The CyberWire Daily

It’s always DNS, but that may just be FUD. The DoD notifies victims of a cloud email server leak. New Jersey cops sue online data brokers. Crooks use WiFi jammers to thwart security systems. A copyright case against OpenAI is partially dismissed. Patch Tuesday includes two actively exploited zero days. CharmingCypress gathers political intelligence. Ann Johnson from Microsoft Security’s Afternoon Cyber Tea podcast talks with Frank Cilluffo, Director for Cyber and Critical Infrastructure Security at the McCrary Institute of Auburn University, about cyber and critical infrastructure. And beware Cupid’s misleading arrow.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Ann Johnson from Microsoft Security’s Afternoon Cyber Tea podcast talks with Frank Cilluffo, Director for Cyber and Critical Infrastructure Security at the McCrary Institute of Auburn University, about cyber and critical infrastructure. Check out the episode with the full conversation between Ann and Frank here. 

KeyTrap DNS Attack Could Disable Large Parts of Internet: Researchers (SecurityWeek)

US military notifies 20,000 of data breach after cloud email leak (TechCrunch)

New Jersey law enforcement officers sue 118 data brokers for not removing personal info (The Record)

Minnesota burglars are using Wi-Fi jammers to disable home security systems (TechSpot)

Sarah Silverman’s lawsuit against OpenAI partially dismissed (The Verge)

Microsoft February 2024 Patch Tuesday fixes 2 zero-days, 73 flaws (BleepingComputer)

DarkMe Malware Targets Traders Using Microsoft SmartScreen Zero-Day Vulnerability (The Hacker News)

CharmingCypress Use Poisoned VPN Apps to Install Backdoor (Cyber Security News)

Beyond the Hype: Questioning FUD in Cybersecurity Marketing  (SecurityWeek)

Valentine's Day Scams Woo the Lonely-Hearted (Security Boulevard) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Attackers lock up Azure accounts with MFA. Bank of America alerts customers to a third party data breach. Malicious cyber activity targets elections worldwide. CISA highlights a vulnerability in Roundcube Webmail. Lawmakers introduce a bipartisan bill to enhance healthcare cybersecurity. Siemens and Schneider Electric address multiple industrial vulnerabilities. Perception in tech gender parity still has a ways to go. Dave Bittner speaks with Guests Andrew Scott, Associate Director of China Operations at CISA, and Brett Leatherman, Section Chief for Cyber at the FBI, about Chinese threat actor Volt Typhoon. And the scourge of online obituary spam. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guests Andrew Scott, Associate Director of China Operations at CISA, and Brett Leatherman, Section Chief at FBI, discussing  PRC/Volt Typhoon advisory and living off the land guidance. Read the press release on “U.S. and International Partners Publish Cybersecurity Advisory on People’s Republic of China State-Sponsored Hacking of U.S. Critical Infrastructure.”

Ongoing campaign compromises senior execs’ Azure accounts, locks them using MFA (Ars Technica) 

Bank of America warns customers of data breach after vendor hack (BleepingComputer)

Global Malicious Activity Targeting Elections is Skyrocketing (Security Affairs)

CISA Warns Of Active Attacks on Roundcube Webmail XSS Vulnerability (CISA)

Bipartisan Senate Bill Requires HHS to Bolster Cyber Efforts (Gov Info Security)

ICS Patch Tuesday: Siemens Addresses 270 Vulnerabilities (SecurityWeek) 

Four in five men in tech say women are treated equally, as women criticise ‘invisible challenges’ (Euronews)

The rise of obituary spam (The Verge) 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The DOJ shuts down the Warzone rat. Ransomware hits over twenty Romanian hospitals, and Rysida gets a decryptor. Canada may ban the Flipper Zero. Chinese espionage claims against the US are light on facts. Australia looks to criminalize doxxing. Federal IT leaders seek better coordination with CISA and the JCDC. Wired looks at the effect of cyberattacks on inequality. Our guest is Manny Felix, Founder and CEO of US Cyber Initiative, sharing their work in unlocking cyber career opportunities for young people. And this thumb drive will self-destruct in five seconds.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Manuel "Manny" Felix, Founder and CEO of US Cyber Initiative, sharing their work in unlocking career opportunities for young people who are interested in cyber and emergent technology. US Cyber Initiative grew out of AZ Cyber. Learn more about AZ Cyber here. 

