Notes from the underworld. Cyberespionage in occupied Ukraine? Russian patriotic hacktivism in DC? Guidelines from CISA & NSA.

Summary

By the CyberWire staff

At a glance.

Baphomet backs out.
Malware could detect sandbox emulations.
VEC supply chain attack.
Report: a new APT is active in Russian-occupied sections of Ukraine.
Someone claiming to be a Russian patriot claims responsibility for the D.C. Health Link attack.
CISA and NSA offer guidance on identity and access management (IAM).
CISA updates Cybersecurity Performance Goals.
CISA releases eight ICS advisories.

Baphomet backs out.

The Record reports that Baphomet has changed his mind about bringing back BreachForums. Baphomet posted yesterday, "This will be my final update on Breached, as I've decided to shut it down. I'm aware this news will not please anyone, but it's the only safe decision now that I've confirmed that the glowies [sic] likely have access to Poms [that is, Pompompurin's] machine." He added, "Any servers we use are never shared with anyone else, so someone would have to know the credentials to that server to be able to login. I now feel like I'm put into a position where nothing can be assumed safe, whether its our configs, source code, or information about our users the list is endless. This means that I can't confirm the forum is safe, which has been a major goal from the start of this sh*tshow." For more on the demise, resuscitation, and second demise of BreachForums, see CyberWire Pro.

Doing Threat Intel is Really Difficult - Try a Managed Intel Service

Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.

Malware could detect sandbox emulations.

Researchers at crypto wallet provider ZenGo discovered vulnerabilities in leading transaction simulation solutions. Transaction simulations are used to perform sandbox emulations to “evaluate the potential outcome of the intended transaction” before executing them, primarily to combat theft and scams. The researchers found that malware could detect that it was operating in a sandbox, and then “reveal its true malicious nature only when actually executed in a real environment.” The researchers dubbed this a “red pill attack,” since the malware knows it’s in a simulated environment. The researchers note that “all vendors were very receptive to our reports, and most of them were quick to fix their faulty implementations.” Some vendors, including Coinbase, awarded ZenGo with bug bounties. For more on transaction simulation exploits, see CyberWire Pro.

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

VEC supply chain attack.

Abnormal Security describes an attempted vendor email compromise attack (VEC) that tried to steal $36 million from a commercial real estate company. The attackers posed as a trusted contact at an insurance firm, sending the phishing emails from a domain that ended in “.cam” instead of “.com.” The phishing emails contained phony invoices:

“[T]he only piece of this email that was different from what the target would typically expect in an invoice was the wiring instructions, which directed the recipient to submit payment to a company called Forever Home Title in Tampa, Florida. Extremely close inspection of the wiring instructions show minor discrepancies, like the “Reference: Name,” instead of “Reference Name” and the missing state in the disclaimer text. But again, only someone who was expecting an attack would likely look for these minor issues.”

Report: a new APT is active in Russian-occupied sections of Ukraine.

Kaspersky reported yesterday that it had discovered a new advanced persistent threat (APT) operating against "government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions." The attacks begin with phishing emails whose payload is carried in malicious attached Word files that purport to be government documents. Once the phish hook is set, it installs the PowerMagic backdoor and then the CommonMagic framework. Kaspersky says the campaign is thus far unattributed. "So far, we have found no direct links between the samples and data used in this campaign and any previously known actors. However, the campaign is still active, and our investigation continues. So, we believe that further discoveries may reveal additional information about this malware and the threat actor behind it." The organizations, government and otherwise, that Kaspersky refers to in its report appear to be Russian occupation and separatist organizations, and thus the suggestion would be that the APT is acting either for Ukraine or at least against Russian interests, but Kaspersky (a Russian company) carefully avoids either claim. Circumstantially, the campaign's purpose seems to be cyberespionage.

Someone claiming to be a Russian patriot claims responsibility for the D.C. Health Link attack.

Make of it what you will, but someone using the nom-de-hack "Denfur" has claimed, to CyberScoop, that he is a Russian patriot who breached D.C. Health Link and obtained the personal data of many of the systems' users, including members of the US Congress. It was, Denfur said, “was an idea born out of Russian patriotism.” The self-proclaimed attacker said he breached the healthcare service by simple google-dorking, and not through any more exotic approach. When asked by CyberScoop to provide proof of Russian nationality, Denfur told the publication they'd simply have to take his word for it. CyberScoop is properly reticent in its story, and Denfur's claims should be at best regarded as not proven.

The CyberWire's continuing coverage of Russia's war against Ukraine may be found here.

CISA and NSA offer guidance on identity and access management (IAM).

