Iranian threat actor exploits N-day vulnerabilities. Subdomain hijacking vulnerabilities. Discord Papers. Russia’s NTC Vulkan.

Announcement

Listen to (and follow) T-Minus, the only daily space news podcast.

Interested in all things space? The T-Minus Space Daily is a dedicated news-to-knowledge intelligence product designed to help space professionals stay in the know about the latest developments across the industry. In today's fast-paced space industry where technology, business, and operations are constantly changing, keeping up with the latest and staying informed has never been more challenging. Tune in to new episodes covering the latest space news and insights from leading experts.

Summary

By the CyberWire staff

At a glance.

Iranian threat actor exploits N-day vulnerabilities.
Threat actor nomenclature.
CSC exposes subdomain hijacking vulnerabilities.
The Discord Papers.
An update on Russia’s NTC Vulkan.

Iranian threat actor exploits N-day vulnerabilities.

Microsoft this morning reported that the group it's tracked as Phosphorus (and will henceforth refer to as "Mint Sandstorm") has developed a specialty in weaponizing N-day vulnerabilities, that is, vulnerabilities for which a fix or mitigation is available, but which some organizations have failed to patch. It's also been known mostly for reconnaissance and cyberespionage, but that may be changing, as there are signs the group is turning its attention to critical infrastructure. "Mint Sandstorm is known to pursue targets in both the private and public sectors," Microsoft writes, "including political dissidents, activist leaders, the Defense Industrial Base (DIB), journalists, and employees from multiple government agencies, including individuals protesting oppressive regimes in the Middle East. Activity Microsoft tracks as part of the larger Mint Sandstorm group overlaps with public reporting on groups known as APT35, APT42, Charming Kitten, and TA453." Over the past two years the group has been observed to carry out attacks against infrastructure, and Microsoft thinks that its future activities may show a continued lessening of constraint. "Given the hardline consensus among policymakers in Tehran and sanctions previously levied on Iran’s security organizations, Mint Sandstorm subgroups may be less constrained in carrying out malicious cyber activity."

The key to beating ransomware? Use a solution built to defeat ransomware.

Halcyon is the first dedicated, adaptive solution that combines multiple advanced proprietary prevention engines focused specifically on detecting and stopping ransomware. With the fastest endpoint recovery capabilities, multiple layers of resiliency, bypass and evasion protection, automated key capture for swift decryption and data exfiltration prevention, the Halcyon Anti-Ransomware and Resilience Platform reverses the impact of ransomware attacks in just minutes. This is why Halcyon is the resilience platform Global 2000 companies rely on to defeat ransomware.

Threat actor nomenclature.

Why change from Phosphorus to Mint Sandstorm? It's a shift in the way Microsoft names threat actors. Redmond is moving away from giving them elemental names and toward giving them meteorological ones. Henceforth they'll name them as follows:

"Blizzard" will mean Russia.
"Sleet" henceforth stands for North Korea.
"Typhoon" will represent China.
"Sandstorm," as in this first usage, will designate Iranian activity.
"Storm" will be used for "groups in development."
"Tempest" denotes financially motivated groups.
"Tsunami" will be reserved for a "private sector offensive actor."
And, finally, "Flood" will denote an influence operation.

Thus you'll be able to tell the players by the scorecard, without reference to the Periodic Table.

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

CSC exposes subdomain hijacking vulnerabilities.

CSC released its “Subdomain Hijacking Vulnerabilities Report” in which it shows that over 21% of the 400,000 DNS records it queried were likely vulnerable to subdomain hijacking. Subdomain hijacking occurs when threat actors take over a subdomain and use it to host their malicious content, which could lead to further threats like phishing or hosted malware. The report also showed that 63% of the queried DNS records showed a 404 “not found” or 502 “bad gateway” error. CSC explains “DNS records housekeeping is historically one of the most frequently neglected tasks due to a long history of different owners, policies, and vendors.”

The Discord Papers.

The US Department of Defense has decided that the Discord Papers leaks are unlikely to affect relations with allies. The Department is also working to make future leaks of this kind less likely, and less troublesome. The Secretary of Defense has directed "a comprehensive review of DOD security, programs, policies and procedures," with a report due in forty-five days. This study is in addition to ongoing, daily attention to investigating and mitigating the Discord leaks.

Two big questions have arisen in the Discord Papers case. The first involves opportunity: how did the (alleged) leaker have so much access to highly classified information? Vice argues that expanded access is a result of the US assessment that excessive compartmentalization and poor information sharing led to the intelligence failures that enabled the 9/11 terrorist attacks. Increasing information sharing was neither pointless nor necessarily ill-advised, but in this case at least supervision and proper control appear to have been lacking. Inside Defense reports that the Pentagon is tightening up access to classified information.

