NIST releases Cybersecurity Framework 2.0. Russia's APT29 targets cloud services.

Summary

By the CyberWire staff

At a glance.

Russia's APT29 targets cloud services.
ThyssenKrupp sustains cyberattack.
Thousands of legitimate domains hijacked to send phishing emails.
NIST releases Cybersecurity Framework 2.0.

Russia's APT29 targets cloud services.

A joint advisory from the UK's National Cyber Security Centre (NCSC) and other Five Eyes agencies has warned that APT29 (also known as "Cozy Bear," a threat actor attributed to Russia's SVR) has adapted its tactics to target governments and corporations that utilize cloud services. The advisory notes, "As organizations continue to modernize their systems and move to cloud-based infrastructure, the SVR has adapted to these changes in the operating environment. They have to move beyond their traditional means of initial access, such as exploiting software vulnerabilities in an on-premises network, and instead target the cloud services themselves. To access the majority of the victims’ cloud hosted network, actors must first successfully authenticate to the cloud provider. Denying initial access to the cloud environment can prohibit SVR from successfully compromising their target. In contrast, in an on-premises system, more of the network is typically exposed to threat actors."

Secure your future with a master’s degree in cybersecurity from Penn State World Campus.

Boost your cybersecurity career with Penn State World Campus! Our online master's program delivers cutting-edge knowledge, hands-on skills, and expert insights. Benefit from flexible learning that fits your schedule, while gaining industry-relevant expertise in areas like threat detection, risk management, and ethical hacking. Join a renowned institution, be guided by industry leaders, and advance your career in the dynamic field of cybersecurity. Elevate your skills, secure your future — apply today!

NIST releases Cybersecurity Framework 2.0.

The National Institute of Standards and Technology (NIST) yesterday released version 2.0 of its Cybersecurity Framework (CSF). The updated version "has an expanded scope that goes beyond protecting critical infrastructure, such as hospitals and power plants, to all organizations in any sector. It also has a new focus on governance, which encompasses how organizations make and carry out informed decisions on cybersecurity strategy. The CSF’s governance component emphasizes that cybersecurity is a major source of enterprise risk that senior leaders should consider alongside others such as finance and reputation."

Team Cymru’s Threat Intelligence solutions allow you to aim your sights on the malicious actors.

Imagine a world where you're always one step ahead of cyber threats, where your defenses are impenetrable because you see what others don't. With real-time access to the worlds largest threat intelligence data ocean, we enable you to turn the tables on attackers. Transform your security from reactive to proactive through accelerated threat hunting and incident response, made possible through automation. Team Cymru: be the hunter, not the hunted.

ThyssenKrupp sustains cyberattack.

German steel production conglomerate ThyssenKrupp has confirmed that its automotive division sustained a cyberattack last week, BleepingComputer reports. The nature of the attack is unclear, but the company has disconnected systems as a precautionary measure. The incident caused production to shut down at the company's Saarland-based plant.

ThyssenKrupp said in a statement, "Our ThyssenKrupp Automotive Body Solutions business unit recorded unauthorized access to its IT infrastructure last week. The IT security team at Automotive Body Solutions recognized the incident at an early stage and has since worked with the ThyssenKrupp Group's IT security team to contain the threat. To this end, various security measures were taken and certain applications and systems were temporarily taken offline."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Thousands of legitimate domains hijacked to send phishing emails.

Guardio Labs has identified more than 8,000 subdomains belonging to well-known brands and institutions that have been hijacked to send spam and phishing campaigns. Since the emails are sent from trusted domains, they're more likely to bypass email security filters. In one instance, the threat actor took over a domain that had been inactive since 2001.

Guardio notes that the threat actor behind the operation "appears to be systematically scanning the internet for vulnerable domains, identifying opportunities, purchasing domains, securing hosts and IP addresses and then meticulously orchestrating the ongoing campaign of email dissemination. This involves a vast network of both hijacked and deliberately acquired domain and IP assets, indicating a high level of organization and technical sophistication in maintaining this broad scale of operations."

Notes.

Today's issue includes events affecting Australia, Canada, New Zealand, Russia, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Hunting PrivateLoader: The malware behind InstallsKey PPI service (Bitsight) Read the latest Bitsight research on PrivateLoader including important updates recently, including a new string encryption algorithm, a new alternative communication protocol and more.

