Our network is growing again! We are excited to announce that the Cybersecurity Marketing Society has joined N2K’s CyberWire network with their popular weekly podcast, Breaking Through in Cybersecurity Marketing. The first episode is now available, with new episodes airing every Wednesday. Listen to the latest episode and subscribe wherever you find your favorite shows, or visit the show page for more information.
Former CIA programmer Joshua Schulte has been sentenced to forty years in prison for leaking CIA hacking tools to WikiLeaks in 2016, Digital Journal reports. WikiLeaks published the tools in its Vault 7 and Vault 8 disclosures in 2017. Schulte was found guilty of espionage, computer hacking, contempt of Court, making false statements to the FBI, and child pornography. US Attorney Damian Williams said in a statement, "Schulte betrayed his country by committing some of the most brazen, heinous crimes of espionage in American history. He caused untold damage to our national security in his quest for revenge against the CIA for its response to Schulte’s security breaches while employed there."
Gain actionable insights to continuously build and maintain high-performance teams, climb the knowledge curve, and stay ahead in a rapidly changing world. N2K’s Strategic Cyber Workforce Intelligence is a comprehensive solution designed to identify current capabilities and develop a data-driven framework to enrich hiring, upskilling, and career mobility efforts in your people strategy that evolves with ongoing organizational transformation. Learn more.
Cloudflare has disclosed details of a 2023 breach that resulted in unauthorized access to the company's internal wiki and bug database hosted on an Atlassian server. The threat actor had access to the server for ten days between November 14th and November 24th. Cloudflare stresses that "[N]o Cloudflare customer data or systems were impacted by this event. Because of our access controls, firewall rules, and use of hard security keys enforced using our own Zero Trust tools, the threat actor’s ability to move laterally was limited. No services were implicated, and no changes were made to our global network systems or configuration."
Cloudflare says the threat actor gained access "by using one access token and three service account credentials that had been taken, and that we failed to rotate, after the Okta compromise of October 2023." The company adds, "Based on our collaboration with colleagues in the industry and government, we believe that this attack was performed by a nation state attacker with the goal of obtaining persistent and widespread access to Cloudflare’s global network."
Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.
Akamai says the FritzFrog botnet has added the Log4Shell vulnerability (CVE-2021-44228) to its arsenal. The malware is targeting unpatched internal hosts: "When the vulnerability was first discovered, internet-facing applications were prioritized for patching because of their significant risk of compromise. Contrastly, internal machines, which were less likely to be exploited, were often neglected and remained unpatched — a circumstance that FritzFrog takes advantage of. As part of its spreading routine, the malware attempts to target all hosts in the internal network."
Today's issue includes events affecting China, Russia, and the United States.
For more information on these and other developing stories, listen to the CyberWire Daily podcast each day. You can find it here or on your favorite podcast app. On today's show, guest Adam Marré, CISO of Arctic Wolf, joins us to begin our discussion of election security in 2024. Adam will be sharing their Election Cybersecurity Survey outlining key cybersecurity threats to the 2024 election season.
More Android apps riddled with malware spotted on Google Play (BleepingComputer) An Android remote access trojan (RAT) known as VajraSpy was found in 12 malicious applications, six of which were available on Google Play from April 1, 2021, through September 10, 2023.
USB Malware Chained with Text Strings on Legitimate Websites Attacks Users (Cyber Security News) According to the reports shared with Cyber Security News, the threat actor begins the infection chain by delivering the USB drives to the victims by any means of social engineering.
Threat Actors Installing Linux Backdoor Accounts - ASEC BLOG (ASEC BLOG) AhnLab SEcurity intelligence Center (ASEC) is using a Linux SSH honeypot to monitor attacks against unspecified Linux systems. Threat actors install malware by launching brute force and dictionary attacks against Linux systems that are poorly managed, such as using default settings or having a simple password. While there is a variety of attack cases including those where worms, CoinMiners, and DDoS bots are installed, this post will cover attack cases where backdoor accounts are created instead of malware. Such attacks...
PurpleFox malware infects thousands of computers in Ukraine (BleepingComputer) The Computer Emergency Response Team in Ukraine (CERT-UA) is warning about a PurpleFox malware campaign that has infected at least 2,000 computers in the country.
Russian spies impersonating Western researchers in ongoing hacking campaign (The Record) An ongoing Russian campaign is trying to gain access to the email accounts of academics and researchers, according to messages and files seen by Recorded Future News and independently analyzed by two cybersecurity companies.
Cloudflare Hacked After State Actor Leverages Okta Breach (Hackread - Latest Cybersecurity, Tech, Crypto & Hacking News) Follow us on Twitter (X) @Hackread - Facebook @ /Hackread
Biden to Veto Attempt to Overturn SEC Cyber Incident Disclosure Rules (SecurityWeek) President Biden would veto Republican lawmakers’ attempt to overturn the SEC’s recent cyber incident disclosure rules.
Murder suspect mistakenly released from jail after 'cybersecurity incident' (ABC News) Murder suspect Zion River Shaka, 30, was mistakenly released by Clayton County in Georgia last week.
FTC settles with Blackbaud over poor data practices leading to massive hack (The Record) Blackbaud, a data and software services company, will be required to delete personal data it doesn’t need as part of a Federal Trade Commission settlement holding the company responsible for poor data practices which allowed a hacker to exfiltrate sensitive information belonging to millions of customers, the agency announced Thursday.
US announces another arrest in BTC-e cybercrime case (The Record) A Belarusian and Cypriot national allegedly connected with the defunct cryptocurrency exchange BTC-e is in U.S. custody and faces charges related to money laundering, federal prosecutors said Thursday.
40 years in prison for ex-CIA coder who leaked hacking tools to WikiLeaks - Digital Journal (Digital Journal) A former CIA programmer was sentenced to 40 years in prison for leaking the US spy agency's most valuable hacking tools to WikiLeaks.
For a complete running list of events, please visit the Event Tracker.
SANS Tysons Corner – NOVA 2024 (Tysons Corner, Virginia, USA, Feb 5 - 10, 2024) At SANS Tysons Corner-NOVA 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
SANS San Diego 2024 (San Diego (and virtual), California, USA, Feb 12 - 17, 2024) At SANS San Diego 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
SANS Security East New Orleans 2024 (New Orleans, and virtual, Louisiana, USA, Feb 19 - 24, 2024) At SANS Security East New Orleans 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!
Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.
Trellix Public Sector Cybersecurity Summit (Washington, DC, USA, Feb 27, 2024) Public sector organizations continue to face a constant barrage of sophisticated cyber threats. And with new cybersecurity mandates and guidance — from recent executive orders to the release of the 2023 National Cyber Strategy — public sector leaders must make considerable decisions about their cyber enterprise that will have lasting impacts for years to come. On top of this, the emergence of novel security capabilities built on machine learning, AI, predictive analytics and extended detection and response has given security leaders a new arsenal of tools to defend against the next sophisticated attack. Join top technology leaders from across the public sector at the Trellix Public Sector Cybersecurity Summit as they discuss emerging topics in cybersecurity like ransomware, zero trust, global security and XDR. Throughout the summit, you’ll have the opportunity to engage in conversations about how the arrival of AI will intersect with public sector cybersecurity, evolving partnerships to strengthen threat intelligence, how to navigate, take action on and go beyond new cybersecurity policy directives, and much more.
