Supply-chain attack's effects spread. New KEV entries. Bumblebee malware loader. Decoy Dog toolset. Discord Papers update.

Summary

By the CyberWire staff

At a glance.

3CX is not the only victim in the recent supply chain attack.
PaperCut critical vulnerability under active exploitation, as are Google and MinIO vulnerabilities.
Bumblebee malware loader used by ransomware gangs.
Decoy Dog, a new unique malware toolkit.
Report: the alleged Discord Papers leaker shared earlier and more widely than previously known.
Cyberattack against Eurocontrol.

3CX is not the only victim in the recent supply chain attack.

The supply chain attack that affected 3CX didn’t end at the telecommunications company. The Trojanized X_Trader software which led to the 3CX attack was available for download in 2022, and it seems to have been downloaded by at least two critical infrastructure organizations. Symantec reported Friday that “The X_Trader software supply chain attack affected more organizations than 3CX. Initial investigation by Symantec’s Threat Hunter Team has, to date, found that among the victims are two critical infrastructure organizations in the energy sector, one in the U.S. and the other in Europe.” Symantec adds “The process for payload installation is almost identical as that seen with the Trojanized 3CX app.” Given the nature of the initially infected software (X_Trader is a financial trading program), it seems that this could be a financially motivated attack. Symantec explained that there are probably more victims as this breach is indicative of a complex and “successful template for software supply chain attack.” For information on this supply-chain attack, see CyberWire Pro.

The mWISE Call for Speakers is now open. Help security’s best get better.

Take lead in a global community of security pros. Be a speaker at mWISE.

PaperCut critical vulnerability under active exploitation, as are Google and MinIO vulnerabilities.

On Friday CISA added three vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2023-27350 PaperCut MF/NG Improper Access Control Vulnerability, CVE-2023-28432 MinIO Information Disclosure Vulnerability, and CVE-2023-2136 Google Chrome Skia Integer Overflow Vulnerability.

PaperCut blogged details of a critical level vulnerability (9.8 out of 10 CVSS score) CVE-2023-27350 affecting servers running the software. The company explained, “The PaperCut application is popular with the State, Local, and Education (SLED) type organizations, where just education makes up 450 of those results.” PaperCut released a security patch on 8 March 2023 to address this vulnerability, and updated its patch bulletin today advising its users to urgently update their servers with the most recent patch as they believe some servers are actively being exploited. PaperCut also said “If you suspect that your server has been compromised, we recommend taking server backups, then wiping the Application Server, and rebuilding the Application Server and restoring the database from a ‘safe’ backup point prior to when you discovered any suspicious behavior.” Experts continue to recommend that users should update their software in accordance with developer recommendations as this would lessen your organization's exposure to fixed vulnerabilities.

Google released a statement which listed CVE-2023-2136 as one of the 8 vulnerabilities it patched on 18 April. It added “Google is aware that an exploit for CVE-2023-2136 exists in the wild.” CVE-2023-28432 affected version RELEASE.2021-08-31T05-46-54Z and has been patched as of March 20th. MinIO posted that “All users of distributed deployment are impacted. All users are advised to upgrade ASAP.”

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

Bumblebee malware loader used by ransomware gangs.

Bleeping Computer reports that the Bumblebee malware loader, originally developed by the Conti gang, has been observed in use once again. The loader is distributed through fake Google Ads for legitimate companies such as Zoom, Citrix, and ChatGPT. The original malware was observed in April of last year, with stealth updates seen in September. Secureworks reports finding a fake Cisco AnyConnect Secure Mobility Client v4.x Google Ad, which would send the user to a compromised WordPress site to “download” the client. If the user downloaded the fake client, they’d end up with the Bumblebee malware on their device. Secureworks advises utilizing the legitimate sites of these clients in order to download and update them. The Record notes the Google Threat Analysis Group’s discovery of the Bumblebee loader in 2021, with links to a range of threat actors.

Decoy Dog, a new unique malware toolkit.

Infoblox explained that scanning some 70 billion IP addresses daily has led to its discovery of a new malware toolkit, “Decoy Dog.” "The domains we describe are all related to a single tool kit we call Decoy Dog, which is identified using a DNS fingerprint matching 0.0000027% of domains currently active in the world.” Infoblox adds, “When we analyzed the queries in external global DNS data, the C2 communication originated almost exclusively from hosts in Russia. Because global DNS traffic is polluted with retransmitted queries from multiple sources, and because at least one of the C2 servers was located in Russia, we cannot assume that this was authentic communication from a compromised host.”

One of Decoy Dog’s tools is a remote access Trojan (RAT) “Pupy RAT.” Infoblox describes this as “a dangerous and powerful RAT due to its fileless nature and slow, encrypted C2 communications. It is hard to detect by EDR solutions, and can stay hidden for a long time in an afflicted network. Pupy is one of the few RATs that offers broad multi-platform capabilities, uses an old version of Python, and therefore is able to infect a majority of Linux and mobile devices.” This unusual feature makes Decoy Dog easy to identify. Infobox says it hasn’t yet discovered the purpose of Decoy Dog, and that it plans to release more findings as they become available. “In writing this paper, we have found that the mysteries surrounding Decoy Dog and its presence in our networks are complex and unresolved. We expect to release further reporting as we are able to explain the activity.”

Report: the alleged Discord Papers leaker shared earlier and more widely than previously known.

