CyberWire Daily

Palo Alto describes the Black Basta ransomware-as-a-service operation. Okta on Scatter Swine, the threat actor that compromised Twilio. Microsoft describes Nobelium's new approach to establishing persistence. Russia's war against Ukraine has induced stresses in the cyber underworld. LastPass discloses a security incident. Josh Ray from Accenture on cyber crime and the cost-of-living crisis. Our own Dave Bittner sits down with Chris Handman from TerraTrue to discuss how he works to transform legal teams into advocates and collaborators that can ensure privacy is baked in every step of the way. And CISA adds ten entries to its Known Exploited Vulnerabilities Catalog.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/165

Threat Assessment: Black Basta Ransomware (Palo Alto Networks Unit 42)

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone (Microsoft Threat Intelligence Center)

Microsoft Uncovers New Post-Compromise Malware Used by Nobelium Hackers (The Hacker News)

Microsoft: Russian hackers gain powerful 'MagicWeb' authentication bypass (ZDNET)

Detecting Scatter Swine: Insights into a relentless phishing campaign (Okta Security)

Twilio hackers hit over 130 orgs in massive Okta phishing attack (BleepingComputer)

Twilio says breach also compromised Authy two-factor app users (TechCrunch)

How the war in Ukraine is reshaping the dark web (New Statesman)

Notice of Recent Security Incident (The LastPass Blog)

LastPass Says Source Code Stolen in Data Breach (SecurityWeek)

LastPass developer systems hacked to steal source code (BleepingComputer)

Ukrainian and Russian cyber operations at six months. Oktapus criminal campaign compromises 9931 accounts in more than 130 organizations. Exotic Lily and Bumblebee Loader. Insights derived from DNS traffic. Chris Novak from Verizon on DHS Cyber Safety Review Board's report on the Log4j investigation that Verizon conducted. Dave Bittner sits down with our guest Dr. Scott Crowder, CTO and VP, Quantum Computing, Technical Strategy and Transformation for IBM Systems to discuss the increasingly urgent need for industries to prepare for security threats that quantum could unleash. And the US Department of Homeland Security shutters its Disinformation Governance Board.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/164

How Ukraine used Russia’s digital playbook against the Kremlin (POLITICO)

Ukraine's volunteer 'IT army' responds to Russian hackers, minister says (ABC News) 

Overview of the Cyber Weapons Used in the Ukraine - Russia War (Trustwave) 

How Russia-Ukraine cyberwar is impacting orgs: Two-thirds say they have been targeted (VentureBeat)

Twilio hackers breached over 130 organizations during months-long hacking spree (TechCrunch)

Roasting 0ktapus: The phishing campaign going after Okta identity credentials (Group-IB)

Bumblebee Malware Loader: Deep Instinct Prevents Attack Pre-Execution (Deep Instinct)

Akamai’s Insights on DNS in Q2 2022 (Akamai)

Following HSAC Recommendation, DHS terminates Disinformation Governance Board (US Department of Homeland Security)

Homeland Security Scraps Disinformation Board Attacked by GOP (Bloomberg)

A medical center near Paris comes under ransomware attack, and refuses to pay up. Lessons for the fifth domain from six months of hybrid war. Deepfake scams appear to have arrived. Deepen Desai from Zscaler with introduction to our audience. Dave Bittner sits down with Gil Hoffer, CTO and Co-founder of Salto to discuss “Who Hacked Slack?.” And Threat actors prepare to exploit Hikvision camera vulnerability.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/163

Cyber attackers disrupt services at French hospital, demand $10 million ransom (France 24)

French hospital hit by $10M ransomware attack, sends patients elsewhere (BleepingComputer)

DECLENCHEMENT DU PLAN BLANC DIMANCHE 21 AOUT 2022 (CHSF - Centre Hospitalier Sud Francilien)

Ukraine at D+181: Independence Day and six months of war. (CyberWire) 

Six months, twenty-three lessons: What the world has learned from Russia’s war in Ukraine (Atlantic Council) 

Hackers Used Deepfake of Binance CCO to Perform Exchange Listing Scams (Bitcoin News)

Hackers Use Deepfakes of Binance Exec to Scam Multiple Crypto Projects (Gizmodo) 

Binance's CEO said thousands of people are falsely claiming to be his employees on LinkedIn. Experts warn it's an example of the platform's growing problem with fake accounts. (Business Insider)

Twitter’s Ex-Security Head Files Whistleblower Complaint (Wall Street Journal)

Twitter is vulnerable to Russian and Chinese influence, whistleblower says (CNN)

Over 80,000 exploitable Hikvision cameras exposed online (BleepingComputer)

Experts warn of widespread exploitation involving Hikvision cameras (The Record by Recorded Future) 

Hikvision Surveillance Cameras Vulnerabilities (CYFIRMA)

Iranian APT data extraction tool described. LockBit gang comes under DDoS. Twitter whistleblower security claims made public. Poland and Ukraine conclude cybersecurity agreement. Greek national natural gas supplier under criminal cyberattack. Update to the Joint Alert on Zimbra exploitation. Addition to CISA's Known Exploited Vulnerabilities Catalog. Johannes Ullrich from SANS on Control Plane vs. Data Plane vulnerabilities. Our guest is David Nosibor, Platform Solutions Lead for UL to discuss SafeCyber Phase II. And, finally, targeting and trolling, with an excursus on Speedos. Really.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/162

New Iranian APT data extraction tool (Google)

LockBit gang hit by DDoS attack after Entrust leaks (Register) 

Former security chief claims Twitter buried ‘egregious deficiencies’ (Washington Post) 

Ex-Twitter exec blows the whistle, alleging reckless and negligent cybersecurity policies (CNN) 

Twitter’s Ex-Security Head Files Whistleblower Complaint (Wall Street Journal)

Deception, Bots, and Foreign Agents: The Twitter Whistleblower’s Biggest Allegations (Time)

The Ministry of Digital Transformation, State Service of Special Communication and Information Protection and the Council of Ministers of the Republic of Poland signed Memorandum of understanding in the cybersecurity field. (State Service of Special Communication and Information Protection) 

Greek natural gas operator suffers ransomware-related data breach (BleepingComputer) 

Greek gas operator refuses to negotiate with ransomware group after attack (The Record by Recorded Future)

Announcement | (DESF)

Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite (CISA) 

US government really hopes you've patched your Zimbra server (Register)

CISA Adds One Known Exploited Vulnerabilities to Catalog (CISA) 

Speedo-wearing Russian tourists leak defence secrets on Twitter (The Telegraph)

Bogus DDoS protection pages distribute malware. Estonia deals with DDoS attacks. Roskomnadzor's Internet panopticon. Rick Howard on the RSA Security Breach of 2011 and the Equifax breach of 2017. Caleb Barlow on what does a recession mean for cyber security venture capital and what is the impact of this on the industry? And data-tampering attacks are regarded as a growing risk.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/161

