760,000 employee records leaked online. Energy industry contractor hit by ransomware.

Announcement

This holiday season, Only Malware in the Building returns with a festive A Christmas Carol-inspired twist! In this special episode, your hosts—Selena Larson, Proofpoint intelligence analyst and host of DISCARDED, along with N2K Networks’ Dave Bittner and Rick Howard—embark on a ghostly journey through the most pressing cybersecurity threats of the season. Picture this: the flicker of candlelight, the warmth of eggnog, cozy holiday sweaters, and three cybersecurity experts unraveling the digital dangers that lurk behind the tinsel and cheer.

Much like Scrooge's visitations, Selena, Dave, and Rick take on the roles of modern-day cybersecurity detectives, guided by the ghostly spirits of past, present, and future threats. In this festive adventure, they investigate key cyber trends such as two-factor authentication (2FA), social engineering scams, and the frightening return of consumer-targeted attacks. From the ghostly echoes of past cyberattacks to the current threats hidden behind holiday merriment, this episode promises to offer both practical wisdom and a bit of festive spirit.

So, grab your eggnog, settle in by the fire, and let these cybersecurity detectives guide you through the season’s most mischievous and mysterious digital threats. With their expert advice, may your holidays be merry, bright, and free of cyber fright! Listen now.

Summary

By the CyberWire staff

At a glance.

760,000 employee records leaked online.
Energy industry contractor hit by ransomware.
Russia sentences Hydra Market founder to life in prison.

760,000 employee records leaked online.

Information belonging to more than 760,000 employees of several major companies has been posted online by a criminal threat actor, SecurityWeek reports. The data was apparently stolen during last year's widespread attacks on Progress Software's MOVEit file transfer tool. The information appears to belong to Xerox, Nokia, Koch, Bank of America, Morgan Stanley, and Bridgewater, and includes names, emails, phone numbers, work ID numbers, job titles, and manager names.

Atlas Privacy CSO Tsachi (Zack) Ganot told SecurityWeek "We believe the data originates from the Cl0p ransomware group, who frequently exploit vulnerabilities like MOVEit to exfiltrate and publish sensitive data as part of their extortion campaigns. It’s likely Name3l3ss dug through terabytes of darkweb data and repackaged it for wider consumption." Ganot also noted in a comment to the Register that this data is "a goldmine for social engineering."

From response to resilience: unlock next-level automation for security teams

Security teams are facing a constant uphill battle. Between alert fatigue, repetitive manual tasks, endless false positives, inflexible technology, and the looming risk of burnout, it all adds up, making it tough for teams to stay ahead of threats.

That’s where effective workflow orchestration and automation comes in.

Discover how automation can empower analysts and engineers to automate their most repetitive, time-consuming tasks - regardless of complexity - in this guide from Tines. Get the guide today!

Energy industry contractor hit by ransomware.

Texas-based energy industry contractor ENGlobal Corporation sustained a ransomware attack on November 25th that encrypted some of its IT systems, the Record reports. ENGlobal provides engineering and automation services to the US energy and defense sectors.

The company said in an SEC filing, "Upon detecting the unauthorized access, the Company immediately took steps to contain, assess and remediate the cybersecurity incident, including beginning an internal investigation, engaging external cybersecurity specialists, and restricting access to its IT system. As a result of these and other measures, and while the investigation and remediation efforts remain ongoing, access to the Company’s IT system is limited to essential business operations. The timing of restoration of full access to the Company’s IT system remains unclear as of the date of this filing. The Company has not yet determined whether the cybersecurity incident is reasonably likely to materially impact the Company’s financial condition or results of operations."

Build a Stronger Identity Security Program to Protect Your Organization

In our eBook, Building an Identity Security Program, we provide a step-by-step guide to creating a resilient identity security framework. You'll learn how to integrate identity security into your overall security strategy, protect against threats like MFA attacks, and secure access across your entire organization. Don’t leave your organization vulnerable to identity-based attacks. Arm yourself with the knowledge and tools to defend your business. Download the eBook.

Russia sentences Hydra Market founder to life in prison.

A Russian court has sentenced Stanislav Moiseyev, the accused leader of the Hydra darknet marketplace, to life in prison, BleepingComputer reports. Fifteen accomplices received prison terms ranging from 8 to 23 years for drug production and distribution. Hydra was the world's largest darknet drug market before its servers were seized by German police in 2022.

The Moscow prosecutor's office stated yesterday, "The court established that from 2015 to October 2018, the criminal group operated in various regions of the Russian Federation and the Republic of Belarus. In total, law enforcement officers seized almost a ton of narcotic drugs and psychotropic substances in various constituent entities of the Russian Federation during searches of the defendants' residences, houses adapted for laboratories for the production of prohibited substances, garages used for storage, and cars equipped with special hiding places during the liquidation of the criminal community."

Dropzone AI Named a Gartner Cool Vendor for the Modern SOC.

Dropzone AI has been recognized as a Gartner Cool Vendor, validating its role in transforming SOCs. With an AI SOC Analyst that autonomously investigates alerts 24/7, Dropzone AI helps security teams stay ahead by reducing alert fatigue and providing decision-ready insights. Discover how we're leading SOC innovation.

Notes.

