SVB phishbait. An "attack superhighway." Unauthorized software. A new cyberespionage group. Hacktivists & gamers.

Summary

By the CyberWire staff

At a glance.

Expect phishing, BEC scams, and other social engineering to use SVB lures.
An "attack superhighway."
Unauthorized software in the workplace.
A new cyberespionage group emerges.
Squad up (but not IRL).
What are gangs paying cyber criminals, nowadays?

Expect phishing, BEC scams, and other social engineering to use SVB lures.

Security experts are warning that cybercriminals are gearing up to take advantage of the disruption surrounding the collapse and shutdown of Silicon Valley Bank (SVB). Johannes Ullrich from the SANS Institute is tracking a spike in newly registered SVB-related domains, including “login-svb[.]com,” “svbbailout[.]com,” “svbcertificates[.]com.” It’s not clear how many of these domains were created by scammers, but Ullrich expects to see business email compromise (BEC) attacks taking advantage of the situation for several reasons:

“It involves a lot of money
“Urgency: Many companies and individuals employed by companies have questions about how to pay urgent bills. Will my employer be able to make payroll? Is there anything I need to do right now?
“Uncertainty: For many, it isn't clear how to communicate with SVB, what website to use, or what emails to expect (or where they will come from?)”

For more on Silicon Valley Bank themed fraud, see CyberWire Pro.

Doing Threat Intel is Really Difficult - Try a Managed Intel Service

Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.

An "attack superhighway."

Akamai Technologies this morning released its State of the Internet report titled “Attack Superhighway: Analyzing Malicious Traffic in DNS,” detailing the global spread of malware. Researchers report that around 10-16% of organizations have shown potential signs of a breach last year. Key findings of the Akamai report include that 26% of affected devices “have attempted to reach out to known initial access brokers (IAB) C2 domains, including Emotet-related domains.” Attackers are also reportedly using the QSnatch botnet to abuse network-attached storage devices, with 36% of devices affected linked to QSnatch-affiliated C2 domains. The targeting by threat actors of home networks seeks out computers, cell phones, and Internet of Things (IoT) devices, as mobile malware and IoT botnets have been significantly observed. For more on the attack superhighway, see CyberWire Pro.

Predictive analytics to ensure your team passes the CISSP the first time.

Other CISSP certification training providers don't have a way to determine exam readiness until a practitioner passes (or fails) their certification exam. CyberVista's online CISSP course includes predictive analytics to show who is ready, who needs more time, and where to focus training. Through diagnostic exams, custom quizzes, a mock Computer Adaptive Test (CAT) Exam, and more, employers and practitioners alike feel confident in passing their CISSP the first time with CyberVista.

Unauthorized software in the workplace.

Devo Technology this morning released a study they commissioned from Wakefield Research detailing unauthorized use by security professionals of artificial intelligence (AI) tools. The study found that IT security professionals are increasingly dissatisfied with their company’s adoption of automation in Security Operation Centers (SOCs). 96% of IT security professionals admit to knowing that someone in their organization is using external, unauthorized AI tools, with a surprising 80% admitting to the use of these tools themselves, the researchers report. These pros report the use of these unauthorized AI tools because 96% report dissatisfaction with their organization’s implementation of automation in the SOC. 42% of respondents expressed concern over a limited scalability and flexibility currently within their organizations’ implemented solutions, while 39% reference financial issues, such as high costs. These unauthorized tools are reportedly appealing to respondents because of better user interfaces, more specializations, and more efficiency, with 47%, 46%, and 44% of those surveyed reporting these reasons, respectively. For more on unauthorized software in the workplace, see CyberWire Pro.

A new cyberespionage group emerges.

Researchers at Cisco Talos have identified a new threat actor, and a new cluster of activity, in Eastern Europe and the former Soviet Union. They're calling the group "YoroTrooper," and, while it appears to be a Russophone group, Cisco Talos thinks the evidence is too ambiguous for clear attribution. The threat actors, for example, may speak Russian, and there are "snippets of [the] Cyrillic [alphabet] in some of their implants," but this simply shows linguistic familiarity, and doesn't necessarily mean that they're either based in Russia or are Russian nationals. Some of the targets are also Russian-speakers, and the victimology for the most part consists of countries in the Commonwealth of Independent States, former Soviet Republics that remain on speaking terms with Russia. Attribution remains unclear, but the group will bear watching.

