SVB's collapse. Cybercrime: BatLoader, Emotet, and Medusa. Law enforcement against NetWire. Update on Russia's hybrid war.

Summary

By the CyberWire staff

At a glance.

Coping with Silicon Valley Bank's collapse.
BatLoader's abuse of Google Search Ads.
More on Emotet’s re-emergence.
Medusa rising.
Not a remote access tool, but malware.
DDoS apart, all remains more-or-less quiet on the cyber front.

Coping with Silicon Valley Bank's collapse.

A run on the bank drove Silicon Valley Bank (SVB) into insolvency. The failure hit the tech sector (and the cybersecurity sector) hard, especially its venture-backed start-ups, hard. Just before noon on Friday the US Federal Deposit Insurance Corporation (FDIC) closed SVB, placed it in receivership, and began working to find buyers for the failed bank. Federal regulators worked over the weekend to control the damage. It is, as the AP puts it, “the largest failure of a U.S. financial institution since the height of the financial crisis almost 15 years ago.”

The US Department of the Treasury, the FDIC, and the Federal Reserve announced late Sunday that the government had decided to take extraordinary measures to protect depositors: “After receiving a recommendation from the boards of the FDIC and the Federal Reserve, and consulting with the President, Secretary Yellen approved actions enabling the FDIC to complete its resolution of Silicon Valley Bank, Santa Clara, California, in a manner that fully protects all depositors. Depositors will have access to all of their money starting Monday, March 13." A comparable arrangement has been reached for SVB's British unit, Silicon Valley Bank UK. Reuters reports that HSBC UK Bank early this morning agreed to acquire SVB UK for £1 ($1.21). For more on the situation of Silicon Valley Bank, see CyberWire Pro.

Doing Threat Intel is Really Difficult - Try a Managed Intel Service

Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.

BatLoader's abuse of Google Search Ads.

eSentire says the operators of the BatLoader malware downloader are continuing to abuse Google Search Ads to redirect users to malicious webpages. The malware is being distributed via phishing sites that impersonate ChatGPT, Adobe, Spotify, Tableau, and Zoom. BatLoader is used to deliver an assortment of malware, including the Redline Stealer, Ursnif, and the Vidar Stealer. The researchers note that Microsoft late last year linked BatLoader to Royal Ransomware infections.

Predictive analytics to ensure your team passes the CISSP the first time.

Other CISSP certification training providers don't have a way to determine exam readiness until a practitioner passes (or fails) their certification exam. CyberVista's online CISSP course includes predictive analytics to show who is ready, who needs more time, and where to focus training. Through diagnostic exams, custom quizzes, a mock Computer Adaptive Test (CAT) Exam, and more, employers and practitioners alike feel confident in passing their CISSP the first time with CyberVista.

More on Emotet’s re-emergence.

Emotet’s re-emergence last week had the goal of infiltrating corporate networks via malicious emails in order to sell access to ransomware groups, SC Magazine reports. Deep Instinct researcher Simon Kenin shared in a post that Emotet has now been observed sending malware in Microsoft Word files. Paradoxically, researchers say, the payload’s large size (over 500 megabytes) “drastically” decreases detection and subsequent neutralization of the malicious files: many security products and sandboxes don’t scan or isolate the files due to their size.

“When the operator of the botnet sees a high value target infected, he can sell access to a ransomware group, which will have initial access and try to hack the whole network,” Kenin told SC Magazine. “The return on investment is much higher for ransomware than banking trojans these days. For other less valuable targets, a method of pay-per-install can be used and the operator just loads other cybercriminals malware in bulk.” Kenin says products that aren’t solely reliant on static detection and analysis are more effective against attacks like Emotet’s most recent campaigns.

Medusa rising.

BleepingComputer reports that the Medusa ransomware gang has been stepping up its double-extortion racket over the past several months. (Note that the Medusa ransomware operation is unrelated to the MedusaLocker ransomware-as-a-service offering.) The threat actor has launched its “Medusa Blog” to leak data from victims who refuse to pay up. The blog gives victims an option to pay a lower sum to advance the deadline by one day. The Medusa gang last week released a lengthy video showing data allegedly stolen from the Minneapolis Public Schools (MPS) district. The threat actor is demanding $1 million in ransom from the school district.

Not a remote access tool, but malware.

Authorities in Croatia Thursday arrested a person of interest whom they believe to be the administrator of worldwiredlabs.com, a domain used to distribute the NetWire remote access Trojan (RAT), Help Net Security reported Friday. Swiss law enforcement also reportedly seized the computer behind the Trojan’s infrastructure.

NetWire was simultaneously advertised on hacking fora, as well as in legitimate markets, where it was offered as a legitimate remote administration tool, TechCrunch wrote Thursday. Used as a remote access Trojan (RAT), NetWire allowed cyber criminals to remotely access and control devices, as well as lift sensitive data from victims. In an archived version of the site found by TechCrunch reporters, NetWire is described as “specifically designed to help businesses complete a variety of tasks connected with maintaining computer infrastructure. It is a single ‘command center’ where you can keep a list of all your remote computers, monitor their statuses and inventory, and connect to any of them for maintenance purposes.”

The US Attorney's Office in the Central District of California said in the press release announcing the site’s seizure that the FBI’s investigation into the site began in 2020. TechCrunch reports that in the FBI’s investigations, the Bureau found that the site “never required the FBI to confirm that it owned, operated, or had any property right to the test victim machine that the FBI attacked during its testing (as would be appropriate if the attacks were for a legitimate or authorized purpose).” Krebs on Security has an account of what the domains used by NetWire suggest about its operators.

DDoS apart, all remains more-or-less quiet on the cyber front.

Estonia has successfully conducted its elections (where a majority of voting is done online) despite extensive distributed denial-of-service (DDoS) attacks by Russian threat actors on election infrastructure and other government services, the Record reports. The attempts didn't succeed in disrupting voting, but Estonia's Prime Minister Kaja Kallas said there are clear signs the Russians are trying to adapt. The Record quotes her: "We see now, the Russian attacks — actually, they are not attributed officially, so maybe I can’t say this so openly — but the attacks on our systems, we see that they are learning. They see that ‘OK, these things are not going through’ so they are improving and constantly trying new ways to really undermine our system.”