The second question involves motive: why did the (alleged) leaker do what he (allegedly) did? Politico reports that investigators are looking, so far in vain, for some foreign connection that would make the incident a familiar if regrettable instance of espionage. But it seems increasingly likely that the leaker was motivated by social media cachet, not by cash, or conviction, or compromise.

The FBI has the blogger and podcast host Sarah Bils (nom-d'influence Donbass Devushka) under investigation, the Wall Street Journal reports. Ms Bils appears to have been involved in spreading the information from the Thug Shaker Central Discord community to the broader (but still fringy) Internet. “She is actively under federal investigation,” a US official told the Journal, “but the circumstances of the content of the investigation are unclear at this time.” Ms Bils says she's the victim here, and the Bureau is investigating death threats made against her. “I have been forthright and honest with the FBI and NCIS in regards to what my clearances were and what I had access to, which was literally nothing,” she said to the Journal. “I didn’t leak the documents and they’ve never even been in my possession.”

An update on Russia’s NTC Vulkan: SIGINT, EW, and cyber ops.

Since the end of March, the media have reported on the activities of NTC Vulkan, a corporate threat actor working against OT systems under contract to the Russian government. The Vulkan papers, as the leaks are being called, reveal that Vulkan is engaged in supporting a full range of offensive cyber operations: espionage, disinformation, and disruptive attacks intended to sabotage infrastructure. On Monday Dragos released a study of what the Vulkan Papers mean for that last class of activity: infrastructure disruption. Dragos took as its point of departure the coverage in the Washington Post, and its researchers focused in particular on one of Vulkan’s tools, a malware suite known as Amesit-B. The researchers offered four key takeaways:

First, the papers represent genuine leaks. “Dragos assesses with moderate confidence that the documents reviewed are legitimate and were leaked or stolen from a Russian contracting repository.”
Second, “it is unlikely that these tools and platforms are exclusively used for testing or training purposes.” They represent a real operational capability.
Finally, Amesit-B represents a clear potential threat to the rail transportation and petrochemical sectors. “Modules contained in the Amesit-B platform could allow for a range of impacts in rail and petrochemical environments which could result in physical consequences, including damage to physical equipment or creating unsafe conditions where injury and loss of life are possible.” And what Amesit-B seems designed to do comes from a familiar Russian military intelligence playbook. As Dragos puts it, “The capabilities described are consistent with previous attacks attributed to various units of the Russian Military’s GRU, with tactics, techniques, and procedures (TTP) overlapping with multiple identified threat groups.”

The Amesit-B platform shows an interesting convergence of cyber operations with traditional signals intelligence and electronic warfare operations. And it’s very much a combat support system, intended for battlefield use by a combatant commander.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Notes.

Today's issue includes events affecting Brazil, China, Germany, Greece, Iran, Iraq, Israel, NATO/OTAN, the Netherlands, the Philippines, Poland, Russia, Slovakia, Sudan, Ukraine, the United Kingdom, and the United States.

Dateline Moscow and Kyiv: Vulkan Papers, Discord Papers.

Ukraine at D+418: Cyber potential in the hybrid war. (CyberWire) As attrition gutters on in the Donbass, the Discord Papers continue to prompt speculation about both sides' prospects in Russia's war, and the Vulkan Papers afford some insight into the convergence of EW, SIGINT, and cyber operations.

Russia-Ukraine war: List of key events, day 419 (Al Jazeera) As the conflict enters its 419th day, we take a look at the main developments.

Putin rallies his troops with 2nd Ukraine visit in 2 months (AP NEWS) The Kremlin says Russian President Vladimir Putin has visited headquarters of Russian troops fighting in Ukraine. A video released by the Kremlin showed Putin visiting the command post for Russian forces in southern Ukraine's Kherson province and receiving reports from the top military brass. He then moved by helicopter to the headquarters of the Russian National Guard in Luhansk province. The trip on Monday was Putin’s second to Russian-occupied areas of Ukraine in as many months. On Tuesday, Ukrainian President Volodymyr Zelenskyy made his latest trip to positions near the front line. Zelenskyy's office said he visited units in a Donetsk province city where fierce battles are taking place.

West prepares for Putin to use ‘whatever tools he’s got left’ in Ukraine (the Guardian) Officials ready for nuclear threats and cyber-attacks as part of Russian response to predicted counter-offensive

Austin, defense leaders to meet again at Ramstein to pledge more support for Ukraine (Stars and Stripes) NATO allies and partners have used the contact group forum to hammer out what resources and military weapons to collectively provide to Ukraine since Russia launched its full-scale invasion Feb. 24, 2022.

Ukraine rejects Iraqi offer to mediate talks with Russia (Military Times) Iraq has offered to mediate between Ukraine and Russia to try resolve the war in Europe, but Ukraine’s top diplomat rejected the offer.