The New York Times reports that its found signs that Airman Jack Teixeira, who faces US Federal charges in the Discord Papers case, began sharing highly classified intelligence about Russia's war against Ukraine earlier than had hitherto been reported, and that he appears to have done so in a second Discord channel that was larger than the Thug Shaker Central group he's been associated with. "In February 2022, soon after the invasion of Ukraine," the Times writes, "a user profile matching that of Airman Jack Teixeira began posting secret intelligence on the Russian war effort on a previously undisclosed chat group on Discord, a social media platform popular among gamers. The chat group contained about 600 members." The Times also reports that the Airman also direct-messaged foreign members of the group offering to tell them more about the information he had available: “DM me and I can tell you what I have.” The evidence connecting Airman Teixeira with the recently discovered Discord group is circumstantial but suggestive. Neither his defense attorney nor the FBI and the US Justice Department were willing to comment to the Times on its story.

Cyberattack against Eurocontrol.

The effects of the cyberattack against Eurocontrol, the European air traffic control organization, continued into the weekend. The disruptions, claimed by Russia's KillNet, did not disrupt flight operations, the Wall Street Journal reports.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Dateline Moscow and Kyiv: A counter-offensive seems imminent.

Ukraine at D+424: Counter-offensive preparations. (CyberWire) Signs of a Ukrainian counteroffensive are reported as Russian military leaders appear to urge their president to go over to the defensive. The alleged Discord Papers leaker may have been busier earlier, and with a wider audience, than previously believed.

Russia-Ukraine war: List of key events, day 425 (Al Jazeera) As the war enters its 425th day, we take a look at the main developments.

Drones attack Sevastopol, crashed drone found near Moscow (AP NEWS) Russian-appointed authorities in Crimea say the military fended off a Ukrainian strike on the port of Sevastopol, while a drone was also reportedly found in a forest near Moscow. The attacks come as Ukraine is preparing for a major counteroffensive. The Moscow-appointed head of Sevastopol in Crimea said that the military destroyed a Ukrainian sea drone that attempted to attack the harbor in the early hours on Monday.

In Bakhmut, Ukrainian troops cling to western edge of a destroyed city (Washington Post) Moving between apartment blocks, small teams of Ukrainian and Russian ground forces are battling for control of Bakhmut’s western edge.

Russia-Ukraine war live: Ukraine reportedly sets up positions on eastern Dnipro river in attempt to dislodge Russian troops (the Guardian) Constant attacks from Russian troops have made it impossible for Kherson residents to return to their normal lives

Ukrainian troop positions spark counteroffensive speculation (AP NEWS) A Washington-based think tank says that Ukrainian forces have successfully crossed the wide Dnieper river in the country's south to establish and maintain positions on its east bank. That prompted Ukrainian media on Sunday to hail the reported advances as an early sign of Kyiv's long-awaited spring counteroffensive.

Ukraine’s counteroffensive against Russia: What you should know (Al Jazeera) Western weapons pour into Ukraine as officials in Kyiv promise new attacks will start soon.

11,000 Ukrainians Have Had at Least Some US Training As Spring Offensive Looms (Defense One) Ukraine also set to start training on U.S. Abrams tanks by mid-May.

Moscow claims capture of parts of Bakhmut – as it happened (the Guardian) Russian defence ministry says it has made progress in heavily contested region

Ukraine Says Russian Troops Are Evacuating Civilians From Occupied Areas of South (New York Times) Russian troops are forcibly relocating residents near the southern city of Kherson as fighting there intensifies, Ukrainian officials said Sunday.

Russia's air force accidentally bombs own city of Belgorod (AP NEWS) Russia’s military has acknowledged that a bomb accidentally dropped by one of its warplanes caused a powerful blast in a Russian city about 40 kilometers (25 miles) east of the Russia-Ukraine border. Belgorod has faced regular drone attacks during Russia’s military operation in Ukraine.

Why did Russia bomb itself? (The Telegraph) The announcement that an 'abnormal descent of aviation ammunition' is why a jet accidentally bombed a Russian city is likely to be accurate

Bungling Putin can’t avoid bombing his own cities (The Telegraph) The “abnormal descent of aviation ammunition” is the perfect illustration of his catastrophically self-destructive war

Murder, ‘alcohol and prostitutes’: Wagner convicts pardoned by Putin return to terrorise home towns (the Guardian) Violent criminals who served with the notorious Russian militia in Ukraine are terrorising the communities they return to

Russian soldiers beg for help as own army throws them into pit (The Telegraph) Troopers kept in caged hole and denied food and water as Kremlin cracks down on those who refuse to fight or who drink too much

The Free World Must Stay the Course on Ukraine (Foreign Affairs) A frozen conflict or partial victory will solve nothing.

Ukraine can retake Crimea within months, if we let it (The Telegraph) There is no need for a diplomatic solution. Russia’s war could soon be brought to a humiliating end

Milley Says Ukraine Has Leadership, Morale to Beat Russia (U.S. Department of Defense) More than a year after the Russian invasion of Ukraine, Ukraine continues to fight, and allies and partners continue to support and stand behind the nation, Army Gen. Mark A. Milley said.

Secretary of Defense Lloyd J. Austin III and Chairman of the Joint Chiefs of Staff General Mark A. Milley Hold a Post-Ukraine Defense Contact Group Press Conference, Ramstein Air Base, Germany (U.S. Department of Defense) Secretary of Defense Lloyd J. Austin III and Chairman of the Joint Chiefs of Staff General Mark A. Milley held a post-Ukraine Defense Contact Group press conference at Ramstein Air Base, Germany.

