Uber suffers a data breach. Social media executives testify before Congress. A Large DDoS attack is thwarted in Eastern Europe. The FBI warns of increased cyberattacks against healthcare payment processors. Policy makers consider new OT security incentives. Malek Ben Salem from Accenture on future-proof cloud security. Our guest Diana Kelley from Cybrize discusses the need for innovation and entrepreneurship in cybersecurity. And if you’ve been hoping for a LockerGoga decryptor, you’re in luck.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/179

Uber hacked, internal systems breached and vulnerability reports stolen (BleepingComputer) 

Uber suffers computer system breach, alerts authorities (Washington Post)

Uber Investigating Data Breach After Hacker Claims Extensive Compromise (SecurityWeek) 

Uber Investigating Breach of Its Computer Systems (New York Times)

Uber investigating "total compromise" of its internal systems (Computing) 

There’s No Honor Among Thieves: Carding Forum Staff Defraud Users in an ESCROW Scam (Digital Shadows) 

Social media hearings highlight lack of trust, transparency in sector (The Record by Recorded Future) 

Breaking the Boycott (Cybersixgill)

Record-Breaking DDoS Attack in Europe (Akamai)

Cyber Criminals Targeting Healthcare Payment Processors, Costing Victims Millions in Losses (FBI)

Siemens Mobility CoreShield OWG Software (CISA)

Siemens Simcenter Femap and Parasolid (CISA)

Siemens RUGGEDCOM ROS (CISA) 

Siemens Mendix SAML Module (CISA)

Siemens SINEC INS (CISA)

Siemens RUGGEDCOM ROS (Update A) (CISA)

Simcenter Femap and Parasolid (CISA) 

Siemens Industrial Products Intel CPUs (Update A) (CISA)

Siemens OpenSSL Affected Industrial Products (CISA) 

Siemens OpenSSL Vulnerability in Industrial Products (Update E) (CISA)

Siemens SCALANCE (CISA) 

CISA Adds Six Known Exploited Vulnerabilities to Catalog (CISA)

Building on our Baseline: Securing Industrial Control Systems Against Cyberattacks (House Committee on Homeland Security) 

Bitdefender Releases Universal LockerGoga Decryptor in Cooperation with Law Enforcement (Bitdefender Labs)

Learn more about your ad choices. Visit megaphone.fm/adchoices

This joint Cybersecurity Advisory highlights continued malicious cyber activity by advanced persistent threat actors affiliated with the Iranian Government’s Islamic Revolutionary Guard Corps. The IRGC-affiliated actors are actively targeting a broad range of entities, including entities across multiple U.S. critical infrastructure sectors as well as Australian, Canadian, and United Kingdom organizations. 

AA22-257A Alert, Technical Details, and Mitigations

AA22-257A.stix

CISA’s Iran Cyber Threat Overview and Advisories

FBI’s Iran Threat webpage.

Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities

Technical Approaches to Uncovering and Remediating Malicious Activity

All organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at [email protected] or (888) 282-0870 and to the FBI via your local FBI field office or the FBI’s 24/7 CyWatch at (855) 292-3937 or [email protected].

Learn more about your ad choices. Visit megaphone.fm/adchoices

Nuisance-level DDoS and cyberespionage continue to mark Russia's cyber campaign in the hybrid war. There’s a US Presidential memorandum on software supply chain security. Webworm repurposes older RATs. Trends in cyber insurance claims. OriginLogger may be the new Agent Tesla. The SparklingGoblin APT described. Mathieu Gorge of VigiTrust describes cyber vulnerabilities in the hospitality industry. Dinah Davis from Arctic Wolf explains a PayPal phishing attack. And Royal funeral phishbait.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/178

Pro-Russia hackers claim to have temporarily brought down Japanese govt websites (Asia News Network)

Gamaredon APT targets Ukrainian government agencies in new campaign (Cisco Talos)

Russia-linked Gamaredon APT target Ukraine with a new info-stealer (Security Affairs)

Fears grow of Russian spies turning to industrial espionage (The Record by Recorded Future)

Enhancing the Security of the Software Supply Chain through Secure Software Development Practices (The White House)

Enhancing the Security of the Software Supply Chain to Deliver a Secure Government Experience (The White House)

