US government disrupts China's Raptor Train botnet.

Summary

By the CyberWire staff

At a glance.

US government disrupts China's Raptor Train botnet.
Vanilla Tempest deploys INC ransomware against the healthcare sector.
Port of Seattle refuses to pay ransom to Rhysida gang.

US government disrupts China's Raptor Train botnet.

The US Justice Department has announced a court-authorized law enforcement operation that disrupted a botnet consisting of more than 200,000 consumer devices, including routers, IP cameras, DVRs, and network-attached storage devices. The Justice Department says "the botnet devices were infected by People’s Republic of China (PRC) state-sponsored hackers working for Integrity Technology Group, a company based in Beijing, and known to the private sector as 'Flax Typhoon.'" SecurityWeek notes that the botnet, dubbed "Raptor Train," has been used to target critical sectors in the US and Taiwan.

The Justice Department stated, "The court-authorized operation took control of the hackers’ computer infrastructure and, among other steps, sent disabling commands through that infrastructure to the malware on the infected devices. During the course of the operation, there was an attempt to interfere with the FBI’s remediation efforts through a distributed denial-of-service (DDoS) attack targeting the operational infrastructure that the FBI was utilizing to effectuate the court’s orders. That attack was ultimately unsuccessful in preventing the FBI’s disruption of the botnet."

Next-Gen Container Security: Why Cloud Context Matters

Attackers are able to automate their reconnaissance and other tactics due to the uniformity of cloud providers’ APIs and architectures, executing attacks in less than 10 minutes. Organizations need to rethink their approach to container security and workload protection or risk being outpaced by these attacks. Read the blog to learn why cloud context is absolutely critical to protecting your organizations’ assets and mitigating risk.

Vanilla Tempest deploys INC ransomware against the healthcare sector.

Microsoft warns that the financially motivated threat actor "Vanilla Tempest" has deployed the INC ransomware for the first time, hitting an organization in the US healthcare sector, BleepingComputer reports. The company said in a series of X posts, "Vanilla Tempest receives hand-offs from Gootloader infections by the threat actor Storm-0494, before deploying tools like the Supper backdoor, the legitimate AnyDesk remote monitoring and management (RMM) tool, and the MEGA data synchronization tool. The threat actor then performs lateral movement through Remote Desktop Protocol (RDP) and uses the Windows Management Instrumentation Provider Host to deploy the INC ransomware payload."

Do You Know What Software Is Running in Your Environment?

Thousands of companies are unaware of the software lurking in the background on their devices. ThreatLocker® is offering free I.T. security health reports to organizations looking to harden their environment and mitigate the risks of shadow I.T., foreign software, nation-state attacks, and unpatched vulnerabilities. Get your free report today and effortlessly visualize what is occurring within your organization.

Port of Seattle refuses to pay ransom to Rhysida gang.

The Port of Seattle, which also oversees Seattle's airport, has refused to pay a $6 million ransom demanded by the Rhysida ransomware gang to prevent the release of stolen data, the Register reports. The group claimed to have stolen more than three terabytes of data, including "full names, social security numbers, dates of birth, home addresses, phone numbers, heights and weights, hair and eye colors, signatures, and passport scans," as well as login credentials from the port's employees. Rhysida has since offered the data for sale for 100 Bitcoin (approximately $6 million).

The Port is still working to recover some systems following the attack, which occurred on August 24th.

Notes.

Today's issue includes events affecting China, Taiwan, and the United States.

Sponsored Events

2024 DataTribe Challenge (Virtual (for submissions), Sep 9 - 27, 2024) The DataTribe Challenge is a unique startup competition for pre-seed and seed stage cybersecurity and data science startups. It’s a platform for startups to connect with DataTribe, to tighten their pitch, to gain industry exposure, and to make connections with prospective investors and customers.

Upcoming Cybersecurity Summits (Multiple locations, Sep 17 - 27, 2024) Join us In-Person and network over breakfast, lunch & a cocktail reception on 9/17 in Atlanta, 9/19 in Wall Street, 9/26 in Columbus and 9/27 in Philadelphia. Learn about the latest threats and solutions from The IRS, U.S. DHS/CISA, Visit Philadelphia & more. Earn CPE/CEU credits with your attendance. Get 50% off admission w/ code CSS24-CYBERWIRE at CyberSecuritySummit.com (Only $125 with code)

HITRUST Collaborate 2024 (Omni Star at The Dallas Cowboys World Headquarters, Oct 1 - 3, 2024) Cybersecurity risk management leaders will cover critical topics, like challenges posed by AI, business resilience in the face of ransomware, the future cybersecurity workforce, and access to cybersecurity insurance. Thought leaders will offer actionable insights to help you fortify your security posture.