DOJ shuts down ‘Warzone’ malware vendor and charges two in connection (The Record)

Ransomware attack forces 18 Romanian hospitals to go offline (BleepingComputer)

Decryptor for Rhysida ransomware is available (Help Net Security)

Canada moves to ban the Flipper Zero amid rising auto theft concerns (TECHSPOT)

China’s Cyber Revenge | Why the PRC Fails to Back Its Claims of Western Espionage (SentinelOne)

‘Doxxing’ laws to be brought forward after Jewish WhatsApp leak  (The Sydney Morning Herald)

Exclusive: Duke Energy to remove Chinese battery giant CATL from Marine Corps Base (Reuters)

Federal IT officials call on CISA for tougher standards, more coordination (FedScoop)

Priorities of the Joint Cyber Defense Collaborative for 2024 (CISA)

The Hidden Injustice of Cyberattacks (WIRED)

Ovrdrive USB stick with data-hiding and overheating self-destruct features nears crowdfunding goal (TechSpot)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Computer security writer, podcaster and public speaker Graham Cluley describes learning to program on his own from magazines, creating text adventure games for donations, and his journey from programming to presenting and writing with a bit of tap dancing on the side. Along the way, Graham collaborated with others and learned to communicate so that all could understand, not just techies. Our thanks to Graham for sharing his story with us. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Jon DiMaggio, Chief Security Strategist for Analyst1, is discussing his research on "Ransomware Diaries Volume 4: Ransomed and Exposed - The Story of RansomedVC." While there is evidence to support that RansomedVC runs cybercrime operations, Jon questions the claims it made regarding the authenticity of the data it stole and the methods it used to extort victims.

The research states "I uncovered sensitive information about the group's leader, Ransomed Support (also known as Impotent), relating to secrets from his past." In this episode John shares his 6 key findings after spending months engaging with the lead criminal who runs RansomedVC.

The research can be found here:

• Ransomware Diaries Volume 4: Ransomed and Exposed - The Story of RansomedVC

Learn more about your ad choices. Visit megaphone.fm/adchoices

A LastPass imitator sneaks its way past Apple’s app store review. Bitdefender identifies a new macOS backdoor. The Air Force and Space Force collaborate for stronger cyber defense. CISA offers an election security advisory program. The FCC bans AI robocalls. The Feds put a bounty on the Hive ransomware group. Senators introduce a bipartisan drone security act. Cisco Talos IDs a new cyber espionage campaign. Fighting the good fight against software bloat. On our Solution Spotlight, N2K President Simone Petrella talks with Amy Kardel, Senior Vice President for Strategic Workforce Relationships at CompTIA about the cyber talent gap. And sports fans check your passwords. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Solution Spotlight, N2K President Simone Petrella talks with Amy Kardel, Senior Vice President for Strategic Workforce Relationships at CompTIA about their perspectives and initiatives in response to the cyber talent gap.

Fake LastPass App Sneaks Past Apple's Review Team (MacRumors)

Warning: Fraudulent App Impersonating LastPass Currently Available in Apple App Store (LastPass)

New Rust-Based macOS Backdoor Steals Files, Linked to Ransomware Groups (HACKREAD)

New Department of Air Force partnership brings cyber, space and information units closer (DefenseScoop)

Federal Cybersecurity Agency Launches Program to Boost Support for State, Local Election Offices (SecurityWeek)

FCC votes to outlaw scam robocalls that use AI-generated voices (CNN Business)

US offers $10 million for tips on Hive ransomware leadership (Bleeping Computer)

New legislation would give NIST drone cybersecurity responsibilities (FedScoop) 

