Mr. Baphomet's shop. New malware in SE Asia. Data theft extortion rising. A look at cyber readiness. Notes on the hybrid war.

Summary

By the CyberWire staff

At a glance.

BreachForums seems to be under new management.
Threat group with novel malware operates in Southeast Asia.
Data theft extortion on the rise.
Key findings of Cisco's Cybersecurity Readiness Index.
iPhones are no longer welcome in the Kremlin.
Russian cyber auxiliaries and privateers devote increased attention to the healthcare sector.

BreachForums seems to be under new management.

Following the arrest of alleged BreachForums proprietor Pompompurin (allegedly known as Conor Brian Fitzpatrick IRL) last week, another figure has stepped up to claim ownership of the criminal forum, the Record reports. The forum, well-known as a C2C souk where stolen data were traded, is presently still inaccessible, but one "Baphomet" says he'll be bringing it back online soon. “Although I had already suspected it to be the case, its now been confirmed that Pom has been arrested. I think it's safe to assume he won't be coming back, so I'll be taking ownership of the forum,” the record quotes Baphomet as saying. “I have most, if not all the access necessary to protect BF infrastructure and users.” If Mr. Baphomet is as good as his word (and whom can you trust, if you can't trust someone with a demonological nom-de-hack?) BreachForums will return shortly, staged in new infrastructure.

Doing Threat Intel is Really Difficult - Try a Managed Intel Service

Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.

Threat group with novel malware operates in Southeast Asia.

Developers of the SIESTAGRAPH malware family, REF2924, have been observed shifting their focus from data theft to persistent access, Elastic reported yesterday. A new executable, Wmdtc.exe, is written in C# and referred to as “NAPLISTENER.” The malware is said to evade “network-based forms of detection.” NAPLISTENER is capable of processing incoming Internet requests, reading submitted data, decoding data from base 64 format, and executing it in memory. Researchers shared that the REF2924 attacker is reliant on code from open sources and public repositories. The researchers share the abilities of the found sample, saying that “This unique malware sample contains a C# class called MsEXGHealthd that consists of three methods: Main, SetRespHeader, and Listener. This class establishes an HTTP request listener that can process incoming requests from the Internet, and respond accordingly by filtering malware commands and transparently passing along legitimate web traffic.”

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

Data theft extortion on the rise.

Palo Alto Networks’ Unit 42 has published its 2023 Ransomware Threat Report, finding that threat actors have significantly escalated their extortion tactics. By late 2022, threat actors were conducting data theft in 70% of ransomware attacks, compared to 40% in 2021. Additionally, the use of harassment as an extortion tactic rose from less than 1% in 2021 to 20% in 2022. Manufacturing organizations, particularly in the US, were the most frequent targets for extortion attacks last year. For more on the upward trend in data theft extortion, see CyberWire Pro.

Key findings of Cisco's Cybersecurity Readiness Index.

In its Cybersecurity Readiness Index, released today, Cisco sheds light on organizations’ ability to safeguarde against cyber threats. The results suggest that an alarming number of companies are not at a strong enough, level of protection against threats posited in cyber security today. The research found that only 15% of global organizations have what is defined as a “Mature” level of readiness, meaning that they have implementations in place that are strong enough to defend against current cyber threats. 82% of the survey’s respondents report expectations of a cybersecurity incident against their company in the next 1 to 2 years. Those surveyed also report bearing high costs due to underpreparedness, with 41% of organizations that reported an incident in the last year disclosing costs of at least $500,000. For more on Cisco's study, see CyberWire Pro.

iPhones are no longer welcome in the Kremlin.

Citing reports in the Russian media outlet Kommersant, the Register says that members of President Putin's staff have been told to get rid of their iPhones, replacing them with Android devices, or with phones using either Chinese operating systems or Russia's homegrown Aurora. The Daily Star says that the word around Moscow is that Apple products are particularly susceptible to monitoring by American intelligence services. Users have been told that, by the end of the month, they should either toss their iPhones or "give them to the kids."