Squad up (but not IRL).

BleepingComputer reports that the Ukrainian game developer GSC Game World, whose STALKER 2: Heart of Chornobyl has been widely anticipated, has come under cyberattack by Russian hacktivists who claim to have stolen game-specific material (storylines, images, etc.) which they threaten to release unless their demands are met. The hacktivists, on the VK channel, write that they want GSC to change its attitude toward players from Belarus and Russia, lift the ban on a player ("NF Star") who's been booted from the game's Discord channel, and permit Russian localization for STALKER 2. In short, "Don’t ruin people’s enjoyment of the game due to politics." Games Industry reports that GSC Game World is hanging tough. "We have been enduring constant cyberattacks for more than a year now. We have faced blackmail, acts of aggression, hacks, attempts to hurt players and fans, and efforts to damage the development process or the reputation of our company," GSC says. "We are a Ukrainian company, and like most Ukrainians, we have experienced many things that are much more terrifying: destroyed houses, ruined lives, and the deaths of our loved ones. Attempts to blackmail or intimidate us are completely futile."

The CyberWire's continuing coverage of Russia's war against Ukraine may be found here.

What are gangs paying cyber criminals, nowadays?

IBM's Security Intelligence takes a quick look at the cyber underworld (and Kaspersky's January study of the same) and finds that the crminal labor market resembles the legitimate labor market in a number of respects. A criminal career can be well-compensated, with some gangs offering around $240 thousand a year to applicants looking for a career betraying trust, exploiting their fellow human beings, preying on the innocent and gullible, and so on. To get hired (not of course that you'd want to, but if you were conscienceless enough to apply), you have to pass certain screens: test assignments account for about 82% of the hiring decision, your CV and portfolio for 37%, and, finally, the interview counts for roughly 26%. Benefits often include flexible hours, the possibility of remote work, paid sick leave, and (our favorite) "a welcoming work environment." Pass, thanks.

Dateline Moscow and Kyiv: Fighting continues in Bakhmut.

Ukraine at D+383: Hacktists squad up. (CyberWire) The horror of continued close combat in Bakhmut eclipse cyberespionage and desultory hacktivism.

Russia-Ukraine war: List of key events, day 384 (Al Jazeera) As the Russia-Ukraine war enters its 384th day, we take a look at the main developments.

Russia-Ukraine war: strike on Kramatorsk kills at least one; Poland ‘could give Ukraine fighter jets in weeks’ – live (the Guardian) One killed and three injured in attack on city in Donetsk region; Polish PM says MiG jets could arrive in four to six weeks

Russian Advance Stalls in Ukraine's Bakhmut, Think Tank Says (Military.com) A leading think tank says Russia’s advance seems to have stalled in Moscow’s campaign to capture the eastern Ukrainian city of Bakhmut.

Partisans blow up key railway used by Putin’s forces (The Telegraph) Pro-Ukrainian guerrillas claim the strike will hinder the supply of Russian troops in the southern Kherson and Zaporizhzhia regions

Ukrainian and Russian casualties mount as battle for central Bakhmut rages (the Guardian) Ukrainian general says it is using opportunity to kill as many Russian troops as possible and wear down its reserves

Ukraine short of skilled troops and munitions as losses, pessimism grow (Washington Post) The quality of Ukraine’s military force, once considered a substantial advantage over Russia, has been degraded by a year of casualties that have taken many of the most experienced fighters off the battlefield, leading some Ukrainian officials to question Kyiv’s readiness to mount a much-anticipated spring offensive.

Why Russia Will Lose (CEPA) Russia’s aggression against Ukraine is the act of a country with the landmass of a giant but the industrial potential of a dwarf.

Russia’s Collapse: Ringside Seat (CEPA) Putin's centralized government in Russia has brought catastrophic economic, cultural, and environmental results, as well as a disastrous war.