New Zardoor backdoor used in long-term cyber espionage operation targeting an Islamic organization (Talos Intelligence)

Why Bloat Is Still Software’s Biggest Vulnerability (IEEE Spectrum)

Super Bowl of Passwords: Chiefs vs. 49ers in the Battle of Cybersecurity (Security Boulevard)

Taylor Swift's Influence on Cybersecurity (Enzoic)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A joint advisory warns of Volt Typhoon’s extended network infiltration. Check your Cisco devices for patches. Fortinet clarifies its latest vulnerabilities. Internet outages plague Pakistan on election day. Kaspersky describes the new Coyote banking trojan. Cyber insurance is projected to reach new heights. The White House appoints a leader for the AI Safety Institute, and sees pushback on proposed reporting regulations. Can we hold AI liable for its foreseeable harms? Joe Carrigan joins us with insights on the Mother of All Data Breaches. The potential of Passkeys versus the comfort of passwords.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Podcast partner and Hacking Humans co-host Joe Carrigan stops by today to discuss the mother of all data breaches.

Chinese hackers hid in US infrastructure network for 5 years (BleepingComputer) 

Akira, LockBit actively searching for vulnerable Cisco ASA devices (Help Net Security)

Cisco fixes critical Expressway Series CSRF vulnerabilities (SecurityAffairs)

Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure (BleepingComputer) 

Pakistani telcos suffer widespread Internet blackouts on election day (DCD)

Coyote: A multi-stage banking Trojan abusing the Squirrel installer (Securelist)

Cyber insurance market growing dramatically, Triple-I Finds (AI-TechPark)

Biden Administration Names a Director of the New AI Safety Institute (SecurityWeek)

No one's happy with latest US cyber incident reporting plan (The Register)

DHS Is Recruiting Techies for the AI Corps (BankInfoSecurity)

Can the courts save us from dangerous AI? (Vox)

I Stopped Using Passwords. It's Great—and a Total Mess (WIRED)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A security researcher has been charged in an alleged multi-million dollar theft scheme targeting Apple. A House committee hearing explores OT security. Fortinet withdraws accidental CVEs. 2023 saw record highs in ransomware payments. A youtuber finds a cheap and easy bypass for Bitlocker encryption. Political pressure proves challenging for the JCDC. New Hampshire tracks down those fake Biden robocalls. European security agencies bolster warnings about Ivanti devices. HHS fines a New York medical center millions over an identity theft ring. On our sponsored Industry Voices segment, Navneet Singh, Vice President of Marketing Network Security at Palo Alto Networks, shares some practical examples of healthcare organizations transitioning to the cloud. Giving that toothbrush story the brushoff.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Industry Voices segment, Navneet Singh, Vice President of Marketing Network Security at Palo Alto Networks, discusses the transition to the cloud and shares some practical examples in healthcare.

A Security Researcher Allegedly Scammed Apple (404 Media)

US House Homeland Security subcommittee addresses OT threats, CISA's role in securing OT - Industrial Cyber (Industrial Cyber)

Operational Technology disruptions: An eye on the water sector. Robert M. Lee’s opening statement to before the U.S. Congressional Subcommittee on Cybersecurity and Infrastructure Protection. (Control Loop podcast)

Securing Operational Technology: A Deep Dive into the Water Sector (Homeland Security Events YouTube)

Fortinet Patches Critical Vulnerabilities in FortiSIEM (SecurityWeek)

Fortinet snafu: Critical FortiSIEM CVEs are duplicates, issued in error (Bleeping Computer)

Ransomware hackers raked in $1 billion last year from victims (NBC News)

BitLocker encryption broken in 43 seconds with sub-$10 Raspberry Pi Pico — key can be sniffed when using an external TPM (Tom’s Hardware)

The far right is scaring away Washington's private hacker army (POLITICO)

N.H. attorney general says he found source of fake Biden robocalls (NBC News)

European security agencies publish joint statement on Ivanti Connect Secure, Policy Secure vulnerabilities (Industrial Cyber)

