Babuk resurfaces. Alert on PaperCut vulnerabilities. Too many bad bots. KillNet's PMHC regrets.

Summary

By the CyberWire staff

At a glance.

Babuk source code as criminal inspiration.
CISA and FBI release a joint report on PaperCut NG/MF vulnerability exploitation.
More bad bots out there than anyone would like.
KillNet’s short-lived PMHC venture: new services amidst the reorganization regret.

Babuk source code as criminal inspiration.

The leaked Babuk ransomware source code has become a treasure trove for ransomware operators, Bleeping Computer reports.The Babuk code was leaked on a Russian forum in September of 2021, Decipher adds in its own coverage. SentinelLabs researchers discovered ten ransomware families throughout the second half of 2022 and the first half of 2023, using VMware ESXi lockers based on the Babuk code. “There is a noticeable trend that actors increasingly use the Babuk builder to develop ESXi and Linux ransomware,” said the researchers in their release.

The malware compromises VMware ESXi servers on Linux machines. The researchers noted that “The talent pool for Linux malware developers is surely much smaller in ransomware development circles, which have historically held demonstrable expertise in crafting elegant Windows malware.” Use of Babuk code is expected to increase, and may do so in tandem with the anticipated growth of the Go-based locker version that targets network attached storage (NAS) devices. For more on Babuk, see CyberWire Pro.

The mWISE Call for Speakers is now open. Help security’s best get better.

Take lead in a global community of security pros. Be a speaker at mWISE.

CISA and FBI release a joint report on PaperCut NG/MF vulnerability exploitation.

CISA and the FBI have released a joint report detailing the PaperCut NG and PaperCut MF vulnerability CVE-2023-27350. The FBI has observed the Bl00dy ransomware gang attempting to exploit the vulnerability on PaperCut servers belonging to education sector targets. “Education Facilities Subsector entities maintained approximately 68% of exposed, but not necessarily vulnerable, U.S.-based PaperCut servers. In early May 2023, according to the FBI, the Bl00dy Ransomware Gang gained access to victim networks across that subsector where PaperCut servers vulnerable to CVE-2023-27350 were exposed to the internet. Some of these operations led to data exfiltration and encryption of victim systems. The Bl00dy Ransomware Gang left ransom notes on victim systems demanding payment in exchange for decryption of encrypted files.” CISA recommends that organizations implement “Emerging Threat Suricata Signatures to detect when GET requests are sent to the SetupCompleted page.” (And the agency warns that they should “be careful of improperly formatted double-quotation marks if copying and pasting signatures from this advisory.” If an organization finds it’s been compromised, CISA and the FBI urge them to create a backup of their PaperCut servers, wipe the application server, and restore the database from a safe backup point before April 2023. Organizations can also mitigate the risk by updating their applications to the latest version, in which the vulnerability has been fixed.

Add value to your lead generation strategy.

Broaden the reach of your ads, fill your funnel, and build partnerships with valuable leads. Having the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, means companies trust us to get their messages out. Feature your brand with the source that top security leaders choose. Learn more.

More bad bots out there than anyone would like.

Imperva’s 10th edition of the Bad Bot report, regarding autonomous bot traffic on the internet, found that in 2022 almost 50% of all internet traffic was from automated bots marking a 5.1% increase in automated traffic. The report also showed that “good bots” are increasing in prevalence with 17.3% of all traffic, and “bad bots” (those used by bad actors to troll for vulnerabilities) increased to 30.2%. Imperva writes, “As bad bot evasion techniques become increasingly sophisticated, we are observing a fascinating trend, where advanced bad bot levels (51.2%) are growing at the expense of moderate ones (15.4%). Simple bad bot levels have remained similar, at about a third (33.4%) of all bad bot traffic. Because moderate and advanced bad bots represent the more “self-conscious” bots that go to greater lengths to hide their true identity, we often group them and refer to them as evasive bad bots. In 2022, these evasive bad bots accounted for 66.6% of all bad bot traffic – a slight increase from the previous year (65.5%). While the increase isn’t substantial, it is the makeup of evasive bad bots that is alarming, with advanced bad bot levels essentially doubling.” For more on Imperva's report, see CyberWire Pro.

