US Treasury Department sanctions Chinese cybersecurity firm.

Summary

By the CyberWire staff

At a glance.

US Treasury Department sanctions Chinese cybersecurity firm.
US Department of Defense adds Tencent to its list of Chinese military companies.
Staten Island hospital notifies 674,000 people of data breach.

US Treasury Department sanctions Chinese cybersecurity firm.

The US Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned Beijing-based cybersecurity company Integrity Technology Group for its alleged involvement in cyberattacks targeting US critical infrastructure. OFAC says the company supported the operations of the Chinese state-sponsored threat actor Flax Typhoon.

The Treasury Department stated, "Between summer 2022 and fall 2023, Flax Typhoon actors used infrastructure tied to Integrity Tech during their computer network exploitation activities against multiple victims. During that time, Flax Typhoon routinely sent and received information from Integrity Tech infrastructure."

The Chinese Foreign Ministry has protested the sanctions, calling them part of an effort to "defame and smear China," SecurityWeek reports.

US Department of Defense adds Tencent to its list of Chinese military companies.

The US Department of Defense has added Chinese web and gaming giant Tencent to its list of "Chinese military companies," meaning the US DOD can no longer work with the company. The Register notes that the designation doesn't restrict US companies from doing business with Tencent, but its addition to the list complicates matters for US firms with DOD contracts. The New York Times observes that US firms often voluntarily stop working with companies on the list in order to avoid being barred from future Pentagon contracts. A Tencent spokeswoman told the Times the company's inclusion on the list was "clearly a mistake" and that Tencent would "work with the Department of Defense to address any misunderstanding."

Staten Island hospital notifies 674,000 people of data breach.

Richmond University Medical Center in Staten Island, New York, is notifying 674,000 individuals that their data may have been compromised during a May 2023 ransomware attack, BankInfoSecurity reports. The hospital said in a notice to Federal regulators last month, "On December 1, 2024, the manual review process determined that at least one of those files contained personal information, including full names and one or more of the following: Social Security numbers, dates of birth, driver’s license numbers or state identification numbers, other government identification numbers, financial account information, credit or debit card information, biometric information, user credentials, medical treatment/diagnosis information, and/or health insurance policy information."

Notes.

Today's issue includes events affecting , and China the United States.

Attacks, Threats, and Vulnerabilities

PhishWP WordPress Plugin Turns Legit Sites into Phishing Traps (SlashNext) PhishWP creates fake payment pages that look like trusted services. It's used as a phishing trap to steal sensitive information such as credit card numbers, personal data, and browser metadata.

Netskope Threat Labs: Phishing Clicks Nearly Tripled in 2024, Ubiquitous Use of Personal Cloud Apps and GenAI Tools Require Modern Workplace Security to Mitigate Risk (PR Newswire) /PRNewswire/ -- Netskope, a global leader in Secure Access Service Edge (SASE), today shared new research showing that, as a result of the growing prevalence...

Trends

State of the Cyber Nation 2024 Report (YL Ventures) We’re thrilled to present YL Ventures' 2024 "State of the Cyber Nation" report - an annual initiative highlighting the past year’s trends, funding rounds, and exits in the Israeli cybersecurity ecosystem!

O'Reilly 2025 Tech Trends Report Reveals AI Skills Surge While Security Governance Takes Center Stage (BusinessWire) Annual usage data from O’Reilly’s online learning platform provides business leaders with the top tech trends and tools poised to shape business strategies in 2025

Marketplace

Cymulate Acquires CYNC Secure in Move to Accelerate Innovation in Continuous Threat Exposure Management (BusinessWire) Partnership adds operational efficiency and risk reduction capabilities for validation-driven CTEM solution

Veracode Acquires Phylum, Inc. Technology to Transform Software Supply Chain Security (Veracode) Technology Acquisition Delivers Automated Malicious Package Analysis, Detection, and Mitigation in Open-source Code

1Password Acquires Trelica to Accelerate Delivery of New Extended Access Management Platform Capabilities (BusinessWire) 1Password, a leader in identity security, today announced the acquisition of Trelica, a pioneer in modern SaaS access management.

New Report: Israeli Cybersecurity Industry Showed Remarkable Growth in 2024, Doubling Investment to $4B (GlobeNewswire News Room) YL Ventures' State of the Cyber Nation 2024 report shows unprecedented growth and global confidence in Israeli innovation...

Products, Services, and Solutions

Qlik Recognized With the Customers' Choice Distinction for Analytics and Business Intelligence Platforms (GlobeNewswire News Room) 91% of our reviewers are willing to recommend us based on 184 reviews as of September 30, 2024...

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Cyberjutsu Unplugged: Career Exploration Day (Las Vegas, Nevada, USA, Jan 25, 2025) Join us January 25th and learn more about Cybersecurity and how you can have a career in this space. This is a FREE event but we do recommend making a donation. Just $50, provides a one year membership to the Women's Society of Cyberjutsu and all the resources available to help you along your journey.

Events

Hacking 4 Humanity 2025 (Virtual, Jan 24 - Feb 7, 2025) Online hate is on the rise, leading to real-world devastating effects on individuals and communities around the world. Join Carnegie Mellon, Duquesne, Pitt, and other undergrad and grad students from Pittsburgh at a multidisciplinary hackathon to develop new tech and policy solutions that mitigate online hate and create safer communities. Hacking4Humanity is a tech and policy hackathon for undergraduate and graduate students, which offers students a new way to engage with real-world social problems that can be improved with novel technical and policy solutions.

GSA Spaceport Summit 2025 (Orlando, Florida, USA, Jan 27, 2025) Commercial Space Week begins with annual GSA Spaceport Summit on January 27, 2025.

Space Mobility Conference and Expo (Orlando, Florida, USA, Jan 28, 2025) Space Mobility mobilizes commercial industry executives and high-ranking officials from defense and government agencies to assure access and superiority in the highly contested space domain.

SpaceCom/Space Congress (Orlando, Florida, USA, Jan 28 - 30, 2025) SpaceCom | Space Congress exclusively draws participation from the industry leaders and organizations with the power to drive new space strategies, fuel forward progress, signal demand for continued innovation, inform policy, and institute a sustainable future for commercial space. As host of Commercial Space Week, SpaceCom integrates the people, institutions, and solutions that ignite innovation– facilitating progress for every space mission.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 01.07.25

At a glance.

US Treasury Department sanctions Chinese cybersecurity firm.

US Department of Defense adds Tencent to its list of Chinese military companies.

Staten Island hospital notifies 674,000 people of data breach.

Notes.

Attacks, Threats, and Vulnerabilities

Trends

Marketplace

Products, Services, and Solutions

Newly Noted Events

Events