Putin’s Paranoia and Moldova (CEPA) Russia is raising the pressure on Moldova. There are underlying shifts in the Moldovan and Russian outlook on negotiations about Transnistria.

How to Prepare for Peace Talks in Ukraine (Foreign Affairs) Ending a war requires thinking ahead.

‘Morality Shouldn’t Get in the Way’ — Russia’s Genocidal State Media (CEPA) It occasionally occurs to Putin’s mouthpieces that they may one-day face charges in a war crimes tribunal for Russian war crimes in Ukraine.

International Court to Open War Crimes Cases Against Russia, Officials Say (New York Times) The cases before the International Criminal Court would accuse Russia of abducting Ukrainian children and of deliberately targeting civilian infrastructure.

Russia says it does not recognise Hague court amid reports of arrest warrants (the Guardian) International criminal court prosecutor is said to be preparing to formally open two war crimes cases

The 4-metre-wide board detailing the entire Russian military chain of command in Ukraine (the Guardian) Chart used by Ukrainian prosecutors maps hundreds of Russian soldiers all the way up to Vladimir Putin

Italy claims Wagner mercenaries behind latest migrant wave (The Telegraph) Senior Italian politicians accuse the Russian unit of being behind a surge of refugees crossing the Mediterranean

Talos uncovers espionage campaigns targeting CIS countries, including embassies and EU health care agency (Cisco Talos Blog) Cisco Talos has identified a new espionage oriented threat actor, which we are naming “YoroTrooper,” targeting a multitude of entities in Europe and Turkey.

STALKER 2 game developer hacked by Russian hacktivists, data stolen (BleepingComputer) GSC Game World, the developer of the highly-anticipated 'STALKER 2: Heart of Chornobyl' game, warned their systems were breached, allowing threat actors to steal game assets during the attack.

GSC Game World suffers Stalker 2 leak after latest cyber attack (GamesIndustry.biz) Stalker developer GSC Game World has been the victim of "constant cyberattacks" over the past year, the studio said. In…

Attacks, Threats, and Vulnerabilities

Dark Pink APT group linked to new KamiKakaBot attacks in Southeast Asia (CSO Online) The latest APT cyberattacks on ASEAN countries use similar techniques as a previous Dark Pink KamiKakaBot campaign, including phishing.

Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects (The Hacker News) A malicious cyber operation has been redirecting visitors of thousands of websites aimed at East Asian audiences to adult-themed content.

Fake ChatGPT Chrome Extension Hijacking Facebook Accounts for Malicious Advertising (The Hacker News) A fake ChatGPT Chrome browser extension has been found to hijack Facebook accounts and create rogue admin accounts.

Warning: AI-generated YouTube Video Tutorials Spreading Infostealer Malware (The Hacker News) Threat actors have been using AI-generated YouTube Videos to spread stealer malware such as Raccoon, RedLine, and Vidar.

CatB Ransomware | File Locker Sharpens Its Claws to Steal Data with MSDTC Service DLL Hijacking (SentinelOne) CatB ransomware abuses MSDTC service for DLL hijacking and takes a swipe at victim's mail and browser data.

Shining a Light on Malware Beaconing (BlackBerry) Malware attacks come in many forms, from infostealers to ransomware. Despite their differences, many of these threats share similar tactics, and malware beaconing, which is extremely hard to detect, is one of those common threads.

Emotet Has Resumed Activity after a Three-Month Break (Gridinsoft Blogs) Experts noticed that this week Emotet resumed its activity and after a three-month "rest" began to send malicious spam again.

Ransomware Group Claims Hack of Amazon's Ring (Vice) The group is blackmailing Ring on its site: "There's always an option to let us leak your data," they posted.

InfoSec Handlers Diary Blog (SANS Internet Storm Center) Incoming Silicon Valley Bank Related Scams, Author: Johannes Ullrich

SYS01 stealer targets Facebook business accounts and browser credentials (TechRepublic) The SYS01 infection chain uses DLL sideloading to steal information. Learn how to protect your business from this cybersecurity threat.

Zoll Medical Data Breach Impacts 1 Million Individuals (SecurityWeek) Zoll Medical is notifying one million individuals that their personal information was compromised in a data breach earlier this year.

