Current news of cyber gangland. Cyberespionage hits NGO. Hacktivism, supply chains, and developments in hybrid warfare.

Summary

By the CyberWire staff

At a glance.

Google targets CryptBot malware infrastructure.
FIN7 used CVE-2023-27532 to attack Veeam servers and steal credentials.
Ransomware-as-a-service offering threatens Linux systems.
Chinese APT group Evasive Panda targets NGOs in China.
Anonymous Sudan is active against targets in Israel.
Russian ransomware operations aim at disrupting supply chains into Ukraine.
KillNet declares itself a Russian “Private Military Hacker Company.”
Prosecutors ask that accused Discord Papers leaker remain in custody.
Bots want new kicks.

Google targets CryptBot malware infrastructure.

Google blogged yesterday explaining steps they’re taking to disrupt the CryptBot malware gang’s infrastructure after securing a court order against the malware’s operators. The tech giant has filed litigation against the CryptBot distributors, who they believe operate out of Pakistan and run what they call a “worldwide criminal enterprise.“ The legal complaint Google filed is based on multiple claims, which include “computer fraud and abuse and trademark infringement.” The company has been granted a temporary restraining order, Bleeping Computer reports, that allows for them to take down domains both now, and in the future that are linked to the malware. Google says that this will hinder CryptBot’s growth and decelerate the infection rate (which Google estimated at about 670,000 last year). “Lawsuits have the effect of establishing both legal precedent and putting those profiting, and others who are in the same criminal ecosystem, under scrutiny.” For more on Google's action against CryptBot, see CyberWire Pro.

The mWISE Call for Speakers is now open. Help security’s best get better.

Take lead in a global community of security pros. Be a speaker at mWISE.

FIN7 used CVE-2023-27532 to attack Veeam servers and steal credentials.

WithSecure Intelligence reported yesterday that the FIN7 Russian cybercrime group was likely behind the attack on Veeam Backup and Replication servers. The gang was able to steal credentials using a custom PowerShell script not previously associated with FIN7. “Our research indicates with high confidence that the intrusion set used in these attacks is consistent with activities attributed to the FIN7 activity group. It is likely that initial access & execution was achieved through a recently patched Veeam Backup & Replication vulnerability, CVE-2023-27532.” WithSecure Intelligence explained that there are some uncertainties on how the threat actor was able to gain access, but explained that the servers were not patched to deal with CVE-2023-27532. WithSecure Intelligence concluded:

“WithSecure Intelligence has so far identified two instances of such attacks conducted by FIN7. As the initial activity across both instances were initiated from the same public IP address on the same day, it is likely that these incidents were part of a larger campaign. However, given the probable rarity of Veeam backup servers with TCP port 9401 publicly exposed, we believe the scope of this attack is limited.

“Nonetheless, we advise affected companies to follow the recommendations and guidelines to patch and configure their backup servers appropriately as outlined in KB4424: CVE-2023-27532. The information in this report as well as our IOCs GitHub repository can also help organizations look for signs of compromise.”

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

Ransomware-as-a-service offering threatens Linux systems.

The Uptycs threat research team released a blog this morning detailing a ransomware-as-a-service (RaaS) offering impacting Linux systems. This malware is attributed to RTM Group, and researchers say it “appears to be inspired by Babuk ransomware's leaked source code. It uses a combination of ECDH on Curve25519 (asymmetric encryption) and Chacha20 (symmetric encryption) to encrypt files.” The team reports that they found the hacker group through dark web hunting, and that the malware is focused on ESXi hosts. The initial point of access remains unknown.

Chinese APT group Evasive Panda targets NGOs in China.

ESET reported yesterday that Evasive Panda, a Chinese APT group also known as BRONZE HIGHLAND and Daggerfly, had conducted a campaign to install its custom MsgBot backdoor malware on Chinese users by using malicious software updates for legitimate applications. BleepingComputer writes “Evasive Panda is a cyberespionage group active since at least 2012 that has previously targeted organizations and individuals in mainland China, Hong Kong, Macao, Nigeria, and various countries in Southeast and East Asia.”

ESET explains that, “The majority of the Chinese victims are members of an international NGO that operates in two of the previously mentioned provinces. One additional victim was also discovered to be located in the country of Nigeria.” ESET assesses that Evasive Panda may have compromised the messaging software Tencent QQ and its update servers in order to tailor their targeting list and distribute corrupted updates targets of interest while providing legitimate updates to non-targets. This campaign would then be classified as a supply chain attack (much like the attack on SolarWinds, or the more recent 3CX attacks) since it uses upstream infiltration of third parties to infect downstream users with malware through updates or software downloads. Evasive Panda’s goal in this campaign seems to be credential theft.

