Spoofing CryptoAPI. Python phishing. DevSecOps tension. Killnet hits German sites. Private sector in the hybrid war.

Summary

By the CyberWire staff

At a glance.

Spoofing vulnerability discovered in Windows CryptoAPI.
Python-based malware distributed via phishing.
MacOS may have a reputation for threat-resistance, but users shouldn't get cocky.
DevSecOps survey results show tension between innovation and security.
Russian hacktivist auxiliaries hit German targets.
Private sector support for Ukraine's cyber defense.
CISA issues two ICS advisories.

Spoofing vulnerability discovered in Windows CryptoAPI.

Akamai this morning released research detailing their analysis of a critical spoofing vulnerability, CVE-2022-34689, affecting Windows CryptoAPI. The vulnerability allows for malicious actors to feign a genuine entity’s identity and perform certain actions. According to Microsoft, this vulnerability allows for attackers to “spoof their identity and perform actions such as authentication or code signing as the targeted certificate.” CryptoAPI is the primary Windows API handling cryptography; particularly certificates. Akamai says exploitation has two primary steps: in the first, malicious actors take a “legitimate certificate, modify it, and serve the modified version to the victim,” researchers explain. “The second phase involves creating a new certificate whose MD5 collides with the modified legitimate certificate, and using the new certificate to spoof the identity of the original certificate’s subject.” The vulnerability, although rated critical, was only given a CVSS score of 7.5. Researchers attribute that rating to “the limited scope of vulnerable applications and Windows components in which the vulnerability prerequisites are met.” For more on the CryptoAPI vulnerability, see CyberWire Pro.

Ready to make the switch to 1Password? It’s easy!

Bank logins. Confidential project files. Your grandma's super-secret shortbread recipe. Everything your team or business stores in 1Password is protected by our industry-leading encryption models – because security isn't just a feature. It's our foundation. And with dedicated onboarding and customer success teams at your disposal, switching is easier than you think.

Python-based malware distributed via phishing.

Securonix describes an attack campaign that’s using a Python-based remote access Trojan dubbed “PY#RATION.” Securonix observed the first version of PY#RATION in August 2022, and the malware has been updated several times since. The RAT is distributed via phishing emails written in English containing malicious ZIP files. The ZIP files contain LNK files disguised as JPG images showing a UK driver’s license. The researchers believe the campaign is targeting users in the UK or other English-speaking countries. After installation, the malware can carry out a wide variety of malicious activities associated with other RATs, such as keylogging and data theft. For more on PY#RATION, see CyberWire Pro.

Doing Threat Intel is Really Difficult - Try a Managed Intel Service

Why are you struggling with interpreting threat intel by yourself? Engage Nisos to achieve better risk insights and outcomes. Rely on the experts with a managed service that gives you the people, process, and technology to control costs while improving your defenses. Nisos leverages automation efficiency and analyst expertise that eliminates noise, identifies risks, and prioritizes your company-specific threats. We help you respond to threats faster and more effectively through assessments, monitoring, and investigations.

MacOS may have a reputation for threat-resistance, but users shouldn't get cocky.

BlackBerry has released its Quarterly Threat Intelligence Report for Q4 2022, looking at various threats facing desktop and mobile devices. The researchers note that while macOS is often viewed as being more secure than other operating systems, users frequently install malicious or unwanted software on their Apple devices: “During the 90-day reporting period, the malicious application Dock2Master was the most-seen threat on macOS: BlackBerry researchers noted that a whopping 34 percent of client organizations using macOS had Dock2Master on their network, where it was found on 26 percent of their devices.” And Windows systems have their characteristic threats, too: BlackBerry found that RedLine was the most active infostealer targeting Windows systems. For more on BlackBerry's report, see CyberWire Pro.

DevSecOps survey results show tension between innovation and security.

Dynatrace has published a study looking at the challenges of maintaining security during DevOps processes. The survey of 1,300 CIOs and senior DevOps managers found that over a third (34%) of respondents are forced to sacrifice code security to keep up with the demand for faster innovation. The report outlines the following findings:

“90% of organizations say digital transformation has accelerated in the past 12 months.
“78% of organizations deploy software updates into production every 12 hours or less, and 54% say they do so at least once every two hours.
“DevOps teams spend nearly a third (31%) of their time on manual tasks involving detecting code quality issues and vulnerabilities, reducing the time spent on innovation.
“55% of organizations make tradeoffs between quality, security, and user experience to meet the need for rapid transformation.
“88% of CIOs say the convergence of observability and security practices will be critical to building a DevSecOps culture, and 90% say increasing the use of AIOps will be key to scaling up these practices.”

For more on the tension between security and innovation, see CyberWire Pro.

Russian hacktivist auxiliaries hit German targets.