Air defense top priority for Ukraine Contact Group amid leak revealing missile stockpiles running out (Breaking Defense) “Ukraine urgently needs our help to shield its citizens and infrastructure from Russia’s missile threat,” said US secretary of defense Lloyd Austin.

US to start training Ukrainian troops on Abrams tanks within weeks (Military Times) A separate shipment of refurbished M1A1 Abrams tanks is expected to reach Ukrainian battlefields by the end of the year.

Why the 155mm round is so critical to the war in Ukraine (Military Times) The 155mm howitzer round is one of the most requested artillery munitions of the war in Ukraine.

Airman Shared Sensitive Intelligence More Widely and for Longer Than Previously Known (New York Times) A Discord user matching the profile of Jack Teixeira distributed intelligence to a larger chat group, days after the beginning of the Ukraine war.

FBI leak investigators home in on members of private Discord server (Washington Post) Investigators have spoken to online friends of alleged leaker Jack Teixeira, who hung out and viewed secret documents in a gaming chatroom

From Discord to 4chan: The Improbable Journey of a US Intelligence Leak (bellingcat) A recent leak of sensitive US intelligence documents leads to stranger corners of the internet than initially thought.

Data company Palantir to help Ukraine prosecute alleged Russian war crimes (Reuters) Ukraine plans to deploy software from U.S. data analytics provider Palantir Technologies Inc to help it prosecute alleged war crimes committed by Russia, the company told Reuters.

The ‘all-seeing’ tech giant mapping Putin’s war crimes (The Telegraph) Palantir's chief on AI, Ukraine and the battle to defend the West

Europe’s Planes Keep Flying Despite Cyberattack (Wall Street Journal) As lower-level cyber attacks proliferate, critical infrastructure targets such as Europe’s top air-traffic agency show resilience.

Cyber resilience one year into the Ukraine/Russia conflict (Security Magazine) The war between Russia and Ukraine is the first time two countries are seen waging a physical war while also engaging in open cyber conflict.

UK sanctions officials behind arrest of Kremlin critic Kara-Murza (The Guardian Nigeria News) The UK on Friday sanctioned five individuals "connected to the poisoning and arrest" of Kremlin critic and British dual-national Vladimir Kara-Murza after he was sentenced on charges including treason.

Ukraine sends Russian tank to Maryland's Aberdeen Proving Ground (Baltimore Fishbowl) Ukrainian officials have sent a Russian tank to Maryland as a not-so-small token of their gratitude to the United States.

A lost Ukraine: the photographs that show the calm before the carnage (the Guardian) Katherine Turczan grew up in the US listening to her family of Ukrainian exiles talk about home. In the 90s, she finally visited the country, taking gentle, bucolic pictures that now feel tragic

Russian-speaking Ukrainians want to shed ‘language of the oppressor’ (the Guardian) Kharkiv on country’s eastern border has long had Russian-speaking majority but things are changing fast

Attacks, Threats, and Vulnerabilities

Iran cyberespionage group taps SimpleHelp for persistence on victim devices (CSO Online) Group-IB researchers have also identified a previously unknown command and control infrastructure and a PowerShell script that APT group MuddyWater is using for its cyberespionage and IP theft attacks.

SimpleHarm: Tracking MuddyWater’s infrastructure (Group-IB) Group-IB analysts discovered the new MuddyWater infrastructure while researching the pro-state group’s use of the legitimate SimpleHelp tool.

3CX Hackers Also Compromised Critical Infrastructure Firms (Infosecurity Magazine) Symantec warns North Korean actors may return for further exploitation

That 3CX supply chain attack keeps getting worse (Register) Also, Finland sentences CEO of breach company to prison (kind of), and this week's laundry list of critical vulns

Energy sector orgs in US, Europe hit by same supply chain attack as 3CX (Record) The same initial supply chain attack allegedly launched by North Korean hackers against enterprise phone company 3CX also affected two critical infrastructure organizations based in the United States and Europe.

Even more victims found in complex 3CX supply chain attack (CybersecurityConnect) Security researchers at Symantec have uncovered a number of new victims in the supply chain attack that saw 3CX’s video conferencing software compromised.

X_Trader Supply Chain Attack Affects Critical Infrastructure Organizations in U.S. and Europe (Symantec Enterprise Blogs) North Korean-linked operation affected more organizations beyond 3CX, including two critical infrastructure organizations in the energy sector.

Aqua Nautilus Discovers 250 Million Artifacts Exposed via Misconfigured Registries and Artifact Repositories (GlobeNewswire News Room) Five Fortune 500 companies and thousands of organizations worldwide potentially exposed to software supply chain attacks...

Fortune 500 at Risk: 250M Artifacts Exposed via Misconfigured Registries (Aqua Sec) The Aqua Nautilus research team found detected thousands of exposed registries and artifact repositories in some of the world’s largest organizations

Decoy Dog malware toolkit found after analyzing 70 billion DNS queries (BleepingComputer) A new enterprise-targeting malware toolkit called 'Decoy Dog' has been discovered after inspecting anomalous DNS traffic that is distinctive from regular internet activity.

Analyzing DNS Traffic for Anomalous Domains and Threat Detection (Infoblox Blog) Learn how Infoblox’s Threat Intelligence Group identified C2 servers in DNS arising from a persistent toolkit called Decoy Dog and how Infoblox can help protect your network from similar attacks.

Sudan internet shutting down as fighting causes power cuts (Record) Sudan is experiencing severe internet outages amid a power struggle that has pitted the army against a powerful paramilitary force in the streets of the capital Khartoum and around the country.

