The CyberWire Daily

German officials take down a dark web market. Google patched zero-day. Terrapin attack targets SSL. A look at payment fraud. Agent Tesla is spreading through an old vulnerability. An iPhone thief explains his techniques. Ukrainian reprisals for Russia's Kyivstar attack. Israeli officials warn of data wipers. Rick Howard speaks with Scott Roberts of Interpress about Driving Intelligence with MITRE ATT&CK, and leveraging limited resources to build an evolving threat repository. And go ahead and click that like button - just don’t expect to get paid.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guest Scott Roberts of Interpres joins N2K’s Rick Howard from the recent MITRE ATT&CKcon event. They discuss driving intelligence with MITRE ATT&CK: Leveraging limited resources to build evolving threat repository. 

German police takes down Kingdom Market cybercrime marketplace (BleepingComputer)

GOOGLE ADDRESSED A NEW ACTIVELY EXPLOITED CHROME ZERO-DAY (Securityaffairs)

SSH protects the world’s most sensitive networks. It just got a lot weaker (Ars Technica)

Annual Payment Fraud Intelligence Report: 2023 (Recorded Future)

Threat Actors Exploit CVE-2017-11882 To Deliver Agent Tesla (Zscaler)

iPhone Thief Explains How He Breaks Into Your Phone (Wall Street Journal)

Ukrainian hackers breach Rosvodokanal, seize data of Russia's largest private water utility (RBC Ukraine)

Fake F5 BIG-IP zero-day warning emails push data wipers (BleepingComputer)

“Get Paid to Like Videos”? This YouTube Scam Leads to Empty Wallets (Hack Read)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Interpol leads cybercrime take downs. ALPHV/Blackcat is in a “tug of Tor” with the FBI.  The Senate confirms a new leader for Cyber Command and NSA. Rite Aid is banned from using facial recognition. CISA prepares a new approach to information sharing. Remote encryption of ransomware. CitrixBleed is exploited to access customer data. An update on the Kyivstar cyberattack. The Tallinn Mechanism solidifies Western support for Ukraine's cybersecurity. In today’s Learning Layer segment, host Sam Meisenberg talks with Shelby Ludtke about passing the new ISC2 Certified in Cybersecurity (CC) exam. And GCHQ introduces youngsters to code breaking.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

In our Learning Layer segment today, host Sam Meisenberg talks with Shelby Ludtke about passing the new ISC2 Certified in Cybersecurity (CC) exam. For more information on practice tests, please visit N2K’s certification page. 

Practice tests

Interpol operation arrests 3,500 cybercriminals, seizes $300 million (Bleeping Computer)

AlphV claims to have ‘unseized’ its darkweb domain from the FBI. What’s happening? (The Record)

Senate confirms Biden’s pick for Cyber Command, NSA (The Record)

Rite Aid Banned from Using AI Facial Recognition After FTC Says Retailer Deployed Technology without Reasonable Safeguards (Federal Trade Commission)

Enabling Threat-Informed Cybersecurity: Evolving CISA’s Approach to Cyber Threat Information Sharing (CISA)

CryptoGuard: An asymmetric approach to the ransomware battle (Sophos)

Notice To Customers of Data Security Incident (Businesswire)

Ukraine's Kyivstar says it is fully operational after cyber attack (Reuters)

UK and partners form The Tallinn Mechanism for cyber security (Gov.UK)

GCHQ Christmas challenge: Agency reveals 2023 codebreaker (BBC)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The FBI takes down ALPHV/BlackCat. Comcast reveals breach of nearly 36 million Xfinity customers. Microsoft and Cyberspace Solarium Commission release water sector security report. Malware increasingly uses public infrastructure. Iran's Seedworm and its telco targets. QR code scams. Feds release joint analysis of 2022 election integrity. Joint advisory on Play ransomware group. In today’s Mr Security Answer Person, John Pescatore considers the risks of AI. Rick Howard talks with Lauren Brennan of GuidePoint Security about evaluating and maturing your SOC. Iranian gas stations running on empty.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

John Pescastore joins us for Mr. Security Answer Person to address the question, “Things seem to be moving quickly with AI, what is your feeling about that positioning for early 2024?”

Today’s guest is Lauren Brennan of GuidePoint Security. N2K’s Rick Howard caught up with Lauren recently  at the MITRE ATT&CKcon 4.0. They discussed evaluating and maturing your SOC.