Russian cyber auxiliaries and privateers devote increased attention to the healthcare sector.

A review in SC Media tracks the recent trend on the part of Russophone cyber threat actors to attack the healthcare sector in countries unsympathetic to Russia's invasion of Ukraine. Prominent among the groups making the attacks are two criminal ransomware gangs, LockBit and BlackBasta (this latter generally regarded as a rebranding of the nominally defunct Conti) and the hacktivist auxiliary KillNet. CISA and the FBI urge threatened organizations "to prioritize patch management or network segmentation of known, exploited vulnerabilities, in addition to training users how to recognize and report phishing attacks and enforcing 'phishing-resistant' multi-factor authentication."

The CyberWire's continuing coverage of Russia's war against Ukraine may be found here.

Notes.

Today's issue includes events affecting Australia, China, Ecuador, Germany, Greece, Iran, Ireland, Russia, Ukraine, the United Kingdom, and the United States.

Dateline Moscow and Kyiv: Summits, counteroffensives, and hacktivism.

Ukraine at D+390: Summits in Moscow and Kyiv. (CyberWire) Reports of Ukrainian drone strikes against Russian supply lines and minor advances around Bakhmut as China and Russia hold a summit in Moscow. The Kremlin doesn't want its staff using iPhones, and Russian privateers and auxiliaries continue to attack the healthcare sector.

Russia-Ukraine war: List of key events, day 391 (Al Jazeera) As the Russia-Ukraine war enters its 391st day, we take a look at the main developments.

Russia-Ukraine war live: Xi Jinping arrives at Kremlin for start of formal talks with Putin; Japan’s PM in Kyiv for surprise visit (the Guardian) Chinese and Russian anthems played before talks begin; Fumio Kishida to meet Volodymyr Zelenskiy

Watch: Ukraine counter-attack pushes Russian troops back from key Bakhmut supply line (The Telegraph) Kyiv’s forces have repelled Moscow’s army further away from the T0504 highway, dubbed ‘the highway of life’ for those in the besieged city

Ukraine says Russia Kalibr missile cargo hit in transit to Crimea (Al Jazeera) Ukraine says shipment of Russian Kalibr cruise missiles was destroyed in transit to the Black Sea Fleet in Crimea.

Watch: Putin heckled during Mariupol visit (The Telegraph) Television footage shows Russian president meeting supposedly grateful Ukrainians as a woman shouts: ‘It’s all lies’

Drone strikes, sabotage, shelling: Russia’s war on Ukraine comes to Russia (Washington Post) Three drones buzzed through the night sky on Feb. 27 over Belgorod, a Russian city just a couple dozen miles from the Ukrainian border. One drone smashed through the window of a sixth-floor apartment, startling a couple who were watching television. The other two crashed on nearby streets, denting parked cars and rattling the residents’ nerves.

Japan Prime Minister Fumio Kishida makes surprise visit to Ukraine (AP NEWS) KYIV, Ukraine (AP) — Japanese Prime Minister Fumio Kishida arrived in Kyiv for a surprise visit shortly after noon Tuesday, hours after Chinese President Xi Jinping arrived in neighboring Russia for a three-day trip.

Japan PM Fumio Kishida visits Ukraine for talks with Zelenskyy (Nikkei Asia) Trip demonstrates commitment to war-torn country, foreign ministry says

Putin sticks to protocol during Chinese leader Xi's visit (AP NEWS) President Vladimir Putin wasn't waiting at the end of the red carpet to greet Chinese leader Xi Jinping upon his arrival in Russia on Monday for a high-profile visit .

Xi makes first trip to Russia since Ukraine invasion (Nikkei Asia) China embraces international mediator role with eye on U.S.

Xi and Putin open talks in Russia, trading compliments, amid war in Ukraine (Washington Post) Chinese leader Xi Jinping arrived in Russia on Monday for a much-anticipated three-day state visit, taking a joint stand with President Vladimir Putin against the West even as the Russian leader stands accused by the International Criminal Court of war crimes in Ukraine.