KillNet’s short-lived PMHC venture: new services amidst the reorganization regret.

We’ve been watching Killnet’s social media chatter for the hacktivist auxiliary’s latest self-presentation.

KillNet’s impresario (or at least mouthpiece) KillMilk, expressed doubt about the Russian hacking auxiliary’s organizational change to a private military hacking company (PMHC) on Tuesday during a “heart-to-heart” with the group’s followers. KillMilk explained that he had made a terrible mistake in making the group a PMHC, and took full responsibility for what he now regrets as a misstep. He explained that while attempting to acquire more servers for their botnet, he had drawn the attention of the FBI and, as a result, the organization’s botnet was seized. He then added that he would not be going to the government for support, and requested donations from his fan base. He ended his heart-to-heart by saying, “Give us all we ask for and within 30 days there will only be native Americans left in the USA.” Presumably he meant that with the correct material supply he and his (now no longer so merry) band of renegades could and would send the US back to the Stone Age.

Since this airing of grievances the organization has changed its Telegram handle back to the original “WE ARE KILLNET.” On Thursday, May 11th, the group announced that, thanks to the donations they’d received, they would be able to purchase more resources and continue their patriotic labor of love. It remains unconfirmed whether KillNet’s botnet infrastructure was swept up by the FBI’s Operation Medusa (announced on Tuesday), but if KillNet’s botnet were indeed tightly coupled to the FSB’s network Operation Medusa expunged from US computers, then this would be a key indicator of KillNet’s ties to the Russian organs.

KillNet’s de-rebranding came after the group launched its own Telegram based cryptocurrency exchange. They’ve boasted that they can deliver cash to anyone in the Russian Federation, and that they’re looking to expand to other countries. The group is charging a 6% processing fee for amounts under $5,000, dropping as amounts grow larger, with the fee for transferring more than $100,000 coming in at a low, low 3%. (This surcharge is in addition to the conversion fees from whatever exchange they use to flip the currency.)

Last but not least, KillNet announced its Telegram-based OSINT tool which they claim to be “The best in the world in the right hands.” The Telegram bot reportedly allows for name searches, social media account research (only for Russian social media), IP address tracing, license plate look-ups (only in Russia), and various other phone number and email address queries. Why anyone would use KillNet’s OSINT tool instead of an-off-the-shelf tool with multi-country querying capabilities is not immediately clear. An interesting puzzle is that the tool seems to only query Russian-owned social media and public databases, which seems to go against KillNet’s promise not to operate against or inside of Russia proper. Perhaps the OSINT is for domestic surveillance: in any case there’s been some barking in Russian state-controlled media that Russians insufficiently enthusiastic about the Special Military Operation are really not worthy of the name “Russian” at all.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Notes.

Today's issue includes events affecting , and .

Dateline Moscow and Kyiv: Preparing for renewed fighting.

Ukraine at D+442: Russians say the Ukrainian counteroffensive has begun. Ukraine differs. (CyberWire) Mr. Prigozhin offers an alibi for combat failure, and KillNet meditates on the problems of rebranding as a PMHC.

Russia-Ukraine war: List of key events, day 443 (Al Jazeera) As the war enters its 443rd day, we take a look at the main developments.

Ukraine drives back Russian forces around Bakhmut (NBC News) President Volodymyr Zelenskyy said his military needed more time before launching a counteroffensive, despite claiming to have struck back in the key eastern battle.

Ukraine’s counter offensive is 'in full swing', claims Wagner chief (The Telegraph) Yevgeny Prigozhin accuses Volodymyr Zelensky of being deceptive when he says Kyiv is not ready to mount an attack

Beyond Ukraine’s Offensive (Foreign Affairs) The West needs to prepare the country’s military for a long war.

