IAM trends. RagnarLocker as a critical infrastructure threat. AI hype as phishbait. Updates on the hybrid war: leaks and hacks.

Summary

By the CyberWire staff

At a glance.

Key trends in Identity Access Management.
RagnarLocker and critical infrastructure.
Cyber criminals capitalize on the AI hype.
Updates on the leaked US classified documents.
Report from the leaks: Russian hackers compromised a Canadian gas pipeline.
KillNet counts some coup against NATO (but not as much as it claims).

Key trends in Identity Access Management.

April 11th marks Identity Management Day. Today, we discuss trends in Identity Access Management (IAM), and look at some expert commentary and advice on IAM. VentureBeat reported that one of four key trends discussed at the 2023 Gartner IAM Summit this year included the importance of adding identity threat detection and response solutions to protect against cyber threats and breaches. Other trends included the implementation of an identity-first approach to cybersecurity, the use of cloud infrastructure entitlement management (CIEM) tools in identity management approaches, and the implementation of a journey-time solution for a streamlined user experience. For more on IAM, see CyberWire Pro.

The key to beating ransomware? Use a solution built to defeat ransomware.

Halcyon is the first dedicated, adaptive solution that combines multiple advanced proprietary prevention engines focused specifically on detecting and stopping ransomware. With the fastest endpoint recovery capabilities, multiple layers of resiliency, bypass and evasion protection, automated key capture for swift decryption and data exfiltration prevention, the Halcyon Anti-Ransomware and Resilience Platform reverses the impact of ransomware attacks in just minutes. This is why Halcyon is the resilience platform Global 2000 companies rely on to defeat ransomware.

RagnarLocker and critical infrastructure.

Sygnia today shared a blog detailing RagnarLocker, a threat actor the security firm says “uses double-extortion tactics since early 2020 and targets, among others, the critical infrastructure sector.” The blog says that the initial attack vector was a known vulnerability in an external-facing remote service. Many customized batch scripts were found, intending to be used for reconnaissance against Windows event logs and deploy ransomware. The group used the Remote Manipulator System (RMS) as Command & Control, and remote access tool AnyDesk was also observed in use to lift data. The use of these legitimate tools allows for the RagnarLocker group to fly under the radar.

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

Cyber criminals capitalize on the AI hype.

Anticipation leads people to suspend their better judgment as a new campaign of credential theft exploits a person’s excitement about the newest AI systems not yet available to the general public. This morning Veriti explained that several unknown actors are making false Facebook ads which advertise a free download of AIs like ChatGPT and Google Bard. Veriti writes “These posts are designed to appear legitimate, using the buzz around openAI language models to trick unsuspecting users into downloading the files. However, once the user downloads and extracts the file, the Redline Stealer (aka RedStealer) malware is activated and is capable of stealing passwords and downloading further malware onto the user's device.” Veriti describes the capabilities of the Redline Stealer malware which, once downloaded, can take sensitive information like credit card numbers, passwords, and personal information like user location, and hardware. Veriti added “The malware can upload and download files, execute commands, and send back information about the infected computer at regular intervals.” Experts recommend using official google or openAI websites to learn when their products will be available and only downloading files from reputable sources. With the rising use of Google and FaceBook ads as attack vectors experts also suggest refraining from clicking on suspicious advertisements promising early access to any product on the internet.

Updates on the leaked US classified documents.

The US continues to investigate the leaks of classified information that appeared on Discord servers and have since circulated through social media (especially in Russian channels). The investigation is seeking to confirm, first, that the leaks have stopped, second, to determine their authenticity, and, third, to identify their source. Some of the documents appear, on preliminary evidence to have been altered, CBS News reports. National Security Council spokesman John Kirby on Monday said, “We know that some of them have been doctored.” Many or most of them, however, seem to be genuine, and the AP writes that the US Department of Defense is taking them seriously. While the leaks are not believed to contain operational plans, according to CNN Ukraine has indicated that the leaks have induced it to make some alterations in its own planning.

Discord servers have shown themselves readily adaptable to the sharing, scraping, and dissemination of sensitive information, CyberScoop explains. The publication also gives some color to the nature of the leaks. "The leaked documents are photographs of briefing slides that appear to have been folded up. They are photographed mostly against what appears to be a low table. In the background of some of the photographs can be seen a bottle of Gorilla Glue and what appears to be a strap with the Bushnell brand, a popular maker of outdoor optics and rifle scopes." Other files, the Wall Street Journal reports, are photographs of paper documents, with folds in the paper visible in many of them. Since their initial posting the images have circulated through 4chan and various Russian social media accounts.

