The CyberWire Daily

Swatting is on the rise. LoanDepot, the Toronto Zoo and the World Council of Churches all confirm ransomware attacks. Iran-linked hackers target Albania. Sea Turtle focuses on espionage and information theft. Fake “security researchers” offer phony ransomware recovery services. Could AI make KYC  EOL? Avast enhances Babuk decryption. Joe Carrigan looks at the human side of email security. And a group of midwives fail to deliver.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, we are joined by Joe Carrigan from JHU ISI on the human elements that impact email security 

Tanya Chutkan, the judge overseeing Trump's federal election interference case, appears to be victim of 'swatting'

Special counsel Jack Smith was targeted by attempted swatting on Christmas Day

LoanDepot Takes Systems Offline Following Ransomware Attack

Toronto Zoo hit by ransomware attack | Cybernews

Rhysida ransomware gang takes responsibility for attack on World Council of Churches

Wiper malware found in analysis of Iran-linked attacks on Albanian institutions

Turkish espionage campaigns in the Netherlands

"Security researcher" offers to delete data stolen by ransomware attackers

Gen AI could make KYC effectively useless | TechCrunch 

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The DOJ concludes its xDedic Marketplace investigation. A cyberattack shuts down a major mortgage lender. The Swiss Air Force suffers third party breach. An update on SilverRAT. The Space Force emphasizes collaboration for effective cyber growth. The DOE announces cyber resilience funding. Merck reaches a settlement on NotPetya. NIST warns of AI threats. Our guest is Dragos CEO Robert M. Lee, with a look at intellectual property theft in manufacturing. And Chump Change fines for big tech. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, we are joined by Robert M. Lee, founder and CEO of Dragos, to discuss intellectual property theft in manufacturing. 

AsyncRAT campaign targets US infrastructure. (CyberWire)

19 Individuals Worldwide Charged In Transnational Cybercrime Investigation Of The xDedic Marketplace (US Department of Justice)

Space Force is crafting in-house cyber teams but sees need for closer work with USCYBERCOM (Nextgov/FCW)

Energy Department has cyber threats to infrastructure in mind with $70 million funding offer (FedScoop)

Swiss Air Force documents exposed via cyber attack on third party (BeyondMachines.net)

Major IT, Crypto Firms Exposed to Supply Chain Compromise via New Class of CI/CD Attack (SecurityWeek)

Merck settles with insurers who denied $700 million NotPetya claim (The Record)

Syrian Threat Group Peddles Destructive SilverRAT (DarkReading)

NIST Warns of Security and Privacy Risks from Rapid AI System Deployment (The Hacker News)

Mortgage firm loanDepot cyberattack impacts IT systems, payment portal (BleepingComputer)

Big Tech has already made enough money in 2024 to pay all its 2023 fines (Proton)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dean of Research, Johannes Ullrich, relays his experiences from studying the hard sciences to his career shift to cybersecurity. Basic principles, superhero origin stories, physics labs and radiation all figure in. And there’s a lot in common with network security best practices. Have a listen to what Johannes has learned and what he hopes to impart on his students. Our thanks to Johannes for sharing his story with us. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Guilherme Venere from Cisco Talos joins to discuss their research on "A deep dive into Phobos ransomware, recently deployed by 8Base group." Cisco Talos discovered that 8Base’s Phobos ransomware payload contains an embedded configuration, which is a significant difference between 8Base’s Phobos variant and other Phobos samples that have been observed in the wild since 2019. 

In this 2-part research series, Talos conducts a deep dive into the Phobos ransomware, including its affiliate structure, activity and capabilities, as well as the one private key that could enable decryption of all the samples analyzed. 

The research can be found here:

Learn more about your ad choices. Visit megaphone.fm/adchoices

BGP attack disrupts Internet service. Data breach law firm breached. Remcos RAT returns. Poison packages in the PyPI repository. Hacktivist personae and GRU fronts. BreachForums impresario re-arrested. Cyber National Mission Force gets a new leader. On our Solution Spotlight, Simone Petrella talks with ISC2 CEO Clar Rosso about putting a dent in the cybersecurity workforce gap. LinkedIn as a dating platform?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On our Solution Spotlight, N2K President Simone Petrella talks with ISC2 CEO Clar Rosso about putting a dent in the cybersecurity workforce gap through empowerment, breaking down barriers and expanding Diversity, Equity and Inclusion (DE&I) initiatives.

