Play ransomware's new tools. Warnings of GRU cyber ops. US Air Force investigates alleged leaker's ANG wing. Passwordless MFA.

Summary

By the CyberWire staff

At a glance.

Play ransomware's new tools.
Fancy Bear, out and about.
Other GRU activity: more on Sandworm (a.k.a. FROZENBARENTS).
Ransomware in Russia's war against Ukraine.
US Air Force opens investigation into alleged leaker's ANG wing.
Passwordless MFA solutions are coming.

Play ransomware's new tools.

Symantec, part of Broadcom Software, shared this morning their observation of two new tools the Play ransomware gang is using. The tools include an infostealer, “Grixba,” as well as a Volume Shadow Copy Service, or VSS, copying tool. Grixba is “a network scanning tool used to enumerate all users and computers in the domain.” The tool was developed using “a popular .NET development tool for embedding and applications dependencies into a single executable file,” known as Costura.

Also developed using Costura was another executable, a VSS copying tool that the researchers say “embeds the library AlphaVSS into executables. The AlphaVSS library is a.NET framework that provides a high-level interface for interacting with VSS. The library makes it easier for .NET programs to interface with VSS by offering a set of controlled APIs.” This tool allows for the threat actors to copy files normally blocked by the OS. For more on new developments in Play, see CyberWire Pro.

The key to beating ransomware? Use a solution built to defeat ransomware.

Halcyon is the first dedicated, adaptive solution that combines multiple advanced proprietary prevention engines focused specifically on detecting and stopping ransomware. With the fastest endpoint recovery capabilities, multiple layers of resiliency, bypass and evasion protection, automated key capture for swift decryption and data exfiltration prevention, the Halcyon Anti-Ransomware and Resilience Platform reverses the impact of ransomware attacks in just minutes. This is why Halcyon is the resilience platform Global 2000 companies rely on to defeat ransomware.

I spy, with (at least two of) my Five Eyes, a Fancy Bear.

The GRU's exploitation of vulnerable Cisco routers has drawn a joint warning from UK and US intelligence agencies. "The UK National Cyber Security Centre (NCSC), the US National Security Agency (NSA), US Cybersecurity and Infrastructure Security Agency (CISA) and US Federal Bureau of Investigation (FBI) are releasing this joint advisory to provide details of tactics, techniques and procedures (TTPs) associated with APT28’s exploitation of Cisco routers in 2021. We assess that APT28 is almost certainly the Russian General Staff Main Intelligence Directorate (GRU) 85th special Service Centre (GTsSS) Military Intelligence Unit 26165. APT28 (also known as Fancy Bear, STRONTIUM, Pawn Storm, the Sednit Gang and Sofacy) is a highly skilled threat actor."

The vulnerability Fancy Bear has taken advantage of since 2021 at least is CVE-2017-6742 (Cisco Bug ID: CSCve54313). Cisco announced the vulnerability in June 2017 and issued patches and mitigations. Cisco Talos yesterday published its appraisal of the threat:

"Because of the large presence of Cisco network infrastructure around the world, any sustained attack against network infrastructure would likely target Cisco equipment, but attacks are by no means limited to Cisco hardware. In reporting on Russian intelligence contracting documents, samples of which were recently shared with Cisco Talos, it was shown that any infrastructure brand would be targeted, with one scanning component targeting almost 20 different router and switch manufacturers (see the image below). Looking at past research, in 2018 Talos looked into the VPNFilter threat, also believed to be of Russian origin, which showed a well-developed capability targeting Asus, Huawei, Linksys, MikroTik, Netgear, QNAP, TP-LINK, Ubiquiti, and Upvel devices."

Cisco Talos also points out that Russia isn't the only nation-state whose intelligence services are collecting in this manner. China has also been active. Much of the exploitation, Cisco Talos says, has been post-compromise, enabled by stolen credentials. Both Cisco and the British and American intelligence agencies who issued the joint warning offer sound advice for reducing risk.

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

Other GRU activity: more on Sandworm (a.k.a. FROZENBARENTS).

Google's Threat Analysis Group this morning published an update on what it's observed recently from Russia's Sandworm (or, as Google calls it, FROZENBARENTS) a well-known group associated with the GRU's Unit 74455. Its activities continue to include intelligence collection, information operations, and leaks of stolen data over Telegram. "As we described in the Fog of War report, FROZENBARENTS remains the most versatile GRU cyber actor with offensive capabilities including credential phishing, mobile activity, malware, external exploitation of services, and beyond. They target sectors of interest for Russian intelligence collection including government, defense, energy, transportation/logistics, education and humanitarian organizations." One of FROZENBARENTS's favored modes of gaining access to its targets is exploitation of vulnerable EXIM mail servers.

Among the information operations Google describes are those mounted by the CyberArmyofRussia and the CyberArmyofRussia_Reborn, both of which are now clearly identifiable as front groups, fictitious identities created, operated, and maintained by the GRU. "The CyberArmyofRussia_Reborn Telegram channel has primarily been used for posting stolen data and DDoS targets. In several recent incidents, FROZENBARENTS compromised a webserver of the target organization and uploaded a webshell to maintain persistent access to the compromised system. The attackers then deployed Adminer, a single file PHP script for managing databases, to exfiltrate data of interest. Shortly after exfiltration, the data appeared on the CyberArmyofRussia_Reborn Telegram channel." Among the favored narratives boosted by the GRU fronts has been the long-running false claim that biological weapons have been used in Ukraine, and that this has been done at the instigation of the US, which is (falsely) claimed to be responsible for the proliferation of biological warfare agents around the world.

Ransomware in Russia's war against Ukraine.