Who leaked them? No one knows, so far. And, as the New York Times reports, a large number of people had access to the compromised information.

Report from the leaks: Russian hackers compromised a Canadian gas pipeline.

There are some indications in the leaked files that a Russian threat actor has claimed to have compromised a Canadian natural gas pipeline in an incident reminiscent of the 2020 Colonial Pipeline attack, but the claim is just that: a claim. Canadian authorities have declined to comment.

The Washington Post quotes a section of the leaked files, a February intelligence report. “A pro-Russia hacking group is receiving instructions from a presumed Federal Security Service (FSB) officer to maintain network access to Canadian gas infrastructure and wait for further instruction. The FSB officers anticipated a successful operation would cause an explosion at the gas distribution station... If Zarya succeeded, it would mark the first time the IC [intelligence community] has observed a pro-Russia hacking group execute a disruptive attack against Western industrial control systems.”

Many experts regard the claims with skepticism. Zarya's record, such as it is, shows no ability to conduct anything beyond nuisance-level attacks, nothing more sophisticated than distributed denial-of-service (DDoS) operations. The group is thought to be an offshoot of the Cyber Spetsnaz auxiliary, itself spawned from KillNet. The Wall Street Journal cites cybersecurity experts who believe the claim looks like "active disinformation." Even if there were a breach, and that's far from confirmed, it seems likely that only business systems would have been compromised. The Journal quotes Lesley Carhart, director of incident response for North America at Dragos, who explains, “There is a mountainous gap between getting access to control devices in an industrial network, and actually being able to make something, and I quote, explode. That involves understanding chemical engineering, understanding the process systems, and understanding all of the safety controls—human, mechanical, electronic, otherwise—that are involved in that specific configuration.”

KillNet counts some coup against NATO (but not as much as it claims).

Some follow-up to reports of KillNet's distributed denial-of-service (DDoS) action against NATO. The Russian news source Lenta published an article yesterday alleging that “during the DDoS attack the hackers were able to paralyze at a minimum 60% of the alliance’s electronic infrastructure.” Lenta also claims that the hackers gained access to secret data from the NATO countries. The CyberWire wrote to NATO asking for comment, and a NATO official responded as follows:

“Cyberspace is contested at all times, and we face malicious cyber activity on a daily basis. NATO takes this very seriously. We remain vigilant and continue to adapt to evolving threats. NATO and Allies are strengthening our ability to detect, prevent and respond to such activities.

“We are currently experiencing Denial of Service attempts against a number of NATO websites, and our experts are responding. NATO’s classified networks are not affected and there is no impact on NATO operations.”

Thus Lenta’s claims that KillNet had disabled some 60% of NATO’s “electronic infrastructure” seem overstated. NATO School Oberammergau, the most commonly mentioned victim of DDoS, is not, we note, an operational command.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Notes.

Today's issue includes events affecting Canada, China, India, the Democratic People's Republic of Korea, NATO/OTAN, Russia, Ukraine, the United Kingdom, and the United States.

Dateline

Ukraine at D+411: US leaks remain under investigation. (CyberWire) Governments continue to focus on the provenance and implications of the US intelligence documents, many of them having to do with Russia's war against Ukraine, that leaked into Discord servers.

Russia-Ukraine war: List of key events, day 412 (Al Jazeera) As the Russia-Ukraine war enters its 412th day, we take a look at the main developments.

Russia-Ukraine war at a glance: what we know on day 412 of the invasion (the Guardian) Leaked US documents appear to indicate Egypt was planning to covertly supply Russia weapons; US says reporter Evan Gershkovich ‘wrongfully detained’

Ukraine Says Russia Is Using ‘Scorched Earth’ Tactics in Bakhmut (Wall Street Journal) A top Ukrainian military commander described the situation in the city, where Ukrainian forces have been largely pushed out of its center, as “difficult but under control.”

'More comfortable than a Rolls-Royce': Ukrainian tank drivers eagerly await Western rides (Los Angeles Times) As anticipation builds for a counteroffensive, Ukrainian forces are desperate to lay their hands on Western tanks that could help turn the war's tide.