Reuters reports this morning that Killnet responded to the German government's decision to supply Leopard tanks to Ukraine by hitting a range of German sites with distributed denial-of-service (DDoS) attacks. They were generally of brief duration and amounted to little more than a minor nuisance. Germany's BSI cybersecurity agency said, "Currently, some websites are not accessible. There are currently no indications of direct effects on the respective service and, according to the BSI's assessment, these are not to be expected if the usual protective measures are taken."

Private sector support for Ukraine's cyber defense.

Kyiv has often acknowledged the contribution private-sector corporations have made to its cyber defense and IT resiliency over the course of Russia's war. Computer World has an account of how one company in particular, Microsoft, has helped. The assistance rendered has been, the piece argues, both principled and the working of enlightened self-interest. "Microsoft isn’t just trying to help defend a country under siege from an aggressive, more-powerful neighbor," Computer World argues. "Russian cyberattacks against Ukraine can also get loose in the wild and do damage to enterprises and organizations that rely on Microsoft technology. (Russia could also deliberately target private companies with those attacks.) By helping Ukraine, Microsoft also helps its customers — and it happens to be good PR, as well." Russian cyberattacks against Ukraine had gotten loose in the wild even before last year's invasion, with NotPetya being the most prominent example.

Microsoft has provided both threat intelligence and the sort of hardening and resiliency that have helped Ukraine keep its networks up and running. Computer World summarizes the effects: "Ukraine has so far defeated Russia in the cyberwar. Russia’s once-feared hackers threw everything they had against Ukraine, including trying to shut down the power grid, disable government networks, and kill satellite communications. They failed every time."

The CyberWire's continuing coverage of Russia's war against Ukraine may be found here.

CISA issues two ICS advisories.

The US Cybersecurity and Infrastructure Security Agency (CISA) yesterday issued two industrial control system (ICS) advisories, one for XINJE XD and the other for SOCOMEC MODULYS GP.

Dateline

Ukraine at D+335: Germany sends Leopards; Russia sends Killnet. (CyberWire) Russian cyber auxiliaries respond to Germany's decision to send Ukraine tanks with DDoS attacks against German sites.

Russia-Ukraine war: List of key events, day 336 (Al Jazeera) As the Russia-Ukraine war enters its 336th day, we take a look at the main developments.

Russia-Ukraine war live: Zelenskiy ‘sincerely grateful’ for German tank decision as Russia warns it takes conflict ‘to new level’ (the Guardian) Ukraine’s president welcomes decision to send Leopard 2 tanks while Moscow accuses Germany of abandoning ‘historic responsibility’

Ukraine-Russia war latest: Start training on Leopard tanks, Germany tells Ukraine forces (The Telegraph) Kyiv's allies can start training Ukrainian forces to use Leopard 2 battle tanks, Germany has said, raising hopes of a breakthrough in deliveries of the vehicles.

Russian saboteurs seek to hamper Putin’s war machine (Al Jazeera) Anti-Putin activists try to slow down Russia’s war in Ukraine and say they are willing to step up their violence.

Ukraine-Russia latest news: Europe to send Ukraine two battalions of tanks, says Scholz (The Telegraph) Olaf Scholz has announced Germany's decision to permit the export of Leopard 2 tanks to Ukraine in the wake of heavy criticism from Western allies.

After US offer, Germany unleashes Leopard tanks for Ukraine (AP NEWS) After weeks of hesitation that created impatience among Germany's allies, Chancellor Olaf Scholz announced Wednesday that his government would provide Ukraine with Leopard 2 battle tanks and approve requests by other countries to do the same.

Hammer blow for Vladimir Putin as Ukraine to get 200 tanks from West (The Telegraph) Kyiv to become the ‘real punching fist of democracy’ after breakthrough donations from Germany and US that could turn tide of war

Leopard tanks to Ukraine – all your questions answered (The Telegraph) As Germany agrees to donate some of its game-changing tanks to Kyiv, here is everything you need to know

Germany could approve deliveries of Leopard II tanks to Ukraine by Wednesday (The Telegraph) News comes as Nato secretary general warns alliance’s members they must ‘urgently’ ramp up support for Kyiv

In reversal, US poised to approve Abrams tanks for Ukraine (AP NEWS) In what would be a reversal, the Biden administration is poised to approve sending M1 Abrams tanks to Ukraine, U.S. officials said Tuesday, as international reluctance to send tanks to the battlefront against the Russians begins to erode.

Russia-Ukraine War: Germany Confirms It Will Send Leopard Tanks to Ukraine (New York Times) Berlin’s announcement comes after weeks of domestic and international pressure. The U.S. is expected to announce soon that it will send its own tanks to Ukraine.

The M1 Abrams Is the Right Tank for the Job in Ukraine (Foreign Policy) Sending American tanks now helps guarantee a safer world tomorrow.

