Chinese threat actors target Canadian government networks.

Summary

By the CyberWire staff

At a glance.

Chinese threat actors target Canadian government networks.
North Korean threat actor collaborates with the Play ransomware gang.
FakeCall Android malware intercepts phone calls.

Chinese threat actors target Canadian government networks.

The Canadian Centre for Cyber Security (CCCS) yesterday released its National Cyber Threat Assessment for 2025-2026, disclosing that networks belonging to at least 20 Canadian government agencies have been compromised by Chinese state-sponsored actors over the past four years. The report states, "The People’s Republic of China’s (PRC) expansive and aggressive cyber program presents the most sophisticated and active state cyber threat to Canada today. The PRC conducts cyber operations against Canadian interests to serve high-level political and commercial objectives, including espionage, intellectual property (IP) theft, malign influence, and transnational repression. Among our adversaries, the PRC cyber program’s scale, tradecraft, and ambitions in cyberspace are second to none."

The CCCS also outlines strategic threats from Russia and Iran, but notes that "[t]he PRC’s cyber program surpasses other hostile states in both the scope and resources dedicated to cyber threat activity against Canada."

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

North Korean threat actor collaborates with the Play ransomware gang.

Palo Alto Networks' Unit 42 assesses that Jumpy Pisces, a threat actor associated with North Korea's Reconnaissance General Bureau, is collaborating with the Play ransomware gang. Jumpy Pisces conducts both cyberespionage and financial crime on behalf of the North Korean government, and Unit 42 says network defenders should now be aware that Jumpy Pisces activity may also be a precursor to ransomware attacks.

While investigating a Play ransomware attack in September 2024, Unit 42 "discovered with high confidence that the North Korean state-sponsored threat group Jumpy Pisces gained initial access via a compromised user account in May 2024." The researchers add, "Jumpy Pisces carried out lateral movement and maintained persistence by spreading the open-source tool Sliver and their unique custom malware, DTrack, to other hosts via Server Message Block (SMB) protocol. These remote tools continued to communicate with their command-and-control (C2) server until early September. This ultimately led to the deployment of Play ransomware."

It's not clear if Jumpy Pisces was involved in the deployment of the ransomware or if it simply acted as an initial access broker for the Play gang. Either way, the researchers note that "[t]his development could indicate a future trend where North Korean threat groups will increasingly participate in broader ransomware campaigns."

Fortify Your Cybersecurity Against Modern-Day Outlaws with Cisco

In our free eBook, Attack Vectors Decoded: Securing Organizations Against Identity-Based Threats, we delve into the attacker’s playbook and arm you with the knowledge and tools to bolster your secure access. Learn how to build powerful, secure identity access that protects your business, your data, and your workers—no matter where they are. Download the eBook now and take the first step in modernizing and galvanizing your secure access against identity-based threats.

FakeCall Android malware intercepts phone calls.

Researchers at Zimperium are tracking new variants of the FakeCall Android malware. The malware is delivered via social engineering attacks, and is designed to hijack phone calls to the victim's bank. Zimperium explains, "When the compromised individual attempts to contact their financial institution, the malware redirects the call to a fraudulent number controlled by the attacker. The malicious app will deceive the user, displaying a convincing fake UI that appears to be the legitimate Android’s call interface showing the real bank’s phone number. The victim will be unaware of the manipulation, as the malware’s fake UI will mimic the actual banking experience, allowing the attacker to extract sensitive information or gain unauthorized access to the victim’s financial accounts."

Save 30% on N2K Cyber & IT practice tests

In celebration of Cybersecurity Awareness Month, N2K is offering a 30% discount on all N2K practice tests with promo code "SECURE30". Choose from our vast exam prep library that includes top vendors like AWS, CompTIA, ISC2, Microsoft, and more. Get access to simulated exams, custom quizzes, e-flashcards, and more. Whether you're gearing up for a certification exam or looking to enhance your skills, now is the perfect time to invest in your cybersecurity journey. Visit n2k.com/certify to find your cert and save 30% with promo code “SECURE30” today.

Notes.