Death registry system in Hawaii had data breach, health department says (Record) Hawaii's Department of Health is notifying families that its Electronic Death Registry System was breached in January, but officials say the intruder wasn't able to create actual death certificates.

LA housing authority discloses data breach after ransomware attack (BleepingComputer) The Housing Authority of the City of Los Angeles (HACLA) is warning of a "data security event" after the LockBit ransomware gang targeted the organization and leaked data stolen in the attack.

Hospital in Brussels latest victim in spate of European healthcare cyberattacks (Record) Belgium's Centre Hospitalier Universitaire Saint-Pierre says it suffered a cyberattack but was prepared with an emergency plan to keep IT operations running.

Analysts tracking $197 million theft from DeFi lender Euler Finance (Record) Hackers reportedly stole $197 million in cryptocurrency from the decentralized finance (DeFi) platform Euler Finance in the latest flash loan attack to target the industry.

Hackers steal $197 million in crypto in Euler Finance attack (BleepingComputer) Lending protocol Euler Finance was hit by a cryptocurrency flash loan attack on Sunday, with the threat actor stealing $197 million in multiple digital assets.

Counting ICS Vulnerabilities: Examining Variations in Numbers Reported by Security Firms (SecurityWeek) Reports published by various industrial cybersecurity companies provide different numbers on ICS vulnerabilities — here’s why.

Threat Groups Offer $240k Salary to Tech Jobseekers (Security Intelligence) With the flood of laid-off tech workers scrambling to find work, threat groups are stepping up their recruitment efforts.

Security Patches, Mitigations, and Software Updates

OpenSea patches vulnerability that potentially exposed users’ identities (Cointelegraph) Cybersecurity firm Imperva detailed a now fixed vulnerability on OpenSea’s website that could have leaked potentially sensitive information about its users.

Trends

2023 Annual Identity Exposure Report (SpyCloud) Last year, more than half the credentials we recaptured from the darknet came from botnets, indicating a significant shift in the exposed credentials trend: threat actors continue to evolve beyond traditional account takeover tactics and are aggressively gaining entry with other forms of authentication data stolen straight from malware-infected devices.

Study Reveals 8 out 10 Security Professionals Use Unauthorized AI Tools In the Workplace (Devo.com) Read the results of a new survey commissioned by Devo that highlights how cybersecurity automation drives positive business outcomes.

Ransomware Attacks Have Entered a ‘Heinous’ New Phase (WIRED) With victims refusing to pay, cybercriminal gangs are now releasing stolen photos of cancer patients and sensitive student records.

The changing face of ransomware attacks (Panda Security Mediacenter) Ransomware attacks are becoming less common – and a lot more expensive

Brand Names in Finance, Telecom, Tech Lead Successful Phishing Lures (Dark Reading) AT&T, PayPal, and Microsoft top the list of domains that victims visit following a link in a phishing email, as firms fight to prevent fraud and credential harvesting.

A Face Recognition Site Crawled the Web for Dead People’s Photos (WIRED) PimEyes appears to have scraped a major ancestry website for photos, without permission. Experts fear they could be used to identify living relatives.

Young government workers show poor password management habits (Help Net Security) Only 27% of government workers feel fully ready to identify and report cybersecurity threats such as malware while working.

SpyCloud Report: Malware Infections the Most Prolific & Persistent Threat to Businesses (Business Wire) 721.5 million credentials exposed and over 22 million unique devices infected by malware in 2022 alone

Marketplace

Optiv More Than Doubles Federal Presence with ClearShark Acquisition (Optiv) Optiv, the cyber advisory and solutions leader, today announced it has acquired Maryland-based ClearShark LLC and ClearShark Services Inc. (collectively ClearShark), a premier advisor and top value-added reseller of cybersecurity and modernization technology to the United States federal government.

Osborne Clarke advises cybersecurity start-up Edgeless Systems on seed funding round (Osborne Clarke) Osborne Clarke has advised Bochum-based cybersecurity company Edgeless Systems on its recent EUR 5 million seed funding round.

