Ransomware and data breaches continue. State fronts and cyber offensives.

Summary

By the CyberWire staff

At a glance.

Third-party data breach at Discord.
Black Basta conducts ransomware attack against technology company ABB.
Intrusion Truth returns to dox APT41.
Anonymous Sudan looks like a Russian front operation.
Attribution and motivation of "RedStinger" remain murky.
CISA summarizes Russian cyber offensives.
Seven new entries to CISA's Known Exploited Vulnerabilities Catalog.
Remote code execution exploits Ruckus in the wild.
Espionage and YouTube comments.

Third-party data breach at Discord.

Bleeping Computer reports that Discord, the well-known VoIP and instant messaging social platform, has experienced a data breach via the compromised account of a third-party support agent. Discord says that the ticket queue of the support agent contained “user email addresses, messages exchanged with Discord support, and any attachments sent as part of the tickets.” The company quickly disabled the agent’s account and did a malware sweep of the device. Security Affairs reports that Discord is also working with their third-party support provider to improve their cybersecurity and prevent an incident like this from taking place again. Discord told affected users that the company believed the risk from the breach is minimal, but that they advise vigilance against potential fraud or phishing attempts.

What are your biggest resource challenges? Expel makes every investment count.

ISOs have lots to think about. Teams and tech stacks. Budgets and booming attack surfaces. Security strategies evolving to address business goals. All of the above?

Expel’s software-driven approach to managed security puts your existing tech to work across cloud (and Kubernetes!), on-prem, network, SaaS, and SIEM, automating alert analysis, prioritization, and remediation so you get better answers to what matters the most. Fast.

Optimize your tech. Support your team. Stretch your budget. Expel.

Black Basta conducts ransomware attack against technology company ABB.

ABB, a technology company based in Switzerland, confirmed Friday that they are experiencing technical issues relating to a cyber attack. BleepingComputer reports that the Black Basta ransomware gang was behind the attack, but ABB has yet to confirm this. “BleepingComputer has learned from multiple employees that the ransomware attack has affected the company’s Windows Active Directory, affecting hundreds of devices. In response to the attack, ABB terminated VPN connections with its customers to prevent the spread of the ransomware to other networks.”, writes BleepingComputer. ABB seems to remain mostly operational. Eike Christian Mueter, group spokesperson at ABB, told ET CISO, “The vast majority of its systems and factories are up and running and ABB continues to serve its customers in a secure manner.” See CyberWire Pro for more on Black Basta and the incident at ABB.

The key to beating ransomware? Use a solution built to defeat ransomware.

Halcyon is the first dedicated, adaptive solution that combines multiple advanced proprietary prevention engines focused specifically on detecting and stopping ransomware. With the fastest endpoint recovery capabilities, multiple layers of resiliency, bypass and evasion protection, automated key capture for swift decryption and data exfiltration prevention, the Halcyon Anti-Ransomware and Resilience Platform reverses the impact of ransomware attacks in just minutes. This is why Halcyon is the resilience platform Global 2000 companies rely on to defeat ransomware.

Intrusion Truth returns to dox APT31.

The Washington Post reports that Intrusion Truth, the anonymous bloggers who have made a specialty of exposing Chinese Ministry of State Security cyber operations, resurfaced last week to publish an account of APT31's recent activities. In this case it's a claimed exposé of the MSS's "Kerui Cracking Academy," located in Wuhan. Mandiant describes APT31 as "a China-nexus cyber espionage actor focused on obtaining information that can provide the Chinese government and state-owned enterprises with political, economic, and military advantages." It's less clear who Intrusion Truth is. The group presents itself as a collection of hacktivists, but there's speculation that in fact they're a cybersecurity firm or an activity run by a Western intelligence service. In any case, their reports have a good track record of confirmation by independent sources.

Anonymous Sudan looks like a Russian front operation.

Bloomberg reports that Anonymous Sudan, which represents itself as an Islamist Sudanese hacktivist collective, appears in fact to be a false-flag operation of Russian intelligence services. Research published in February by the Swedish cybersecurity firm Truesec concludes that Anonymous Sudan is instead in all probability a Russian operation directed at Sweden. Its aim is to interfere with Sweden's accession to NATO using a mix of nuisance-level distributed denial-of-service (DDoS) attacks and influence operations directed at Sweden's Muslim minority and at Turkish public opinion. The DDoS attacks, apart from the irritation they represent, lend verisimilitude to Anonymous Sudan's self-presentation as a hacktivist group: DDoS, after all, is along with website defacements, a common hacktivist tactic. But Anonymous Sudan displays, Truesec concludes, both a detailed, close knowledge of Sweden's political climate and a level of funding that far exceeds what's available to genuine hacktivist groups.

Bloomberg cites Katarzyna Zysk, a professor of international relations at the Norwegian Institute for Defence Studies in Oslo, who sees "the timing and organization of the attacks, the hackers’ knowledge of religious and political friction points in Sweden, and the attacks’ similarities to other Russian influence operations" have "led her to conclude that the group was controlled or guided by Russia’s intelligence services."

