In this episode of CyberWire-X, N2K’s CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined by guest Rohit Dhamankar, Fortra's Vice President of Product Strategy, and Hash Table member Steve Winterfeld, Akamai's Advisory CISO to discuss CISO initiatives such as vendor consolidation, automation, and attack surface management as a way to determine if it’s possible to achieve both increased security maturity and decreased operational load. This session covers common mistakes when adopting security technologies, including the pros and cons of AI, and how to better collaborate together.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A look back at Patch Tuesday. BlackCat uses malicious Google ads. Social engineering in the third quarter of 2023. Are small businesses in denial about ransomware? Molerats have some new tools. Israel turns to NSO Group's Pegasus to search for hostages taken by Hamas. Tim Starks from the Washington Post examines the potential aftermath of a Russian group hitting a Chinese bank. In our Learning Layer, Sam Meisenberg helps a student understand and create a strategy for the CISSP CAT. And a cyberespionage campaign is attributed to Russia's SVR.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/218

Adobe Releases Security Updates for Multiple Products | CISA (Cybersecurity and Infrastructure Security Agency CISA) 

Fortinet Releases Security Updates for FortiClient and FortiGate (Cybersecurity and Infrastructure Security Agency | CISA) 

VMware Releases Security Update for Cloud Director Appliance (Cybersecurity and Infrastructure Security Agency | CISA) 

CISA Releases Two Industrial Control Systems Advisories (Cybersecurity and Infrastructure Security Agency | CISA) 

Microsoft Releases October 2023 Security Updates (Cybersecurity and Infrastructure Security Agency | CISA) 

Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws (BleepingComputer)

SAP Security Patch Day for November 2023 (Onapsis)

The ALPHV/BlackCat Ransomware Gang is Using Google Ads to Conduct… (eSentire)

Q3 2023 Threat Landscape Report: Social Engineering Takes Center Stage (Kroll) 

OpenText Cybersecurity 2023 Global Ransomware Survey: The risk perception gap (OpenText Blogs)

TA402 Uses Complex IronWind Infection Chains to Target Middle East-Based Government Entities (Proofpoint) 

Israel's NSO unleashes controversial spyware in Gaza conflict (Axios) 

APT29 Attacks Embassies Using CVE-2023-38831 (NCSCC)

Cyber-espionage operation on embassies linked to Russia’s Cozy Bear hackers (Record)

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA and the FBI issue an update on Royal Ransomware. A look at Smash-and-grab ransomware attacks as well as Cloud vulnerabilities. A pre-Black Friday look at card skimmers. Fences, and their place in organized cybercrime. DP World Australia restores port operations. Joe Carrigan on scammers taking advantage of the Bitrex crypto market being shut down. In our Industry Voices segment, Usama Houlila from CrossRealms International shares his insights on the pivotal role of AI in cybersecurity. And LockBit may be drawing unwelcome attention to itself. 

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/217

#StopRansomware: Royal Ransomware (Cybersecurity and Infrastructure Security Agency | CISA) 

FBI: Royal ransomware asked 350 victims to pay $275 million (BleepingComputer) 

The Song Remains the Same: The 2023 Active Adversary Report for Security Practitioners (Sophos)

Why 93% of Security Leaders Say Cloud Security Requires Zero Trust Segmentation (Illumio Cybersecurity Blog)

Malwarebytes Labs Reveals 50% Uptick in Credit Card Skimming in Advance of the Holiday Shopping Season (PR Newswire) 

Credit card skimming on the rise for the holiday shopping season (Malwarebytes)

The Fencers: The Lynchpin of Organized Retail Crime Enterprise (Nisos)

DP World cyberattack blocks thousands of containers in ports (BleepingComputer)

Operations at Major Australian Ports Significantly Disrupted by Cyberattack (SecurityWeek) 

Australian Ports Recover From Cyber Incident (Bank Info Security)

DP World: Australia sites back online after cyber-attack (BBC News)

Australian ports resume some operations after major cyberattack (CNN)

Australia Cyberattack Leaves 30,000 Containers Stuck at Ports (Bloomberg) 

Hacking Gang Behind Attack on Largest Global Lender Says It Got Ransom Payment (Bloomberg)

Gang says ICBC paid ransom over hack that disrupted US Treasury market (Reuters) 

After a surprise cyberattack, the world's largest bank had to shuffle a USB stick around Manhattan to do business (PC Gamer)

WSJ News Exclusive | ICBC Hackers Used Methods Previously Flagged by U.S. Authorities (Wall Street Journal) 

Inside Wall Street's scramble after ICBC hack (Reuters) 

Did a ransomware gang mess up by attacking a U.S. arm of China’s biggest bank? (Washington Post)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Australian ports are recovering from a cyberattack. SysAid is hit by Cl0p user Lace Tempest. Ransomware targets China's largest bank. LockBit doxes Boeing as Boeing hangs tough on paying ransom. Docker Engine for DDoS. Rick Howard looks at the SEC’s targeting of SolarWinds’ CISO. And Anonymous Sudan claims attacks on ChatGPT and Cloudflare.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/216