Envy, high praise and an awkward gaff as Putin meets Xi for talks (The Telegraph) Two leaders greeted one another as ‘dear friends’ as the Chinese president arrived in Moscow on Monday for three days of talks

Why Xi can't solve Putin's Ukraine problem (The Telegraph) Chinese president could have profound influence but questions remain about whether he can, or wants to, end the war

The Limits of the No-Limits Partnership (Foreign Affairs) China and Russia can’t be split, but they can be thwarted.

Ukraine-Russia war latest: World should not be fooled by China's 'peace' plan says US (The Telegraph) US Secretary of State Antony Blinken has voiced scepticism over Chinese President Xi Jinping's "peace" proposals in Moscow, warning they could be a "stalling tactic" to help Russia on the ground in Ukraine.

Zelensky Has an Answer for DeSantis (The Atlantic) In an interview, the Ukrainian president makes a pragmatic case for continued American support.

EU agrees to send Ukraine one million artillery shells (Al Jazeera) EU defence and foreign ministers backed an initiative aimed at providing Ukraine with one million artillery shells.

US sending ammunition, tanker trucks, boats to Ukraine (C4ISRNet) Latest package includes large amounts of ammunition, such as rockets for the High Mobility Artillery Rocket Systems, fuel tanker trucks and riverine boats.

DOD Announces Additional Security Assistance for Ukraine (U.S. Department of Defense) The Defense Department announced the authorization of a Presidential Drawdown of security assistance to meet Ukraine's critical security and defense needs.

Memorandum on Delegation of Authority Under Section 506(a)(1) of the Foreign Assistance Act of 1961 | The White House (The White House) Delegation of Authority Under Section 506(a)(1) of the Foreign Assistance Act of 1961 By the authority vested in me as President by the Constitution and the laws of the United States of America, including section 621 of the Foreign Assistance Act of 1961 (FAA), I hereby delegate to the…

Russia opens criminal case against ICC after Putin arrest warrant (Al Jazeera) Russia says the ICC has knowingly accused an innocent person of a crime, in another show of defiance against the court.

Russia to Hold UN Meeting on Ukraine Kids Taken to Russia (Military.com) Russia plans to hold an informal meeting of the U.N. Security Council in early April on what it says is “the real situation” of Ukrainian children taken to Russia.

Team Putin Melts Down Over International Arrest Warrant (The Daily Beast) The Kremlin’s propagandists say Vladimir Putin is being mistreated by the legal system just like Donald Trump.

Putin to staffers: throw out your iPhones over security (Register) April Fools should use Russian or Chinese tech instead Kermlin advises

Сотрудникам администрации президента рекомендовали отказаться от iPhone к апрелю (Коммерсантъ) Подробнее на сайте

Paranoid Putin bans Kremlin staff from using iPhones over US spying fears (Daily Star) Russian Government sources claim Apple's phone – used by some 1.5 billion people worldwide – is 'more susceptible to hacking and espionage by Western experts' than its rivals

Russian meddling in media space, efforts to undermine Europe’s cybersecurity (Ukrinform) Bots, coordinated inauthentic behavior originating from Russia, espionage attempts by Russian hackers targeting Ukraine’s allies, cyberattacks, and mass creation of resources with the sole aim of spreading disinformation— Russia resorts to any means to penetrate Europe’s information space. — Ukrinform.

2022 Report on EEAS Activities to Counter FIMI (EEAS) The EEAS has a specific team working on the challenge of Foreign Information Manipulation and Interference, including disinformation. Following the Activity

Black Basta, Killnet, LockBit groups targeting healthcare in force (SC Media) Federal agencies, along with Microsoft, detail three threats facing critical infrastructure entities like healthcare: Black Basta, Killnet and LockBit.