For Ukraine, what’s so special about Germany’s Leopard 2 tanks? (Washington Post) As the war in Ukraine nears its one-year mark, Kyiv is pushing Western allies to provide modern battle tanks for its fight with Russian forces. And there’s one particular model the Ukrainians want — the German-made Leopard 2.

Sweden sending Leopard 2 tanks to Ukraine not 'on the plate,' Swedish official says (Breaking Defense) “We are, politically, open to support with all types of capabilities but tanks have not yet been on the plate," said a senior Swedish military official.

Leopard tank saga: Germany remains haunted by history (Atlantic Council) Germany's reluctance to send Leopard 2 tanks to Ukraine reflects the ongoing influence of war guilt for the crimes of the Nazi era while also highlighting a failure to differentiate between modern Russia and the Soviet Union.

Lady Luck has come to Europe’s rescue – but now it faces a bigger threat than Putin (The Telegraph) The West’s economy faces fresh mayhem just as it recovers from Russia's energy shock

Putin thinks the West will self-immolate – and he may be right (The Telegraph) While Europe dithers, Russia’s spring campaign could yet transform the dynamics in Ukraine

Wartime Ukraine must maintain course from Russian past to European future (Atlantic Council) As Russia continues its genocidal war against Ukraine, it is more important than ever for Kyiv to maintain its commitment to the European future that so many Ukrainians are currently fighting for, writes Andrew D’Anieri.

Putin's Ukraine Folly Enables Kremlin Rivals (Military.com) As we near the one-year anniversary of Russia’s all-out assault on Ukraine, the political fractures inside Russia are on public display

Top Ukrainian officials ousted in anti-corruption sweep (Washington Post) Several senior Ukrainian officials were swept out of their posts on Tuesday, including a close adviser of President Volodymyr Zelensky, in part over corruption allegations, as Kyiv moved swiftly to show zero tolerance for graft that could undermine the confidence of Western nations that have kept the country alive with vast shipments of donated weapons and billions in economic assistance.

Ukraine’s Zelensky Removes Top Officials in Bid to Contain Corruption Scandals (Wall Street Journal) The Ukrainian president is looking to shore up the confidence of Western governments that are giving Kyiv billions of dollars in aid.

Volodymyr Zelensky dismisses several ministers in crackdown on war-time graft (The Telegraph) Ukraine's leader has also banned civil servants from circumventing a ban on travel for military age men

‘No return to the past’: the man leading Ukraine’s fightback against corruption (the Guardian) Ex-public prosecutor Oleksandr Novikov is on a mission to build a culture of integrity in the wartorn country

Russian 'hacktivists' briefly knock German websites offline (Reuters) Russian activist hackers knocked several German websites offline on Wednesday in response to Berlin's decision to send tanks to Ukraine, although Germany's BSI cyber agency said the digital blitz had little tangible effect.

How Microsoft is helping Ukraine’s cyberwar against Russia (Computerworld) Microsoft's efforts to aid Ukraine aren't just altruistic; by fending off Russian cyberattacks, the company is helping its customers, too.

Ukraine says it has enough energy for winter amid Russian attacks (Al Jazeera) After months of attacks on energy facilities, Ukraine is working with partners to speed up repair work.

Attacks, Threats, and Vulnerabilities

Pakistani authorities investigating if cyberattack caused nationwide blackout (The Record from Recorded Future News) Pakistani authorities are investigating whether a nationwide blackout which left millions of people without power on Monday was caused by a cyberattack.

TA444: The APT Startup Aimed at Acquisition (of Your Funds) (Proofpoint) TA444 is a North Korea state-sponsored threat actor that tested numerous infection methods in 2022 with varying degrees of success.

FBI says N. Korea-related hacker group behind U.S. crypto firm heist (Reuters) A hacker group associated with North Korea, the Lazarus Group, also known as APT38, was responsible for the theft last June of $100 million from U.S. crypto firm Harmony's Horizon bridge, the Federal Bureau of Investigation said on Monday.

FBI: North Korean Hackers Behind $100M Horizon Bridge Theft (CoinDesk) Lazarus Group and APT38, both associated with North Korea, are responsible for the attack in June, the agency concluded.

The Unrelenting Menace of the LockBit Ransomware Gang (WIRED) The notorious Russian-speaking cybercriminals grew successful by keeping a low profile. But now they have a target on their backs.

Exploiting a Critical Spoofing Vulnerability in Windows CryptoAPI (Akamai) Akamai Security Research recently analyzed a critical vulnerability in Windows CryptoAPI that was disclosed by the National Security Agency (NSA) and the National Cyber Security Center (NCSC) to Microsoft.

Bots Are Now Robocalling to Phish For Your Two-Factor Authentication (2FA) Codes (Radware Blog) In a new form of 2FA phishing, criminals now use bots to make phishing calls to potential victims to get 2FA codes & OTPs sent by websites and apps.