On March 21st the US Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) released, as part of their Enduring Security Framework (ESF), Identity and Access Management Recommended Best Practices Guide for Administrators. The ESF's IAM best practices are organized into five categories:

"Identity Governance - policy-based centralized orchestration of user identity management and access control and helps support enterprise IT security and regulatory compliance;"
"Environmental Hardening - makes it harder for a bad actor to be successful in an attack;"
"Identity Federation and Single Sign-On – Identity federation across organizations addresses interoperability and partnership needs centrally. SSO allows centralized management of authentication and access thereby enabling better threat detection and response options;"
"Multi-Factor Authentication - uses more than one factor in the authentication process which makes it harder for a bad actor to gain access;"
"IAM Monitoring and Auditing - defines acceptable and expected behavior and then generates, collects, and analyzes logs to provide the best means to detect suspicious activity."

Each class of best practice is accompanied by an explanation of what it is, why it matters, and how it's implemented, with notes on the threat landscape interspersed in the discussion. An appendix to the document contains a checklist of actions organizations can take now. For more on NSA and CISA's recommended set of IAM best practices, see CyberWire Pro. And for a discussion of identity and access management, see CyberWire's Word Notes.

CISA updates Cybersecurity Performance Goals.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published an update to its Cybersecurity Performance Goals. These are cross-cutting goals intended to be applicable across all critical infrastructure sectors. "Originally released last October, the CPGs are voluntary practices that businesses and critical infrastructure owners can take to protect themselves against cyber threats. The CPGs have been reorganized, reordered and renumbered to align closely with NIST CSF functions (Identify, Protect, Detect, Respond, and Recover) to help organizations more easily use the CPGs to prioritize investments as part of a broader cybersecurity program built around the CSF."

CISA releases eight ICS advisories.

CISA, the US Cybersecurity and Infrastructure Security Agency, yesterday released eight Industrial Control Systems (ICS) advisories:

ICSA-23-080-01 Keysight N6854A Geolocation Server and N6841A RF Sensor
ICSA-23-080-02 Delta Electronics InfraSuite Device Master
ICSA-23-080-03 Siemens RUGGEDCOM APE1808 Product Family
ICSA-23-080-04 Siemens RADIUS Client of SIPROTEC 5 Devices
ICSA-23-080-05 VISAM VBASE Automation Base
ICSA-23-080-06 Rockwell Automation ThinManager
ICSA-23-080-07 Siemens SCALANCE Third-Party
ICSA-21-343-01 Hitachi Energy GMS600, PWC600, and Relion (Update A)

Dateline

Ukraine at D+391: Attribution ambiguity. (CyberWire) A new, unattributed APT seems active in Russian occupied territories. A Russian proposal for new cyberspace norms.

Russia-Ukraine war: List of key events, day 392 (Al Jazeera) As the Russia-Ukraine war enters its 392nd day, we take a look at the main developments.

Ukraine’s Leadership Doubles Down on Bakhmut Defense as Russians Get Closer (Wall Street Journal) Ukrainian commanders say they are sapping Russian strength in the eastern city to give their planned offensive a better chance of success.

Russian cruise missiles destroyed in drone strike on Crimea train (The Telegraph) Kyiv says Kalibr missiles being transported on a train in Dzhankoi were destroyed while Russia's region chief blames drone attack

Ukraine, Russia Trade Claims After Blast Rocks Crimean Town (Military.com) Russian and Ukrainian officials have given conflicting accounts of what appeared to be a brazen attack on Russian cruise missiles being transported by train in Moscow-annexed Crimea.

Japan Prime Minister Fumio Kishida makes surprise visit to Ukraine (AP NEWS) Japanese Prime Minister Fumio Kishida arrived in Kyiv for a surprise visit shortly after noon Tuesday, hours after Chinese President Xi Jinping arrived in neighboring Russia for a three-day trip.

Xi, Putin signal unity against U.S. in joint statement (Nikkei Asia) China urges peace talks in Ukraine, Moscow backs Beijing on Taiwan

After Kremlin talks, Xi and Putin sign cooperation agreements as Japan’s leader visits Ukraine (Washington Post) Putin, Xi agree on expanding natural gas trade, other economic ties. Visit by Japan’s Kishida to Kyiv gives sharp contrast to Xi in Russia. Xi and Putin to meet for ceremony, talks and state dinner.

