Iranian threat actor targeted the 2024 Olympics.

Summary

By the CyberWire staff

At a glance.

Iranian threat actor targeted the 2024 Olympics.
Chinese threat actor uses credentials stolen by the Quad7 botnet.
Scammers compromise over a thousand online stores.

Iranian threat actor targeted the 2024 Olympics.

The US FBI and Israel's National Cyber Directorate have issued a joint advisory on activity by the Iranian threat actor "Emennet Pasargad" (also tracked as "Cotton Sandstorm," "Marnanbridge," and "Haywire Kitten"). The FBI states, "The group exhibited new tradecraft in its efforts to conduct cyberenabled information operations into mid-2024 using a myriad of cover personas, including multiple cyber operations that occurred during and targeting the 2024 Summer Olympics – including the compromise of a French commercial dynamic display provider. ASA has also undertaken a project to harvest content from IP cameras and used online resources related to Artificial Intelligence."

The threat actor has also "exhibited new tradecraft including the use of fictitious hosting resellers to provision operational server infrastructure to its own actors as well as to an actor in Lebanon involved in website hosting."

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

Chinese threat actor uses credentials stolen by the Quad7 botnet.

Microsoft warns that the Chinese threat actor tracked as "Storm-0940" is using stolen credentials obtained by the Quad7 botnet (tracked by Microsoft as "CovertNetwork-1658") to gain initial access to networks. The botnet is made up of compromised small office and home office (SOHO) routers, most of which were manufactured by TP-Link. Microsoft notes, "Any threat actor using the CovertNetwork-1658 infrastructure could conduct password spraying campaigns at a larger scale and greatly increase the likelihood of successful credential compromise and initial access to multiple organizations in a short amount of time. This scale, combined with quick operational turnover of compromised credentials between CovertNetwork-1658 and Chinese threat actors, allows for the potential of account compromises across multiple sectors and geographic regions."

Fortify Your Cybersecurity Against Modern-Day Outlaws with Cisco

In our free eBook, Attack Vectors Decoded: Securing Organizations Against Identity-Based Threats, we delve into the attacker’s playbook and arm you with the knowledge and tools to bolster your secure access. Learn how to build powerful, secure identity access that protects your business, your data, and your workers—no matter where they are. Download the eBook now and take the first step in modernizing and galvanizing your secure access against identity-based threats.

Scammers compromise over a thousand online stores.

HUMAN’s Satori threat research team has published a report on a major fraud operation that compromised over a thousand legitimate shopping sites to post fake product listings. When a user clicked on one of these products, they were sent to a separate phishing site controlled by the threat actor.

The researchers explain, "The threat actors, whose internal tools used Simplified Chinese, drove traffic to these fake web shops by infecting legitimate websites with a malicious payload. This payload creates fake product listings and adds metadata that puts these fake listings near the top of search engine rankings for the items, making them an appealing offer for an unsuspecting consumer. When a consumer clicks on the item link, they’re redirected to another website, this one controlled by the threat actor. On this website, one of four targeted third-party payment processors collects credit card info and confirms a 'purchase,' but the product never arrives."

Save 30% on N2K Cyber & IT practice tests

In celebration of Cybersecurity Awareness Month, N2K is offering a 30% discount on all N2K practice tests with promo code "SECURE30". Choose from our vast exam prep library that includes top vendors like AWS, CompTIA, ISC2, Microsoft, and more. Get access to simulated exams, custom quizzes, e-flashcards, and more. Whether you're gearing up for a certification exam or looking to enhance your skills, now is the perfect time to invest in your cybersecurity journey. Visit n2k.com/certify to find your cert and save 30% with promo code “SECURE30” today.

Attacks, Threats, and Vulnerabilities

Zero-Click Flaw Exposes Potentially Millions of Popular Storage Devices to Attack (WIRED) A vulnerability categorized as “critical” in a photo app installed by default on Synology network-attached storage devices could give attackers the ability to steal data and worse.

2024 looks set to be another record-breaking year for ransomware — and it's likely going to get worse | TechCrunch (TechCrunch) This year, 2024, looks set to be the most profitable yet for hackers, with four ransom demands paid in the tens of millions of dollars.