Biden administration doesn't know extent of classified Pentagon document leak (CBS News) NSC spokesman John Kirby said the administration doesn't know whether the national security threat has been contained.

Ukraine ‘alters counter-offensive plans’ after Pentagon leak (The Telegraph) Ukrainian air force spokesman says, ‘We need jets here, and now’, as leaked documents raise fresh questions over RAF Black Sea incident

Ukraine had to change military plans because of US Pentagon leak, source says (CNN) Highly classified Pentagon documents leaked online suggest key weaknesses in Ukrainian weaponry, air defense, and readiness, and reveal US penetration of Russia's Defense Ministry and the mercenary organization Wagner Group.

Leaked Pentagon documents claim that hackers breached a Canadian gas network. Here’s what to know. (Washington Post) Hackers claimed to have breached a Canadian pipeline. Their assertions lie somewhere between dangerous and doubtful.

Pro-Russia Hackers Say They Breached Canadian Pipeline, but Experts Are Skeptical (Wall Street Journal) Leaked Pentagon documents show hackers bragged to Russia’s FSB about allegedly compromising industrial control systems at an unnamed Canadian gas-pipeline operator.

Leaked US intel: Russia operatives claimed new ties with UAE (AP NEWS) A leaked document suggests U.S. spies caught Russian intelligence officers boasting that they had convinced the oil-rich United Arab Emirates “to work together against US and UK intelligence agencies." The purported document was posted online as part of a major U.S. intelligence breach. U.S. officials have declined to comment on the document, which had top-secret markings and was viewed by The Associated Press. The Emirati government dismissed the allegations that the UAE had deepened ties with Russia as “categorically false.” But the allegation comes at a time of growing U.S. concerns about companies in the UAE helping Russia thwart international sanctions imposed over Russia’s invasion of Ukraine.

Egypt secretly planned to supply rockets to Russia, leaked U.S. document says (Washington Post) President Abdel Fatah El-Sisi in February planned to produce 40,000 rockets for Russia and instructed officials to keep production and shipment secret ‘to avoid problems with the West’

How the Latest Leaked Documents Are Different From Past Breaches (New York Times) The freshness of the documents — some appear to be barely 40 days old — and the hints they hold for operations to come make them particularly damaging, officials say.

How U.S. friends and foes have responded to leaked Pentagon documents (Washington Post) Washington’s appetite for intelligence on friends and adversaries alike is well known to foreign governments — and should they ever forget, periodic leaks of classified information serve to remind them.

Pentagon leaks: US seeks to mend ties after claims Washington spied on key allies (the Guardian) Defence secretary speaks to South Korean counterpart after leak suggesting US was spying on Seoul’s internal discussions on arms sales

Pentagon Probe Under Way in Leaks Case (Wall Street Journal) A Pentagon team is looking into how the purported classified documents were exposed, as the U.S. seeks to contain diplomatic fallout.

Pentagon assessing damage after 'highly classified' US secrets leaked online (Breaking Defense) “The Department of Defense is working around the clock to look at the scope and scale of the distribution, the assessed impact and our mitigation measures,” said Chris Meagher, the assistant to the secretary of defense for public affairs.

The Pentagon’s Purported Classified-Document Leak: The Biggest Takeaways and Questions So Far (Wall Street Journal) The U.S. is seeking to assess the damage from an intelligence breach after officials discovered images of purportedly classified U.S. documents circulating online.

The ongoing scandal over leaked US intel documents, explained (Vox) What you need to know about those top-secret files that got posted on Discord.

Leaked documents a 'very serious' risk to security: Pentagon (AP NEWS) The Pentagon says online leaks of scores of highly classified documents about the Ukraine war present a “very serious” risk to national security and senior leaders are quickly taking steps to mitigate the damage. In the days since Defense Secretary Lloyd Austin became aware of the leaks, he's reached out to top allies, convened daily meetings to assess the damage and set up a group not only to assess the scope of the information lost but review who has access to those briefings. And as the public airing of the data sends shockwaves across the U.S. government, the White House says there are concerns there could be additional leaks.

The Discord servers at the center of a massive US intelligence leak (CyberScoop) The intelligence files related to the Ukraine war that appeared online aren't the first sensitive military documents shared on video game forums.

Social-Media Platform Discord Emerges at Center of Classified U.S. Documents Leak (Wall Street Journal) The company started as an online space for gamers to gather and has grown to attract all sorts of users.

