US Justice Department restricts bulk data sharing with certain countries.

Announcement

Dive deep into the cyber talent ecosystem.

Episode one of the new season of CISO Perspectives premieres tomorrow. Hosted by veteran CISO Kim Jones, CISO Perspectives returns with a sharper focus on people, leadership, and talent in cybersecurity—because success in cyber is about people, not just technology. Join Kim for candid discussions with industry leaders as they take on the tough questions shaping the future of the cybersecurity workforce. Listen to the trailer and get ready for episode one releasing tomorrow.

Summary

By the CyberWire staff

At a glance.

US Justice Department restricts bulk data sharing with certain countries.
Researchers warn of "Dangling DNS" subdomain takeovers.
ResolverRAT targets the healthcare industry.

US Justice Department restricts bulk data sharing with certain countries.

The US Justice Department has revealed a new Data Security Program establishing "export controls" for bulk data belonging to US citizens, Infosecurity Magazine reports. The initiative, which was enacted by a February 2024 executive order under the Biden administration, prohibits US data brokers from knowingly engaging in transactions with specified countries unless authorized by a license. The DOJ designated six "countries of concern" regarding the purchase of US data: China, Cuba, Iran, North Korea, Russia, and Venezuela.

The program went into effect last week, though the government said it will be lenient for the first ninety days as long as entities are engaging in "good faith efforts" to comply.

Enhance Your Network Security with Zero Trust!

IT pros, are you ready to fortify your defenses? Discover ThreatLocker® Network Control, a powerful Zero Trust host-based firewall with dynamic ACLs. Gain full visibility, granular control, and advanced filtering to secure your network like never before. Learn how to stop breaches, implement microsegmentation, and integrate seamlessly with the ThreatLocker Platform. Download the whitepaper now and get the insights you need to enhance your organization’s defenses!

Researchers warn of "Dangling DNS" subdomain takeovers.

SentinelOne warns of the risks posed by expired, unused, or misconfigured subdomains, a scenario known as "Dangling DNS." In many cases, attackers use these hijacked subdomains to "either produce a defaced message and attack your organization’s reputation and branding, or they could spoof a website that looks legitimate and deliver malware or attempt to steal credentials." SentinelOne adds that Dangling DNS can also lead to serious supply chain risks, citing an investigation by watchTowr into abandoned cloud storage buckets that could be hijacked by attackers.

Over the past year, SentinelOne identified "more than 1,250 instances of subdomain takeover risk due to deprovisioned cloud resources, and more than 650 instances of the risk identified due to other factors."

Only the Right Users, Only the Right Access—Is Your Security Strong Enough?

Secure Access is crucial for U.S. Public Sector missions, ensuring that only authorized users can access certain systems, networks, or data - are your defenses ready? Cisco's Security Service Edge delivers comprehensive protection for your network and users. Experience the power of zero trust and secure your workforce, wherever they are. Elevate your security strategy by visiting: cisco.com/go/sse.

ResolverRAT targets the healthcare industry.

Morphisec has published a report on "ResolverRAT," a new Trojan "that combines advanced in-memory execution, API and resource resolution at runtime, and layered evasion techniques." The malware is targeting multiple countries, delivered via phishing emails with region-specific themes. Notably, the researchers have observed a wave of attacks against entities in the healthcare and pharmaceutical sectors.

The researchers dubbed the RAT "Resolver" due to its "heavy reliance on runtime resolution mechanisms and dynamic resource handling, which make static and behavioral analysis significantly more difficult."

Many Voices. One Community.

Join Us at the RSAC 2025 Conference. Join us at RSAC, April 28 - May 1 in San Francisco and gain access to cybersecurity innovators, expert-led sessions, and hands-on workshops. Leave with new strategies, insights, and connections to elevate your cybersecurity journey.

Notes.

Today's issue includes events affecting China, Cuba, Iran, the Democratic People's Republic of Korea, Russia, the United States, and Venezuela.