Deciphering Vladimir Putin’s unspoken Victory Day message (Atlantic Council) Putin's unspoken Victory Day message: The seating arrangements at this week’s parade indicate that despite the military setbacks of the past 15 months, the Russian dictator is doubling down on his goal of subjugating Ukraine.

Britain is first nation to send long-range missiles to Ukraine (The Telegraph) The weapons, which cost about £2.2m each, outstrip the US-supplied Himars and can be fired deep behind Russian enemy lines

Britain becomes first country to supply Ukraine with long-range missiles (Atlantic Council) Britain has confirmed it is providing Ukraine with long-range missiles. The decision is a major milestone in international efforts to support the Ukrainian fight back against Russia’s ongoing invasion, writes Peter Dickinson.

Ukraine gets British long-range missiles ahead of counteroffensive (Defense News) British Defense Minister Ben Wallace described the move as a “calibrated, proportionate response to Russian’s escalation” in its invasion of Ukraine.

Ukraine’s Hidden Advantage (Foreign Affairs) How European trainers have transformed Kyiv’s army and changed the war.

US Abrams tanks for training Ukrainian forces arrive in Germany ahead of schedule (AP NEWS) U.S. officials say the Abrams tanks needed for training Ukrainian forces have arrived in Germany slightly ahead of schedule, and are on their way to the Grafenwoehr Army base where the training will begin in two to three weeks. Defense Secretary Lloyd Austin tells the Senate Appropriations defense subcommittee that by the time the Ukrainians complete that training, the Abrams tanks currently being built specifically for Ukraine will be ready.

The failure of Russia’s missile war in Ukraine (Defense News) Russia's missile attacks have, in the aggregate, failed to produce the kind of decisive strategic effects Moscow likely expected.

Why Putin Needs Wagner (Foreign Affairs) The hidden power struggle sustaining Russia’s brutal militia.

Putin's fighting power is exhausted in Ukraine – here's why (The Telegraph) Video analysis: As Russian assaults in Ukraine dwindle, Putin's army is making a mockery of three key components of fighting power

Russia’s reverses in Ukraine give China cause for caution, US defense luminaries say (Breaking Defense) Leon Panetta, Michèle Flournoy, and H.R. McMaster agreed Ukraine is showing China how tough a target Taiwan could be, while Bob Gates predicted Xi would not arm Putin and Condi Rice said Beijing is already backing off its worst ‘Wolf Warrior diplomacy.’

Greater clarity is needed in US policy toward Ukraine (Atlantic Council) The US has been instrumental in rallying international support for Ukraine, but the Biden administration still needs to clarify whether it views the Russian invasion as a pivotal moment in world politics, writes Michael F. Oppenheimer.

NATO must codify these lessons from Ukraine while motivation is there (Breaking Defense) NATO experts Ira Straus and Jim Townsend offer a to-do list of lessons learned for alliance leadership - and urge them not to miss this moment of transformation.

Ukrainian historian Serhii Plokhy: ‘This may not be the last chapter of the Russian empire, but it’s an important one’ (the Guardian) The Harvard academic on writing while grieving – and where his country goes from here

IRS gives Ukraine tools to expose Russian oligarchs hiding riches in crypto exchanges (CyberScoop) The agency's crime-fighting unit will provide licenses and training for a Chainalysis platform to track Russian oligarch's assets in Ukraine.

“Shared threats, shared understanding”: U.S., Canada and Latvia conclude defensive Hunt Op (U.S. Cyber Command) “Shared threats, shared understanding”: U.S., Canada and Latvia conclude defensive Hunt Operations

Signals intelligence teams reposition to face China, Russia (Defense News) The mission has shifted dramatically as the United States ratchets up competition in the frequency bands with peer competitors like Russia and China.