Today's issue includes events affecting Canada, China, Iran, the Democratic People's Republic of Korea, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

Government Organizations Face Surge in Malware and DDoS Attacks, Raising Alarms Over Potential Election Disruption (SonicWall) Newest report highlights some escalating risks to critical infrastructure as election day approaches

GreyNoise Intelligence Discovers Zero-Day Vulnerabilities in Live Streaming Cameras with the Help of AI (GreyNoise Blog) GreyNoise has discovered previously undisclosed zero-day vulnerabilities in IoT-connected live streaming cameras, leveraging AI to catch an attack before it could escalate. This marks one of the first instances where threat detection has been augmented by AI to discover zero-day vulnerabilities.

Inside a Firewall Vendor's 5-Year War With the Chinese Hackers Hijacking Its Devices (WIRED) Sophos went so far as to plant surveillance “implants” on its own devices to catch the hackers at work—and in doing so, revealed a glimpse into China's R&D pipeline of intrusion techniques.

Every Doggo Has Its Day: Unleashing the Xiū Gǒu Phishing Kit | Netcraft (Netcraft) Key data This article explores Netcraft’s research into Xiū gǒu (修狗), a phishing kit in use since at least September 2024 to deploy phishing campaigns ...

Don't Let Scammers Steal Your Holiday Cheer: New Norton Report Reveals Nearly Half of U.S. Consumers Were Targeted by a Scam While Online Shopping (Gen Digital Newsroom) Norton's Cyber Safety Sunday Helps Shoppers Stay Safe Ahead of the Peak Holiday Shopping Season TEMPE, Ariz. and PRAGUE, Oct. 29, 2024 /PRNewswire/ -- Holiday shopping is in full swing, with over...

MacOS Malware Surges as Corporate Usage Grows (Trellix) With more corporate users, the platform has become increasingly attractive to criminals, ranging from eCrime all the way to Advanced Persistent Threat (APT) actors.

Forescout Vedere Labs Unveils Riskiest Connected Medical Devices (Forescout) Report Identifies 162 Vulnerabilities, Potentially Exposing Patient Data, Disrupting Healthcare Operations, and Posing Risks to Patient Safety

Trends

Latest ISC2 Study Finds that AI Viewed as Catalyst for Career Growth, Stronger Security Despite Slowing Growth in Cybersecurity Workforce (PR Newswire) /PRNewswire/ -- ISC2 – the world's leading nonprofit member organization for cybersecurity professionals – today released the 2024 ISC2 Cybersecurity Workforce...

Veracode Research Highlights Financial Sector’s Escalating Security Debt (BusinessWire) State of Software Security Report Finds Half of Financial Organizations Have High-Severity Security Flaws in Their Apps

2024 Trustwave Risk Radar Report: Cyber Threats to the Retail Sector (Trustwave) The 2024 Trustwave Risk Radar Report: Retail Sector reveals that cybercriminals have sharpened their tactics, utilizing ransomware and phishing attacks.

Traceable Releases 2025 State of API Security Report: API Breaches Persist as Fraud, Bot Attacks, and Generative AI Increase Risks (Traceable) 57% of Organizations Suffer API-related Breaches; Fraud, Bot Attacks, and Generative AI Applications Exploit API Vulnerabilities as Traditional Defenses Fail

Products, Services, and Solutions

Oasis Security Launches Industry-First Non-Human Identity Ownership Discovery Engine (PR Newswire) /PRNewswire/ -- Oasis Security, the leading provider of Non-Human Identity Management (NHIM) solutions, announced today an industry-first NHI Ownership...

Keyfactor Recognized as the Leader in PKI-as-a-Service by Frost & Sullivan (BusinessWire) Digital Trust Leader Secures Top Spot in the 2024 Frost Radar™ Out of 20 PKIaaS Vendors Considered

Seemplicity Announces Next Evolution of RemOps Platform with AI-Powered Capabilities (PR Newswire) /PRNewswire/ -- Seemplicity, the industry's leading Remediation Operations (RemOps) platform provider, today announced the next generation of its flagship...

LogicGate Further Empowers Customers with New Record Linking Recommendations and AI Text Assistant Features through Risk Cloud Spark AI (PR Newswire) /PRNewswire/ -- LogicGate, the holistic GRC experts delivering leading solutions for cyber, governance, risk, and compliance leaders, is excited to empower...