For its own part Anonymous Sudan has poo-pooed Truesec's report. They're not Russian, they say, but Russia has helped them in the past, and this is just their way of giving back. A look at the ongoing violence in Sudan would suggest that this is implausible: actual hacktivists, especially actual Sudanese Islamist hacktivists, would have more immediate concerns than doing their Russian buddies a solid.

Attribution and motivation of "RedStinger" remain murky.

The RedStinger campaign Malwarebytes described last week seems to have been active against both Ukrainian and Russian targets. A discussion in Cybernews notes that while the APT group (which the outlet refers to as "Red Stealer"), is known to have been active between 2020 and 2022 and seems to be Russian, its motivation is curious, as it has collected against targets on both sides of Russia's war with Ukraine. One possible explanation is that RedStinger was interested in quasi-domestic surveillance of officials in Ukrainian provinces illegally annexed by Russia. A report in SC Media observes "An example of the baffling diversity of the targets of Red Stinger’s attacks occurred in September last year when Russia held referendums in Luhansk, Donetsk, Zaporizhzhia and Kherson seeking support for its occupation. The group targeted several election officials involved in the Russian referendums, but during the same operation it also targeted a Ukrainian library in the city of Vinnytsia."

CISA summarizes Russian cyber offensives.

CISA, the US Cybersecurity and Infrastructure Security Agency, has published a compendium of its studies of "the Russian government’s malicious cyber activities." The most recent entry is last week's discussion of the Snake malware and its disruption by the Five Eyes. The oldest entry goes back to December 29, 2016, and covers the Grizzly Steppe operation conducted against US targets associated with the 2016 US elections. It's noteworthy that CISA's compendium addresses only Russian government malicious activity. The large and active Russian cyber underworld is outside the scope of the summary.

The CyberWire's continuing coverage of Russia's war against Ukraine, with special attention to the cyber phases of that war, may be found here.

Seven entries added to CISA's Known Exploited Vulnerabilities Catalog.

CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog (KEV). Vulnerabilities are added to the catalog based on evidence of active exploitation in the wild. US Federal civilian executive agencies have until June 2nd, 2023, to address them:

CVE-2023-25717 Multiple Ruckus Wireless Products CSRF and RCE Vulnerability
CVE-2021-3560 Red Hat Polkit Incorrect Authorization Vulnerability
CVE-2014-0196 Linux Kernel Race Condition Vulnerability
CVE-2010-3904 Linux Kernel Improper Input Validation Vulnerability
CVE-2015-5317 Jenkins User Interface (UI) Information Disclosure Vulnerability
CVE-2016-3427 Oracle Java SE and JRockit Unspecified Vulnerability
CVE-2016-8735 Apache Tomcat Remote Code Execution Vulnerability

Remote code execution exploits Ruckus in the wild.

One of the more noteworthy vulnerabilities CISA added to its Known Exploited Vulnerabilities Catalog Friday was the critical remote code execution (RCE) issue affecting multiple Ruckus products. Bleeping Computer reports that the flaw concerns devices using the Ruckus Wireless Admin panel. The CVE-2023-25717 vulnerability, while first acknowledged in February, has probably not seen many patches on vulnerable Wi-Fi access points, which in these attacks have been targeted by AndoryuBot malware. The malware, once within the system, adds the compromised device to a botnet for use in distributed-denial-of-service (DDoS) attacks. Ruckus released a security bulletin in February that was updated last week, detailing the almost 60 devices impacted and patches available. Many end-of-life devices, however, have no patch available.

Dead drops, Gangnam style.

Dead drops used to use things like trash bags beneath Northern Virginia footbridges, maybe signaled with a chalk mark on a mailbox or some chewing gum on a lamp post. Now they can use comments in YouTube videos. The Suwon District Prosecutors Office has charged four members of the Korean Confederation of Trade Unions (KCTU) with spying for North Korea. The South Korean trade unionists are accused, NK News reports, of communicating with their handlers by leaving a prearranged comment in a YouTube video “Tutorial: How to open Yamaha NVX 155 without key.” The KCTU members are accused of violating the Republic of Korea's National Security Act through both espionage--providing Pyongyang's intelligence services with information that included photographs of sensitive installations--and serving as agents of influence--seeking to incite anti-Japanese and anti-American sentiment. (Not all of the signaling was digital. The four accused also allegedly used old-school tradecraft that would be familiar to any reader of John Le Carré novels.)

Notes.

Today's issue includes events affecting Australia, China, Costa Rica, the European Union, France, Germany, the Holy See, the Democratic Peoples Republic of Korea, the Republic of Korea, Latvia, NATO/OTAN, Pakistan, Russia, Sweden, Turkey, Ukraine, the United Kingdom, and the United States.

The section on the Kerui Cracking Academy erroneously gave the associated APT as APT41--that's been corrected above to APT31.

Dateline Russia's war: Russian forces' tactical withdrawal around Bakhmut.