Brazil's welcome of Russian minister prompts US blowback (AP NEWS) Russia’s Foreign Minister Sergey Lavrov traveled to the Brazilian capital Monday and expressed gratitude for Brazil’s push for an end to hosilities in Ukraine — even as that same effort has irked both Kyiv and the West, and by afternoon had prompted an unusually sharp rebuke from the White House. Lula has refused to provide weapons to Ukraine while proposing a club of nations including Brazil and China to mediate peace. Following the meeting, the spokesperson for the White House’s National Security Council blasted Brazil’s approach to the war and said officials are parroting Russian and Chinese propaganda without at all looking at the facts.

Egypt nearly supplied rockets to Russia, agreed to arm Ukraine instead, leak shows (Washington Post) THE DISCORD LEAKS | Egypt made detailed plans to export rockets at Moscow’s request, but after a diplomatic offensive from Washington, later approved artillery production for Kyiv

Readout of Secretary of Defense Lloyd J. Austin III's Call With Ukrainian Minister of Defense (U.S. Department of Defense) Secretary of Defense Lloyd J. Austin III spoke with Ukrainian Minister of Defence Oleksii Reznikov to discuss priorities ahead of this week’s Ukraine Defense Contact Group meeting at Ramstein Air

Partnered Commitment to Ukraine Unlikely to be Deterred by Recent Intel Leaks (U.S. Department of Defense) It's unlikely that public knowledge of the contents of recently leaked intelligence documents will affect ongoing efforts by the Ukraine Defense Contact Group to provide security assistance to

Polish PM re-affirms U.S. relations amidst document leak (NBC News) Prime Minister Mateusz Morawiecki says Poland can continue to trust U.S. intelligence following a bilateral meeting with Vice President Kamala Harris.

DOD Assessing Document Disclosures and Implementing Mitigation Measures (U.S. Department of Defense) The Defense Department continues to actively address the incident involving the unauthorized disclosure of classified documents, Deputy Pentagon Press Secretary Sabrina Singh said.

After leak, Pentagon purges some users' access to classified programs, launches security review (Breaking Defense) The review, whose initial findings are due in 45 days, involves DoD CIO John Sherman, who's already been long at work revamping how the Pentagon protects its secrets.

Why Did a 21-Year-Old Guardsman Have Access to State Secrets? (Vice) "I have a feeling that at least one, if not multiple people on the security side were asleep at the wheel."

U.S. officials have examined whether alleged doc leaker had foreign links (POLITICO) While there’s no clear public evidence of a foreign link, the investigators have considered every avenue as they struggle to understand the leaker’s motivations.

The Air Force Loves War Gamers Like Alleged Leaker Teixeira (Military.com) Today, defense contractors make millions of dollars selling AI insider threat systems that are meant to predict which government employee might pose a potential national security threat.

FBI Investigating Ex-Navy Noncommissioned Officer Linked to Pro-Russia Social-Media Account (Wall Street Journal) Sarah Bils is an administrator of the Donbass Devushka account, which disseminated leaked classified documents and sells pro-Russian merchandise.

Pentagon leak suggests Russia honing disinformation drive – report (the Guardian) Latest disclosure includes claims that social media platforms detect false accounts only 1% of the time

Dragos Analyzes Russian Programs Threatening Critical Civilian Infrastructure (Dragos) Dragos reviewed a series of alleged contracts between the Russian Company NTC Vulkan and the Russian Ministry of Defense that were highlighted in a recent press article from the Washington Post. This public intelligence brief outlines the threats to critical infrastructure described in those documents.

Jailed US reporter in Russian court to appeal detention (AP NEWS) Jailed American journalist Evan Gershkovich has appeared in a Moscow court to appeal his detention on spying charges. His detention is part of a sweeping Kremlin crackdown on dissent amid the war in Ukraine. He and the U.S. government strenuously deny the allegations. Journalists and supporters at the courthouse Tuesday caught their first glimpse in weeks of the Wall Street Journal reporter. He is the first U.S. correspondent since the Cold War to be detained in Russia for alleged spying. Russia’s Federal Security Service detained the 31-year-old in Yekaterinburg on March 29 and accused him of trying to obtain classified information about a Russian arms factory.

Russia-Ukraine war live: Putin and Zelenskiy visit troops near frontline (the Guardian) Russian president in southern Kherson region while Ukrainian counterpart seen in Avdiivka

Slovakia joins Poland and Hungary in halting Ukraine grain imports (the Guardian) EU and Kyiv condemn unilateral bans that aim to protect local farmers amid glut and price crash

Attacks, Threats, and Vulnerabilities

Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets (Microsoft Security) Over the past several months, Microsoft has observed a mature subgroup of Mint Sandstorm, an Iranian nation-state actor previously tracked as PHOSPHORUS, refining its tactics, techniques, and procedures (TTPs).