Citing other research by Google's Mandiant unit, Breaking Defense reports that Russia's GRU has increasingly turned to ransomware. This is read as either a sign of weakness (“GRU’s shift to using ransomware may be a sign they are undergoing tooling shifts and don’t have the resources to rely on writing or modifying custom malware") or as possible misdirection, shifting attention away from Russia's military intelligence service and toward conventional, financially motivated criminals.

Mandiant's report explains, "The most recent phase of operations was characterized by a resurgence in disruptive cyber attacks in Ukraine. Though some of the attacks appeared similar to disruptive attacks seen in previous phases, this new wave of disruptive attacks appeared to deviate from the historical norm. Earlier attempts relied on quick turnaround operations using CADDYWIPER variants, but the attacks undertaken in October to December saw GRU clusters deploying ransomware variants on targeted networks. This shift is consistent with Microsoft’s reporting on the Prestige (PRESSTEA) ransomware deployment by IRIDIUM in Poland. Though the cycle of access and action appears to have continued during this phase, GRU’s shift to using ransomware may be a sign they are undergoing tooling shifts and don’t have the resources to rely on writing or modifying custom malware."

US Air Force opens investigation into alleged leaker's ANG wing.

The Secretary of the Air Force has directed the Service's Inspector General to open an investigation into compliance with safeguards for classified material at the 102nd Intelligence Wing, the organization to which Airman 1st Class Jack Teixeira, the accused Discord Papers leaker, had belonged. "The Secretary of the Air Force directed the Department of the Air Force inspector general to investigate overall compliance with policy, procedures and standards, including the unit environment and compliance at the 102nd Intelligence Wing related to the release of national security information," an Air Force representative told Military.com. Air Force Secretary Frank Kendall appeared before the Senate Appropriations Defense Subcommittee yesterday to explain the ongoing investigation, Air & Space Forces Magazine reports. “There is a full-court press going on about this,” Secretary Kendall said in his testimony. “We are all disturbed about it and we are working very very hard to get to the bottom of it and take corrective action.”

Until further notice, the 102nd Intelligence Wing has lost its mission, the AP reports. The Air Force told the AP, “The 102nd Intelligence Wing is not currently performing its assigned intelligence mission. The mission has been temporarily reassigned to other organizations within the Air Force.” The wing's website describes that now suspended mission: "To provide world wide precision intelligence and command and control along with trained and experienced Airmen for expeditionary combat support and homeland security."

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Passwordless MFA solutions are coming.

SecureAuth has released its State of Authentication Report, and it forecasts more passwordless solutions to multifactor authentication (MFA) in the near term. The report includes survey results from 285 IT professionals from various companies in the sector.Traditional MFAs are widely considered to be vulnerable to “MFA bombing” and man-in-the-middle attacks. 50% of the IT professionals who responded regarded legacy MFA approaches as vulnerable. “Most respondents picked One-Time-Passwords or OTPs with 38% selecting that as one of the methods. The next most popular passwordless technologies were PINs (27%) and biometrics, which was tied with security keys at 26%.” When asked what their plans were for updating MFA for their companies they found that 65% of the IT professionals they surveyed were “planning on implementing passwordless technologies in the next 24 months. Nearly a third are planning to do so in the next six months, and another third are looking at the 12-24 month horizon.”

Dateline

Ukraine at D+419: GRU cyber ops scrutinized. (CyberWire) Much dissection of current Russian cyber operations, even as Ukraine receives essential weapons and prepares its (kinetic) counteroffensive.

Russia 'preparing to retreat' from parts of Kherson (The Telegraph) Russia appears to be preparing a retreat from some areas of Kherson, a Ukraine military spokeswoman said on Tuesday.

‘It was scary’: acts of resistance in Russian-occupied Kherson (the Guardian) Risky actions of Ukraine’s secretive grassroots Yellow Ribbon movement recalled in Brussels exhibition

Ukraine official: We will launch counteroffensive when ready (AP NEWS) A top Ukrainian official says that Ukraine will launch its counteroffensive against Russian troops when the country is ready. The secretary of Ukraine’s National Security and Defense Council told The Associated Press in an interview in Kyiv on Monday that it’s only a matter of time before Ukraine achieves the necessary level of military preparedness to do so. Oleksiy Danilov also expressed frustration that sometimes officials from allied countries “promise one thing and do a completely different one.” He didn't elaborate.

Ukraine awaits Patriot air defense systems as deadly Russian strikes continue (PBS NewsHour) The death toll from Russian missile strikes on eastern Ukraine's city of Sloviansk rose to 11 Saturday as rescue crews tried to reach people trapped in the rubble of an apartment building, Ukrainian authorities said.

Russia-Ukraine war live: Kyiv receives Patriot missile systems from US and Germany (the Guardian) Ukraine defence minister said he had first lobbied for the Patriots in August 2021, before the invasion

Former senior diplomats urge west to ‘go all in’ on military support for Ukraine (the Guardian) Group also made up of former high-level military advisers say ‘actions still fail to match the rhetoric’

Two Russians claiming to be former Wagner commanders admit killing children and civilians in Ukraine (CNN) Two Russian men who claim to be former Wagner Group commanders have told a human rights activist that they killed children and civilians during their time in Ukraine.

‘I do not regret a thing’: Wagner fighter admits torturing Ukrainian troops and PoWs (the Guardian) Former convict tells of torturing troops and says he does ‘not regret a single thing’

Russia’s Ukraine invasion is the latest stage in the unfinished Soviet collapse (Atlantic Council) Vladimir Putin's full-scale invasion of Ukraine is best understood as the latest stage in the unfinished collapse of the Soviet Union and as part of Russia's historic retreat from empire, argues Richard Cashman.

Don’t Dismiss Non-Western Efforts to End the War in Ukraine (World Politics Review) While in China, Brazilian President Lula talked up the idea of a non-Western coalition leading peace talks to end the Russia-Ukraine War.