The Year of the Wiper (Fortinet Blog) FortiGuard Labs has been tracking wiper malware since the start of the 2022 Russia-Ukraine conflict. Read our latest blog to find out recent updates about the trends in wiper malware and how attack…

High Risk Advisory: EzAdsPro "BlackBox" Application (Bishop Fox) Read this high risk advisory to learn how EzAdsPro "BlackBox" application allowed directory listing resulting in unauthorized information disclosure.

Too Much Caffeine? Phishing-as-a-Service Makes Us Jittery (Security Intelligence) Phishing attacks have been around for a while and are only growing more sophisticated. Learn more about one of the growing PHaaS platforms, Caffeine.

GoTo says hackers stole customers' backups and encryption key (BleepingComputer) GoTo (formerly LogMeIn) is warning customers that threat actors who breached its development environment in November 2022 stole encrypted backups containing customer information and an encryption key for a portion of that data.

GoTo Says Hackers Stole Encrypted Backups, MFA Settings (SecurityWeek) GoTo says a threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.

LastPass owner GoTo shares more bad news about November’s security breach (The Verge) Hackers have encryption keys for some of the stolen GoTo data.

GoTo says hackers stole encrypted backups during November cyberattack (The Record from Recorded Future News) Billion-dollar SaaS provider GoTo said hackers stole an encryption key for customer-owned backups during a November cyberattack.

Canadian tool manufacturer hit by cyber attack (IT World Canada) A Canadian-based international manufacturer of die cast tools and car parts has been the victim of a cyber attack. Exco Technologies said Monday that three production facilities within its Large Mould Group are recovering from a cyber incident last week. The Toronto-headquartered company temporarily disabled some computer systems as it investigated this incident. It is

DuoLingo investigating dark web post offering data from 2.6 million accounts (The Record from Recorded Future News) DuoLingo said it is investigating a post on a hacking forum offering information on 2.6 million accounts for $1,500.

Binance Acknowledges Storing User Funds With Collateral in Error (Bloomberg) Exchange wallet held both customer assets and reserve tokens. Binance is aware of mistake and in the process of correcting.

Hackers Demand $10M From Riot Games to Stop Leak of ‘League of Legends’ Source Code (Vice) Motherboard obtained the ransom note that hackers sent Riot Games on Tuesday, which threatened to release ‘League of Legends’ source code.

Riot Games receives ‘ransom email’ for stolen source code following social engineering attack (The Record from Recorded Future News) Riot Games, the video game developer and esports organizer, said on Tuesday that it had received a “ransom email” following a social engineering attack last week.

‘League of Legends’ Source Code Stolen in Riot Games Cyberattack (Bloomberg) Code for League of Legends among data exfiltrated in hack. Company received ransom note. ‘Needless to say, we won’t pay.’

Riot Games receives ‘ransom email’ for stolen source code following social engineering attack (The Record from Recorded Future News) Riot Games, the video game developer and esports organizer, said on Tuesday that it had received a “ransom email” following a social engineering attack last week.

GTA Online bug exploited to ban, corrupt players’ accounts (BleepingComputer) Grand Theft Auto (GTA) Online players report losing game progress, in-game money being stolen, and being banned from game servers due to an alleged vulnerability in the game's PC version.

Report: Contractor 'mistakenly' opened email starting Baltimore County school cyberattack (WBFF) Maryland's Office of the Inspector General for Education released its investigative report for the

Los Angeles school system shifts timeline of ransomware attack (Cybersecurity Dive) Post-breach investigations are complex. The timeline and scope of damage inflicted often change as investigations unfold.

Ohio town working to restore municipal court systems after cyberattack (The Record from Recorded Future News) Circleville, Ohio is investigating a cyberattack that has brought down the systems used by their court and may have accessed sensitive data.

Microsoft investigates outage affecting Teams and Outlook users worldwide (the Guardian) Service status monitoring website Downdetector records thousands of people reporting problems

Microsoft services including Teams and Outlook down for thousands (Computing) Microsoft is looking into an outage that has prevented thousands of users worldwide from using its services, including Teams and Outlook.

Bulletin (SB23-023) Vulnerability Summary for the Week of January 16, 2023 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week.

Security Patches, Mitigations, and Software Updates

Apple Releases Security Updates for Multiple Products (CISA) Apple has released security updates to address vulnerabilities in multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected device. CISA encourages users and administrators to review the Apple security updates page for the following products and apply the necessary updates as soon as possible:

Apple patches are out – old iPhones get an old zero-day fix at last! (Naked Security) Don’t delay, especially if you’re still running an iOS 12 device… please do it today!