WordPress sites hacked with fake Cloudflare DDoS alerts pushing malware (BleepingComputer)

Fake DDoS Pages On WordPress Sites Lead to Drive-By-Downloads (Sucuri Blog)

Car blast kills daughter of Russian known as 'Putin's brain' (AP NEWS)

Russia blames Kyiv for killing daughter of ‘Putin’s Rasputin’, but the truth may be closer to home (The Telegraph)

Alexander Dugin's daughter killed by anti-war Russians: Former state deputy (Newsweek)

Estonia Repels Biggest Cyber-Attack Since 2007 (Infosecurity Magazine) 

Estonia's Battle Against a Deluge of DDoS Attacks (Infosecurity Magazine)

Latvia Starts Removing Soviet Monument in Challenge to Russia (Bloomberg)

Data-tampering attacks are a 'nightmare' threat that's hard to detect (Protocol)

Roya Gordon, a Security Research Evangelist at ICS cybersecurity firm Nozomi Networks, started her career as an intelligence specialist in the U.S. Navy. After her time serving, Roya spent time as a Control Systems Cybersecurity Analyst at the Idaho National Laboratory and then took the role of Cyber Threat Intelligence Manager at Accenture. She shares her story after the NSA accepted her and then quickly diverted, creating a new path for Roya to follow. She shares the jobs she went after along the way, leading up to Nozomi Networks and how she wishes to be a trailblazer for young black women everywhere. She hopes to shape young women's minds on what the cybersecurity industry is actually like, in hopes that she can be a figure people look up to. We thank Roya for sharing her story.

Dick O'Brien from Symantec, a part of Broadcom Software, joins Dave to discuss how the cyber-criminal operation, Clipminer Botnet, makes operators behind it at least $1.7 million. Symantec's research says "The malware being used, tracked as Trojan.Clipminer, has a number of similarities to another crypto-mining Trojan called KryptoCibule, suggesting it may be a copycat or evolution of that threat."

Symantec determined that the malware has the ability to mine for cryptocurrency using compromised computers’ resources. They also share a way to protect against the cyber-criminal operation, as well as sharing some indicators you could be compromised.

The research can be found here:

• Clipminer Botnet Makes Operators at Least $1.7 Million

Killnet claims a DDoS campaign against Estonia. The head of GCHQ calls Russian cyber operations a failure. US Cyber Command concludes its "hunt forward" mission in cooperation with Croatia. A criminal gang targets the travel and hospitality sectors. Thomas Pace of NetRise shares insights on firmware vulnerabilities. Daniel Floyd from BlackCloak on Quantifying the Business Need for Digital Executive Protection. CISA issues five ICS security advisories.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/160

Estonia says it repelled major cyber attack after removing Soviet monuments (Reuters)

There’s a chance regular people didn’t even notice: expert on Russian cyber attack (TVP World) 

Estonia says it repelled a major cyberattack claimed by Russian hackers. (New York Times)

The head of GCHQ says Vladimir Putin is losing the information war in Ukraine (The Economist)

Cyber Command deployed 'hunt forward' defenders to Croatia to help secure systems (The Record by Recorded Future)

U.S. Cyber Command completes defensive cyber mission in Croatia (CyberScoop)

You Can’t Audit Me: APT29 Continues Targeting Microsoft 365 (Mandiant)

Reservations Requested: TA558 Targets Hospitality and Travel (Proofpoint)

Cybercrime Group TA558 Ramps Up Email Attacks Against Hotels (Decipher)

CISA Adds Seven Known Exploited Vulnerabilities to Catalog (CISA) 

Siemens Linux-based Products (Update G) (CISA)

Siemens Industrial Products LLDP (Update B) (CISA)

Siemens OpenSSL Affected Industrial Products (CISA)

Mitsubishi Electric MELSEC Q and L Series (CISA)

Mitsubishi Electric GT SoftGOT2000 (CISA)

BlackByte is back. Iran suspected of cyber operations against four Israeli sectors. A look at wipers as a tool in hybrid war. A Russian cyber ops scorecard. Josh Ray from Accenture on how dark web actors are focusing on VPNs. Our guest is Corey Nachreiner from WatchGuard with findings of their latest Internet Security Report. Cyber war clauses coming to cyber insurance policies.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/159

BlackByte ransomware gang is back with new extortion tactics (BleepingComputer) 

Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors | Mandiant (Mandiant)

Russia-Ukraine cyberwar creates new malware threats  (VentureBeat)

Global Threat Landscape Report: A Semiannual Report by FortiGuard Labs (Fortinet) 

Overview of the Cyber Weapons Used in the Ukraine - Russia War (Trustwave SpiderLabs)

Lloyd’s sets requirements for state-backed cyber attack exclusions (Insurance Day)

A DDoS attack against a Ukrainian nuclear power provider. The US Army draws some lessons from the cyber phases of Russia's hybrid war. Vulnerabilities in Zimbra are undergoing widespread exploitation.Reports of new Lazarus Group activity. CISA releases eight ICS security advisories. Carole Theriault looks at scammers and cryptocurrencies. Our guest is Jennifer Reed from Aviatrix on the changing landscape of cloud security. And the SEC charges three with insider trading during the 2017 Equifax breach.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/158

Ukrainian Nuclear Operator Accuses Russians Hackers Of Attacking Its Website (RadioFreeEurope/RadioLiberty)

Ukraine nuclear power company says Russia attacked website (Al Jazeera)

Ukraine Nuclear Operator Reports Cyberattack on Its Website (The Defense Post)

How electronic warfare is reshaping the war between Russia and Ukraine (The Record by Recorded Future)

Army lesson from Ukraine war: cyber, EW capabilities not decisive on their own (FedScoop)

Learning from Ukraine, Army cyber schoolhouse focuses on electromagnetic spectrum (Breaking Defense)

Cyber and full-spectrum operations push the Great Power conflict left of boom (Breaking Defense)

Microsoft Exchange alternative Zimbra is getting widely exploited, 1000s hit (The Stack)

CISA Alert AA22-228A – Threat actors exploiting multiple CVEs against Zimbra Collaboration suit (CyberWire)

Threat Actors Exploiting Multiple CVEs Against Zimbra Collaboration Suite (CISA)

A signed Mac executable… (ESET)

Yokogawa CENTUM Controller FCS (CISA)

LS ELECTRIC PLC and XG5000 (CISA)

Delta Industrial Automation DRAS (CISA)

Softing Secure Integration Server (CISA)

B&R Industrial Automation Automation Studio 4 (CISA)

Emerson Proficy Machine Edition (CISA)

Sequi PortBloque S (CISA)

Siemens Industrial Products with OPC UA (CISA)

U.S. SEC charges 3 people with insider trading tied to Equifax hack (Reuters) 

SEC Charges Three Chicago-Area Residents with Insider Trading Around Equifax Data Breach Announcement (US Securities and Exchange Commission)

CISA and the Multi-State Information Sharing & Analysis Center, or MS-ISAC are publishing this joint Cybersecurity Advisory in response to active exploitation of multiple Common Vulnerabilities and Exposures against Zimbra Collaboration Suite, an enterprise cloud-hosted collaboration software and email platform.