Sudanese telecoms provider MTN blocks internet services, MTN officials say (Reuters) Sudan's MTN telecommunications company has blocked internet services in the country on the orders of the government telecommunications regulator, two officials from the company told Reuters on Sunday. (Reporting by Khalid Abdelaziz; Writing by Omar Abdel-Razek; Editing by...

Hackers can breach networks using data on resold corporate routers (BleepingComputer) Enterprise-level network equipment on the secondary market hide sensitive data that hackers could use to breach corporate environments or to obtain customer information.

'RustBucket' malware targets macOS (Jamf) Learn how APT group, BlueNoroff targets macOS devices with newly discovered malware.

Jaguar Tooth (NCSC) Cisco IOS malware that collects device information and enables backdoor access

Bumblebee Malware Distributed Via Trojanized Installer Downloads (Secureworks) Learn how CTU™ researchers observed Bumblebee malware distributed via trojanized installers for popular software such as Zoom, Cisco AnyConnect, ChatGPT, and Citrix Workspace.

Google ads push BumbleBee malware used by ransomware gangs (BleepingComputer) The enterprise-targeting Bumblebee malware is distributed through Google Ads and SEO poisoning that promote popular software like Zoom, Cisco AnyConnect, ChatGPT, and Citrix Workspace.

Bumblebee malware infects victims via fake Zoom, Cisco and ChatGPT software installers (Record) Cybersecurity researchers say they’ve observed a sophisticated malware variant hitching a ride on fake online advertisements for well-known programs like ChatGPT, Zoom, and Citrix.

The New Risks ChatGPT Poses to Cybersecurity (Harvard Business Review) The FBI’s 2021 Internet Crime Report found that phishing is the most common IT threat in America. From a hacker’s perspective, ChatGPT is a game changer, affording hackers from all over the globe a near fluency in English to bolster their phishing campaigns. Bad actors may also be able to trick the AI into generating hacking code.

Threat actors can use ChatGPT to sharpen cyberthreats, but no need to panic yet (Cybersecurity Dive) Startling dangers, such as autonomous attack mechanisms and sophisticated malware coding, have yet to materialize. For now, the threat is more specific.

Ransomware Attack Hits Marinette Marine Shipyard, Results in Short-Term Delay of Frigate, Freedom LCS Construction (USNI News) This post has been updated with a statement from Lockheed Martin. The Wisconsin shipyard that builds the U.S. Navy’s Freedom-class Littoral Combat Ship and the Constellation-class guided-missile frigate suffered a ransomware attack last week that delayed production across the shipyard, USNI News has learned. Fincantieri Marinette Marine experienced the attack in the early morning hours …

Shields Health Care Group data breach impacted more than 2.3 million patients (teiss) US medical services provider Shields Health Care Group (SHCG) has disclosed a data breach that compromised the sensitive personal information of more than 2.3 million people.

No evidence yet of gov’t data leak – NPC (INQUIRER.net) Amid ongoing investigations, there is no “concrete evidence” yet that more than 1.2 million records from several government agencies were leaked, according to the

ICICI Bank refutes data breach allegation; here's what we know so far (ETCISO.in) Bank issues 4-point statement denying data breach; researchers say leaked data appears legit, but cannot be sourced to ICICI Bank.

ABA Says 1.5 Million Member Accounts Hacked in Data Breach (1) (Bloomberg) A hacker stole 1.5 million American Bar Association account usernames and passwords in March, the nation’s largest voluntary legal organization told Bloomberg Law.

Yellow Pages Canada confirms cyber attack as Black Basta leaks data (BleepingComputer) Yellow Pages Group, a Canadian directory publisher has confirmed to BleepingComputer that it has been hit by a cyber attack. Black Basta ransomware and extortion gang claims responsibility for the attack and has posted sensitive documents and data over the weekend.

Scammers using social media to dupe people into becoming money mules (Help Net Security) Fraudsters in the US are targeting unsuspecting consumers, with almost 50% of them being approached to receive funds, according to Feedzai.

Cyber attack will keep casino closed throughout weekend (SooToday.com) Official could not put dollar figure on impact of shutdown and could not provide details of what needs to be done to restore IT system

For 'resilient' casino giant, a new hurdle: A ransomware attack (lfpress) A ransomware cybersecurity attack that’s shut down Gateway Casino and Entertainment is a blow to the business here and nationwide as it continues to emerge…

URGENT | PaperCut MF/NG vulnerability bulletin (March 2023) (PaperCut) PaperCut provides simple and affordable print management software for Windows, Mac, and Linux. Our print control software helps keep track of all your print accounting and print quotas for your business or educational facility.

PaperCut CVE-2023-27350 Deep Dive and Indicators of Compromise (Horizon3.ai) PaperCut CVE-2023-27350 Technical Deep-Dive, Indicators of Compromise, and Exploit Proof-of-Concept.

Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers (The Hacker News) PaperCut, a print management software provider, has warned about ongoing exploitation of unpatched servers, potentially by Russian hackers.

CISA KEV Breakdown | April 21, 2023 (Nucleus Security) In this Breakdown, Nucleus explores the 3 vulnerabilities for Google, MinIO and PaperCut added to the CISA KEV list on April 21, 2023

CISA Adds Three Known Exploited Vulnerabilities to Catalog (Cybersecurity and Infrastructure Security Agency CISA) CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-28432 MinIO Information Disclosure Vulnerability CVE-2023-27350 PaperCut MF/NG Improper Access Control Vulnerability CVE-2023-2136 Google Chrome Skia Integer Overflow Vulnerability

CISA Adds 3 Actively Exploited Flaws to KEV Catalog, including Critical PaperCut Bug (The Hacker News) U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds 3 vulnerabilities to its KEV catalog due to active exploitation.