Why Leaked Pentagon Documents Are Still Circulating on Social Media (New York Times) Twitter and the social media platform Discord have policies about how they would handle the material. But those rules have gray areas and can be unevenly enforced.

Clues Left Online Might Aid Leak Investigation, Officials Say (New York Times) A large number of people potentially had access to the Pentagon intelligence documents posted on social media.

KillNet Claims Creating Gay Dating Profiles with NATO Logins (HackRead) KillNet claims it carried out cyberattacks that resulted in the “paralysis” of 40% of NATO’s electronic infrastructure.

The Russians Took Their Children. These Mothers Went and Got Them Back. (New York Times) Making a nerve-wracking 3,000-mile journey from Ukraine, into Russia-occupied territory, and back again, a group of mothers managed to recover their children from the custody of the Russian authorities.

Attacks, Threats, and Vulnerabilities

GuLoader Targeting the Financial Sector Using a Tax-themed Phishing… (eSentire) Learn more about a new cyber threat, the GuLoader malware, and get security recommendations from our Threat Response Unit (TRU) to protect your business from this cyberattack.

Supporters of Indian separatists using Twitter bots to promote violence (Washington Post) The messages are too numerous for Twitter’s reduced moderation teams to delete

Threat Actor Spotlight: RagnarLocker Ransomware (Sygnia) The Windows DPAPI mechanism is exploited by attackers to extract data. Defenders can replace their DPAPI backup key to fully remediate their organization.

From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard (Veriti) The rise of malware-as-a-service campaigns leveraging OpenAI ChatGPT and Google Bard platforms and strategies to mitigate the risks.

TN IPS officer flags 'serious data breach issue' on Twitter (DT next) CHENNAI: A Tamil Nadu cadre IPS (Indian Police Service) officer has flagged an alleged data breach after he placed an order on an online cosmetic shopping porta

Attackers are starting to target .NET developers with malicious-code NuGet packages (JFrog) Malicious packages are often spread by the open source NPM and PyPI package repositories, with few other repositories affected. Specifically – there was no public evidence of severe malicious activity in the NuGet repository other than spam packages used for spreading phishing links. As with other repositories, the JFrog Security Research team regularly monitors the …

Analysis of the First NuGet (.Net) Malicious Package Attack (JFrog) Analyzing Impala Stealer, a custom crypto stealer, and the payload of the first NuGet malicious package attack on .net developers

Did someone really hack into the Oldsmar, Florida, water treatment plant? New details suggest maybe not. (CyberScoop) Statements from the FBI and former Oldsmar city manager indicate what happened at the plant may not have been the work of an outside hacker.

FBI warns of public 'juice jacking' charging stations that steal your data. How to stay protected (ZDNET) Public power outlets are being illegally modified to steal your phone's data, the FBI suggests. I walk you through options to keep your information safe.

Juice jacking: FBI warns against using free charging stations at airports, hotels, shopping centers (ABC7 Chicago) According to the FBI, hackers have figured out how to use public USB ports to install malware and monitor software on your device.

FBI warns against using public phone charging stations (CNBC) The law enforcement agency said bad actors had figured out how to infect phones with malware using public charging cables.

Hikvision Alerts Technology Partners to Vulnerability in Some Products (Security Sales & Integration) Hikvision has issued a notice to its technology partners about a vulnerability in some Hikvision Hybrid SANcluster storage products.

Massive Balada Injector campaign attacking WordPress sites since 2017 (BleepingComputer) An estimated one million WordPress websites have been compromised during a long-lasting campaign that exploits "all known and recently discovered theme and plugin vulnerabilities" to inject a Linux backdoor that researchers named Balad Injector.

KFC, Pizza Hut owner discloses data breach after ransomware attack (BleepingComputer) Yum! Brands, the brand owner of the KFC, Pizza Hut, and Taco Bell fast food chains, is now sending data breach notification letters to an undisclosed number of individuals whose personal information was stolen in a January 13 ransomware attack.

SD Worx shuts down UK payroll, HR services after cyberattack (BleepingComputer) Belgian HR and payroll giant SD Worx has suffered a cyberattack causing them to shut down all IT systems for its UK and Ireland services.

Scope of CommonSpirit massive data breach is revealed (Crain's Chicago Business) The full extent of last year's ransomware attack, which involved more than 600,000 patients, is now known.