An Iranian hacking group went on the offensive against U.S. targets, Microsoft says (Washington Post) An Iranian government-linked hacking group previously known for its focus on reconnaissance has shifted to targeting U.S. critical infrastructure, potentially with the goal of launching destructive cyberattacks, Microsoft said in a report today.

NSO hacked iPhones without user clicks in 3 new ways, researchers say (Washington Post) Israeli spyware maker NSO Group deployed at least three new “zero-click” hacks against iPhones last year, finding ways to penetrate some of Apple’s latest software, researchers at Citizen Lab have discovered.

Hackers start abusing Action1 RMM in ransomware attacks (BleepingComputer) Security researchers are warning that cybercriminals are increasingly using the Action1 remote access software for persistence on compromised networks and to execute commands, scripts, and binaries.

Hackers abuse Google Command and Control red team tool in attacks (BleepingComputer) The Chinese state-sponsored hacking group APT41 was found abusing the GC2 (Google Command and Control) red teaming tool in data theft attacks against a Taiwanese media and an Italian job search company.

New Domino Malware Used to Deliver Infostealers, Cobalt Strike (Decipher) Researchers believe that the Domino malware is being deployed by former Conti members and has been developed by FIN7, indicating “at least some level of collaboration between the two groups.”

FIN7 and Ex-Conti Cybercrime Gangs Join Forces in Domino Malware Attacks (The Hacker News) Cybercriminal syndicates FIN7 and ex-Conti members have teamed up to launch Domino malware attacks.

FIN7, Former Conti Gang Members Collaborate on 'Domino' Malware (Dark Reading) Members of the former ransomware group are using a FIN7 backdoor to deliver malware —including Cobalt Strike — to victim systems.

New Chameleon Android malware mimics bank, govt, and crypto apps (BleepingComputer) A new Android trojan called 'Chameleon' has been targeting users in Australia and Poland since the start of the year, mimicking the CoinSpot cryptocurrency exchange, an Australian government agency, and the IKO bank.

Beware of The Chameleon: A Sinister New Android Banking Malware That Disguises Itself as ChatGPT (TimesNow) Discovered by the security researchers at Cyble Research & Intelligence Labs (CRIL), this new strain of malware with its ever-changing tactics and advanced capabilities, could be a game-changer for cybercriminals., Technology & Science News, Times Now

Chameleon: A New Android Malware Spotted In The Wild (Cyble) CRIL analyzes the newly discovered Android Banking Trojan "Chameleon" targeting users from Australia and Poland.

Darktrace wrongly added to LockBit ransomware's victim list (SC Media) U.K.-based cybersecurity company Darktrace has refuted being impacted by a ransomware attack after being mistakenly included in the LockBit ransomware operation's leak site, reports The Record, a news site by cybersecurity firm Recorded Future. "None of the LockBit social media posts link to any compromised Darktrace data.

Darktrace confirms LockBit never breached its systems (Cyber Security Connect) Following claims by LockBit that its systems had been compromised, cybersecurity firm Darktrace has stated that it has verified that its systems were never breached. Darktrace issued the statement o

Philippines Police Employee Records Leaked Online in a Massive Data Breach (vpnMentor) Over 1.2M Philippines Police employee records leaked online in massive data breach. Learn more about it and its potential impact on privacy and security.

Ransomware Attack Hits Payments Giant NCR's Datacenter (Infosecurity Magazine) The ransomware attack targeted one of its data centers in Hawaii and affected some PoS products

Payments giant says it is investigating ransomware incident that caused POS outage (Record) Payment processing giant NCR disclosed a ransomware attack this weekend that caused an outage on its point of sale technology used by restaurants, retailers and other businesses.

DFW05 datacenter outage (NCr) NCR Aloha's Status Page - DFW05 datacenter outage.

Hackers publish sensitive employee data stolen during CommScope ransomware attack (TechCrunch) CommScope confirmed it was hit by ransomware after thousands of employees’ Social Security numbers and bank account details leaked online.

Cyber attack: Data from charities stolen in ransomware attack (BBC News) The targeted firm manages data for 140 groups, including some that work with victims of sexual crime.

Rape victims' charities had data stolen in cyber attack on NI company (BelfastLive) The PSNI referred the case to specialist cyber crime detectives

Investigation underway into cyber attack affecting charities for sexual assault survivors (TheJournal.ie) Around 1,000 people being supported by one organisation alone may have been affected.

Capita investigates authenticity of ransomware gang leaks (Record) The UK outsourcing company has not been able to confirm the source of the information released by a ransomware group, a spokesperson told The Record.

Cybersecurity Nightmare in Japan Is Everyone Else’s Problem Too (Bloomberg) Kojima Industries Corp. is a small company and little-known outside Japan, where it produces cup holders, USB sockets and door pockets for car interiors. But its modest role in the automotive supply chain is a critical one. And when the company was hacked in February 2022, it brought Toyota Motor Corp.’s entire production line to a screeching stop.