US ambassador accuses South Africa of providing weapons, ammo to Russia (AP NEWS) The U.S. ambassador to South Africa has accused the country of providing weapons and ammunition to Russia. Ambassador Reuben Brigety said the U.S. government was certain that military equipment was loaded onto a Russian cargo ship that docked secretly at a naval base near the city of Cape Town for three days in December. He says the weapons were then brought to Russia. South African President Cyril Ramaphosa said an investigation was underway. His office added there was currently "no evidence" the cargo was weapons. But the AP has established that the vessel in question is tied to a Russian company sanctioned by the U.S. for transporting military equipment for the Russian government.

Exclusive: Biden administration hunts for high-value Russians for potential prisoner swap (CNN) The Biden administration is scouring the globe for offers that could entice Russia to release two wrongfully detained Americans, Evan Gershkovich and Paul Whelan, according to three sources familiar with the matter.

Attacks, Threats, and Vulnerabilities

CISA and FBI Release Joint Advisory in Response to Active Exploitation of PaperCut Vulnerability (Cybersecurity and Infrastructure Security Agency CISA) CISA and FBI have released a joint Cybersecurity Advisory (CSA), Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG.

Malicious Actors Exploit CVE-2023-27350 in PaperCut MF and NG (Cybersecurity and Infrastructure Security Agency CISA) The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) in response to the active exploitation of CVE-2023-27350. This vulnerability occurs in certain versions of PaperCut NG and PaperCut MF and enables an unauthenticated actor to execute malicious code remotely without credentials. PaperCut released a patch in March 2023.

CryptNet: Russian ransom gang makes its debut (Cybernews) Another day, another new ransomware gang: the latest bad actor to be spotted on a Russian-speaking corner of the dark web is called CryptNet.

Plug-and-Play Microsoft 365 Phishing Tool 'Democratizes' Attack Campaigns (Dark Reading) New "Greatness" phishing-as-a-service used in attacks targeting manufacturing, healthcare, technology, and other sectors.

Multiple Vendor Camera System Attack (FortiGuard) Active attack attempts targeting vulnerable CCTV Cameras and DVR systems from multiple vendors such as Argus, Axis, MVPower and Vacron.

Researchers Uncovered C2 Infrastructure Used by Banking Malware Ursnif (Cyber Security News) Bridewell's Cyber Threat Intelligence (CTI) team has discovered previously undetected Ursnif infrastructure used in 2023 campaigns, suggesting that the malware operators have not yet utilized this highly elusive infrastructure.

Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers (SentinelOne) Availability of leaked Babuk source code is fuelling a proliferation of file lockers targeting VMware ESXi.

Ransomware Actors Adopt Leaked Babuk Code to Hit Linux Systems (Decipher) Various threat groups are increasingly using Babuk’s leaked source code to build ESXi lockers, including a never-before-seen Linux version of the Play ransomware.

Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers (BleepingComputer) An increasing number of ransomware operations are adopting the leaked Babuk ransomware source code to create Linux encryptors targeting VMware ESXi servers.

The Race to Patch: Attackers Leverage Sample Exploit Code in Wordpress Plugin (Akamai) The Akamai Security Intelligence Group (SIG) has been analyzing attack attempt activity following the announcement of a critical vulnerability in a WordPress custom fields plug-in affecting more than 2 million sites.

Discarded, not destroyed: Old routers reveal corporate secrets (WeLiveSecurity) Secondary market core routers are often not wiped clean and are replete with sensitive, even confidential, data, according to ESET research.

Toyota: Data on more than 2 million vehicles in Japan were at risk in decade-long breach (ABC News) Toyota’s much-touted online service for its drivers had a data breach spanning over a decade, risking outside access to information on more than 2 million vehicles

Attackers threaten to contact Dragos CEO's wife and son in failed extortion attempt (SiliconANGLE) Attackers threaten to contact Dragos CEO's wife and son in failed extortion attempt - SiliconANGLE

Seacom Hit By Cyber Attack, Says No Customer Data Breached (TechFinancials) African telecommunications services and managed services provider Seacom says it has suffered a cyber security incident.