BGP attack disrupts Internet service. Pirated Zeppelin ransomware source code for sale in a C2C souk. BreachForums impresario re-arrested. (CyberWire)

Hacker hijacks Orange Spain RIPE account to cause BGP havoc (Bleeping Computer)

RIPE Account Hacking Leads to Major Internet Outage at Orange Spain (SecurityWeek)

Law firm that handles data breaches was hit by data breach (TechCrunch)

UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT (The Hacker News)

EXPERTS FOUND 3 MALICIOUS PACKAGES HIDING CRYPTO MINERS IN PYPI REPOSITORY (SecurityAffairs)

BreachForums administrator detained after violating parole (The Record)

Russian hackers wiped thousands of systems in KyivStar attack (Bleeping Computer)

US military’s Cyber National Mission Force gets a new chief (The Record)

The Hottest New Dating Site: LinkedIn (Business Insider)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Sandworm was in Kyivstar's networks for months. Museums face online outages. Emsisoft suggests a ransomware payment ban. An ambulance service suffers a data breach. Mandiant’s social media gets hacked. GXC Team's latest offerings in the C2C underground market. 23andMe blames their breach on password reuse. Lawyers are using outdated encryption.  On today’s Threat Vector segment, David Moulton chats with Garrett Boyd,  senior consultant at Palo Alto Networks Unit 42  about the importance of internal training and mentorship in cybersecurity. And in Russia, holiday cheers turn to political jeers. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On today’s Threat Vector segment with David Moulton features Garrett Boyd, a senior consultant at Unit 42 by Palo Alto Networks with a background as a Marine and professor, discusses the importance of internal training and mentorship in cybersecurity. He provides insights into how training prepares professionals for industry challenges and how mentorship fosters professional growth and innovation. Garrett emphasizes the need for a mentorship culture in organizations and the responsibility of both mentors and mentees in this dynamic. The episode highlights the transformative impact of mentorship through personal experiences and concludes with an invitation for listeners to share their stories and a reminder to stay vigilant in the digital world.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin. 

Compromised accounts and C2C markets. Cyberespionage and state-directed hacktivism. (CyberWire)

Exclusive: Russian hackers were inside Ukraine telecoms giant for months (Reuters)

Hackers linked to Russian spy agency claim cyberattack on Ukrainian cell network (reuters)

Museum World Hit by Cyberattack on Widely Used Software (The New York Times)

The State of Ransomware in the U.S.: Report and Statistics 2023 (Emsisoft)

Nearly 1 million affected by ambulance service data breach (The Record)

Mandiant’s account on X hacked to push cryptocurrency scam (Bleeping Computer)

Cybercriminals Implemented Artificial Intelligence (AI) For Invoice Fraud (Resecurity)

23andMe tells victims it’s their fault that their data was breached (TechCrunch+)

The Curious Case of MD5 (katelynsills)

Firmware prank causes LED curtain in Russia to display ‘Slava Ukraini’ — police arrest apartment owner (The Record)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber-kidnapping in Utah. Hospitals sue for data recovery. The US Department of Homeland Security assesses cyber threats to the US. Mac malware is on the rise. Cameras hacked by Russian intelligence services provide targeting information. Ransomware roundup. An NPM dependency campaign. Google recommends enhanced safe browsing. Rob Boyce from Accenture describes the Five Families and the trend of hacker collaboration. And the FTC wants to hear your cloned voice.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, we are joined by Rob Boyce from Accenture talking about the Five Families, the trend of hacker collaboration. 