China ‘lacks credibility’ to secure Ukraine ceasefire amid Russia drone fears (The Telegraph) Nato sceptical of Beijing’s plan for peace following reports that a Chinese firm was in talks to arm Moscow with kamikaze drones

Putin got very little out of Xi’s big visit except pomp and ceremony (The Telegraph) The Chinese president’s grand trip to Moscow looked like theatre that played more to his benefit than to Russia’s

Putin’s two-day charm offensive with Xi underlines who’s boss (the Guardian) Kremlin toasts the Russian-Chinese partnership, which appears warm but far from equal

Why Xi can't solve Putin's Ukraine problem (The Telegraph) Chinese president could have profound influence but questions remain about whether he can, or wants to, end the war

7 myths standing in the way of Ukraine’s victory (POLITICO) If Kyiv is forced to settle, it will bring neither justice, nor peace. Only victory will stop Putin coming at us again.

Freeing Belarus from tyranny: A conversation with Sviatlana Tsikhanouskaya (Atlantic Council) How can the United States and its Western allies help support freedom and self-determination in Belarus? What effect has Russia’s full-scale invasion of Ukraine had on Belarusian democratic opposition and civil society?

Putin the Pariah: War crimes arrest warrant deepens Russia’s isolation (Atlantic Council) The ICC decision to indict Putin for war crimes is a highly consequential step that will deepen Russia’s international isolation while weakening Putin’s personal position both at home and abroad, writes Anders Åslund.

ICC arrest warrant for Putin is a step toward ending Russian impunity (Atlantic Council) The International Criminal Court decision to issue an arrest warrant for Putin over his alleged role in the deportation of Ukrainian children has sparked a lively debate. Is the move truly historic or merely symbolic?

Putin warns UK it is ramping up war with its 'nuclear component' arms for Ukraine (The Telegraph) Britain confirms it will send depleted uranium shells, but Kremlin accused of 'bonkers' reaction at press conference with President Xi

Putin says Russia ‘will respond’ if UK supplies depleted uranium shells to Ukraine (the Guardian) Russian leader reacts to comments by UK defence minister that Britain will supply armour-piercing rounds to Kyiv

The Army Digs in for Competition Against Russia, Sets Garrison in Poland (Military.com) The Army now has a permanent garrison in Poland, a major milestone underscoring that country's central role as a hub of NATO support for Ukraine's fight against invading Russian forces.

‘Absolutely a quick study’: Ukrainians master Patriot system faster than expected (POLITICO) “They are the best of the best in what they do in air defense for Ukraine," a U.S. general said.

Ukrainians to Get U.S. Tanks by Fall (U.S. Department of Defense) The U.S. will send M1A1 Abrams tanks from refurbished hulls already in U.S. inventory to Ukraine, and the delivery will be in the fall, which is faster than what was initially expected.

US speeds up Abrams tank delivery to Ukraine war zone (AP NEWS) The Pentagon is speeding up its delivery of Abrams tanks to Ukraine, opting to send a refurbished older model that can be ready faster, with the aim of getting the 70-ton battle powerhouses to the war zone by the fall, the Pentagon said Tuesday.

US to accelerate delivery of tanks to Ukraine (CNN) The US will dramatically accelerate the time it takes to ship Abrams tanks to Ukraine by sending older M1-A1 models of America's main battle tank instead of the more modern version of the tank, according to two US officials.

The Dangers of a New Russian Proposal for a UN Convention on International Information Security (Council on Foreign Relations) Russia recently issued a new draft for a UN international convention on cybersecurity. An alternative proposal offers a freer vision of internet governance, and would provide a more action-oriented p…

Bad magic: new APT found in the area of Russo-Ukrainian conflict (Securelist) In October 2022, we identified an active infection of government, agriculture and transportation organizations located in the Donetsk, Lugansk, and Crimea regions.

Unknown actors target orgs in Russia-occupied Ukraine (Register) If this is Kyiv's work, Russia can Crimea river

New 'Bad Magic' Cyber Threat Disrupt Ukraine's Key Sectors Amid War (The Hacker News) New "Bad Magic" activity cluster targeting gov't, agriculture & transportation orgs in Donetsk, Lugansk & Crimea amid ongoing Russia-Ukraine war.

Partisan suspects turn on the cyber-magic in Ukraine (Cybernews) A previously unidentified threat actor is believed to be using new malware programs called CommonMagic and PowerMagic to phish for details of targets in disputed Russian-controlled areas of Ukraine.

Hacker tied to D.C. Health Link breach says attack 'born out of Russian patriotism' (CyberScoop) The hacker who took responsibility for the D.C. Health Link breach claims to have targeted U.S. politicians out of allegiance for Russia.

Financial cyber threats heightened by ideologically motivated hacktivism amidst geopolitical tension (SC Media) Russia's war with Ukraine has triggered a surge in ideologically motivated hacktivism that persists to this day, posing by far the most significant impact on the cyber threat landscape for financial services, according to a report by the Financial Services Information Sharing and Analysis Center.