Anonymous Sudan is active against targets in Israel.

The Jewish Press reports that Anonymous Sudan, generally regarded an Islamist group with a primarily religious set of motivations, has conducted a denial-of-service attack that rendered webpages of Israel's Supreme Court inaccessible.

Apart from any religious motivation, Anonymous Sudan also has a Russian connection, or at least some Russian hacktivists say that it does. KillNet again boasted Monday that Anonymous Sudan was a part of the KillNet network, and that this claimed Sudanese affiliate are experiencing troubles conducting operations due to the civil war in Sudan. This underlines Russia’s continued interest in Sudan and, as Deutsche Welle reports, ”Sudan has long been a particular focus for Wagner mercenaries, and there are many of them there. Back during the rule of the dictator Omar al-Bashir, who was in power from 1993 to 2019, licences already went to the Russian firm "M-Invest," which is probably under the control of oligarchs, including Wagner boss Yevgeny Prigozhin. This led to Wagner members being given the job of protecting the M-Invest gold mines in Sudan.”

Russian ransomware operations aim at disrupting supply chains into Ukraine.

The US Intelligence Community sees Russian cyber operators devoting more effort toward disruption of supply chains supporting Ukraine. CyberScoop quotes NSA's Rob Joyce, the agency's director of cybersecurity, as saying that NSA is observing “a significant amount of intelligence gathering into the Western countries, to include the U.S., in that logistics supply chain.” A significant fraction of that supply chain carries humanitarian aid.

And KillNet declares itself a Russian “Private Military Hacker Company.”

Looking, apparently, for a bigger payday, yesterday the Russian cyber auxiliary KillNet announced that they would become Russia’s “Private Military Hacker Company (PMHC).” What this means for their operational tempo is unclear, but they promised they would continue distributed denial-of-service (DDoS) attacks against NATO sites as they pursue their current objective of “destroying NATO infrastructure.” The group says it will now also accept jobs from private individuals and from governments. They will still work to defend Russian interests. They explained in their post that they will no longer be making money from donations and promised sponsorships (and they included an emoji that indicated the sponsorships fell short of expectations).

Earlier this month KillMilk, the group’s nominal leader, explained that he was tired of waiting for government personnel and businessmen to fund his group’s cyber escapades. Shortly after their announcement they changed their channel name to PMHC KillNet. This could be just a publicity stunt, as the ramifications of a cybercriminal group sanctioned by Moscow attacking NATO websites are unknown but probably severe. KillNet has yet to release any information on pending contracts (either governmental or private) to conduct cyber warfare.

Prosecutors ask that accused Discord Papers leaker remain in custody.

According to the AP, US Federal prosecutors have asked that Jack Teixeira, charged with violations of the Espionage Act, be held in custody and not, as Airman Teixeira's defense is expected to request, be released to his parents. “There simply is no condition or combination of conditions that can ensure the Defendant will not further disclose additional information still in his knowledge or possession,” prosecutors wrote in their petition. “The damage the Defendant has already caused to the U.S. national security is immense. The damage the Defendant is still capable of causing is extraordinary.”

The Air Force has suspended two leaders in Airman Teixeira's former organization, CNN reports. “The commander of the 102nd Intelligence Wing at Otis Air National Guard Base, Massachusetts, has suspended the commander of the 102nd Intelligence Support Squadron pending further investigation into the unauthorized disclosure of classified information,” an Air Force representative told CNN. “Additionally, the detachment commander overseeing administrative support for Airmen at the unit mobilized for duty under Title 10 USC has also been suspended,”

The AP reports that investigators are still working to determine whether Airman Teixeira retained any other classified information that has so far remained unreleased. Investigators and prosecutors have also not discussed Airman Teixeira's possible motives for the alleged leaks, but the consensus among Discord users who had been in touch with him is that he was simply showing off, without any serious political purpose.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Bots want new kicks.

What are the scalper bots after nowadays? Sneakers, lots of sneakers, Netacea reports. The scalper bots are especially partial to Black and White Nike Dunk Low Panda. And while they certainly love them some sneakers, the bots don't work via sneakernet.

Notes.

Today's issue includes events affecting Brazil, China, Czechia, Hungary, Iran, Israel, the Democratic People's Republic of Korea, the Republic of Korea, Malaysia, Myanmar, Nigeria, the Philippines, Russia, Taiwan, Ukraine, the United Kingdom, the United States, and Vietnam.

Dateline

Ukraine at D+427: Russian cyberattacks and disinformation before Ukraine's spring offensive. (CyberWire) As Ukraine completes preparations for its spring offensive, Russia seeks to redress the balance of forces with disinformation and ransomware attacks on logistical chains.

