US charges five alleged Scattered Spider members.

Summary

By the CyberWire staff

At a glance.

US charges five alleged Scattered Spider members.
VMware vCenter Server flaws are being actively exploited.
China-aligned threat actor deploys new Linux malware.

US charges five alleged Scattered Spider members.

The US Justice Department has charged five alleged members of the Scattered Spider cybercriminal group, accusing them of exfiltrating sensitive corporate data and stealing millions of dollars worth of cryptocurrency, CyberScoop reports. Four of the defendants are US citizens, and one is from the UK.

The Justice Department stated, "[F]rom at least September 2021 to April 2023, the defendants conducted phishing attacks by sending mass short message service (SMS) text messages to mobile phones of numerous victim companies’ employees – messages that purported to be from the victim company or a contracted information technology or business services supplier of the victim company....The defendants then used the stolen credentials to gain unauthorized access the accounts of victim companies’ employees and the companies’ computer systems to steal confidential information, including confidential work product, intellectual property, and personal identifying information, such as account access credentials, names, email addresses, and telephone numbers. The group also used stolen information obtained from victim company intrusions, leaked data sets, and other sources, to gain unauthorized access to numerous individuals’ cryptocurrency accounts and wallets and steal millions of dollars’ worth of virtual currency."

How CISOs are tackling the realities of AI adoption

How are security leaders navigating AI adoption? Hear from leading CISOs in the latest Tines report, CISO Perspectives: Separating the Reality of AI from the Hype.

What to expect:

Top challenges CISOs are facing in AI adoption
Key opportunities AI presents for security teams
Strategies for handling the added pressure AI brings

Get the report to learn why 74% of CISOs believe AI will introduce more benefits than risks to the SOC.

VMware vCenter Server flaws are being actively exploited.

The US Cybersecurity and Infrastructure Security Agency (CISA) warns that two vulnerabilities affecting VMware vCenter Server are being actively exploited. One of the flaws (CVE-2024-38812) has been assigned a CVSS score of 9.8 and can allow an attacker to achieve remote code execution. Broadcom issued updated patches in October after determining that its September patches didn't fully address the vulnerability. The company strongly encourages customers to ensure they've applied the new patches. The vulnerabilities affect "VMware vCenter and any products that contain vCenter, including VMware vSphere and VMware Cloud Foundation."

Survey Your Security Perimeter with a Free Security Assessment

By getting started with a free identity security assessment, Cisco can help you find and secure the gaps in your identity infrastructure and provide insights for improving your identity posture. Outcomes of the assessment include:

A complete view of your identity security posture
A detailed view of all identities and devices logging into your network
An analysis of your multi-factor authentication usage and adoption
A snapshot of your total number of inactive accounts

Request Your Free Identity Security Assessment Today

China-aligned threat actor deploys new Linux malware.

ESET has published a report on "WolfsBane," a newly discovered Linux backdoor deployed by the China-aligned threat actor Gelsemium. WolfsBane samples were uploaded to VirusTotal by users in Taiwan, the Philippines, and Singapore, which aligns with Gelsemium's targeting in previous campaigns. WolfsBane is the Linux equivalent of Gelsemium’s Gelsevirine Windows backdoor. ESET notes, "The trend of APT groups focusing on Linux malware is becoming more noticeable. We believe this shift is due to improvements in Windows email and endpoint security, such as the widespread use of endpoint detection and response (EDR) tools and Microsoft’s decision to disable Visual Basic for Applications (VBA) macros by default."

Dropzone AI Named a Gartner Cool Vendor for the Modern SOC.

Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.

Notes.

Today's issue includes events affecting China, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Apple says Mac users are being targeted by dangerous zero-day attacks, so update now (TechRadar) Mac users should patch immediately, Apple warns

New Chrome, Safari, Firefox, Edge Warning—Do Not Shop On These Websites (Forbes) A dangerous website list has been issued before Black Friday—here’s what you need to know.

Manufacturing Industry Faces Wave of Advanced Email Attacks (Abnormal) New data shows a surge in advanced email attacks on manufacturing organizations. Explore our research on this alarming trend.

Trends

New Semperis Ransomware Study: Global Organizations Should Brace for Holiday Season Cyberattacks - Semperis (Semperis) We protect the world’s largest and most complex environments from cyberattacks, data breaches, and operational errors. Read our press release "New Semperis Ransomware Study: Global Organizations Should Brace for Holiday Season Cyberattacks" to learn more.

Attackers Targeting VPNs Account for 28.7 Percent of Ransomware Incidents in Q3 According to Corvus Insurance Cyber Threat Report (PR Newswire) /PRNewswire/ -- Corvus Insurance, a wholly owned subsidiary of The Travelers Companies, Inc., today released its Q3 2024 Cyber Threat Report, The Ransomware...

Marketplace

Haveli Investments Acquires Controlling Interest in Machine Identity Leader AppViewX - AppViewX (AppViewX) Haveli Investments to Help Accelerate Global Growth and Market Leadership for AVX ONE, One of the Most Advanced CLM and PKI Platform for Non-Human Identity & Access Management NEW YORK – (BUSINESS WIRE) November 21, 2024 – AppViewX, a leader in automated certificate lifecycle management (CLM) and public key infrastructure (PKI) solutions, today announced a […]

RSA Conference 2025 Innovation Sandbox Contest Celebrates 20th Anniversary; Introduces $50 Million Annual Investment Program for Top 10 Finalists (PR Newswire) /PRNewswire/ -- RSA Conference™, the world's leading cybersecurity conferences and expositions, today announced that starting in April 2025, the Top 10...