AA22-228A Alert, Technical Details, and Mitigations

Volexity’s Mass Exploitation of (Un)authenticated Zimbra RCE: CVE-2022-27925

Hackers are actively exploiting password-stealing flaw in Zimbra

CISA adds Zimbra email vulnerability to its exploited vulnerabilities catal…

CVE-2022-27925 detail

Mass exploitation of (un)authenticated Zimbra RCE: CVE-2022-27925

CVE-2022-37042 detail

Authentication bypass in MailboxImportServlet vulnerability

CVE-2022-30333 detail

UnRAR vulnerability exploited in the wild, likely against Zimbra servers

Zimbra Collaboration Kepler 9.0.0 patch 25 GA release

Zimbra UnRAR path traversal

Operation EmailThief: Active exploitation of zero-day XSS vulnerability in…

Hotfix available 5 Feb for zero-day exploit vulnerability in Zimbra 8.8.15

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.

Microsoft identifies and disrupts Russian cyberespionage activity. An update on RedAlpha. An evil PLC proof-of-concept shows how programmable logic controllers could be "weaponized." Ben Yelin has an update on right to repair. Our guest is Arthur Lozinski of Oomnitza with a look at attack surface management maturity. And the Cl0p gang hits an English water utility (but tries to extort the wrong one–stuff happens, y’know?).

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/157

Disrupting SEABORGIUM’s ongoing phishing operations (Microsoft Security

Microsoft disrupts Russian-linked hackers targeting NATO countries (Breaking Defense) 

Microsoft Announces Disruption of Russian Espionage APT (SecurityWeek) 

Microsoft disrupts Russia-linked hacking group targeting defense and intelligence orgs (The Record by Recorded Future) 

Microsoft shuts down accounts linked to Russian spies (Register)

RedAlpha Conducts Multi-Year Credential Theft Campaign Targeting Global Humanitarian, Think Tank, and Government Organizations (Recorded Future)

Hackers linked to China have been targeting human rights groups for years (MIT Technology Review) 

Evil PLC Attack: Using a Controller as Predator Rather than Prey (Claroty)

Hackers attack UK water supplier but extort wrong victim (BleepingComputer)

South Staffordshire Water victim of cyber attack, customers not at risk (Computing) 

South Staffordshire Water says it was target of cyber attack as criminals bungle extortion attempt (Sky News)

Shuckworm maintains its focus on Ukrainian targets. Killnet's DDoS and dubious proof-of-work. Iron Tiger's supply chain campaign. TikTok and national security. Dinah Davis from Arctic Wolf shares insights on Dark Utilities. Rick Howard digs into identity management. And an arrest in the case of the Tornado Cash crypto mixer.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/156

Shuckworm: Russia-Linked Group Maintains Ukraine Focus (Symantec)

Killnet Releases 'Proof' of its Attack Against Lockheed Martin (SecurityWeek) 

Killnet greift lettisches Parlament an (Tagesspiegel)

Iron Tiger Compromises Chat Application Mimi, Targets Windows, Mac, and Linux Users (Trend Micro)

How Frustration Over TikTok Has Mounted in Washington (New York Times)

3 ways China's access to TikTok data is a security risk (CSO Online)

Arrest of suspected developer of Tornado Cash (FIOD)

Tornado Cash Developer Arrested After U.S. Sanctions the Cryptocurrency Mixer (The Hacker News)

Arrested Tornado Cash developer is Alexey Pertsev, his wife confirms (The Block)

Christian Lees, CTO at Resecurity, shares his story and insight on coming into the cybersecurity world. He considers himself a late bloomer because he did not go to college until he was 23. He wasn’t sure of what he wanted to do, and a family friend gave him a computer and the rest was history, he says. He fell in love with computers and started working at different companies trying to get ahead. He says it's not always textbook, and sometimes you just need to cut your teeth on something to get where you're going. Throughout his journey, he was constantly questioning whether he made the right decision, and in the end he says you have to be willing to "define friction points in it, you may join security field, not knowing what you're gonna do, but by being that curious person and breaking things and putting it back together, you'll find the right way and just never stop being curious." We thank Christian for sharing his story.

Cybercriminals are motivated by one simple incentive - money. Their favorite tools are bots to leverage sophistication, scalability, and ease of use. The effect is the creation of the underground bot ecosystem. This community allows threat actors to work together and continually improve their tactics. They sell bypasses for rule-based anti-bot solutions to other less technical fraudsters.

In this episode of CyberWire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined in the first half by Hash Table member Etay Maor. Cato Networks’ Senior Director Security Strategy. They discuss this reality that has put defenders at a serious disadvantage and the mitigation steps to consider for future attacks.. In the second half of the show, CyberWire podcast host Dave Bittner talks with our episode sponsor Kasada's founder Sam Crowther talking about what he saw first-hand as a red teamer at a major Australian bank and what inspired him to reimagine bot mitigation with the founding principle of undermining the attacker’s ROI.

Ashley Taylor from SANS.edu, joins Dave to discuss fake job ads and methods to proactively detect these scams. The research shares how job seekers are under attack, with scammers posing as fake job recruiters to steal information from people who are interested in the job posting. The brands being impersonated as are at risk of losing credibility to their brand identity.

The research shares exactly how these doppelgängers are posing a threat to job seekers and the best practices to detect these scams. It also shares how one company that works in medical device manufacturing industry has been a target for these scams. It concludes with sharing some of the ways to proactively spot these scams before they happen.

The research can be found here:

• Doppelgängers: Finding Job Scammers Who Steal Brand Identities

The optempo of the war's cyber phase, and Ukraine’s response. Organizing and equipping hacktivists. Joint warning on Zeppelin ransomware. Update on the DoNot Team, APT-C-35. Rewards for Justice offers $10 million for information on Conti operators. Rob Boyce from Accenture shares insights from BlackHat. Caleb Barlow ponders closing the skills gap while shifting to remote work. And, hey, Mr. Target: pick one, OK?

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/155

Black Hat 2022‑ Cyberdefense in a global threats era (WeLiveSecurity)

How one Ukrainian ethical hacker is training 'cyber warriors' in the fight against Russia (The Record by Recorded Future)

#StopRansomware: Zeppelin Ransomware (CISA)

APT-C-35: New Windows Framework Revealed (Morphisec)

The US Offers a $10M Bounty for Intel on Conti Ransomware Gang (Wired)

Zeppelin ransomware functions as a ransomware-as-a-service (RaaS), and since 2019, actors have used this malware to target a wide range of businesses and critical infrastructure organizations. Actors use remote desktop protocol (RDP), SonicWall firewall vulnerabilities, and phishing campaigns to gain initial access to victim networks and then deploy Zeppelin ransomware to encrypt victims’ files.