CISA adds printer bug, Chrome zero-day and ChatGPT issue to exploited vulnerabilities catalog (Record) The Cybersecurity and Infrastructure Security Agency (CISA) added an issue affecting a popular print management software tool to its list of exploited vulnerabilities on Friday.

Security Patches, Mitigations, and Software Updates

Oracle Releases Security Updates (Cybersecurity and Infrastructure Security Agency CISA) Oracle has released its Critical Patch Update Advisory, Solaris Third Party Bulletin, and Linux Bulletin for April 2023 to address vulnerabilities affecting multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

Drupal Releases Security Advisory to Address Vulnerability in Drupal Core (Cybersecurity and Infrastructure Security Agency CISA) Drupal has released a security advisory to address an access bypass vulnerability affecting multiple Drupal versions. An attacker could exploit this vulnerability to take control of an affected system.

VMware Releases Security Update for Aria Operations for Logs (Cybersecurity and Infrastructure Security Agency CISA) VMware has released a security update to address multiple vulnerabilities in Aria Operations for Logs (formerly vRealize Log Insight). A cyber threat actor could exploit these vulnerabilities to take control of an affected system.

Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products (The Hacker News) Attention IT teams! Critical security flaws have been found in Cisco and VMware products.

VMware patches break-and-enter hole in logging tools: update now! (Naked Security) You know jolly well/What we’re going to say/And that’s “Do not delay/Simply do it today.”

Cisco Releases Security Advisories for Multiple Products (Cybersecurity and Infrastructure Security Agency CISA) Cisco has released security updates for vulnerabilities affecting Industrial Network Director (IND), Modeling Labs, StarOS Software, and BroadbandWorks Network Server. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.

Trends

Securing the Edge Ecosystem Global Research released – Complimentary report available (AT&T) AT&T Cybersecurity is committed to providing thought leadership to help you strategically plan for an evolving cybersecurity landscape. Our 2023 AT&T Cybersecurity InsightsTM Report: Edge Ecosystem is now available. It describes the common characteristics of an edge computing environment, the top use cases and security trends, and key recommendations for strategic planning. Get your free copy now. This is the 12th edition of our vendor-neutral and forward-looking report. During the las

2023 Cybersecurity Insights Report: Stay Ahead of Emerging Threats (AT&T) Get the latest insights on cybersecurity threats and trends with our comprehensive report. Stay informed and protect your business in 2023.

AppSec Indicator Spring 2023 edition | Invicti (Invicti) In this Invicti AppSec Indicator, development and security practitioners share how they deal with the excess AppSec noise and the relentless pressure to deliver business-critical software on time without compromising security.

Marketplace

TIM expands into the cybersecurity market with the acquisition of TS-Way (Capacity Media) TIM has grown is presence in the cybersecurity market with the acquisition TS-Way, an Italian company that specialise in prevention and analysis services for cyber threat intelligence.

ZeroFox Completes Acquisition of LookingGlass (GlobeNewswire News Room) The ZeroFox External Cybersecurity Portfolio now includes broadened attack surface management and vulnerability intelligence capabilities...

Bridge District developers seek to establish 'national center for cyber learning' in Anacostia (Washington Business Journal) "We're basically at the nexus of all of these top-secret agencies," the developer said. "There is a massive dearth of trained cyber workers."

CyberArk Software positioned strongly for durable growth - Truist By Investing.com (Investing.com) CyberArk Software positioned strongly for durable growth - Truist

SentinelOne rises as Stephens calls out 'best-in-class growth,' coming free cash flows (Seeking Alpha) SentinelOne (NYSE:S) shares rose nearly 1% in premarket trading on Friday as investment firm Stephens started coverage on the cybersecurity firm, citing its "best-in-class growth" and potential for strong free cash flow.

Mark Zuckerberg’s metaverse is shattering into a million pieces (The Telegraph) Having stuck with a fateful mission, the rest of the Facebook empire is now paying a heavy price

Former BT chief architect Neil McRae looks to juice up Juniper Networks (Enterprise Times) BT’s outspoken former chief architect and managing director for architecture and technology strategy, Neil McRae, has found a new home at Juniper Networks, where he will assume the role of Chief Network Strategist.

Products, Services, and Solutions

New infosec products of the week: April 21, 2023 (Help Net Security) The featured infosec products this week are from: Armorblox, Cofense, D3 Security, Sotero, Venafi, Veracode, Versa Networks, and Zyxel Networks.

Onapsis Announces New Product Updates to Strengthen ERP Cybersecurity (Business Wire) The leader in SAP and Oracle Security continues to drive market innovation with a powerful new Security Advisor, based on 14 years of business data and threat research

IBM Launches New QRadar Security Suite to Speed Threat Detection and Response (IBM Newsroom) IBM unveiled its new security suite designed to unify and accelerate the security analyst experience across the full incident lifecycle

Cisco Unveils New Open Source Security Tools at KubeCon EU (Newstack) Cisco introduced three new open source tools — VMClarity, Nasp and Media Streaming Mesh — that are designed to add functionality for securing Kubernetes and cloud native environments in general.

Onapsis updates its platform to strenghten ERP cybersecurity (Help Net Security) Onapsis platform update boosts customers' security and cyber resilience amidst volatile threats and economic conditions.