Tennova patients' personal data leaked after Community Health Systems software breach | ClarksvilleNow.com (ClarksvilleNow.com) Between January 28 and January 30, 2023, an unauthorized party accessed personal information on CHS's system, according to Fortra, LLC, a hired cyber security company.

Reports of Data Breach at PharMerica Corporation Leave Customers Worried About Their Personal Information (JD Supra) On April 8, 2023, reports of a PharMerica Corporation data breach began to surface after the Money Message ransomware group added PharMerica to its...

HawaiiUSA Federal Credit Union Confirms Recent Data Breach Affected Over 20k Customers (JD Supra) On April 7, 2023, HawaiiUSA Federal Credit Union (“HawaiiUSA”) filed a notice of data breach with the Attorney General of Maine after a cybersecurity...

Minnesota school district cancels classes for 42 schools after alleged cyberattack (Record) A public school system in Rochester, Minnesota announced this weekend that it was canceling classes at all 42 schools it operates on Monday after it was hit by a suspected cyberattack that began late last week.

Rochester Public Schools to close Monday after possible cyber attack (FOX 9 Minneapolis-St. Paul) Rochester Public Schools will be closed Monday due to a possible cyber attack. The district plans to re-open Tuesday with reduced network access.

Amazon sends warning and tells customers 'check 'your orders' section urgently' (Manchester Evening News) The tech giant has sent a clear warning to customers

Big Pharma-partnered Evotec on high alert after cyber attack takes systems offline (Fierce Biotech) German biotech Evotec is on high alert after a late-week cyber attack prompted the company to shut down its network. | German biotech Evotec is on high alert after a late-week cyber attack prompted the company to shut down its network.

Evotec SE provides update on cyber attack (Evotec) Business continuity upheld at all global sites after cyber attack. Forensic examination ongoing with external experts.

How LockBit Changed Cybersecurity Forever (Security Intelligence) LockBit has pioneered a disturbing new trend in ransomware. What caused the gang's rise to prominence, and how can organizations protect themselves?

Breached shutdown sparks migration to ARES data leak forums (BleepingComputer) A threat group called ARES is gaining notoriety on the cybercrime scene by selling and leaking databases stolen from corporations and public authorities.

ARES Leaks - Emerging Cyber Crime Cartel (CYFIRMA) INTRODUCTION As part of CYFIRMA Research team’s continuous external threat landscape monitoring efforts, the team has identified the emergence of...

47% of Workers Admit to Hacking Accounts With Former Employers’ Passwords (Password Manager) 47% say they have used at least one of these passwords to access accounts belonging to a previous employer.

Security Patches, Mitigations, and Software Updates

Apple fixes recently disclosed zero-days on older iPhones and iPads (BleepingComputer) Apple has released emergency updates to backport security patches released on Friday, addressing two actively exploited zero-day flaws also affecting older iPhones, iPads, and Macs.

Apple zero-day spyware patches extended to cover older Macs, iPhones and iPads (Naked Security) That double-whammy Apple browser-to-kernel spyware bug combo we wrote up last week? Turns out it applies to all supported Macs and iDevices – patch now!

CISA orders govt agencies to update iPhones, Macs by May 1st (BleepingComputer) The Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch two security vulnerabilities actively exploited in the wild to hack iPhones, Macs, and iPads.

Trends

Pindrop Voice Intelligence & Security Report Finds Consumers Living in States Restricting Biometrics are Twice as Likely to Experience Fraud (PR Newswire) Pindrop, a global leader in voice technology, today released its annual Voice Intelligence & Security Report. Through an analysis of five...

2023 Email Security Threat Report (Armorblox) Download the second, annual Armorblox 2023 Email Security Threat Report.

Nearly 4 in 5 Ransomware Attacks Include Threats Beyond Data Encryption, Finds “2023 Cyberthreat Defense Report” (Business Wire) Yet Survey Results Point to Unusual Optimism About 2023 Among IT Security Professionals

Marketplace

Trellix Appoints Ash Parikh to Chief Marketing Officer (Business Wire) XDR leader’s addition brings three decades of marketing strategy and execution

Global Secure Partners Launches to Strengthen Security Team Resiliency and Retention, Improve Operations for Cybersecurity’s First Responders (Business Wire) At Any Time, Approximately Half of All CISOs and Security Pros Are Considering New Roles. GSP Helps Organizations Identify and End Ineffective Practices, Improve Job Satisfaction and Retain Talent.