AA22-223A Alert, Technical Details, and Mitigations

Zeppelin malware YARA signature

What is Zeppelin Ransomware? Steps to Prepare, Respond, and Prevent Infection

Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts.

No-cost cyber hygiene services: Cyber Hygiene Services and Ransomware Readiness Assessment.

This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed TTPs and IOCs to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.

KillMilk says his crew downed Lockheed Martin's website. Industroyer2, and what became of it. CISA releases its election cybersecurity toolkit. Post-incident disruption at Britain’s NHS. Carl Wright of AttackIQ shares strategies for CISOs to successfully prepare for the next attack. Dr. Christopher Pierson from Blackcloak joins us from Black Hat. And Cisco seems to have thwarted a security incident.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/154

Russian hacking group claims attack on Lockheed Martin (SiliconANGLE

HIMARS-Maker Lockheed Martin "confident" against Russian hackers (Newsweek)

Industroyer2: How Ukraine avoided another blackout attack (SearchSecurity)

Researchers Look Inside Russian Malware Targeting Ukrainian Power Grid (PCMAG)

CISA Releases Toolkit of Free Cybersecurity Resources for Election Community (CISA)

Cybersecurity Toolkit to Protect Elections (CISA) 

NHS staff told to plan for three weeks of disruption following cyberattack (Computing)

Major NHS IT outage to last for three weeks (The Independent)

Exclusive: NHS chiefs fear cyber attackers have accessed patient data (Health Service Journal) 

Cisco Event Response: Corporate Network Security Incident (Cisco)

Cisco Talos shares insights related to recent cyber attack on Cisco (Cisco Talos)

Cisco confirms May attack by Yanluowang ransomware group (The Record by Recorded Future)

Cisco Hit by Cyberattack From Hacker Linked to Lapsus$ Gang (Bloomberg)

Cisco's own network compromised by gang with Lapsus$ links (Register) 

Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen (BleepingComputer)

Patch notes, and the risks associated with failure to patch. Finland's parliament comes under cyberattack. Killnet says there will be blood, but they may just be grandstanding for the home crowd. Cyberattacks against a UK firm that's criticized Russia's war. We’re joined by FBI Cyber Division AD Bryan Vorndran and Adam Hickey, deputy assistant attorney general for the National Security Division with an introduction to Watchguard. Our guest is Matthew Warner from Blumira with tips on avoiding burnout. And not all criminal organizations are working for Russia.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/153

Already Exploited Zero-Day Headlines Microsoft Patch Tuesday (SecurityWeek) 

Microsoft August 2022 Patch Tuesday fixes exploited zero-day, 121 flaws (BleepingComputer).

IBM Patches High-Severity Vulnerabilities in Cloud, Voice, Security Products (SecurityWeek)

Adobe Patch Tuesday: Code Execution Flaws in Acrobat, Reader (SecurityWeek) 

ICS Patch Tuesday: Siemens, Schneider Electric Fix Only 11 Vulnerabilities (SecurityWeek) 

VMSA-2022-0022 (VMware) 

Emerson OpenBSI (CISA) 

Emerson ControlWave (CISA)

Mitsubishi Electric GT SoftGOT2000 (CISA) 

Multiple attackers increase pressure on victims, complicate incident response (Sophos News)

Life After Death—SmokeLoader Continues to Haunt Using Old Vulnerabilities (Fortinet Blog) 

NBI launches probe into attack on Finnish Parliament site (Yle)

Russian hacker warns cyberwarfare will turn deadly (Newsweek) 

Russian hacker warns cyberwarfare will turn deadly (Newsweek)

Suspected Russian cyber attack on British soil as firm subjected to ‘daily’ hacks (The Telegraph)

Meet DUMPS Forum: A pro-Ukraine, anti-Russia cybercriminal forum | Digital Shadows (Digital Shadows)

Tracking apparent Chinese industrial cyberespionage. Tornado Cash sanctions. Twilio discloses a breach. Social engineering exposes data at Klaviyo. Microsoft’s Ann Johnson previews the latest season of Afternoon Cyber Tea. Joe Carrigan tracks the growth in cryptojacking. And what might the Mounties be monitoring?

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/152

Cyberspying Aimed at Industrial Enterprises in Russia and Ukraine Linked to China (SecurityWeek)

China-linked spies used six backdoors to steal defense info (Register)

U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash (U.S. Department of the Treasury)

Twilio hacked by phishing campaign (TechCrunch)

Twilio, a texting platform popular with political campaigns, reports breach (CyberScoop)

Incident Report: Employee and Customer Account Compromise - August 4, 2022 (Twilio Blog)

Email marketing firm hacked to steal crypto-focused mailing lists (BleepingComputer)

RCMP has used spyware to access targets’ communications as far back as 2002: Senior Mountie (Global News)

RCMP says it has not used Pegasus spyware (POLITICO)

In order to run a successful SOC, security leaders rely on tools with different strengths to create layers of defense. This has led to a highly siloed industry with over 2,000 vendors, each with their own specific function and who very seldom work together. To gain an advantage on attackers, we need to start seeing cybersecurity as a team sport–united for a shared mission.

In this episode of CyberWire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined in the first half by two Hash Table members, Ted Wagner, CISO at SAP National Security Services, and Jenn Reed, CISO at Aviatrix. In the second half of the show, CyberWire podcast host Dave Bittner talks with our episode sponsor ExtraHop's Senior Product Marketing Manager, Chase Snyder, and CrowdStrike's Head of Product Marketing, Janani Nagarajan .They discuss why and how vendors should work together to enable better integrated security for their customers. They’ll answer questions like “what is XDR?” and “how do I get my vendors to work together?”. 

Shifting cyber threats during Russia's war against Ukraine. A Twitter exploit may have compromised more than 5 million accounts. A Cyberattack disrupts NHS 111. Developments in the C2C market. An alleged Russian cryptocurrency exchange operator is extradited to the US. Rick Howard looks at FinTech. Andrea Little Limbago from Interos on Industrial policy and the tech divide. And a Crypto mixing service has been sanctioned by the US Treasury Department.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/151

ESET Threat Report T 1 2022 (WeLiveSecurity) 

Twitter confirms zero-day used to expose data of 5.4 million accounts (BleepingComputer)

NHS 111 software outage confirmed as cyber-attack (BBC News) 

Ministers coordinate response after cyber-attack hits NHS 111 (the Guardian)

Thousands of hackers flock to 'Dark Utilities' C2-as-a-Service (BleepingComputer)

Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns (Cisco Talos)

Genesis Brings Polish to Stolen-Credential Marketplaces (Sophos)

Cyber-related Designation (U.S. Department of the Treasury)

U.S. imposes sanctions on virtual currency mixer Tornado Cash (Reuters)

Crypto Mixing Service Tornado Cash Blacklisted by US Treasury (CoinDesk)

Alleged Russian Cryptocurrency Money Launderer Extradited to United States (US Department of Justice)

Russian accused of money laundering and running $4B bitcoin exchange extradited to US | CNN Politics (CNN)

Anna Belak, Director of Thought Leadership at Sysdig, shares her story from physics to cyber. Anna explains how she went into college with the thinking of getting a physics degree and then for her PhD decided to switch to material science and engineering. Both were not something she enjoyed and ultimately decided to go into cyber. She shares some advice on how you should never limit yourself to your degree, as well as always learning new skills and honing in on skills you already have. She say's by doing these things it will make you into a unicorn, meaning if you are good at one thing and teach yourself to be good at something else, you will become that much more valuable. Anna hopes she makes an impact with the people she works with, she hopes they will want to work with her even long after she leaves a company. We thank Anna for sharing her story.