Review: Protecting and Defending Ukraine’s Cultural Identity (New York Times) A festival responds to the assaults and insults of war by celebrating the composer who shaped the nation’s contemporary music, Borys Liatoshynsky.

Attacks, Threats, and Vulnerabilities

ENISA Transport Threat Landscape (ENISA) This report is the first analysis conducted by the European Union Agency for Cybersecurity (ENISA) of the cyber threat landscape of the transport sector in the EU. The report aims to bring new insights into the reality of the transport sector by mapping and studying cyber incidents from January 2021 to October 2022. It identifies prime threats, actors and trends based on the analysis of cyberattacks targeting aviation, maritime, railway and road transport over a period of almost 2 years.

Ransomware ‘likely’ to target transportation OT systems, warns EU cyber agency (Record) The European Union's cyber agency says ransomware is the biggest cyberthreat to Europe's ports, railways and aviation, and attackers are likely to target operational technology (OT) instead of information technology (IT) at some point.

Vulnerability Spotlight: Netgear Orbi router vulnerable to arbitrary command execution (Cisco Talos Blog) Cisco Talos recently discovered four vulnerabilities in the Netgear Orbi mesh wireless system, including the main hub router and satellite routers that extend the network’s range.

From Ransomware to Cyber Espionage: 55 Zero-Day Vulnerabilities Weaponized in 2022 (The Hacker News) 55 zero-day vulnerabilities exploited in 2022, mainly in software from Microsoft, Google, and Apple.

Chatbots, Celebrities, and Victim Retargeting: Why Crypto Giveaway Scams Are Still So Successful (Akamai) Akamai researchers have been monitoring several cryptocurrency giveaway scam kits that impersonate celebrities and brands, notably Elon Musk and his associated companies. The scams are delivered through various social media platforms as well as direct messaging apps such as WhatsApp or Telegram.

ZenGo uncovers security vulnerabilities in popular Web3 Transaction Simulation solutions: The red pill attack (ZenGo) ZenGo uncovers security vulnerabilities in popular Web3 Transaction Simulation solutions: The red pill attack ZenGo is the first keyless bitcoin and cryptocurrency wallet — the most simple and secure way to manage your crypto assets.

Google Pixel phones had a serious data leakage bug – here’s what to do! (Naked Security) What if the “safe” images you shared after carefully cropping them… had some or all of the “unsafe” pixels left behind anyway?

Stopping a $36 Million Vendor Fraud Attack (Abnormal Intelligence) Abnormal recently observed an attempted vendor email compromise attack that sought to steal $36 million. Here's how we detected and stopped the attack.

Ransomware gangs incite fear in victims to fuel attacks (Cybersecurity Dive) Attacks involving data theft nearly doubled and harassment spiked 20 times by late 2022, Palo Alto Networks Unit 42 said.

Harvest Keeper Rugged Users And Shows Why "AI Crypto" Can't Work (CryptoMode) Harvest Keeper boasted of being an AI project that "optimizes the trading process for maximum payout" and promised users a 4.81% return on deposits.

Personal details of 8,000 staff and clients compromised in cyber attack, health organisation says (ABC) After a lengthy investigation, an Aboriginal health organisation says hackers accessed Medicare numbers, licences, passports and tax file numbers in the attack last year.

Ferrari Extorted Over Client Database Breach (Tech Times) The Italian automaker opted not to pay the ransom—here's why!

WSJ News Exclusive | U.S. State-Government Websites Use TikTok Trackers, Review Finds (Wall Street Journal) The presence of the Chinese app’s trackers means that U.S. states might be inadvertently participating in data-collection efforts for a foreign-owned company.

Cybercriminals care about security too: how shady business is done on the dark web (ANI News) Latest Kaspersky research reveals cybercriminals posted more than 1 million messages mentioning escrow services on the darknet in 2020-2022. Escrow agents are third-party intermediaries involved in such deals to control the fulfillment of agreements and reduce the risks of cheating. They partner with cybercriminals who want to sell or buy data, services, or conclude a partnership - usually earning from three to 15 per cent of the transaction. However, the deal can still fail for various reasons, including those related to escrow scams. How such business is done on the darknet is described in a new report by Kaspersky Digital Footprint Intelligence team.

Security Patches, Mitigations, and Software Updates

CISA Releases Eight Industrial Control Systems Advisories | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA released eight Industrial Control Systems (ICS) advisories on March 21, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Trends

These Fortune 500 Companies Show Up Most Often in Compromised Password Data (Specops Software) Today, the Specops research team is sharing the results of their latest findings on the use of Fortune 500 company names in compromised passwords. The...