Sevco Security Expands Leadership Team with Appointment of Brian Contos as Chief Strategy Officer (Business Wire) Former ArcSight, Imperva, and Verodin Security Leader Brings More Than 25 Years of Experience to Disruptive CAASM Platform Company

Very Good Security Appoints Chuck Yu as CEO (GlobeNewswire News Room) Very Good Security (VGS), the leading provider of payment security and compliance solutions for...

Products, Services, and Solutions

CrowdStrike Falcon® Insight for IoT: Breakthrough XIoT protection (CrowdStrike) The world’s only extended detection and response (XDR) platform purpose-built to stop breaches for the extended Internet of Things (XIoT)

Phosphorus Showcases Game-Changing Enterprise xIoT Security Management Platform at RSAC 2023 (GlobeNewswire News Room) The world leader in xIoT breach prevention is also unveiling the industry’s first Intelligent Active Discovery (IAD) solution that safely and accurately...

Netskope Revolutionizes Hybrid Work with Industry-First Unified SASE Client and Integrated Endpoint SD-WAN (Netskope) Endpoint SD-WAN extends Netskope Borderless SD-WAN and SASE innovations to deliver consistent security and superior user experience for the hybrid worker,

ZeroFox Partners with Google Cloud to Disrupt Phishing Attacks and Malicious URLs (GlobeNewswire News Room) As one of the first external cybersecurity organizations contributing to Google Cloud’s Web Risk Submission API, ZeroFox will continuously provide Google...

GitGuardian Launches Honeytoken (GlobeNewswire News Room) With this new solution, GitGuardian expands the platform's capabilities to safeguard the entire software supply chain...

Buoyant Announces Linkerd 2.13 with New Reliability and Security Featu (PRWeb) New release introduces dynamic request routing, circuit breaking, automated health monitoring, vulnerability alerts, proxy upgrade assistance, and FIPS compat

Delinea's Latest Product Update Reduces the Risk of Backdoor Threats on Servers (PR Newswire) Delinea, a leading provider of solutions that seamlessly extend Privileged Access Management (PAM), today announced the latest release of...

ThreatX Delivers First Cloud-Native Solution to Detect & Block Runtime Threats to APIs and Applications (Business Wire) Patent-Pending Capability Leverages eBPF to Extend Protection to Egress, “East/West” Traffic; Supports Transition from Legacy to Cloud Environments

Hopr Selected for Google for Startups Cloud Program (Business Wire) Company receives Google Cloud training and support, among other Google-wide offerings

Technologies, Techniques, and Standards

Gaps in agency cybersecurity measures (Security Magazine) Federal governments across the globe work to better their security measures against cyberattacks.

Meta Verified is under fire in sex work circles for revealing users' legal names (TechCrunch) Meta's new paid verification system is raising concerns among sex workers, trans creators and other privacy advocates.

Design and Innovation

AI’s Breaking Point: What Happens When We Push Machines Too Far? (Softonic) Everyone is going crazy testing ChatGPT and the possibilities of artificial intelligence. It has come to break the patterns we had established for th

Research and Development

Inca Digital awarded DARPA contract to map crypto contagion risk (Axios) The same government agency credited with developing GPS, Siri and the internet, is digging in to further its understanding of digital assets.

Legislation, Policy, and Regulation

New Director GCHQ announced (GCHQ) Anne Keast-Butler to succeed Sir Jeremy Fleming as the 17th Director of GCHQ

Anne Keast-Butler: Britain appoints first woman to lead spy agency GCHQ (Record) Anne Keast-Butler comes to GCHQ from the U.K.’s domestically focused intelligence service MI5, where she has been serving as deputy director general.

National Cyber Threat Assessment 2023-2024 (Canadian Centre for Cyber Security) Over the last two years, cyber security has become a top concern for Canadians. Ransomware incidents hit the headlines on an almost daily basis both in Canada and around the world. Our essential services are being disrupted, from hospitals and schools to municipalities and utility providers. Our personal and financial data are being stolen, traded, or leaked online. Our online spaces are being flooded with false information and divisive rhetoric.

China Mandates Security Reviews for AI Services Like ChatGPT (Bloomberg) Alibaba, SenseTime just unveiled AI services this week. Regulators have already asserted control over algorithms.