Ukraine at D+445: Russian forces' tactical withdrawals around Bakhmut. (CyberWire) Ukrainian forces have, since Friday, conducted local attacks around Bakhmut, and have enjoyed some success, but it seems to early to call the the beginning of the spring offensive.

Russia-Ukraine war: List of key events, day 446 (Al Jazeera) As the war enters its 446th day, we take a look at the main developments.

Russia-Ukraine war at a glance: what we know on day 446 of the invasion (the Guardian) France to provide more tanks and armoured vehicles to Ukraine as Zelenskiy hails Kyiv’s ‘expanding’ war capabilities and announces visit to London; two Russian commanders killed in Ukraine

Footage shows massive explosions and fireballs after a wave of Russian drones targeted a city in western Ukraine (Business Insider) The massive explosions in Khmelnytskyi, western Ukraine, resulted from a salvo of attack drones launched by Russia, officials confirmed.

Ukrainian Commander Touts Successful Advance In Bakhmut; Zelenskiy Gets Weapons Pledge From Britain (RadioFreeEurope/RadioLiberty) A top Ukrainian commander has said that his ground forces have shown that they can succeed under difficult conditions in their effort to beat back Russian forces in the eastern city of Bakhmut.

Russia-Ukraine war at a glance: what we know on day 445 of the invasion (the Guardian) Zelenskiy lands in Berlin to shore up support; Russian missiles strike home town of Ukraine’s Eurovision entry during song contest

As Ukraine Makes Inroads in Bakhmut, Devastation Still Reigns (New York Times) The fight for Bakhmut is now the war’s single longest and bloodiest battle. Although the Ukrainians are making small gains, Russia still controls about 90 percent of the largely ruined city.

Russian Offensive Campaign Assessment, May 13, 2023 (Critical Threats) Ukrainian forces continue to counterattack in the Bakhmut area amid unconfirmed claims of further marginal Ukrainian gains southwest of t...

Russian troops fall back to ‘defensive positions’ near Bakhmut (the Guardian) Moscow statement is first admission that Ukraine is successfully recapturing ground around eastern city

Russia Acknowledges Retreat North Of Bakhmut After Major Advance By Ukrainian Troops (RadioFreeEurope/RadioLiberty) The Russian Defense Ministry has acknowledged its forces retreated from positions north of the city of Bakhmut in Ukraine's eastern Donetsk region that for months has been the scene of heavy fighting.

Russian troops fall back to ‘defensive positions’ near Bakhmut (the Guardian) Moscow statement is first admission that Ukraine is successfully recapturing ground around eastern city

Multiple Russian Jets, Helicopters Reportedly Crash Near Ukrainian Border (RadioFreeEurope/RadioLiberty) At least one Russian warplane and a military helicopter have crashed in the Bryansk region bordering Ukraine, Russian emergency services were quoted by TASS news agency as saying, with several reports claiming the craft had been shot down.

Russia lost a hypersonic missile trying to destroy one of Ukraine's Patriot missiles (Task & Purpose) Russia specifically targeted one of the Western-supplied missile systems. Ukraine hit them with an Uno reverse card.

On the front line when Ukraine did the unthinkable in Bakhmut after months of retreat (The Telegraph) The Ukrainians unleash one of the loudest artillery barrages of the war as the spring counter-offensive begins

Ukraine war live: Russia facing 60 mile Ukrainian offensive (The Telegraph) Russia has said that it faced Ukrainian attacks along a 60 mile stretch of the front near the besieged city of Bakhmut on Thursday.

Ukraine captures 10 Russian positions near Bakhmut (The Telegraph) Head of Wagner group confirms Ukrainian forces captured land on Russian southern flank plus reports that two senior officers killed

The week that Putin lost control of his mercenary chief (The Telegraph) Challenging the Russian leader would be a stunning about face for a former petty criminal but Prigozhin has often risen above his station

Wagner chief offered to give Russian troop locations to Ukraine, leak says (Washington Post) THE DISCORD LEAKS | Yevgeniy Prigozhin said he would tell Ukraine’s military where to attack Russian troops if it pulled its own forces back from the beleaguered city of Bakhmut, where Wagner mercenaries were taking heavy losses

Putin's fighting power is exhausted in Ukraine – here's why (The Telegraph) Video analysis: As Russian assaults in Ukraine dwindle, Putin's army is making a mockery of three key components of fighting power

Russia's "eroded" ground forces have run into "big problems"—U.S. general (Newsweek) "They've lost a lot of people, they've lost a lot of equipment," General Christopher G. Cavoli told the Lennart Meri Conference.

Russian Recruiters 'More Assertive' Toward Central Asian Migrants As Dual Citizens' Urged To Fight In Ukraine (RadioFreeEurope/RadioLiberty) Russian military recruiters are said to have become more assertive in approaching Central Asian migrants amid Moscow's efforts to recruit more men to fight in Ukraine. It comes as a Russian lawmaker criticized naturalized citizens for their unwillingness to fight.