New CSC Research Finds One in Five DNS Records are Susceptible to Subdomain Hijacking Due to Insufficient Cyber Hygiene | CSC (CSC) CSC announced today that it will complete the acquisition of Intertrust Group, as set out in further detail in the joint press release issued b

CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of

Trends

Pig Butchering Scams: Fastest Growing Mobile Threat | Proofpoint US (Proofpoint) Conversational scams were the fastest-growing mobile threat of 2022, specifically “pig butchering.” Learn about these scams and what to do to defend against them.

Zscaler ThreatLabz Research Shows a Nearly 50% Increase in Phishing Attacks with Education, Finance, and Government Being the Most Targeted (GlobeNewswire News Room) Annual Phishing Report Highlights New and Evolving Phishing Campaigns Resulting from the Rise of AI Platforms, like ChatGPT, Urges Organizations to Adopt a...

The Report on Enterprise Network Transformation 2023 Survey (Aryaka) Insights from CIOs, CISOs, and IT leaders on the evolving market of network security.

New Virtual Intelligence Briefing Research Study Reveals Surprising Results and Emerging Trends in Virtual Private Network Usage (DH2I) This ViB report suggests virtual private network usage is at a saturation point, and software-defined perimeter may be on its way in.

Akamai Research Finds 137 Percent Increase in Application and API Attacks (Akamai) New Report Focuses on Emerging Threats Such as BOLA and SSTI

The State of Data Security: The Hard Truths of Data Security (Rubrik) The newest Rubrik Zero Labs study leverages three distinct datasets to provide objective views of data security in real environment, the threat landscape working against these efforts, and the actual impacts to organizations and people

2023 State of the External Attack Surface Report (CybelAngel) Download CybelAngel's annual cybersecurity report - 2023 State of the External Attack Surface Report.

F-Alert — Discover the latest cyber security news and insights (F-Secure) Get the all-new monthly threats report. Featuring the latest cyber security news and insight.

Rubrik Zero Labs Finds Only 16% of Organizations Recovered All Data Via Attacker Decryption Tools After Paying Ransomware Demand (GlobeNewswire News Room) 93% of organizations reported encountering significant issues with their backup and recovery solutionsNine out of ten organizations reported malicious...

Europe, Cyber and the Cloud: A View from the International Cybersecurity Forum (GovTech) As a keynote speaker and multiday attendee at Europe’s largest cybersecurity conference, here are some of my top takeaways from a thought-provoking, global event with a distinctly European flare.

Marketplace

Mobb raises $5.4 million and launches community tool (Help Net Security) Mobb has raised $5.4M and has also launched a free version for developers to test its vulnerability remediation technology.

Maltego Secures $100M to Accelerate Growth of its Intelligence Platform to Combat Cybercrime and Misinformation (GlobeNewswire News Room) Boston-based Charlesbank Plans to Boost Product Development and Global Expansion for Munich-based Intelligence Platform...

Safe Security Raises $50 Million Series B Round for AI-Driven Platform to Manage and Mitigate Cyber Risk (PR Newswire) Safe Security, the leader in AI-based cyber risk management SaaS platforms, today announced the close of a $50 million Series B round led by...

SpecterOps Raises $25M to Accelerate Company Growth and Expand Attack Path Management Solutions (Business WIre) Investment will drive the company’s next phase of expansion across the BloodHound Enterprise and FOSS platforms, security consulting services, research and more

Safe Security Raises $50 Million in Series B Round (Wall Street Journal) The cybersecurity company has raised $50 million in Series B financing as insurers and regulators drive efforts to assess cyber risk, boosting interest in its wares.

Allurity acquires two new cybersecurity companies and advances its goal of becoming a European cybersecurity giant (Pressat) Allurity Group acquires the Portuguese company CloudComputing and the Swiss company Securix

Radiant Logic Finalizes Acquisition of Brainwave GRC (Business Wire) Joint Company Vision Includes Industry-first Identity Data Management Approach

CTM360 Makes North American Debut at RSA Conference 2023 (Business Wire) North American launch of the only fully consolidated platform for External Attack Surface Management, Digital Risk Protection and Cyber Threat Intelligence. Actively recruiting for its North American expansion

Offensive cyber company QuaDream shutting down amidst spyware accusations (CTech) It was reported last week that the Israeli firm's hacking tools have been used against journalists, opposition figures and advocacy organizations across at least 10 countries

Cenlar Appoints Theodore Mugnier Director of Information Security (Business Wire) Cenlar FSB, the nation’s leading mortgage loan subservicer, announced today that Theodore “Ted” Mugnier has joined the company as Director of Information Security.

