US Justice Department charges Chinese national over alleged spearphishing operation.

Announcement

[Live podcast] Cloud Security in the Age of Generative AI.

Join N2K CyberWire’s Dave Bittner and Sysdig’s Loris Degioanni tomorrow, September 18th at 2pm EDT for a live discussion around how generative AI (GenAI) and Large Language Models (LLMs) are changing the cloud security landscape. We’ll explore how to secure your AI deployments to safeguard sensitive information and delve into the state-of-the-art for employing AI to boost the effectiveness of your cloud security teams in the face of evolving threats. Learn more and register now.

[Live podcast] CSO Perspectives Live w/ Rick Howard.

This quarter’s CSO Perspectives Live discussion, normally a N2K Pro exclusive, is open to the public! Join Rick Howard, host of our CSO Perspectives podcast, and our Hash Table panelists Alan Berry of Centene and Bob Turner of Cyber Hero vCISO Network on Thursday, September 26th at 2:00 PM EST. Register now and join us to analyze emerging industry trends, recent threats and events, and the evolving role of executives in our field.

Summary

By the CyberWire staff

At a glance.

US Justice Department charges Chinese national over alleged spearphishing operation.
D-Link patches critical vulnerabilities affecting wireless routers.
Snowflake will enforce MFA by default.

US Justice Department charges Chinese national over alleged spearphishing operation.

The US Justice Department has charged a Chinese national, Song Wu, for allegedly sending spearphishing emails to employees at the US Air Force, Navy, Army, NASA, and the Federal Aviation Administration, as well as major research universities in Georgia, Michigan, Massachusetts, Pennsylvania, Indiana, and Ohio. The Justice Department says Song was an employee of the Aviation Industry Corporation of China (AVIC), a Beijing-headquartered aerospace and defense conglomerate owned by the Chinese government.

The Justice Department states, "Song allegedly engaged in a multi-year 'spear phishing' email campaign in which he created email accounts to impersonate U.S.-based researchers and engineers and then used those imposter accounts to obtain specialized restricted or proprietary software used for aerospace engineering and computational fluid dynamics. This specialized software could be used for industrial and military applications, such as development of advanced tactical missiles and aerodynamic design and assessment of weapons."

Next-Gen Container Security: Why Cloud Context Matters

Attackers are able to automate their reconnaissance and other tactics due to the uniformity of cloud providers’ APIs and architectures, executing attacks in less than 10 minutes. Organizations need to rethink their approach to container security and workload protection or risk being outpaced by these attacks. Read the blog to learn why cloud context is absolutely critical to protecting your organizations’ assets and mitigating risk.

D-Link patches critical vulnerabilities affecting wireless routers.

D-Link has fixed several critical vulnerabilities affecting three of its wireless router models, BleepingComputer reports. Three of the flaws (CVE-2024-45694, CVE-2024-45695, and CVE-2024-45697) were assigned CVSS scores of 9.8. CVE-2024-45694 and CVE-2024-45695 are both stack-based buffer overflow vulnerabilities that can allow unauthenticated attackers to achieve remote code execution. CVE-2024-45696 and CVE-2024-45697 can allow an attacker to enable telnet and log in using hardcoded credentials.

Do You Know What Software Is Running in Your Environment?

Thousands of companies are unaware of the software lurking in the background on their devices. ThreatLocker® is offering free I.T. security health reports to organizations looking to harden their environment and mitigate the risks of shadow I.T., foreign software, nation-state attacks, and unpatched vulnerabilities. Get your free report today and effortlessly visualize what is occurring within your organization.

Snowflake will enforce MFA by default.

Cloud data storage provider Snowflake has announced new security measures following a string of high-profile breaches affecting the company's customers, GovInfoSecurity reports. Beginning in October, Snowflake will enforce multifactor authentication by default and require passwords with a minimum of 14 characters.

Dozens of Snowflake customers, including Ticketmaster and Santander Bank, were breached by criminal threat actors earlier this year via credential-stuffing attacks. Mandiant, which investigated the campaign, found that none of the breached accounts had multifactor authentication enabled.