Russia-Ukraine war: List of key events, day 428 (Al Jazeera) As the war enters its 428th day, we take a look at the main developments.

Live Briefing: Russia Invades Ukraine (RadioFreeEurope/RadioLiberty) RFE/RL's Ukraine Live Briefing gives you the latest developments on Russia's ongoing invasion, Western military aid, global reaction, and the plight of civilians. The Live Briefing presents the latest developments and analysis, updated throughout the day.

Wagner Group Leader Accuses Russian 'Decision-Makers' Of Treason For Lack Of Ammunition In Ukraine (RadioFreeEurope/RadioLiberty) Yevgeny Prigozhin, the Kremlin-connected businessman who controls the notorious Wagner mercenary group, has accused “decision-makers” in Russia of treason for not providing his troops and military units of Russia's regular armed forces with ammunition needed to fight in Ukraine.

Ukrainian journalist killed by Russian snipers in ambush near Kherson (the Guardian) Bogdan Bitik was working as a fixer for Corrado Zunino, Italian correspondent for La Repubblica, who was wounded

How Ukraine's artillery is doing more damage than Russia's, even with fewer rounds (Business Insider) If the trend continues, then the days of artillery batteries blasting away blindly at map coordinates may be over.

Investigative Report Says Putin Made Decision To Invade Ukraine In March 2021 (RadioFreeEurope/RadioLiberty) An investigative report by the Vyorstka online newspaper says Russian President Vladimir Putin made the decision to invade Ukraine in early March 2021.

Ukraine's Zelenskyy upbeat after talk with China's Xi (AP NEWS) Ukrainian President Volodymyr Zelenskyy says he and Chinese leader Xi Jinping have had a “long and meaningful” phone conversation in their first known contact since Russia invaded Ukraine. In the call, Beijing said it wanted to send an envoy to Kyiv to serve as a mediator to pursue a “political settlement.” The development came a month after Xi visited Moscow. It also comes as Ukraine is readying its forces for an expected spring counteroffensive. Russia's Foreign Ministry commended China’s approach but was scathing about Ukraine’s stance. Western analysts expressed skepticism about the prospects for peace.

Ukrainian President Zelensky held ‘meaningful’ call with China’s Xi Jinping (Washington Post) Ukrainian President Volodymyr Zelensky and China’s Xi Jinping spoke by phone Wednesday — their first conversation since Russia invaded Ukraine 14 months ago and a signal that Beijing may be angling to play a mediating role.

How China Could Save Putin’s War in Ukraine (Foreign Affairs) The logic—and consequences—of Chinese military support for Russia.

U.S. Envoy Calls Hungary's Call For A Ukraine Cease-Fire 'Cynical' (RadioFreeEurope/RadioLiberty) The Hungarian government's call for a cease-fire in Ukraine is "cynical" given large swathes of the country are occupied by invading Russian forces, the U.S. Ambassador to Hungary David Pressman said on April 26.

DOD Officials Detail Efforts to Support Ukraine, Defend NATO (U.S. Department of Defense) Russia's unprovoked invasion of neighboring Ukraine has provoked the worst security crisis in Europe since World War II, and nations around the globe are rallying to help Ukraine defend its

Ukraine’s Azov brigade races to rebuild ahead of fateful fight (Washington Post) The Azov brigade, hailed by Ukrainians for its tenacity during Russia’s siege of Mariupol, is scrambling to rebuild from heavy combat losses as it seeks to play a muscular role in Ukraine’s next major assault.

Military must train to fight when communications break down: experts (C4ISRNet) “We should take it as a given that in places, our communications are going to break and fail,” said Center for a New American Security's Andrew Metrick.

Opinion What 6 data points tell us about the status of the war in Ukraine (Washington Post) As a rather mild winter in Eastern Europe turns to spring and mud turns gradually to firm soil, the Russia-Ukraine war is entering a new phase. The question is whether this will lead to a change in warfare — from the high-intensity attrition kind that has been going on for the past six months to so-called maneuver warfare, in which positions and territorial holdings can shift significantly.

Why Russia's cyber arms transfers are poor threat predictors (CSO Online) Sharing cyber tools and technology with nations such as Iran or North Korea has limited impact without also providing operational and organizational support.

NSA sees 'significant' Russian intel gathering on European, U.S. supply chain entities (CyberScoop) Russian hackers are targeting Ukrainian and European supply chains to disrupt the flow of humanitarian goods and lethal aid into Ukraine.