Russia can't match the US military's hardware, but it has other ways to keep it from working properly (Business Insider) Lots of Russian military hardware has been lost or destroyed in Ukraine, but Moscow has other, unconventional tools to bring to bear against the US.

Information Environment: Opportunities and Threats to DOD's National Security Mission (Government Accountability Office) To offset U.S. conventional warfighting advantages, opponents try to use the information environment, including information technology and social...

Online Sleuths Untangle the Mystery of the Nord Stream Sabotage (WIRED) Open source intelligence researchers are verifying and debunking opaque claims about who ruptured the gas pipelines in the Baltic Sea.

Attacks, Threats, and Vulnerabilities

Journalist opens USB letter bomb in newsroom (BBC News) The Ecuadorean government has condemned the attack after journalists nationwide were targeted.

After BreachForums arrest, new site administrator says the platform will live on (Record) A new administrator has stepped up to take over BreachForums — a popular cybercriminal platform whose alleged owner was arrested last week by the FBI.

The Scorched-Earth Tactics of Iran’s Cyber Army (WIRED) Amid ongoing protests, the Iranian regime has lost control of its image, pushing it to employ increasingly drastic tactics where everyone loses.

Google suspends top Chinese shopping app Pinduoduo (Register) Alleges it’s infected with malware – but not the version in its own digital tat bazaar

Google Suspends Pinduoduo After Finding Malware in Versions (Yahoo Finance) Google has suspended PDD Holdings Inc.’s main Chinese shopping app Pinduoduo after discovering malware in unsanctioned versions of the software, dealing a blow to one of the country’s biggest online retailers.

NAPLISTENER: more bad dreams from developers of SIESTAGRAPH (Elastic Blog) Elastic Security Labs observes that the threat behind SIESTAGRAPH has shifted priorities from data theft to persistent access, deploying new malware like NAPLISTENER to evade detection.

Threat actors are experimenting with QR codes (Help Net Security) QR scan scams trick users into scanning QR codes from their PCs using their mobile devices to take advantage of weaker phishing protection.

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule (Security Intelligence) Explore opportunities for detection of the FudModule within a Lazarus malware sample analyzed by IBM Security X-Force.

Mirai Hackers Use Golang to Create a Bigger, Badder DDoS Botnet (Dark Reading) With HinataBot, malware authors have created a beast many times more efficient than even the scariest botnets of old, packing more than 3Tbit/s DDoS speeds.

Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm (SecurityWeek) Hitachi Energy blames data breach affecting employees on the recent exploitation of a zero-day vulnerability in Fortra’s GoAnywhere solution.

Millions Stolen in Hack at Cryptocurrency ATM Manufacturer General Bytes (SecurityWeek) Cryptocurrency ATM maker General Bytes discloses a security incident resulting in the theft of millions of dollars’ worth of crypto-coins.

Bitcoin ATM customers hacked by video upload that was actually an app (Naked Security) As the misquote goes, “Once is misfortune…” This is the second time, and you know what Lady Bracknell had to say about that…

Ferrari discloses data breach after receiving ransom demand (BleepingComputer) Ferrari has disclosed a data breach following a ransom demand received after attackers gained access to some of the company's IT systems.

Ferrari says ransomware attack exposed customers' personal data (TechCrunch) Italian supercar manufacturer Ferrari said customers’ personal information was compromised in a ransomware attack.

Latitude Financial to cover the cost of replacing 330,000 people's stolen identification following cyber attack (Stuff) Finance company Latitude Financial says it will cover the cost of replacing identification documents following a cyber attack that breached the privacy of 330,000 customers.

Oakland mayor says 'up to 1 month' until city systems are back online following ransomware attack (ABC7 San Francisco) "We are optimistic we can get there in the next few weeks, or maybe the next month," Mayor Thao said.

NBA alerts fans after hack of third-party service provider (Record) The National Basketball League says "copies of names and email addresses of some NBA fans were captured" when one of its service providers was hacked.