Notes.

Today's issue includes events affecting , and China the United States.

Sponsored Events

2024 DataTribe Challenge (Virtual (for submissions), Sep 9 - 27, 2024) The DataTribe Challenge is a unique startup competition for pre-seed and seed stage cybersecurity and data science startups. It’s a platform for startups to connect with DataTribe, to tighten their pitch, to gain industry exposure, and to make connections with prospective investors and customers.

Upcoming Cybersecurity Summits (Multiple locations, Sep 17 - 27, 2024) Join us In-Person and network over breakfast, lunch & a cocktail reception on 9/17 in Atlanta, 9/19 in Wall Street, 9/26 in Columbus and 9/27 in Philadelphia. Learn about the latest threats and solutions from The IRS, U.S. DHS/CISA, Visit Philadelphia & more. Earn CPE/CEU credits with your attendance. Get 50% off admission w/ code CSS24-CYBERWIRE at CyberSecuritySummit.com (Only $125 with code)

HITRUST Collaborate 2024 (Omni Star at The Dallas Cowboys World Headquarters, Oct 1 - 3, 2024) Cybersecurity risk management leaders will cover critical topics, like challenges posed by AI, business resilience in the face of ransomware, the future cybersecurity workforce, and access to cybersecurity insurance. Thought leaders will offer actionable insights to help you fortify your security posture.

On-demand webinar - Watch now: Generative AI for Security (Virtual, On-demand, Oct 2 - Sep 30, 2024) How can generative artificial intelligence (AI) enhance your security operations? Watch this webinar from AWS and SANS to get a comprehensive roadmap for securely adopting generative AI using Amazon Bedrock. Experts will address key challenges and ethical considerations, then guide you through a hands-on Explore-Develop-Deploy framework while looking at real-world use cases and implementation. Watch now.

ISC2 Security Congress 2024 (Virtual / Las Vegas, NV, US, Oct 14 - 16, 2024) Join us at ISC2 Security Congress, October 14-16 in Las Vegas or online. Connect with global cyber experts, hear from four keynote speakers, and participate in one of eight pre-conference workshops. Discover cutting-edge insights and advance your skills in cybersecurity. Don’t miss out!

Step into the heart of excitement at the Finance & Accounting Technology Expo! (New York, NY, Oct 29 - 30, 2024) FATE is the leading expo in the finance industry, bringing together experts, innovators, and professionals like yourself to connect, explore and expand! There will be over 70 technologies, more than 60 learning sessions, incredible networking with over 1000 finance and accounting professionals -- and great keynote speakers. Our keynote speakers range from Shark Tank Judge Daymond John to CFO Glenn Hopper and even a TechStack of Sports panel, bringing you CFOs of some of the most recognized brands in sports sharing how technology powers their decisions and their growth! This premier event will leave you with the latest insights, strategies, and tools necessary to excel in the dynamic landscape of finance, accounting, and technology. And the best part is that – it's FREE! Use Code: wko735 and reduce your ticket price to $0. Register here today!

Selected Reading

Attacks, Threats, and Vulnerabilities

Marko Polo cybercrime gang targets cryptocurrency users, influencers with scams (The Record) A group known as Marko Polo has compromised thousands of devices worldwide as it goes after "high-value targets" with online scams, according to Insikt Group researchers.

DataDome: 95% of Advanced Bots Go Undetected on Websites (DataDome) New research finds e-commerce and luxury industries at highest risk for online fraud

Trends

New Study from Osterman Research and OPSWAT Finds 80% of Organizations Experienced an Email-Related Security Breach in the Last Year - OPSWAT (OPSWAT) Study finds low confidence in the ability to prevent email-related threats and an urgent need for improved email security practices in critical infrastructure sectors

Arctic Wolf Security Operations Report Reveals Threat Landscape Intensifies, Almost Half of Security Incidents Occur After Hours (GlobeNewswire News Room) Technology companies drastically trail other industries in overall security posture...