Chinese and Russian hackers are making moves. Here’s how the NSA is trying to counter them. (Washington Post) NSA cyber chief discusses Discord Leaks risks, foreign hackers and spying

NSA cyber director warns of ransomware attacks on Ukraine, Western supply chains (Record) Russian hackers are attempting to inject ransomware into Ukraine's logistics supply chain and those of the Western countries that back Kyiv in its fight against Moscow, a senior National Security Agency official said on Wednesday.

EU warns Twitter over disinformation after Musk policy shifts found to boost Kremlin propaganda (TechCrunch) The European Commission hasn't wasted any time warning the Elon Musk-owned social network that things aren't looking good for staying on the right side of the bloc's incoming digital rulebook.

The Era of Hybrid Warfare: How Space Became the Latest Dimension in Conflict (Via Satellite) PARIS — Speaking at the Cysat event in Paris, France, Greg Wyler, founder and CEO of E-Space, said that gateways are the biggest security vulnerability in

Releasing leak suspect a national security risk, feds say (AP NEWS) Federal prosecutors are urging a judge to keep behind bars a Massachusetts Air National guardsman accused of leaking highly classified military documents, arguing he may still have access to secret national defense information that he could expose. In court papers filed late Wednesday, the Justice Department lawyers said releasing 21-year-old Jack Teixeira from jail while he awaits trial would be a grave threat to U.S. national security. A detention hearing is scheduled for Thursday in the federal court in Worcester. Teixeira has been in jail since his arrest earlier this month on charges stemming from the highest-profile intelligence leak in years.

Pentagon leak suspect may still have access to classified info, court filings allege (the Guardian) Jack Teixeira, 21, expected to appear in Massachusetts court on Thursday as prosecutors urge judge to keep him behind bars

Air Force suspends leadership for unit of suspected Pentagon document leaker | CNN Politics (CNN) The Air Force suspended two leaders of suspected classified document leaker Jack Teixeira's unit, it said in a statement Wednesday, one week after the unit stopped performing its intelligence mission amid an investigation into the leaks.

Ukrainian arrested for selling data of 300M people to Russians (BleepingComputer) The Ukrainian cyber police have arrested a 36-year-old man from the city of Netishyn for selling the personal data and sensitive information of over 300 million people, citizens of Ukraine, and various European countries.

Ukraine launches ‘BRAVE1′ tech cluster to boost military capability (C4ISRNet) The government aims to bring state, military and private sector developers together to give Ukraine a battlefield advantage.

Trial Begins Of Yevgeny Roizman, One Of The Last Prominent Kremlin Critics Not Behind Bars (RadioFreeEurope/RadioLiberty) Yevgeny Roizman, the former mayor of the Urals city of Yekaterinburg and one of the last prominent opposition figures left in Russia who is not behind bars, went on trial on April 26 on a charge of "repetitively discrediting the armed forces" involved in the Kremlin's invasion of Ukraine.

Czechs Put Russian Patriarch Kirill On Sanctions List Over Comments On War In Ukraine (RadioFreeEurope/RadioLiberty) The Czech government has made the head of the Russian Orthodox Church the first person on its national sanctions list due to his support for Russia's invasion of Ukraine, Foreign Minister Jan Lipavsky said on April 26.

‘We created our own weapon’: the anti-invasion magazines defying Putin in Ukraine (the Guardian) Visually striking and politically strident, a new subgenre of magazines in Kyiv and Russia is sharing images and stories of the invasion to challenge ‘the Putin myth’

UK company set up in name of top Putin official in Ukraine (the Guardian) Volodymyr Saldo, a Kremlin puppet in the Russian-occupied territories, listed as firm’s owner, despite being under sanctions

Attacks, Threats, and Vulnerabilities

FIN7 Hackers Caught Exploiting Recent Veeam Vulnerability (SecurityWeek) Russian cybercrime group FIN7 has been observed exploiting a Veeam Backup & Replication vulnerability patched in March 2023.

RTM Locker Ransomware as a Service (RaaS) Now on Linux (Uptycs) Uptycs threat research team discovered a new ransomware Linux binary attributed to the RTM Locker group, a known Ransomware-as-a-Service (RaaS) provider.

Evasive Panda APT group delivers malware via updates for popular Chinese software (WeLiveSecurity) ESET Research uncovers a campaign by Evasive Panda that targeted an international NGO in China with malware delivered through updates of popular software.

Evasive Panda's Backdoor MgBot Delivered Via Chinese Software Updates (Infosecurity Magazine) Most of the plugins are designed to steal information from highly popular Chinese applications

Tencent QQ users hacked in mysterious malware attack, says ESET (BleepingComputer) The Chinese APT hacking group known as 'Evasive Panda' are behind a mysterious attack that distributed the MsgBot malware as part of an automatic update for the Tencent QQ messaging app.