Deepen Desai from Zscaler's ThreatLabz joins Dave to discuss how APTs, like Lyceum Group, create tactics and malware to carry out attacks against their targets. The Lyceum group has been active since 2017 and is a state-sponsored Iranian APT group. This group targets Middle Eastern organizations most notably in the energy and telecommunication sectors, and they rely heavily on .NET based malwares.

Zscaler said in their research they "recently observed a new campaign where the Lyceum Group was utilizing a newly developed and customized .NET based malware targeting the Middle East by copying the underlying code from an open source tool." They go on to give an analysis explaining why the .NET based DNS backdoor is causing problems.

The research can be found here:

• Lyceum .NET DNS Backdoor

CyberFront Z's failed influence operation. Iranian operators target Albanian government networks. CISA issues two ICS security advisories. Andy Robbins of SpecterOps to discuss Attack Paths in Azure. Denis O'Shea of Mobile Mentor talking on the intersection of endpoint security and employee experience. CISA and ACSC issue a joint advisory on top malware strains.

for links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/150

Quarterly Adversarial Threat Report (Meta)

Meta took down Russian troll farm that supported country’s invasion of Ukraine (The Hill)

Russia's Infamous Troll Farm Is Back -- and Sh*tting the Bed (Rolling Stone) 

Meta’s threat report highlights clumsy attempt to manipulate Ukraine discourse (TechCrunch) 

Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations (Mandiant) 

CISA Alert AA22-216A – 2021 top malware strains. (The CyberWire)

2021 Top Malware Strains (CISA)

Digi ConnectPort X2D (CISA)

Cisco Releases Security Updates for RV Series Routers (CISA)

Ukraine claims to have taken down a massive Russian bot farm. Russian cyber operations may have been premature. A report says Emergency Alert Systems might be vulnerable to hijacking. The Mirai botnet may have a descendant. Adam Flatley from Redacted with a look back at NotPetya. Ryan Windham from Imperva takes on Bad Bots. Attacks on a cryptocurrency exchange attempt to bypass 2FA. Solana cryptocurrency wallets looted.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/149

Ukraine takes down 1,000,000 bots used for disinformation (BleepingComputer)

Did Russia mess up its cyberwar with Ukraine before it even invaded? (Washington Post) 

So RapperBot, What Ya Bruting For? (Fortinet Blog)

Gaming Respawned (Akamai)

Coinbase Attacks Bypass 2FA (Pixm Anti-Phishing)

Thousands of Solana wallets drained in multimillion-dollar exploit (TechCrunch)

Thousands of Solana Wallets Hacked in Crypto Cyberattack (Wall Street Journal) 

Solana, USDC Drained From Wallets in Attack (Decrypt) 

Ongoing solana attack targets thousands of crypto wallets, costing users more than $5 million so far (CNBC) 

Solana and Slope Confirm Wallet Security Breach (Crypto Briefing)

How Hackers Target Bridges Between Blockchains for Crypto Heists (Wall Street Journal)

This joint Cybersecurity Advisory was coauthored by CISA and the Australian Cyber Security Centre, or ACSC. This advisory provides details on the top malware strains observed in 2021.

AA22-216A Alert, Technical Details, and Mitigations

For alerts on malicious and criminal cyber activity, see the FBI Internet Crime Complaint Center webpage.

For more information and resources on protecting against and responding to ransomware, refer to StopRansomware.gov, a centralized, U.S. Government webpage providing ransomware resources and alerts.

The ACSC recommends organizations implement eight essential mitigation strategies from the ACSC’s Strategies to Mitigate Cyber Security Incidents as a cybersecurity baseline. These strategies, known as the “Essential Eight,” make it much harder for adversaries to compromise systems.

Refer to the ACSC’s practical guides on how to protect yourself against ransomware attacks and what to do if you are held at ransom at cyber.gov.au.

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at central@cisa.dhs.gov or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or CyWatch@fbi.gov.

Tories delay a leadership vote over security concerns. A summary of the cyber phases of the hybrid war. Cyberattacks affect three official sites in Taiwan. Malware designed to abuse trust. Gunter Ollmann of Devo to discuss how Cybercriminals are Winning the AI Race. Renuka Nadkarni of Aryaka explains enterprises can recession proof security architecture. Plus, putting a price on your privacy.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/148

Tory leadership vote delayed after GCHQ hacking alert (The Telegraph) 

Nozomi Networks Labs Report: Wipers and IoT Botnets Dominate the Threat Landscape – Manufacturing and Energy at Highest Risk (Nozomi Networks) 

Those Pelosi-inspired cyberattacks in Taiwan probably weren't all they were cracked up to be (Washington Post)

Increase in Chinese "Hacktivism" Attacks (SANS Internet Storm Center)

Cyberattacks crashed several Taiwanese government websites hours before Pelosi’s visit. (New York Times)

Taiwan presidential office website hit by cyberattack ahead of Pelosi visit (POLITICO) 

Taiwanese government sites disrupted by hackers ahead of Pelosi trip (The Record by Recorded Future)

Deception at a scale (VirusTotal)

The Price Cybercriminals Charge for Stolen Data (SpiderLabs Blog)

Nomad cryptocurrency bridge is looted. The BlackCat ransomware gang hits a Luxembourgeois energy company. DSIRF disputes Microsoft's characterization of the Austrian firm as cyber mercenaries. Ben Yelin looks at privacy concerns in the education software market. Our guest is PJ Kirner from Illumio to discuss Zero Trust Segmentation. And, finally, are there spies under Mr. Putin’s very very long table?

