CryptoAPI proof-of-concept exploit. CISA warns chemical industry. Soldiers' families harassed. Phishing in Turtle Bay. Fleeceware update. Burisma hack.

CRN offers a rundown of opinion to the effect that reaction to CVE-2020-0601 has been “overblown,” and to be sure the NSA-disclosed Windows crypto flaw is not apocalyptic, but it’s nonetheless one that should be patched without delay. ZDNet reports that two proof-of-concept exploits of the CryptoAPI (Crypt32.dll) bug have already appeared. (And they add that the vulnerability is now being called “Curveball.”)

As the US and Iran continue their confrontation, no significant attacks from either side have come to public attention. But the US Cybersecurity and Infrastructure Security Agency (CISA) has cautioned the chemical industry that it could be subject to cyberattack, and offers advice on hardening itself against the threat.

Families of deployed US paratroopers are being harassed in social media. The source is unclear, the Military Times reports.

According to Threatpost and BleepingComputer, Cofense researchers determined that the United Nations sustained a phishing campaign designed to deliver Emotet and the TrickBot Trojan. The campaign, which apparently was less than fully successful, used emails spoofing the Norwegian Mission to deliver a malicious Word document.

Sophos finds more fleeceware apps in Google’s Play Store. Fleeceware automatically charges subscription fees if the user neglects to cancel when a “trial period” expires. Users often find that breaking up is harder to do than they expected, and the subscriptions can be pricey.

Moscow delivers its usual informational counterbattery fire in the Burisma hacking case, with Sputnik pooh-poohing the whole episode as a self-serving conspiracy theory launched by Hillary Clinton. So sez Sputnik.