Freight giant DP World recovers from cyber attack, but warns investigation and remediation is 'ongoing' (ABC)

DP World port operations in Australia recovering after cyber-attack (The Loadstar) 

Ransomware attack against China's largest bank. (CyberWire)

China's biggest lender ICBC hit by ransomware attack (Reuters)

Ransomware attack on ICBC disrupts trades in US Treasury market (Financial Times) 

Hackers Hit Wall Street Arm of Chinese Banking Giant ICBC (Wall Street Journal)

LockBit finally publishes its proof-of-hack as Boeing hangs tough. (CyberWire)

SysAid On-Prem Software CVE-2023-47246 Vulnerability (SysAid) 

Critical Vulnerability: SysAid CVE-2023-47246 (Huntress)

SysAid Zero-Day Vulnerability Exploited By Lace Tempest (Rapid7)

SysAid vulnerability exploited. (CyberWire)

OracleIV - A Dockerised DDoS Botnet (Cado Security)

Anonymous Sudan and OpenAI. (CyberWire)

Russia-Linked Hackers Claim Credit for OpenAI Outage This Week (Bloomberg) 

Major ChatGPT Outage Caused by DDoS Attack (SecurityWeek) 

Anonymous Sudan and Skynet claim Cloudflare DDoS takedown (Cyber Daily)

Cloudflare website downed by DDoS attack claimed by Anonymous Sudan (BleepingComputer)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Grace Cassy, and Associate Fellow from Ten Eleven Ventures sits down to share her career path, getting her to where she is now. Grace spent 10 years in the UK Diplomatic Service, working on global security policy in Asia, Europe, and the Americas. Earlier in her career she was an advisor to Prime Minister Tony Blair, specializing in Asia and national security. She also co-founded Epsilon Advisory Partners, a strategy and growth firm working with world-leading global technology companies and investors. Now she is a Co-founder at CyLon and is an Early Stage Investor in cybersecurity companies. She says "I think we probably don't need too many more words, but we definitely need a bit more action." We thank Grace for sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Rick Howard (The Cyberwire’s Chief Analyst, CSO, and Senior Fellow), and the cast of the entire Cyberwire team, honor our U.S. veterans on this special day.

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA, FEMA, and Shields Ready. Ransomware operators exploit 3rd-party tools. A Bittrex bankruptcy phishing campaign. Spammers abuse Google Forms quizzes. Imperial Kitten in action against Israeli targets. Iranian cyberattacks against Israel are called "reactive and opportunistic." In our sponsored Industry Voices segment, Adam Bateman from Push Security outlines how attackers are targeting cloud identities. Luke Vander Linden from RH-ISAC speaks with Target's Ryan Miller and Leah Schwartzman about the evolving fraud landscape retailers are facing with the holidays approaching. And Sandworm and Ukraine's power grid: 2022 attacks may foreshadow the winter of 2023 and 2024.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/215

Shields Ready | CISA (Cybersecurity and Infrastructure Security Agency CISA) 

DHS Unveils New Shields Ready Campaign to Promote Critical Infrastructure Security and Resilience (FEMA) 

US Urges Critical Infrastructure Firms to Get “Shields Ready” (Infosecurity Magazine) 

US launches “Shields Ready” campaign to secure critical infrastructure (CSO Online) 

DHS Launches New Critical Infrastructure Security and Resilience Campaign (SecurityWeek) 

Ransomware Actors Continue to Gain Access through Third Parties and Legitimate System Tools (FBI) 

Phishing Attack Driven by Bittrex Bankruptcy (Abnormal) 

Spammers abuse Google Forms’ quiz to deliver scams (Cisco Talos Blog)

IMPERIAL KITTEN Deploys Novel Malware Families in Middle East-Focused Operations (CrowdStrike)

Microsoft shares threat intelligence at CYBERWARCON 2023 (Microsoft Security)

Iran and Hamas showed no signs of cyber coordination in run-up to war, researchers say (Washington Post) 

Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology (Mandiant)

Russian spies behind cyber attack on Ukraine power grid in 2022 - researchers (Reuters) 

Hackers Linked To Russian Intelligence Blamed For 2022 Ukraine Grid Disruption (RadioFreeEurope/RadioLiberty) 

Ukraine updates: Russia hacked Kyiv's power grid — report – DW – 11/09/2023 (Deutsche Welle) 

Russian Hackers Used OT Attack to Disrupt Power in Ukraine Amid Mass Missile Strikes (SecurityWeek) 

Energy security at forefront of NATO-Ukraine Council meeting (NATO)