Kennan Cable No. 82: Putin’s Home War: Imperialism vs. Economy (Wilson Center) Speeches on the one-year anniversary of the Ukraine war by Presidents Putin and Biden show why the West is losing the information war.

Ukraine can defeat Russia by end of year with western help, Zelenskiy says (the Guardian) President travels to Berlin to meet German chancellor, who announces new military aid package including Leopard tanks

Russia-Ukraine war – as it happened: Zelenskiy arrives in France to meet Macron after Germany visit (the Guardian) Ukrainian president will hold talks with French president over dinner following rip to Berlin

Zelensky in UK for surprise meeting with Sunak (BBC News) Ukraine's president says he will discuss "urgent support for the Ukraine" with the prime minister.

France pledges more military aid as Ukraine's Zelenskyy makes surprise Paris visit to meet Macron (AP NEWS) France has pledged additional military aid, including light tanks, armored vehicles, training for soldiers and other assistance for Ukraine as it gears up for a counteroffensive against Russian forces. The fresh French support followed surprise talks Sunday in Paris between the Ukrainian and French presidents. Ukraine’s Volodymyr Zelenskyy and France’s Emmanuel Macron met for three hours at the presidential Elysee Palace. The encounter was kept under wraps until shortly before the Ukrainian leader's arrival in Paris from Germany on a French government jet, extending a multi-stop European tour. Zelenskyy met earlier Sunday with Germany's chancellor, Olaf Scholz.

Ukraine’s Zelensky visits Germany, turning a page on fragile ties (Washington Post) German Chancellor Olaf Scholz pledged Sunday to support Ukraine for as long as needed to repel Russia’s invasion as President Volodymyr Zelensky visited Berlin and the two leaders tried to bolster their countries’ sometimes strained relationship.

Zelenskiy and pope discuss peace in Ukraine as Russia retreats in Bakhmut (the Guardian) Pope Francis offers help repatriating Ukrainian children from Russia as Volodymyr Zelenskiy meets select leaders in Italy

Top Chinese Envoy To Visit Ukraine, Russia On 'Peace' Mission (RadioFreeEurope/RadioLiberty) A top Chinese envoy will begin a tour of Ukraine, Russia, and other European cities on May 15 in a trip Beijing says is aimed at discussing a "political settlement" to the Ukraine crisis.

Wider Europe Briefing: Unpacking The Latest EU Sanctions On Russia. Plus, Two Damning Reports On Moscow And Minsk. (RadioFreeEurope/RadioLiberty) I'm RFE/RL Europe Editor Rikard Jozwiak, and this week I'm drilling down on two major issues: the European Union's latest sanctions package targeting Moscow and two damning OSCE reports on Belarus and Russia.

Posing as Islamists, Russian Hackers Take Aim at Sweden (Bloomberg) A series of coordinated cyberattacks intended to jeopardize the Nordic country’s chances of joining NATO have been disrupting its biggest companies

Russian ‘Red Stealer’ cyberattacks target breakaway territories in Ukraine (Cybernews) A suspected Russian cyber campaign has been spotted targeting eastern Ukraine, using fake bulletins about the separatist regions of Luhansk and Donetsk as a lure to steal data from unsuspecting victims.

Newly identified APT group's motives in Ukraine baffle researchers (SC Media) Red Stinger has targeted victims on both sides of Russia’s war on Ukraine, and even infected its own machines.

Ukraine’s cultural counteroffensive: The rush to erase Russia’s imprint (Washington Post) In one of the most profound examples of how President Vladimir Putin’s brutal invasion has backfired, some Ukrainians are now trying to erase Russia — and the Russian language — from their culture and landscape.

Detained Ukrainian Industrialist, Suspected Of Collaboration, Requests Transfer To Russia (RadioFreeEurope/RadioLiberty) Former Motor Sich aviation-engine plant head Vyacheslav Bohuslayev, whom the government suspects of encouraging Russia's invasion of Ukraine, has asked to be exchanged for Ukrainian prisoners in Russia, RFE/RL has found.

G-7 vows to take 'necessary' steps to stop Russia evading sanctions (Nikkei Asia) Ministers agree to launch framework for countering Chinese supply chain dominance

Attacks, Threats, and Vulnerabilities

Three opposition media outlets hit by cyber attack (Duvar English) As the most critical elections in Turkey's history are taking place, opposition media outlets on May 14 were hit by cyber attacks. Television channel Halk TV, newspaper Sözcü, and Cumhuriyet reported cyber attacks on their websites.

Vulnerabilities Jeopardize Users of Major Industrial Cellular Routers Cloud Management Platforms (OTORIO) OTORIO research unveils vulnerabilities exposing hundreds of thousands of devices and OT networks, raising questions about connecting OT to the cloud.

They dox Chinese hackers. Now, they’re back. (Washington Post) These mysterious bloggers are back — and doxing suspected Chinese hackers

Conti Ransomware Group Poses $20 Million Threat to Costa Rican Government (Latest Hacking News) In a threatening move, the notorious ransomware group Conti has demanded a $20 million ransom from the Costa Rican government, warning that it will release data it has hijacked if the demand is not met.