Marketplace

BlackCloak Raises $17M Series B Funding Round to Enhance Personal Cybersecurity Protections for Corporate Executives, High Net Worth Individuals, and Family Offices (PR Newswire) BlackCloak has raised $17M in a Series B funding round led by Baird Capital, with contributions from Blue Heron Capital, TDF Ventures, and TechOperators. This...

Quorum Cyber Accelerates Growth with Acquisition of Difenda (Quorum Cyber) Quorum Cyber has acquired Difenda, a Canada-based Microsoft Solutions Partner for Security, fuelling the next phase of growth.

CFO and Sales VP Appointments (Axiad) Axiad moves headquarters to San Jose to increase accessibility and collaboration representing the strong #OneAxiad culture.

Products, Services, and Solutions

Rapid7 Introduces Vector Command (Rapid7) New offensive security offering powered by Rapid7’s Command Platform and expert Red Team enables organizations to continuously discover, assess, and validate vulnerabilities through the lens of an adversary.

Sumo Logic launches first customer awards program to celebrate organizations leveraging log analytics to modernize DevSecOps (Sumo Logic) Sumo Logic today announced the launch of The Sumie Awards, its first public customer awards program. The Sumie Awards will showcase Sumo Logic customers and partners, spotlighting their achievements in leveraging Sumo Logic’s solutions to promote application reliability and security, drive operational efficiency and deliver value at cloud scale.

IGEL App Creator Portal makes it fast and easy to package Linux apps for IGEL OS (IGEL) MUNICH – IGEL Disrupt – Sept. 16, 2024 – IGEL, which provides the secure endpoint OS for now and next, today announced the IGEL App Creator Portal, opening the door for organizations to deploy Linux applications to IGEL OS through…

Litigation, Investigation, and Law Enforcement

US Ramps Up Sanctions on Spyware-Maker Intellexa (Infosecurity Magazine) The US Treasury has issued more sanctions against directors of notorious spyware developer Intellexa

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SecureWorld Detroit (Novi, Michigan, USA, Sep 18, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld St. Louis (Clayton, Missouri, USA, Sep 26, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

2024 DataTribe Challenge Submission Deadline (Fulton and Virtual, Maryland, USA, Sep 27, 2024) As founders ourselves, we have never liked the feeling of being the entertainment that comes with participating in most pitch competitions. So, in creating the DataTribe Challenge, we have centered it on the North Star of creating a platform that is a valuable use of time for the founders participating. Submit your startup to potentially be selected to be part of a startup competition like no other. The DataTribe Challenge is a unique program to accelerate your cybersecurity startup. Workshop your messaging and meet potential investors and customers. We will pick five finalists to join the program, receive coaching from our team of startup veterans, present at the live event, and benefit from free promotion and press coverage. Finalists share $25,000 in prizes and all will receive the title of DataTribe Challenge Finalist.

Uniting Women in Cyber 2024 (Arlington, Virginia, USA, Oct 1, 2024) The premier networking event to advance diversity in cybersecurity! Join renowned cyber leaders and experts from all walks of life. Uniting Women in Cyber (UWIC) event convenes a powerful and diverse network of cyber leaders and experts to discuss emerging global trends, technological advancements, and workforce development. UWIC is the premier event for professionals, aspiring practitioners and all who are interested in cybersecurity, to meet and network with national leaders in the field. Come and be a part of a vibrant, diverse community to learn, share ideas, and expand your professional network!

HITRUST® Collaborate 2024 (Frisco, Texas, USA, Oct 1 - 3, 2024) HITRUST Collaborate is the most comprehensive information protection and risk management conference for privacy, security, and compliance. The 2.5-day conference includes keynotes, panel discussions, and educational sessions for industry professionals.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.17.24

[Live podcast] Cloud Security in the Age of Generative AI.

[Live podcast] CSO Perspectives Live w/ Rick Howard.

At a glance.

US Justice Department charges Chinese national over alleged spearphishing operation.

D-Link patches critical vulnerabilities affecting wireless routers.

Snowflake will enforce MFA by default.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Products, Services, and Solutions

Litigation, Investigation, and Law Enforcement

Events