RIIG Secures $3 Million to Help Protect Organizations from Cyber Threats with Advanced Data, Intelligence Solutions (PR Newswire) /PRNewswire-PRWeb/ -- RIIG, a risk intelligence and cybersecurity solutions provider, announced today that it has closed a $3 million seed funding round. Led...

N-able Acquires Existing Strategic Partner Adlumin, Adding Cloud-Native XDR and MDR Capabilities to Its End-to-End Security and IT Management Platform (BusinessWire) Acquisition Builds on Successful Partnership to Fuel Resilience Across the Full IT Environment and Strengthen the Security Posture of Customers Worldwide

Products, Services, and Solutions

C1 Edge Research Reveals 99% of Organizations Are Accelerating Generative AI Adoption to Enhance Employee and Customer Experiences (C1 MediaRoom) C1, a global technology solution provider focused on elevating connected human experiences, today published a comprehensive report titled The Era of AI-Powered Connected Human Experience is...

Versa Introduces Cloud Firewall on AWS Marketplace (BusinessWire) Versa Cloud Firewall for AWS Combines AWS Integration with Industry’s Highest Performance and Security Effectiveness

CyberRatings.org 2024 Product Test Report for Cloud Network Firewall (Versa Networks) CyberRatings.org Research Report CyberRatings.org 2024 Product Test Report for Cloud Network Firewall CyberRatings.org conducted an independent test of Versa Operating System (v. 22.1.3) against the Cloud Firewall Test Methodology v2.1, using Amazon Web Services running a c7a.4xlarge instance. The product was thoroughly tested to determine how it handled TLS/SSL 1.2 and 1.3 cipher suites, how it

Wipro and Lineaje Collaborate to Boost Enterprise Software Supply Chain Security (PR Newswire) /PRNewswire-PRWeb/ -- Wipro (NYSE: WIT, BSE: 507685, NSE: WIPRO), a leading technology services and consulting company and Lineaje, today announced a...

1Password Expands North American Presence, Announces Strategic Alliance with Ingram Micro (BusinessWire) Enables channel partners to help businesses proactively address the ‘Access-Trust Gap’ by securing every sign-in, app, and device with 1Password Extended Access Management

Rubrik Delivers Cyber Resilience Solution for Microsoft Azure Blob Storage (Rubrik) Complete cloud repository data security enables customers to securely leverage the cloud for business agility.

Baffle Announces Vector Database Protection to Enhance Data Security for GenAI Applications (GlobeNewswire News Room) New feature extends security platform to sensitive data in PostgreSQL...

Leveling Up Fuzzing: Finding more vulnerabilities with AI (Google Online Security Blog) Posted by Oliver Chang, Dongge Liu and Jonathan Metzman, Google Open Source Security Team Recently, OSS-Fuzz reported 26 new vulnerabilities...

Checkmarx Expands Software Supply Chain Security with Advanced Secrets Detection and Repository Health (BusinessWire) New solutions help organizations secure more of their software supply chain as both applications and application development grow in complexity and risk

SlashNext Launches MSP and MSSP Partner Progra (SlashNext) The SlashNext MSP Partner Program provides partners with AI-driven phishing protection, helping to keep customers safe from cyber threats and social engineering attacks.

CirrusMD Receives FedRAMP® Moderate Authorization for Virtual Care Solution (GlobeNewswire News Room) CirrusMD is now available on the FedRAMP Marketplace, the central, online portal of approved cloud service offerings available for federal government use....

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

SANS Holiday Hack Cybersecurity Challenge 2024: Snow-maggedon (Vienna, Nov 7 - Dec 2, 2024) Whether you're a first-time player or a seasoned participant, this year’s Holiday Hack brings exciting new features you won’t want to miss! We’ve introduced a new dynamic for this year: challenges will be gradually released in sync with the story, keeping the experience fresh and immersive. See challenges release dates and new features included.

CYBERWARCON (Arlington + Virtual, Virginia, USA, Nov 22, 2024) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds including the military and government, academia, the media, and the private sector.

AWS re:Invent (Las Vegas, Nevada, USA, Dec 2 - 6, 2024) AWS re:Invent offers learning sessions on many topics in a variety of formats and at various levels so you can expand your knowledge and grow your skills at a pace that is right for you. Select a topic from the list to learn more about these opportunities at re:Invent.

ISC2 SECURE Washington, DC (Virtual, Dec 4 - 5, 2024) You’re invited to participate in powerful collaboration and discover the latest topics impacting the cybersecurity profession. Join us for ISC2 SECURE Washington, DC, Live online on December 4-5, 2024! Over two days of interactive sessions, cybersecurity experts will address common challenges shared by government entities and the private sector/industry - not just in DC but around the globe. After a number of major national and global cybersecurity incidents in 2024, its clear we're all part of one ecosystem that must remain a united front to ensure resilience in the face of threats. Make an impact on the security of your organization’s assets and data with actionable ideas and strategies from this important event.  Members earn up to 7.5 CPE credits.

SecureWorld Pacific Virtual Conference (Virtual, Dec 11, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 11.21.24

At a glance.

US charges five alleged Scattered Spider members.

VMware vCenter Server flaws are being actively exploited.

China-aligned threat actor deploys new Linux malware.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Products, Services, and Solutions

Events