CISA and Cyber Command continue to describe Russian TTPs. China's Personal Information Protection Law. Calling out the Guard.

Summary

By the CyberWire staff

At a glance.

CISA, US Cyber Command, continue detailed warnings describing foreign intelligence services' cyber tools.
China's Personal Information Protection Law.
US governors interested in cooperative use of state's National Guard cyber units.

New CISA tutelage on Moscow malware.

CISA and US Cyber Command continue their practice of issuing public warnings against malware used by hostile foreign intelligence services. Yesterday the US Cybersecurity and Infrastructure Security Agency published two Malware Analysis Reports. One concerns the PowerShell script ComRAT—a tool favored by Russian APT Venomous Bear—and the other describes the Zebrocy backdoor, which the agency said is “used by a sophisticated cyber actor.” Security Affairs reports the malware has been deployed against several embassies, parliaments, and foreign affairs ministries.

Venomous Bear, first identified in 2007, attacks governments and businesses in Europe, Asia, North America, South America, the Middle East, and one-time Soviet states. Zebrocy is a known weapon of Moscow-connected APT Fancy Bear, and has been seen in European and Asian assaults. CISA recommends the following security measures: updating software, deactivating sharing services, limiting employee permissions, approaching attachments and removable media with skepticism, maintaining strong passwords and firewalls, scrubbing unneeded applications, and cultivating situational awareness. US Cyber Command congratulated the FBI and CISA on their efforts in a Halloween-themed tweet.

Update on Beijing’s Personal Information Protection Law.

JD Supra says China’s long-promised Personal Information Protection Law, the first of its kind in the country, was distributed for feedback last week. The law deals with end-to-end management of residents’ data, and applies to both foreign and domestic operations. Permissible grounds for data processing are expanded beyond consent to cover contracts, legal obligations, emergencies, and media activities. Data protection officer (DPO) and localization requirements are limited, personal information impact assessment (PIIA) regulations are formalized, and noncompliance penalties are increased from 1 to 50 million Yuan. Entities can also be blacklisted for jeopardizing Chinese interests. The remaining provisions generally align with the 2017 China Cybersecurity Law and other national guidelines. JD Supra describes the law as “a critical step forward,” saying it will probably take effect in the next two years.

Governors advocate facilitating their National Guards' cyber units' ability to work across state lines.

StateScoop reports that the National Governors' Association have endorsed measures in the pending National Defense Authorization Act (NDAA) that would clarify and expand the role of the National Guard in meeting cyber defense missions at the state and national level. Two provisions in the NDAA were of particular interest. One would direct the Department of Defense to develop guidance on how the Guard ought to cooperate with civilian agencies that share a cybersecurity mission. Such agencies might include CISA, the FBI, ISACs, and state fusion centers. The other would authorize the Army and Air Force to develop pilot programs in which one state's Guard might offer remote assistance to another state's Guard.

Selected Reading

Coming Storms: The Return of Great-Power War (Foreign Affairs) Since the closing days of the Cold War, U.S. policymakers, pundits, international relations scholars, and policy analysts have argued that great-power war is a relic of a bygone age.

China's Personal Information Protection Law: Legislative Update (JD Supra) Long-awaited legislation in China—the Personal Information Protection Law of the People’s Republic of China—was released for public consultation on...

What the IoT Cybersecurity Improvement Act of 2020 means for the future of connected devices (Help Net Security) The IoT Cybersecurity Improvement Act of 2020 is a landmark accomplishment for the IoT industry but is hopefully only just the beginning.

DoD unveils electromagnetic spectrum superiority strategy (C4ISRNET) The new strategy outlines five strategic goals for achieving superiority in the electromagnetic spectrum.

Cybersecurity policy is a must in government (TechRepublic) One policy expert says cybersecurity measures should be an expected item that comes with every purchase, like the safety measures in your car.

Senate hauls Zuckerberg, Dorsey into hearing to yell at them about tweets (Ars Technica) Big Tech's scale causes real problems. Disingenuous posturing solves none of them.

Governors endorse interstate cyber assistance in defense bill (StateScoop) The National Governors Association backed a proposal that would allow National Guard units to respond remotely to cyber incidents across state lines.

Changing the Scope of the CCPA (Lexology) The CPRA significantly changes the types of “businesses” that are subject to the CCPA by amending the criteria (e.g., gross revenue, scope of data…

Want to collaborate on cyber? Just ask, city officials say (StateScoop) Getting state and local governments to work together is all about knowing who to call and being persistent about it, speakers said during an online conference.

Facebook Antitrust Data-Hunt Gets Ground Rules From EU Court (Bloomberg) Facebook is suing EU over ‘irrelevant’ data demands in probes. Tech giant said data requests included risks to staff families.

Overstating the foreign threat to elections poses its own risks, U.S. officials and experts say (Washington Post) Iranian government-backed hackers last week pulled off a feat few were expecting. They became the first foreign adversary to interfere in the 2020 election by sending threatening emails to voters.

Russian cyber actors are targeting national parliaments and ministries of foreign affairs, US agencies warn (Computing) Hackers used ComRAT and Zebrocy malware in these attacks

US shares info on Russian malware used to target parliaments, embassies (BleepingComputer) US Cyber Command today shared information on malware implants used by Russian hacking groups in attacks targeting multiple ministries of foreign affairs, national parliaments, and embassies.

()

MAR-10310246-1.v1 – ZEBROCY Backdoor (CISA) This Malware Analysis Report (MAR) is the result of analytic efforts between the Cybersecurity and Infrastructure Security Agency (CISA) and the Cyber National Mission Force (CNMF). The malware variant, known as Zebrocy, has been used by a sophisticated cyber actor. CISA and CNMF are distributing this MAR to enable network defense and reduced exposure to malicious activity. This MAR includes suggested response actions and recommended mitigation techniques.

MAR-10310246-2.v1 – PowerShell Script: ComRAT (CISA) This Malware Analysis Report (MAR) is the result of analytic efforts between the Cybersecurity and Infrastructure Security Agency (CISA), the Cyber National Mission Force (CNMF), and the Federal Bureau of Investigation (FBI). The malware variant, known as ComRAT, has been used by Turla, a Russian-sponsored Advanced Persistent Threat (APT) actor. CISA, CNMF, and FBI are distributing this MAR to enable network defense and reduced exposure to malicious activity. This MAR includes suggested response actions and recommended mitigation techniques.