APT41's backdoor campaign. Tax fraud season news. Shipping hack? Tech transfers. COVID-19 notes.

Today's issue includes events affecting Canada, China, Germany, India, Japan, Malaysia, Russia, United Kingdom, and United States.

Bring your own context.

What's up with distributed denial-of-service operations nowadays?

"I went in our system and pulled how many unique botnets we'd pulled out of the IoT DDoS space over the last few months. And we found 900 unique botnets in the last 90 days, over 10 per day. And so a lot of these folks are in the gaming community. They may be what a lot of security community people would categorize as script kiddies or teenagers focused on bravado with their friends. 

"But realistically, these things can cause substantive damage to businesses. They can take down infrastructure. They can really break things. And so the IoT space, the devices people have plugged in in their homes, there's still a massively large vulnerable pool. Exploits are still being released. And we do see actors including those new exploits in their scanners and in their distribution methods. So these things are still there. Thankfully, however, for the most part, they don't, on an individual-case basis, build enough firepower to take down major infrastructure." 

—Mike Benjamin, head of Black Lotus Labs at CenturyLink, on the CyberWire Daily Podcast, 4.10.20.

So a lot of it is from the skids, the script kiddies, the gaming bravos. But keep an eye on it. As the gentleman says, "these things can [still] cause substantive damage." And don't jump to conclusions about DDoS being the work of a nation-state. That guy the police in Utrecht collared the other day for hitting two of the Hague's websites was a nineteen-year-old, misspending his youth, time, and talent. Not a Bear, not a Panda, not a Kitten, just a guy.

CSO Perspectives, now available to CyberWire Pro subscribers.

CyberWire Pro, our new subscription program designed for security professionals and all others who want to stay abreast of cybersecurity news, launched a new offering this week: CSO Perspectives. This new service—available as both a weekly column and a podcast—features Rick Howard, the CyberWire's CSO, Chief Analyst and Senior Fellow, who offers an informed, nuanced perspective on the ideas, strategies and technologies that senior cybersecurity executives grapple with daily. Reevaluating the network defender's core tenets in the face of technological change and threat actors' evolving strategies and sorting through the deluge of marketing claims and buzzwords, CSO Perspectives will inform and challenge readers and listeners to think critically about cybersecurity. CSO Perspectives will also be available in the CyberWire Daily Podcast feed for its inaugural three weeks.