Air Force unit in document leaks case loses intel mission (AP NEWS) The Air Force says it is investigating how a lone airman could access and distribute possibly hundreds of highly classified documents, and in the meantime has taken away the intelligence mission from the unit where the leaks took place. Air Force Secretary Frank Kendall told a congressional panel he directed the Air Force inspector general to go look at the Massachusetts Air National Guard base where Airman 1st Class Jack Teixeira served and determine what went wrong to allow such highly classified secrets to be leaked onto an online chat forum popular with gamers.

Pentagon Details Review of Policies for Handling Classified Information (New York Times) The Air Force also announced actions focused on security protocols following the arrest of an Air National Guardsman accused of posting classified documents online.

Kendall Promises ‘Full-Court Press’ Security Review After Intel Leak (Air & Space Forces Magazine) Air Force Secretary Frank Kendall said the department will conduct a security review after an intel leak allegedly involving an Airman.

Air Force Launches Investigation of Teixeira's Guard Unit After Leak Arrest (Military.com) The Department of the Air Force's review is in addition to the one the Pentagon announced following Teixeira's arrest

Russia tests secretive weapon to target SpaceX’s Starlink in Ukraine (Washington Post) THE DISCORD LEAKS | Moscow’s bid to sever Ukrainian forces’ internet access is more sophisticated than previously known, leaked document shows

Russia-Tied Hackers Target Key UK Sectors, Top Official Warns (Bloomberg) UK official to call for tougher cyber rules for key sectors. Hackers tied to Russia have been targeting UK businesses.

Russia-linked cyber attack groups want to 'destroy' UK, minister warns (Sky News) Firms have urged to beef up their cyber security to protect the country from "ideologically motivated, rather than financially motivated" enemies who have started to target the UK.

NCSC-UK, NSA, and Partners Advise about APT28 Exploitation of Cisco Routers (National Security Agency/Central Security Service) The National Security Agency (NSA) has partnered with the UK’s National Cyber Security Centre (NCSC), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security

APT28 exploits known vulnerability to carry out reconnaissance and deploy malware on Cisco routers (NCSC) APT28 accesses poorly maintained Cisco routers and deploys malware on unpatched devices using CVE-2017-6742.

State-sponsored campaigns target global network infrastructure (Cisco Talos Blog) This campaign, dubbed "Jaguar Tooth," is an example of a much broader trend of sophisticated adversaries targeting networking infrastructure to advance espionage objectives or pre-position for future destructive activity.

US, UK warn of govt hackers using custom malware on Cisco routers (BleepingComputer) The US, UK, and Cisco are warning of Russian state-sponsored APT28 hackers deploying a custom malware named 'Jaguar Tooth' on Cisco IOS routers, allowing unauthenticated access to the device.

Patched holes in Cisco routers have been used by Russians for years: Report (IT World Canada) Russian government attackers have been exploiting unpatched and badly-configured Cisco Systems routers since 2021, according to an alert from U.S. and U.K. cybersecurity agencies. The vulnerabilities, which were publicized and patched in 2017, are in the Simple Network Management Protocol (SNMP) subsystem of Cisco's IOS and IOS XE Software. They could allow an authenticated remote

Cisco warns of attacks on network routers, firewalls (Network World) Cisco's Talos intelligence group's warning follows a UK notice about increasing exploits against perimeter-based networking equipment.

Ukraine remains Russia’s biggest cyber focus in 2023 (Google) Google's Threat Analysis Group shares first quarter cyber updates on the threat landscape from the war in Ukraine.

Fog of War: How the Ukraine Conflict Transformed the Cyber Threat Landscape (Google Threat Analysis Group) One year after the Russian invasion of Ukraine, Google TAG, Mandiant, and Trust & Safety provide insights into changes in the cyber threat landscape triggered by the war.

M-Trends 2023: Cybersecurity Insights From the Frontlines (Mandiant) We are excited to release M-Trends 2023, our comprehensive report from the frontlines of incident response.

Faltering against Ukraine, Russian hackers resort to ransomware: Researchers (Breaking Defense) Both the quantity and quality of Russian attacks appear to be falling off, and the global cybersecurity picture is looking brighter, reports Google Cloud’s Mandiant branch.

Putin threatens Europe with fresh gas crisis (The Telegraph) Fears over a new surge in prices as Russia's Gazprom warns over winter supplies

Ukrainian victory “could help ensure Europe’s future energy security” (Atlantic Council) Ukraine has massive potential to increase domestic energy production and could eventually replace Russian energy exports to the European Union in the post-war era, says Naftogaz CEO Oleksiy Chernyshov.

Vladimir Kara-Murza’s 25-year sentence is a verdict against all Russians (Atlantic Council) Vladimir Kara-Murza's 25-year prison sentence for speaking the truth about the invasion of Ukraine is a major milestone in modern Russia's descent into Stalinism, says former Ukrainian PM Arseniy Yatsenyuk.

Attacks, Threats, and Vulnerabilities

Chinese group Vixen Panda suspected of recent cyberattack on Slovenian Foreign Ministry (teiss) Chinese hacker group Vixen Panda (also known as APT15 group), one of the most active and skilled cyber espionage groups, is suspected of the recent cyberattack on Slovenian Foreign Ministry.

Deceptive ‘Vibranced’ npm Package Discovered Masquerading as Popular ‘Colors’ Package (Mend) A new malicious package named 'Vibranced' has been detected on the Node Package Manager (npm) repository and poses a significant threat to users who may unknowingly install it. The package has been carefully crafted to mimic the popular ‘colors’ package.

LockBit for Mac | How Real is the Risk of macOS Ransomware? (SentinelOne) Discovery of a macOS variant of LockBit has caused alarm, but how serious a threat is it? We explore the malware and the threat of ransomware on Apple Macs.