Elsewhere in the Near Abroad, and especially in Russia's war against Ukraine, there's little new on the cyber front. But on other aspects of the war, the CyberWire's continuing coverage of Russia's war against Ukraine may be found here.

Dateline Moscow and Kyiv: Elite disputes in Russia.

Ukraine at D+382: Two struggles in Bakhmut. (CyberWire) Observers see signs of disagreement within Russia's elites, over both the kinetic and the information war.

Russia-Ukraine war: List of key events, day 383 (Al Jazeera) As the Russia-Ukraine war enters its 383rd day, we take a look at the main developments.

Ukraine Steps Up Calls for Evacuation of Kupiansk Under Relentless Russian Shelling (New York Times) Attacks on the northeast town in the Kharkiv region of Ukraine continued on Sunday.

Daily Briefing: War in Ukraine: British and French Leaders Pledge to Coordinate Support for Ukraine (New York Times) Meeting in Paris, Prime Minister Rishi Sunak of Britain and President Emmanuel Macron of France vowed to stay the course on Ukraine but steered clear of concrete promises to provide new advanced weapons, like fighter jets. Here is what we’re covering:

Ukraine-Russia war: Bakhmut has ‘bought time’ to plot Ukrainian counteroffensive (The Telegraph) The fight in Bakhmut has bought time to plan a future counteroffensive against Russia's forces, said Oleksandr Syrsky, the commander of Ukraine's ground forces.

‘Worse than Stalingrad’: Ukraine troops battle Wagner fighters in Bakhmut metal works (The Telegraph) One soldier said they were ‘trying to knock out’ the Russian mercenaries that stormed the complex Kyiv had hoped to make a stronghold

Russian advance stalls in Ukraine's Bakhmut, think tank says (AP NEWS) Russia’s advance seems to have stalled in Moscow's campaign to capture the eastern Ukrainian city of Bakhmut , a leading think tank said in an assessment of the longest ground battle of the war .

Russia-Ukraine war at a glance: what we know on day 382 of the invasion (the Guardian) UK defence ministry calls Bakhmut a ‘killing zone’; Russian shelling kills three Ukrainian civilians in Kherson, Ukrainian officials say; Russia lists World Wildlife Fund as a foreign agent

Russia-Ukraine war at a glance: what we know on day 381 of the invasion (the Guardian) Ukraine decides to fight on in Bakhmut, says Zelenskiy aide; Wagner chief worried about ammunition shortages; Nord Stream blasts ‘carried out by dive team’

Russia's best units 'pinned down' in Bakhmut battle (The Telegraph) The battle over the ruined city of Bakhmut is pinning down Russia's best units and degrading them ahead of a planned Ukrainian counter-offensive, an adviser to Volodymyr Zelensky has said.

UK: Russian advance in Bakhmut could come with heavy losses (AP NEWS) Russian forces have made progress in the front-line hotspot of Bakhmut, a key target of Moscow’s monthslong campaign in eastern Ukraine that has resulted in staggering casualties, but their assault will be difficult to sustain without further harsh losses, U.K.

The Wagner Group is losing so many fighters in Bakhmut that it’s launching a recruitment drive (Task & Purpose) Things are going great for the mercenary firm, why do you ask?

'Why should I fight?': How Russian soldiers are mutinying in face of 'certain death' (The Telegraph) Videos and messages from inside Putin’s army show troops deserting, fleeing and struggling to find their teams

Russia’s hypersonic missile attack on Ukraine highlights Western vulnerability (Washington Post) Russia fired a half-dozen of its rare Kinzhal hypersonic missiles at Ukraine on Thursday, as part of a broader barrage that killed six people and that the Russian Defense Ministry described as revenge for an incursion into western Russia last week by a far-right Russian nationalist group fighting on Ukraine’s side in the war.

Why Would Russia Use Hypersonic Missile to Strike Ukraine? (Military.com) The latest Russian missile barrage against Ukraine’s civilian infrastructure was one of the largest in months.

Anti-Russia Guerrillas in Belarus Take on 'Two-Headed Enemy' (Military.com) After Russia invaded Ukraine, guerrillas from Belarus began carrying out acts of sabotage on their country's railways.

Kremlin explains its ‘only option’ in Ukraine (RT International) Kremlin spokesman Dmitry Peskov said Russia has no alternative but to keeping fighting in Ukraine

Putin is running out of time to win the ammunition war against the West (The Telegraph) Russia's feeble economy cannot compete with Western production

Ex-Russian president suggests new name for Ukraine (RT International) Dmitry Medvedev has suggested that Ukraine should be renamed “Bandera-Reich”

The Russia That Might Have Been (Foreign Affairs) Moscow squandered its power and influence.

The Game of Responsibility (Wilson Center) “The war, which we are trying to stop, which was launched against us using the Ukrainian people....” At a recent G20 event in India the audience laughed at these remarks by Sergei Lavrov, Russia’s foreign minister. For those who do not live in an upside-down world, this phrase may indeed sound funny in its blatant disregard for the truth.

Ukraine as Russian Imperial Action: Challenges and Policy Options (Royal United Services Institute for Defence and Security Studies) The inherently imperial motivations behind Russia’s decision to invade Ukraine and its approach to the war have significant implications for Western support to Ukraine and the prospects for a just peace.

War will end at negotiating table with Ukraine in ‘best place’, Sunak says (the Guardian) British PM arrives in Paris for summit with Macron and marks clear departure from Boris Johnson’s stance

UK-French summit produces commitment to future defence initiatives and ongoing support for Ukraine (Estonian Free Press) Defence and security were a key focus at the 36th UK-France Summit in Paris on 10 March 2023, with new initiatives to advance what the UK Ministry of Defence (MoD) called “the already strong military relationship between the two nations”. UK Defence Secretary Ben Wallace met France’s Minister for the Armed Forces, Sébastien Lecornu, as

Divers used chartered yacht to sabotage Nord Stream pipelines – report (the Guardian) Report in Der Spiegel says six-person crew took Andromeda to Christiansø, close to site of blasts, but experts question theory

Russia has been sending captured US Javelins and Stingers from Ukraine to Iran, which may be able to reverse-engineer the weapons: report (Business Insider) Russia has been capturing US and NATO provided Javelins and Stingers in Ukraine and sending them to Iran to reverse-engineer, sources told CNN.