How Biden saved Silicon Valley startups: Inside the 72 hours that transformed U.S. banking (POLITICO) A historic rescue of a distressed industry came together rapidly, reshaping the government’s relationship with banks in far-reaching ways.

After Bank Debacle, Silicon Valley Reckons With Its Image (New York Times) Even as start-ups and investors began recovering their money from Silicon Valley Bank, the episode exposed the tech industry’s vulnerabilities.

Silicon Valley Firms Gird for Change After U.S. Backing of SVB (Wall Street Journal) Startups and venture investors voice relief at federal decision to protect depositors, but see need for new banking practices.

After two historic US bank failures, here’s what comes next (AP NEWS) Two large banks that cater to the tech industry have collapsed after a bank run , government agencies are taking emergency measures to backstop the financial system, and President Joe Biden is reassuring Americans that the money they have in banks is safe.

Biden says 'the banking system is safe' after Silicon Valley Bank shutdown (NBC News) The president addressed the federal efforts to prevent economic ripples.

Bank shares sink as Joe Biden fails to reassure markets - latest updates (The Telegraph) Joe Biden said "Americans can have confidence that the banking system is safe" as small bank shares crashed as markets opened in the US.

UK channel breathes sigh of relief as Silicon Valley Bank 'bloodbath' averted (CRN) Collapsed bank is used by thousands of tech start-ups, including smaller vendors

Private Equity Giant Talks to VC Firms About SVB Bid (The Information) A large private equity firm has been talking to General Catalyst, Redpoint Ventures, Upfront Ventures and other venture capitalists as the PE firm considers bidding for part of the bank, according to four people with knowledge of the discussions. The identity of the private equity firm couldn’t ...

SVB Held Money for Nearly 1,000 Private Tech Investors (The Information) The failure of Silicon Valley Bank sent shockwaves through the tech financing universe. Roughly 1,000 firms, from big names such as Sequoia Capital, Andreessen Horowitz and Benchmark to key crypto and China tech investors, had disclosed that SVB was a custodian for their funds’ capital, ...

SVB’s Failure Means ‘Easiest Money’ for Startups Is Gone (The Information) After Chris Herndon raised $9 million from venture capitalists for his travel startup The Guild five years ago, he wanted to take out a loan to pad the firm’s finances. He went with Silicon Valley Bank over JPMorgan, which had more onerous lending terms. SVB also had a closer relationship with ...

SVB Meltdown: What It Means for Cybersecurity Startups' Access to Capital (Dark Reading) The implosion of Silicon Valley Bank will impact investors, startups, and enterprise customers as they become more cautious over the near term, security experts say.

The Silicon Valley Bank Contagion Is Just Beginning (WIRED) The collapse of SVB isn’t just a tech industry problem—as the rest of the world is about to find out.

The Fed’s tightening is a recipe for global volatility. Silicon Valley Bank’s collapse is just the start. (Atlantic Council) In this volatile environment, it may take less than a historic shock to cause severe disruption. Governments and central banks around the world better be prepared.

Crypto’s 24/7 Trading Disrupted By Bank Crisis (The Information) Crypto in many ways used to be a 24/7 market, but the escalating crisis among a set of small U.S. banks has upended that. Regulators’ abrupt closure Sunday of Signature Bank following Silvergate’s shuttering last week knocked out the two biggest crypto-friendly banks and also means the ...

Y Combinator to End Late-Stage Startup Fund, Lays Off Staff (The Information) Silicon Valley startup accelerator Y Combinator won’t raise another continuity fund, which backs mature private tech companies, two people familiar with the matter said. The partners who led the fund, AnuHariharan and Ali Rowghani, plan to leave the firm, the two people said. The pair plan to ...

Why CrowdStrike Stock Rallied on Monday (The Motley Fool) The endpoint security specialist's banking relationships were in focus this morning.

CrowdStrike’s SVB Credit Line ‘Remains Undrawn,’ Stock Price Climbs (CRN) CrowdStrike’s stock price climbed as the company said its credit line with Silicon Valley Bank (SVB) will not be needed.

Meta to Lay Off Another 10,000 Workers (New York Times) It would be the tech company’s second round of cuts since November. Mark Zuckerberg, its chief executive, has declared 2023 the “year of efficiency.”