Australia's TechnologyOne says customers face no impact from cyber attack (Reuters) Australia's TechnologyOne Ltd said on Friday its customer-facing software-as-a-service platform was not connected to the internal back-office system that came under cyber attack this week.

Australian software giant won't say if customers affected by hack (TechCrunch) Brisbane-based TechnologyOne asked regulators to halt trading on its stock after confirming that cybercriminals breached its network.

Brightly warns of SchoolDude data breach exposing credentials (BleepingComputer) U.S. tech company and Siemens subsidiary Brightly Software is notifying customers that their personal information and credentials were stolen by attackers who gained access to the database of its SchoolDude online platform.

RUMC suffers ransomware attack; unclear if patient info compromised (silive) The hospital said "disruptions have been limited with the exception of overnight trauma and stroke services."

FTC: Those urgent emails from MetaMask and PayPal are phishing scams (WJXT) Most unexpected emails saying to act quickly, click a link, or call a number are phishing scams.

Security Patches, Mitigations, and Software Updates

CISA Releases Fifteen Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency CISA) CISA released fifteen Industrial Control Systems (ICS) advisories on May 11, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

How to use the Apple Rapid Security Response updates (Enterprise Desktop | TechTarget) With the release of Apple's Rapid Security Response framework for security OS updates, IT should adjust strategies to accommodate the quicker time frame.

Trends

Power Rankings: 2022 Ransomware Malicious Quadrant (Halcyon) Halcyon Blog Post: The Halcyon team of ransomware experts has put together this RaaS power rankings guide for the ransomware threat landscape based on data from throughout 2022...

2023 Imperva Bad Bot Report | Resource Library (Imperva) Automated business logic attacks are on the rise, driven by bad bots that can evade detection while wreaking havoc and enabling online fraud. Bad bots mimic hum

Bad Bots Now Account For 30% of All Internet Traffic (Infosecurity Magazine) Figure is highest since records began, says Imperva

Bots now make up nearly half of all internet traffic, and that's very bad news for our security (TechRadar) Advanced bots are growing alongside bad bots

Three in Five Businesses Affected by Software Supply Chain Attacks in Last 12 Months (Capterra) Learn why you should be concerned about software supply chain threats and the strategies companies are using to defend against them.

CISOs' confidence in post-pandemic security landscape fades (Help Net Security) Most CISOs have returned to the elevated concerns they experienced early in the pandemic and feel more unprepared then last year.

Paying Cyber Hijackers’ Ransoms Doubles Cost of Recovery, Sophos Study Shows (MSSP Alert) “Paying ransoms not only enriches criminals, but it also slows incident response and adds cost to an already devastatingly expensive situation.”

Marketplace

Keeper Security wins minority equity investment from Summit Partners (WhaTech) Investment marks the second significant funding round from a leading technology growth equity firm

Akamai Lays Off Nearly 300 Staff to Hit Profitability Goals (Gov Info Security) Akamai will shrink its workforce by 3% as its shifts resources from its shrinking content delivery business to growth areas in cloud computing and security. The

WSJ News Exclusive | NBCUniversal’s Linda Yaccarino Is in Talks to Become Twitter CEO (Wall Street Journal) Yaccarino is chairman of global advertising and partnerships at NBCU. Twitter owner Elon Musk said earlier he had picked a new chief executive without naming the person.

Elon Musk Says He Hired New Twitter CEO (Information) Elon Musk tweeted on Thursday that he had hired a woman as Twitter’s new CEO, the social media company he purchased in October for $44 billion and has led in the months since.

Halcyon Appoints Kris Lamb as Chief Product Officer (Business Wire) Former Early Member of ISS X-Force (now IBM) Brings Unmatched Security Product Knowledge and Experience to Halcyon’s Leadership Team

Products, Services, and Solutions

Azion Obtains PCI DSS v4.0 Cybersecurity Certification (Azion Technologies) With PCI DSS v4.0, Azion is prepared to support the payment card sector in facing the new challenges of today's cybersecurity. Find out how.