Beijing chooses targets carefully as it goes on offensive in US chip wars (Financial Times) Analysts see memory-chip maker Micron as obvious first choice but say China will tread cautiously on further retaliation.

State Dept wants 'cyber assistance fund' to aid allies and partners against hackers (Breaking Defense) The special fund is part of a three-part plan floated by Nate Fick, the State Department’s roving ambassador for cybersecurity, to help bolster allied cyber skills before — and during — crises.

Litigation, Investigation, and Law Enforcement

Inside the international sting operation to catch North Korean crypto hackers (CNN) A team of South Korean spies and American private investigators quietly gathered at the South Korean intelligence service in January, just days after North Korea fired three ballistic missiles into the sea.

ChatGPT is entering a world of regulatory pain in Europe (POLITICO) AI chatbot makes itself an easy target for privacy regulators as fears around artificial intelligence grow.

‘I didn’t give permission’: Do AI’s backers care about data law breaches? (the Guardian) Regulators around world are cracking down on content being hoovered up by ChatGPT, Stable Diffusion and others

Illegal bitcoin mining by Suffolk County employees suspected years before discovery, records show (Newsday) Bitcoin miner delayed security upgrade that might have prevented ransomware attack, Suffolk County executive said.

Search for military hacker escalates as police give seven day deadline (Bangkok Post) The army is keen to interrogate a hacker alleged to have worked in its ranks after the Royal Thai Police (RTP) on Saturday submitted a letter to the suspect's supervisor and the army staff judge advocate to have him brought in for questioning within seven days.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

OT Cybersecurity Summit—Scotland (Aberdeen, Scotland, UK, May 29 - Jun 1, 2023) This brand new event will focus on how you can protect your fortress with the ISA 62443 series of standards and related training courses. Cybersecurity is a hot topic as supply chain risk emerges as a top concern in the energy sector. A cyber breach at any level in a supply chain has the potential to take down the whole operation. Regulators in the North Sea are asking contractors detailed questions about OT Cybersecurity, especially on operations classified as critical infrastructure. This increased scrutiny has resulted in more detailed contractual requirements. Insurance companies are also looking for specific details before writing a cybersecurity policy. ISA has established a series of industrial cybersecurity standards that serve as your roadmap to improve security and protect your operations with strategies such as zero-trust architecture and OPC/protocols.

Events

Identity Management Day 2023 Virtual Conference (Virtual, Apr 11, 2023) Identity Management Day, started in 2021 and hosted by the Identity Defined Security Alliance and National Cybersecurity Alliance, aims to inform about the dangers of casually or improperly managing and securing digital identities by raising awareness and sharing best practices across the industry. In its second year, the 2023 Virtual Conference brings together identity and security leaders and practitioners from all over the world to learn and engage. The conference is presented virtually with a full day of sessions featuring leading identity and security experts discussing the role of identity in cybersecurity strategies and how to address the threats facing organizations today. Registration is free! The conference will be open April 11th 9am ET to 4:30pm ET, giving attendees an opportunity to visit with our exhibitors. The Virtual Conference kicks off at 10am ET.

CrowdStrike Government Summit (Washington and virtual, DC, USA, Apr 11, 2023) Join cybersecurity and government leaders for the first-ever CrowdStrike Government Summit featuring can’t-miss in-person discussions on the capabilities, tactics, and technologies that will protect your agency and power your efficiency.

SecureWorld Healthcare Virtual Conference (Virtual, Apr 12, 2023) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 5 CPE credits learning from nationally recognized industry leaders. The agenda offers 15+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Five Critical Components of Product Design for Cybersecurity (Virtual, Apr 12, 2023) A Pre-RSA Virtual Fireside Chat with Mindgrub. In this webinar, Todd Marks, CEO, and Ben Slavin, SVP of Strategy and Design, will share principles and best practices for creating exceptional user experiences and improving the success of your cybersecurity product. With 20 years of experience designing, developing, marketing, and managing every phase of product operations, they’ve learned what customers want–and how to reach them–from their work with leading companies like Wendy’s, Exelon, NASA, Volexity, ID Agent, Dragos, and the USO. You'll learn about core fundamentals of product design that are often overlooked in the cybersecurity space, leaving great opportunities to grab more market share for those who embrace them. Don't miss out on this valuable opportunity to learn from the experts and gain a competitive edge in the cybersecurity market.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Apr 14 - 21, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.