South Korea investigates reported military intelligence leak.

Summary

By the CyberWire staff

At a glance.

South Korea investigates reported military intelligence leak.
Google fixes flaw that allowed threat actors to bypass Workspace account verification process.
Cyberattacks in the shipping industry.
New PowerShell backdoor tied to novel Zloader variant.

South Korea investigates reported military intelligence leak.

South Korea is investigating a leak that reportedly exposed the identities of its military intelligence agents, the New York Times reports. South Korean media reported that the leak, which includes the identities of agents operating under civilian cover, may have reached North Korea.

NK News cites sources as saying the leak is believed to have occurred "through a personal laptop belonging to a military-civilian public servant in the DIC’s overseas operations department." The owner of the laptop claims the device was hacked, in which case they would still be guilty of storing classified information on a personal device.

Seoul's defense ministry said in a statement, "[T]he matter is currently under investigation by military authorities, so we cannot provide detailed explanations. Based on the investigation results, the military will handle the matter strictly according to the law and regulations."

If you're on the front line, we've got your back.

Mark your calendar for mWISE™, the unique cybersecurity conference from Mandiant, now part of Google Cloud. Built by practitioners for practitioners, it runs from September 18–19, 2024 in Denver, Colorado.

What makes mWISE different from other cybersecurity conferences? It’s a targeted event with hands-on learning for frontline practitioners. The intimate setting allows you to make one-on-one connections with leaders in the field. And best of all, it’s focused on learning without the sales pitches.

Google fixes flaw that allowed threat actors to bypass Workspace account verification process.

Google has fixed a flaw that allowed criminals to bypass the email verification required to create a Google Workspace account, KrebsOnSecurity reports. Google sent a notice stating, "In the last few weeks, we identified a small-scale abuse campaign whereby bad actors circumvented the email verification step in our account creation flow for Email Verified (EV) Google Workspace accounts using a specially constructed request. These EV users could then be used to gain access to third-party applications using ‘Sign In with Google."

Anu Yamunan, director of abuse and safety protections at Google Workspace, told KrebsOnSecurity that the malicious activity began in June, and Google fixed the flaw within 72 hours of discovering it. Yamunan stated, "The vector here is they would use one email address to try to sign in, and a completely different email address to verify a token. Once they were email verified, in some cases we have seen them access third party services using Google single sign-on."

87% of executives use personal devices with zero security.

What’s the easiest way for cybercriminals to get around your company’s defenses? By attacking executives at home. Once executives leave your network, they become easy targets for hijacking, credential theft, and reputational harm. Close the at-home security gap with BlackCloak Concierge Cybersecurity & Privacy™. Award-winning day-and-night protection for executives and their families. Learn more

Cyberattacks in the shipping industry.

Researchers at the Netherlands' NHL Stenden University of Applied Sciences warn that the shipping industry is facing a significant increase in cyberattacks, the Financial Times reports. The sector saw sixty-four attacks in 2023, compared to just three a decade earlier in 2013. More than 80 percent of cyberattacks since 2001 were tied to a known threat actor tied to Russia, China, North Korea, or Iran.

New PowerShell backdoor tied to novel Zloader variant.

Walmart’s Cyber Intelligence Team has discovered a new PowerShell backdoor that's being used to deploy additional malware, including a new variant of the Zloader/SilentNight Trojan, Infosecurity Magazine reports. A Walmart spokesperson told Infosecurity, "The threat actor involved has links to Zloader/SilentNight, which CISA has linked to Black Basta publicly, so the aim would be breach and ransom activities." The researchers note that there's no indication the malware has been used to target Walmart.

D.C.’s Premier Gathering of Cybersecurity Visionary Leaders

N2K CyberWire is proud to partner with DMV Rising 2024 to celebrate the remarkable accomplishments of the DMV's cybersecurity community, and provide a unique opportunity to foster new connections and innovative ideas. Join us on September 12, 2024 to experience firsthand why the DMV region is the beating heart of cyber innovation. Register now to secure your spot.

Notes.

Today's issue includes events affecting the Democratic People's Republic of Korea, the Republic of Korea, the Netherlands, and the United States.

Attacks, Threats, and Vulnerabilities

Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services (KrebsOnSecurity) Google says it recently fixed an authentication weakness that allowed crooks to circumvent email verification needed to create a Google Workspace account, and leverage that to impersonate a domain holder to third-party services that allow logins through Google's "Sign in with…

Cyberattacks Present Shipping Industry's Biggest Threat Since WWII (PYMNTS.com) The shipping sector is reportedly facing a spike in cyberattacks tied to state-sponsored hackers, with at least 64 cyber incidents last year.

SeleniumGreed Cryptomining Campaign Exploiting Grid Services (Wiz) SeleniumGreed is an active crypto-mining campaign targeting older versions of Grid services. Explore the risks, attack methods, and essential security measures.

Marketplace

The CrowdStrike Outage and Market-Driven Brittleness (Lawfare) The outage is another consequence of companies’ sacrifice of resilience for expediency.

Legislation, Policy, and Regulation

UK ‘desperately exposed’ to cyber-threats and pandemics, says minister (the Guardian) Science secretary Peter Kyle says national resilience suffered ‘catastrophically’ under Tories

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Jul 29 - 30, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the ITP, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

Unpacking the 2024 Ransomware Landscape: Insights and Strategies from ThreatLabz (Virtual, Aug 22, 2024) This live discussion on the latest findings from the Zscaler ThreatLabz 2024 Ransomware Report highlights the most targeted industries and regions, the dynamics behind a ransom payout, emerging ransomware families, and predictions for 2025. Register now.

SecureWorld Manufacturing & Retail Virtual Conference (Virtual, Aug 28, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

SANS Network Security Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Sep 4 - 9, 2024) At SANS Network Security 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Jailbreak Brewing Company Security Summit (Laurel, Maryland, USA, Sep 6, 2024) Join some of the world's best security researchers as they talk about disinformation; the misleading and deliberate deception in today's connected world, both from the technical and policy sides at the only computer security event held at a production brewery. Attendance is limited to 150 to keep the Security Summit small and encourage conversation between speakers, attendees, and sponsors. Tickets include breakfast, lunch, and an awesome time to chat with fellow security experts. Come participate in the talks, the conversation, and the beer!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 07.29.24

At a glance.

South Korea investigates reported military intelligence leak.

Google fixes flaw that allowed threat actors to bypass Workspace account verification process.

Cyberattacks in the shipping industry.

New PowerShell backdoor tied to novel Zloader variant.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Legislation, Policy, and Regulation

Events