On-demand webinar - Watch now: Generative AI for Security (Virtual, On-demand, Oct 2 - Sep 30, 2024) How can generative artificial intelligence (AI) enhance your security operations? Watch this webinar from AWS and SANS to get a comprehensive roadmap for securely adopting generative AI using Amazon Bedrock. Experts will address key challenges and ethical considerations, then guide you through a hands-on Explore-Develop-Deploy framework while looking at real-world use cases and implementation. Watch now.

ISC2 Security Congress 2024 (Virtual / Las Vegas, NV, US, Oct 14 - 16, 2024) Join us at ISC2 Security Congress, October 14-16 in Las Vegas or online. Connect with global cyber experts, hear from four keynote speakers, and participate in one of eight pre-conference workshops. Discover cutting-edge insights and advance your skills in cybersecurity. Don’t miss out!

Step into the heart of excitement at the Finance & Accounting Technology Expo! (New York, NY, Oct 29 - 30, 2024) FATE is the leading expo in the finance industry, bringing together experts, innovators, and professionals like yourself to connect, explore and expand! There will be over 70 technologies, more than 60 learning sessions, incredible networking with over 1000 finance and accounting professionals -- and great keynote speakers. Our keynote speakers range from Shark Tank Judge Daymond John to CFO Glenn Hopper and even a TechStack of Sports panel, bringing you CFOs of some of the most recognized brands in sports sharing how technology powers their decisions and their growth! This premier event will leave you with the latest insights, strategies, and tools necessary to excel in the dynamic landscape of finance, accounting, and technology. And the best part is that – it's FREE! Use Code: wko735 and reduce your ticket price to $0. Register here today!

Selected Reading

Attacks, Threats, and Vulnerabilities

Cybercriminals Use Evilginx to Bypass MFA: Gmail, Outlook, and Yahoo… (Abnormal) Discover how cybercriminals are using Evilginx to bypass multi-factor authentication (MFA) in attacks targeting Gmail, Outlook, Yahoo, and more.

Fortinet Breach Highlights Cloud Storage Vulnerabilities (Metomic) The Fortinet breach serves as a cautionary tale, emphasising the need for organisations to understand what data is stored in their cloud environments and how it's being accessed.

Walmart customers scammed via fake shopping lists, threatened with arrest (Malwarebytes) Scammers are creating fake Walmart virtual shopping lists that look like a contact page for customer service.

Legislation, Policy, and Regulation

FCC Cyber Grant Pilot Opens Applications for Schools and Libraries (Infosecurity Magazine) US Schools and libraries have until November 1, 2024 to enrol for a three-year program during which participants will receive discounts on eligible cybersecurity services and equipment

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SecureWorld St. Louis (Clayton, Missouri, USA, Sep 26, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

2024 DataTribe Challenge Submission Deadline (Fulton and Virtual, Maryland, USA, Sep 27, 2024) As founders ourselves, we have never liked the feeling of being the entertainment that comes with participating in most pitch competitions. So, in creating the DataTribe Challenge, we have centered it on the North Star of creating a platform that is a valuable use of time for the founders participating. Submit your startup to potentially be selected to be part of a startup competition like no other. The DataTribe Challenge is a unique program to accelerate your cybersecurity startup. Workshop your messaging and meet potential investors and customers. We will pick five finalists to join the program, receive coaching from our team of startup veterans, present at the live event, and benefit from free promotion and press coverage. Finalists share $25,000 in prizes and all will receive the title of DataTribe Challenge Finalist.

Uniting Women in Cyber 2024 (Arlington, Virginia, USA, Oct 1, 2024) The premier networking event to advance diversity in cybersecurity! Join renowned cyber leaders and experts from all walks of life. Uniting Women in Cyber (UWIC) event convenes a powerful and diverse network of cyber leaders and experts to discuss emerging global trends, technological advancements, and workforce development. UWIC is the premier event for professionals, aspiring practitioners and all who are interested in cybersecurity, to meet and network with national leaders in the field. Come and be a part of a vibrant, diverse community to learn, share ideas, and expand your professional network!

HITRUST® Collaborate 2024 (Frisco, Texas, USA, Oct 1 - 3, 2024) HITRUST Collaborate is the most comprehensive information protection and risk management conference for privacy, security, and compliance. The 2.5-day conference includes keynotes, panel discussions, and educational sessions for industry professionals.

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Oct 2 - 3, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the program, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.19.24

At a glance.

US government disrupts China's Raptor Train botnet.

Vanilla Tempest deploys INC ransomware against the healthcare sector.

Port of Seattle refuses to pay ransom to Rhysida gang.

Notes.

Attacks, Threats, and Vulnerabilities

Legislation, Policy, and Regulation

Events