pulse - November 2023 (NCC Group) Ransomware attacks in November rise 67% from 2022

Cyber Threat Intelligence Report - November 2023 (NCC Group) Welcome to NCC Group’s monthly Cyber Threat Intelligence Report, bringing you exclusive insight into the latest Threat Intelligence, updates on recent and emerging advances in the threat landscape and a deep understanding of the latest Tactics, Techniques and Procedures (TTPs) of threat actors.

Twitter’s Demise Is About So Much More Than Elon Musk (The Atlantic) TikTok is eating microblogging as we’ve always known it.

America’s Spam-Call Scourge (The Atlantic) How robocalls disturbed a nation

Marketplace

Cisco to Acquire Isovalent, Add eBPF Tech to Cloud Portfolio (SecurityWeek) Isovalent raised about 70 million in funding from prominent investors including Microsoft’s venture fund, Google, and Andreessen Horowitz.

Cisco to acquire cloud-native networking and security startup Isovalent (TechCrunch) Cisco is acquiring cloud native networking and security startup Isovalent, giving it a key set of cloud native technologies.

Is Microsoft The Answer To Cybersecurity Risks Or The Problem? (Investor's Business Daily) Its cybersecurity business is booming. So what about those hacks that gave it a black eye?

DeNexus expands re/insurance and Insurance-Linked Securities expertise with new senior hire (PR Newswire) DeNexus Inc, a provider of second-generation cyber risk quantification and management services to industrial enterprises and critical...

GCA Announces Three New Appointments for its Board of Directors (Global Cyber Alliance) The Global Cyber Alliance (GCA), an international nonprofit that builds communities to deploy tools, services, and programs that provide cybersecurity at global scale, announced the appointment of three new Board Members: Michael Lashlee, Executive Vice President, Deputy Chief Security Officer at Mastercard, who has been a long term strategic advisor to GCA with Mastercard being a valued Premium Partner and sponsor of our Cybersecurity Toolkit for Small Business; Kiersten Todt, former Chief of Staff of the Cybersecurity and Infrastructure Security Agency (CISA), and Greg Kapfer, formerly Board Member of the Public Interest Registry (PIR).

Products, Services, and Solutions

Socure Eliminates More Than 200K Synthetic Identities in 2023 (PR Newswire) Socure, the leading provider of artificial intelligence for digital identity verification, sanction screening, and fraud prevention, today...

NetSPI Celebrates Momentous Year for its Partner Program, Achieves 30% Growth in 2023 (PR Newswire) NetSPI, the global leader in proactive security, today celebrates the achievements of its Partner Program in 2023, which experienced...

QuSecure™ Launches QuProtect™ Post-Quantum Cryptography Cybersecurity Software in AWS Marketplace (Yahoo Finance) QuSecure™, Inc., a leader in post-quantum cryptography (PQC), today announced the availability of its cutting-edge cybersecurity software QuProtect™ in AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that makes it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS). This strategic move marks a significant milestone not only for QuSecure but also for the PQC market...

Technologies, Techniques, and Standards

DOD Issues Civilian Harm Mitigation, Response Instruction (U.S. Department of Defense) Defense Department officials have completed work on a DOD instruction that incorporates the direction of the department's civilian harm mitigation and response action plan.

DOD INSTRUCTION 3000.17: CIVILIAN HARM MITIGATION AND RESPONSE (U.S. Department of Defense) Consistent with Section 936 of Public Law 115-232, also known and referred to in this issuance as the “John S. McCain National Defense Authorization Act (NDAA) for Fiscal Year (FY) 2019”, as amended and codified as a note in Section 134 of Title 10, United States Code (U.S.C.), this issuance: • Establishes policy, assigns responsibilities, and provides procedures for civilian harm mitigation and response (CHMR). • Helps implement U.S. Government (USG) policy prescribed in Executive Order 13732. • Helps implement the August 25, 2022 DoD Civilian Harm Mitigation and Response Action Plan (CHMR-AP). • Will be implemented through the phased approach established by the CHMR-AP.