What Makes Invalid Printer Loader so Stealthy? (Morphisec Breach Prevention Blog) The Aurora stealer is a notorious Golang-based information stealer that's been gaining popularity from the end of 2022 through the first quarter of 2023. The Morphisec Threat Labs team has been tracing its activities using our prevention telemetry...

YouTube Videos Distributing Aurora Stealer Malware via Highly Evasive Loader (The Hacker News) A new report has revealed the advanced techniques used by threat actors to deliver the Aurora information stealer malware through the in2al5d p3in4er

Detecting the Use of Stolen AWS Lambda Credentials (Secureworks) Secureworks® Counter Threat Unit™ (CTU) researchers have developed a technique using AWS CloudTrail to detect the use of stolen credentials.

#BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services (Wiz Blog) A container escape vulnerability, combined with accidental 'write' permissions to a private registry, opened a backdoor for Wiz Research to access Alibaba Cloud databases and potentially compromise its services through a supply-chain attack

Giving a Face to the Malware Proxy Service ‘Faceless’ (KrebsOnSecurity) For the past seven years, a malware-based proxy service known as "Faceless" has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised…

NSO hacked iPhones without user clicks in 3 new ways, researchers say (Washington Post) Examination of phones from Mexico led to the discoveries

Discarded, not destroyed: Old routers reveal corporate secrets | WeLiveSecurity (WeLiveSecurity) Secondary market core routers are often not wiped clean and are replete with sensitive, even confidential, data, according to ESET research.

Used Routers Often Come Loaded With Corporate Secrets (WIRED) More than half of the enterprise routers researchers bought secondhand hadn’t been wiped, exposing sensitive info like login credentials and customer data.

in2al5d p3in4er is Almost Completely Undetectable (Morphisec) in2al5d p3in4er is a highly evasive new loader that has a detection ratio of 0 on VirusTotal. We explain how it works, and how to prevent it.

Black Basta claims it's selling off stolen Capita data (Register) No worries, outsourcer only handles government tech contracts worth billions

Hundreds of Southwest Airlines flights are delayed after FAA lifts nationwide ground stop (CNN) Hundreds of Southwest Airlines flights were delayed after technical issues that prompted the airline to temporarily halt its operations on Tuesday morning.

Southeastern University Faces Questions About a Possible Data Breach Following Cybersecurity Incident | JD Supra (JD Supra) In February 2023, reports began to surface that Southeastern University (“Southeastern”) experienced a cybersecurity incident following comments made...

DC Health Link data breach blamed on human error (ABC News) The recent data breach of personal information for thousands of users of Washington, DC....

Personal info tied to 17 House members, 585 staffers leaked in D.C. health insurance breach (Axios) DC Health Link's executive director will tell a House committee that a misconfigured cloud server is to blame.

Scammer targets state employees with phony attorney general emails (NorthJersey.com) Workers were targeted by a phishing scam that used emails cleverly disguised with a domain name matching that of the Attorney General's Office.

Cyber Attack Closes Down Gateway’s 14 Ontario Casinos (VegasSlotsOnline News) After a cyber attack, 14 Gateway casinos in Ontario, including those in London and Thunder Bay, will remain closed for some days.

No evidence found of Little Rock School District data use (Arkansas Online) The Little Rock School District, a victim of a 2022 data security attack, is telling its past and present employees, student families and vendors that there is no evidence that their personal data has been "viewed, used or misused."

Data breach concerns ahead of Gloucester cyber attack report (BBC News) Hackers linked to Russia are understood to be responsible for the attack on Gloucester City Council.

Trends

KnowBe4 Phishing Test Results Reveal IT and Online Services Emails Drive Dangerous Attack Trend (KnowBe4) KnowBe4 Phishing Test Results Reveal IT and Online Services Emails Drive Dangerous Attack Trend

60% Increase in Ransomware Attacks: March 2023 Sees Highest Victim Count in Two Years (Corvus Insurance) Ransomware is up 60% from this time last year, and 141% from two years ago. Here's what you need to know.

Aryaka Network Transformation Report: The Age of SASE and Network-as-a-Service is Upon Us (PR Newswire) Aryaka®, the leader in Unified SASE solutions, today released its annual Enterprise Network Transformation report, outlining key trends in the...

Netwrix Annual Security Survey: 68% of Organizations Experienced a Cyberattack within the Last 12 Months (Netwrix) The most common consequences were unplanned expenses, loss of competitive edge, and decreased sales.

2023 Hybrid Security Trends Report (Netwrix) To track the evolution of IT security both on premises and in the cloud, Netwrix surveyed 1,610 IT pros, and compared the results to its reports from 2022, 2020 and 2019.

2023 Thales Data Threat Report Reveals Increase in Ransomware Attacks and Human Error as Main Cause of Cloud Data Breaches (Business Wire) 48% of IT professionals reported an increase in ransomware attacks with 22% of organisations experienced a ransomware attack in past 12 months

Report: Security teams take an average of 6 days to resolve alerts (VentureBeat) A report released by Palo Alto Networks reveals that cybersecurity teams take 145 hours, approximately 6 days, to resolve alerts.

Censys Releases 2023 State of the Internet Report Evaluating the State of Security on the Modern Internet (PR Newswire) Today, Censys, the leading internet intelligence platform for threat hunting and exposure management, announced its 2023 State of the Internet...

The 2023 State of the Internet Report | Censys (Censys) In the second annual State of the Internet Report, the Censys Research Team is back with fresh insights into the state of internet security – and what they mean for security teams.

2023 Threat Intelligence Report (Deepwatch) Get the 2023 Deepwatch Threat Intelligence Report highlighting 2022 observations and metrics, and forecasting the threat landscape for 2023.