Qrypt and Carahsoft Partner to Provide Quantum Secure Encryption to Federal Agencies (Business Wire) Innovative Quantum-Secure Encryption Technology Now Available to Fortify Data Security Across the Government

RKVST launches Instaproof so anyone can decide what data to trust (Business Wire) View instantly verifiable provenance records for any file with a simple drag and drop

Bitdefender Launches App Anomaly Detection for Android Mobile Devices – Industry’s First Real-Time Protection Layer (Bitdefender) New App Anomaly Detection Innovation Monitors, Detects, and Notifies Users of Suspicious Behavior Even Among Trusted Apps that Turn Rogue

Twitter launches encrypted DMs behind a paywall (The Verge) Why pay?

Twitter’s Encrypted DMs Are Deeply Inferior to Signal and WhatsApp (WIRED) The social network’s new privacy feature is technically flawed, opt-in, and limited in its functionality. All this for just $8 a month.

DigiCert ONE to be made available on Oracle Cloud (ChannelLife New Zealand) DigiCert and Oracle will collaborate on further integration into the OCI ecosystem to help joint customers manage their digital trust initiatives.

Technologies, Techniques, and Standards

NIST Debuts New Cyber Guidance for Contractors Handling Sensitive Data (Nextgov.com) The National Institute of Standards and Technology is accepting comments on the revised document through July 14.

Cybersecurity for Level 0,1 devices is underdeveloped (Control Global) “Challenges in Federal Facility Control System Cyber Security, Including Level 0 and 1 Devices” addresses the problem that cybersecurity for Level 0,1 devices is underdeveloped

Why more transparency around cyber attacks is a good thing for everyone (NCSC) Eleanor Fairford, Deputy Director of Incident Management at the NCSC, and Mihaela Jembei, Director of Regulatory Cyber at the Information Commissioner’s Office (ICO), reflect on why it’s so concerning when cyber attacks go unreported – and look at some of the misconceptions about how organisations respond to them.

UK ‘increasingly concerned’ ransomware victims are keeping incidents secret (Record) British authorities are “increasingly concerned” that ransomware victims in the country are keeping incidents secret, the National Cyber Security Centre (NCSC) said on Thursday.

Focus is integral to safeguarding health data (RSM) Health care continues to prioritize patient data security in an interoperable and growing industry.

Bad data and death: Ian Hill speaks about AI in warfare at the Cybersecurity Festival (Computing) Computing is the leading information resource for UK technology decision makers, providing the latest market news and hard-hitting opinion.

Design and Innovation

The open-source AI boom is built on Big Tech’s handouts. How long will it last? (MIT Technology Review) Greater access to the code behind generative models is fueling innovation. But if top companies get spooked, they could close up shop.

Research and Development

UNITED STATES : DARPA looks for vulnerabilities in cyber-physical systems (Intelligence Online) The US Department of Defense's latest obsession, cyber-physical systems, contain physical components and cyber elements whose vulnerabilities could impact the physical world. Under its Faithful

Academia

Tennessee, Georgia colleges respond to cyberattacks as school year wraps up (Record) Chattanooga State and Mercer University are the latest U.S. higher education institutions to disclose that hackers had attacked their networks.

NSF Supports New AI Institute for Agent-based Cyber Threat Intelligence and OperatioN (University of Illinois) Earlier in May, the US National Science Foundation announced an investment of $140 million to launch seven new Artificial Intelligence Research Institutes across the country. One of the seven new institutes will be established at the University of California, Santa Barbara, and includes 11 educational institutions – of which the University of Illinois Urbana-Champaign is one.

CMU Hacking Team Defends Title at MITRE Cybersecurity Competition (CMU) For the second year in a row, Carnegie Mellon’s competitive hacking team, the Plaid Parliament of Pwning (PPP), has taken home the top prize at the MITRE Embedded Capture-the-Flag cybersecurity competition.