Poland builds Europe’s largest land force to counter Russian threat (The Telegraph) Warsaw is embarking on its biggest re-armament drive in 50 years in response to the growing threat posed by Russia

Kremlin elites are fighting over how best to control their Ukraine war narrative, says the Russian foreign ministry's top spokesperson (Business Insider) "There is a battle going on, including among the elites," said Maria Zakharova of the Kremlin's efforts to control information about the Ukraine war.

Estonia’s Election Was More Than Just a Win for Kallas (World Politics Review) Estonian Prime Minister Kaja Kallas’ center-right coalition won a landslide victory in the country’s parliamentary election, with the Russia-Ukraine conflict a salient part of her campaign. The results were interesting not only because of Kallas’ sweeping win, but also for the drop in support for other established parties.

Estonian official says parliamentary elections were targeted by cyberattacks (Record) Estonia's parliamentary elections this month were unsuccessfully targeted by cyberattacks, one of the country's leading cybersecurity officials told The Record.

Moldovan Police Say They Foiled Russian-Backed Unrest Plot (RadioFreeEurope/RadioLiberty) Moldovan police said on March 12 that they had foiled a plot by groups of Russian-backed actors specially trained to cause mass unrest during a protest in the capital against the country’s new pro-Western government.

Russia’s Covert Operation for ‘the Next Ukraine’ Has Already Begun (The Daily Beast) A major Russian influence operation to destabilize the Moldovan government is underway, U.S. and Moldovan officials told The Daily Beast.

Russia Is Powering Up a Giant Laser to Test Its Nukes (WIRED) To check that atomic weapons work, scientists run simulations of explosions using high-energy lasers—and Russia is building the strongest one of all.

US turns to new ways to punish Russian oligarchs for the war (AP NEWS) The U.S. has begun an aggressive new push to inflict pain on Russia’s economy and specifically its oligarchs with the intent of thwarting the Kremlin’s invasion of Ukraine. From the Treasury Department to the Justice Department, U.S.

European Central Bank to Hold Cyber Stress Tests for Banks (Gov Info Security) The European Central Bank will conduct cyber stress tests to determine banks' resilience against cyberattacks. The tests, which will receive a "significant

UNITED ARAB EMIRATES : Influx of Russian hackers benefits Abu Dhabi's cyber offensive capabilities (Intelligence Online) Beacon Red, the Edge Group conglomerate's Emirati cyber subsidiary, has hired a wave of cyber engineers fleeing Russia after the invasion of Ukraine. Intelligence Online understands the Russian

Attacks, Threats, and Vulnerabilities

“Massive” cyber attack crashes African Union’s system (Reporter) Cyber attackers prey on the African Union, resulting in the unscheduled suspension of its systems.

Emotet Again! The First Malspam Wave of 2023 (Deep Instinct) Earlier this week, on Tuesday, March 7th, Emotet was observed for the first time this year sending new malspam to infect victims. This is significant because the last time Emotet was seen sending malicious spam was in November of 2022. This current wave is different from the one in November, though, including new evasion techniques that we will detail in this blog.

Emotet attempts to sell access after infiltrating high-value networks (SC Media) The Emotet trojan re-emerged this week after a hiatus, sending malicious emails to infiltrate high-value corporate networks and then try to sell that access to ransomware groups.

Medusa ransomware gang picks up steam as it targets companies worldwide (BleepingComputer) A ransomware operation known as Medusa has begun to pick up steam in 2023, targeting corporate victims worldwide with million-dollar ransom demands.

Clop ransomware gang begins extorting GoAnywhere zero-day victims (BleepingComputer) The Clop ransomware gang has begun extorting companies whose data was stolen using a zero-day vulnerability in the Fortra GoAnywhere MFT secure file-sharing solution.

BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif (eSentire) Learn more about the BatLoader malware, how we detected the attack, and recommendations from our Threat Response Unit (TRU) to protect your business from this cyber threat.

BATLOADER Malware Uses Google Ads to Deliver Vidar Stealer and Ursnif Payloads (The Hacker News) Malware downloader BATLOADER has been found abusing Google Ads to deliver secondary payloads like Vidar Stealer and Ursnif.

KamiKakaBot Malware Used in Latest Dark Pink APT Attacks on Southeast Asian Targets (The Hacker News) Dark Pink is suspected to be of Asia-Pacific origin and has been linked to attacks targeting government and military entities with KamiKakaBot malware

SHEIN shopping app goes rogue, grabs price and URL data from your clipboard (Naked Security) It’s not exactly data theft, but it’s worryingly close to “unintentional treachery” – apparently because it’s great for marketing purposes

CASPER attack steals data using air-gapped computer's internal speaker (BleepingComputer) Researchers at the School of Cyber Security at Korea University, Seoul, have presented a new covert channel attack named CASPER can leak data from air-gapped computers to a nearby smartphone at a rate of 20bits/sec.

Most lauded ChatGPT capability also brings big risk to businesses (ZDNET) Its ability to mimic humans with its responses has ignited much of the hype currently swirling around the AI-powered tool and is also what presents a major threat.

The risk of pasting confidential company data into ChatGPT (Security Affairs) Experts warn that employees are providing sensitive corporate data to the popular artificial intelligence chatbot model ChatGPT. Researchers from Cyberhaven Labs analyzed the use of ChatGPT by 1.6 million workers at companies across industries. They reported that 5.6% of them have used it in the workplace and 4.9% have provided company data to the popular […]

D.C. Data Breach That Included Members of Congress Affected More Than 56,000 (New York Times) The Social Security numbers and personal information of thousands of people, including some lawmakers, were stolen in a hack of a D.C. health marketplace disclosed this week.

DC Health Link responds to data breach, saying investigation in the works (WTOP News) DC Health Link released a statement Friday giving the public an update on the serious breach of confidential data that occurred this week.

