The CyberWire Daily

The US healthcare sector is struggling to recover from a cyberattack. Russia listens in via Webex. The former head of NCSC calls for a ransomware payment ban. An Indian content farm mimics legitimate online news sites. The FTC reminds landlords that algorithmic price fixing is illegal. FCC employees are targeted by a phishing campaign. Experts weigh in on NIST’s updated cybersecurity framework. Police shut down the largest German-speaking cybercrime market. Guest Mike Hanley, Chief Security Officer and the Senior Vice President of Engineering at GitHub, shares insights with Ann Johnson of Afternoon Cyber Tea. And celebrating the most inspiring women in cyber.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Mike Hanley, Chief Security Officer and the Senior Vice President of Engineering at GitHub, shares insights with Ann Johnson of Afternoon Cyber Tea. You can hear their full discussion here, and tune in to Microsoft Security’s Afternoon Cyber Tea every other Tuesday on the N2K’s CyberWire Network.  

Health-care hack spreads pain across hospitals and doctors nationwide (Washington Post)

Russia’s chief propagandist leaks intercepted German military Webex conversation (The Record)

Cyber ransoms are too profitable. Let’s make paying illegal (The Times UK)

News farm impersonates 60+ major outlets: BBC, CNN, CNBC, Guardian… (Bleeping Computer)

Price fixing by algorithm is still price fixing (Federal Trade Commission)

FCC Employees Targeted in Sophisticated Phishing Attacks (SecurityWeek)

Industry Reactions to NIST Cybersecurity Framework 2.0: Feedback Friday (SecurityWeek)

Germany takes down cybercrime market with over 180,000 users (Bleeping Computer)

Exceptional Women Recognised for Contribution to Cyber Industry at Most Inspiring Women in Cyber Awards 2024 (IT Security Guru)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Product Manager in Anti-Fraud Solutions at SpyCloud, Pattie Dillon shares her journey from raising her family to specializing in the anti-fraud space. Upon reentering the workforce, Pattie worked on identity verification and developed a system with privacy concerns in mind. She moved to work in gift cards and was exposed to money laundering. Traveling along the fraud spectrum, Pattie learned about underground data and feels that this data can be leveraged to actually prevent and fight online fraud. Pattie believes if you don't try, you'll never know. We know we appreciate Pattie sharing her story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

This week we are joined by, Selena Larson from Proofpoint, who is discussing their research, "Bumblebee Buzzes Back in Black." Bumblebee is a sophisticated downloader used by multiple cybercriminal threat actors and was a favored payload from its first appearance in March 2022 through October 2023 before disappearing.

After a four month hiatus, Proofpoint researchers found that the downloader returned. Its return aligns with a surge of cybercriminal threat activity after a notable absence of many threat actors and malware.

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

A court orders NSO Group to hand over their source code. The Five Eyes reiterate warnings about Ivanti products. Researchers demonstrate a generative AI worm. Fulton County calls LockBit’s bluff. SMS codes went unprotected online. Golden Corral serves up a buffet of personal data. Ransom demands continue to climb. A US Senator calls on the FTC to investigate auto industry privacy practices. Dressing up data centers. Our guest is Dominic Rizzo, founder and director of OpenTitan and CEO at zeroRISC, discussing the first open-source silicon project to reach commercial availability. And Cops can’t keep their suspects straight. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest is Dominic Rizzo, founder and director of OpenTitan and CEO at zeroRISC, discussing the first open-source silicon project to reach commercial availability. You can find the press release here. 

Five Eyes Warn of Ivanti Vulnerabilities Exploitation, Detection Tools Insufficient (Infosecurity Magazine)

A leaky database spilled 2FA codes for the world’s tech giants (TechCrunch)

Report: Average Initial Ransomware Demand in 2023 Reached $600K (Security Boulevard)

Here Come the AI Worms (WIRED)

Golden Corral restaurant chain data breach impacts 183,000 people (Bleeping Computer)

Hackers stole 'sensitive' data from Taiwan telecom giant: ministry(Tech Xplore)

CISA adds Microsoft Streaming Service bug to its Known Exploited Vulnerabilities catalog (Security Affairs)

Senator asks FTC to investigate automakers’ data privacy practices (The Record)

Looking good, feeling safe – data center security by design (Data Center Dynamics)

Cops visit school of 'wrong person's child,' mix up victims and suspects in epic data fail (The Register)

OpenTitan® Partnership Makes History as First Open-Source Silicon Project to Reach Commercial Availability (lowRISC)