Chinese-speaking hackers compromised Tencent app to spy on nonprofit, report says (Record) Cybersecurity company ESET says a group known as Evasive Panda, Bronze Highland or Daggerfly tried to spy on a nonprofit in China using malware delivered through the Tencent QQ app.

CrowdStrike details new MFA bypass, credential theft attack (Security | TechTarget) CrowdStrike executives demonstrated a new MFA bypass technique at RSA Conference, which has been used in the wild by a threat group.

Iranian cyberspies deploy new malware implant on Microsoft Exchange Servers (CSO Online) Attacks using the BellaCiao malware dropper seem to be customized for specific targets.

Iranian hacking group targets Israel with improved phishing attacks (CSO Online) Research by CheckPoint presents a new and improved infection chain leading to the deployment of a new version of a Windows backdoor called PowerLess.

Iranian hackers targeted Israelis using rare cyber attack techniques (The Jerusalem Post) The new malware allows hackers to steal data from Telegram and take screenshots and record sound.

‘Anonymous Sudan’ Cyber Attack Targets Israel’s Supreme Court (Jewish Press) Although the group said it had also attacked the Israel Post website, it did not appear to be affected when accessed by JewishPress.com.

Can Someone With No Programming Experience Write Ransomware Using ChatGPT? (Avertium) Two team members with no programming experience were able to successfully manipulate ChatGPT into writing ransomware encryptors. Let's go into the details.

Hackers are breaking into AT&T email accounts to steal cryptocurrency (TechCrunch) A gang of cybercriminals broke into the accounts of several AT&T email users with the goal of stealing their cryptocurrency.

School documents leaked by hackers appear to include the most sensitive of student records (NBC News) The leak is a stark reminder of the reams of sensitive information held by schools, and that such leaks often leave parents and administrators with little recourse.

Hackers Leaked Minneapolis Students' Psychological Reports, Allegations of Abuse (Gizmodo) In a hacking episode that is spiraling from bad to worse, cybercriminals have leaked highly sensitive documents related to droves of Minneapolis students.

Truman State University slowly recovering from ‘cybersecurity virus attack’ (Record) Truman University in Kirksville, Missouri said it is in the process of recovering from a “cybersecurity virus attack” last week that forced it to shut down the campus network and order all school-issued devices to be turned off.

It was a data leak, not a breach or a hack – PNP (INQUIRER.net) The Philippine National Police had “serious lapses” after more than a million identity documents and private records of police personnel and applicants were exposed

Netacea Quarterly Index: Top 5 Scalper Bot Targets of Q1 2023 (Netacea) Netacea’s Threat Research team provides expert analysis on the most scalped items from January to March 2023.

Security Patches, Mitigations, and Software Updates

PrestaShop fixes bug that lets any backend user delete databases (BleepingComputer) The open-source e-commerce platform PrestaShop has released a new version that addresses a critical-severity vulnerability allowing any back-office user to write, update, or delete SQL databases regardless of their permissions.

Trends

New OnSolve® Report Shows Physical Threats are Skyrocketing, but CEOs are Unprepared (PR Newswire) OnSolve, a leading critical event management provider that enables organizations to mitigate physical threats and remain agile when a crisis...

Checkmarx' Global Pulse on AppSec Study Finds 88% of AppSec Managers Surveyed Experienced at least One Breach in Prior Year as a Direct Result of Vulnerable Application Code (PR Newswire) Checkmarx, the global leader in application security solutions, today released its Global Pulse on Application Security study at the 2023 RSA...

New coercive tactics used to extort ransomware payments (Help Net Security) The increase in reported ransomware victims across Q1 2023 reflects the continued prevalence of ransomware as a worldwide threat.

First Annual BioCatch EMEA Fraud Intelligence Report Reveals Scams Now Account for more than 50% of reported banking fraud in Europe & Middle East Banking Markets (PR Newswire) BioCatch, the leader in behavioral biometric intelligence and digital fraud detection, today released its first annual EMEA Digital Banking...

Delinea Onsite RSA Conference Survey Reveals Cloud Security Remains Top Cybersecurity Concern in 2023 (PR Newswire) Delinea, a leading provider of solutions that seamlessly extend Privileged Access Management (PAM), today announced the results of an anonymous...

Governments blocked Twitter and Facebook the most in 2022 (Atlas VPN) In today's digital age, social media has become a powerful tool for communication, activism, and information dissemination. However, some governments worldwide have resorted to imposing internet shutdowns and social media blocks to control the flow of information and suppress conflict.

Marketplace

Metomic Raises $20 Million to Protect Sensitive Data in SaaS Applications (Business Wire) As a data security solution focused solely on SaaS ecosystems, Metomic will use the Series A funding round to expand into the U.S.

Cyber Defense Magazine Announces Winners of the Global InfoSec Awards (PRWeb) Cyber Defense Magazine (CDM), on its 11th anniversary, the industry’s leading electronic information security magazine has spent the past six months scouring

NINJIO named “Hot Company in Security Awareness Training” at RSA & Global InfoSec Awards (NINJIO) Cybersecurity awareness training company, NINJIO, is excited to announce they have received two awards from Cyber Defense Magazine during the 2023 RSA Conference including “Hot Company in Security Awareness Training” and “Most Comprehensive Cybersecurity Training Videos.” “We’re delighted that our innovative and effective cybersecurity awareness solution has been recognized as an industry leader at this year’s RSA Conference,”

AppOmni Expands Ignition Technology Partnership to Northern Europe (Business Wire) Partnership brings SaaS security platform to Nordics, Baltics, and Benelux regions through MSPs, VARs, and MSSPs.

Outpost24 Expands Leadership Team by Appointing Brendan Hogan as Chief Strategy Officer (Business Wire) Outpost24, a leading innovator in cyber risk management, today announced it has appointed Brendan Hogan as Chief Strategy Officer (CSO). Hogan is responsible for spearheading M&A Strategy, Corporate Development and Alliance strategy for the company.

Products, Services, and Solutions

RSA Conference 2023 – Announcements Summary (Day 2) (SecurityWeek) Hundreds of companies are showcasing their products and services this week at the 2023 edition of the RSA Conference in San Francisco.

Thales Unveils CipherTrust Ransomware Protection to Safeguard Critical Data (Business Wire) Thales has released CipherTrust Ransomware Protection to help customers safeguard critical files and folders from ransomware attacks.

SaaS Alerts™ Launches Unify, the World’s First Cybersecurity Solution That Provides Visibility Between SaaS Applications and End-User Devices using RMM Agents (SaaS Alerts) SaaS Alerts announces the first-of-its kind solution to provide visibility between SaaS applications and end user devices using RMM agents.

BigID Launches BigAI: Adapting Generative AI to Accelerate Data Security, Governance and Risk Management (PR Newswire) BigID, the leading platform for data security, compliance, privacy, and governance, today announced the launch of BigAI, its newest AI engine...

BigID and Thales Collaborate to Deliver Comprehensive Data Protection and Privacy Compliance (PR Newswire) BigID, the leading data intelligence platform that enables organizations to know their enterprise data and take action for privacy, security,...

Skyhigh Security Announces Major Updates to Product Portfolio at RSA Conference 2023 (Skyhigh Security) The Skyhigh Cloud Platform Simplifies the Adoption of SSE with Unified Protection at Every Control Point

TeamViewer launches next generation remote access and support solution with 1-click sessions, web client and increased security (PR Newswire) Introduction of 1-click sessions: simplifying the connection process similar to joining an online meeting New web client includes all features bridging the gap...

Paperclip SAFE® and TLA Innovation, Inc. Partner to Integrate Encryption-in-Use Within Innovative Identity Authentication Solution (GlobeNewswire News Room) TLA’s BoomID Mobile leverages Paperclip SAFE® to keep data encrypted and readily available...

Award-Winning Ransomware Recovery Solution Boosts Capabilities with Latest Upgrade (GlobeNewswire News Room) Data443 Risk Mitigation, Inc. (OTCPK: ATDS) (“Data443”), a data security and privacy software company for "All Things Data Security," is pleased to announce the latest update to its award-winning Ransomware Recovery Manager product. The latest version offers even more advanced features, designed to help businesses and individuals quickly and easily recover from ransomware attacks.

Shift-Left, Shield Right | Early Availability of Wiz Integration with SentinelOne (SentinelOne) SentinelOne is pleased to announce early availability (EA) of our integration with the Wiz cloud-native application protection platform.

SentinelOne® Sets New Standard for Cloud Security (Business Wire) Company launches integration with Wiz, providing complete visibility into cloud-hosted infrastructure on a single platform, enabling customers to detect and respond to security threats with unparalleled speed

Cybersixgill [RSAC booth 5372] Complements Its Market-Leading Threat Intelligence with New Attack Surface Management (ASM) Module (ACCESSWIRE News Room) New ASM Offering Boosts an Organization's Threat Exposure Management by Uniquely Prioritizing Clear, Deep, and Dark Web CTI Based on Each Organization's Attack Surface Key Takeaways: - Cyber threat intelligence (CTI) leader Cybersixgill has embedded an attack surface management module with its existing solution that automates and streamlines the discovery of unknown assets and systems to deliver real-time insights into an organization's

AT&T and Trinity Cyber Partner to Protect U.S. Air Force Networks - MSSP Alert (MSSP Alert) The AT&T-Trinity joint cyber solution focuses on the tactics, techniques and procedures used by attackers.