Capitol Hill data breach more 'extensive' than previously known (CBS58) A sweeping cybersecurity breach of congressional members' private information was more extensive than previously known and affects not only House lawmakers and their staff but a

Stolen data from D.C.'s health insurance marketplace is already being sold on the dark web (Axios) A hacker is selling a database claiming to have sensitive data from at least 55,000 customers.

PeopleGrove security lapse exposed users' personal information (TechCrunch) An exposed database was accessible from the internet using only a web browser, but none of the exposed data was encrypted.

The SVB demise is a fraudster's paradise, so take precautions (Help Net Security) Silicon Valley Bank (SVB) has been shut down, so Mitiga CTO Ofer Maor explains the cyber fraud potential of this situation.

Researchers Uncover Over a Dozen Security Flaws in Akuvox E11 Smart Intercom (The Hacker News) More than a dozen security flaws have been disclosed in Akuvox E11, a smart intercom product.

The Silent Spy Among Us: Modern Attacks Against Smart Intercoms (Claroty) What started out as a journey to learn more about a new smart intercom inside the Claroty offices turned into an expansive Team82 research project that uncovered 13 vulnerabilities in the popular Akuvox E11.

CISA warns of actively exploited Plex bug after LastPass breach (BleepingComputer) CISA has added an almost three-year-old high-severity remote code execution (RCE) vulnerability in the Plex Media Server to its catalog of security flaws exploited in attacks.

CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CISA warns of critical VMware RCE flaw exploited in attacks (BleepingComputer) CISA has added a critical severity vulnerability in VMware's Cloud Foundation to its catalog of security flaws exploited in the wild.

Acronis states that only one customer’s account has been compromised. Much ado about nothing (Security Affairs) Acronis downplays the severity of the recent security breach explaining that only a single customer’s account was compromised. The CISO of Acronis downplayed a recent intrusion, revealing that only one customer was impacted. This week a threat actor, who goes online with the moniker “kernelware”, claimed the theft of data from technology firm Acronis and […]

Cybersecurity Firm Acronis Data Breach: Hackers Leak 21GB of Data (HackRead) Acronis has confirmed the data breach, stating that the leak does not contain login credentials.

3,400 records accessed in DOH security breach (KHON2) The Hawai’i Department of Health announced Thursday, March 9 that their security system has been breached.

Online mental health provider's use of tracking tech highlights dangers (Washington Post) Cerebral disclosure shows vulnerability of online mental health data, risk of tracking tools

Data breach at UNC-Chapel Hill: Tax forms with sensitive info sent to wrong people (News & Observer) UNC-Chapel Hill potentially exposed sensitive and personal information — including Social Security numbers — when the university erroneously sent tax forms to the wrong people and entities in January.

Russian ransomware gang posts more Lehigh Valley patient photos to dark web (Becker's Hospital Review) Russian ransomware gang BlackChat has posted more photos of patients from Allentown, Pa.-based Lehigh Valley Health Network to the dark web after the health system refused to pay following a February hack, The (Allentown) Morning Call reported March 10.

“They cleared my whole bank account,” Jax woman scammed, experts now warning others about spam texts (Action News Jax) “They cleared my whole bank account,” Tesa Childs said. “Somehow, they had complete access to my phone.”

Indigo union demands more details on cyberattack, support for affected workers (Yahoo Finance) A union representing 200 employees of Indigo Books & Music Inc. is calling on the retailer to disclose more information about the scope of its recent data breach and offer additional support to staff affected by the cyberattack. United Food and Commercial Workers International Union Local 1006A said Saturday that it is "increasingly alarmed" by new information that has come to light about a Feb. 8 cyberattack on Canada's biggest bookstore. Current and former Indigo workers learned this

STALKER 2 developer asks fans to “stay patient” in wake of data breach (PCGamesN) STALKER 2 developer GSC Game World shares a statement after a data breach, asking fans to avoid watching leaked material and wait for the official release date.

Hackers to Ramp Up Their Game During March Madness (The Street) A surge in cyber attacks is expected as curiosity and betting rises on the March Madness college basketball tournament.

Keeper Security Issues Top 5 Cybersecurity Tips for 2023 College Basketball Tournament (PR Newswire) March is an exciting time for diehard and casual college basketball fans alike, but anyone planning to have fun around the tournament should...

Cyber attack affecting Gloucester museum's system one year on (BBC News) A breach in December 2021 is still preventing the museum from accessing its artefact database.

Security Patches, Mitigations, and Software Updates

Veeam Backup & Replication admins, get patching! (CVE-2023-27532) (Help Net Security) Veeam Software has patched CVE-2023-27532, a high-severity security hole in its widely-used Veeam Backup & Replication solution.

Trends

Investment Fraud is Now Biggest Cybercrime Earner (Infosecurity Magazine) Category surged 127% year-on-year, says FBI

Cloudflare Uses the Power of its Global Network to Identify the Top 50 Most Impersonated Brands and Protect Zero Trust Customers From Phishing Scams (Business Wire) AT&T, PayPal, and Microsoft top the list of most impersonated brands in phishing attempts. Most targeted industries include Finance, Technology, and Telecom for phishing scammers. New anti-phishing protections in Cloudflare One block the tricks phishers use to confuse end-users

Top 50 most impersonated brands in phishing attacks and new tools you can use to protect your employees from them (The Cloudflare Blog) We’re expanding the phishing protections available to Cloudflare One customers by automatically identifying—and blocking—so-called “confusable” domains.

Marketplace

One of Silicon Valley's top banks fails; assets are seized (AP NEWS) Regulators rushed Friday to seize the assets of one of Silicon Valley's top banks, marking the largest failure of a U.S. financial institution since the height of the financial crisis almost 15 years ago.

US, UK try to stem fallout from Silicon Valley Bank collapse (AP NEWS) Governments in the UK and U.S. took extraordinary steps to stop a potential banking crisis after the historic failure of Silicon Valley Bank, even as another major bank was shut down.

In abrupt reversal, regulators to cover Silicon Valley Bank, Signature uninsured deposits (American Banker) The Treasury Department issued a "systemic risk exception" allowing it to cover uninsured deposits at SVB and Signature Bank, which New York State closed on Sunday.