Legacy Tech Poses a Challenge to Zero Trust Adoption, While Risk Management Needs Continue to Drive its Advancement (PR Newswire) C-suite and other executives at organizations adopting Zero Trust say complexity and compatibility issues with legacy systems and environments...

Deloitte Poll: Legacy Tech Poses a Challenge to Zero Trust Adoption (SlideShare iOS) C-suite and other executives at organizations adopting Zero Trust say complexity and compatibility issues with legacy systems and environments pose the greates…

As Economy Slows, Headcount and Resource Cuts Harm Security Teams’ Ability to Combat Threats (HackerOne) HackerOne Research Reveals Cybersecurity Budget Reductions and Team Layoffs Continue as Vulnerabilities Rise, Potentially Leaving Organizations More Vulnerable to Attack

Marketplace

Akamai Technologies To Acquire API Security Company Neosec (Akamai) Combined solutions expected to deliver complete API visibility and security coverage across all of the OWASP API top 10 attacks

NightDragon Acquires vArmour, Appoints Matt Gyde as CEO to Capitalize on Growing Global Cloud Application Security Opportunity (PR Newswire) NightDragon and vArmour today together announced that NightDragon, a dedicated cybersecurity, safety, security and privacy investment firm, has...

Saket Modi-founded cyber-risk mitigation firm Safe Security raises $50 million (The Economic Times) Returning investors in this round include Fidelity Investments venture capital arm Eight Roads, Telstra Ventures and WTI, said a statement by Safe Security.

Dasera Raises $12 Million Series A Funding to Pioneer a New Era of Data Security and Governance Risk Management (Business WIre) Dasera's automated data security and governance controls streamlines risk management, ensuring cloud security and privacy for organizations throughout the data lifecycle

Safe Security Raises $50M to Bring ML to Risk Quantification (Bank Info Security) A cyber risk quantification startup backed by ex-Cisco CEO John Chambers has raised $50 million to apply ML technology and build more API adapters. The money will

Coro Raises an Additional $75M Bringing the Total Raised to $155M in 12 Months (Business Wire) New funding to drive aggressive growth of industry’s only cybersecurity platform that brings enterprise grade cybersecurity to the mid-market; 300% year-over-year growth projected for 5th year in a row

19 startups to check out at RSA Conference 2023 (CSO Online) Young vendors of identity and access management, application security, and third-party risk solutions dominate the list of startups exhibiting at RSA.

What’s hot at RSA Conference 2023: 6 must-see malware analysis and threat hunting talks (Security Boulevard) The RSA Conference is happening next week in San Francisco and bringing some of the top minds in information security together to meet, mingle, deal — and also learn. The event started more than 30 years ago as a confab for cryptographers. These days, it doesn’t have the “zero-day cachet” of conferences like Black Hat, DEF CON or CanSecWest with its Pwn2Own competition. But it makes up for that with a steady and impressive parade of executives, top-shelf policy makers and subject matter experts.

Fortinet Joins the Joint Cyber Defense Collaborative (JCDC) to Continue Strengthening U.S. Cybersecurity Resiliency (GlobeNewswire News Room) JCDC will benefit from Fortinet’s in-depth cybersecurity expertise and industry-leading threat intelligence from FortiGuard Labs...

Darwinium Enters US Market, Expands Leadership Team and Announces Platform to Disrupt Digital Fraud Protection Market (PR Newswire) Darwinium, with global offices in London and Sydney, today announced its expansion into the U.S. market, with a bolstered U.S.-based leadership...

ThreatModeler Achieves 50% Customer Growth in FY2023 as it Increases Automated Attack Surface and Threat Discovery, Reducing Threat Modeling Friction in DevSecOps (News Direct) Achievements Accelerate Substantial Momentum in Addressing Compounding Regulatory Mandates for Complex Multi-Cloud Environments

Contrast Security Appoints Former Splunk Executive Rick Fitz as New CEO (PR Newswire) Contrast Security (Contrast), the code security platform built for developers and trusted by security, today announced the appointment of Rick...

Open letter to customers and partners from Contrast Security CEO Rick Fitz (Contrast Security) Learn more about Contrast Security's new CEO, Rick Fitz, in his open letter to customers and partners.

Splunk Appoints Yamini Rangan to Its Board of Directors (Business Wire) Splunk Inc. (NASDAQ: SPLK), the cybersecurity and observability leader, today announced that Yamini Rangan has joined the company’s Board of Directors.

Gigamon Promotes Kristi Thiele to Vice President of Worldwide Sales Engineering (Business Wire) Thiele to lead global SE team dedicated to helping customers enhance business agility, ensure cloud security, and contain hybrid cloud cost and complexity

Marlinspike adds Charles Carmakal to its Advisory Board (StreetInsider.com) Marlinspike Partners, a venture capital investment firm focusing on disruptive dual-use technology companies advancing national security and commercial interests of the United States, today announced that Charles Carmakal has joined its Advisory Board.

SentinelOne Appoints Sally Jenkins as Chief Marketing Officer (SentinelOne) Former Elastic, Informatica, VMware and Symantec marketing leader brings over 30 years of experience amplifying brand and demand at hyper growth companies SentinelOne (NYSE: S), a global leader in autonomous security, today announced the appointment of Sally Jenkins as Chief Marketing Officer.

Products, Services, and Solutions

Nozomi Networks Works with AWS to Deliver Advanced OT and IoT Cybersecurity and Analytics on the Cloud (Nozomi Networks) Nozomi Networks Works with AWS to Deliver Advanced OT and IoT Cybersecurity and Analytics on the Cloud – press release from Nozomi Networks

Darwinium Launches Platform to Deliver Fraud Prevention at the Edge, Without Compromising Customer Security or Privacy (PR Newswire) Darwinium today announced the launch of its Continuous Customer Protection platform, an evolutionary next step for security and fraud...