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/147

Crypto Firm Nomad Loses Nearly $200 Million in Bridge Hack (Bloomberg) 

Crypto Bridge Nomad Drained of Nearly $200M in Exploit (CoinDesk)

Nomad token bridge drained of $190M in funds in security exploit (Cointelegraph) 

Nomad token bridge hacked in nearly $200 million exploit (mint) 

BlackCat ransomware gang hits Luxembourg energy supplier Creos (Computing)

Luxembourg energy provider Encevo Group battles ransomware attack by BlackCat (Tech Monitor)

BlackCat ransomware claims attack on European gas pipeline (BleepingComputer)

Luxembourg energy companies struggling with alleged ransomware attack, data breach (The Record by Recorded Future)

Austrian spy firm accused by Microsoft says hacking tool was for EU states (Reuters)

Dilyana Gaytandzhieva: Putin’s Elite Inner Circle Infiltrated By Nato Informants (SouthFront)

GEC Special Report: Pillars of Russia’s Disinformation and Propaganda Ecosystem (US Department of State)

KillNet threatens hack-and-leak op against HIMARS maker. Online investment scams hit Europe. Microsoft associates Raspberry Robin with EvilCorp. Rick Howard previews season ten of the CSO Perspectives podcast. Our guest is Nate Kharrl of SpecTrust on deploying fraud detection at the gateway. And a heartfelt farewell to a woman who’s inspiration lives on.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/146

Cyberactivist Group Killnet Declares War on Lockheed Martin (Sputnik)

Russian Hackers Target U.S. HIMARS Maker in 'New Type of Attack': Report (Newsweek)

Founder of pro-Russian hacktivist Killnet quitting group (SC Magazine) 

Huge network of 11,000 fake investment sites targets Europe (BleepingComputer)

Microsoft links Raspberry Robin malware to Evil Corp attacks (BleepingComputer) 

Microsoft ties novel ‘Raspberry Robin’ malware to Evil Corp cybercrime syndicate (The Record by Recorded Future)

FakeUpdates malware delivered via Raspberry Robin has possible ties to EvilCorp (SC Magazine)

Ransomware-as-a-service: Understanding the cybercrime gig economy and how to protect yourself (Microsoft Security)

Australia charges dev of Imminent Monitor RAT used by domestic abusers (BleepingComputer) 

Brisbane teenager built spyware used by domestic violence perpetrators across world, police allege (the Guardian)

Larry Cashdollar, Principal Security Intelligence Response Engineer at Akamai Technologies, sits down with Dave Bittner to discuss his life leading up to working at Akamai. He shares his story from his beginnings to now, describing what college life was like as a young computer enthusiast. He says "If you look at my 1986 yearbook, I think it was my sixth grade class, it says computer scientist for my career path. So I had a love of computers when I was really young. I guess I knew what field I wanted to get into right off the bat." He describes different career paths that all led him to his current position. He also shares his love for computers and technology through the decades of his youth, and how he is learning, even now. We thank Larry for sharing his story.

Israel Barak, CISO from Cybereason, sits down with Dave to discuss their research, "Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation." Cybereason researchers recently found an attack lurking beneath the surface which was assessed to be the work of Chinese APT Winnti. Cybereason briefed the FBI and the DOJ on the investigation into the malicious campaign.

The research states, "For years, the campaign had operated undetected, siphoning intellectual property and sensitive data." The team quickly made two reports on the campaign, one sharing an examination on the tactics and techniques. The second gives a detailed analysis of the malware and exploits used.

The research can be found here:

• Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation

Anonymous's hacktivism in a hybrid war. Pyongyang's [un]H0lyGh0st. Phishing in the IPFS. Update on the initial access criminal-to-criminal market and its effect on MSPs. Cyber gangs move away from malicious macros. Thomas Etheridge from CrowdStrike on managed detection and response. Rick Howard sits down with Art Poghosyan from Britive to discuss DevSecOps and Identity Management. And Rewards for Justice seeks some righteous snitches.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/145

Putin 'embarrassed' as hackers launch cyber war on Russian President over Ukraine invasion (Express.co.uk)

Is Anonymous Rewriting the Rules of Cyberwarfare? Timeline of Their Attacks Against the Russian Government (Website Planet) 

HolyGhost’s Bargain Basement Approach To Ransomware (Digital Shadows)

IPFS: The New Hotbed of Phishing (Trustwave)

Threat Advisory: Hackers Are Selling Access to MSPs (Huntress) We’re currently monitoring a situation that entails a hacker selling access to an MSP with access to 50+ customers, totaling 1,000+ servers.

Experts warn of hacker claiming access to 50 U.S. companies through breached MSP (The Record by Recorded Future)

How Threat Actors Are Adapting to a Post-Macro World (Proofpoint)

Rewards for Justice – Reward Offer for Information on Russian Interference in U.S. Elections (United States Department of State)

SSSCIP and CISA sign a memorandum of cooperation. Are private-sector offensive actors tailored security services, or are they just hired guns? Bringing cyber mercenaries to heel. Malek Ben Salem from Accenture on why crisis management is at the heart of ransomware resilience. Our guest is Derek Manky from Fortinet on the World Economic Forum Partnership Against Cybercrime. And more credential-harvesting scams are out in the wild.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/144

United States and Ukraine Expand Cooperation on Cybersecurity (CISA)

US, Ukraine sign pact to expand cooperation in cyberspace (The Hill)

Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits (Microsoft Security)

Continuing the fight against private sector cyberweapons (Microsoft On the Issues)

Experts Urge Congress to Pressure Commercial Spyware Vendors (Decipher)

Mirroring Actual Landing Pages for Convincing Credential Harvesting (Avanan)

IBM reports on the cost of a data breach. Personal apps as a potential business risk. Over on the dark side, there’s help wanted in the C2C labor market. An employee engagement study reaches predictably glum conclusions. Betsy Carmelite from Booz Allen Hamilton on reducing software supply chain risks with SBOMs. Our guest is Elaine Lee from Mimecast discussing the pros and cons of AI in cybersecurity. And Why so much attempted DDoS, but not so much ransomware?

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/143

IBM Report: Consumers Pay the Price as Data Breach Costs Reach All-Time High (IBM Newsroom)

Cost of a Data Breach Report 2022 (IBM Security)

Netskope Threat Research: Data Sprawl Creating Risk for Organizations Worldwide as Personal App Use in Business Continues to Rise (PR Newswire)

Financial Incentives May Explain the Perceived Lack of Ransomware in Russia’s Latest Assault on Ukraine (Council on Foreign Relations)

Tessian | 1 in 3 Employees Do Not Understand the Importance of Cybersecurity at Work, According to New Report (RealWire)

LockBit gets an upgrade. CosmicStrand firmware rootkit is out in a new and improved version. Are thieves being treated like white hats? AV-Test's Twitter account is hijacked. Joe Carrigan considers the mental health effects of the online scam economy. Mr. Security Answer Person John Pescatore ponders the cybersecurity talent gap. And ongoing speculation on the cyber phase of the hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/142

LockBit Ransomware Group Augments Its Latest Variant, LockBit 3.0, With BlackMatter Capabilities (Trend Micro)

CosmicStrand: the discovery of a sophisticated UEFI firmware rootkit (Securelist)

Crypto Firms Make Thieving Hackers an Offer: Keep a Little, Give Back the Rest (Wall Street Journal)

Phishers’ Favorites Top 25, H1 2022: Microsoft Is the Most Impersonated Brand in Phishing Attacks (Vade Secure)

Testing times for AV-Test as Twitter account hijacked by NFT spammers (Graham Cluley)

Ukraine fall-out and new ransomware tactics elevate cyber risks (Strategic Risk Europe)