Silicon Valley Bank collapse will not trigger new financial crisis, insists Sunak (The Telegraph) Prime Minister says there is 'no systemic contagion risk' following banking failure

‘Banking system is safe’: Joe Biden reassures markets in address on Silicon Valley Bank collapse – live updates (the Guardian) Failure of bank last weak sparked fears of financial crisis, as US government announces plans to stabilize situation

Joint Statement by the Department of the Treasury, Federal Reserve, and FDIC (U.S. Department of the Treasury) The following statement was released by Secretary of the Treasury Janet L. Yellen, Federal Reserve Board Chair Jerome H. Powell, and FDIC Chairman Martin J. Gruenberg: Today we are taking decisive actions to protect the U.S. economy by strengthening public confidence in our banking system. This step will ensure that the U.S. banking system continues to perform its vital roles of protecting deposits and providing access to credit to households and businesses in a manner that promotes strong and sustainable economic growth.

After SVB failure, US guarantees all deposits to stem fallout (Reuters) U.S. officials stepped in to stem financial fallout from the failure of tech startup-focused Silicon Valley Bank , saying that all customers will have access to their deposits starting on Monday.

Transcript: Treasury Secretary Janet Yellen on "Face the Nation," March 12, 2023 (CBS News) The following is a transcript of an interview with Treasury Secretary Janet Yellen that aired on "Face the Nation" on Sunday, March 12, 2023.

Statement on Silicon Valley Bank (Bank of England) The Bank of England (Bank), in consultation with the Prudential Regulation Authority (PRA), HM Treasury (HMT) and the Financial Conduct Authority (FCA), has taken the decision to sell Silicon Valley Bank UK Limited (‘SVBUK’), the UK subsidiary of the US bank, to HSBC UK Bank Plc (HSBC).

HSBC rescues British arm of stricken Silicon Valley Bank (Reuters) HSBC bought the UK arm of stricken Silicon Valley Bank for a symbolic one pound on Monday, rescuing a key lender for technology start-ups in Britain and helping curb the fallout from the biggest bank collapse since the financial crash.

World markets set for aftershocks as SVB collapse ripples out (Reuters) Markets were set for a bumpy ride this week as the fallout from collapsed startup-focused lender Silicon Valley Bank (SVB), the biggest U.S. bank failure since the 2008 financial crisis, coincides with key economic data and policy meetings.

Inside Silicon Valley Bank’s collapse as chief begged tech giants not to panic (The Telegraph) Customers scrambled to pull their deposits in a bank run that sent shockwaves around the world

SVB’s Failure Exposes Lurking Systemic Risk of Tech’s Money Machine (Bloomberg) Many private equity and venture capital firms found themselves facing the same counterparty risk, creating a frenetic weekend before federal intervention.

Explainer: What caused Silicon Valley Bank's failure? (Reuters) SVB Financial Group Inc's shutdown and takeover by banking regulators on Friday can be traced to the U.S. Federal Reserve raising interest rates and souring the risk appetite of investors.

SVB’s Valley of Death (Puck) Assessing the reality of an historic 48 hours on Wall Street.

SVB’s 44-Hour Collapse Was Rooted in Treasury Bets During Pandemic (Bloomberg) Largest bank failure since 2008 rooted in bad bets on rates. Leaders who recently showed confidence now seeking quick deal.

How Silicon Valley Turned on Silicon Valley Bank (Wall Street Journal) The fallout threatens to engulf the startup world—and has exposed a new set of vulnerabilities for the banking system.

Silicon Valley Bank Collapse Sets Off Blame Game in Tech Industry (New York Times) The implosion of the Silicon Valley bank led to finger-pointing, as executives and investors jumped on the crisis for their own messaging.

VC Firms Push for Relief to Avoid SVB-Linked Furloughs (The Information) The influential investors that back startups pushed for government action and took other emergency measures Sunday to avoid the growing threat of furloughs if startups with money tied up at Silicon Valley Bank can’t meet payroll this week. As the government auctioned Silicon Valley Bank’s ...

SVB Draws Support From More Than 100 Venture Firms, Investors (Bloomberg) General Catalyst, Sequoia, others call bank ‘trusted partner’. Investors are appealing for invervention to help startups.

Startups Seek to Raise Emergency Cash from VC Firms, Secondary Sales (The Information) As the weekend approached, startup founders with money stuck in Silicon Valley Bank rushed to sell secondary shares and enter financing deals to meet payroll and other needs, a sign of the desperate dash for funds set off by the abrupt collapse of the tech-centric bank. Many startup founders ...

Hundreds of startups face a crippling cash crunch and an 'extinction-level event' if no one buys Silicon Valley Bank by Monday (Business Insider) Startup accelerator Y Combinator's CEO Garry Tan said 30% of his companies that banked with SVB wouldn't be able to pay their staff in 30 days.

Silicon Valley Bank is shut down by regulators in biggest bank failure since global financial crisis (CNBC) The tech-focused bank was closed by regulators on Friday after attempts to raise more capital failed.

Silicon Valley Bank Closed by Regulators, FDIC Takes Control (Wall Street Journal) The tech-focused lender was seeking a buyer after scrapping a plan to shore up its finances through a capital raise.

FDIC Races to Return Some Uninsured SVB Deposits Monday (Bloomberg) Initial payout depends on efforts to sell assets over weekend. Figures floated behind scenes range from 30% to 50% or more.

FDIC Auction for Failed SVB Underway, Final Bids Due Sunday (Bloomberg) Final bids due, winner may only be known late Sunday. FDIC is racing to sell SVB assets before branches open Monday.

Bank of London submits proposal for SVB's UK arm (Reuters) Bank of London has tabled an offer to Silicon Valley Bank UK, SVB's subsidiary, the company said on Sunday, adding that it had sent the proposals to British authorities, including the Treasury and the Bank of England.

SVB UK holds $3 billion of venture capital-backed firms' funds, survey shows (Reuters) British start-ups backed by venture capital have around 2.5 billion pounds ($3 billion), largely in deposits, "locked" in Silicon Valley Bank's UK subsidiary, according to a weekend survey by an industry body seen by Reuters.