Trulioo Instant Results Capability Accelerates Identity Matching by 56% (BusinessWire) Verification Platform Reinforces Industry Leadership With 33% Year-Over-Year Increase in Enterprise Transaction Volume

TRM Labs and Flashpoint Join Forces to Enhance Visibility into Cyberattacks Involving Cryptocurrencies (GlobeNewswire News Room) TRM Labs and Flashpoint have announced a strategic partnership to strengthen cybersecurity efforts by integrating Flashpoint’s threat intelligence into...

watchTowr Partners with Orange to Redefine External Attack Surface Management for Strategic Enterprise Customers (BusinessWire) New Partnership Focuses on APAC Region with Plans for Global Expansion

Technologies, Techniques, and Standards

Inside the counter-offensive tactics, techniques, and procedures used to neutralize China-based threats (Sophos) In the story, we disclose how the attackers used a series of campaigns with novel exploits and customized malware to conduct surveillance, sabotage, and cyberespionage.

Intel Co-Develops One of Three New Post-Quantum Crypto Standards Released by NIST (Intel) Manoj Sastry is a senior principal research scientist at Intel Labs. Highlights The U.S. National Institute of Standards and Technology (NIST) released three post-quantum cryptography standards designed to provide data security and withstand future adversarial attacks from quantum computers. Inte...

Securing the Core: Why Operating System Hardening is Vital for Cybersecurity (VERITI) Veriti’s latest research reveals how attackers exploit OS vulnerabilities. Discover OS hardening techniques to protect against advanced tactics from threats like Magic Hound and Quasar RAT.

Legislation, Policy, and Regulation

Agencies face ‘inflection point’ ahead of looming zero-trust deadline, CISA official says (CyberScoop) Shelly Hartsook said she’s seen promising data on implementation of security protocols ahead of next week’s due date for agencies to submit updated plans.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Pacific Hackers Conference (Mountain View, California, USA, Nov 2, 2024) Pacific Hacker Conference is an information security and hacking conference that gathers the brightest minds in cybersecurity and hacking from Silicon Valley and beyond. Focusing on cutting-edge techniques, research, and developments, we aim to create an environment where knowledge is shared and connections are made. Our audience ranges from security professionals, researchers, and ethical hackers to industry decision-makers. We keep the conference small, allowing us to provide what other Cons leave out.

SecureWorld Seattle (Bellevue, Washington, USA, Nov 6 - 7, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 12-18 CPE credits through 30+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Beyond Earth Symposium (Washington, DC, USA, Nov 12 - 13, 2024) The acceleration of space innovations that will enable space migration is outpacing public policy and international law regimes. Beyond Earth Institute’s mission is to create a policy and legal framework to support the robust development of an in-space economy and the expansion of human civilization beyond Earth. At the Beyond Earth Symposium 2024, we will wrestle with the critical current issues of the day and delve into the bleeding edge issues that must be moved to the center of international debate. What we do in a post-ISS era is an urgent, immediate concern. Policies that can foster the creation of a lunar-based economy are equally important. Let’s be bold together! Join stakeholders from across the industry, government, and international sector for this third annual Beyond Earth Symposium. Momentum is building to transform policy and legal landscape to enable a space migration future. Dare to be part of this work.

SecureWorld Midwest Virtual Conference (Virtual, Nov 13, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

CYBERSAT24 (Reston, Virginia, USA, Nov 18 - 20, 2024) CyberSat Summit has been at the forefront of the satellite industry’s burgeoning cybersecurity landscape since the event’s launch in 2017. Initially run as a single annual event, it morphed into two separate events in recent years – CyberLEO and CyberSatGov. This was done in response to changing market conditions, most notably the huge growth of LEO satellites and the corresponding rise of commercial interest in space. While CyberSatGov and CyberLEO were successful independently, the continued demand for LEO architectures and the ever-increasing collaboration between government and industry meant that these conversations needed to happen under one roof. As a result, 2024 will feature a single CyberSat event in November, where for the first time in its 7-year history, we will nearly double the event’s content offerings to include two concurrent tracks – one track titled “Space Infrastructure” and the second track titled “Space Data & Technology.” The “Space Infrastructure” track will continue CyberSat’s legacy focus on the overall satellite cybersecurity ecosystem and the protection of tangible assets like ground systems and satellite components, while the new “Space Data & Technology” track will focus on emerging technologies and the protection of space’s intangible assets like data. Keynotes, and a handful of general sessions, will contain talks that apply to all attendees.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.31.24

At a glance.

Chinese threat actors target Canadian government networks.

North Korean threat actor collaborates with the Play ransomware gang.

FakeCall Android malware intercepts phone calls.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Products, Services, and Solutions

Technologies, Techniques, and Standards

Legislation, Policy, and Regulation

Events