Binary Defense Launches New "Phishing Response" Service with Built-In Intelligence Correlation and Threat Hunting Capabilities (Benzinga) This next-level defense service substantially reduces an organization's risk of phishing-based compromise by combining robust email defense and elite phishing incident response capabilities with Binary Defense's

Proofpoint Introduces New Innovations at the 2023 RSA Conference to Break the Attack Chain (Proofpoint) Expansion of Proofpoint’s platforms ushers in new defenses – spanning from initial to post compromise – to effectively combat increasingly common threats

Cato Networks Introduces Instant RBI Featuring Single-Click Activation (Cato Networks) Cato partners with RBI leader Authentic8 to improve user productivity without increasing risk

Caveonix Launches NextGen AI-powered Caveonix Cloud 5.0 Platform to Safeguard Enterprise Digital Transformation with Automated Security, Compliance, and Governance of Hybrid Cloud (GlobeNewswire News Room) Caveonix’s AI-driven insights provide customized and prioritized actions unique to user roles. It also ensures real-time auto-remediation to minimize...

Rubrik Ups the Ante with $10 Million Ransomware Recovery Warranty (GlobeNewswire News Room) Response to New White House National Cybersecurity Strategy Deepens Trust and Commitment to Shared Responsibility with Customers...

Arctic Wolf Launches OEM Solutions to Enable Embedded Security Operations Capabilities (GlobeNewswire News Room) OEMs, ISVs, and large enterprises gain access to the power and scale of the Arctic Wolf Security Operations Cloud...

Arctic Wolf Launches Cyber JumpStart Solution to Help Insurance Brokers and Carriers Address the Cyber Insurability Gaps of Their Clients (GlobeNewswire News Room) Comprehensive suite of tools designed to improve business resilience and reduce the frequency and severity of cyber claims ...

Rubrik & Zscaler Announce Industry’s First Double Extortion Ransomware Solution (GlobeNewswire News Room) Data-at-rest intelligence combined with data-in-motion security delivers end-to-end cybersecurityThe new integration enables smarter and more complete data...

Kandji Announces Endpoint Detection & Response Solution to Bolster Security for the Mac Ecosystem (GlobeNewswire News Room) With the general availability of Endpoint Detection & Response (EDR), Kandji furthers its position among the world’s most comprehensive device management...

On-Premises Customers Continue to Migrate to BIO-key’s Cloud-Based PortalGuard Identity-as-a-Service Authentication Solution (GlobeNewswire News Room) BIO-key International, Inc. (NASDAQ: BKYI), an innovative provider of workforce and customer identity and...

Lookout Extends Partnership with VMware to Deliver Endpoint-to-Cloud Security With Optimized Network Connectivity | Lookout News (Lookout) Lookout, Inc. today announced the integration of the Lookout Cloud Security Platform with VMware SD-WAN™.

Huntress Expands Managed Detection & Response Capabilities to Include Microsoft 365 Protection (GlobeNewswire News Room) New Solution Defends Microsoft 365 Users Against Cyberattacks...

Torq Introduces World’s First Enterprise-Grade Security Hyperautomation Platform (Business Wire) Torq unveils your security product’s favorite security product used by Wiz, Abnormal Security, Armis, SentinelOne, and Fortune 500 companies, featuring innovative GPT AI-based analytics

Cycode Launches New Application Security Orchestration and Correlation (ASOC) Solution (Cycode) Organizations are struggling to manage and secure their development infrastructure. The number of development tools in modern software delivery pipelines has exploded.

SSPM Solutions | Security in SaaS (Valence Security) SSPM solutions provide SaaS security with collaborative remediation workflows to contextualize & reduce SaaS data sharing, supply chain, identity & misconfiguration risks.

Paladin Cloud launches new SaaS cloud security platform to help enterprises define their cyber asset attack surface and extend their security posture (GlobeNewswire News Room) New advancements in identifying security risks help developers and security teams significantly reduce their exposure to vulnerabilities and threats...

Spin.AI Announces New Google Integration for App Risk Assessment (Spin.AI) Google integration for Chrome Extensions risk assessment and SaaS security

Interpres Security Operationalizes Threat Exposure Management Programs by Continuously Improving Defensive Posture & Managing Risk (PR Newswire) Interpres Security, a company dedicated to right-sizing and optimizing defenses to reduce threat exposure, today announced new enhancements to...

SentinelOne® Unveils Revolutionary AI Platform for Cybersecurity (Business Wire) Industry-first offering will leverage generative artificial intelligence and reinforcement learning capabilities to detect, stop and autonomously remediate attacks across the enterprise at machine speed

JupiterOne Enters RSA 2023 With Innovative AI Capability, New Query Builder, and Exclusive Security Research (PR Newswire) JupiterOne, the leading cyber asset visibility and management company, is kicking off RSA 2023 with several product enhancements including new...

Akamai Announces Brand Protector to Defend Against Phishing Attacks and Fake Websites (Akamai) Akamai Technologies, Inc. (NASDAQ: AKAM), the cloud company that powers and protects life online, today announced the availability of Brand Protector, a new solution that detect and disrupt phishing sites, fake stores, and brand impersonations. Brand Protector enables organizations to retain and grow customer loyalty while minimizing loss, drops in productivity and bad customer feedback.

CrowdStrike Introduces CrowdStream to Accelerate and Simplify XDR Adoption (CrowdStrike) CrowdStrike today introduced CrowdStream, powered by open observability company Cribl. CrowdStream, a new native platform capability, will be available at no additional cost for the first 10GB of streaming data to new and existing CrowdStrike Falcon platform customers.