Medical Center Fined $4.75M in Insider ID Theft Incident (GovInfoSecurity)

Surprising 3 Million Hacked Toothbrushes Story Goes Viral—Is It True? (Forbes)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The global community confronts spyware. Canon patches critical vulnerabilities in printers. Barracuda recommends mitigations for Web Application Firewall issues. Group-IB warns of ResumeLooters. Millions are at risk after a data breach in France. Research from the UK reveals contradictory approaches to cybersecurity. Meta’s Oversight Board recommends updates to Facebook’s Manipulated Media policy. We’ve got a special segment from the Threat Vector podcast examining Ivanti's Connect Secure and Policy Secure products. And it’s time to brush up on IOT security. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

In a special segment from Palo Alto Networks’ Threat Vector podcast, host David Moulton, Director of Thought Leadership at Unit 42, along with guests Sam Rubin, VP, Global Head of Operations, and Ingrid Parker, Senior Manager of the Intel Response Unit, dives deep into the critical vulnerabilities found in Ivanti's Connect Secure and Policy Secure products. You can check out the full conversation here. 

US to restrict visas for those who misuse commercial spyware (Reuters)

Britain and France assemble diplomats for international agreement on spyware (The Record)

Israeli government absent from London spyware conference and pledge (The Record)

Government hackers targeted iPhones owners with zero-days, Google says (TechCrunch)

Google agrees to pay $350 million settlement in security lapse case (Washington Post)

Canon Patches 7 Critical Vulnerabilities in Small Office Printers  (SecurityWeek)

Barracuda Disclosed Critical Vulnerabilities in WAF, Affecting File Upload and JSON Protection (SOCRadar)

ResumeLooters target job search sites in extensive data heist (Help Net Security)

Millions at risk of fraud after massive health data hack in France (The Connexion)

Fragmented cybersecurity vendor landscape is exacerbating risks and compounding skills shortages, SenseOn research reveals (IT Security Guru)

Meta’s Oversight Board Urges a Policy Change After a Fake Biden Video (InfoSecurity Magazine)

Toothbrushes are a cybersecurity risk, too: millions participate in DDoS attacks (Cybernews)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Anydesk confirms a serious breach. Clorox and Johnson Controls file cyber incidents with the SEC. There’s already a potential Apple Vision Pro kernel exploit. A $25 million deepfake scam. Akamai research hops on the FritzFrog botnet. The US sanctions Iranians for attacks on American water plants. Commando Cat targets Docker API endpoints. Pennsylvania courts fall victim to a DDoS attack. A new leader takes the reins at US Cyber Command and the NSA. Our guest is Dr. Heather Monthie from N2K Networks, with insights on the White House's recent easing of education requirements for federal contract jobs. And remembering one of the great cryptology communicators. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Heather Monthie from N2K Networks shares some insight into the White House's recent easing of education requirements for federal contract jobs. You can find the background to that in our Selected Reading section. 

AnyDesk, an enterprise remote software platform used by major firms including Raytheon and Samsung, suffered a security breach - here’s what you need to know (IT Pro)

Clorox and Johnson Controls Reveal $76m Cyber-Attack Bill (Infosecurity Magazine)

MIT student claims to hack Apple Vision Pro on launch day (Cybernews)

Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’ (CNN)

FritzFrog botnet is exploiting Log4Shell bug now, experts say (The Record)

US sanctions Iranian officials over cyber-attacks on water plants (BBC)

The Nine Lives of Commando Cat: Analysing a Novel Malware Campaign Targeting Docker  (Cado Security)

Pennsylvania court agency's website hit by disabling cyberattack, officials say (ABC News)

Cyber Command, NSA usher in Haugh as new chief (The Record)

White House moves to ease education requirements for federal cyber contracting jobs (CyberScoop)

White House moves to ease education requirements for federal cyber contracting jobs (GAO)

David Kahn, historian who cracked the code of cryptology, dies at 93 (Washington Post)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices