Integrated influence and cyber ops. Criminal threat trends. Updates from Russia's hybrid war.

Summary

By the CyberWire staff

At a glance.

Iran integrates influence and cyber operations.
ChatGPT use and misuse.
Phishing reports increased by 34% in Q12023.
HTML attacks double in one year.
Discord Papers update.
Cyberstrikes against civilian targets.
War clause can't be invoked in NotPetya case: New Jersey court.

Iran integrates influence and cyber operations.

Microsoft has observed Iran making increasingly sophisticated attempts at influence operations. "Microsoft has detected these efforts rapidly accelerating since June 2022. We attributed 24 unique cyber-enabled influence operations to the Iranian government last year – including 17 from June to December – compared to just seven in 2021. We assess that most of Iran’s cyber-enabled influence operations are being run by Emennet Pasargad – which we track as Cotton Sandstorm (formerly NEPTUNIUM) – an Iranian state actor sanctioned by the US Treasury Department for their attempts to undermine the integrity of the 2020 US Presidential Elections." The new playbook is predictable but no less influential for its templated quality. A campaign begins with a "cyber persona" announcing and usually exaggerating a low-grade cyberattack. That announcement is then picked up, distributed, and amplified by inauthentic personae using the target audience's native language. "The goals of its cyber-enabled IO have included seeking to bolster Palestinian resistance, fomenting unrest in Bahrain, and countering the ongoing normalization of Arab-Israeli ties, with a particular focus on sowing panic and fear among Israeli citizens."

The mWISE Call for Speakers is now open. Help security’s best get better.

Take lead in a global community of security pros. Be a speaker at mWISE.

ChatGPT use and misuse.

OpenAI has confirmed a data breach in its ChatGPT system, Security Week reports. The breach was enabled by a flaw in the system. The rapidly growing chatbot contained a vulnerability in its open source library, allowing outside users to see others’ chat histories. The breach took the chatbot offline until the company’s patch was released. Although the patch was quick, and the exploit appears minor, this vulnerability may have allowed users (malicious or otherwise) to see payment information, names, and email addresses of others using the service for a few hours.

In a separate development, Samsung has completely barred employees from using generative AI systems like ChatGPT on company devices and networks after it was found that the tech giant’s employees had uploaded sensitive internal data to the platform. Bloomberg reports that the South Korean tech giant fears the implications of the chatbot’s data being stored on external servers. That storage could take the ability to secure such data out of Samsung’s hands, and could allow disclosure of shared information to unauthorized parties. (This isn’t a case of general reluctance to be involved with AI: Samsung has also shared plans to create its own internal AI tools.)

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

Phishing reports increased by 34% in Q12023.

Cofense released its Q12023 phishing intelligence trends review today. They report a 20% increase in active threat reports in Q1 when compared to last quarter, and a 34% increase when compared to Q12022. Threat actors are updating their delivery systems: they are, for example, now including OneNote files. YouTube has become a surprising target of abuse by threat actors. Threat actors will use redirects to point to phishing pages. “The top malware families and types remained mostly consistent to that of Q4. However, the most significant change in malware types was a 38% increase in the use of keyloggers.” Researchers explain that “Qakbot remained the most successful malware family reaching inboxes, 185% more often than Emotet, despite Emotet’s extremely high dissemination volume.” Telegram bot usage for exfiltration increased very sharply, by 397%, during Q12023. CoFense states “Further, Telegram bot API usage continued to rise tremendously in Q1, already surpassing all of 2022 by 310%. The use of Telegram bots has already reached new highs this quarter compared to all of last year and is expected to hold these levels or even go beyond.” Cofense expects an increase in phishing attempts as we enter the summer months.

HTML attacks double in one year.

Barracuda released a study this morning indicating that HTML attacks have doubled since last year. The researchers note that not only is the total number of attacks increasing, but the number of unique attacks seems to be increasing as well. “On March 23, almost nine in ten (405,438 — 85%) of the total 475,938 malicious HTML artefacts were unique ― which means that almost every single attack was different.” HTML attacks are commonly seen in phishing campaigns when users download HTML attachments from emails. Barracuda recommends that organizations adopt email protections to spot and block malicious HTML attachments, that they train their personnel to spot phishing emails, that they implement MFA and consider a zero trust security model, and that they prepare an incident response plan that includes ways of disrupting a campaign should it penetrate your organization.

Discord Papers update.

Ukrainian President Zelenskyy said he didn't receive a briefing from the US on the leaks in the Discord Papers: he found out about them from new reports, the Washington Post writes. In fairness to the White House, the leaks do seem to have caught US authorities on the hop, and news outlets were among those who discovered the leaks at roughly the same time the officials did.

Cyberstrikes against civilian targets.

CERT-UA reports that Russia continues to attempt cyberattacks against civilian infrastructure. Ukrinform quotes Volodymyr Kondrashov, spokesman for the State Service of Special Communications and Information Protection. "Where are the attacks coming from? CERT-UA, which is manually engaged in prevention, detection, and response to cyber attacks and cyber incidents, monitors the activities of more than 80 groups, most of which are hacker groups from the Russian Federation, whose 90% of the members are Russian military operatives. That is, we see that Russia uses the same tactics in cyberspace as it does on the conventional battlefield, that is, it tries to attack civilian infrastructure."

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

War clause can't be invoked in NotPetya case: New Jersey court.

A New Jersey Court ruled Monday that Merck may be entitled to a payout from their insurers following a 2017 cyberattack against the company, Fierce Pharma reports. The June 2017 cyberattack was conducted by NotPetya, a group with ties to Russia, whose malware was distributed through accounting software and affected more than 40,000 machines in the pharmaceutical organization’s network, Bloomberg Law reports. The government did attribute the attack later to Russian intelligence and charged six Russian officers. Merck’s insurers disputed a payout of $1.4 billion to the company on the basis of the “hostile/warlike action” exclusion clause within their policies, Wall Street Journal writes. However, the appeals court this week said that the exclusion clause should not apply to a non-military affiliated company, despite the nature of its origin. It’s a win for Merck, but more litigation is expected.

Dateline Moscow and Kyiv: Plans for spring offensive are closely held.

Ukraine at D+433: Keeping secrets. (CyberWire) Russian cyber operations continues as Ukraine prepares its spring offensive.

Russia-Ukraine war: List of key events, day 434 (Al Jazeera) As the war enters its 434th day, we take a look at the main developments.

Russia Launches Wave Of Drone Strikes On Ukrainian Cities As Battle For Bakhmut Continues (RadioFreeEurope/RadioLiberty) Russia launched a new series of overnight drone strikes on Ukrainian cities, including the capital, Kyiv, but most of them were downed by Ukraine's air defenses, the military said on May 3, as Ukrainian forces in the eastern city of Bakhmut repelled more Russian attacks.

Russia says Putin 'assassination' attempt by Ukraine foiled (AP NEWS) Russia claims it foiled a Ukrainian assassination attempt using drones against President Vladimir Putin, denouncing the alleged attack as a ‘’terrorist’’ act and promising retaliation. Kremlin spokesman Dmitry Peskov was quoted as saying Putin wasn’t in the Kremlin at the time of the nighttime attack. There were no immediate details and no independent verification of the reported attack, which Russia authorities said occurred overnight but presented no evidence in support of the claim. Nor did officials say why it took more than 12 hours to report the incident. Ukrainian officials did not comment on the news. If true, the alleged attack is a significant escalation in the 14-month conflict, with Ukraine taking the war to the heart of Russian power.

Ukraine war live: Putin survives 'assassination attempt' at Kremlin (The Telegraph) Two Ukrainian drones tried to attack Vladimir Putin’s residence in the Kremlin late on Tuesday, the Russian presidential press office has claimed.

Fuel depot near key Crimea bridge bursts into flames - live (The Independent) Ukraine-Russia war: latest news and live updates

Russian Deaths Mount as Men, Money Become Scarce (US News and World Report) Russian President Vladimir Putin faces a grim death toll and massive resource shortfalls as he prepares for a widely anticipated Ukrainian spring offensive.

'Human Flesh, It Cannot Survive': Russian Infantry 'No Match For Western Weapons,' British Analyst Says (RadioFreeEurope/RadioLiberty) Military analyst and British Army Colonel Hamish Stephen de Bretton-Gordon talks about Russian mistakes in Ukraine, Moscow's growing reliance on a massive, ragtag mobilization, and how Vladimir Putin's dream of joining the list of great Russian leaders "is all going wrong."

Ukraine withholding counteroffensive details from allies (POLITICO) A Ukrainian lawmaker said that top officials in Kyiv also had withheld details about the counteroffensive from other politicians inside the capital.

Ukraine’s Best Chance (Foreign Affairs) A successful offensive could end the war with Russia.

Russia rejects US-released casualty figures from Ukraine war: ‘Plucked from thin air’ (The Hill) Moscow on Tuesday rejected U.S. estimates for the number of Russian casualties in the Ukraine war, including that more than 20,000 Russians have died since December, claiming the numbers were “pluc…

Spike in Russian combat deaths fuels fears of worse carnage to come (Washington Post) The rate at which Russian forces are being killed or wounded in Ukraine has spiked in recent months, according to estimates disclosed by the White House this week, underscoring how ferocious the combat has become and suggesting the carnage could get even worse with Kyiv’s long-planned counteroffensive to retake occupied territory.

Putin the Pariah (Foreign Affairs) Sanctions and the threat of prosecution have imperiled Russia’s president.

Blast causes another train to derail in Russia near Ukraine (Al Jazeera) A blast derailed a freight train in a Russian region near Ukraine, authorities say, adding there were no casualties.

Russia Ramps Up Pressure on Civilians in Occupied Ukraine (New York Times) Wary of Ukrainian partisans and anticipating a counteroffensive, Russian authorities have “reinforced” counterintelligence units in occupied territory, Ukraine says.

US to send Ukraine $300 million in military aid (Military Times) This is the 37th package of Pentagon stocks to go to Ukraine since the war began in February 2022.

Without a strong Ukrainian counter-offensive, Putin will get his frozen conflict – and win his war (The Telegraph) If Kyiv’s forces can make significant gains, they will retain vital momentum. Fail, and American interest may wane – handing Putin victory

White House asserts Russian latest offensive in Ukraine has ‘backfired’ (Washington Examiner) BACKFIRED, WITH 20,000 KIA: For months, against the advice of some senior U.S. military officials, Ukraine has stubbornly held on to the largely-destroyed town of Bakhmut, successfully tying down Russian forces and inflicting heavy casualties while buying time for its counter-invasion force to…

Placing Russian nukes in Belarus could destabilize Putin’s last ally (Atlantic Council) Vladimir Putin's decision to place nuclear weapons in Belarus will strengthen Russia's grip on the country but could also spark a new wave of opposition to Belarusian dictator Alyaksandr Lukashenka, writes Olivia Yanchik.

How strong is Russian public support for the invasion of Ukraine? (Atlantic Council) The Kremlin has worked hard to create the impression of overwhelming public support for the invasion of Ukraine but it remains difficult to gauge true levels of pro-war sentiment in today's Russia, writes Sviatoslav Hnizdovskyi.

Opinion | The Curious Conservative Case Against Defending Ukraine (New York Times) George Orwell would have called it objectively pro-Putin.

Russian regions scrap Victory Day parades amid fear of Ukraine strikes (the Guardian) Governor of region 400 miles from border latest to cancel over ‘safety concerns’ in glaring admission of vulnerability

Zelensky says White House told him nothing about Discord intelligence leaks (Washington Post) Ukrainian President Volodymyr Zelensky has not had any conversations with the White House about a massive leak of top-secret U.S. intelligence documents, he said in a wide-ranging interview with The Washington Post on Monday, calling the disclosures damaging to both Washington and Kyiv.

Ukrainian AI company raises $1 million to fight Russian propaganda (Cybernews) Osavul, a startup born in response to Russia's full-scale invasion of Ukraine, has raised $1 million and plans to direct it toward integrating large language models (LLMs) into its platform.

How the US government can combat Russian disinformation on Ukraine (C4ISRNet) U.S. support could go a long way toward helping Balkan countries in their attempts to remain autonomous from Russia.

Russia attacks civilian infrastructure in cyberspace just as it does on ground - watchdog (Ukrinform) The Government Cyber Emergency Response Team, CERT-UA, monitors the activities of more than 80 hacker groups, most of which are those from the Russian Federation, while 90% of their members are Russian military operatives. — Ukrinform.

Ukraine-Russia news live: White House did not inform Kyiv of Pentagon leaks, says Zelensky (Aol App) Secret leaks not good for Washington’s reputation, says Ukrainian president

How not to interview a war criminal (.coda) In a masterclass on how not to interview a genocidal war criminal, Vice News traveled to Moscow to sit down for an exclusive with Maria Lvova-Belova, Russian President Vladimir Putin’s commissioner for children’s rights.

Russia may use civilians, journalists to spy on Denmark: Danish intelligence (WTVB) COPENHAGEN (Reuters) - Denmark's intelligence service expects Russia to recruit civilians and use journalists and business people to spy on the countr...

China ‘must use its influence to end Russia’s war on Ukraine’ – Tánaiste sets out Ireland’s stance on China (Independent.ie) National security demands now go far beyond military defence to take in threats from pandemics, climate, human rights abuses, economic shocks, and cyber and hybrid attacks, Micheál Martin has told a conference on global insecurity.

Increase in NZ support for Ukraine - Ukraine (ReliefWeb) News and Press Release in English on Ukraine and 1 other country about Contributions, Food and Nutrition and more; published on 3 May 2023 by Govt. New Zealand

Editorial: Global threats abound, but this militarily neutral nation will not be cowed by them (Independent.ie) Finbar Cafferkey, from Achill Island in Co Mayo, was killed on the front line in the east of Ukraine, helping to defend a sovereign nation from invasion by the neighbouring power of Russia.

Russia Sanctions Database (Atlantic Council) The Atlantic Council’s Russia Sanctions Database tracks the level of coordination among Western allies in sanctioning Russian entities, individuals, vessels, and aircraft, and shows where gaps still remain.

Two Russian Men Get Prison Sentences In Dugin Daughter's Murder Case (RadioFreeEurope/RadioLiberty) A court in Russia's western city of Tula has sentenced two men to 3 1/2 years in prison each for their alleged involvement in a car bombing in August that killed Darya Dugina, the daughter of Kremlin-linked far-right ideologue Aleksandr Dugin.

Attacks, Threats, and Vulnerabilities

Quarterly Adversarial Threat Report (Meta) Our public threat reporting began about six years ago when we first shared our findings about coordinated inauthentic behavior (CIB) by a Russian influence operation.

Rinse and repeat: Iran accelerates its cyber influence operations worldwide (Microsoft On the Issues) Iran continues to be a significant threat actor, and it is now supplementing its traditional cyberattacks with a new playbook, leveraging cyber-enabled influence operations to achieve its geopolitical aims, according to a new Microsoft Threat Intelligence report on Iranian cyber operations.

Iranian Threat Groups Spread Cyberattack Fears Through Influence Operations (Decipher) Iranian threat groups are launching cyberattacks - or in some cases saying they are - and then sowing fear around the hacks through online influence operations.

Microsoft says Iranian hackers combine influence ops with hacking for maximum impact (CyberScoop) Many of the 24 cyber-enabled Iranian influence operations Microsoft detected in 2022 were intended to further Iran's Mideast political agenda.

Microsoft warns Iran increasing its cyber-enabled influence operations (SC Media) Microsoft is warning that Iran is using a new set of preferred techniques that combine its traditional cyberattacks with cyber-enabled influence operations (IO) for greater geopolitical effect.

China 'Innovated' Its Cyberattack Tradecraft, Mandia Says (Dark Reading) Mandiant CEO Kevin Mandia explains why a recently revealed targeted attack by a cyber-espionage group out of China rivals the SolarWinds attack in its complexity, and weighs in on how defenders can best leverage generative AI.

Vulnerabilities identified in Amazon Fire TV Stick, Insignia FireOS TV Series (Bitdefender Labs) Streaming devices have become increasingly popular in recent years, and for good reason.

FP-2023-01 - NETGEAR’s ProSAFE® Network Management System NMS300 (Flashpoint) Flashpoint disclosed a new vulnerability affecting NETGEAR's ProSAFE® Network Management System NMS300.

Infoblox discovers rare Decoy Dog C2 exploit (TechRepublic) Infoblox discovered a C2 exploit that, while extremely rare and complex, could be a warning growl from a new, as-yet anonymous state actor.

ChatGPT Confirms Data Breach, Raising Security Concerns (Security Intelligence) ChatGPT has taken the digital world by storm. But with a recent data breach raising more security concerns, what's next for OpenAI?

Samsung Bans Generative AI Use by Staff After ChatGPT Data Leak (Bloomberg) Samsung Electronics Co. is banning employee use of popular generative AI tools like ChatGPT after discovering staff uploaded sensitive code to the platform, dealing a setback to the spread of such technology in the workplace.

Fake ChatGPT extension stealing victims' account details (SecurityBrief Asia) We must educate ourselves and stay informed about the tactics scammers employ to protect ourselves and our sensitive information.

Malicious email campaigns abusing Telegram bots rise tremendously in Q1 2023, surpassing all of 2022 by 310% (Cofense) Q1 of 2023 was filled with many updates and changes to the major malware families used in phishing scams, as well as several notable deviations in tactics, techniques, and procedures (TTPs).

T-Mobile promises better security after year’s second breach (SC Media) T-Mobile apologized to customers affected by its second data breach this year and says it is continuing to work on enhancements to its information security systems.

The Untold Story of the Boldest Supply-Chain Hack Ever (WIRED) The attackers were in thousands of corporate and government networks. They might still be there now. Behind the scenes of the SolarWinds investigation.

UPDATE: Murfreesboro Medical Clinic Fell Victim to a Sophisticated Criminal Cyberattack (WGNS) On April 22, 2023, Murfreesboro Medical Clinic and SurgiCenter was the victim of a sophisticated criminal cyberattack. In response, MMC rapidly initiated an emergency shut down of their network to limit the spread of the attack within their systems and their technology partners. Since that time, MMC reports they have been working with law enforcement agencies and third-party experts to identify the source and scope of the attack ...

Russia-Linked Hackers Behind Bay Area Health-Care Breach (GovTech) Santa Clara Family Health Plan said Monday that the sensitive information of 276,993 members — including names, contact information, dates of birth, member IDs and Medi-Cal credentials — may have been compromised.

Security leaders weigh in on school district ransomware attack (Security Magazine) A Minneapolis school district is still dealing with ramifications after being the victim of a ransomware attack earlier this year. Security leaders share their thoughts.

1Password explains scary Secret Key and password change alerts (BleepingComputer) 1Password says a recent incident that caused customers to receive notifications about changed passwords was the result of service disruption and not a security breach.

US Marshals to Unveil ‘Fully Reconstituted System’ Following Ransomware Attack (Nextgov.com) Offline since February, the new system will have improved cybersecurity countermeasures.

CyRC Vulnerability Advisory: CVE-2023-25826 and CVE-2023-25827 in OpenTSDB (Application Security Blog) Synopsys Cybersecurity Research Center discovers new RCE vulnerability and cross-site scripting vulnerability in OpenTSDB.

May 1, 2023 CISA KEV Breakdown | Apache, Oracle, TP-Link (Nucleus Security) In this Breakdown, three vulnerabilities were added to CISA KEV, including a Log4j exploit and TP-Link Archer Firmware command injection bug.

Security Patches, Mitigations, and Software Updates

Apple delivers first-ever Rapid Security Response “cyberattack” patch – leaves some users confused (Naked Security) Just when we’d got used to three-numbered versions, such as “13.3.1”, here comes an update suffix, bringing you “13.3.1 (a)”…

iPhone Users Report Problems Installing Apple's First Rapid Security Response Update (SecurityWeek) Apple has released its first Rapid Security Response patch, but iPhone users are complaining that they are having problems installing it.

CISA Releases One Industrial Control Systems Advisory (Cybersecurity and Infrastructure Security Agency CISA) CISA released one Industrial Control Systems (ICS) advisory on May 2, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

Google Announces Support for Account Passkeys (MacRumors) Google today announced that it is introducing support for passkeys, providing an easier and more secure login method for Google accounts. Apple...

Trends

APT groups muddying the waters for MSPs (WeLiveSecurity) A quick dive into the murky world of cyberespionage and other growing threats facing managed service providers – and their customers.

Cyber-Risk Declines But 78% of Organizations Predict Successful Attacks in Coming Year (PR Newswire) Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global cybersecurity leader, today announced that cyber-risk levels have improved from...

KnowBe4’s KB4-CON 2023 Speakers Tackled Cyber Defense and Security Culture Topics (KnowBe4) KnowBe4’s KB4-CON 2023 Speakers Tackled Cyber Defense and Security Culture Topics

Threat Spotlight: Proportion of malicious HTML attachments doubles within a year (Barracuda) The security industry has been highlighting the cybercriminal misuse of HTML for years — and evidence suggests it remains a successful and popular attack tool.

Marketplace

Millennium Adds to Cyber Portfolio With Maxisiq Vulnerability Assessment Division Purchase (GovCon Wire) Looking for the latest GovCon News? Check out our story: Millennium Builds Up Cybersecurity Offering With MAXISIQ's Business Unit. Click to read more!

BlueCat hires Francisco Velasquez as Chief Financial Officer (GlobeNewswire News Room) BlueCat Networks, a leading provider of mission-critical network and cloud infrastructure software for reliable...

Ciaran Martin CB appointed UK Chairman of CyberCX (CyberCX | UK) CyberCX has appointed Ciaran Martin CB as its Chairman for its newly launched UK entity, CyberCX UK.

Infoblox Hires Sco Mo as MD (Australian Cyber Security Magazine) Infoblox has hired Scott Morris as its Managing Director for Australia & New Zealand.

GreenPages Appoints Technology Industry Veteran Terry Richardson as New Chief Revenue Officer (GlobeNewswire News Room) Highly Respected Former AMD, HPE and EMC Channel and Sales Executive Joins Fast Growing National Managed Services Provider...

Products, Services, and Solutions

GMO GlobalSign Receives Provisional Certification for TX-RAMP (GlobalSign) Top identity solution provider’s managed PKI products now available to Texas agencies, higher education institutions and community colleges

Coalition Releases Control 2.0, the Cyber Risk Management Platform for Businesses of All Sizes (Business Wire) Active Insurance Provider Also Introduces Managed Detection and Response Offering to Help Identify and Respond to Cyber Threats As Soon As They Are Discovered

HYAS Infosec Announces Onpoint Partner Program Targeting Advanced Adversary Infrastructure Intelligence and Detection Market Opportunity (Business Wire) HYAS Onpoint Partner Program Seeks to Transform Cyber Protection for End User Customers to Benefit from Access to a Suite of Cutting-Edge Security Products

BeyondTrust Expands Identity & Access Security Platform with New Features and Advanced Capabilities (GlobeNewswire News Room) New infrastructure access capabilities provide developers, cloud ops engineers, and technical staff with frictionless, dynamic, and secure access to...

Akamai launches Prolexic Network Cloud Firewall (SC Media) SDxCentral reports that Akamais Prolexic distributed denial-of-service platform has received a new cloud-based expansion called Network Cloud Firewall.

Comcast helps Fortune 500s hunt down cybersecurity threats with 'DataBee' (Light Reading) A platform developed internally by Comcast to scrub data and keep cybersecurity threats in check has been turned into a product now being offered to enterprises.

LogRhythm announces partnership with Zscaler to cover cloud access security - Intelligent CIO APAC (Intelligent CIO APAC) LogRhythm has announced its partnership with Zscaler to facilitate a modern Zero Trust architecture increasing network insight and addressing cloud access security challenges. Zscaler’s integration with LogRhythm is pitched as providing visibility into everything occurring in a network and the websites/ cloud-based resources employees are using. As logs are ingested from Zscaler’s Nanolog Streaming Service […]

Sophos Announces Partnership with Measured Analytics and Insurance to Unlock Cyber Insurance Premium Savings for Customers (GlobeNewswire News Room) New Research Exposes How the Quality of Cyber Defenses Directly Impacts Insurability, Premium Costs and Policy Terms...

Liquid Group Selects Velotix as its Data Security Platform (PR Newswire) Velotix, the data security platform that governs and controls compliant access to data throughout the data access lifecycle, announced today...

Immersive Labs Unveils World’s First Comprehensive Score to Gauge Enterprise Cyber Resilience (Business Wire) New ‘Resilience Score’ Leverages Extensive Benchmarking Data to Help Organizations Prove their People-Centric Threat Preparedness

Keeper Security Joins Pax8 to Aid MSPs In Mitigating Password-Related Cyber Risks (PR Newswire) Keeper Security, a renowned industry leader in exceptional password management, secrets management, privileged access, secure remote access and...

ManageEngine ADSelfService Plus Rolls Out Offline MFA for Enhanced Remote Work Security (ManageEngine) ManageEngine ADSelfService Plus Rolls Out Offline MFA for Enhanced Remote Work Security Ensures Authorized Access to Business Data with Cutting-edge Verification Methods, Regardless of Time, Location or Connectivity Issues

Dashlane Introduces Passwordless Login (Business Wire) New advancements from Dashlane mark a significant step toward a passwordless future, enabling seamless and secure account access

Deal Box Announces Integration With Fireblocks to Increase Security and Reliability for Digital Asset Management (PR Newswire) Deal Box, a capital markets advisory and secure token offering packaging platform, today announced an integration with Fireblocks, an...

Technologies, Techniques, and Standards

DOD Aims to Improve Network Security, Leverage New Technologies (U.S. Department of Defense) The Defense Information Systems Agency and the Department of Defense Information Network are looking for ways to repurpose cutting-edge technology to protect the DOD's global network, the director of

Two core Unix-like utilities, sudo and su, are getting rewrites in Rust (Ars Technica) AWS-backed group believes command is too central to the web to keep as-is.

Constant Activity Defines Cyber Operations (SIGNAL) Partnerships are key to staying atop cybersecurity needs.

How can you do incident response if you can't recognize an incident? (Control Global) Cyber incident response starts with the assumption that you can recognize a control system cyber-related event as being a cyber event, but there's no training for the engineers to recognize an event as being cyber-related.

When your house spreads gossip about you (Techxplore) More and more of the devices that we surround ourselves with on a daily basis are connected to the internet. This makes them not only smart, but also vulnerable to cyberattacks and criminal acts.

7 Practical Solutions for Modern Businesses Combating Cloud-Based Attacks (SentinelOne) Businesses continue to face a changing threat landscape. Learn how CISOs can defend against the top 7 cloud-based risks.

Design and Innovation

‘The Godfather of A.I.’ Leaves Google and Warns of Danger Ahead (New York Times) For half a century, Geoffrey Hinton nurtured the technology at the heart of chatbots like ChatGPT. Now he worries it will cause serious harm.

Apple and Google team up to stop unwanted AirTag tracking (CNBC) Tuesday's announcement suggests that Android phones will also soon gain the ability to warn their users if they are being tracked by an AirTag.

Tenable is developing generative AI tools to combat advanced cyber threats (Techcircle) Cybersecurity company Tenable’s research team is experimenting with generative artificial intelligence (AI) applications like ChatGPT, a large language model trained by AI lab OpenAI, to enhance security research, which in turn can help in combating cyber threats.

DOD Aims to Improve Network Security, Leverage New Technologies (U.S. Department of Defense) The Defense Information Systems Agency and the Department of Defense Information Network are looking for ways to repurpose cutting-edge technology to protect the DOD's global network, the director of

Military cyber directors: Help us better leverage AI to gain the 'high ground' (Breaking Defense) In a sign of how ubiquitous AI has become recently, DISA Director Lt. Gen. Robert Skinner began his keynote not speaking himself, but with a generative AI that cloned his voice and delivered the start of his remarks.

Pentagon Network Chiefs Are Putting Automation to Work (Defense One) Tireless cyber tools can patrol parts of DOD’s networks, tools, and applications where hackers like to hide.

Research and Development

Plurilock Receives Funding from the Government of Canada for Research of New Behavioural Biometric Techniques (Yahoo Finance) Vancouver, British Columbia--(Newsfile Corp. - May 2, 2023) - Plurilock Security Inc. (TSXV: PLUR) (OTCQB: PLCKF) and related subsidiaries ("Plurilock" or the "Company"), an identity-centric cybersecurity solutions provider for workforces, is pleased to announce that the Company's wholly-owned subsidiary, Plurilock Security Solutions Inc., has received advisory services and up to $75,000 in funding from the National Research Council of Canada Industrial Research Assistance Program (NRC IRAP) to

Augusta University Partners with National Lab for Cyber Research (GovTech) A public university in Georgia will collaborate with Savannah River National Laboratory in research and global security projects related to cybersecurity, cyberphysical systems, data analytics and quantum cryptography.

Academia

US educational system hit with deluge of cyberattacks (SC Media) Several U.S. schools, colleges, and universities have reported being impacted by ransomware attacks and cybersecurity incidents during the past few weeks, according to The Record, a news site by cybersecurity firm Recorded Future.

Wichita State restoring systems after cyber attack (JC Post) WICHITA —Over the weekend, Wichita State University took proactive measures and disconnected several University systems to isolate an unauth

VCU and the Institute of Data Partner to Offer Tech Learning to Nontraditional Students (Business Wire) VCU Continuing and Professional Education bootcamps provide practical and immersive training in 12- to 24-week sessions

Legislation, Policy, and Regulation

We will stop the text scam misery (The Telegraph) We need bold and firm action to block fraud at source, but prevention is as important any cure

Spies to track down text scammers and bring them to justice (The Telegraph) Home Secretary’s crackdown to bring intelligence agencies and new police squads together in fight against fraud

Cybercom Commander Says Partnerships Are Key to Success in Challenging Strategic Environme (U.S. Department of Defense) Collective focus and alignment across the government and private sector are key to owning the cyber domain in an increasingly complex environment, says Army Gen. Paul M. Nakasone.

Lawmakers update Kids Online Safety Act to address potential harms, but fail to appease some activists, industry groups (CNBC) As Congress and President Joe Biden have made clear kids online protections are a key priority, KOSA has become one of the leading bills on the subject.

Echoes of History in New National Push to Shield Children Online (New York Times) In the 1990s, the U.S. government limited what young people could see online, but lost a court fight challenging those rules. Now it’s happening again.

Pornhub Blocks All of Utah From Its Site (Vice) People in Utah who visit Pornhub will now be greeted by adult performer Cherie DeVille asking them to tell their representatives to change their age verification law.

Litigation, Investigation, and Law Enforcement

Dominican investigative journalist targeted with NSO spyware, report says (the Guardian) Nuria Piera, known for her investigations into corruption, was targeted three times, Amnesty International says

Knesset panel reveals Israeli police tried to wiretap over 1,000 phones (Haaretz) Deputy Attorney General Amit Marari who headed a Knesset committee examining police's use of spyware intended to be used only for wiretaps says police illegally collected data from infected devices

Crypto Regulatory Affairs: OFAC Sanctions North Korea’s Crypto Laundering Networks | Elliptic (Elliptic Connect) The US Treasury’s Office of Foreign Assets Control (OFAC) has used sanctions to target money laundering networks that support North Korea’s crypto-enabled cybercrime activity. Read more.