Ed’s note: The Ukrainian-Russian cyber war no one speaks about (Smart Energy)

The minor mystery of GPS-jamming. Twitter investigates an apparent data breach. Ransomware command and control staging is discovered. Andrea Little Limbago from Interos looks at the intersection of social sciences and cyber. Our guest is Nelly Porter from Google Cloud on the emerging idea of confidential computing. A C2C offering restricted to potential privateers.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/141

Why Isn’t Russia jamming GPS harder in Ukraine? (C4ISRNet)

Twitter data breach exposes contact details for 5.4M accounts; on sale for $30k (9to5Mac)

Twitter investigating authenticity of 5.4 million accounts for sale on hacking forum (The Record by Recorded Future)

Russian Ransomware C2 Network Discovered in Censys Data (Censys)

Researcher finds Russia-based ransomware network with foothold in U.S. (The Record by Recorded Future)

New Cross-Platform 'Luna' Ransomware Only Offered to Russian Affiliates (SecurityWeek) 

Mary Writz, Vice President of Product Strategy at ForgeRock, shares how each career path she has taken has led her to where she is now. Mary describes how she has been a woman working in a male dominated field for most of her career and how she had to take charge, and she had to get the men to take charge with her. She says "I was often leading people, mostly men older than me, potentially smarter than me, more well paid than me. So I had to learn how to think about galvanizing this group to charge forward with me, even though I was a bit of a minority in that way." She also states that she tells herself to always make a positive out of a negative by showing people how you can respond to what's happening with a lot of energy, focus, and care and that's what got her to where she is today.

Shifting left has been a buzzword in the application security space for several years now, and with good reason – making security an integral part of development is the only practical approach for modern agile workflows. But in their drive to build security testing into development as early as possible, many organizations are neglecting application security in later phases and losing sight of the big picture. In this episode of CyberWire-X, the CyberWire's CSO, Chief Analyst, and Senior Fellow, Rick Howard, talks with two Hash Table members, Centene’s VP and CISO for Healthcare Enterprises, Rick Doten, and Akamai’s Advisory CISO, Steve Winterfeld. In the second half of the show, CyberWire podcast host Dave Bittner talks with our episode sponsor Invicti’s Chief Product Officer, Sonali Shah. They discuss the challenges and misunderstandings around shifting left, and provide tips on how organizations can implement web application security program without tradeoffs throughout the whole application security lifecycle.

Rob Pantazopoulos from Secureworks, joins Dave to discuss their work on "REvil Development Adds Confidence About GOLD SOUTHFIELD Reemergence." Secureworks researchers published a new analysis on what can be considered the ‘first’ set of ransomware samples associated with the reemergence. These updated samples indicate that GOLD SOUTHFIELD has resumed operations.

The research states "The identification of multiple samples containing different modifications and the lack of an official new version indicate that REvil is under active development." Researchers identified two samples, one in October of 2021, and the other in March of 2022. The March sample has modifications that lead researchers to distinguish the two samples from one another.

The research can be found here:

• REvil Development Adds Confidence About GOLD SOUTHFIELD Reemergence

Traditional espionage and counterespionage during the hybrid war. Assessing Russian cyberattacks. Conti's fate and effects. Investigating cut Internet cables in France. My conversation with AD Bryan Vorndran of the FBI Cyber Division on reverse webshell operation and Hafnium. Our guest is Tom Kellermann of VMware to discuss the findings of their Modern Bank Heists report. And, finally the dark online world of “pig-butchering.”

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/140

UK Spy Chief Sees Russia’s Military Running ‘Out of Steam’ Soon (Bloomberg)

Exhausted Russian army gives Ukraine chance to strike back, says British spy chief (The Telegraph) 

'Cut by half' Putin's masterplan backfires as 400 Russian spies thrown out of Europe (Express) 

Half of Russian spies in Europe expelled since Ukraine invasion, says MI6 chief (the Guardian) 

MI6 chief: Russia’s spies ‘not having a great war’ in Ukraine (The Record by Recorded Future) 

CIA chief says 15,000 Russians killed in war, dismisses Putin health rumors (Washington Post) 

CIA Chief Says Russia’s Iran Drone Deal Shows Military Weakness (Bloomberg) 

Ukraine confronts Kremlin infiltration threat at unreformed state bodies (Atlantic Council) 

US seeking to understand Russia’s failure to project cyber power in Ukraine (Defense News)

Battling Moscow's hackers prior to invasion gave Kyiv 'full dress rehearsal' for today's cyber warfare (CyberScoop)

How Conti ransomware hacked and encrypted the Costa Rican government (BleepingComputer) 

Anatomy of Attack: Truth Behind the Costa Rica Government Ransomware 5-Day Intrusion (AdvIntel) 

Conti Criminals Resurface as Splinter RaaS Groups  (Security Boulevard)

The Unsolved Mystery Attack on Internet Cables in Paris (Wired) 

Massive Losses Define Epidemic of ‘Pig Butchering’ (KrebsOnSecurity)

A criminal talent broker emerges. Developing threats to financial institutions. Phishing through PayPal. Lessons to be learned from LAPSUS$, post-flameout. More spearphishing of Ukrainian targets. US Cyber Command releases IOCs obtained from Ukrainian networks. Johannes Ullrich from SANS on the value of keeping technology simple. Our guests are Carla Plummer and Akilah Tunsill from the organization Black Girls in Cyber. And not really honor, but honor’s self-interested first cousin.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/139

Atlas Intelligence Group (A.I.G) – The Wrath of a Titan (Cyberint)

'AIG' Threat Group Launches With Unique Business Model (Dark Reading)

Buy, Sell, Steal, EvilNum Targets Cryptocurrency, Forex, Commodities (Proofpoint)

Sending Phishing Emails From PayPal (Avanan) 

Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group (Tenable®)

Evacuation and Humanitarian Documents used to Spear Phish Ukrainian Entities (Mandiant)

Cyber National Mission Force discloses IOCs from Ukrainian networks (U.S. Cyber Command) 

The Evolution of Cybercrime: Why the Dark Web is Supercharging the Threat Landscape and How to Fight Back (HP Wolf Security)

What’s Russia up to in cyberspace, nowadays? Belgium accuses China of cyberespionage. LockBit ransomware spreading through compromised servers. Malek Ben Salem from Accenture explains the Privacy Enhancing Technologies of Federated Learning with Differential Privacy guarantees. Rick Howard speaks with Rob Gurzeev from Cycognito on Data Exploitation. And Micodus GPS tracker vulnerabilities should motivate the user to turn the thing off.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/138

Continued cyber activity in Eastern Europe observed by TAG (Google)

Declaration by the High Representative on behalf of the European Union on malicious cyber activities conducted by hackers and hacker groups in the context of Russia’s aggression against Ukraine (European Council)

China: Declaration by the Minister for Foreign Affairs on behalf of the Belgian Government urging Chinese authorities to take action against malicious cyber activities undertaken by Chinese actors (Federal Public Service Foreign Affairs) 