Creating Connections: Embracing change. (N2K Women in STEM newsletter) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Iran-Linked Cyber-Espionage Targets Middle East's Aerospace and Defense. SpaceX is accused of limiting satellite internet for US troops. Savvy Seahorse' Floods the Net with Investment Scams. GUloader Malware draws on a crafty graphic attack vector. Repo confusion attacks persist. European consumer groups question Meta’s data collection options. Allegations of Russia targeting civilian critical infrastructure in Ukraine. Cisco patches high-severity flaws. The US puts a Canadian cyber firm on its Entity List. On the Threat Vector segment, we have a conversation between host David Moulton and Michael "Siko" Sikorski, Unit 42's CTO and VP of Engineering, discussing Unit 42's 2024 Incident Response Report. And the counter-productive messaging in anti-piracy campaigns. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On the Threat Vector segment, we have a conversation between host David Moulton, Director of Thought Leadership at Palo Alto Networks Unit 42,  and Michael "Siko" Sikorski, Unit 42's CTO and VP of Engineering, discussing the Unit 42's 2024 Incident Response Report. 

Suspected Iranian cyber-espionage campaign targets Middle East aerospace, defense industries (The Record)

US tells Musk to allow service in Taiwan (Taipei Times)

SpaceX Refutes Claim It’s Withholding Starshield in Taiwan (Bloomberg) 

Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads (infoblox)

GUloader Unmasked: Decrypting the Threat of Malicious SVG Files  (McAfee Blog)

Over 100,000 Infected Repos Found on GitHub (Apiiro)

Rights groups file GDPR suits on Meta's pay-or-consent model (The Register)

Russia Attacked Ukraine's Power Grid at Least 66 Times to ‘Freeze It Into Submission’ (WIRED)

Cisco Patches High-Severity Vulnerabilities in Data Center OS  (SecurityWeek)

Network intelligence company Sandvine banned from trading in the US  (SC Media)

Intimidating anti-piracy warnings have the opposite effect on men, new study says (TechSpot)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

President Biden is set to sign an executive order restricting overseas sharing by data brokers. US Federal agencies warn of exploited Ubiquiti EdgeRouters. A new ransomware operator claims to have hacked Epic Games. A cross-site scripting issue leaves millions of Wordpress sites vulnerable. The Rhysida ransomware group posts a multi-million dollar ransom demand on a Children’s Hospital in Chicago. Mandiant tracks Chinese threat actors targeting Ivanti VPNs. The former head of DHS weighs in on a federal cyber insurance backstop. Domain Registrars offer bulk name blocking for brands. Our guest is Magpie Graham, Principal Adversary Hunter Technical Director at Dragos, reviews the key findings of Dragos’ Cybersecurity Year in Review report. Cameo celebrities are taken out of context for political gains.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Magpie Graham, Principal Adversary Hunter Technical Director at Dragos, reviews the key findings of Dragos’ Cybersecurity Year in Review report. You can download a copy of the report here. To hear the full interview with Magpie, check out Control Loop. 

Biden Executive Order Targets Bulk Data Transfers to China (GovInfo Security)

FBI Alert: Russian Hackers Target Ubiquiti Routers for Data, Botnet Creation (HACKREAD)

Fortnite game developer Epic Games allegedly hacked (Cyber Daily)

LiteSpeed Cache Plugin XSS Flaw Exposes 4M+ Million Sites to Attack (Cyber Security News)

Ransomware gang seeks $3.4 million after attacking children’s hospital (The Record)

Chinese Cyberspies Use New Malware in Ivanti VPN Attacks (SecurityWeek)

A Cyber Insurance Backstop (Schneier on Security)

Cyberwar Podcast with Kate and Alex - Special Guest Michael Chertoff 

Registrars can now block all domains that resemble brand names (BleepingComputer)

Cameo is being used for political propaganda — by tricking the stars involved (NPR)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

NIST’s Cybersecurity Framework gets an upgrade. ONCD makes a case against memory-related software bugs. A recent cyberattack targets Canada's Royal Canadian Mounted Police. US dethrones Russia as top target in cyber breaches. Caveat podcast cohost Ben Yelin discusses remedies in the generative AI copyright cases.And, Reggaeton Be Gone, a creative way to deal with your neighbors’ music choices. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Ben Yelin, cohost of Caveat podcast and Program Director, Public Policy & External Affairs at University of Maryland Center for Health and Homeland Security, thinking about remedies in the generative AI copyright cases. You can find the Lawfare article Ben references here.  