Fortinet Annual Skills Gap Rep (GuruFocus) New Fortinet research reveals escalating cyber risks due to the ongoing talent shortage while the number of organizations experiencing five or more breaches jumped by 53%

Only 1 in 10 workers remembers all their cyber security training (CybSafe) Only 1 in 10 workers remembers all their cyber security training. Read more...

Marketplace

Join the Brightest Startups at RSAC Innovation Sandbox (RSA Conference 2023) For 17 years, cybersecurity's boldest new innovators have competed in the RSAC Innovation Sandbox contest to put the spotlight on their potentially game-changing ideas. This year, 10 finalists will again have three-minutes to make their pitch to a panel of judges.

XM Cyber Announces Acquisition of Confluera, Adding Run-Time Protection on Cloud workloads to Extend CNAPP Capabilities (XM Cyber) Learn more about XM Cyber Announces Acquisition of Confluera, Adding Run-Time Protection on Cloud workloads to Extend CNAPP Capabilities . Read more on XM Cyber website.

dope.security Lands $16M in Funding for Fly-Direct Secure Web Gateway (Business Wire) Former Symantec, Forcepoint Product Leader Takes on Legacy Vendors, Disrupting SWG Market with Radical New Architecture

Backslash Security Emerges from Stealth to Fuse Code Security with Cloud-Native Context, Transforming a Decades-Long AppSec Paradigm (Yahoo Finance) Backed by StageOne Ventures and a stellar roster of security industry leaders, AppSec disruptor secures $8M to equip AppSec teams with visual control over cloud-native applications by identifying toxic code flows and automating threat models

Summers Predicts “Cleaning Out” of Fintech Sector After SVB Failure (The Information) Former Treasury Secretary Larry Summers predicted Silicon Valley will see a “cleaning out” in the fintech sector as a result of regulatory attention flowing from the failure of Silicon Valley Bank. In an interview with The Information’s editor in chief Jessica Lessin, Summers also said that the ...

Briefing: TikTok CEO to Pledge App Will be Free From Any Government Influence (The Information) TikTok CEO Shou Zi Chew will offer a broad series of promises to protect American users’ data and keep the app free from government interference in his upcoming testimony to Congress. “We will firewall protected U.S. user data from unauthorized foreign access,” he will say, according to a copy of the prepared remarks . “Tiktok will remain a platform for free expression and will not be

TikTok CEO appears on TikTok to warn users about the TikTok ban (The Verge) A message to the app’s 150 million US users

TikTok bans deepfakes of nonpublic figures and fake endorsements in rule refresh (The Verge) TikTok says realistic deepfakes need to be clearly labeled.

TikTok is D.C.'s new boogeyman. Can Silicon Valley’s tactics save them? (Washington Post) The app, owned by Beijing-headquartered ByteDance, is adopting the lobbying tactics of many of its American tech company peers

Here's Why CrowdStrike Is Thrilled to Partner With Dell (The Motley Fool) There's a lot of good stuff here for investors to think about.

Check Point tells employees no raises in 2023 (CTech) The Israeli cyber giant informed its employees that, in view of the economic situation, instead of salary increases, they will receive a special bonus of blocked shares for one year in the amount of 5% of their base salary

Radware Named a Gold Winner for Application Security in the 2023 Globee Cybersecurity Awards (GlobeNewswire News Room) Receives top honors for Radware SecurePath, its innovative application security architecture ...

Industry Veteran Kevin Senator Joins aDolus as CEO (EIN News) Experienced OT/IT/IoT executive to expand customer base

AppOmni Bolsters C-Suite with Key Leadership Appointments (Business Wire) SaaS security leader names new Chief Development Officer and Chief Customer Officer

NinjaOne Appoints Robert Gibbons as Chief Technology Officer (NinjaOne) Read first-hand accounts of how Ninja's products and superior support help companies deliver fast and effective IT management.

SaaS Data Security Leader DoControl Announces Christine Castro as its New Vice President of Marketing (PR Newswire) DoControl, the automated Software as a Service (SaaS) security company, today announced that Christine Castro has joined as Vice President of...

HUMAN Expands Legal and Compliance Capabilities with Newly-Appointed General Counsel (HUMAN Security) HUMAN Expands Legal and Compliance Capabilities with Newly-Appointed General Counsel, Kirsten Canton.

https://www.businesswire.com/news/home/20230322005527/en/Orca-Security-Appoints-Co-Founder-Gil-Geron-as-CEO (Business Wire) Strategic Changes Position Company for Next Stage of Growth as Cloud-Native Application Protection Platform Market Leader

Products, Services, and Solutions

This Ukrainian Startup Is Looking to Automate Crypto Crime Reporting Using Smart Contracts, AI (Yahoo Finance) HAPI Labs has launched a platform for reporting of scam- and crime-related addresses in partnership with Ukraine’s cyber police.