Discord discloses data breach after support agent got hacked (BleepingComputer) Discord is notifying users of a data breach that occurred after the account of a third-party support agent was compromised.

Discord suffered a data after third-party support agent was hacked (Security Affairs) Discord disclosed a data breach, the security breach was caused by the compromise of a third-party support agent’s account. Discord, the popular VoIP and instant messaging social platform, disclosed a data breach and is notifying the impacted users. The security breach resulted in unauthorized access to a third-party customer service agent’s support ticket queue. Due to the nature […]

A ransomware source code leak spawned at least 10 ‘Babuk’ imitators, researchers say (Record) Cybersecurity researchers said they’ve identified ten different ransomware families that have recently branched off from Babuk — a ransomware strain that had its source code leaked online in 2021.

CISA: Bl00dy Ransomware Gang using printer vulnerability to attack schools (Record) The Cybersecurity and Infrastructure Security Agency (CISA) and FBI said a relatively new ransomware group has been exploiting an issue with a popular printing software to attack schools across the U.S.

Russia-affiliated CheckMate ransomware quietly targets popular file-sharing protocol (Security Affairs) The CheckMate ransomware operators have been targeting the Server Message Block (SMB) communication protocol used for file sharing to compromise their victims’ networks. Unlike most ransom campaigns, CheckMate, discovered in 2022, has been quiet throughout its operations. To the best of our knowledge, it doesn’t operate a data leak site. That’s quite unusual for a […]

Redirect Rampage Released Via Cloud Storage (Media Trust) DustRoyal-3PC redirect influx hides behind CDNs

Multinational tech firm ABB hit by Black Basta ransomware attack (BleepingComputer) Swiss multinational company ABB, a leading electrification and automation technology provider, has suffered a Black Basta ransomware attack, reportedly impacting business operations.

Automation specialist ABB 'hit by Black Basta ransomware attack' (Tech Monitor) ABB hit by ransomware attack by RaaS gang Black Basta, disabling hundreds of devices and disrupting company projects...

Swiss tech giant ABB confirms ‘IT security incident’ (Record) A spokesperson confirmed that ABB was responding to a cyberattack, but would not say if it was a ransomware incident. Reports said the Black Basta cybercrime group had attacked the company.

Breaking: ABB confirms cyberattack; work underway to restore operations (ETCISO.in) ABB still working to contain the security incident, says company spokesperson.

Criminal actors switch tactics after Microsoft began to block macros last year (Cybersecurity Dive) Researchers from Proofpoint have seen a rise in HTML smuggling, PDFs and OneNote files for malware delivery since late 2022.

Terrifying study shows how fast AI can crack your passwords; here’s how to protect yourself (9to5Mac) Along with the positive aspects of the new generative AI services come new risks. One that’s surfaced is an advanced...

Pension fund warns 470,000 members may have been compromised by Capita hackers (Computing) USS, the UK's largest pension fund, relies on Capita's technology to facilitate its internal pension administration procedures

Capita cyber-attack: USS pension fund members’ details may have been stolen (the Guardian) Universities Superannuation Scheme says it can not be certain information about 470,000 members is safe

Data of 237,000 US government employees breached (The Economic Times) The breach hit systems for processing TRANServe transit benefits that reimburse government employees for some commuting costs. It was not clear if any of the personal information had been used for criminal purposes.

How a cyberattack left one Indiana hospital reeling (NPR) Cyberattacks on hospitals are increasing. We follow an Indiana hospital's hacking story, showing how patient care was affected, in addition to the hospital's bottom line.

Warnings over NHS data privacy after ‘stalker’ doctor shares woman’s records (the Guardian) Exclusive: Victim speaks of feeling violated by hospital doctor incident that expert says is evidence of ‘systemic’ flaw in England

Innocent text message over dinner helps hacker infiltrate NSW business owner's account (Breaking Australian and World News Headlines - 9News) A New South Wales woman who helped a friend after they were locked out of their Facebook account ended up f...

LACROIX : Cyber attack contained at LACROIX. (Yahoo Finance) 2023/05/15 Cyber attack contained at LACROIX LACROIX announces that during the night of Friday 12 May to Saturday 13 May, it intercepted a targeted cyber attack on the French (Beaupréau), German (Willich) and Tunisian (Zriba) sites of the Electronics activity. Measures to secure all the Group's other sites were immediately taken. Prior to restarting the systems of these sites, investigations are underway to ensure that the attack is completely contained. However, some local infrastructures have

The Philadelphia Inquirer’s operations continue to be disrupted by a cyber incident (Philadelphia Inquirer) It was unclear when systems would be fully restored. The incident is the greatest disruption to Inquirer publication since 1996.

Philadelphia Inquirer hit by cyberattack causing newspaper’s largest disruption in decades (ABC27) The Philadelphia Inquirer experienced the most significant disruption to its operations in 27 years due to what the newspaper calls a cyberattack. The company was working to res…

Operations at Philadelphia Inquirer disrupted by "apparent cyber attack" (CBS News) The Inquirer was unable to print its regular Sunday paper because systems were down.