Missing Riverdale foreign exchange student found near Brigham City in case of ‘cyber kidnapping’ (ABC4)

What is ‘cyber kidnapping’ and what can you do to stay safe online? (Deseret News)

Hospitals ask courts to force cloud storage firm to return stolen data (BleepingComputer)

Homeland Threat Assessment (US Department of Homeland Security)

 The Mac Malware of 2023 (Objective-See)

SBU blocks webcams that ‘flashed’ operation of air defense during missile attack on Kyiv on Jan 2 (Interfax-Ukraine)

Ukraine says Russia hacked web cameras to spy on targets in Kyiv (The Record) 

Akumin radiology and oncology reports ransomware attack and data breach (beyondmachines)

Coop supermarket chain hit by ransomware cyberattack (beyondmachines)

When “Everything” Goes Wrong: NPM Dependency-Hell Campaign – 2024 Edition (Checkmarx)

Accounts in danger: Google recommends enhanced safe browsing and extra care (cybernews)

The FTC Voice Cloning Challenge (FTC)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A zero-click exploit affects iPhones belonging to Kaspersky employees. A GRU cyber campaign incorporates novel malware. The Indian government targets Apple over hacking attempts. Microsoft disables App Installer. Australian courts’ AV is compromised. A BlackBasta decryptor is released. Cyber Toufan claims attacks against Israeli targets. Patients in Oklahoma face online extortion. LoanCare customers’ data is at risk. Google settles a private browsing lawsuit. Barracuda patches a zero-day. That Chinese spy balloon was making a local call. And then Caleb Barlow, a friend of our show, shares password security tips you should know. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Caleb Barlow, CEO of Cyberbit, joins us today to share helpful tips to remember those passwords. 

4-year campaign backdoored iPhones using possibly the most advanced exploit ever (Ars Technica) 

New malware found in analysis of Russian hacks on Ukraine, Poland (The Record)

Russian Military Intelligence Blamed for Blitzkrieg Hacks (GovInfo Security)

India targets Apple over its phone hacking notifications (Washington Post)

Microsoft disables App Installer after observing financially motivated threat actor activity (Cybernews) 

Microsoft disables App Installer after observing financially motivated threat actor activity (Cybernews) 

Cyber attack on Victoria's court system may have exposed recordings of sensitive cases (ABC News) 

New Black Basta decryptor exploits ransomware flaw to recover files (Bleeping Computer)

Pro-Palestinian operation claims dozens of data breaches against Israeli firms (The Record)

Integris Health patients get extortion emails after cyberattack (Bleeping Computer) 

AG: Corewell Health reports another data breach; affects 1 million patients (The Oakland Press)

LoanCare Notifying 1.3 Million of Data Breach Following Cyberattack on Parent Company (Security Week)

Google settles $5 billion consumer privacy lawsuit (Reuters)

Barracuda fixed a new ESG zero-day exploited by Chinese group UNC4841 (Security Affairs)

U.S. intelligence officials determined the Chinese spy balloon used a U.S. internet provider to communicate (NBC News)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Microsoft Security EVP Charlie Bell joins Ann on this week's episode of Afternoon Cyber Tea. Charlie has over four decades in the tech industry, from developing space shuttle software to leading the creation of Amazon Web Services' decentralized engineering system and now leading Microsoft’s effort to make the digital world safe and secure for everyone on the planet. Ann and Charlie discuss AI, the Security ecosystem, and why he thinks speed and acceleration of problem-solving are so relevant today. 

Resources:

View Charlie Bell on LinkedIn  

View Ann Johnson on LinkedIn 

Related Microsoft Podcasts:         

Listen to: Uncovering Hidden Risks 

Listen to: Security Unlocked  

Listen to: Security Unlocked: CISO Series with Bret Arsenault   

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Afternoon Cyber Tea with Ann Johnson is produced by Microsoft and distributed as part of The CyberWire Network. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Financial firm CISO, Tom Quinn, takes us from his first experience with modern computers in the military to his current role as a Chief Information Security Officer. It's important to understand how the technology works, but it's also important to understand how people work. And, to make a difference. Our thanks to Tom for sharing his story with us. 

Learn more about your ad choices. Visit megaphone.fm/adchoices