Europol reveals German law enforcement was behind ‘Monopoly Market’ takedown (Record) Europol announced on Tuesday that 288 suspects involved in drug trafficking on the darknet marketplace “Monopoly Market” have been arrested globally following an unannounced takedown in December 2021.

Years-long dark-web drug bust yields hundreds of arrests (Washington Post) Federal officials on Tuesday touted a sweeping international cybercrime bust that has garnered nearly 300 arrests.

FBI, Ukraine seize 9 exchange domains on money laundering allegations (Cointelegraph) The FBI and police departments from Ukraine, have shut down and seized the domains of nine digital currency exchanges that allegedly allowed cybercriminals to skirt money laundering measures.

FBI, Ukraine seize cryptocurrency exchanges for abetting cybercriminals (Record) The FBI and Ukrainian law enforcement have taken down nine cryptocurrency exchanges allegedly catering to cybercriminals.

Cops Just Revealed a Record-Breaking Dark Web Dragnet (WIRED) Operation SpecTor likely drew on leads from multiple dark web market busts, including the secret takedown of Monopoly Market in 2021.

Merck’s Insurers On the Hook in $1.4 Billion NotPetya Attack, Court Says (Wall Street Journal) A court rejected arguments by insurers that they shouldn’t have to cover Merck’s losses from the Russia-linked attack.

Merck entitled to $1.4B in cyberattack case after court rejects insurers' 'warlike action' claim (Fierce Pharma) Merck may finally be entitled to a hefty insurance payout from the high-profile NotPetya cyberattack—if an appeals court ruling stands.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Fuel Frenzy CTF (Baltimore, Maryland, USA, Jun 7 - 8, 2023) Critical infrastructure systems are increasingly becoming targets for cyber-attacks, and it's up to us to protect them! Fuel Frenzy is a Percival Engineering Capture the Flag (CTF) competition with various fuel-related challenges: securing fuel supplies, interrupting fuel transportation, protecting fuel-related assets, and disrupting fuel critical infrastructure. This CTF is designed to help raise awareness about the importance of protecting critical infrastructure from cyber threats while also supporting the development of skills and knowledge in the cybersecurity community.

Events

TechNetCyber (Baltimore, Maryland, USA, May 2 - 4, 2023) The harnessing of the right cyber power is more important than ever in a domain deluged by persistent attacks and simultaneous sophisticated campaigns that threaten global political, economic and security interests. A flagship event, AFCEA’s TechNet Cyber serves as a center of gravity for a whole-of-government effort to bring together the policy, strategic architecture, operations and C2— along with the joint capabilities—needed to meet the global security challenges and successfully operate in a digital environment. Join us in Baltimore and be a part of the conversation led by U.S. Cyber Command, DISA, the DoD CIO, and numerous industry and academia partners to deliver solutions for this enduring, no-fail mission.

SecureWorld Kansas City (Kansas City, Kansas, USA, May 3, 2023) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational elements learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Friends Summit on the Water (Annapolis, Maryland, USA, May 4, 2023) Suits & Spooks / Safe House Global presents a Friends Summit on Intelligence and Future Threats at the Annapolis Maritime Museum. We'll feature 10 20-minute talks by our speakers and five 5-minute lightning rounds that our attendees may nominate and vote for. Topics to include ChatGPT as a force multiplier for offensive cyber operations, counter-drone technology, cognitive warfare from Russia and China, and more. Attendance is free for full-time government and military employees.

Third-Party and Supply Chain Cyber Security Summit (Barcelona, Spain, May 4 - 5, 2023) Learn the latest case studies on the end to end cyber security implementation practices when working with third parties to ensure a truly resilient and secure supply chain network at the Third Party & Supply Chain Cyber Security Summit. How much of your data security is really under your control? What is your risk management approach towards your suppliers? How to secure your network and protect your sensitive data? Led by the TOP Information Security professionals from leading companies the discussion will give you an opportunity to see the issue from the perspective of different industries & angles and identify the complex solution to be implemented.

Summit on Modern Conflict and Emerging Threats (Nashville, and virtual, Tennessee, USA, May 4 - 5, 2023) Modern conflict has created a global problem that is moving at the speed of innovation and technology. The Vanderbilt Summit on Modern Conflict and Emerging Threats on May 4-5, 2022 brought together internationally recognized leaders and experts in the military and intelligence community to examine the subjects of cyber conflict, artificial intelligence, peer competition and emerging threats.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.