Attacks, Threats, and Vulnerabilities

Fortinet: Hackers retain access to patched FortiGate VPNs using symlinks (BleepingComputer) Fortinet warns that threat actors use a post-exploitation technique that helps them maintain read-only access to previously compromised FortiGate VPN devices even after the original attack vector was patched.

Security Patches, Mitigations, and Software Updates

Microsoft: New Windows updates fix Active Directory policy issues (BleepingComputer) Microsoft has released emergency Windows updates to address a known issue affecting local audit logon policies in Active Directory Group Policy.

Trends

Global AI Adoption Statistics & Trends (AITools) Full-year AI Market Report by Web Visits Across 10500+ Tools, 2024

ThreatLabz Announces Findings From Its 2025 VPN Risk Report (Zscaler) Annual report highlights how unpatched VPNs fuel Ransomware attacks, underscoring the urgency for Zero Trust security.

Products, Services, and Solutions

ESET launches integration with Wazuh (ESET Newsroom) ESET, a global leader in cybersecurity solutions, is continuing to increase its number of integrations, this time, by connecting with Wazuh, a popular open-source security platform.

Legislation, Policy, and Regulation

Interior Department Ousts Key Cyber Leaders Amid DOGE Spat (Data Breach Today) The U.S. Department of Interior has reportedly removed several key cybersecurity and technology officials from their posts following a reported dispute with

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Protecting CISOs From Increasing Personal Liability Risk-Civil & Criminal Insurance Considerations (Columbia, Mar, USA, Apr 17, 2025) An in-depth discussion of CISO Liability to include the following: · Increasing accountability and claims events and trends facing CISOs · How D&O and Cyber policies differ · How CISOs are covered under one or both policies · Risk Management and best practices to maximize the value of the D&O policy and optimize policy performance in a claims scenario.

Community Event with The Cyber Guild - Book Club (Reston, Virginia, USA, Apr 17, 2025) Join the growing Cyber Guild Community - "where everyone wants to know your name " The Cyber Guild community is a growing network of cyber enthusiasts who are invested in building a sustainable cyber ecosystem.

RSA Innovation Sandbox 2025 (San Francisco, California, USA, Apr 28, 2025) RSA Conference 2025 marks 20 years for cybersecurity’s top innovation startup competition: RSAC Innovation Sandbox contest. The contest puts the spotlight on cybersecurity’s boldest new innovators while highlighting their potentially game-changing ideas. Hundreds of submissions are reviewed and narrowed down to only 10 finalists. The Top 10 Finalists will take the stage during RSA Conference 2025 and will have three minutes to make their award-winning pitch to a panel of leading industry experts. Since the start of the contest, the Top 10 Finalists have collectively seen over 90 acquisitions and over $16.4 billion in investments.*

RSA Conference 2025 (San Francisco, California, USA, Apr 28 - May 1, 2025) At RSAC 2025, you're not just attending a conference—you're stepping into a vibrant, thriving community of thinkers, innovators, and achievers. Though we come from different corners of the cybersecurity world, we are united by a common mission: to foresee risks, counter threats, and embrace the challenges ahead. Together, we shape the future of security. Together, we shine as one.

CYSAT (Paris, France, May 14 - 15, 2025) In today’s society, we heavily rely on space-based assets, and considering the continuously evolving cyber threats in the current geopolitical environment, securing space data is a major challenge. Since 2021, CYSEC has been organizing CYSAT to bring together all the players in the space cybersecurity domain.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 04.14.25

Dive deep into the cyber talent ecosystem.

At a glance.

US Justice Department restricts bulk data sharing with certain countries.

Researchers warn of "Dangling DNS" subdomain takeovers.

ResolverRAT targets the healthcare industry.

Notes.

Attacks, Threats, and Vulnerabilities

Security Patches, Mitigations, and Software Updates

Trends

Products, Services, and Solutions

Legislation, Policy, and Regulation

Events