Senators Warn the Next US Bank Run Could Be Rigged (WIRED) Lawmakers call for an investigation into the SVB collapse, fearing hostile foreign governments will use social media to manipulate markets.

Visa's Spring 2023 Biannual Threats Report (LinkedIn) Today, my colleagues throughout the risk organization here at Visa and I are proud to publish the Spring 2023 Biannual Threats Report, highlighting the emerging themes of evolving cybercrimes. While the full report is worth the read, the below themes are what I think are the most pressing for cybers

Move, Patch, Get Out the Way: 2022 Zero-Day Exploitation Continues at an Elevated Pace (Mandiant) In this post we share insights from Mandiant's analysis of 2022 zero-day exploitation.

Chinese-linked hackers deployed the most zero-day vulnerabilities in 2022, researchers say (CyberScoop) The overall number of zero-day vulnerabilities discovered in the wild last year declined compared to numbers in 2021.

Why You Should Opt Out of Sharing Data With Your Mobile Provider (KrebsOnSecurity) A new breach involving data from nine million AT&T customers is a fresh reminder that your mobile provider likely collects and shares a great deal of information about where you go and what you do with your mobile device --…

Trends

Credit ratings increasingly looking at cybersecurity (Washington Post) U.S. companies face a wide array of issues potentially impacting their ability to borrow money. In recent months, a banking crisis and high interest rates have stretched some companies thin, leading to layoffs and decreases in spending.

Why are cyber premiums 'going gangbusters'? (Computing) Five years ago carriers thought of cyber insurance as “stealing candy from babies” - but they were totally unprepared for how the market has changed.

New Research Confirms Machine Identity Management Remains Problematic for 60% of Enterprises; Identity Threat Surface Continues to Expand (Business Wire) Security professionals hyper-focused on reducing complexity of PKI infrastructure to combat IAM woes, embrace zero trust, and prepare for post-quantum world

Data Deluge: Businesses Struggle With TMI (Wall Street Journal) The cloud helped open the floodgates on data collection. Now, IT departments are racing to make it usable for AI. ‘In some instances, it is overwhelming,’ one CIO says of the sheer amount of data.

Cisco Cybersecurity Readiness Index (Cisco) Cisco’s first-ever Cybersecurity Readiness Index measures the readiness of companies to maintain cybersecurity resilience against modern threats.

Another cybersecurity wake-up call: Cisco Cybersecurity Readiness Index (Cisco) A look at how organizations are safeguarding against complex threats in a hybrid world

Cisco Cybersecurity Readiness Index: Resilience in a Hybrid World (Cisco) In a post COVID world, the requirements of cybersecurity have changed as the landscape for businesses has been spun on its head. Organizations have moved from an operating model that was largely static – where people operated from single devices from one location, connecting to a static network – to a hybrid world in which we increasingly operate from multiple devices in multiple locations, connecting to multiple networks.

Geopolitical Tensions Enabled Increased Hacktivist Cyber Threats in 2022 (FS-ISAC) New Navigating Cyber 2023 report from FS-ISAC highlights opportunity for cyberattacks against public and private institutions

Navigating Cyber 2023 (FS-ISAC) FS-ISAC releases its annual report on cyber threats in 2022 and predictions for 2023 and beyond.

Marketplace

Interactive acquires Slipstream Cyber Security (influencing) Interactive is pleased to announce its acquisition of Slipstream Cyber Security.  The acquisition strengthens Interactive's position in the market as a cyber security leader set on demystifying the cyber landscape and significantly improving

Cybersecurity Startup Aembit Launches With $16.6M in Total Funding to Bring Identity-First Security to Workloads (PR Newswire) Aembit, the identity platform that lets DevOps and Security teams discover, manage, enforce, and audit access between federated workloads,...

Security Industry Veterans Launch Oleria Out of Stealth Mode with $8M Seed Funding (Oleria) Oleria, a security company that sets businesses free with adaptive and autonomous access solutions, today announced its emergence from stealth mode and $8 million in seed funding. The funding round was led by Salesforce Ventures, with participation from Tapestry VC and angel investors including CEOs and CISOs of prominent tech and security companies.