Today's issue includes events affecting the Republic of Korea, Russia, Taiwan, and the United States.

Attacks, Threats, and Vulnerabilities

SmokeLoader Attack Targets Companies in Taiwan | FortiGuard Labs (Fortinet Blog) FortiGuard Labs has uncovered an attack targeting companies in Taiwan with SmokeLoader, which performs its attack with plugins this time. Learn more.…

Xerox, Nokia, BofA, Morgan Stanley's employees data dumped (The Register) Yet another result of the MOVEit mess

Code found online exploits LogoFAIL to install Bootkitty Linux backdoor (Ars Technica) Unearthed sample likely works against Linux devices from Acer, HP, Fujitsu, and Lenovo.

Trends

Report: The Increasing Global Complexity of an Open-Source Software Supply Chain (Lineaje) This new Lineaje AI Labs Report uncovers the critical vulnerabilities hidden deep within open-source software and the geopolitical risks shaping today’s software supply chains.

Marketplace

Upwind Secures $100M to Power Next-Generation Cloud Security - Upwind (Upwind) Customers have always been our north-star. Being “Driven By Customers” is not just a paragraph written on our Careers page – it’s the way we operate on a daily basis. It is how we hire, promote, and give each other feedback. It is also how we build products, prioritize features, and think about our roadmap. […]

ArmorCode Appoints Jon Skoglund as Chief Financial Officer to Strengthen Operational Leadership and Accelerate Scalable Growth (PR Newswire) /PRNewswire-PRWeb/ -- ArmorCode, the leader in AI-powered Application Security Posture Management (ASPM), today announced the appointment of Jon Skoglund as...

Products, Services, and Solutions

Nucleus Security Partners with SecurityScorecard to Enhance Unified Risk Analysis and Compliance Reporting (PR Newswire) /PRNewswire/ -- Nucleus Security, the leader in unified vulnerability management, today announced it has partnered with SecurityScorecard, the global leader in...

Progress Unveils Q4 2024 Release for Telerik and Kendo UI, Breaking New Ground in Design-to-Code Processes and Adding Support for .NET 9 and Angular 19 (GlobeNewswire News Room) New design capabilities, advanced data visualization and support for .NET 9 and Angular 19 add to the most comprehensive offer on the market for .NET and...

LastPass Announces Partnership with TD SYNNEX (LastPass) Ensuring password security and effortless access to credentials across customer IT ecosystem

Sumo Logic Drives Dynamic Observability with AI Innovations Fueled by Logs (BusinessWire) Sumo Logic Mo Copilot and a Dynamic Observability prototype combine logs with AI to close the data gap and provide a scalable way to achieve the next generation of observability

Latest Innovations from Veracode Help Organizations Be Secure by Design (BusinessWire) Company Launches Veracode Risk Manager and Enhancements in AI-powered Remediation

Introducing Wiz Defend (Wix) We’re excited to announce the public preview of Wiz Defend, a cloud-native detection and response solution.

Sweet Security Introduces Evolutionary Leap in Cloud Detection and Response, Releasing First Unified Detection & Response Platform (GlobeNewswire News Room) With Sweet, customers can now unify detection and response for applications, workloads, and cloud infrastructure...

Wipro and Netskope Partner to Offer Cybersecurity Optimization Advisory Services (Netskope) Wipro CyberTransformSM Optimization Service enhances business value by boosting cybersecurity performance and reducing costs

Litigation, Investigation, and Law Enforcement

Korea arrests CEO for adding DDoS feature to satellite receivers (BleepingComputer) South Korean police have arrested a CEO and five employees for manufacturing over 240,000 satellite receivers pre-loaded or later updated to include DDoS attack functionality at a purchaser's request.

Russia sentences Hydra dark web market leader to life in prison (BleepingComputer) Russian authorities have sentenced the leader of the criminal group behind the now-closed dark web platform Hydra Market to life in prison.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

AWS re:Invent (Las Vegas, Nevada, USA, Dec 2 - 6, 2024) AWS re:Invent offers learning sessions on many topics in a variety of formats and at various levels so you can expand your knowledge and grow your skills at a pace that is right for you. Select a topic from the list to learn more about these opportunities at re:Invent.

ISC2 SECURE Washington, DC (Virtual, Dec 4 - 5, 2024) You’re invited to participate in powerful collaboration and discover the latest topics impacting the cybersecurity profession. Join us for ISC2 SECURE Washington, DC, Live online on December 4-5, 2024! Over two days of interactive sessions, cybersecurity experts will address common challenges shared by government entities and the private sector/industry - not just in DC but around the globe. After a number of major national and global cybersecurity incidents in 2024, its clear we're all part of one ecosystem that must remain a united front to ensure resilience in the face of threats. Make an impact on the security of your organization’s assets and data with actionable ideas and strategies from this important event.  Members earn up to 7.5 CPE credits.

SecureWorld Pacific Virtual Conference (Virtual, Dec 11, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

GovSummit (Washington, DC, USA, Dec 11, 2024) In a world of escalating digital threats and disruptions, Splunk stands at the core of government agencies, equipping them with the solutions they need to stay resilient and ensure mission success, even in the face of the unexpected. Today, the power is in digital resilience.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 12.03.24