Aqua Security Incorporates CIS Kubernetes Benchmarks Scanning into Open Source Trivy (GlobeNewswire News Room) Rich, comprehensive reports deliver results and recommendations for improving the security of infrastructure and workloads...

GitLab and Oracle Expand Strategic Collaboration With AI/ML Offering (GlobeNewswire News Room) New offering enables developers to bolster AI/ML practices to speed up model training and inference, delivering software faster and more cost-effectively...

Data Breakthrough Awards Names Symmetry Systems' DataGuard "Data Solution of the Year for Security" (PR Newswire) Symmetry Systems, the industry's leading data-centric security company, today announced that its AI-powered, data security posture management...

Illumio Announces Incident Response Partner Program and New Product Features to Fight Ransomware - Illumio News | Illumio (Illumio) Illumio Zero Trust Segmentation Dashboards Make it Easy to Improve Ransomware Resilience as Proven Incident Response Partner Program Empowers DFIR Providers with ZTS

Sumo Logic Helps Control the Chaos by Enhancing Predictive Analytics for Observability (Sumo Logic) KubeCon + CloudNativeCon Europe 2023 – Sumo Logic today announced Predict for Metrics. When combined with existing capabilities in Sumo Logic, Predict for Metrics provides a comprehensive way to harness observability analytics to better predict variable applications, cloud and infrastructure usage…

Sumo Logic Marks Milestone in OpenTelemetry Posture Removing Complexity in Collection for Faster Time to Insights (Sumo Logic) KubeCon + CloudNativeCon Europe 2023 – Sumo Logic today announced it has taken steps to remove complexity from data collection, improved normalization of data, and consolidated collection agents with OpenTelemetry.

Swimlane Partners with AWS for Most Cost Effective Security Cloud (Low-Code Security Automation & SOAR Platform | Swimlane) Turbine becomes the industry’s only full-stack cloud-native security automation platform, enabling AWS customers to extend their security cloud beyond the SOC.

Inside-Out Defense Launches with Industry's First Platform to Provide Real-Time Detection and Remediation to Privilege Access Abuse (ACCESSWIRE News Room) Start-Up Funded by Bain & Company Delivers Holistic Approach to Solving Privilege Access Abuse PALO ALTO, CA / ACCESSWIRE / April 12, 2023 / Inside-Out Defense, the cybersecurity industry's first platform to solve privilege access abuse, emerged today from stealth funded by Bain & Company to provide real-time detection and remediation to today's most prolific attack vector - privilege access abuse. 99% of all cyber breaches are due to

Armis Enhances its Cyber Asset Attack Surface Management (CAASM) Solution (Armis) New functionality will enable organizations to better identify gaps in security controls, prepare compliance reporting and audits, identify technical debt and enhance their CMDBs

Normalyze Expands Its Data-first Cloud Security Platform to Analyze Lineage and Track Data Flows Across Structured and Unstructured Datastores (GlobeNewswire News Room) New 2.0 capabilities with dynamic data visualization lets security teams analyze sensitive data in motion and extract lineage to accelerate the remediation...

Versa Extends Zero Trust Network Access Beyond Remote Workers to Workers in Campus and Branch Offices (Versa Networks) Versa Zero Trust Everywhere™ Combines Integrated Zero Trust Security with Software-Defined LAN to Ensure Best User-to-Application Experience for Onsite, Remote and Hybrid Workers

Industry leading Email Signature Software Firm Crossware Achieves Vital Cyber Security Milestone with SOC 2 Compliance (Benzinga) AUCKLAND, New Zealand, April 18, 2023 /PRNewswire/ -- security milestone. Crossware has

CrowdStrike Delivers Cyber Resilience for the Airline Industry to Meet New TSA Requirements (CrowdStrike) The CrowdStrike Falcon platform together with CrowdStrike Services can deliver a solution needed to address the new cybersecurity requirements issued by TSA.

Forcepoint Launches Global Managed Security Service Provider Program for Forcepoint ONE SSE (Business Wire) Managed service offerings based on Forcepoint ONE SSE platform simplifies Zero Trust security, provides a fast ramp to Data-first SASE for partners

DoControl SaaS Security Platform Now Offered Through GuidePoint Security (PR Newswire) DoControl, the no-code Software as a Service (SaaS) security company, is proud to announce its partnership with GuidePoint Security, a leading...

LogRhythm Announces Partnership with Zscaler to Address Cloud Access Security Challenges Faced by the Modern SOC (Business Wire) New integration streamlines website access control with LogRhythm’s centralized data collection and automation

Lookout Launches Mobile Endpoint Detection and Response for MSSPs to Close the Mobile Security Gap for Customers (Lookout News) Lookout, Inc. today announced the availability of Lookout Mobile Endpoint Security, the industry’s most advanced mobile EDR offering for MSSPs.

IRONSCALES Unveils New BEC Capabilities Ahead of RSA (IRONSCALES) IRONSCALES unveils a suite of new capabilities that combines AI and human insights to aid in the fight against business email compromise ahead of RSA.

Picus Security Announces New Attack Surface Management and Cloud Security Posture Management Capabilities (PR Newswire) Picus Security, the pioneer of Breach and Attack Simulation (BAS), today announced the expansion of its continuous threat exposure management...

Talon Cyber Security Collaborates with Microsoft to Bring Enterprise-Grade ChatGPT Service to Modern Organizations (Business Wire) Integration of Talon’s Enterprise Browser and Microsoft Azure OpenAI Service Boosts Employee Productivity, Improves Security for Customers

Salt Security Accelerates API Threat Detection with New Investigation Capabilities (PR Newswire) Salt Security, the leading API security company, today announced the addition of new advanced threat detection capabilities and improved API...