Intelligent CloudCare Launches Online Cybersecurity Employee Training Courses (GlobeNewswire News Room) Intelligent CloudCare, an IT services firm for small and medium-sized businesses and a subsidiary of...

ConnectWise Challenges IT Solution Providers to Prepare for the Future at IT Nation London Conference (GlobeNewswire News Room) MSP software leader kicks off annual conference in Europe with broad updates to tools and services and messages on solving challenges in time of rapid...

Cybersecurity & Compliance Platform from Onapsis Now an SAP Endorsed App Available on SAP® Store (Onapsis) Customers can benefit from accelerated cloud and digital transformation initiatives through supplementary, independent cybersecurity and compliance capabilities.

Sophos Partners with Cowbell to Provide Businesses with Easier Access to Cyber Insurance (Sophos) Partnership Helps Organizations Apply for Cyber Insurance and Assess Security Health for Insurability

Sophos Partners with Cowbell (Sophos News) Providing Small and Medium Enterprises with streamlined access to cyber insurance coverage and facilitating optimal insurance provision for Sophos customers in the U.S. through the opt-in sharing o…

Cellebrite Announces Enhanced Solution Capabilities for Digital Investigations (GlobeNewswire News Room) Cellebrite's latest AI-enabled Investigative Analytics Solution, Pathfinder X, equips investigators with new breadth of investigative tools and enterprise...

Cellebrite Announces RelativityOne Integration for Quicker, Safer Data Review (GlobeNewswire News Room) Cellebrite’s LegalView add-on for RelativityOne to simplify how modern data is collected and reviewed...

Dell strengthens security portfolio (IT-Online) Dell Technologies has announced new security services and solutions to help organisations protect against threats, respond to attacks and secure their devices, systems and clouds. Seventy-two percent of IT business leaders and professionals believe the changing working world exposes their organization to even greater risk. The highly distributed IT environment creates new opportunities for cybercriminals […]

Launch of Virtru Private Keystore Enables Heightened Privacy and Secure Collaboration in the Cloud (GlobeNewswire News Room) Encryption Key Management Solution Gives Customers Full Control of Cloud-Hosted Data...

Cemtrex Announces Vicon End-to-End Security System Order for Next Generation Zero-Carbon Prison System in United Kingdom (GlobeNewswire News Room) $0.8 Million in Vicon Surveillance Equipment with Latest Smart Technologies to Better Protect Prisoners, Staff and Public...

OP[4] Launches with Groundbreaking IoT and Embedded Systems Security Tech (Yahoo Finance) Automated Platform Detects, Prioritizes, Remediates Exploitable VulnerabilitiesCHANTILLY, Va., March 22, 2023 (GLOBE NEWSWIRE) -- OP[4], a new company built on pioneering cybersecurity technology originally developed for DARPA and productized via AFWERX, launched today with over $2 million U.S. dollars in initial seed funding secured through a combination of product sales and private investment. OP[4]'s revolutionary security platform is designed to automatically find and fix N-Day and 0-Day vul

Vectra Unifies AI-driven Behavior-based Detection and Signature-based Detection in a Single Solution (Vectra news release) Published: Mar 22, 2023. Vectra Unifies AI-driven Behavior-based Detection and Signature-based Detection in a Single Solution. Visit our news releases page to read more!

Bluescape and Jazz Solutions Add Virtual Workspace Solutions to Automa (PRWeb) FedRAMP-certified Bluescape helps achieve new levels of agility for dispersed teams Bluescape®, a visual collaboration and workspace platform,

Cohesity and OwnBackup Partner to Offer Simplified and Consolidated Data Protection for SaaS workloads (Cohesity) Leading Data Protection and Management Providers OwnBackup and Cohesity Join Forces to Streamline Data Backup for Customers and Elevate Business Continuity in the Ransomware Era

Lightspin Launches Remediation Hub to Identify and Fix the Cloud Security Threats that Matter Most (PR Newswire) Lightspin, the leading cloud security solution for SaaS companies, today launched the Remediation Hub as part of its cloud-native application...

Technologies, Techniques, and Standards

CISA Releases Updated Cybersecurity Performance Goals (Cybersecurity and Infrastructure Security Agency CISA) Today, we published stakeholder-based updates to the Cybersecurity Performance Goals (CPGs). Originally released last October, the CPGs are voluntary practices that businesses and critical infrastructure owners can take to protect themselves against cyber threats

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management | CISA (Cybersecurity and Infrastructure Security Agency CISA) As part of the Enduring Security Framework (ESF), the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) has released Identity and Access Management Recommended Best Practices Guide for Administrators. These recommended best practices provide system administrators with actionable recommendations to better secure their systems from threats to Identity and Access Management (IAM).