Sentra Strengthens Advisory Board with Appointment of Fortune 500 Security Leader, Shaun Marion (PR Newswire) Sentra, a cloud data security company, today announced that Shaun Marion, vice president and chief information security officer (CISO) at...

6clicks Appoints John Meacock, Formerly Deloitte Global Chief Strategy Officer, As New Chairman of the Board (PR Newswire) 6clicks, the leading AI-powered GRC platform for businesses and advisors, today announced that John Meacock, previously Global Chief Strategy...

Netacea Promotes Joe Murray to SVP of Partnerships (PR Fire) Murray to oversee the company’s rapidly evolving strategic partner programme for its enterprise bot protection platform with a focus on expanding its network of MSSP and technology partnerships

Styra Selects Industry Champion Mark Pundsack as CEO (Business Wire) Pundsack brings exceptional product strategy and industry-leading DevOps expertise from GitLab growth years to Styra.

Akeyless Security names former Palo Alto Networks executive Suresh Sathyamurthy as Chief Marketing Officer (Yahoo Finance) Akeyless Security, the leading provider of SaaS-based secrets management, announced today that it has appointed Suresh Sathyamurthy as its Chief Marketing Officer. Sathyamurthy, a seasoned marketing executive who previously held marketing and product leadership roles at Palo Alto Networks, Dell EMC, and other leading companies, will head growth initiatives and increase brand awareness for the Akeyless Vault Platform.

Products, Services, and Solutions

Cycode Launches New Application Security Orchestration and Collaboration (ASOC) Solution (Cycode) Organizations are struggling to manage and secure their development infrastructure. The number of development tools in modern software delivery pipelines has exploded.

Imperva® and Fortanix Partner to Protect Confidential Customer Data (Business Wire) Imperva Data Security Fabric and Fortanix Data Security Manager combine to provide end-to-end data security

Sumo Logic Helps Control the Chaos by Enhancing Predictive Analytics for Observability (GlobeNewswire News Room) Predicts variable cloud resource needs during production and managing the reliability of digital services...

Sumo Logic Marks Milestone in OpenTelemetry Posture Removing Complexity in Collection for Faster Time to Insights (GlobeNewswire News Room) Reinforces commitment to OpenTelemetry strategy, removes complexity in collection and normalization across data types for OTel native experiences...

CRITICALSTART® Announces Expansion of its Security Services for SIEM with Sumo Logic® (PR Newswire) Today, Critical Start, a leading provider of Managed Detection and Response (MDR) cybersecurity solutions, announced the expansion of its...

Risco Promotes Cost-Effective Installations With Preview Of Professional Wireless And Smart Automation Solutions At The Security Event 2023 (Security Informed) Two new RISCO professional security solutions will be previewed at The Security Event 2023, providing installers with the opportunity to deliver commercial and residential projects efficiently and cost-effectively.

Illumio Launches Zero Trust Segmentation ROI Calculator to Help Organizations Maximize Cyber Investments (GlobeNewswire News Room) Illumio ZTS platform delivered 111 percent return on investment and 66 percent reduction in blast radius...

Baffle Streamlines Data Protection For Databases (GlobeNewswire News Room) With field-level protection, companies can secure sensitive data from creation to production to meet global compliance standards without significant cost...

Veracode Introduces Intelligent Software Security with Launch of Veracode Fix (Veracode) Veracode, a leading provider of intelligent software security solutions, today launches Veracode Fix, a new AI-powered product. Trained on Veracode’s proprietary dataset, Veracode Fix suggests remediations for security flaws found in code and open-source dependencies.

Cycode Launches Application Security Orchestration and Correlation Solution to Streamline Vulnerability Testing and Remediation (GlobeNewswire News Room) Cycode, the leader in software supply chain security, today announced the launch of Cycode Application...

Kasten by Veeam Names Inaugural Partners for KubeCampus.io Kubernetes Learning Platform (Kasten) Kasten by Veeam Names Inaugural Partners for KubeCampus.io Kubernetes Learning Platform

Bolster Releases 'Insights' Reporting to Deliver Instant Visibility and Performance Analytics into an Organization's Digital Risk Landscape (PR Newswire) Bolster Inc., the automated digital risk protection company, today released Bolster Insights, a new module that provides organizations with...

Tanium Expands into the New Digital Employee Experience Category To Help Organizations Increase Employee Satisfaction and Productivity (Tanium) Tanium today unveiled its digital employee experience (DEX) solution, which helps IT leaders continuously measure and improve the technology experience that companies offer to their employees.

CIP Audits of Energy Industry Networks (Business Wire) Network Perception, innovators of operational technology (OT) solutions that protect mission-critical assets, and NAES Corporation, the energy industry’s largest independent provider of operations, maintenance and repair services, have announced a technical partnership making Network Perception’s best-in-class network audit technology immediately available to the fleet of NAES customers.