CISA Releases Two Industrial Control Systems Advisories (CISA) CISA released two Industrial Control Systems (ICS) advisories on January 24, 2023.These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. CISA encourages users and administrators to review the newly released ICS advisories for technical details and mitigations: ICSA-23-024-01 XINJE XD ICSA-23-024-02 SOCOMEC MODULYS GP

XINJE XD (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.3 ATTENTION: Low attack complexity/public exploits are available Vendor: XINJE Equipment: XINJE XD Programing Tool Vulnerabilities: Relative Path Traversal, Uncontrolled Search Path Element 2.

SOCOMEC MODULYS GP (CISA) 1. EXECUTIVE SUMMARY CVSS v3 5.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: SOCOMEC Equipment: MODULYS GP Vulnerability: Weak Encoding for Password 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to obtain sensitive information on the target system.

Trends

One year since Log4Shell, two since SolarWinds: What’s coming in 2023? (SC Media) As we approach two years since the SolarWinds hack that brought supply chain security concerns into the mainstream, we asked Invicti experts what they see as the key lessons so far and what developments to expect in 2023.

One-third of orgs don’t take cyberwarfare seriously despite the Russia-Ukraine war (VentureBeat) Research released by Armis finds that one-third of organizations don't take cyberwarfare seriously, despite the ongoing Russia-Ukraine war.

Armis State of Cyberwarfare and Trends Report: 2022-2023 Highlights Global IT and Security Professionals’ Sentiment on Cyberwarfare (Armis) New Armis State of Cyberwarfare and Trends Report: 2022-2023 highlights global IT and security professionals’ sentiment on cyberwarfare. What did we find? Nearly a quarter of global organizations (24%) feel underprepared to handle cyberwarfare and more than half (55%) of IT professionals surveyed agree with the statement, ‘My organization has stalled or stopped digital transformation projects due to the threat of cyber warfare.’

The State of Cyberwarfare Report (Armis) Cyberwarfare attacks are on the rise worldwide. Armis surveyed 6021 IT and security professionals worldwide, and the results were astounding.

Global CIO Report Reveals Growing Urgency for Observability and Security to Converge (Business Wire) Software intelligence company Dynatrace (NYSE: DT) announced today the results of an independent global survey of 1,300 CIOs and senior DevOps manager

CIOs face pressure to innovate faster (Dynatrace) We asked 1,300 CIOs and senior DevOps managers about the challenges they face. Here’s what they reported.

Global CIO Report Reveals Growing Urgency for Observability and Security to Converge (Business Wire) Software intelligence company Dynatrace (NYSE: DT) announced today the results of an independent global survey of 1,300 CIOs and senior DevOps manager

Top 10 Ransomware Targets in 2022 and Beyond (Security) Today's top ransomware targets include organizations in the media, retail and energy sectors. Learn which 14 industries have the highest attack rates.

Marketplace

CYGNVS raises $55M to help enterprises respond to cyberattacks (SiliconANGLE) CYGNVS raises $55M to help enterprises respond to cyberattacks - SiliconANGLE

Temasek leads €100 million round in atomic-level quantum processor builder Pasqal (Tech.eu) Once the stuff of Feynman's dreams, Pascal executives predict that their solution will deliver major commercial advantages over classical computers by 2024.

Sumo Logic could be worth $17 per share in a takeout, Jefferies says (Seeking Alpha) Sumo Logic (SUMO) could be worth as much as $17 per share if it were to be taken private, investment firm Jefferies said on Tuesday.

Cybersecurity is more necessary than every. Here are the VCs supercharging the cybersecurity startup boom (Fortune) While other industries falter during a recession, the demand for cybersecurity has still been growing.

Google CEO defends job cuts in animated town hall as employees demand clarity on process (CNBC) Google executives held a town hall meeting with staffers on Monday after the company announced its largest layoff in history.

Bolt CEO Cuts Staff a Third Time as Revenue Lags (The Information) Bolt, the one-click checkout startup that slashed staff at least twice last year as growth fell short of its goals, laid off around 10% of employees on Tuesday, or at least 50 people, according to two people with direct knowledge. In total, the company, which previously raised $1 billion from ...

NSA Launches Unprecedented Hiring Effort in 2023 (National Security Agency/Central Security Service) Seeking to grow its workforce in 2023, NSA is undertaking one of its largest hiring surges in 30 years with openings for over 3,000 new employees.

Rapid Loss of Talent Contributing to DOD Cyber Shortfalls (Real Clear Defense) “Shortfalls” in the Department of Defense’s cyber posture can be attributed to the rapid loss of talent to private industry, according to the Pentagon’s chief weapons tester.

Delinea Bolsters Sales Leadership with New Chief Revenue Officer David Castignola (PR Newswire) Delinea, a leading provider of Privileged Access Management (PAM) solutions for seamless security, today announced that David Castignola has...

Forescout Appoints Technology Veteran Barry Mainz as CEO (Forescout) Mainz brings 25 years of industry experience to execute on Forescout’s strategy and drive its next phase of growth

Security software provider Forescout has brought in a new CEO after shifting to a subscription model (Silicon Valley Business Journal) Barry Mainz's job will be to ramp up the cybersecurity provider's business and prepare to head back to Wall Street.