ESF Partners, NSA, and CISA Release Identity and Access Management Recommended Best Practi (National Security Agency/Central Security Service) As part of the Enduring Security Framework (ESF), the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) published the Recommended Best Practices Guide for

Identity and Access Management: Recommended Best Practices for Administrators (NSA and CISA) Identity and access management (IAM) is a framework of business processes, policies, and technologies that facilitate the management of digital identities to ensure that users only gain access to data when they have the appropriate credentials.

How to Manage Cyber Risk as a Board Director (OODA Loop) The evolving responsibilities of board members to cyber security and cyber risk were highlighted as a theme in the OODA Almanac 2023. While cybersecurity has been a focus of corporate boardrooms in the past, it is about to become a required focus as the Securities and Exchange Commission (SEC) seeks to have companies identify a board of directors member as the cybersecurity lead. OODA has specific expertise supporting the nexus between technical cybersecurity and corporate governance risk management and looks forward to supporting a wide range of companies by either placing a cybersecurity expert directly on the board or working as a consultant to the board to help guide their strategic initiatives and ensure they are exercising due care in managing cyber risks. Following is a guide for board members as they begin to explore the impact of cyber risk on the fiduciary responsibilities of a board of directors.

Weak, Repetitive Passwords a Common Problem in Government, Says Report (FEDweek) Use of weak and/or repetitive passwords is a common problem in government, according to a report by a cybersecurity firm that is the latest caution about

Meet Data Privacy Mandates With Cybersecurity Frameworks (CPO Magazine) In the coming months, data protection laws will continue to evolve and strengthen, requiring organizations to refine their data protection policies further and take demonstrable steps to safeguard the privacy of individual customers’ information.

Proactive Defence : How Enterprises Are Using Dark Web Threat Intelligence - Searchlight Cyber (Searchlight Cyber) Download our latest research report - based on a survey of more than 1,000 CISOs in the US and UK - to find out how large enterprises are using dark web intelligence. We found that 93 percent of CISOs are concerned about dark web threats but the use of threat intelligence varies by geography and...

Opinion Social media is devastating teens’ mental health. Here’s what parents can do. (Washington Post) If we are serious about addressing the alarming worsening of teens’ mental health, we must reduce their social media use.

What is the CIA Triad? - Check Point Software (Check Point Software) Learn what the CIA Triad is, and how potential cyber threats to an organization’s systems are limited if they ensure confidentiality, integrity, and availability.

Cyber Warfare is Upon Us: Why the Next Generation of ‘War Games’ so Important (Infosecurity Magazine) Modern businesses are increasingly used as pawns in cyber battles between nation-states and affiliated groups

Design and Innovation

Turing Award Won by Co-Inventor of Ethernet Technology (New York Times) In the 1970s, Bob Metcalfe helped develop the primary technology that lets you send email or connect with a printer over an office network.

Google Rolls Out Its Bard Chatbot to Battle ChatGPT (WIRED) A new bot has entered the chat. But Google warns that, like its competitor, it will sometimes “hallucinate.”

Google just launched Bard, its answer to ChatGPT—and it wants you to make it better (MIT Technology Review) Under pressure from its rivals, Google is updating the way we look for information by introducing a sidekick to its search engine.

Amazon Faces Moment of Truth on Alexa as ChatGPT Steals Its Thunder (The Information) At the 2018 Consumer Electronics Show, Amazon announced one of its biggest partnerships yet to help make its Alexa voice assistant ubiquitous: a deal with Toyota to integrate Alexa into the auto giant’s cars. “Our vision for Alexa is that she should be everywhere a customer might need her—at ...

The case for slowing down AI (Vox) Pumping the brakes on artificial intelligence could be the best thing we ever do for humanity.

Twitter Used to Make Us Smarter (The Information) A handful ofmonths into Twitter’s new management and it’s clear an era has ended. For the site’s power users, which include academics, journalists and lawmakers, the sudden changes in the social network’s policies, practices and culture have destroyed years of careful network building. What that ...

I Saw the Face of God in a Semiconductor Factory (WIRED) As the US boosts production of silicon chips, an American journalist goes inside TSMC, the mysterious Taiwanese company at the center of the global industry.

Legislation, Policy, and Regulation

The Secretary General’s Annual Report 2022 (NATO) On 21 March 2023, NATO Secretary General Jens Stoltenberg released his Annual Report for 2022.