Silobreaker named Most Innovative Security Company of the Year in the 19th Annual 2023 Globee® Cybersecurity Awards (Silobreaker) Silobreaker honoured as Gold Globee® Winner in the Best Security Companies Category for its ground-breaking threat intelligence solution Silobreaker, a leading security and threat intelligence firm, announced today that The Globee® Awards, organisers of the world’s premier business award programmes and business ranking lists, have named Silobreaker a winner in the 19th Annual 2023 Globee Cybersecurity...

CISA and Girl Scouts of the USA Strengthen Collaboration to Bring More Young Women into Cybersecurity (Cybersecurity and Infrastructure Security Agency) The Cybersecurity and Infrastructure Security Agency (CISA) and Girl Scouts of the USA (GSUSA) announced a new memorandum of understanding (MOU) today that formalizes the collaboration between the two organizations in their pursuit to bridge the gender gap in cybersecurity.

Code42 Appoints New Channel Leader to Drive ‘Channel-First’ Go-To-Market Strategy (Business Wire) Established SaaS executive Michael Guglielmi joins as Vice President of Channel Sales and Consulting Partners to lead Code42’s Accelerate channel partner program

Products, Services, and Solutions

Sophos improves cyberthreat defenses with endpoint security advancements (Help Net Security) Sophos endpoint security advancements improve protection and operational efficiency, as well as speed up detection and response.

Radware Introduces a Next-Gen Cloud Application Security Center in Israel (GlobeNewswire News Room) Continues to deliver on global cloud security service expansion strategy...

Datadobi Introduces StorageMAP - The Future of Unstructured Data Management (Datadobi) Announcing the launch of StorageMAP, a new solution that provides a single pane of glass for organizations to manage unstructured data across their complete data storage estate. Built upon Datadobi’s best-in-class vendor-neutral unstructured data mobility engine, the software enables enterprises to visualize, organize, and act on their data in hybrid vendor and cloud environments. StorageMAP puts companies in control of their data’s cost, carbon footprint, risk, and value.

Microchip Expands its Secure Authentication IC Portfolio (GlobeNewswire News Room) Six new security-focused products aim to optimize and scale embedded security across a wide range of industries including IoT, consumer, industrial and...

BIO-key and BeyondTrust Announce Integrated Partnership to Offer Identity-Bound Biometrics to Enhance Security for Privileged Remote Access (GlobeNewswire News Room) BIO-key International, Inc. (NASDAQ: BKYI) an innovative provider of Identity and Access Management (IAM)...

Mobile Operator 2degrees adopts BroadForward's Signaling Transfer Point (STP), Firewall and Mobile Number Portability solution (PR Newswire) Following the successful deployment of the BroadForward DRA, New Zealand operator 2Degrees has gone live with the BroadForward STP. Deployment...

Xage Security selected by Kinder Morgan to Cyber-Harden Critical Infrastructure (GlobeNewswire News Room) Xage Security teams up with one of the largest North American energy infrastructure companies to support cybersecurity resilience and digital...

AvePoint Adds New Solutions to its FedRAMP (moderate) Authorization (GlobeNewswire News Room) Demonstrating its commitment to security for public sector customers, AvePoint continues to assess its solutions against high security standards...

ShorePoint, Inc. Awarded Zero Trust Architecture BPA from the Department of Education (Business Wire) ShorePoint Inc., a cybersecurity services company that protects customers’ critical assets from cyber threats, announced that the Department of Education (ED) has awarded the company a single-award Blanket Purchase Agreement (BPA), with a base and 4 optional ordering periods, to provide Zero Trust Architecture (ZTA) Program and Enterprise Services.

CyberArk Workforce Password Management Delivers Advanced Protections for Enterprise Users (Business Wire) New Capabilities for Securing Access to High-Risk, High-Value Business Applications Help Organizations Improve Security and Reduce Risk

Viakoo and Presidio Announce Partnership to Deliver Best-in-Class IoT/OT Enterprise Security (PR Newswire) Viakoo, the leader in IoT/OT vulnerability remediation, today announced a partnership with Presidio, a global digital services and solutions...