Laminar Adds Google Cloud, Snowflake Support and Becomes First Cloud-native Data Security Platform to Fully Support the Four Largest Cloud Data Providers (Business Wire) Adding Google Cloud and Snowflake to its existing AWS and Azure support enables Laminar to provide comprehensive data protection for multi-cloud data organizations

ThreatQuotient Launches ThreatQ Academy Including New Online Certification Program to Address Security Skills Gaps (Business Wire) Self-paced training modules accelerate user proficiency of the ThreatQ Platform for any operational need, ensuring immediate return on investment for ThreatQuotient clients and partners

Delinea Announces Delinea Unlocked 2023 to Foster Global Channel Success (PR Newswire) Delinea, a leading provider of solutions that seamlessly extend Privileged Access Management (PAM), today announced Delinea Unlocked, a series...

Netskope Announces ZTNA Next, A Landmark in Private Access, Delivering on the Promise of 100% Legacy VPN Retirement (Netskope) Industry’s first unified SASE Client successfully converges Netskope Private Access (NPA) ZTNA with Netskope Endpoint SD-WAN for optimal security and

Aravo Strategic Alignment Framework™ Guides Customers Throughout Their Third-Party Risk Management Journey (GlobeNewswire News Room) Methodology Based on Industry Best Practices Aligns Cross-Functional Teams and Delivers a Program Charter and Playbook...

NetRise and Qwiet AI Align to Find and Fix Vulnerabilities from Firmware to Application Code (PR Newswire) NetRise, the company solving the world's XIoT security problem, announced today an integration partnership with Qwiet AI, the first in the...

CybeReady Unveils Advanced Data-Driven Analytics to Revolutionize Cybersecurity Awareness Training (EIN Presswire) Company to Showcase PhishCage Analytics with Deep Visualization for Enhanced Security Awareness at RSAC 2023

Veridas Facial Biometrics Among The Four Best in the World According to NIST (Business Wire) Veridas has achieved its best result in the most demanding category possible: the evaluation of one among many (1:N) with a sample size (N) of 12 million

Daon Launches SaaS-Based Platform for Identity Proofing and Authentication (Business Wire) Next-gen platform provides rapid deployment of workflows leveraging no-code orchestration

GitLab and Oracle Expand Strategic Collaboration With AI/ML Offering (GlobeNewswire News Room) New offering enables developers to bolster AI/ML practices to speed up model training and inference, delivering software faster and more cost-effectively...

Technologies, Techniques, and Standards

CISA Releases Software Bill of Materials (SBOM) Sharing Lifecycle Report | CISA (Cybersecurity and Infrastructure Security Agency CISA) CISA has released the SBOM Sharing Lifecycle Report to the cybersecurity and supply chain community. The purpose of this report is to enumerate and describe the different parties and phases of the SBOM Sharing Lifecycle and to assist readers in choosing suitable SBOM sharing solutions based on the amount of time, resources, subject-matter expertise, effort, and access to tooling that is available to the reader to implement a phase of the SBOM sharing lifecycle.

Castles Built on Sand: Towards Securing the Open-Source Software Ecosystem (Institute for Security and Technology) This report advocates shifting open-source software security to a shared responsibility model, redoubling support for existing secure software development frameworks, policies, and licenses, and reexamining approaches to vulnerability management and mitigation to ensure they account for open-source software.

Object Management Group Announces DDS Extensions for TSN (Object Management Group) Press Release: Learn how the Financial Industry Data Transparency Act Affects Business.

New study finds passwords following industry-standard requirements no longer secure (Hive Systems) Hive System research finds most passwords can be hacked instantaneously

Design and Innovation

OpenAI’s CEO Says the Age of Giant AI Models Is Already Over (WIRED) Sam Altman says the research strategy that birthed ChatGPT is played out and future strides in artificial intelligence will require new ideas.

Hype grows over “autonomous” AI agents that loop GPT-4 outputs (Ars Technica) AutoGPT and BabyAGI run GPT AI agents to complete complex tasks iteratively.

Legislation, Policy, and Regulation

Germany to examine China-made kit in its 5G networks (Register) Do you like American music? I like American music

Dutch intel agency paints grim picture of multiple threats (AP NEWS) The Dutch national intelligence agency has painted a grim picture of a growing number of internal and external threats to the rule of law in the Netherlands compounded by Russia’s war in Ukraine, international cyber attacks and espionage. In its annual report, the General Intelligence and Security Service on Monday called China “the biggest threat to the Netherlands’ economic security.” The agency's director-general says that China is targeting the Netherlands as an innovative country that develops new technology. He says that "every day they try to steal that from the Netherlands.”

Greek opposition asks if government exported ‘Predator’ to Sudan (Euractiv) Greece’s main opposition leftist Syriza party on Sunday asked the government whether it has exported Predator illegal spyware to Sudan, which currently is on the verge of civil war.