Technologies, Techniques, and Standards

CISA Releases Two SBOM Documents (Cybersecurity and Infrastructure Security Agency CISA) Today, CISA released two community-drafted documents around Software Bill of Materials (SBOM): Types of SBOM documents and Minimum Requirements for Vulnerability Exploitability eXchange (VEX).

DHS task force will examine how to use A.I. to protect homeland security (CNBC) Secretary Alejandro Mayorkas said the technology could potentially be used to better screen for imports of goods produced by forced labor as well as fentanyl.

National push to bolster security of key election technology (AP NEWS) An effort to create a national testing program for technology central to U.S elections will get underway later this year. The aim is to strengthen the security of equipment that's been targeted by foreign governments and that's provided fertile ground for conspiracy theories.

Hacker Group Names Are Now Absurdly Out of Control (WIRED) Pumpkin Sandstorm. Spandex Tempest. Charming Kitten. Is this really how we want to name the hackers wreaking havoc worldwide?

Design and Innovation

Prototype cyber tech has revolutionary potential | Computer Weekly (ComputerWeekly) The so-called CHERI protection model developed at the University of Cambridge is showing great promise for future cyber security technologies.

Google says its AI developed unexpected skills (Quartz) The company’s AI experts call the feature a “black box”

AI Can't Solve this Famous Murder Mystery Puzzle (Scientific American) The 1934 puzzle book  Cain’s Jawbone  stumped all but a handful of humans. Then AI took the case

ChatGPT and AI Will Make Humans More Necessary, Not Replace Them (World Politics Review) While concerns about artificial intelligence’s effects on the economy and job market are understandable, we shouldn’t overreact.

The Companies That Are Threatened by ChatGPT (The Information) Big software companies including Microsoft and Salesforce are racing to incorporate the technology behind ChatGPT, known as generative artificial intelligence, into their products to attract new users and boost profits. But the rapidly advancing technology threatens other companies that have ...

AI is hijacking these actors’ voices. Can you tell the difference? (Washington Post) Advances in artificial intelligence have allowed software to recreate voices with eerie precision. The technology puts voice actors, often-nameless professionals, in a precarious position.

Academia

Inaugural Langevin Symposium addresses cybersecurity and cyberwarfare (University of Rhode Island News) When U.S. Army Major General William J. Hartman first joined the military 34 years ago, he and his fellow soldiers arrived on the battlefield by jumping out of an airplane. Today, the battlefield that concerns Hartman the most is not accessible via aircraft or any other vehicle. As […]

Eastern Washington Eagles take first in national cybersecurity competition (NonStop Local KHQ) A group of computer science students at Eastern Washington University won a national cybersecurity competition on Saturday, narrowly beating out a number of other cyberteams from major universities.

Students spend weekend as cyber sleuths, trace fictional attack (Auburn University) A large-scale cyberattack targeted a water company with aims at disrupting service to thousands of customers. What was the entry and extent of the attack? Who was behind the attack and what was its purpose?

Cyber games night Friday at Peninsula College | Peninsula Daily News (Peninsula Daily News) Peninsula College will host Cyber Games Family Night at 5 p.m. Friday.

Legislation, Policy, and Regulation

Top legislature to deliberate Counter-Espionage Law amendment with focus on fighting cyber spying (Global Times) China's top legislature is set to review the draft of a Counter-Espionage Law Amendment in a Monday-Wednesday session to improve regulation on cyber espionage activities amid the nation's push for overall national security.

Government launches new cyber security measures to tackle ever growing threats (GOV.UK) New and enhanced cyber security measures will better protect the UK government’s IT systems, which run key services for the public, from growing cyber threats.

Irish government staff advised to remove TikTok from work devices (Reuters) The state body responsible for advising the Irish government on cyber security recommended on Friday that staff at government departments and state agencies not use Chinese-owned video app TikTok on official devices.

The Cyber Resilience Act Threatens Open Source (Hackaday) Society and governments are struggling to adapt to a world full of cybersecurity threats. Case in point: the EU CRA — Cyber Resilience Act — is a proposal by the European Commission to …

Biden’s cybersecurity strategy is bold, but it may get held up in Congress (VentureBeat) All stakeholders must work together to make Biden's proposed cybersecurity strategy successful — and our country will be better off for it.

FDA Issues Guidance on Premarket Submissions for Cyber Devices (American Bar Association) On March 30, 2023, the FDA issued a guidance document called Cybersecurity in Medical Devices: Refuse to Accept Policy for Cyber Devices and Related Systems Under Section 524B of the FD&C Act. The document signals the FDA’s initial approach to

GAO: DHS Must Clarify Cyber Acquisition Policies (Meritalk) A new report from the Government Accountability Office (GAO) says that the Department of Homeland Security (DHS) needs to clarify some of its cybersecurity policies when it comes to the department’s acquisition programs.

'The problem child’: FBI’s Hill allies warn it is fueling surveillance angst (POLITICO) The bureau is at the heart of a fight over a controversial surveillance program. But its toxic relationship with the House GOP means it has to stay far away from reauthorization talks.

Leak of Government Secrets Adds Pressure to Overhaul Security Clearances (Wall Street Journal) A new U.S. government report warned that inconsistent vetting procedures and backlogs are among the factors that hobble the security-clearance system.

Limit access to most secret US documents, Senate intel panel head says (Reuters) Too many people have access to the U.S. government's closest secrets and a central entity should oversee the classification process, the chairman of the Senate Intelligence Committee said on Sunday, addressing leaks of documents in an online chat group.