Déclaration du porte-parole de l'Ambassade de Chine en Belgique au sujet de la déclaration du gouvernement belge sur les cyberattaques (Embassy of the People's Republic of China in the Kingdom of Belgium)

LockBit: Ransomware Puts Servers in the Crosshairs (Broadcom Software Blogs | Threat Intelligence)

Critical Vulnerabilities Discovered in Popular Automotive GPS Tracking Device (MiCODUS MV720) (BitSight)

CISA released Security Advisory on MiCODUS MV720 Global Positioning System (GPS) Tracker (CISA)

A Cozy Bear sighting. Shaking up Ukraine's intelligence services. Albania's national IT networks continue to work toward recovery. US Justice Department seizes $500k from DPRK threat actors. The FBI warns of apps designed to defraud cryptocurrency speculators. A White House meeting today addresses the cyber workforce. Ben Yelin looks at our right to record police. Our guest is Tim Knudsen, Director of Product Management for Zero Trust at Google Cloud, speaking with Rick Howard. And another trend we’d like to be included out of.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/137

Russian APT29 Hackers Use Online Storage Services, DropBox and Google Drive (Unit 42)

Russian hacking unit Cozy Bear adds Google Drive to its arsenal, researchers say (CyberScoop)

Russian SVR hackers use Google Drive, Dropbox to evade detection (BleepingComputer) 

Ukraine’s spy problem runs deeper than Volodymyr Zelensky’s childhood friend (The Telegraph) 

Albanian government websites go dark after cyberattack (Register) 

On Google Play, Joker, Facestealer, & Coper Banking Malware (Zscaler) 

Justice Department seizes $500K from North Korean hackers who targeted US medical organizations (CNN) 

Cyber Criminals Create Fraudulent Cryptocurrency Investment Applications to Defraud US Investors (US Federal Bureau of Investigation)

Announcement of White House National Cyber Workforce and Education Summit | The White House (The White House)

Fortinet Announces Free Training Offering for Schools at White House Cyber Workforce and Education Summit (Fortinet)

Not your average side hustle: the women making thousands from 'pay pigs' who enjoy being financially dominated (Business Insider)

Ukraine shakes up its security and prosecutorial services. Cyberattacks hit Albania. Advanced persistent threat actors prospect journalists. The GRU is said to be trolling researchers who look into Sandworm. Thomas Etheridge from CrowdStrike on identity management. Our guest is Robin Bell from Egress discussing their Human Activated Risk Report. And CISA opens a liaison office in London.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/136

Ukraine's Zelenskyy fires top security chief and prosecutor (AP NEWS)

Zelenskiy Ousts Ukraine’s Security Chief and Top Prosecutor (Bloomberg)

Volodymyr Zelensky sacks top aides over 'Russian collaboration' (The Telegraph)

A massive cyberattack hit Albania (Security Affairs)

Information Systems Are Intact, Says Albanian Government after Cyber Attack (Exit - Explaining Albania) 

Albania closes down online gov't systems after cyber attack (ANI News).

Albania Shuts Down Digital Services and Government Websites after Cyber Attack (Exit - Explaining Albania)

Hackers pose as journalists to breach news media org’s networks (BleepingComputer)

Cybersecurity Firm: What US Journalists Need To Know About The Foreign Hackers Targeting Them Forbes)

Sandworm APT Trolls Researchers on Its Trail as It Targets Ukraine (Dark Reading)

Mike Arrowsmith, Chief Trust Officer at NinjaOne, leads the organization’s IT, security, and support infrastructure to ensure they meet customers’ security and data privacy demands as it scales. Mike discusses how his career path has led him to the position he currently holds and how exciting the world of cybersecurity can be. He mentioned how he mentored students in college thinking of going into the field, and he used a metaphor to help describe the industry, saying "We are working against adversaries that are always typically one step ahead. Figuratively, if you could imagine, you're trying to chase a ball, but you never can quite get your hands on it." He shares how he loves the evolving field and that he thrives in a situation where things are constantly changing. We thank Mike for sharing his story.

On this episode of CyberWire-X, we examine double extortion ransomware. The large-scale cyber events of yesterday – Stuxnet, the Ukraine Power Grid Attack – were primarily focused on disruption. Cybercriminals soon shifted to ransomware with disruption still the key focus – and then took things to the next level with Double Extortion Ransomware.

When ransomware first started to take off as the attack method of choice around 2015, the hacker playbook was focused on encrypting data, requesting payment and then handing over the encryption keys. Their methods escalated with Double Extortion, stealing data as well as encrypting it - and threatening to leak data if they don’t receive payment. We’ve seen with ransomware groups like Maze that they will follow through with publishing private information if not paid.

In the first part of the show, Rick Howard, the CyberWire’s CSO, Chief Analyst, and Senior Fellow, talks with Wayne Moore, Simply Business' CISO and CyberWire Hash Table member, and, in the second half of the show, the CyberWire's podcast host Dave Bittner talks with Nathan Hunstad, episode sponsor Code42’s Deputy CISO. They discuss how classic ransomware protection such as offsite backups are no longer enough. They explain that Double Extortion means that you need to understand what data has been stolen and weigh the cost of paying with the cost of your data going public.

Chad Seaman, Team Lead at Akamai SIRT joins Dave to discuss their research about a record-breaking DDoS Attack. The research says "A new reflection/amplification distributed denial-of-service (DDoS) vector with a record-breaking potential amplification ratio of 4,294,967,296:1 has been abused by attackers in the wild to launch multiple high-impact DDoS attacks."

Starting in mid-February 2022, security researchers, network operators, and security vendors noticed a spike in DDoS attacks. Researchers started to investigate the spike and determined that the devices that were being abused to launch these attacks are MiCollab and MiVoice Business Express collaboration systems. The research goes into how you can help mitigate the attacks and how Mitel has now released patched software.

The research can be found here:

• CVE-2022-26143: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

Gangland goes to war. Is there a "cyber world war" in progress? Ukraine thinks so. A new North Korean ransomware operation is described, but it’s not yet clear if it’s a state operation or some moonlighting by Pyongyang’s operators. Media organizations remain attractive targets for state actors. NSA releases guidance on characterizing threats and risks to microelectronics. Betsy Carmelite from Booz Allen talks about why now is the time to plan for post-quantum cryptography. Our guest is Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly discussing her time at CISA and the work of her team. 

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/135

Inside The Russian Cybergang Thought To Be Attacking Ukraine—The Trickbot Leaks (Forbes)

Who is Trickbot? (Cyjax)

Who is Trickbot? (Cyjax)

NATO and the European Union work together to counter cyber threats (NATO) 

The Man at the Center of the New Cyber World War (POLITICO)

Russian cyber threat to Canada worse than previously reported: CSE (National Post) 

North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware (Microsoft Security) 

Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media (Proofpoint)

NSA Publishes Guidance on Characterizing Threats, Risks to DoD Microelectronics (National Security Agency/Central Security Service)