Apple warns individuals of mercenary spyware attacks.

Announcement

Cyber Talent Insights podcast series launches on Friday, April 12th.

N2K is excited to share the launch of Cyber Talent Insights, a three-part special series podcast, on Friday, April 12th. The new series guides listeners through effective strategies to develop cybersecurity teams in the constantly changing landscape of the industry.

Join us each Friday for dynamic discussions around:

the challenges of the cyber talent shortage, and strategies for talent development and retention.
real-world case studies that demonstrate the impact of workforce intelligence.
deep-dives into interviews with industry leaders and workforce experts working to close the talent gap through partnerships and collaborations.

Summary

By the CyberWire staff

At a glance.

Apple warns individuals of mercenary spyware attacks.
Threat actor uses AI-generated malware loader.
Earth Hundun deploys Waterbear malware.

Apple warns individuals of mercenary spyware attacks.

Apple yesterday notified individuals in 92 countries that they may have been targeted by mercenary spyware, TechCrunch reports. The company told the individuals, "Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID...This attack is likely targeting you specifically because of who you are or what you do. Although it’s never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning — please take it seriously."

Apple added, "We are unable to provide more information about what caused us to send you this notification, as that may help mercenary spyware attackers adapt their behavior to evade detection in the future."

Scan Your Active Directory for Breached Passwords 24/7

More than 80% of confirmed breaches are related to stolen, weak, or reused passwords. With Specops Password Policy you can continuously monitor and block over 4 billion known breached passwords from our proprietary list which includes daily refreshed live attack data.

Plus, you can enforce compliance requirements and help users create stronger passwords in Active Directory with customizable rules and real-time client feedback. Test it out with a free trial of Specops Password Policy.

Threat actor uses AI-generated malware loader.

Proofpoint says the financially motivated threat actor TA547 is targeting German organizations with the Rhadamanthys information stealer. Notably, the threat actor is using a malicious PowerShell script that appears to have been crafted by a generative AI tool. The researchers note, "While it is difficult to confirm whether malicious content is created via LLMs – from malware scripts to social engineering lures – there are characteristics of such content that points to machine-generated rather than human-generated information. Regardless of whether it is human or machine-generated, the defense against such threats remains the same."

Establish your brand as a thought leader in cybersecurity.

Launching a new product or service? Looking for alternative ways to recruit cyber talent? Want your company or leadership team members to be seen as an industry thought leader? Be heard by over 350,000 subscribers on the N2K CyberWire network. Whether through sponsored advertising, executive events, or exclusive interviews, we offer off-the-shelf and bespoke packages to help you reach your goals. Let’s work together.

Earth Hundun deploys Waterbear malware.

Trend Micro is tracking a cyberespionage campaign by the Earth Hundun threat actor (also known as BlackTech) that's targeting "a number of organizations in various sectors such as technology, research, and government," mostly in the Asia-Pacific region. The threat actor is deploying the Waterbear malware in these attacks. Trend Micro explains, "Among the group’s arsenal of weapons, the Waterbear backdoor is one of the most complex, with a wide array of anti-debug, anti-sandbox, and general antivirus-hindering techniques. Moreover, the frequent updates from its developers have led to even more evasion tactics, including enhancements of its loader, downloader, and communication protocol."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

On-demand Webinar—2024 and beyond: Top six cloud security trends

Watch this webinar to find out about six emerging trends that are dominating the cloud cybersecurity landscape. You’ll also discover a range of solutions that can help you protect the security of your cloud environments. Watch now.

Notes.

Today's issue includes events affecting , and Germany the United States.

Attacks, Threats, and Vulnerabilities

New Technique Detected in an Open Source Supply Chain Attack (Checkmarx.com) In a recent attack campaign, cybercriminals were discovered cleverly manipulating GitHub's search functionality, and using meticulously crafted repositories to distribute malware.

BatBadBut: You can't securely execute commands on Windows (Flatt) Hello, I’m RyotaK ( @ryotkak ), a security engineer at Flatt Security Inc. Recently, I reported multiple vulnerabilities to several programming languages that allowed an attacker to perform command injection on Windows when the specific conditions were satisfied. Today, affected vendors published advisories of these vulnerabilities 1, so I’m documenting the details here to provide more information about the vulnerabilities and minimize the confusion regarding the high CVSS score.

AT&T now says data breach impacted 51 million customers (BleepingComputer) AT&T is notifying 51 million former and current customers, warning them of a data breach that exposed their personal information on a hacking forum. However, the company has still not disclosed how the data was obtained.

RUBYCARP: A Detailed Analysis of a Sophisticated Decade-Old Botnet Group (Sysdig) The Sysdig Threat Research Team discovered a long-running botnet operated by a Romanian threat actor group, which we are calling RUBYCARP.

Taxi software vendor exposes personal details of nearly 300K (The Record) High-profile individuals including MPs said to be caught up in leak

Marketplace

Women make less than men in US cyber jobs — but the gap is narrowing (CyberScoop) A study from non-profit ISC2 finds that the cybersecurity fields bucks U.S. trends of pay disparities between men and women.

Legislation, Policy, and Regulation

CISA to expand automated malware analysis system beyond government agencies (The Record) CISA's Malware Next-Gen service has been available to federal government and military workers since November.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Season IV US Cyber Games Open SEASON IV US Cyber Games® Kick-Off CELEBRATION (Virtual, May 30, 2024) -Help us kick off and celebrate Season IV -Get the scoop on all that we have planned -Hear from US Cyber Team athletes and coaches -Learn about accessibility in cyber -Find out how to stand out as an applicant -Get a CyberChef walk-through -Be inspired by special VIP guest keynotes

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

SANS Santa Clara (Santa Clara (and virtual), California, USA, Apr 8 - 13, 2024) At SANS Santa Clara 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

SANS New York City Spring 2024 (New York (or virtual), New York, USA, Apr 8 - 13, 2024) At SANS New York City Spring 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

2024 RH-ISAC Cyber Intelligence Summit (Denver, Colorado, USA, Apr 9 - 11, 2024) The RH-ISAC is proud to bring you the 2024 RH-ISAC Cyber Intelligence Summit, coming up on April 9-11, 2024 in Denver, Colorado. This event brings together top cybersecurity leaders and teams representing the most prominent organizations in retailers, restaurants, hotels, gaming casinos, food retailers, consumer products, and other consumer-facing companies.

Cyber Bytes Foundation Youth STEM Summer Camps Open House (Stafford, Virginia, USA, Apr 13, 2024) As the warmth of summer draws near, we are thrilled to extend a special invitation to our upcoming Open House Event, where we'll be showcasing our lineup of thrilling summer camps! Whether you're a tech enthusiast, a budding engineer, or simply seeking an unforgettable summer experience, we have something tailor-made for you.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 04.11.24

Cyber Talent Insights podcast series launches on Friday, April 12th.

At a glance.

Apple warns individuals of mercenary spyware attacks.

Threat actor uses AI-generated malware loader.

Earth Hundun deploys Waterbear malware.

Notes.

Attacks, Threats, and Vulnerabilities

Marketplace

Legislation, Policy, and Regulation

Newly Noted Events

Events