Regional Banks Are Most Likely to Prevail in SVB Sale Process, Sources Say (The Information) Regional banks are the likeliest bidders to prevail in the sale process for Silicon Valley Bank, people familiar with the matter said, as the Federal Deposit Insurance Corp. seeks a new buyer and sorts through the wreckage of the failed bank. The FDIC, which took over SVB on Friday, has sought ...

Exclusive: PNC, RBC interest in SVB cools as regulators seek bids (Reuters) The FDIC has been trying to find a buyer after taking control of the collapsed Bank on Friday so that corporate clients that had their money frozen can meet their payroll obligations. But a deal on a tight timeline has proven to be hard.

Treasury, regulators unveil rescue for bank depositors (POLITICO) The collapse of the bank, which was seized by FDIC last week, has heightened fears of instability at small and mid-sized financial institutions.

Silicon Valley Bank imploded in a single day. It could just be the tip of the iceberg. (Markets Insider) It turns out getting easy money at rock-bottom interest rates can come back to bite you if you're careless. More firms are about to find that out.

3 Lessons From Silicon Valley Bank’s Failure (New York Times) Here’s one takeaway: The bank’s extremely online clientele may have contributed to its downfall.

SVB collapse to test Fed's faith in a strong, low-risk financial system (Reuters) Earlier this month the U.S. Federal Reserve in a report to Congress gave what has become a standard reassurance: Banks were strong and the overall financial system in solid shape.

US Discusses Fund to Backstop Deposits If More Banks Fail (Bloomberg) FDIC, Fed weigh special vehicle after SVB swiftly collapses. Regulators are racing to stem the fallout for other banks.

Silicon Valley Bank’s Swoon Should Really Scare Us (Bloomberg) The California-based lender to startups dropped 60% on Thursday, taking its far larger peers tumbling with it.

The Demise of Silicon Valley Bank (Net Interest) The Rapid Collapse of the 16th Largest Bank in America

SVB’s Auction Block Includes VC-Focused Lender, Wealth Unit (Bloomberg) FDIC seeks asset buyers as it looks to repay depositors. Failed lender’s startup client base may attract suitors.

Startup Bank Had a Startup Bank Run (Bloomberg) One problem for Silicon Valley Bank is that its customers had too much cash, and now they don’t.

Silicon Valley Bank CEO Tells VC Clients to ‘Stay Calm’ (The Information) Silicon Valley Bank CEO Greg Becker on Thursday told top venture capitalists in Silicon Valley to “stay calm” amid concerns around a capital crunch that wiped nearly $10 billion off the bank’s market valuation. On a call, Becker said that “calls started coming and started panic.”He added that ...

How founders are reacting to Silicon Valley Bank’s collapse (TechCrunch) What happened to SVB? The ripple effect of SVB’s downfall is reverberating throughout the tech and startup sectors.

Wall Street’s Favorite Trade Hammered in Bank Stock Meltdown (Bloomberg) Financial shares sink most since June 2020 amid rate concern. Bad news from SVB, Silvergate spills over to larger lenders.

Summers Sees No Systemic Risk From SVB If Depositors Protected (Bloomberg) Former Treasury chief sees ‘element of overreaction’ in stocks. Summers says ‘going to be issues’ for regulators to look at.

The Final Breaths of Silicon Valley Bank (The Information) Silicon Valley Bank wasn't just a bank—it was a central artery in the venture capital circulatory system. VC firms recruiting new partners would tell them SVB could set them up with a mortgage in a day. The bank wined and dined the industry in Napa. It sponsored numerous events across the ...

SVB’s Balance-Sheet Time Bomb Was ‘Sitting in Plain Sight,’ Short Seller Says (Bloomberg) Short seller Martin began tweeting about risks in January. Suspicions about loans drew him in; he found something else.

Startups and VCs Scramble to Pay Employees After SVB’s Collapse (The Information) The sudden collapse of Silicon Valley Bank sowed panic at hundreds of startups and venture capital firms that banked there and now must seek new ways to pay employees and access funds from their investors and customers. Founders and VC firms, which also kept billions of dollars worth of assets ...

Silicon Valley Bank Collapse Leaves Tech Industry Scrambling For Answers (Crunchbase News) The unraveling at Silicon Valley Bank will have far-reaching implications for U.S. venture-backed startups, half of which did business at the bank, and the broader tech ecosystem. We follow the unfolding story.

SVB Collapse Is 'Self-Inflicted Gunshot Wound' for Startups (Bank Info Security) One top venture capitalist says the sudden downfall of Silicon Valley Bank will make it harder for cybersecurity startups to get loans and credit lines. For

SVB Securities Management Exploring Buying Firm Back (Bloomberg) The managers of Silicon Valley Bank’s investment banking arm are exploring ways to buy the firm back from its parent, according to people familiar with the matter.

Silicon Valley Bank failure could wipe out 'a whole generation of startups' (NPR) The implosion of Silicon Valley Bank could force hundreds of tech startups to lay off workers or shut down completely. It remains unclear how much, if any, of depositors' money will be returned.

SVB CEO Becker addresses employees with 'heavy heart' in video (Reuters) Greg Becker, the chief executive of SVB Financial Group , sent a video message to employees acknowledging the "incredibly difficult" 48 hours leading up to the collapse of its Silicon Valley Bank on Friday.

Wall Street Firm Pounces on SVB Implosion With Offer to Buy Deposit Claims (The Information) At least one Wall Street firm is sensing an opportunity in the panic around failed Silicon Valley Bank. Traders from Jefferies are contacting startup founders with money stuck at the bank, offering to buy their deposit claims at a discount, according to several people with direct knowledge of ...

Circle’s USDC Stablecoin Breaks Peg With $3.3 Billion Stuck at Silicon Valley Bank (Wall Street Journal) Worried investors cashed out more than $2 billion worth of USD Coin, knocking the dollar-pegged token below 87 cents.