Limit access to US secret documents, Democrat says in response to leaks (the Guardian) Chair of Senate intelligence committee addresses Pentagon leaks and says central entity should oversee classification process

NFTs: US Policies and Priorities in 2023 (ITIF) Non-fungible tokens, or NFTs, offer unique policy challenges. While the United States has taken some important steps to address the potential risks and benefits of the technology, there is more policymakers can do to protect consumers while encouraging innovation.

Cyber-attack protection bill signed into law (NBC Right Now ) OLYMPIA, Wash.- A committee to create a plan against cybersecurity threats will be created after Governor Jay Inslee signed Senate Bill 5518.

Wisconsin kids could see a curfew for social media use under proposed legislation (Wisconsin Public Radio) Wisconsin's teenagers could see their access to social media limited under legislation being considered at the state Capitol.

Why child safety bills are popping up all over the US (MIT Technology Review) They’re shaping consequential policies around privacy, parental rights, and speech in the US.

Litigation, Investigation, and Law Enforcement

Israel Police use of NSO spyware set to be probed by Knesset subcommittee (Times of Israel) Panel will discuss findings and recommendations of dossier produced last year by Deputy Attorney General Amit Merari

This court case could further shape commercial tech requirements in contracts (Washington Technology) Percipient.AI says it has the right commercial data analytics tool for a National Geospatial-Intelligence Agency program and wants a federal judge to ensure it joins the prime contractor's team.

Autonomy founder Mike Lynch loses appeal against extradition to US (the Guardian) Tech entrepreneur alleged to have duped Hewlett-Packard into overpaying for software in $11bn deal

Hacked therapy centre's ex-CEO gets 3-month suspended sentence (YLE) The district court characterised the defendant's actions as particularly reprehensible, due to the scale of the data breach as well as the sensitive nature of the information involved.

S.B.F. and The Mooch’s Arabian Nights (Puck) What could possibly go wrong on a heavy-duty fundraising trip to the Middle East (with cameos from M.B.S., Jared, and Schwarzman) with FTX secretly on the brink of collapse?

Pune court convicts 11 accused in Cosmos Bank cyber fraud case (Deccan Herald) A court in Maharashtra's Pune district has convicted 11 people in the Cosmos Bank cyber fraud case, in which hackers siphoned off more than Rs 94 crore through a malware attack over a period of two days in 2018, police said on Sunday. The judicial magistrate (first class) on Saturday sentenced nine of the accused to four years' imprisonment and two others to three years and imposed a fine on them, an official said. The accused were convicted of charges under relevant provisions of the Indian Penal Code and the Information Technology Act, he said.

The IRS is sending four investigators across the world to fight cybercrime (TechCrunch) The IRS plans to send four investigators specialized in cybercrime to Australia, Singapore, Colombia and Germany for a 120-day pilot program.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

RSAC 2023 (San Francisco, California, USA, Apr 24 - 27, 2023) We couldn’t be more excited about the RSAC 2023 theme: Stronger Together. In the cybersecurity industry, no one goes it alone. Instead, we build on each other’s diverse knowledge to create the next breakthrough—exchanging ideas, sharing our success stories, and bravely examining our failures. Now that we’ve nailed the theme, we are hard at work planning the agenda, building out the RSAC Sandbox and other hands-on learning experiences, networking opportunities, and so much more. Already excited for next year? Us too!

AFCEA Spring Intelligence Symposium (Springfiled, Virginia, USA, Apr 25 - 26, 2023) The 41st annual AFCEA Intelligence Symposium returns to the NGA Campus East in Springfield, Virginia on April 25-26, 2023. This classified (TS/SI/TK/NOFORN) two-day flagship intelligence event is a forum for Intelligence Community professionals and an ideal venue for learning and networking. The symposium will focus on government, industry and academia partnering essential to meeting the intelligence demands posed by an ever more integrated cross-domain threat. Our discussions will be informed by an Intelligence Community assessment of this environment and the capabilities needed to inform policy and operations within it. These insights will be deepened by consideration of lessons being learned from the war in Ukraine, initiatives being undertaken to defend space as the essential enabler of United States integrated domain operations, and the need for new approaches to deterrence in a multi-polar world. The risk from economic espionage will also be explored along with its impact on pursuing market opportunities while preserving operational advantage that derives from commercial space and other emerging disruptive technologies. Through these discussions, symposium participants will gain a more informed perspective on evolving intelligence requirements and the opportunities for partnerships to address them.

Future Compute (Cambridge, and virtual, Massachussetts, USA, Apr 30 - May 1, 2023) Embrace emerging technologies to compete with compute. Future Compute offers CTOs and IT Leadership the emerging technology and strategy insight required to outpace change and ensure their digital infrastructure aligns to and exceeds business goals.

TechNetCyber (Baltimore, Maryland, USA, May 2 - 4, 2023) The harnessing of the right cyber power is more important than ever in a domain deluged by persistent attacks and simultaneous sophisticated campaigns that threaten global political, economic and security interests. A flagship event, AFCEA’s TechNet Cyber serves as a center of gravity for a whole-of-government effort to bring together the policy, strategic architecture, operations and C2— along with the joint capabilities—needed to meet the global security challenges and successfully operate in a digital environment. Join us in Baltimore and be a part of the conversation led by U.S. Cyber Command, DISA, the DoD CIO, and numerous industry and academia partners to deliver solutions for this enduring, no-fail mission.

SecureWorld Kansas City (Kansas City, Kansas, USA, May 3, 2023) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational elements learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.