NIST Releases Version 2.0 of Landmark Cybersecurity Framework (NIST)

After decades of memory-related software bugs, White House calls on industry to act (The Record) 

Canada's RCMP, Global Affairs Hit by Cyberattacks (SecurityWeek)

A cyber attack hit the Royal Canadian Mounted Police (Security Affairs) 

UK email mistake put ‘lives at risk’ for Afghans who had worked with British military (The Record) 

Russia and Belarus targeted by at least 14 nation-state hacker groups, researchers say (The Record) 

Number of data breaches falls globally, triples in the US (TechSpot)

Steel giant ThyssenKrupp confirms cyberattack on automotive division (Bleeping Computer)

The Change Healthcare cyberattack is still impacting pharmacies. It's a bigger deal than you think (Fast Company)

US Pharmacy Outage Triggered by 'Blackcat' Ransomware at UnitedHealth Unit, Sources Say (US News and World Report) 

Getting Ahead of Cybersecurity Materiality Mayhem (Security Boulevard) 

Raspberry Pi maker builds device to hack neighbor's Bluetooth speakers that were streaming annoying music (TechSpot)

Reggaeton Be Gone (Hackster.io)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

LockBits reawakening. China's ramp up to safety for vital sectors. Data leak leaves China feeling exposed. Malware hidden by North Korea in fake developer job listings. UK Watchdog rebukes firm for biometric scanning of staff at leisure centers. SVR found adapting for the cloud environment. DOE proposes cybersecurity guidelines for the electric sector. Wideness of breach in the financial industry revealed. Moving on to better things. Things are looking up in the cybersecurity startup ecosystem. UK's National Cyber Security Centre announced they are launching a Cyber Governance Training Pack for boards. N2K’s President Simone Petrella talks with Elastic's CISO Mandy Andress about the CISO role and the intersection of cybersecurity, law, and organizational strategy. And, there’s a facial recognition battle going on at Waterloo, the University of Waterloo that is. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Simone Petrella, N2K’s President, talks with Mandy Andress, Elastic's CISO, about the CISO role and the intersection of cybersecurity, law, and organizational strategy.

LockBit Ransomware Gang Resurfaces With New Site (SecurityWeek)

LockBit ransomware gang attempts to relaunch its services following takedown (The Record) 

China to increase protections against hacking for key industries (Reuters)

The I-Soon data leak unveils China's cyber espionage tactics, techniques, procedures, and capabilities. (N2K CyberWire)

Fake Developer Jobs Laced With Malware (Phylum Blog)

Data watchdog tells off outsourcing giant for scanning staff biometrics despite 'power imbalance' (The Register) 

SVR cyber actors adapt tactics for initial cloud access (National Cyber Security Centre)

New DOE-Funded Initiative Outlines Proposed Cybersecurity Baselines for Electric Distribution Systems (Energy.gov) 

LoanDepot says about 17 million customers had personal data and Social Security numbers stolen during cyberattack (TechCrunch) 

Actual filing to Office of Maine Attorney General: Data Breach Notifications - Consumer Protection (Maine.gov) 

U-Haul data breach affects 67,000 customers in US and Canada (AZ Central)

Actual filing to Office of Maine AG: Data Breach Notifications - Consumer Protection (Maine.gov)  

Funding Down, Optimism Up: The Bright Spots For Cybersecurity Startups In 2024 (Forbes)

NCSC to Offer Cyber Governance Guidance to Boards (InfoSecurity Magazine) 

'Facial recognition' error message on vending machine sparks concern at University of Waterloo (CTV News) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Director of Security Engineering at Marqeta and Host of Hacker Valley Studio podcast Chris Cochran describes his transitions throughout the cybersecurity industry, from an intelligence job with the Marine Corps, to starting the intelligence apparatus for the House of Representatives, then on to leading Netflix's threat intelligence capability. Chris points out that when pivoting to different roles and responsibilities, you must rely on your own strengths to move forward and bring value to your work Our thanks to Chris for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Assaf Dahan and Daniel Frank from Palo Alto Networks Cortex sit down with Dave to talk about their research "Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor." From late 2020 to late 2022, Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union.

The research states "They have further deepened their foothold in victims’ environments by mass deployment of web shells, which granted them sustained access, as well as access to internal resources of the compromised websites."

The research can be found here:

• Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor

Learn more about your ad choices. Visit megaphone.fm/adchoices