Briefing: Stablecoin Issuer Circle Reveals $3.3 Billion Exposure to Silicon Valley Bank (The Information) Circle, the issuer of USD Coin, said in a tweet Friday evening that $3.3 billion of its reserves backing the stablecoin were held in Silicon Valley Bank, the bank that regulators shut down earlier in the day. After Circle’s disclosure, the price of USD Coin, which is meant to stay pegged to the U.S. dollar, fell to a little under 92 cents before recovering to roughly 94 cents, according to

One of Crypto’s Last Safe Havens Is Spiraling After Silicon Valley Bank Implosion (The Information) Silicon Valley Bank’s collapse is sending shockwaves through a key piece of the crypto industry’s financial plumbing. The price of stablecoin USDC tumbled at one point lower than 88 cents Saturday morning, below its theoretical $1 peg, after its issuer, Circle, disclosed it has billions in cash ...

Briefing: Regulators Shut Signature Bank (The Information) The New York Department of Financial Services said Sunday evening it had taken possession of Signature Bank, marking the second downfall of a major crypto-focused bank over the past week. Signature had $110.36 billion in total assets and $88.59 billion in total deposits as of Dec. 31, the regulators said in a press release. All depositors will be made whole. Signature was one alternative to

Parsons Establishes Strategic Partnership with Microsoft, Accelerating the Digital Transformation of Global Infrastructure (Investors Observer) Parsons Establishes Strategic Partnership with Microsoft, Accelerating the Digital Transformation of Global Infrastructure

Cado Security raises $20 million to drive global expansion (Help Net Security) Cado Security raised $20M in funding from Eurazeo and Ten Eleven Ventures to accelerate the transformation of security operations.

Grip Security & The Syndicate Group (TSG) Announce Strategic Investment to Accelerate Channel-Led Growth (GlobeNewswire News Room) Grip Solutions Meet Critical Need for Channel Ecosystem to Manage SaaS Risk; TSG Expands Reach to 450+ Strategic Partners...

WSJ News Exclusive | Meta Plans New Layoffs That Could Match Last Year’s in Scope (Wall Street Journal) Meta Platforms is planning additional job cuts in multiple rounds over the coming months that in total would be roughly the same magnitude as the 13% reduction in its workforce last year.

Lloyd’s has a duty to lead in cyber: Patrick Tiernan (ReinsuranceNe.ws) Patrick Tiernan, Chief of Markets at Lloyd’s, says the insurance and reinsurance marketplace has a duty to provide leadership in the cyber market and

Here’s how we can collectively shrink the cybersecurity skills gap (CSO Online) While security breaches are rising across all industries, organizations are finding it difficult to attract and retain security professionals. Here are several ways we can collectively shrink the cybersecurity skills gap.

Radware Customers Provide Insightful Tips for Women Interested in a Cybersecurity Career (Radware Blog) Radware has the unique opportunity to work with many women in technology and cybersecurity. So, to celebrate International Women’s Day 2023, we turned to our customers — in this case, women — who continually provide us with interesting, insightful responses to questions we present to them.

NCC Group appoints new Global Capability Leader for Managed Services to help drive next chapter of strategy (Mynewsdesk) With a history of leading highly successful managed security services organisations at a global level, Doug Klotnia brings with him a wealth of industry...

Cybersecurity Technology Leader David Meltzer Joins Netography as Chief Product Officer (Business Wire) Company appoints new executive as it closes a year of record revenue and customer growth and kicks off a year of expanded innovation

Zscaler welcomes new global channel chief (Channel Asia) Zscaler has appointed Karl Soderlund as senior vice president of worldwide partners and alliances and will be responsible for “advancing and modernising” the vendor’s partner program.

Products, Services, and Solutions

New KnowBe4 SecurityCoach Integrates With SentinelOne's Singularity Platform (Yahoo Life) KnowBe4, the provider of the world's largest security awareness training and simulated phishing platform, today announced a new integration between KnowBe4's SecurityCoach and SentinelOne's Singularity Platform. Together, these offerings reduce risky behavior with extended protection, detection and response and real-time security coaching.

Avast Introduces Avast One Platinum (PR Newswire) Avast, a leading digital security and privacy brand of Gen™ (NASDAQ: GEN), today launched Avast One Platinum, the new premium tier of the...

ThreatBlockr and Engaged Security Partners help users prioritize breach prevention (Help Net Security) ThreatBlockr and Engaged Security Partners announced a partnership focusing on “left of boom” protection to bring enhanced breach prevention.

GrammaTech Makes Finding Vulnerabilities in Binaries Simpler (Security Boulevard) GrammaTech this week updated its CodeSentry software composition analysis (SCA) tool to make it simpler to identify specific types of vulnerabilities

SentinelOne Expands Singularity Marketplace with new SOAR, Insider Threat, Training, and Prioritization Integrations (SentinelOne) Joint Solutions with Revelstoke, Fletch, Code42, and KnowBe4 Address Diverse XDR Use Cases

ID-Pal expands into the United States with identity verification solution (News Direct) ID-Pal expands into the United States with identity verification solution

Technologies, Techniques, and Standards

Protecting collocated servers from DDoS attacks using GRE tunnels (BleepingComputer) You can get DDoS protection remotely for your collocated server using a generic routing encapsulation (GRE) tunnel. We will explain how GRE tunnels combined with Gcore scrubbing centers can help keep your data safe.

Beyond Cybersecurity: The Fundamentals of Federal System Resilience (Government CIO) Increased capacity for critical information requires efficient and secure maintenance of systems.

The Role of Cybersecurity in Building Trust with Customers and Investors (Entrepreneur) Unfortunately, many companies still treat cybersecurity as just another box to check. How can they leverage it to build trust instead?

Annoying Password Rules Actually Make Us Less Secure (Wall Street Journal) Forcing users to change their passwords, mandating special characters are outdated but persistent rules. “Some bits of old password wisdom have turned into a bit of a religion.”

After the LastPass Hack, Can You Trust Password Managers? (Wall Street Journal) Services such as 1Password, Dashlane and Bitwarden keep logins safe, but a strong master password is a must.

Hunting Emotet: How Behavioural Hunting Trumps IOC Detection Every Time (Cyborg Security) Hunting emotet, and other malware is increasingly challenging for organizations relying on IOCs. That is why we show a better way, behaviors!

Design and Innovation

Get Ready to Meet the ChatGPT Clones (WIRED) The technology behind OpenAI’s viral chatbot is set to become widely replicated, unleashing a tidal wave of bots.

