Chinese police investigate I-Soon leak. US offers $15 million reward for information on LockBit operators.

Summary

By the CyberWire staff

At a glance.

Chinese police investigate I-Soon leak.
US offers $15 million reward for information on LockBit operators.
Change Healthcare disrupted by cyberattack.

Chinese police investigate I-Soon leak.

The Associated Press cites two employees of Chinese cybersecurity vendor I-Soon as saying that the Chinese police are investigating a leak showing that the company provided hacking services to the Chinese government. The AP notes that the leaked documents "reveal, in detail, methods used by Chinese authorities to surveil dissidents overseas, hack other nations, and promote pro-Beijing narratives on social media."

Researchers at SentinelOne have published a report on the breach, stating, "The leaked documents align with previous threat intel on several named threat groups. Victim data and targeting lists, as well as names of the clients who requested them, show a company who competes for low-value hacking contracts from many government agencies."

Secure your future with a master’s degree in cybersecurity from Penn State World Campus.

Boost your cybersecurity career with Penn State World Campus! Our online master's program delivers cutting-edge knowledge, hands-on skills, and expert insights. Benefit from flexible learning that fits your schedule, while gaining industry-relevant expertise in areas like threat detection, risk management, and ethical hacking. Join a renowned institution, be guided by industry leaders, and advance your career in the dynamic field of cybersecurity. Elevate your skills, secure your future — apply today!

US offers $15 million reward for information on LockBit operators.

The US State Department yesterday announced a $15 million reward "for information leading to the arrest and/or conviction of any individual participating in a LockBit ransomware variant attack and for information leading to the identification and/or location of any key leaders of the LockBit ransomware group." Additionally, the US Treasury Department on Tuesday sanctioned two Russian nationals, Ivan Gennadievich Kondratiev and Artur Sungatov, for their alleged participation in LockBit attacks.

Fill in the cyber roles and skills gaps you actually need.

N2K’s Talent Insights solutions provide the workforce intelligence needed to take strategic action. Our workforce experts and proprietary data-analysis tools do the heavy lifting to assess and refine your cyber job roles, the competencies required, and build org charts to organize your workforce. The takeaway? Clarity on where you are, what you need, and a data-driven framework to get you there. Ready to dive in? Learn more.

Change Healthcare disrupted by cyberattack.

A cyberattack against Change Healthcare caused widespread network disruptions yesterday, SecurityWeek reports. The company stated this morning, "Change Healthcare is experiencing a network interruption related to a cyber security issue and our experts are working to address the matter. Once we became aware of the outside threat, in the interest of protecting our partners and patients, we took immediate action to disconnect our systems to prevent further impact. We will provide updates as more information becomes available."

SecurityWeek notes that "[t]he company has access to the medical records of roughly one third of US patients, handling billions of healthcare transactions per year, and the disruption has had a significant impact on the healthcare system, with some pharmacies being unable to process prescriptions."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Notes.

Today's issue includes events affecting China, Russia, and the United States.

Podcast Summary

For more information on these and other developing stories, listen to the CyberWire Daily podcast each day. You can find it here or on your favorite podcast app. On our Learning Layer segment, host Sam Meisenberg of N2K discusses learning science research. Sam breaks down research about quizzes and their impact on learner motivation and long-term retention.

Attacks, Threats, and Vulnerabilities

2024 CrowdStrike Global Threat Report Release (CrowdStrike) CrowdStrike's 2024 CrowdStrike Global Threat Report highlights a surge in adversaries leveraging stolen identity credentials and the threat horizon for 2024.

Hack at Services Firm Hits 2.4 Million Eye Doctor Patients (GovInfoSecurity) An Arizona firm that provides administrative services to a dozen ophthalmology practices in several states is notifying nearly 2.4 million patients of a data theft

New SSH-Snake malware steals SSH keys to spread across the network (BleepingComputer) A threat actor is using an open-source network mapping tool named SSH-Snake to look for private keys undetected and move laterally on the victim infrastructure.