LogicGate Hires Nicholas Kathmann as Chief Information Security Officer (PR Newswire) LogicGate, a leading provider of transformative risk and compliance solutions through its Risk Cloud® platform, has hired Nicholas Kathmann as...

Prancer Cybersecurity Solution Provider Welcomes Mandana Javaheri to t (PRWeb) Prancer Enterprise, a visionary cloud security solution startup focused on offensive security tools, is excited to announce the addition of Mandana Javaheri to

SentinelOne Announces Executive Appointments and Promotions Amidst Rapid Growth (Business Wire) SentinelOne (NYSE: S), an autonomous cybersecurity platform company, today announced key executive appointments and promotions that will fuel the grow

Cloud Visionary, CSPM Pioneer Chen Burshan Joins Skyhawk Security as CEO (GlobeNewswire News Room) Former GM and Site Manager for Israel at Dome9, acquired by Check Point Software, brings deep cloud security domain expertise to the role...

Phosphorus Appoints Martin LeRoy as Chief Financial Officer (GlobeNewswire News Room) LeRoy is a top industry veteran who was pivotal in SailPoint’s 5x value increase, culminating in acquisition...

Products, Services, and Solutions

Code42’s Insider Risk Management Products are Now Available in AWS Marketplace (Business Wire) Code42 Software, Inc., the Insider Risk Management (IRM) leader, today announced its flagship IRM products – Code42® Incydr™, Code42 Instructor™ and I

Global Ride-Hailing Platform inDrive Partners SHIELD to Boost Trust and Fairness (SHIELD) inDrive, the world's fastest-growing ride-hailing service, today announced that it is utilizing global risk intelligence company SHIELD’s Device Intelligence.

Google to stop exempting campaign email from automated spam detection (Washington Post) The technology giant introduced the exemption after the GOP blamed Gmail spam filters for the party’s poor fundraising performance

MeitY & Kyndryl collaborate to launch cybersecurity training initiative for women empowerment (CXOToday.com) Cyber Rakshak program will empower more than 100,000 women in rural and remote areas Common Services Centres (CSC), under the Ministry of Electronics & I

Partnership Between Kingdom of Belgium and Recorded Future to Make Belgium the Safest Cyber Country in Europe (PR Newswire) The Kingdom of Belgium's Centre for Cyber Security Belgium (CCB) and Recorded Future, the intelligence company, today announced details of an...

PKWARE Announces New Solution for Securing Sensitive Information within Microsoft Outlook Email (PR Newswire) PKWARE, a global leader in automated data security, today announced that it has released its newest data discovery and protection solution, PK...

Proofpoint Launches Free Cybersecurity Awareness Kit (Tech Business News) Proofpoint has launched an incredible selection of free resources in its new cyber security awareness kit to help keep business users safe.

Check Point Software Opens New Cyber Center to Raise Awareness on Importance of Cyber Security (GlobeNewswire News Room) The Cyber Center aims to educate the general public and students on the basics of cyber security with practical tips for preventing cyber attacks...

Ground Labs Introduces Enterprise Recon 2.8 with New Way of Discovering Critical Data in Microsoft Platforms (GlobeNewswire News Room) Award-winning data discovery solution scans and remediates widest number and range of data types in the industry...

SpyCloud Compass Reduces Ransomware Risk with Post-Infection Remediation (Business Wire) SpyCloud, the leader in operationalizing Cybercrime Analytics (C2A), today announced the launch of Compass, a transformative solution to help enterpri

Wing Security Disrupts SaaS Security Market with Free Application Discovery (Business Wire) Wing Security, the only holistic SaaS (software-as-a-service) security platform, announced its non-intrusive discovery engine is now completely free

Incognia Introduces New Suspicious Locations Feature (GlobeNewswire News Room) Capable of detecting fraud rings, Incognia’s precise location detection is the critical new intelligence layer for fraud and risk teams...

The Salt Security API Protection Platform is Now Available on Google Cloud Marketplace (PR Newswire) Salt Security, the leading API security company, today announced that it has joined the Google Cloud Partner Advantage Program as a Build...

OTORIO Releases Microsoft DCOM Hardening Toolkit for OT Systems (Otorio) New Open Source Detection Tool Uncovers Vulnerable DCOM in Advance of March Microsoft Patch

Act-On Software becomes HIPAA compliant, adding to existing international security certification (GlobeNewswire News Room) The marketing automation platform’s HIPAA and ISO 27001 certifications provide next-level information security for customers across all industries,...