ThreatBlockr Partners with the Retail and Hospitality Industry on the 2023 RH-ISAC Regional Workshop Series in Atlanta - ThreatBlockr (ThreatBlockr) ThreatBlockr provides the RH-ISAC with unique insights and an interactive threat briefing session for all attendees Tysons Corner, VA, March 14, 2023 – Today, ThreatBlockr, the autonomous cyber intelligence and active threat defense platform, is partnering with The Retail & Hospitality Information Sharing and Analysis Center (RH-ISAC) to sponsor the RH-ISAC Regional Workshop hosted by […]

Tanium Launches Certificate Manager and Expands XEM Platform with Enhanced Device and Policy Management (Tanium) Tanium today announced the release of its new certificate manager and enhanced policy management capabilities.

Semperis Joins Microsoft Intelligent Security Association, Expanding Collaboration to Combat Identity-Related Cyber Threats (Business Wire) Identity-first cybersecurity leader’s Directory Services Protector solution for Microsoft Sentinel, available in the Microsoft Azure Marketplace, provides seamless integration to bring critical cyber threats to the forefront in Sentinel views

Technologies, Techniques, and Standards

CISA Establishes Ransomware Vulnerability Warning Pilot Program (Cybersecurity and Infrastructure Security Agency) Recognizing the persistent threat posed by ransomware attacks to organizations of all sizes, the Cybersecurity and Infrastructure Security Agency (CISA) announces today the establishment of the Ransomware Vulnerability Warning Pilot (RVWP) as authorized by the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022.

CISA Announces Ransomware Vulnerability Warning Pilot (Cybersecurity and Infrastructure Security Agency CISA) Today, CISA is announcing the creation of the Ransomware Vulnerability Warning Pilot (RVWP).

CISA to warn critical infrastructure of ransomware-vulnerable devices (BleepingComputer) Today, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) announced a new pilot program designed to help critical infrastructure entities protect their information systems from ransomware attacks.

Resources | CISA (Cybersecurity and Infrastructure Security Agency CISA) Ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. Ransomware actors often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. In recent months, ransomware has dominated the headlines, but incidents among the Nation’s state, local, tribal, and territorial (SLTT) government entities and critical infrastructure organizations have been growing for years.

CSO vs. CISO: What’s the difference and does it matter? (Cybersecurity Dive) The person in charge of physical security used to monitor keys and supervise guards. Now, the physical and digital are colliding.

IRS plans to approve use of Login-dot-gov as Tax Day nears (FCW) The tax agency intends to add Login-dot-gov this filing season—and as early as next week—as the integration is in final rounds of testing.

The Ethical Use of Social Media in Mental Health (Psychology Today) Caution is necessary to ensure proper treatment.

Academia

The Cost of Unsafe Technology and What We Can Do About It | CISA (Cybersecurity and Infrastructure Security Agency CISA) Strong security should be a standard feature of virtually every technology product, and especially those that support the critical infrastructure that Americans rely on daily.

Shift to secure-by-design must start at university level, CISA director says (Cybersecurity Dive) Jen Easterly says secure coding and memory safety should be incorporated into computer science curriculum.

Legislation, Policy, and Regulation

National Protective Security Authority Begins Work (MI5) A new body has been created to help the UK combat national security threats.

Cyber Resilience Must Focus On Marginalized Individuals, Not Just Institutions (Carnegie Endowment for International Peace) Vulnerable or marginalized people in Africa depend on the digital economy to maintain their livelihoods and access critical services. Yet they could be driven from that economy if their cyber resilience isn’t strengthened.

UK launches new agency to tackle state-sponsored threats to business (Record) The new National Protective Security Authority (NPSA) will be part of the MI5, the U.K.'s domestic intelligence service.

MI5 to oversee new National Protective Security Authority (Computer Weekly) The new National Protective Security Authority will address various national security threats including state-sponsored cyber espionage against UK targets

The UK's bad encryption law can't withstand global contempt (Register) Any sufficiently stupid technology is indistinguishable from magical thinking

Building From the 2023 National Cybersecurity Strategy: Reshaping the Terrain of Cyberspace (Lawfare) If executed well, the strategy will serve as a strong pivot into a better vision for U.S. policy in cyberspace; if not, much of its promise will lack punch.