Attack Surface Management Leader Cyberpion Rebrands as IONIX (PR Newswire) Cyberpion, the leader in Attack Surface Management, has rebranded as IONIX (pronounced 'eye on x'). IONIX helps customers keep an 'eye on x,'...

NormCyber doubles its footprint amid strong growth (Norm) NormCyber has announced it has doubled its office footprint in preparation for the doubling of its headcount by the end of 2023.

Data Theorem Recognized as a Representative Vendor in 2023 Gartner Market Guide for Cloud-Native Application Protection Platforms Report (Business Wire) CNAPPs Address Full Life Cycle Protection Requirements of Cloud-Native Applications from Development to Production

Amazon to lay off 9,000 more workers in addition to earlier cuts (CNBC) Amazon will lay off 9,000 more employees, CEO Andy Jassy said in a memo to staff Monday.

What three years of US sanctions did to Huawei (Tech Wire Asia) Since the US sanctions, Huawei has replaced more than 13,000 components in its range of products and redesigned over 4,000 circuit boards.

The TikTok Investors With the Most to Lose From a U.S. Ban (The Information) For venture investors that have collectively invested more than $8 billion in TikTok’s parent company, ByteDance, the fate of the video app in the U.S., where officials are seeking changes to its ownership, could mean the difference between a huge portfolio win and a soul-crushing loss. Early ...

Cohesity Appoints Seasoned Enterprise Sales and Field Operations Leader Kit Beall as Chief Revenue Officer (Business Wire) Former VMware, Cisco, and Uhana Executive Brings Decades of Sales, Customer, and Business Development Experience to Cohesity

Products, Services, and Solutions

Presidio Expands VMware Practice to Accelerate Cloud Benefits for Customers (Business Wire) Company Achieves new Top Tier Pinnacle Partner status in VMware Partner Connect Program

New KnowBe4 SecurityCoach Integrates With Cloudflare’s Cloud Email Security (KnowBe4) New KnowBe4 SecurityCoach Integrates With Cloudflare’s Cloud Email Security

Waterfall Security, TXOne Networks Launch New OT Security Appliances (SecurityWeek) Waterfall Security Solutions and TXOne Networks have each announced launching new OT security appliances.

SailPoint Delivers New Non-Employee Risk Management Solution to Market (Business Wire) Company quickly delivers on SecZetta acquisition to bring new value to customers worldwide

Is Your Agency Just One Click Away from a Data Breach? (GovTech) HP Sure Click Enterprise isolates and protects government agencies from undetectable threats.

Reflectiz Announces Partnership with PCI Council to Continuously Secure Global Payment Data (Yahoo Finance) As The Council’s Newest Associate Participating Organization, Reflectiz to Contribute to The Development of PCI Security Standards

Sophos Partners with Cowbell to Provide Businesses with Easier Access to Cyber Insurance (GlobeNewswire News Room) Partnership Helps Organizations Apply for Cyber Insurance and Assess Security Health for Insurability...

Cyral Converges DAM, PAM, DLP and DSPM Into a Single Solution (GlobeNewswire News Room) Industry first data security governance platform reduces risk, complexity and cost for databases and data lakes across every cloud...

Splunk Delivers Unified Security and Observability Solutions to Build Digital Resilience (Business Wire) Innovations include the enhancements to Splunk Mission Control and Splunk Observability Cloud; general availability of Splunk Edge Processor

Industry Leaders Collaborate on New Cybersecurity Offering (PR Newswire) Cyberattacks often begin with an unsuspecting user clicking on a link that redirects them to a harmful site containing malware. Even the best...

Genetec authorized by the CVE Program as a CVE Numbering Authority (CNA) (GlobeNewswire News Room) Company brings its cybersecurity expertise to international CVE Program...