Me, Myself, & A.I. (Puck) Billions of dollars are rushing into another high-tech hype cycle, this time around ChatGPT and other large language models. This time, it’s different.

Cyber teams trial ChatGPT as a security tool (CyberSecurity Connect) Cybersecurity companies have been testing the potential of OpenAI’s ChatGPT as a tool that benefits security teams and defenders. When everyone’s favourite AI ChatGPT launched back in November 20

Slovenian biometric identity card wins prestigious international award (Portal GOV.SI) This year's High Security Printing EMEA™ Conference is taking place in Abu Dhabi, United Arab Emirates, from 7 to 9 March 2023 and its award for the best ID card of the year was claimed by the Slovenian biometric identity card.

Legislation, Policy, and Regulation

WhatsApp Has Started a Fight With the UK About Encryption (WIRED) The head of the messaging app says a new law will undermine privacy. The government says it’s about protecting children.

Biden admin’s cloud security problem: ‘It could take down the internet like a stack of dominos’ (POLITICO) The Biden administration is embarking on the nation’s first comprehensive plan to regulate the security practices of cloud providers.

White House cybersecurity plan collides with SecOps reality (IT Operations | TechTarget) Beth Pariseau

FTC Warns to ‘Keep Your AI Claims in Check’ in New AI Guidance (cyber/data/privacy insights) On February 27, 2023, the US Federal Trade Commission (FTC) published new Business Blog guidance from Division of Advertising Practices staff about marketing claims for artificial intelligence products. While prior FTC AI guidance focused on the need to avoid using automated tools that have biased o

New DOD cyber workforce strategy aims to ease revolving door between government and industry (FedScoop) In a changing environment, officials want to adapt the personnel system to make it easier for people to enter government, leave for industry to gain additional experience and perspectives, and possibly come back.

US cyber strategy is missing accountability and a ransomware moonshot (The Hill) The National Cyber Strategy has articulated strong core objectives, but it also falls short.

New Mass. CIO names cyber, data, digital services as tech priorities (StateScoop) Jason Snyder, Massachusetts' new chief information officer, shared his technology priorities for the coming months.

Litigation, Investigation, and Law Enforcement

FBI Once Bought Mobile-Phone Data for Warrantless Tracking. Other Agencies Still Do. (Wall Street Journal) The FBI this week acknowledged having bought precise geolocation data derived from mobile-phone advertising in the past before backing away from the practice in the face of thorny legal issues and public controversy.

Internet Crime Report 2022 (IC3) Today’s cyber landscape has provided ample opportunities for criminals and adversaries to target U.S. networks, attack our critical infrastructure, hold our money and data for ransom, facilitate large-scale fraud schemes, and threaten our national security

Brazil seizing Flipper Zero shipments to prevent use in crime (BleepingComputer) The Brazilian National Telecommunications Agency is seizing incoming Flipper Zero purchases due to its alleged use in criminal activity, with purchasers stating that the government agency has rejected all attempts to certify the equipment.

Alleged seller of NetWire RAT arrested in Croatia (Help Net Security) Federal authorities successfully confiscated a domain utilized by cybercriminals to distribute the NetWire remote access trojan (RAT).

FBI and international cops catch a NetWire RAT (Register) Malware-seekers were diverted to the Feds, severing a Croatian connection

How the FBI proved a remote admin tool was actually malware (TechCrunch) The U.S. government seized a website used to sell malware. Here is how the FBI determined that the software sold on the site was malicious.

Blackbaud agrees to pay $3m to settle SEC ransomware probe (Register) File under cost of doing business

Will S.B.F. Cut a Deal? (Puck) A close reading of the latest developments and looming mysteries: Can S.B.F. flip on a politician? Is Ryan Salame the next FTX insider to plead guilty? What will happen to the parents, Barbara and Joe, and to the brother, G.B.F? And will the case even make it to trial?

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

(ISC)² Security Congress 2023 (Nashville (and virtual), Tennessee, USA, Oct 25 - 27, 2023) This year’s (ISC)² Security Congress theme, Lead with Confidence, champions the growth and vitality of cybersecurity professionals in every phase of their career through engaged learning that builds the competence and confidence to lead. The 13th annual (ISC)² Security Congress 2023 will bring together cybersecurity professionals from around the world for industry-leading education, compelling keynotes, exclusive networking, inside-track career resources, exhibitor showcases and much more, delivered all under one roof at the stunning Gaylord Opryland resort. From expert advice to industry insights, hear from the profession’s most knowledgeable speakers and participate in conversations about the hottest topics in cybersecurity.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Mar 13 - 17, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now.

Security & Policing (Farnborough, England, UK, Mar 14 - 16, 2023) Security & Policing, the official Government global security event, returns to the Farnborough International Exhibition and Conference Centre between 14-16 March 2023. Hosted by the Home Office’s Joint Security & Resilience Centre (JSaRC), Security & Policing offers a world‐class opportunity to meet and discuss the latest advances in delivering national security and resilience with leading UK suppliers, UK and overseas Government officials and senior decision makers across the law enforcement and security sectors. There is no general admittance to Security & Policing and all visitors and exhibitors are subject to Home Office approval.

GISEC Global (Dubai, UAE, Mar 14 - 16, 2023) With the ever-changing global landscape, it is increasingly essential to strengthen cybersecurity across industries. GISEC Global offers a platform for key industry leaders and names to come together in order to stay ahead of potential threats, discover innovative strategies and remain secure from major disruptions.

SINET– Silicon Valley 2023 (Mountain View, California, USA, Mar 16, 2023) SINET – Silicon Valley provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on identifying solutions to Cybersecurity challenges.

Solving Actionable Intelligence Through a Diverse Ecosystem (Virtual, Mar 16, 2023) How do we solve a “last mile” challenge concerning information sharing and threat intelligence without using an ineffective “one-size-fits-all” approach to an end user’s use case? Join Cyber Threat Alliance (CTA) President and CEO Michael Daniel and Fortinet Chief Security Strategist and Vice President of Global Threat Intelligence Derek Manky to learn how CTA’s diverse, ecosystem-first approach is the answer to building an effective digital ecosystem.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.