White House releases post-SolarWinds federal software security requirements (Federal News Network)

Webworm: Espionage Attackers Testing and Using Older Modified RATs (Threat Hunter Team Symantec)

Coalition Releases 2022 Cyber Claims Report: Mid-year Update (GlobeNewswire News Room)

OriginLogger: A Look at Agent Tesla’s Successor (Unit 42) 

You never walk alone: The SideWalk backdoor gets a Linux variant (WeLiveSecurity)

[Scam site harvests credentials] (Proofpoint)

Current, former social media execs address national security issues at Senate hearing (Fox Business)

Senators Have Stopped Embarrassing Themselves at Tech Hearings (Slate Magazine)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Patch Tuesday notes. The US Senate Judiciary Committee hears from the Twitter whistleblower. Joint warning of IRGC cyber activity. Rob Boyce from Accenture on cybercriminals weaponizing leaked ransomware data. Chris Novak from Verizon describes his participation in the CISA Advisory Board. And Ukraine reiterates confidence in its resiliency.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/177

Adobe Patches 63 Security Flaws in Patch Tuesday Bundle (SecurityWeek)

Microsoft Releases September 2022 Security Updates (CISA)

Microsoft's September Patch Tuesday fixes five critical bugs (Computing)

Microsoft Raises Alert for Under-Attack Windows Flaw (SecurityWeek)

SAP Security Patch Day September 2022 (Onapsis) 

Apple Releases Security Updates for Multiple Products (CISA)

Apple fixes eighth zero-day used to hack iPhones and Macs this year (BleepingComputer) 

Apple Will Let You Remove Rapid Security Response Updates in iOS 16 (Mac Rumors)

Data Security at Risk: Testimony from a Twitter Whistleblower (United States Senate Committee on the Judiciary)

Twitter Employees Have Too Much Access to Data, Whistleblower Says (Wall Street Journal) 

Twitter whistleblower reveals employees concerned China agent could collect user data (Reuters)

Security failures cause ‘real harm to real people’ (Washington Post)

Twitter whistleblower testifies to Congress, calls for tech regulation reforms (The Record by Recorded Future)

The Search for Dirt on the Twitter Whistle-Blower (The New Yorker)

Whistle-Blower Says Twitter ‘Chose to Mislead’ on Security Flaws (New York Times) 

Twitter whistleblower says site put growth over security (Computing) 

Written Statement of Peiter (“Mudge”) Zatko United States Senate Judiciary Committee September 13, 2022 (Katz Banks Kumin) 

What we learned when Twitter whistleblower Mudge testified to Congress (TechCrunch) 

How China became big business for Twitter (Reuters)

Twitter whistleblower exposes limits of FTC’s power (Washington Post)

Twitter Whistle-Blower Testimony Spurs Calls for Tech Regulator (Bloomberg)

Iranian Islamic Revolutionary Guard Corps-Affiliated Cyber Actors Exploiting Vulnerabilities for Data Extortion and Disk Encryption for Ransom Operations (CISA)

Ukraine’s Cyberwar Chief Sounds Like He’s Winning (WIRED) 

DDoS attacks on financial sector surge during war in Ukraine, new FCA data reveals (PR Newswire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this extended interview, CyberWire Daily Podcast host Dave Bittner sits down with members of the FBI's Baltimore field office: Special Agent in Charge, Tom Sobocinski, and Supervisory Special Agent for Cyber, Tom Breeden. As part of the FBI's cybersecurity awareness campaign, they discuss what the FBI can do to enhance and amplify cyber efforts in ways unlike any other public or private organization. This interview from August 30, 2022 originally aired as a shortened version on the CyberWire Daily Podcast.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Apple patches its software. Reviewing the cyber phase of a hybrid war. The return of the (ShadowPad) alumni. Phishing from the Static Expressway. The state of cloud security. Overconfidence comes at a cost. Ann Johnson of Afternoon Cyber Tea speaks with Dr. Josephine Wolff from the Fletcher School about cyber insurance past. My conversation with FBI special agents Tom Sobocinski and Tom Breeden. And Charming Kitten and group-think in social engineering.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/176

Apple security updates (Apple Support)

Ukraine Cyber War Update September 2022 (CyberCube)