Denuvo unveils Unbotify technology for bot detection (GlobeNewswire News Room) Denuvo Unbotify delivers the next level of hardware cheat and fraud detection through behavioral biometrics analysis, leaving bots with no place to hide....

Technologies, Techniques, and Standards

Active Cyber Risk Modeling: a new approach to aggregate risk (Coalition) Cyber risk is insurable with the correct data and approach. Our Active Cyber Risk Model underscores how shared technology fuels cyber risk aggregation.

U.S. Payments Forum Unveils First-of-its-Kind Comprehensive Resource on Authentication Techniques for Remote and In-App Payments (GlobeNewswire News Room) The white paper includes use cases, implementation considerations for 19 authentication techniques...

Design and Innovation

Language models might be able to self-correct biases—if you ask them (MIT Technology Review) A study from AI lab Anthropic shows how simple natural-language instructions can steer large language models to produce less toxic content.

Legislation, Policy, and Regulation

Millions in Punjab still without mobile internet as shutdown extended to fourth day (Record) As Indian authorities search for the leader of a Sikh separatist movement, the mobile internet in the state of Punjab has been shut down.

European Ports Brace for Cybersecurity Regulation (Wall Street Journal) A law taking effect in 2024 will require hundreds of companies at ports and in critical sectors to comply with cybersecurity rules for the first time.

Data breaches are increasing at a rapid speed. Here’s what can be done (World Economic Forum) Cybersecurity discussions have had an acute focus on modes of attack, missing how individuals are impacted by data breaches and how they can be protected.

McKinsey behind govt's new cyber strategy (InnovationAus.com) Controversial global consulting giant McKinsey will have a key role in the development of Australia’s cybersecurity strategy, 18 months after the government was widely criticised for using the company to develop its net zero strategy. McKinsey will be paid nearly $1 million for less than two month’s support work on the new cyber strategy being developed by the Albanese government, with the contract set to end just weeks out from the May budget. The Department of Home Affairs awarded McKinsey a one-and-a-half month, $950,000 contract for “project management” early this month after approaching just two other suppliers put of more than 400 pre-approved suppliers.

SEC issues new cybersecurity requirements for risk management (Security Magazine) The SEC has issued new cybersecurity risk management requirements. The requirements will apply to sectors collectively labeled as Market Entities.

SEC Proposes Rash of New Rules on Cybersecurity (Privacy) | Lowenstein Sandler LLP (Lowenstein Sandler) In its efforts to address cybersecurity risks, the U.S. Securities and Exchange Commission (“SEC”) continues to propose rules on cybersecurity. Most recently, on March 15, 2023, the SEC announced its proposal of three cybersecurity measures intended to expand existing rules and create new ones. This announcement amplifies the business and legal communities’ anticipation of the SEC’s expected release of new rules in April 2023.

Director Easterly Announces New Members to Join CISA's Cybersecurity Advisory Committee (Cybersecurity and Infrastructure Security Agency) Today, the Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly announced the appointment of additional members to the CISA Cybersecurity Advisory Committee (CSAC), bringing onboard additional experts from the public and private sectors who will advise the Director on policies and initiatives to enhance the nation's cyber defense.

CISA Advisory Committee Adds Inglis, Katko, Langevin (Meritalk) Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly today announced the appointment of new members to the CISA Cybersecurity Advisory Committee (CSAC), who will help advise her on policies and initiatives to bolster the nation’s cybersecurity posture.

Litigation, Investigation, and Law Enforcement

Facebook political microtargeting at center of GDPR complaints in Germany (TechCrunch) European privacy rights campaign group noyb has used data donated by users of the 'Who Targets me' browser extension to build a case against every political party in Germany -- alleging unlawful microtargeting of voters.