As British Library faces fallout of cyber attack—what can arts bodies do to combat ransomware threats? (The Art Newspaper) A hack that has limited the British Library’s access to its digital systems is the latest in a series of online raids on cultural institutions

Design and Innovation

How to Build Trust in Artificial Intelligence (The Information) Last month, OpenAI fired and then rehired CEO Sam Altman. When the dust settled, Open AI emerged looking even more like a for-profit corporation than a nonprofit, with a board that is indistinguishable from those of other tech startups—right down to the lack of diversity. This is a clear ...

Legislation, Policy, and Regulation

The Premature Quest for International AI Cooperation (Foreign Affairs) AI regulation must start with national governments.

Can AI be creative? Global copyright laws need an answer. (Atlantic Council) Advances in generative artificial intelligence have revealed serious shortcomings in global copyright laws.

New rules in UK could reimburse fraud victims up to £415,000 ($525,000) (Record) Expected in October 2024, the new rules represent a radical change to who is liable for losses incurred in fraud such as romance and investment scams.

Cyber Security Association of India Emphasizes Importance of Cyber Security in Power Sector (India Technology News) Cyber Security Association of India (www.ncsai.in) under the chairmanship of Lt Gen (Dr.) Rajesh Pant, Former National Cyber Security Coordinator organised Power Sector

Congress wants spy agencies to hire more experts in financial intelligence, emerging technology (Federal News Network) Congress wants spy agencies to hire more experts in financial intelligence, emerging technology

Litigation, Investigation, and Law Enforcement

Turkey’s ‘disinformation law’ weaponized to target journalists: int’l NGOs (Turkish Minute) A new report released jointly by several international NGOs details the worsening press freedom environment in Turkey, accusing the government of instrumentalizing the recently passed “disinformation law” to harass and silence journalists, the Stockholm Center for Freedom reported, citing the Evrensel newspaper.

Teen Who Leaked ‘Grand Theft Auto VI’ as Part of Lapsus$ Gang Put in Secure Hospital by UK Judge (Bloomberg) Arion Kurtaj placed in hospital to protect public from harm. Two teens sentenced for hacking, blackmailing tech firms.

Teenage Lapsus$ hacker sentenced to indefinite hospital confinement (Computing) An 18-year-old hacker associated with the cybercrime group Lapsus$ has been sentenced to an indefinite stay in a secure hospital after being involved in high-profile data breaches and extortion attempts.

U.S. appeals court finalizes mandate for forfeiture of Silk Road bitcoin (The Block) A U.S. appeals court finalized a mandate on Wednesday that formalizes the forfeiture of 69,370 bitcoin connected to the Silk Road.

Darknet site “Kingdom Market” has fallen (Cybernews) Law enforcement has taken down the illegal marketplace known as “Kingdom Market,” which specialized in drug trade and malware.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SINETSilicon Valley 2024 (Mountain View, California, USA, Mar 21, 2024) SINET – Silicon Valley provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on identifying solutions to Cybersecurity challenges.

SINETNew York 2024 (New York, New York, USA, Oct 16, 2024) SINET events provide exclusive opportunities to engage directly with a select network of influential thought leaders, solution providers, researchers and investors from the global security community. SINET invites you to become an event sponsor and receive the unique advantage of showcasing your company’s offering directly to high level decision makers and influencers from the security profession.

Events

The International Conference on Cyber Security 2024 (New York, New York, USA, Jan 8 - 10, 2024) The International Conference on Cyber Security (ICCS) is the premier global cybersecurity event spanning three days, with over 50 distinguished speakers from the government, the private sector, and academia. It is an unparalleled opportunity for global cyber threat analysis, operations, research, and law enforcement leaders to coordinate and share their efforts to create a more secure world.

SANS Cloud Defender 2024 (Virtual, Jan 8 - 13, 2024) At SANS Cloud Defender 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS Classic 2024 (Virtual, Jan 15 - 20, 2024) At SANS Classic 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Live Web Based Training Course (Virtual, Jan 17 - 18, 2024) This highly sought after and very comprehensive 1 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.