Cloud Range Launches the First OT/ICS Cyber Range for Live-Fire Training to Reduce Risk from Cyber Attacks on Critical Infrastructure (Business Wire) Cloud Range, the industry’s leading cyber range solution to reduce cyber risk across the organization, today introduced Cloud Range for Critical Infra

Inaugural Linkerd Day Launches at KubeCon + CloudNativeCon Europe (PRWeb) Buoyant, creator of the industry-leading open source service mesh Linkerd, today announced that it will launch the inaugural Linkerd Day in April at KubeCon

Technologies, Techniques, and Standards

How CISA is Delivering Cyber Hygiene Services to Assist SMBs (Nodeware) This blog explains how SMBs can make strides towards their cybersecurity goals.

National Security Agency plans to test out security of zero trust in cloud environments with industry partners (Inside Cybersecurity) Starting this spring, “red team” hackers from the National Security Agency, and potentially hackers from the military services, will attack major cloud service providers chosen by the Pentagon to test their zero-trust systems in each cloud environment.

oak9 Unlocks Multi-Cloud Security Automation with Google Cloud Platform Support (Yahoo Finance) As organizations increase their cloud footprint, security becomes more tedious. According to HashiCorp's State of Cloud Strategy Survey, 90% of organizations say multi-cloud is an effective business strategy. Now there's a way to easily secure infrastructure across those disparate environments.

Data Privacy Day: Privado flags data privacy challenges in 2023 as it hails industry stars (News Direct) Data Privacy Day: Privado flags data privacy challenges in 2023 as it hails industry stars

Design and Innovation

ChatGPT is 'not particularly innovative,' and 'nothing revolutionary', says Meta's chief AI scientist (ZDNET) The public perceives OpenAI's ChatGPT as revolutionary, but the same techniques are being used and the same kind of work is going on at many research labs, says the deep learning pioneer.

Microsoft Plans Security Features, Wider Release for Its OpenAI-Powered Coding Tool (The Information) ChatGPT has generated headlines and hype since its release last year, with its humanlike responses to written prompts. But the business impact of the technology behind the chatbot may first emerge in a different arena: software development. In 2021, Microsoft-owned GitHub, a popular repository ...

Research and Development

No 'second law of entanglement' after all (ScienceDaily) When two microscopic systems are entangled, their properties are linked to each other irrespective of the physical distance between the two. Manipulating this uniquely quantum phenomenon is what allows for quantum cryptography, communication, and computation. While parallels have been drawn between quantum entanglement and the classical physics of heat, new research demonstrates the limits of this comparison. Entanglement is even richer than we have given it credit for.

Academia

CISA Releases Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats (CISA) Today, CISA released Protecting Our Future: Partnering to Safeguard K–12 organizations from Cybersecurity Threats. The report provides recommendations and resources to help K-12 schools and school districts address systemic cybersecurity risk. It also provides insight into the current threat landscape specific to the K-12 community and offers simple steps school leaders can take to strengthen their cybersecurity efforts.

Why universities need to build a culture around data and privacy (EdScoop) On the Cutting EDge podcast, the Rochester Institute of Technology's Ben Woelk previews his new Educause workshop on data and privacy.

Legislation, Policy, and Regulation

Spyware Finally Got Scary Enough to Freak Lawmakers Out—After It Spied on Them (Bloomberg) NSO Group’s Pegasus software was used routinely to listen in on conversations with US, UK and EU officials, prompting investigations into abuses of its shockingly affordable military-grade surveillance.

US Cyber Command, DARPA ink cyberwar fighting agreement (Register) Out of the valley of death and into operational use, ideally

Want to innovate for DoD? Pay close attention to Ukraine (Defense News) The war in Ukraine is a master class on the best and worst practices in competitive maneuvering.

Sen. Warner's cyber priority this year is health care (Washington Post) In a Q&A, Sen. Mark Warner stresses more cybersecurity in health care, describes his broadening TikTok concerns

Litigation, Investigation, and Law Enforcement

DOJ Sues Google, Seeking to Break Up Online Advertising Business (Wall Street Journal) The Justice Department’s suit could have major implications for the digital ad industry.

US Sues Google to Break Up Ad Unit in Heated Antitrust Fight (Bloomberg) DOJ complaint calls for break up of Google’s ad tech business. Google counters that digital ad market is competitive.

The Justice Department is calling for the breakup of Google in a new antitrust lawsuit (Silicon Valley Business Journal) The Justice Department, California and seven other states charged that Google is illegally thwarting competition in the digital advertising business.

Administrator of RSOCKS Proxy Botnet Pleads Guilty (KrebsOnSecurity) Denis Emelyantsev, a 36-year-old Russian man accused of running a massive botnet called RSOCKS that stitched malware into millions of devices worldwide, pleaded guilty to two counts of computer crime violations in a California courtroom this week. The plea comes…

CISOs Beware: The Government Is Watching (The Information) Uber’s former chief of security, Joe Sullivan, was convicted in October of obstructing a federal government investigation and concealing a felony from the Federal Trade Commission. The trial got plenty of attention, particularly from those working as chief information security officers. Not only ...