Lawmakers concerned with social media platforms, as criminals are stealing sensitive information (WCNC) Criminals are taking social media by storm, creating malware through different platforms to steal sensitive information.

onShore Security Endorses Plans to Curb Proliferation of Cyber Mercenaries (Newswire) Five Principles Serve as Call to Action and Set Standard for Responsible Industry Practice

Bailey Bickley Promoted to NSA DIB Defense Chief (Executive Gov) Looking for the latest Government Contracting News? Read about Bailey Bickley Promoted to NSA DIB Defense Chief.

Kiersten Todt Departing as CISA Chief of Staff and Kathryn Coulter Mitchell to Become New Chief of Staff (Cybersecurity and Infrastructure Security Agency) The Cybersecurity and Infrastructure Security Agency (CISA) announced today that Kiersten Todt will be departing from her role as CISA Chief of Staff to return to the private sector, while continuing to work with Director Easterly and the agency in a senior advisory capacity.

Litigation, Investigation, and Law Enforcement

F.B.I. Arrests Two on Charges Tied to Chinese Police Outpost in New York (New York Times) Federal prosecutors in Brooklyn charged the men with conspiring with the Chinese government and destroying evidence.

U.S. alleges secret Chinese police post in NYC, online tracking of dissidents (Washington Post) Two New York residents were arrested, and dozens of Chinese national police officers were criminally charged

ICE Records Reveal How Agents Abuse Access to Secret Data (WIRED) Documents obtained by WIRED detail hundreds of investigations by the US agency into alleged database misuse that includes harassment, stalking, and more.

Crooks’ Mistaken Bet on Encrypted Phones (The New Yorker) Drug syndicates and other criminal groups bought into the idea that a new kind of phone network couldn’t be infiltrated by cops. They were wrong—big time.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

US Cyber Open® Kick-Off Event (Virtual, Jun 1, 2023) US Cyber Open Kick-Off Event. SEASON III WHAT ARE THE US CYBER GAMES ALL ABOUT? -Why should I get into a career in cybersecurity? -What's the key to making the US Cyber Team? -Who are the coaches for Season III? Learn about these and more during our Season III Kick-Off event.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Apr 14 - 21, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now!

SANS Pen Test Austin 2023 (Austin (and virtual), Texas, USA, Apr 17 - 22, 2023) SANS Pen Test Austin 2023 is six days of in-depth, hands-on penetration testing, red teaming, purple teaming, and exploit development training for professionals who need to know how to find vulnerabilities within their organizations, understand risk, and prioritize resources based on potential real-world attacks. This event isn't just for penetration testers or red team members; it is for any information security professional who wants to understand the mindset, tools, and techniques used by those who intrude where they don't belong. If you like to break things, put them back together, find out how they work, and mimic the actions of real-world bad guys—all the while providing real business value to your organization—this event is for you! View the line-up of cutting-edge offensive operations courses, and register now to learn from leading industry experts.

9th Annual Cybersecurity Conference for Executives (Baltimore, Maryland, USA, Apr 18, 2023) The 9th Annual Cybersecurity Conference for Executives, hosted by Ankura and the Johns Hopkins University Information Security Institute, will foster an open learning environment for C-suite executives, IT and security directors, risk managers, legal/compliance directors, and more across all industries. The world of regulatory compliance is becoming increasingly more complex, as privacy and cybersecurity requirements are enforced both nationally and overseas. With regulations such as GDPR, CCPA, CMMC, SEC, HIPAA, and more, executive leaders are challenged to identify the applicable controls for their organization and ensure compliance.

Election Threats: Past, Present, & Future (Virtual, Apr 19, 2023) Join us virtually on April 19th from 12:00 PM - 1:00 PM. Experts will explore both historical and current domestic threats to our election security: Michael Chertoff, Co-Founder and Executive Chairman, The Chertoff Group; Mary McCord, Executive Director of the Institute for Constitutional Advocacy and Protection, Visiting Professor of Law at Georgetown University Law Center; and David Laufman, Partner, Wiggin and Dana LLP. Moderated by David Hickton, Founding Director, Pitt Cyber. Presented by Pitt Cyber, in partnership with The Azure Forum, CSIS, and Keep Our Republic.

Gender Digital Divide Community Forum: Views From Central & Eastern Europe (New York, New York, USA, Apr 19, 2023) Czechitas, the Consulate General of the Czech Republic in New York and CzechInvest invite you to a community forum on the gender digital divide in Central and Eastern Europe. Forum guests will learn first-hand about women‘s technology challenges and opportunities across the CEE region. Participants will also share cross-border insights with experts on empowering women through technology for economic growth and educational success. Networking with coffee and light refreshments included, so remember to bring your business cards! Event is free, but RSVP is required.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.