Ex-Meta security staffer sues Greece for spying on her phone (Register) Beware of Greeks bearing GIFs

Meta executive targeted by 'Predator' spyware, report (Computing) It remains unclear as to why Seaford was targeted for surveillance

Bank of Ireland fined €750k for data breaches (RTE.ie) Bank of Ireland has been fined €750,000 by the Data Protection Commission (DPC) following an investigation into 10 data breaches involving the bank's Banking 365 system.

Wawa to pay up to $28.5M in data breach settlement (Cybersecurity Dive) The chain’s latest payout will go to the financial institutions involved in the 2019 incident, continuing a series of payments it has made to customers and states over the past year.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

NVIDIA GTC Conference (Virtual, Mar 20 - 23, 2023) Join us at the NVIDIA GTC Conference to learn how organizations are using the NVIDIA AI platform to more quickly build and deploy AI-based cybersecurity solutions to achieve threat detection at scale.

Supply Chain & Third-Party Risk Summit (Virtual, Mar 22, 2023) The dramatic surge in open source software supply chain attacks has sent defenders scrambling to find mitigations and solutions. At the highest highest levels of the U.S. government, mandatory guidance is being established to secure code dependencies and security gaps in software used in the most critical projects. Join us as we bring together security experts to discuss the biggest software supply chain hacks, the complex nature of the problem, best practices for mitigating security issues, and the frameworks and specifications currently available.

Election Threats: Past, Present, & Future (Virtual, Apr 19, 2023) Join us virtually on April 19th from 12:00 PM - 1:00 PM. Experts will explore both historical and current domestic threats to our election security: Michael Chertoff, Co-Founder and Executive Chairman, The Chertoff Group; Mary McCord, Executive Director of the Institute for Constitutional Advocacy and Protection, Visiting Professor of Law at Georgetown University Law Center; and David Laufman, Partner, Wiggin and Dana LLP. Moderated by David Hickton, Founding Director, Pitt Cyber. Presented by Pitt Cyber, in partnership with The Azure Forum, CSIS, and Keep Our Republic.

Events

SGTech Week 2023 (Park Plaza Amsterdam Airport, Netherlands, Mar 20 - 24, 2023) The 4th annual SGTech Week 2023 brings together 150+ utility Substation, SCADA System, Utility Telecom and Cybersecurity colleagues, for a review of the latest smart grid implementation projects and innovation roadmaps. The week-long programme combines a series of Standardisation workshops, with C’level plenary sessions, techno-commercial case-study presentations, technology innovation panel debates, and intimate end-user roundtable discussions, to drive awareness of recent successes and setbacks as well as stimulate new ideas to drive the deployment of the smart grid further faster.

2023 Security Prediction & Trends for DevOps - not all CVEs are scary... (Virtual, Mar 21, 2023) Earlier this year, JFrog’s Security Research Team performed in-depth analysis of the top 10 most prevalent vulnerabilities in 2022 and found the severity rating of most CVEs were surprisingly OVERRATED. Why, you ask? Join us in this webinar and we will go deep into the data and show you why. Here’s a teaser on what you might learn: why 6 of the top 10 CVEs had a high CVSS score, but were LOW impact; of the top 50 CVEs, 64% were overrated; of the top 50 CVEs, 10% were underrated; vulnerabilities should be assessed by both real-world impact as well as how exploitable they are in your local environment; not just the severity score (which is important). If it takes 246 hours to remediate a security issue, companies can’t afford to just “fix everything.” In this webinar, we’ll discuss how organizations can make better decisions, get better processes and use better tools for their DevOps security initiatives in 2023.

Security First (London, England, UK, Mar 22, 2023) Security First returns to London in 2023! Join leading cybersecurity experts from across the community as we explore the latest threats and industry trends, and learn practical strategies to safeguard your organisation. Don't miss out - register today to reserve your spot.

The Personal Stories, Challenges, and Triumphs of Women in Cyber (Virtual, Mar 22, 2023) In this panel discussion hosted by Devo, leading women in cyber will come together to share their experiences, discuss challenges they’ve faced throughout their careers, and offer advice on how more women can flourish in cybersecurity. Register today!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.