Leaked documents open the lid on China’s commercial hacking industry (The Record) A trove of files from a Chinese company called I-Soon includes hacking contracts with public agencies, a repository of targets and years of chats among employees.

Fraudsters tried to scam Apple out of 5,000 iPhones worth over $3 million (BleepingComputer) Two Chinese nationals face 20 years in prison after being caught and convicted of submitting over 5,000 fake iPhones worth more than $3 million to Apple with the goal of having them replaced with genuine devices.

LockBit ransomware secretly building next-gen encryptor before takedown (BleepingComputer) LockBit ransomware developers were secretly building a new version of their file encrypting malware, dubbed LockBit-NG-Dev - likely a future LockBit 4.0, when law enforcement took down the cybercriminal's infrastructure earlier this week.

Security Patches, Mitigations, and Software Updates

Joomla fixes XSS flaws that could expose sites to RCE attacks (BleepingComputer) Five vulnerabilities have been discovered in the Joomla content management system that could be leveraged to execute arbitrary code on vulnerable websites.

ConnectWise remote access software needs immediate patching, company says (The Record) IT management software company ConnectWise is urging users to update self-hosted versions of its ScreenConnect product “immediately” because of critical bugs that can allow easy intrusions by outsiders.

Litigation, Investigation, and Law Enforcement

LockBit takedown: Police shut more than 14,000 accounts on Mega, Tutanota and Protonmail (The Record) Accounts with third-party service providers were used “for exfiltration or infrastructure,” according to a post by law enforcement on LockBit’s seized darkweb domain.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cybersecurity Competitions & Gaming (Virtual, Feb 22, 2024) Season IV, US Cyber Games: An Overview The United States faces a critical shortage of well-qualified cyber talent. While attracting students to computer science programs is a crucial first step, additional, complementary programming is needed to truly begin to close this workforce gap. The US Cyber Games program looks to serve this need via practical, hands-on experience with current and emerging technologies provided through cybersecurity competitions and games. These competitions support traditional academic pathways and widen the net by engaging new and different populations with opportunities to learn more about the field, develop skills, gain invaluable experience, and establish connections with industry professionals.

Cybersecurity Competitions & Gaming (Virtual, Apr 9, 2024) Season IV, US Cyber Games: An Overview The United States faces a critical shortage of well-qualified cyber talent. While attracting students to computer science programs is a crucial first step, additional, complementary programming is needed to truly begin to close this workforce gap. The US Cyber Games program looks to serve this need via practical, hands-on experience with current and emerging technologies provided through cybersecurity competitions and games. These competitions support traditional academic pathways and widen the net by engaging new and different populations with opportunities to learn more about the field, develop skills, gain invaluable experience, and establish connections with industry professionals.

Events

SANS Security East New Orleans 2024 (New Orleans, and virtual, Louisiana, USA, Feb 19 - 24, 2024) At SANS Security East New Orleans 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Trellix Public Sector Cybersecurity Summit (Washington, DC, USA, Feb 27, 2024) Public sector organizations continue to face a constant barrage of sophisticated cyber threats. And with new cybersecurity mandates and guidance — from recent executive orders to the release of the 2023 National Cyber Strategy — public sector leaders must make considerable decisions about their cyber enterprise that will have lasting impacts for years to come. On top of this, the emergence of novel security capabilities built on machine learning, AI, predictive analytics and extended detection and response has given security leaders a new arsenal of tools to defend against the next sophisticated attack. Join top technology leaders from across the public sector at the Trellix Public Sector Cybersecurity Summit as they discuss emerging topics in cybersecurity like ransomware, zero trust, global security and XDR. Throughout the summit, you’ll have the opportunity to engage in conversations about how the arrival of AI will intersect with public sector cybersecurity, evolving partnerships to strengthen threat intelligence, how to navigate, take action on and go beyond new cybersecurity policy directives, and much more.

SANS Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Mar 4 - 9, 2024) At SANS Las Vegas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.22.24