Nordics move towards common cyber defence strategy (Computer Weekly) Nordic countries agree to work together to improve their cyber defences amid increasing threat

Dutch bureaucrats told to remove TikTok from work phones (Reuters) Dutch civil servants will soon no longer be allowed to use the Chinese-owned video app TikTok on their work phones, the Dutch Interior ministry said on Tuesday, following similar decisions by other European countries.

Readout from CISA’s Sixth Cybersecurity Advisory Committee Meeting (Cybersecurity and Infrastructure Security Agency) Today, the Cybersecurity and Infrastructure Security Agency (CISA) held its sixth Cybersecurity Advisory Committee meeting, the first quarterly meeting of 2023.

Forget A TikTok Ban, We Need To Regulate Data Brokers And Pass A Real Privacy Law (Techdirt) We’ve noted for a while now how the great TikTok moral panic of 2023 is largely a distraction. It’s a distraction from the fact we’ve refused to meaningfully regulate dodgy data b…

Mobilicom to Meet with Members of U.S. Congress to Advocate for Drone Cybersecurity (GlobeNewswire News Room) Mobilicom Selected to Participate in AUVSI’s 2023 Hill Day to Support Drone Industry Growth & Success Shoham, Israel, March 22, 2023 (GLOBE...

Litigation, Investigation, and Law Enforcement

End of BreachForums could take a bite out of cybercrime (Washington Post) A cybercrime forum’s shuttering could leave the community unsteady — for a while, anyway

BreachForums says it is closing after suspected law enforcement access to backend (Record) In an abrupt about-face, the new administrator of popular cybercriminal platform BreachForums said they plan to shut down the site after its previous administrator was allegedly arrested last week.

A New York Court Is About to Rule on the Future of Crypto (WIRED) The Securities and Exchange Commission’s case against Ripple over the XRP token will establish a critical precedent.

Swatting calls haven’t stopped for a Sanford family: What you can do to protect yourself (FOX 35 Orlando) The swatting calls keep coming for one Florida family, and they are doing whatever they can do to defend themselves from more cyber attacks.

The Cure Tried to Stop Scalpers. Brokers Are Selling Entire Ticketmaster Accounts Instead (Vice) Inside the secretive markets scalpers use to buy and sell entire Ticketmaster accounts to sidestep restrictions.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

innovate Cybersecurity Summit (Nashville, Tennessee, USA, Mar 27 - 29, 2023) The New Standard of Cybersecurity Education. Powered by the collected knowledge of hundreds of experts whose decades of expertise cross a wide variety of industries, Innovate is the premier resource for CISO education & collaboration.

innovate Cybersecurity Summit 2023 (Scottsdale, Arizona, USA, Oct 1 - 3, 2023) The New Standard of Cybersecurity Education. Powered by the collected knowledge of hundreds of experts whose decades of expertise cross a wide variety of industries, Innovate is the premier resource for CISO education & collaboration.

Events

NVIDIA GTC Conference (Virtual, Mar 20 - 23, 2023) Join us at the NVIDIA GTC Conference to learn how organizations are using the NVIDIA AI platform to more quickly build and deploy AI-based cybersecurity solutions to achieve threat detection at scale.

SGTech Week 2023 (Park Plaza Amsterdam Airport, Netherlands, Mar 20 - 24, 2023) The 4th annual SGTech Week 2023 brings together 150+ utility Substation, SCADA System, Utility Telecom and Cybersecurity colleagues, for a review of the latest smart grid implementation projects and innovation roadmaps. The week-long programme combines a series of Standardisation workshops, with C’level plenary sessions, techno-commercial case-study presentations, technology innovation panel debates, and intimate end-user roundtable discussions, to drive awareness of recent successes and setbacks as well as stimulate new ideas to drive the deployment of the smart grid further faster.

Security First (London, England, UK, Mar 22, 2023) Security First returns to London in 2023! Join leading cybersecurity experts from across the community as we explore the latest threats and industry trends, and learn practical strategies to safeguard your organisation. Don't miss out - register today to reserve your spot.

The Personal Stories, Challenges, and Triumphs of Women in Cyber (Virtual, Mar 22, 2023) In this panel discussion hosted by Devo, leading women in cyber will come together to share their experiences, discuss challenges they’ve faced throughout their careers, and offer advice on how more women can flourish in cybersecurity. Register today!

Supply Chain & Third-Party Risk Summit (Virtual, Mar 22, 2023) The dramatic surge in open source software supply chain attacks has sent defenders scrambling to find mitigations and solutions. At the highest highest levels of the U.S. government, mandatory guidance is being established to secure code dependencies and security gaps in software used in the most critical projects. Join us as we bring together security experts to discuss the biggest software supply chain hacks, the complex nature of the problem, best practices for mitigating security issues, and the frameworks and specifications currently available.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.