Classified documents at Pence's home, too, his lawyer says (AP NEWS) Documents with classified markings were discovered in former Vice President Mike Pence 's Indiana residence last week, his lawyer says, the latest in a string of recoveries of papers meant to be treated with utmost sensitivity from the homes of current and former top U.S.

Two more papers found in Trump’s storage last year were marked secret (the Guardian) Since the papers were handed over swiftly, the justice department is not expected to include them as part of its wider inquiry

Biden’s Handling of Secret Documents Complicates the Case Against Trump (New York Times) The cases are markedly different in their particulars. But they are similar enough that as a practical matter, Democrats will have a hard time using the issue against former President Donald J. Trump.

Classified records pose conundrum stretching back to Carter (AP NEWS) At least three presidents. A vice president, a secretary of state, an attorney general. The mishandling of classified documents is not a problem unique to President Joe Biden and former President Donald Trump.

Office of Cyber-Security: Don't be embarrassed to report cyber attacks (Manx Radio) Report reveals a number of sextortion cases towards the end of last year

Senators slam Ticketmaster for reporting just one bot case to FTC despite Taylor Swift fiasco claims (The Record from Recorded Future News) Several U.S. Senators criticized Ticketmaster during a hearing on Tuesday for only reporting one case of bot abuse to the FTC.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Insider Threat Program Development - Management Training Course (Laurel, Maryland, USA, Jan 30 - 31, 2023) The training course will be taught at the Johns Hopkins University Applied Physics Laboratory, in Laurel, Maryland. This highly sought after and very comprehensive 2 day training course will ensure the Insider Threat Program (ITP) Manager/ Senior Official (Insider Threat Analyst, FSO, CSO, CISO, Etc.), and others who support the ITP (Human Resources, IT, Network Security, Etc.), have the Core Knowledge, Blueprint, Resources needed for developing, managing, enhancing an ITP / ITP Working Group. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended this training course and received ITP Manager Certificates.

CybertechGlobal Tel Aviv (Tel Aviv, Israel, Jan 30 - Feb 1, 2023) Cyber is all around us—it is one of the most trending topics in the tech and business arenas. It is a whole-encompassing industry that is not only about threats, but also covers the scope of digitalization and opportunities in the realm of innovation. From Tel Aviv and Rome, to Tokyo, Singapore, Panama, and more, Cybertech is the cyber industry’s foremost B2B networking platform conducting industry-related events all around the globe. Our conferences and exhibitions serve as the go-to place to make business happen and learn all about the latest technological innovations, challenges, and solutions to combating threats within the global cyber arena. Cybertech events feature top executives, government officials, leading decision-makers from a wide range of sectors including critical infrastructure, insurance, retail, health and government, defense, R&D, manufacturing, automotive, and more! Multinational corporations, startups, private and corporate investors, venture capital firms, experts, and clients—come and meet all the key players from the cyber industry and be immersed in everything there is to offer. Cyber. We live it. Breathe it. All at the forefront of global innovation.

Certified CMMC Professional (CCP) 2.0 Exam Prep (Virtual, Feb 6 - 10, 2023) This 5-day CCP course covers the foundational required curriculum along with CMMC Level 2 scoping and the full 110 practices. Edwards Cyber AB approved CCP 2.0 courses enable participants to sit for the CCP exam – making you a valuable resource to a consultancy providing CMMC preparation, C3PAO providing certified assessor support, or organization interested in having in-house CMMC trained resources. Edwards all-star lineup of Provisional Instructors (PIs) includes several of the CMMC industry’s most respected consultants along with Edwards’ internal SMEs to deliver their action packed bootcamps. Learn more and register now.

Chicago Cybersecurity Conference (Chicago, and virtual, Illinois, USA, Feb 8, 2023) FutureCon Events brings high-level Cyber Security Training discovering cutting-edge security approaches, managing risk in the ever-changing threat of the cybersecurity workforce. Join us as we talk with a panel of C-level executives who have effectively mitigated the risk of Cyber Attacks. Educating C-suite executives and CISOs (chief information security officers) on the global cybercrime epidemic, and how to build Cyber Resilient organizations. Gain the latest knowledge you need to enable applications while keeping your computing environment secure from advanced Cyber Threats. Demo the newest technology, and interact with the world’s security leaders and gain other pressing topics of interest to the information security community. The FutureCon community will keep you updated on the future of the Cyberworld and allow you to interact with your peers and the world’s security leaders.

Tech Days (Barcleona (and virtual), Spain, Feb 13 - 15, 2023) The PKI and cryptography landscape is in a state of constant evolution. Emergence of post-quantum cryptography, new PKI and IoT use cases, and rapid growth of machine identities are all serious challenges. At Tech Days 2023, we say “Game On.”

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.