Learn more about your ad choices. Visit megaphone.fm/adchoices

CISA claims "No credible threats" to yesterday's US elections. Criminals seek to profit from the .ai top level domain. A Singapore resort sustains a cyberattack. A look ahead at holiday cyber threats. A major Chinese cyberespionage effort against Cambodia. The four cyber phases of a hybrid war. Robert M. Lee from Dragos explains how outside forces affect OT and critical infrastructure security.  Our guest is Dan Neault of Imperva sharing how organizations are behind the eight-ball when relying upon real-time analytics. Cyber and electronic threats to space systems.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/214

CISA Sees Smooth Election Day Operations, No ‘Credible’ Threats (Meritalk) 

The rise of .ai: cyber criminals (and Anguilla) look to profit (Netcraft) 

Singapore’s Marina Bay Sands Says It Was Hit in Data Breach (Bloomberg)

Marina Bay Sands discloses data breach impacting 665,000 customers (BleepingComputer)

Personal data of 665,000 Marina Bay Sands lifestyle rewards members accessed in data security breach (CNA)

Report Examines Cyber Threat Trends Facing Retail and Hospitality This Holiday Season (RH-ISAC)

Chinese APT Targeting Cambodian Government (Unit 42) 

Chinese cyberspies have widely penetrated networks of ally Cambodia (Washington Post) 

Cyber Escalation in Modern Conflict: Exploring Four Possible Phases of the Digital Battlefield (Flashpoint)

Cyber Security of Space Systems ‘Crucial,’ As US Space Force Official Notes Recent Attacks (Via Satellite)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Data brokers offer information on active US military personnel. Current BlueNoroff activity. A new Gootloader variant is active in the wild. Atlassian vulnerabilities actively exploited. The prevalence of breaches. Update on a Barracuda vulnerability. Hacktivism and the cyber course of the Hamas-Israel war. Bot-hunting in Ukraine. Microsoft’s Ann Johnson from Afternoon Cyber Tea speaks with Sharon Barber, Chief Information Officer at Lloyds Banking Group, about cyber trends in financial services. Ben Yelin looks at the ease of purchasing US military personnel data from data brokers And election security is in the news–an off-year election is an election nonetheless.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/213

Researchers find sensitive personal data of US military personnel is for sale online (CNN)

How foreigners can buy data on US military members, for the right price (POLITICO)

GootBot - Gootloader's new approach to post-exploitation (Security Intelligence)

BlueNoroff strikes again with new macOS malware (Jamf)

GootBot - Gootloader's new approach to post-exploitation (Security Intelligence)

Rapid7-Observed Exploitation of Atlassian Confluence CVE-2023-22518 (Rapid7) 

Armis Research Finds One-Third of Global Organizations Experienced Multiple Security Breaches in Last 12 Months (Armis)

Technical analysis: Barracuda Email Security Gateway by Quentin Olagne (Vectra) 

Maccabi Tel Aviv basketball team website comes under cyber attack (The Jerusalem Post) 

The Digital Frontline of the Israel-Hamas Conflict Could Extend Long After the War (Inkstick) 

Five attack vectors that businesses should focus on in the wake of the Israel-Hamas war (SC Media) 

Israel’s cyber defense chief tells CNN he is concerned Iran could increase severity of its cyberattacks (CNN)

SBU blocks 76 bot farms with 3 mln fake accounts since start of full-scale war (Interfax-Ukraine) 

On Election Day, CISA and Partners Coordinate on Security Operations (Cybersecurity and Infrastructure Security Agency)

Cerby Releases “Threat Briefing: Social Media Security and Elections Volume II,” Providing a Detailed Analysis of Security Gaps in Social Media Platforms (Cerby)

Learn more about your ad choices. Visit megaphone.fm/adchoices

A precautionary shutdown at a major US mortgage lender. Call centers as targets. A push to decouple data and identity. The cyber front in the Hamas-Israeli war. Hacktivism and state-sponsored cyberattacks against Israel. The instructive case of TASS and managing influence operations. Deepen Desai from Zscaler talking about the TOITOIN Trojan. Our guest is Joe Nocera, of PwC sharing their latest Global Digital Trust Insights survey and the impact of the SEC's new cybersecurity disclosure rules. And cybercrime on the side of Ukraine (or at least, cybercrime against Russia).

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/212

Mortgage Giant Mr. Cooper Shuts Down Systems Following Cyberattack (SecurityWeek)

TransUnion Report Shows Fraud Attacks on Financial Industry Call Centers Rising (Transunion)

A Bold New Plan to Make Cloud Computing More Secure (IEEE Spectrum) 

The Cyberwarfare Front of the Israel-Gaza War (The National Interest)

Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors (Unit 42)

GhostSec offers Ransomware-as-a-Service Possibly Used to Target Israel (Uptycs) 

Kremlin Sacks TASS Chief for Wagner Mutiny Coverage (The Moscow Times) 

Russia's 2nd-Largest Insurer Rosgosstrakh Hacked; 400GB of Data Sold Online (Hackread - Latest Cybersecurity News, Press Releases & Technology Today)

Learn more about your ad choices. Visit megaphone.fm/adchoices