Hackers Come up With Innovative Methods to Enforce Ransomware Payment (IT Security News) Ransomware is still one of the most serious cybersecurity risks that organizations and governments face. However, as organizations make a conscious decision to deny ransom payment demands, cybercriminals are devising new methods to recover ransom from their victims. The fall of the most known ransomware gang, Conti, in May 2022, was expected to result

CISA warns of critical Ruckus bug used to infect Wi-Fi access points (BleepingComputer) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today of a critical remote code execution (RCE) flaw in the Ruckus Wireless Admin panel actively exploited by a recently discovered DDoS botnet.

CISA Adds Seven Known Exploited Vulnerabilities to Catalog (Cybersecurity and Infrastructure Security Agency CISA) CISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

Security Patches, Mitigations, and Software Updates

May 2023 Security Bulletin for Trend Micro Mobile Security (Enterprise) (Trend Micro) Trend Micro has released a new build for Trend Micro Mobile Security (Enterprise) that resolves several vulnerabilities.

Microsoft patches a patch for an under-attack Outlook flaw (Register) Let's take a quick dive into Windows API

Trends

2023 Mother’s Day Trends in Fraud (Forter) A look at how fraudsters approach purchasing gifts for Mother's Day in comparison to popular Valentine's Day items.

Marketplace

CorkTM Launches as the World’s First Cyber Warranty Company Dedicated to Making Financial Protection Simple and Easily Accessible for Managed Service Providers and the Small Businesses They Serve (Business Wire) DVx Ventures Leads $6M in Seed Funding; Barracuda Networks and River Run Among First Partners to Offer Cork Cyber Warranty Powered by Its Purpose-Built Platform

Accenture takes stake in generative AI firm Stardog (CRN) Accenture says it wants to 'nurture' the development AI business use cases

Data443 Expands Its Global Customer, Technology Base with Transformative Acquisition of Select Israel-based Cyren Ltd. Assets (GlobeNewswire News Room) Onboarding Customers Representing Over $15 Million in Unaudited FY 2022 Revenue Cyren’s Threat Intelligence Service Protects Over 1 Billion Users Globally...

Barracuda unifies partner programmes to recognise 'diversification' of partner business models (CRN) Reporting from Dubrovnik, Croatia for Barracuda’s annual partner summit, CRN catches up with worldwide partner ecosystems VP Jason Beal to hear more about the unification of the programmes

Accidental exclusion exacerbating cyber's staffing problem (Computing) Many people who would excel in cybersecurity roles see no obvious way in, with those that do make it getting stuck in entry-level positions

HYAS Wins CyberTech 100 Award (Business Wire) HYAS Honored in Fourth Annual CyberTech 100 Honoring Financial Services Innovators - Its Protective DNS Spots and Blocks Threat Actors Before They Can Launch Attacks.

Castellum, Inc. Announces First Quarter Financial Results and Provides Forward Guidance (GlobeNewswire News Room) Castellum, Inc. (the “Company”) (NYSE-American: CTM), a cybersecurity, electronic warfare, data...

WSJ News Exclusive | Ex-Twitter Cyber Chief Joins Cloud-Security Company Lacework (Wall Street Journal) Lea Kissner is the latest senior hire for the company, which has spent much of the past year restructuring.

Aryaka Appoints Pete Harteveld as Chief Revenue Officer (PR Newswire) Aryaka®, the leader in Unified SASE solutions, today announced the appointment of Pete Harteveld to the position of Chief Revenue Officer....

Source Defense Appoints Ross Hogan as Chief Executive Officer (GlobeNewswire News Room) Cybersecurity and Fraud Prevention industry veteran brings more than 20 years of leadership experience to fuel company’s growth, expand its community focus...

Products, Services, and Solutions

Vercel’s Frontend Cloud: Introducing Embedded Storage, Security and Workflow Solutions (Business Wire) A suite of cloud-native tools empowering the frontend ecosystem to deploy the next generation of high-quality Web applications.

Instantly Bypass SSL Errors (Medium) dope.security introduces an industry first: simplifying SSL inspection

Synopsys signs Black Duck software supply chain management deal (eeNews Europe) Synopsys is extending its moves into supply chain management through a deal for its Black Duck tool with ReversingLabs.

Brave unveils new "Forgetful Browsing" anti-tracking feature (BleepingComputer) The privacy-focused Brave Browser is introducing a new "Forgetful Browsing" feature that prevents sites from re-identifying you on subsequent visits.

Quantum Safe, IBM locks down critical government and business data (Breaking Latest News) A complete set of tools and features that, combined with the experience of Ibm on the cybersecurity…

Technologies, Techniques, and Standards

New DOD doctrine officially outlines and defines 'expeditionary cyberspace operations' (DefenseScoop) A sign of the maturity of cyber ops, the Department of Defense has recognized and defined what "expeditionary cyberspace operations" are.