Hackers exploit 14-year-old CMS editor on govt, edu sites for SEO poisoning (BleepingComputer) Threat actors are exploiting a CMS editor discontinued 14 years ago to compromise education and government entities worldwide to poison search results with malicious sites or scams.

UK email mistake put ‘lives at risk’ for Afghans who had worked with British military (The Record) The Information Commissioner's Office (ICO) explained its monetary penalty against the Ministry of Defence for exposing email addresses of certain Afghans interested in being relocated to the U.K.

Number of data breaches falls globally, triples in the US (TechSpot) The Global data breach statistics report comes from Surfshark, which counts every leaked email address used to register for online services as a separate user account.

Hijacked subdomains of major brands used in massive spam campaign (BleepingComputer) A massive ad fraud campaign named "SubdoMailing" is using over 8,000 legitimate internet domains and 13,000 subdomains to send up to five million emails per day to generate revenue through scams and malvertising.

Products, Services, and Solutions

ThreatHunter.ai Halts Hundreds of Attacks in the past 48 hours: Combating Ransomware and Nation-State Cyber Threats Head-On (Cyber Security News) The current large surge in cyber threats has left many organizations grappling for security so ThreatHunter.ai is taking decisive action.

Technologies, Techniques, and Standards

NIST Releases Version 2.0 of Landmark Cybersecurity Framework (NIST) The agency has finalized the framework’s first major update since its creation in 2014.

White House urges devs to switch to memory-safe programming languages (BleepingComputer) The White House Office of the National Cyber Director (ONCD) urged tech companies today to switch to memory-safe programming languages, such as Rust, to improve software security by reducing the number of memory safety vulnerabilities.

Getting Ahead of Cybersecurity Materiality Mayhem (Security Boulevard) Cybersecurity leaders must differentiate between strategic (material) and tactical threats in a cross-functional manner and determine 'materiality.'

Litigation, Investigation, and Law Enforcement

Investigators trace $100 million in crypto payments to Myanmar scam syndicate (The Record) A joint investigation between Chainalysis and a researcher with the International Justice Mission examined the scamming operations within KK Park, a criminal zone along the border with Thailand.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Trellix Public Sector Cybersecurity Summit (Washington, DC, USA, Feb 27, 2024) Public sector organizations continue to face a constant barrage of sophisticated cyber threats. And with new cybersecurity mandates and guidance — from recent executive orders to the release of the 2023 National Cyber Strategy — public sector leaders must make considerable decisions about their cyber enterprise that will have lasting impacts for years to come. On top of this, the emergence of novel security capabilities built on machine learning, AI, predictive analytics and extended detection and response has given security leaders a new arsenal of tools to defend against the next sophisticated attack. Join top technology leaders from across the public sector at the Trellix Public Sector Cybersecurity Summit as they discuss emerging topics in cybersecurity like ransomware, zero trust, global security and XDR. Throughout the summit, you’ll have the opportunity to engage in conversations about how the arrival of AI will intersect with public sector cybersecurity, evolving partnerships to strengthen threat intelligence, how to navigate, take action on and go beyond new cybersecurity policy directives, and much more.

Power Women of GovCon (Arlington, Virginia, USA, Feb 28 - Mar 28, 2024) DCA Live is excited to announce our first ever NEW Power Women of GovCon list and event! We can’t wait to toast the women leading and advising some of the fastest growing and most exciting firms in the DC region’s robust and dynamic government contracting community. We’ll profile these women in the coming weeks and recognize them at a special event on February 28 in Arlington, VA. Join us! You will want to get to know these great women leaders.

CyberLaunch Competition (Orlando, Florida, USA, Mar 1, 2024) Cyber Florida is thrilled to announce Florida’s first-ever statewide high school cybersecurity competition: CyberLaunch! The CyberLaunch program aims to introduce high school students to the universe of cybersecurity careers through the fun of a statewide competition. The program includes resources for teachers and students who are new to cybersecurity, including classroom activities that provide a sneak peek of the competition platform for practice! Through this endeavor, we hope to build interest in cybersecurity careers, awareness of cybersecurity best practices, and help connect the cybersecurity industry in Florida with local school districts.

SANS Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Mar 4 - 9, 2024) At SANS Las Vegas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.27.24