Products, Services, and Solutions

Stamus Networks Partners with Specialist Distributor Titan Data Solutions (Stamus Networks) PRESS RELEASE: Stamus Networks has partnered with Titan Data Solutions to market Stamus Networks’ solutions throughout the U.K.

Legislation, Policy, and Regulation

CISA Strategic Plan Targets Global Cooperation on Cybersecurity (Security Boulevard) The Cybersecurity and Infrastructure Security Agency (CISA) introduced its inaugural international strategic plan, a roadmap for strengthening global partnerships against cyber threats.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

The Future of National Cyber Defense (Arlington, Virginia, USA, Nov 6, 2024) This unique event brings together key leaders from U.S. Department of Defense (DoD) invested in creating and delivering strategies for our nation’s cyber defense. Hon. Leslie Beavers, Acting CIO, DoD will begin an interactive evening in a fireside chat with Mary O'Brien, Principal and Owner Mary O'Brien Strategies, LTG USAF (Ret). This will be followed by our esteemed panel who will stimulate audience discussion about what is required to build on successes and position challenges to the private and public sectors to ensure advancement of the national security mission.

The Cyber Guild Virtual Employer Roundtable (Virtual, Nov 12, 2024) The Cyber Guild Employer Roundtable is an innovative sequence of virtual events for business, technical and people leaders across all sectors and industries building a sustainable cyber ecosystem, and who are invested in driving inclusive workforce practices. A peer discussion on how an intentional approach to deploying innovative tools ensures the desired outcome of increased innovation, inclusion and alignment with NIST AI standards.

Events

Pacific Hackers Conference (Mountain View, California, USA, Nov 2, 2024) Pacific Hacker Conference is an information security and hacking conference that gathers the brightest minds in cybersecurity and hacking from Silicon Valley and beyond. Focusing on cutting-edge techniques, research, and developments, we aim to create an environment where knowledge is shared and connections are made. Our audience ranges from security professionals, researchers, and ethical hackers to industry decision-makers. We keep the conference small, allowing us to provide what other Cons leave out.

The Future of National Cyber Defense (Arlington, Virginia, USA, Nov 6, 2024) This unique event brings together key leaders from U.S. Department of Defense (DoD) invested in creating and delivering strategies for our nation’s cyber defense. Hon. Leslie Beavers, Acting CIO, DoD will begin an interactive evening in a fireside chat with Mary O'Brien, Principal and Owner Mary O'Brien Strategies, LTG USAF (Ret). This will be followed by our esteemed panel who will stimulate audience discussion about what is required to build on successes and position challenges to the private and public sectors to ensure advancement of the national security mission.

SecureWorld Seattle (Bellevue, Washington, USA, Nov 6 - 7, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 12-18 CPE credits through 30+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

The Cyber Guild Virtual Employer Roundtable (Virtual, Nov 12, 2024) The Cyber Guild Employer Roundtable is an innovative sequence of virtual events for business, technical and people leaders across all sectors and industries building a sustainable cyber ecosystem, and who are invested in driving inclusive workforce practices. A peer discussion on how an intentional approach to deploying innovative tools ensures the desired outcome of increased innovation, inclusion and alignment with NIST AI standards.

Beyond Earth Symposium (Washington, DC, USA, Nov 12 - 13, 2024) The acceleration of space innovations that will enable space migration is outpacing public policy and international law regimes. Beyond Earth Institute’s mission is to create a policy and legal framework to support the robust development of an in-space economy and the expansion of human civilization beyond Earth. At the Beyond Earth Symposium 2024, we will wrestle with the critical current issues of the day and delve into the bleeding edge issues that must be moved to the center of international debate. What we do in a post-ISS era is an urgent, immediate concern. Policies that can foster the creation of a lunar-based economy are equally important. Let’s be bold together! Join stakeholders from across the industry, government, and international sector for this third annual Beyond Earth Symposium. Momentum is building to transform policy and legal landscape to enable a space migration future. Dare to be part of this work.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 11.01.24

At a glance.

Iranian threat actor targeted the 2024 Olympics.

Chinese threat actor uses credentials stolen by the Quad7 botnet.

Scammers compromise over a thousand online stores.

Notes.

Attacks, Threats, and Vulnerabilities

Products, Services, and Solutions

Legislation, Policy, and Regulation

Newly Noted Events

Events