Enveil Recognized in 2023 Gartner® Market Guide for AI Trust, Risk and Security Management (Business Wire) Enveil, the pioneering Privacy Enhancing Technology company protecting Data in Use, today announced it was named a Representative Vendor in the 2023 Gartner Market Guide for AI Trust, Risk and Security Management.

Securonix Redefines the Future of SIEM with Launch of Industry’s First Unified Defense SIEM Platform (Securonix) 365 Days of ‘Hot’ Search, Powered by Snowflake, Best-in-Class Threat Defense and Unified TDIR Experience on a Single Platform

Sevco Security Launches World’s Most Accurate CAASM Platform Powered by Proprietary Four-Dimensional Cybersecurity Asset Intelligence Correlation and Visualization Engine (Business Wire) Company Receives Multiple Patent Allowances for Core Platform Technology That Enables True Understanding, Coverage and Context of Devices, Users and Applications on a Continuous, Real-time Basis

CrowdStrike Announces Managed XDR: Closing the Cybersecurity Skills Gap (CrowdStrike) CrowdStrike announces the introduction of Falcon Complete XDR, a new managed eXtended Detection and Response (MXDR) service.

Venafi Launches Venafi Firefly to Deliver Machine Identities for Modern, Cloud Native Workloads (Business Wire) Enables Organizations to Strengthen Security Posture While Accelerating Application Development

Lumu Launches New SecOps Tool to Combat Growing Cybersecurity Threats (ACCESSWIRE News Room) Lumu for SecOps provides rapid detection and response to today's top threats such as ransomware MIAMI, FL / ACCESSWIRE / April 19, 2023 / Lumu Technologies, creators of the Continuous Compromise Assessment cybersecurity model that empowers organizations to measure compromise in real time, will debut Lumu for SecOps, at the RSA Conference 2023. Lumu for SecOps is built to enable security teams to efficiently operate cybersecurity by dynamically

Barracuda makes it easy to secure websites, applications, and APIs with comprehensive enterprise-grade protection (PR Newswire) Barracuda Networks, Inc., a trusted partner and leading provider of cloud-first security solutions, today introduced new Application Protection...

CybeReady Unveils Advanced Data-Driven Analytics to Revolutionize Cybersecurity Awareness Training (ITSecurityWire) CybeReady, announced a major enhancement to the company's award-winning cybersecurity awareness training solution.

Aryaka and Check Point Software Technologies Extend Partnership for Global Managed SASE (PR Newswire) Aryaka®, the leader in Unified SASE solutions, today announced that it is expanding its partnership with Check Point Software Technologies,...

Axiad Expands International Footprint With Canadian Hosting Capabilities (PR Newswire) Axiad, a leading provider of organization-wide passwordless orchestration, today announced it has further expanded internationally, delivering...

SPHERE and BigID Join Forces to Remediate Identity Hygiene Risks (PR Newswire) SPHERE, provider of innovative solutions for identity hygiene and access governance, and BigID, the leading platform for data security,...

Protect Your Mid-Market Organization with Protect+ (Cofense) Equip your mid-market organization with the right tools to protect against cyber threats and identify phishing emails faster! Learn more about Cofense Protect+

Lacework Prioritizes Cloud Security Risks with New Vulnerability Risk Management Technology (PR Newswire) Leading up to RSA Conference 2023, Lacework®, the data-driven cloud security company, today announced the expansion of its cloud-native...

Technologies, Techniques, and Standards

FS-ISAC Leads Financial Sector in Live-Fire Cyber Exercise Locked Shields (GlobeNewswire News Room) Exercise to prepare against unprecedented, worst-case scenario financial meltdown...

Avoiding attacks (Control Engineering Europe) Suzanne Gill posed the following question to a variety of cybersecurity experts: 'What is the best piece of advice you can offer end-users keen to ensure that their connected OT devices do not offer a potential attack surface for bad actors?'

OpenSSF Announces SLSA Version 1.0 Release - Open Source Security Foundation (Open Source Security Foundation) The Open Source Security Foundation (OpenSSF) is proud to announce the release of version 1.0 of Supply-chain Levels for Software Artifacts (SLSA). SLSA is an OpenSSF project that provides specifications for software supply chain security, established by community expert consensus. The stable release of the SLSA 1.0 Build Track lowers the barrier of entry for improvements, helps you focus efforts on improving your build, and reduces the chances of tampering across a large swath of the supply chain.

Design and Innovation

OpenAI’s hunger for data is coming back to bite it (MIT Technology Review) The company’s AI services may be breaking data protection laws, and there is no resolution in sight.

Dell Technologies Builds Ecosystem to Speed Zero Trust Adoption | Dell (Dell) Dell brings together more than 30 leading technology and security companies to create a unified Zero Trust solution.

Legislation, Policy, and Regulation

Cyber: towards stronger EU capabilities for effective operational cooperation, solidarity and resilience (European Commission) Today, the Commission has adopted a proposal for the EU Cyber Solidarity Act to strengthen cybersecurity capacities in the EU. It will support detection and awareness of cybersecurity threats and incidents, bolster preparedness of critical entities, as well as reinforce solidarity, concerted crisis management and response capabilities across Member States.

WhatsApp and other messaging apps oppose 'surveillance' (BBC News) WhatsApp and messaging apps unite to urge the UK government to rethink the Online Safety Bill.

Proposed UK moves to break encryption draw anger of IT world (Register) Plus: Signal, WhatsApp, and Viber also write online protest over Online Safety Bill back door

‘Shut it off immediately’: The health industry responds to data privacy crackdown (POLITICO) Biden administration enforcement actions have chilled advertising spending and cut into bottom lines.