Legislation, Policy, and Regulation

EU lawmakers' committees agree tougher draft AI rules (Reuters) European lawmakers came a step closer to passing new rules regulating artificial intelligence tools such as ChatGPT, following a crunch vote on Thursday where they agreed tougher draft legislation.

China the Target of New G-7 Push Against ‘Economic Coercion’ (Bloomberg) Joint mechanism set to be announced at Hiroshima summit. Plan papers over differences on tangible actions against China.

Flood of ransom payments continues as officials mull ban (Cybersecurity Dive) The revived debate over the viability of a ransom payment ban comes down to the cost ransomware is causing organizations globally.

Senators eye defense bill for classified intelligence reform (Defense News) The bipartisan group announced two bills on May 10 aimed at improving the U.S. government's approach to classifying information.

Lawmakers tell Biden to act quickly to nominate a national cyber director (Washington Post) First in The Cybersecurity 202: Cyberspace Solarium Commission co-chairs urge Biden to fill key cyber gig

WSJ News Exclusive | NSA Chief Paul Nakasone Has Said He Expects to Step Down in Coming Months (Wall Street Journal) Army Gen. Paul Nakasone, director of the National Security Agency, has told colleagues he expects to step down from the helm of the electronic spy agency and military’s Cyber Command.

Head of NSA, Cyber Command expected to resign (The Hill) Gen. Paul Nakasone, the head of the National Security Agency (NSA) and U.S. Cyber Command, is expected to resign from his positions in the coming months, The Wall Street Journal reported. A source …

The Marines’ next cyber chief is stuck in a pileup of nominations in the Senate (Record) President Joe Biden’s expected pick to helm the U.S. Marine Corps’ digital warfighting branch is caught in a monthslong hold on senior military promotions and nominations in the Senate led by a Republican lawmaker.

Litigation, Investigation, and Law Enforcement

Breach of Mental-Health Records Challenges Nation’s Court System (Wall Street Journal) Hacker, reaching a dead end in extorting clinic in Finland, targeted individual patients.

WSJ News Exclusive | Automation Giant Faces U.S. Government Probe Over China Operations (Wall Street Journal) Investigation focuses on whether its software might allow access to critical U.S. government and industrial infrastructure.

UK's National Crime Agency wins major legal challenge over Encrochat hack (Record) The Investigatory Powers Tribunal ruled the NCA had not failed to obtain the proper warrants to access messages from the hacked platform.

F.B.I. Violations of Rules for Searching Surveillance Data Drop, Audit Finds (New York Times) Recent changes by the Federal Bureau of Investigation appear to have significantly improved compliance with rules limiting when agents may access communications intercepted under the Foreign Intelligence Surveillance Act, according to data from the bureau’s auditing office.

Your Ad Data Is Now Powering Government Surveillance (Bloomberg) A product called Echo, made by the Israel-based Rayzone Group, is using information intended for marketers to help authorities track people through their mobile phones.

Engineer Gets 6 Years After Saying His Theft Made Ubiquiti Safer (Bloomberg) Ubiquiti suffered $4 billion market-cap drop, US says. Nickolas Sharp claimed his crime began as ‘unsanctioned drill’.

Former Ubiquiti dev who extorted the firm gets six years in prison (BleepingComputer) Nickolas Sharp, a former senior developer of Ubiquiti, was sentenced to six years in prison for stealing company data, attempting to extort his employer, and aiding the publication of misleading news articles that severely impacted the firm's market capitalization.

A Republican-Led Lawsuit Threatens Critical US Cyber Protections (WIRED) Three states are suing to block security rules for water facilities. If they win, it may open the floodgates for challenges to other cyber rules.