New Wave of Espionage Activity Targets Asian Governments (Broadcom Software Blogs)

Chinese gov’t hackers using ‘diverse’ toolset to target Asian prime ministers, telecoms (The Record by Recorded Future)

Leveraging Facebook Ads to Send Credential Harvesting Links (Avanan)

Unpatched and Outdated Medical Devices Provide Cyber Attack Opportunities (FBI) 

CFO Cyber Security Survey: Over-Confidence is Costly (Kroll) 

Snyk’s State of Cloud Security Report Reveals 80% of Organizations Have Experienced a Severe Cloud Security Incident in Past Year (Snyk) 

Look What You Made Me Do: TA453 Uses Multi-Persona Impersonation to Capitalize on FOMO (Proofpoint)

Iranian military using spoofed personas to target nuclear security researchers (The Record by Recorded Future)

Alleged cyber commander of Iran’s Revolutionary Guard named by opposition outlet (Times of Israel)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Albania reports additional cyberattacks from Iran over the weekend. RaidForums has a new successor. A look at threat actor reconnaissance in the contemporary Internet. Kinetic strikes hit Ukraine’s infrastructure. Rick Howard calculates risk with classic mathematical theorems. Tim Eades from Cyber Mentor Fund on the dynamic nature of the attack surface. And a look into the cyber phase of the hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/11/175

Albania blames Iran for second cyberattack since July (CNN)

Treasury Sanctions Iranian Ministry of Intelligence and Minister for Malign Cyber Activities (US Department of the Treasury)

Iran strongly condemns US sanctions over Albania hacking (Al Arabiya)

Six months into Breached: The legacy of RaidForums? (KELA)

2022 State of the Internet Report (Censys)

Ukraine hails snowballing offensive, blames Russia for blackouts (Reuters)

Ukraine says Russia is retaliating by hitting critical infrastructure, causing blackouts. (New York Times)

Last reactor at Ukraine’s Zaporizhzhia nuclear plant stopped (Associated Press)

Ukraine Warns Russian Cyber Onslaught Is Coming (Voice of America)

Montenegro wrestles with massive cyberattack, Russia blamed (ABC News)

CyberCube: Russia’s Sovereign Internet Creates Security Risks With Implications for Cyber (Re)Insurance While War in Ukraine Develops (Associated Press)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Mark Logan, CEO of One Identity, sits down to share his story, explaining how he fit into different roles growing up in different companies. Mark has nearly two decades of C-Suite experience at an array of different organizations, finally landing on his current position as the CEO at One Identity. Sharing his different roles, he also gives a quote from Steve Jobs, saying "it's not what I say yes to, it's what I say no to." He believes that's a key area for his workers because when he is able to make up his mind, his team and his customers have someone they can rely on. Mark says that as a CEO he wants to share the advice of always marching towards your goals, and identifying that different people have different goals because they work in different fields, but that's what makes a company work best. He says "I've found that the more you can delegate, provided you've got the right folks in place the better." We thank Mark for sharing his story.

Learn more about your ad choices. Visit megaphone.fm/adchoices

From the 20th anniversary of 9/11 in 2021, Rick Howard, the CyberWire’s CSO, Chief Analyst, and Senior Fellow, recounts his experience from inside the Pentagon running the communications systems for the Army Operations Center.

CyberWire Pro subscribers also get exclusive access to Rick's original 2001 essay with notes from the day of the attack. If you would like to check that out, you can subscribe today.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Deepen Desai from Zscaler ThreatLabz joins Dave to discuss their work on "Return of the Evilnum APT with updated TTPs and new targets." Zscaler’s ThreatLabz team recently caught a new Evilnum APT attack campaign that uses the document template on MS Office Word to inject malicious payload to the victim's machine. There are three new instances used of the campaign, including updated tactics, techniques, and procedures.

Researchers have been closely monitoring Evilnum APT’s activity. They ssay ThreatLabz identified several domains associated with the Evilnum APT group. Which has led them to discover that the "group has been successful at flying under the radar and has remained undetected for a long time."

The research can be found here:

• Return of the Evilnum APT with updated TTPs and new targets

Learn more about your ad choices. Visit megaphone.fm/adchoices