Palo Alto Networks embraces AI and ML to automate OT security (SiliconANGLE) Palo Alto Networks embraces AI and ML to automate OT security - SiliconANGLE

Accenture partners with Palo Alto Networks to improve visibility across IT networks (Help Net Security) Accenture and Palo Alto Networks are collaborating to deliver joint SASE solutions powered by Palo Alto NetworksAI-powered PrismaSASE.

Silobreaker wins three top honours at the Global Infosec Awards during RSA conference 2023 (Bdaily Business News) Silobreaker awarded in multiple categories, including ‘Hot Company’ in AI/Machine Learning at Cyber Defense Magazine’s 11th annual awards Silobreaker, a leading…

Sage Leverages Pluralsight Skills to Upskill 1,300+ Engineers in Cybersecurity (Pluralsight) Pluralsight, the technology workforce development company, today announced that Sage, the leader in accounting, financial, HR and payroll technology for small and mid-sized businesses, is leveraging Pluralsight Skills to develop a cybersecurity skills development program, helping to build expertise within its engineering teams globally.

OnbeGuard: Leveraging Behavioral Biometrics to Stop Fraud Before it Happens (Business Wire) By integrating BioCatch’s machine learning technology, OnbeGuard continues Onbe’s drive to innovate with frictionless anti-fraud solutions for companies and for payees.

Technologies, Techniques, and Standards

Zero trust could have limited Pentagon leak, Navy CTO says (C4ISRNet) A zero-trust approach may not have prevented the Discord leak, but the underlying tenets may have helped the Pentagon detect the security breach sooner.

9-Year-Old Horizon3.ai User Challenges Legendary Pentester to Hackathon (Business Wire) Horizon3.ai, a leading cybersecurity firm specializing in AI-fueled autonomous penetration testing, today announced that Daniel Cherry, a 9-year-old user of Horizon3.ai’s product, challenged Jorge Orchilles to a hackathon in response to a derogatory tweet Jorge made about the company’s product NodeZero.

CISOs: unsupported, unheard, and invisible (Help Net Security) CISOs struggle to get the support from the executive board for the resources required to be resilient against cyber attacks.

Design and Innovation

CISA aims to reduce email threats with serial CDR prototype (Security | TechTarget) CISA's Olga Livingston and Thomas Ruoff demonstrated at RSA Conference 2023 how a serial CDR prototype can reduce email threats.

RSA Conference 2023: Innovation Sandbox Finalists Show Promise (ITPro Today) The top prize for RSAC’s Innovation Sandbox went to AI application security startup HiddenLayer, but many other firms had a chance to show off their unique products.

RSA Conference: AI in Cybersecurity Is the Talk of the Town (Spiceworks) Experts believe identity and access management tech, such as zero trust, to be one of the areas that will necessarily have to rely on AI.

Legislation, Policy, and Regulation

The latest tool in China’s influence campaign: Police on social media? (Washington Post) China’s Ministry of Public Security and a major Chinese cybersecurity company appear to be involved in an influence campaign aimed at casting the United States as an irresponsible cyber power, according to a report Wednesday by the Australian Strategic Policy Institute.

South Korea, US agree to cooperate on cybersecurity and combating North Korean digital heists (Record) South Korea and the U.S. announced Wednesday that they have committed to signing a cybersecurity cooperation agreement, citing concerns about North Korea funding its weapons programs with the proceeds of cybercrime.

White House to share roadmap for national cyber strategy implementation this summer (Cybersecurity Dive) Acting National Cyber Director Kemba Walden said the strategy is built to have a 10-year shelf life, allowing for flexibility as new technologies and threats emerge.

AI’s Effects on Cybersecurity Concern U.S. Officials (Wall Street Journal) Rush to deploy ChatGPT and other models may leave organizations open to unknown threats, hacks, cybersecurity officials say.

DHS moves to address the promise, and the perils, of AI (Federal News Network) CBP is moving forward with an effort to embed algorithms in screening technology, while CISA’s director has raised concerns about the “weaponization” of tech.

AI At War - War on the Rocks (War on the Rocks) It is widely believed that the world is on the brink of another military revolution. AI is about to transform the character of warfare, as gunpowder,

US official says Chinese cloud companies like Huawei could pose threat (Reuters) U.S. Commerce Secretary Gina Raimondo said on Wednesday that Chinese cloud computing companies like Huawei Cloud and Alibaba Cloud could pose a threat to U.S. security and vowed to review a request to add them to an export control list.