The Liberal Cyber Order (War on the Rocks) This month the Biden administration released its National Cybersecurity Strategy, ending months of speculation about its contents. The document focuses on

U.S. government provides cyber budget specifics (Washington Post) Biden administration proposes billions for federal cyber budget

White House proposes $74B topline for civilian agencies' IT in 2024 budget (FedScoop) The topline would constitute a nearly $9 billion and 13% increase over requested levels for fiscal 2023.

Cyber regulations can make our nation safer (The Hill) With the current cyber threat landscape growing in sophistication, scale, and impact, it’s clear that a voluntary approach is insufficient.

Biden Administration Plans for Sweeping Cybersecurity Regulation for Critical Infrastructure (Baker Botts) Cybersecurity Update

Pentagon seeks 21% boost in cyberspace spending (C4ISRNet) The fiscal 2024 budget blueprint arrives days after the Biden administration shared its latest national cybersecurity strategy.

US Navy wants $192 million for secretive Overmatch networking effort (C4ISRNet) Project Overmatch is the U.S. Navy’s contribution to Joint All-Domain Command and Control, the Pentagon's vision of seamless military connectivity.

Litigation, Investigation, and Law Enforcement

Pegasus affair shows Israel's judicial reform may violate privacy (The Jerusalem Post) “In my eyes, this is a clear example of how the lack of adequate legal support can lead to a violation of authority and a violation of rights,” said Deputy Attorney General Amit Merari.

UK Probing TikTok’s Ownership, Security Minister Tugendhat Says (Bloomberg) Concerns over whether social media app poses cyber risk. TikTok’s parent company ByteDance is based in Beijing.

House GOP launches investigation into DHS' domestic intelligence gathering (POLITICO) The probe comes after POLITICO reported last week that, under the Department of Homeland Security program, officials are collecting information by questioning people within the U.S.

A third former House GOP candidate alerted to unapproved military records request (POLITICO) Five Republicans have confirmed what the Air Force calls an unauthorized disclosure of personnel files. Colin Schmitt's case indicates that the pursuit of records extended to the Army National Guard.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Mar 13 - 17, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now.

Security & Policing (Farnborough, England, UK, Mar 14 - 16, 2023) Security & Policing, the official Government global security event, returns to the Farnborough International Exhibition and Conference Centre between 14-16 March 2023. Hosted by the Home Office’s Joint Security & Resilience Centre (JSaRC), Security & Policing offers a world‐class opportunity to meet and discuss the latest advances in delivering national security and resilience with leading UK suppliers, UK and overseas Government officials and senior decision makers across the law enforcement and security sectors. There is no general admittance to Security & Policing and all visitors and exhibitors are subject to Home Office approval.

GISEC Global (Dubai, UAE, Mar 14 - 16, 2023) With the ever-changing global landscape, it is increasingly essential to strengthen cybersecurity across industries. GISEC Global offers a platform for key industry leaders and names to come together in order to stay ahead of potential threats, discover innovative strategies and remain secure from major disruptions.

SINET– Silicon Valley 2023 (Mountain View, California, USA, Mar 16, 2023) SINET – Silicon Valley provides a venue where entrepreneurs can meet and interact directly with leaders of government, business and the investment community in an open, collaborative environment focused on identifying solutions to Cybersecurity challenges.

SGTech Week 2023 (Park Plaza Amsterdam Airport, Netherlands, Mar 20 - 24, 2023) The 4th annual SGTech Week 2023 brings together 150+ utility Substation, SCADA System, Utility Telecom and Cybersecurity colleagues, for a review of the latest smart grid implementation projects and innovation roadmaps. The week-long programme combines a series of Standardisation workshops, with C’level plenary sessions, techno-commercial case-study presentations, technology innovation panel debates, and intimate end-user roundtable discussions, to drive awareness of recent successes and setbacks as well as stimulate new ideas to drive the deployment of the smart grid further faster.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.