Litigation, Investigation, and Law Enforcement

How Mexico Became the Biggest User of the World’s Most Notorious Spy Tool (New York Times) A Times investigation reveals the story behind how Mexico became the first and most prolific user of Pegasus. It’s still using it, despite promising to stop.

Legal challenge to EPA rule poses obstacle to Biden's cyber agenda (Washington Post) Republican AGs try to block EPA water cyber protections, citing federal intrusion on states' authority

DOD General Counsel Remarks at U.S. Cyber Command Legal Conference Remarks By Hon. Caroline Krass (U.S. Department of Defense) The DOD General Counsel delivered remarks at the U.S. Cyber Command Legal Conference.

Chinese Cops Ran Troll Farm and Secret NY Police Station, US Says (WIRED) Three criminal cases detail China's alleged attempts to extend its security forces' influence online—and around the globe.

US charges 4 Americans, 3 Russians in election discord case (AP NEWS) Four Americans affiliated with a Black empowerment and political organization have been charged along with three Russians with conspiring to covertly sow discord in U.S. society, spread Russian propaganda and interfere in U.S. elections. An indictment unsealed Tuesday adds the new defendants to an existing case in Tampa, Florida, federal court involving Aleksandr Ionov, described by prosecutors as the founder of a Moscow-based organization funded by the Russian government to carry out an influence campaign in the U.S. The four Americans are all part of the African People’s Socialist Party and Uhuru Movement, which has locations in St. Petersburg, Florida, and St. Louis.

U.S. charges four Americans with aiding Kremlin efforts (Washington Post) Charges are the latest Justice Department effort against secret foreign propaganda networks on U.S. soil

US citizens charged with pushing pro-Kremlin disinformation (Register) Also a bunch of Russians plus someone giving free trips to the Motherland

Ex-CEO of breached pyschotherapy clinic gets prison sentence for bad data security (Naked Security) Did the sentence fit the crime? Read the backstory, and then have your say in our comments! (You may post anonymously.)

Brit cops rapped over app that recorded 200k phone calls (Register) Officers didn't know software was saving personal data and neither did people on other end

Crooks’ Mistaken Bet on Encrypted Phones (The New Yorker) Drug syndicates and other criminal groups bought into the idea that a new kind of phone network couldn’t be infiltrated by cops. They were wrong—big time.

Patient Seeks to Force Hospital Network to Pay Hackers Ransom to Remove Naked Photos Online (Wall Street Journal) Jane Doe lawsuit asks judge to compel Lehigh Valley Health Network to pay hackers more than $5 million in a bid to have stolen photos removed from the internet.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

US Cyber Open® Kick-Off Event (Virtual, Jun 1, 2023) US Cyber Open Kick-Off Event. SEASON III WHAT ARE THE US CYBER GAMES ALL ABOUT? -Why should I get into a career in cybersecurity? -What's the key to making the US Cyber Team? -Who are the coaches for Season III? Learn about these and more during our Season III Kick-Off event.

Hybrid Identity Protection Conference (New York, New York, USA, Aug 23 - 24, 2023) Organized by Semperis, this conference takes up the challenges of hybrid identity protection. Mobile workforces, cloud applications and digitalisation are changing every aspect of the modern enterprise. And with radical transformation come new business risks. Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric practitioners. Whatever industry sector or job function, HIP strives to provide its community with the insights and relationships needed to enable and protect today’s digitally driven organisations.

Events

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Apr 14 - 21, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now!

SANS Pen Test Austin 2023 (Austin (and virtual), Texas, USA, Apr 17 - 22, 2023) SANS Pen Test Austin 2023 is six days of in-depth, hands-on penetration testing, red teaming, purple teaming, and exploit development training for professionals who need to know how to find vulnerabilities within their organizations, understand risk, and prioritize resources based on potential real-world attacks. This event isn't just for penetration testers or red team members; it is for any information security professional who wants to understand the mindset, tools, and techniques used by those who intrude where they don't belong. If you like to break things, put them back together, find out how they work, and mimic the actions of real-world bad guys—all the while providing real business value to your organization—this event is for you! View the line-up of cutting-edge offensive operations courses, and register now to learn from leading industry experts.

Election Threats: Past, Present, & Future (Virtual, Apr 19, 2023) Join us virtually on April 19th from 12:00 PM - 1:00 PM. Experts will explore both historical and current domestic threats to our election security: Michael Chertoff, Co-Founder and Executive Chairman, The Chertoff Group; Mary McCord, Executive Director of the Institute for Constitutional Advocacy and Protection, Visiting Professor of Law at Georgetown University Law Center; and David Laufman, Partner, Wiggin and Dana LLP. Moderated by David Hickton, Founding Director, Pitt Cyber. Presented by Pitt Cyber, in partnership with The Azure Forum, CSIS, and Keep Our Republic.

Gender Digital Divide Community Forum: Views From Central & Eastern Europe (New York, New York, USA, Apr 19, 2023) Czechitas, the Consulate General of the Czech Republic in New York and CzechInvest invite you to a community forum on the gender digital divide in Central and Eastern Europe. Forum guests will learn first-hand about women‘s technology challenges and opportunities across the CEE region. Participants will also share cross-border insights with experts on empowering women through technology for economic growth and educational success. Networking with coffee and light refreshments included, so remember to bring your business cards! Event is free, but RSVP is required.

CYBERUK (Belfast, Northern Ireland, UK, Apr 19 - 20, 2023) Welcome to CYBERUK 2023, the UK’s flagship cyber security event run by the National Cyber Security Centre (NCSC). The theme for 2023 is securing an open and resilient digital future. We face an unprecedented growth in digital and technological development. This will bring huge benefits to society, but it also has the potential to threaten the national and economic security interests of the UK and other free and open societies.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.