A US Bill Would Ban Kids Under 13 From Joining Social Media (WIRED) The legislation would insert the government into online platforms' age-verification efforts—a move that makes some US lawmakers queasy.

Litigation, Investigation, and Law Enforcement

'Creative Diplomacy' And The FSB: Was A Russian NGO Bridging Divides Or Spying On Unwitting Participants? (RadioFreeEurope/RadioLiberty) For years, Natalia Burlinova and her NGO promoted “public diplomacy” and Russia’s perspective on the world. The FBI has now issued an arrest warrant alleging it was a project managed by the Russian FSB. Participants say they’re stunned -- but not surprised.

Continuing our work to hold cybercriminal ecosystems accountable (Google) Google shares details on its most recent actions to hold cybercriminals accountable.

Google Disrupts Massive CryptBot Malware Operation (Decipher) A new court order allows Google to take down current and future domains tied to the distribution of the CryptBot infostealer.

Google disrupts malware that steals sensitive data from Chrome users (TechCrunch) A court granted Google a restraining order to take down current and future domains linked to the distribution of the CryptBot malware.

Google disrupts the CryptBot info-stealing malware operation (BleepingComputer) Google is taking down malware infrastructure linked to the Cryptbot info stealer after suing those using it to infect Google Chrome users and steal their data.

Ken Griffin’s Suit Over IRS Data Leak Should Be Tossed, US Says (Bloomberg) Billionaire sued after ProPublica disclosed his tax returns. US argues Griffin didn’t show IRS personnel took his records.

Telegram suspended in Brazil over links to school attacks (Cybernews) Telegram, the encrypted messaging app, was issued a temporary suspension order from a Brazilian court until it starts sharing information on extremist and neo-Nazi groups using the platform.

Brazil court suspends Telegram for not complying with order on neo-Nazi groups (Reuters) A Brazilian court on Wednesday ordered a temporary suspension in the country of the encrypted messaging app Telegram until it complies with an order to share information on extremist and neo-Nazi groups using the platform.

Morgan: Water Resources IT Staff ‘Extremely Competent’ (Geauga County Maple Leaf) A week after a meeting in which members of the Geauga County Automatic Data Processing board voted to bring the information technology systems of the Water Resources Department under its authority, County Administrator Gerry Morgan is hitting back on “unfair” treatment of GCDWR staff.

Texas man involved in online romance scams gets 3 years (AP NEWS) A Texas man was sentenced on Tuesday to more than three years in prison for his role in an online romance scam in which the identities and images of real U.S.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

RSAC 2023 (San Francisco, California, USA, Apr 24 - 27, 2023) We couldn’t be more excited about the RSAC 2023 theme: Stronger Together. In the cybersecurity industry, no one goes it alone. Instead, we build on each other’s diverse knowledge to create the next breakthrough—exchanging ideas, sharing our success stories, and bravely examining our failures. Now that we’ve nailed the theme, we are hard at work planning the agenda, building out the RSAC Sandbox and other hands-on learning experiences, networking opportunities, and so much more. Already excited for next year? Us too!

Future Compute (Cambridge, and virtual, Massachussetts, USA, Apr 30 - May 1, 2023) Embrace emerging technologies to compete with compute. Future Compute offers CTOs and IT Leadership the emerging technology and strategy insight required to outpace change and ensure their digital infrastructure aligns to and exceeds business goals.

TechNetCyber (Baltimore, Maryland, USA, May 2 - 4, 2023) The harnessing of the right cyber power is more important than ever in a domain deluged by persistent attacks and simultaneous sophisticated campaigns that threaten global political, economic and security interests. A flagship event, AFCEA’s TechNet Cyber serves as a center of gravity for a whole-of-government effort to bring together the policy, strategic architecture, operations and C2— along with the joint capabilities—needed to meet the global security challenges and successfully operate in a digital environment. Join us in Baltimore and be a part of the conversation led by U.S. Cyber Command, DISA, the DoD CIO, and numerous industry and academia partners to deliver solutions for this enduring, no-fail mission.

SecureWorld Kansas City (Kansas City, Kansas, USA, May 3, 2023) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational elements learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Friends Summit on the Water (Annapolis, Maryland, USA, May 4, 2023) Suits & Spooks / Safe House Global presents a Friends Summit on Intelligence and Future Threats at the Annapolis Maritime Museum. We'll feature 10 20-minute talks by our speakers and five 5-minute lightning rounds that our attendees may nominate and vote for. Topics to include ChatGPT as a force multiplier for offensive cyber operations, counter-drone technology, cognitive warfare from Russia and China, and more. Attendance is free for full-time government and military employees.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.