CISA director targeted by swatting attack. loanDepot breach affects 16 million individuals.

Summary

By the CyberWire staff

At a glance.

CISA director targeted by swatting attack.
loanDepot breach affects 16 million individuals.
SEC's X account hack caused by SIM swapping.
Australian government sanctions alleged REvil hacker.
Apple patches zero-day vulnerability.

CISA director targeted by swatting attack.

The Record reports that CISA director Jen Easterly's home was swatted late last month. The Arlington County Police Department said in an incident summary, "Responding officers made contact with the occupant of the residence, determined no shooting had occurred and that there were no injuries associated with the call for service." Easterly said in a statement to the Record, "One of the most troubling trends we have seen in recent years has been the harassment of public officials across the political spectrum, including extreme incidents involving swatting and direct personal threats. These incidents pose a serious risk to the individuals, their families, and in the case of swatting, to the law enforcement officers responding to the situation. While my own experience was certainly harrowing, it was unfortunately not unique. In particular, several of our nation’s election officials have also been targeted with this type of harassment and other threats of violence."

Optimize the value of your biggest investment – your cyber talent.

Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.

loanDepot breach affects 16 million individuals.

US mortage lender loanDepot has disclosed that the personal information of approximately 16.6 million individuals was accessed by attackers during a ransomware attack earlier this month, BleepingComputer reports. The company says it "will notify these individuals and offer credit monitoring and identity protection services at no cost to them."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

SEC's X account hack caused by SIM swapping.

The US Securities and Exchange Commission (SEC) says the hack of its X account on January 9th was due to a SIM swapping attack, the Record reports. The SEC said in a statement, "Access to the phone number occurred via the telecom carrier, not via SEC systems. SEC staff have not identified any evidence that the unauthorized party gained access to SEC systems, data, devices, or other social media accounts."

Australian government sanctions alleged REvil hacker.

The Australian government has sanctioned Russian national Aleksandr Ermakov for his alleged involvement in the 2022 Medibank hack, the ABC reports. According to BleepingComputer, Ermakov is believed to be a member of the REvil ransomware gang. The Guardian notes that this is the first time Australia has used its cyber sanctions powers granted by the country's Magnitsky-style laws passed in 2021.

Apple patches zero-day vulnerability.

Apple has issued a patch for a WebKit type-confusion vulnerability affecting iOS, macOS, tvOS, and Safari, BleepingComputer reports. The flaw could lead to remote code execution. Apple says it's "aware of a report that this issue may have been exploited."

Notes.

Today's issue includes events affecting Australia, Pakistan, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Massachusetts hospital claimed to be targeted by Money Message ransomware (SC Media) Massachusetts-based Anna Jaques Hospital was admitted to be compromised by the Money Message ransomware gang in a Christmas Day attack, which it claims resulted in the exfiltration of 600GB of data, as well as information from Beth Israel Lahey Health, which manages AJH, reports The Record, a news site by cybersecurity firm Recorded Future.

Hackers start exploiting critical Atlassian Confluence RCE flaw (BleepingComputer) Security researchers are observing exploitation attempts for the CVE-2023-22527 remote code execution flaw vulnerability that affects outdated versions of Atlassian Confluence servers.

Magecart Adds Middle East Retailers to Long List of Victims (Dark Reading) Cybercriminals who conspire to put credit-card skimmers on e-commerce sites have hit some large vendors in the region.

AI robocalls impersonate President Biden in an apparent attempt to suppress votes in New Hampshire (PBS NewsHour) The apparent attempt at voter suppression using generative AI is one example of what experts warn will make 2024 a year of unprecedented election disinformation around the world.

CISA’s Easterly the target of ‘harrowing’ swatting incident (The Record) CISA Director Jen Easterly was home alone in late December when a 911 caller falsely claimed a shooting had occurred at the residence. “While my own experience was certainly harrowing, it was unfortunately not unique," Easterly said.

UK water company that serves millions confirms system attack (The Register) Comes mere months after Western intelligence agencies warned of attacks on water providers

Pakistan's internet disrupted during virtual election rally (The Record) Popular social media platforms, including Facebook, Instagram, X and YouTube, were inaccessible for parts of the weekend in Pakistan, which is preparing for a general election next month.

A backdoor with a cryptowallet stealer inside cracked macOS software (Securelist) We review a new macOS backdoor that piggybacks on cracked software to replace Bitcoin and Exodus wallets with malware.

Security Patches, Mitigations, and Software Updates

Apple fixes first zero-day bug exploited in attacks this year (BleepingComputer) Apple released security updates to address this year's first zero-day vulnerability exploited in attacks that could impact iPhones, Macs, and Apple TVs.

Marketplace

Lisa Jiggetts Joins NucoreVision Inc. as Director of Enterprise IT and Cybersecurity Solutions (HS Today) NucoreVision Inc., a prominent player in the cybersecurity and IT solutions arena is proud to announce the appointment of Lisa Jiggetts as their new Director of Enterprise IT and Cybersecurity Solutions.

Litigation, Investigation, and Law Enforcement

Medibank hack: Russian sanctioned over Australia's worst data breach (BBC) Aleksandr Ermakov has been targeted for his role in a "devastating" cyber-attack which rattled the nation.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SANS Cyber Security Mountain: January 2024 (Virtual, Jan 22 - 27, 2024) At SANS Cyber Security Mountain: January 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Insider Threat Program Development, Management & Optimization Training Course (Laurel, Maryland, USA, Jan 30 - 31, 2024) This highly sought after and very comprehensive 2 day training course will ensure that the Insider Threat Program (ITP) Manager and others who support the ITP (Insider Threat Analyst, FSO, CSO, CISO, Human Resources, CIO - IT, Network Security, Counterintelligence Investigators, Behavioral Science Professionals, Legal Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group.

Improve Spear Phishing Detection With AI (Virtual, Jan 30 - 31, 2024) Phishing remains one of the costliest attack vectors. Spear phishing, a more targeted form of phishing, is very convincing and poses a great risk to organizations. As threat actors crank up the volume of spear phishing attacks, companies are increasingly embracing AI for cybersecurity. Join this webinar to learn how NVIDIA’s AI technologies, along with ecosystem partners, can help organizations build powerful solutions to defend against cyber threats.

SANS Tysons Corner – NOVA 2024 (Tysons Corner, Virginia, USA, Feb 5 - 10, 2024) At SANS Tysons Corner-NOVA 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS San Diego 2024 (San Diego (and virtual), California, USA, Feb 12 - 17, 2024) At SANS San Diego 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.23.24