Mike Lynch extradited to US to face fraud charges (Computing) Entrepreneur finally loses his battle to be tried in the UK

Crypto Scammer Arrested Again in Florida on Fraud, Gun Charges (Bloomberg) Nicholas Truglia had been released from prison late last year 25-year-old admitted role in a prior theft of $1 million

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Voice & AI (Washington, DC, USA, Sep 5 - 7, 2023) VOICE & AI 2023 is the world's largest generative and conversational AI event dedicated to developers, designers, product leaders, marketers, and more. The initial program has been revealed for the conference, which will be held Sept. 5-7 2023 at the Washington Hilton in Washington, D.C. Many more talks will be added to the program in the weeks ahead. Workshops on strategy and open-source code will kick off the event on Sept. 5, with leading companies including NVIDIA, Microsoft, GM, Capital One, Google, Apple, and Github providing detailed insights on how they approach the AI revolution. In all, more than 100 speakers will deliver panel discussions, tactical breakout sessions, keynotes, and lightning talks. Additional sessions on AI policy, regulations, and procurements will be presented by federal agencies.

2023 PCI SSC North America Community Meeting (Portland, Oregon, USA, Sep 12 - 14, 2023) Join your global payment security peers at the 2023 PCI SSC Community Meetings! PCI SSC Community Meetings bring together the brightest minds in payment security. Don’t miss the opportunity to collaborate and learn about the latest developments in global payment security and in the PCI Security Standards.

2023 PCI SSC Europe Community Meeting (Dublin, Ireland, Oct 24 - 26, 2023) Join your global payment security peers at the 2023 PCI SSC Community Meetings! PCI SSC Community Meetings bring together the brightest minds in payment security. Don’t miss the opportunity to collaborate and learn about the latest developments in global payment security and in the PCI Security Standards.

2023 PCI SSC Asia-Pacific Community Meeting (Kuala Lumpur, Malaysia, Nov 15 - 16, 2023) Join your global payment security peers at the 2023 PCI SSC Community Meetings! PCI SSC Community Meetings bring together the brightest minds in payment security. Don’t miss the opportunity to collaborate and learn about the latest developments in global payment security and in the PCI Security Standards.

Events

CyberLEO (Los Angeles, California, USA, May 10 - 12, 2023) Our mission is to bring you discussions, updates, briefings, and lessons learned stemming from real-world experiences that will make a positive impact on your cybersecurity strategy. That’s why we work closely with our Advisory Board to build a program that you can feel confident in. With multiple constellations being launched, we could see tens of thousands of satellites entering LEO. CyberLEO will become the epicenter of discussion surrounding security issues in a LEO world.

RuhrSec (Bochum, Nord Rhein-Westphalen, Germany, May 11 - 12, 2023) RuhrSec is the annual English speaking non-profit IT security conference with cutting-edge security talks by renowned experts. RuhrSec provides academic and industry talks, the typical University feeling, and a highly recommended social event.

Insider Threat Program Development / Management - Insider Threat Detection & Data Analysis Training Course (Washington, DC, USA, May 11 - 12, 2023) The training course will be taught at the National Academy of Sciences – Keck Building in Washington D.C. This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CIO, CISO, Human Resources, IT, Network Security, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. This training will also provide students with an in depth view of how to obtain visibility of potential or malicious employee actions on computer systems and networks, using Insider Threat Detection software. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

SGF-Cybersecurity Week 2023 (Amsterdam, Netherlands, May 15 - 19, 2023) This week-long conference draws together power grid CISOs together with their IT and OT security teams for a week-long review of the latest prevention, detection and response solutions and strategies, in the context of increased geopolitical tensions. The week begins with a Risk Management briefing to guide the technical discussions taking place later in the week. The main conference includes a series of plenary sessions on the big organisational issues such as Regulation, Workforce development and data management, and afternoon technical tracks show-casing technical cybersecurity innovations in IT and OT domains. A solution zone running alongside the conference provides a focused display of power grid specific IT and OT cybersecurity solutions, and the extensive networking programme enables IT and OT colleagues to collaborate and seek new partnership opportunities with greater ease.

SANS Security West 2023 (San Diego, California, USA, May 15 - 20, 2023) At Security West, choose from 33 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.