Moats and Boats: Ex-Homeland Security Chief on Best Practices for Law Firm Cyber Defense (The Legal Intelligencer) Michael Chertoff’s consulting firm recently reviewed the Supreme Court's investigation into the Dobbs leak. The former DHS secretary and Third Circuit judge spoke in Philadelphia on Thursday.

Bad breach preparation leads to bad press: what you can do to minimise the impact (The Mandarin) Data breaches are growing more common, and more damaging. While they are often seen as a data security problem, I would argue that this lets organisations off the hook for their poor data management practices. We always ask, “how did they get in?”, but never questions like, “why does this organisation still have this sensitive

Threat Intelligence in OT Security: Best Practices & Use Cases (Sectrio) Discover the importance of threat intelligence in safeguarding operational technology (OT) systems. Explore best practices & effective use cases now!

688th Cyberspace Wing 4th annual tactical exercise enhances cyber defense operations, engages mission partners worldwide (DVIDS) The 688th Cyberspace Wing conducted the 4th annual tactical level exercise, "Savage Cerberus 23", comprised of four defensive cyberspace operations weapon systems and the 88th Communication Squadron Mission Defense Team, March 27- April 7, 2023 at the San Antonio Museum of Science and Technology, Port San Antonio, Texas.

Design and Innovation

A Radical Plan to Make AI Good, Not Evil (WIRED) OpenAI competitor Anthropic says its Claude chatbot has a built-in “constitution” that can instill ethical principles and keep systems from going rogue.

You’re Probably Underestimating AI Chatbots (WIRED) Just as the first iPhone reviews mostly missed the device’s huge potential, it’s folly to draw conclusions from today’s unrefined technology.

Catching bad content in the age of AI (MIT Technology Review) Why haven’t tech companies improved at content moderation?

Open-Source AI Is Gaining on Google and ChatGPT (The Information) In February, Meta Platforms set off an explosion of artificial intelligence development when it gave academics access to sophisticated machine-learning models that can understand conversational language. Within weeks, the academics turned those models into open-source software that powered free ...

Research and Development

DARPA working on cybersecurity tech that could free people from having to change their passwords (DefenseScoop) Are you tired of having to change all your passwords frequently? So is the director of the Defense Advanced Research Projects Agency.

United States Air Force Awards Lp Resilient Services an STTR Phase II Contract (GlobeNewswire News Room) LpRS to develop a Supply Chain Risk Management solution to identify and mitigate susceptibilities, vulnerabilities, and threats throughout DoD’s supply...

Academia

Cyber adversaries are targeting the academic sector - what do we need to know and what can be done about it - HEPI (HEPI) This guest blog has been kindly written for HEPI by Stuart Wiggins, who is Strategic Threat Advisor Europe for CrowdStrike, a leading firm in cybersecurity intelligence and services The academic sector faces a variety of security risks, ranging from physical threats to cyber adversaries targeting student data and personally identifiable information. It continues to be […]

Purdue launches nation’s first Institute for Physical AI (IPAI), recruiting 50 new faculty (Purdue University) As student interests in computing-related majors and societal impact of artificial intelligence and chips continue to rise rapidly, Purdue University’s Board of Trustees announced Friday (April 14) a major initiative, Purdue Computes.

National Cybersecurity Center Welcomed to USSPACECOM Academic Engagement Enterprise (AEE) - National Cybersecurity Center (National Cybersecurity Center) USSPACECOM welcomed the National Cybersecurity Center (NCC) to their Academic Engagement […]

Legislation, Policy, and Regulation

Pakistan shut down the internet - but that didn't stop the protests (BBC News) Millions were plunged offline after Imran Khan's arrest but the blackout hasn't stopped protests.

Latvia to up cybersecurity of national e-services (LSM) The National Health Service has already warned that e-Health will no longer be accessed by online banking identification tools from next year. The ministerial representatives responsible for IT system...

UK-France Cyber Dialogue: 11 May 2023 (British Embassy Paris) The fourth UK-France Cyber Dialogue was held in Paris on 11 May 2023, in line with the commitment made at the 36th Franco-British Summit on 10 March 2023.

Tech CEOs: EU Data Act Threatens Cybersecurity (PYMNTS) Worried about cybersecurity, five European tech CEOs are seeking changes to the proposed Data Act.

Europe’s Moral Crusader Lays Down the Law on Encryption (WIRED) Ylva Johansson is on a personal mission to make the internet safer for children. Her opponents say her plans would wreck online privacy.

UK's covert web surveillance programme moves beyond test phase (Computing) Officials have reportedly commenced efforts towards gathering internet connection records on a national scale

Cyberspace Solarium Co-Chairs “Extremely Concerned” About Vacant Cyber Director Role, Urge Administration for Nominee (US Senator Angus King) Senator King and Representative Gallagher call on the president to swiftly nominate Acting National Cyber Director Kemba Walden

Voting Machines Must Be Test Hacked for Certification, Under Proposed Bill (Nextgov.com) The new law would require cybersecurity penetration testing as part of voting systems’ approval process.

FCC Fortifies International Section 214 Holder Obligations to Promote National Security (Lexology) The Federal Communications Commission recently made significant changes to its rules for holders of international Section 214 authorizations, which…

States share services as DHS cyber grants roll out | StateScoop (StateScoop) As federal cybersecurity grants arrive, most states are opting to share services and capabilities with local governments, rather than issue sub-grants.

Litigation, Investigation, and Law Enforcement

Leaked Pentagon Documents: What We Know (Intelligencer) The chief of the Kremlin-backed Wagner Group mercenaries allegedly offered to provide Russian troop locations to Ukraine.

'Systemic difficulties' hampered review of Canada's cyberspy service: watchdog (Toronto Sun) Problems due in part to 'a larger culture of resisting and impeding the efficient progress of review activities,' records say

Alleged leaker fixated on guns and envisioned ‘race war’ (Washington Post) Videos and chat logs reveal Jack Teixeira’s preparations for a violent social conflict, his racist thinking and a deep suspicion of the government he served

ROK union leaders charged with spying for North Korea in ‘movie-like’ scheme (NK News - North Korea News) South Korean prosecutors unveiled full charges against trade union leaders accused of spying for North Korea on Thursday, describing a “movie-like” scheme that allegedly featured secretive meetings with DPRK operatives abroad and encrypted communications in YouTube comments sections. The Suwon District Prosecutors Office said four members of the Korean Confederation of Trade Unions (KCTU) were […]

South Korea alleges spies messaged North Korean handlers via YouTube comments (Record) Prosecutors say four labor union leaders were instructed to photograph military bases and perform other tasks, while leaving coded messages as comments on obscure videos.

Ex-ByteDance Executive Accuses Company of ‘Lawlessness’ (New York Times) The former executive sued ByteDance, which owns TikTok, for wrongful termination and accused the company of lifting content from rivals and “supreme access” by the Chinese Communist Party.

Latitude data breach: Office of Privacy Commissioner launches investigation, calls attack 'significant' with 'appalling result' (Newshub) More than 14 million Australian and New Zealand driver's licenses, passports and other personal details were stolen in a cyber attack.

National Privacy Commission steps up probe of GCash fiasco (INQUIRER.net) The National Privacy Commission (NPC) on Saturday ordered an in-depth investigation into a potential personal data breach at GCash, the popular digital payments platform of

Silk Road scammer charged with narcotics trafficking and money laundering (Record) The Justice Department announced new charges Thursday against one of the most notorious scammers on the now-defunct criminal marketplace Silk Road, who they say allegedly used the platform to sell a variety of drugs.

Whodunnit? Cybercrook gets 6 years for ransoming his own employer (Naked Security) Not just an active adversary, but a two-faced one, too.

Pawn America Loses Bid To Take Data Breach Claims to Arbitrator (Bloomberg Law) Pawn America Minnesota LLC, Payday America Inc., and PAL Card Minnesota LLC lost their bid to force plaintiffs in a proposed data breach class action to resolve their claims before an arbitrator.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SANSFIRE 2023 (Washington, DC, USA, Jul 10 - 15, 2023) Hands-on cyber security training taught by world-renowned practitioners. Attend in Washington, DC or Live OnlineAt SANSFIRE 2023, choose from 40 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications.

Events

SGF-Cybersecurity Week 2023 (Amsterdam, Netherlands, May 15 - 19, 2023) This week-long conference draws together power grid CISOs together with their IT and OT security teams for a week-long review of the latest prevention, detection and response solutions and strategies, in the context of increased geopolitical tensions. The week begins with a Risk Management briefing to guide the technical discussions taking place later in the week. The main conference includes a series of plenary sessions on the big organisational issues such as Regulation, Workforce development and data management, and afternoon technical tracks show-casing technical cybersecurity innovations in IT and OT domains. A solution zone running alongside the conference provides a focused display of power grid specific IT and OT cybersecurity solutions, and the extensive networking programme enables IT and OT colleagues to collaborate and seek new partnership opportunities with greater ease.

SANS Security West 2023 (San Diego, California, USA, May 15 - 20, 2023) At Security West, choose from 33 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Public Sector Ignite (Tysons, Virginia, USA, May 16, 2023) Public Sector Ignite 2023 will bring together leading cybersecurity experts and government luminaries from the U.S. Air Force, FEMA, the Department of Education, and more to explore what’s next in cybersecurity. This unique one-day experience will uncover both next-gen technology and real-world best practices. Public Sector Ignite is open to all cybersecurity professionals – from CIOs/CISOs to VPs of IT, network engineers/architects, SOC engineers, DevOps and cloud architects as well as IT directors/managers.

SecureWorld Financial Services Virtual Conference (Virtual, May 17, 2023) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 5 CPE credits learning from nationally recognized industry leaders. The agenda offers 15+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SecureWorld Houston (Houston, Texas, USA, May 18, 2023) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational elements learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.