Authorities claim seizure of notorious ALPHV ransomware gang’s dark web leak site (TechCrunch+)

Comcast says hackers stole data of close to 36 million Xfinity customers (TechCrunch+)

Microsoft, Cyberspace Solarium Commission propose measures to strengthen water sector cybersecurity (Industrial Cyber)

Malware leveraging public infrastructure like GitHub on the rise (Reversing Labs)

Seedworm: Iranian Hackers Target Telecoms Orgs in North and East Africa (Symantec)

“Quishing” you a Happy Holiday Season (netcraft)

2022 Election Not Impacted by Chinese, Russian Cyber Activity: DOJ, DHS (Securityweek)

US and Australia Warn of Play Ransomware Threat (Infosecurity Magazine)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A US mortgage company reveals major data breach. Updates from CISA. NSA provides guidance on SBOMs. MongoDB warns customers of a breach. BlackCat/ALPHV is still a market leader, but feeling competitive pressure. Reassessing the effects of Log4shell. The International Committee of the Red Cross calls for restraint in cyber warfare. Ransomware hits a cancer center. Ann Johnson, host of Microsoft Security’s Afternoon Cyber Tea podcast goes beyond basics with her guest Tanya Janca, founder of WeHackPurple. And what can I do to make you take home this chatbot today?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Host of Microsoft Security’s Afternoon Cyber Tea podcast, Ann Johnson, goes beyond basics with her guest Tanya Janca, founder of WeHackPurple. Ann’s full discussion with Tanya can be heard here. You can catch Afternoon Cyber Tea every other Tuesday on your favorite podcast apps and the N2K Network. 

Mr. Cooper reveals breach exposed 14.6 million clients (Cybernews)

Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment (CISA)

NSA Issues Guidance on Incorporating SBOMs to Improve Cybersecurity (Security Week)

MongoDB says customer data was exposed in a cyberattack (Bleeping Computer)

ALPHV Targeting: Ransomware & Digital Extortion (ZeroFox)

A Log4Shell Retrospective - Overblown and Exaggerated (VulnCheck)

We call on States to stop turning a blind eye to the participation of civilian hackers in armed conflict (ICRC)

Seattle cancer center confirms cyberattack after ransomware gang threats (The Record)

What can I do to make you take home this chatbot today? (Mastodon)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Oren Koren, Co-Founder and Chief Product Officer from Veriti sits down to share his amazing story. Before entering the vendor side of the cyber world, Oren served for 14 years in the Israeli 8200 unit where he led a variety of cybersecurity activities and researches that eventually earned him four 8200-unit cyber innovation awards. When he left the Israel Defense Forces, he joined Check Point Software to lead their AI-based innovations and advanced data analytics projects that redefined threat hunting and SIEM applications. This eventually inspired him to start his own company, with fellow co-founder Adi Ikan. Oren shares that he had a love for music growing up, and wanted to be a musician, saying music was the catalyst to him becoming interested in the cyber field, saying "I believe the music helped me a bit with my career in cybersecurity." We thank Oren for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Host of the CyberWire Daily podcast segment Threat Vector, David Moulton sits down with Mike "Siko" Sikorski from Palo Alto Networks Unit 42 to discuss their research on "Fighting Ursa Aka APT28: Illuminating a Covert Campaign."

Unit 42 just published new threat intelligence on Fighting Ursa (aka APT28), a group associated with Russia's military intelligence, on how they are exploiting a Microsoft Outlook vulnerability (CVE-2023-23397) to target organizations in NATO member countries, Ukraine, Jordan, and the UAE. These organizations are of strategic importance in defense, foreign affairs, economy, energy, transportation, and telecommunications.

The research can be found here:

• Fighting Ursa Aka APT28: Illuminating a Covert Campaign

Learn more about your ad choices. Visit megaphone.fm/adchoices

Google boosts Maps privacy, a court shields password disclosure, feds foil a massive scam operation, Iran-Israel cyber tensions escalate, Idaho National Labs reports a significant data breach, a security engineer's cybercrime confession.  N2K’s Rick Howard reports from the recent MITRE ATT&CK con, speaking with Blake Strom of Microsoft about 10 years of the MITRE ATT&CK Framework. And Brian Krebs' relentless investigation into the Target breach.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today, N2K’s Rick Howard recently attended the MITRE ATT&CK Con. While there, Rick spoke with Blake Strom of Microsoft and they discussed 10 years of MITRE ATT&CK Framework.

Google is rolling out new protections for our location data (The Washington Post)

Four men indicted in $80 million ‘pig butchering’ scheme (CNBC)

Just In: Crypto Hacker Shakeeb Ahmed Admits to $12 Million Heist (BET US)

Suspects can refuse to provide phone passcodes to police, court rules (Ars Technica)

Gaza Cybergang | Unified Front Targeting Hamas Opposition (Sentinal Labs)

Israeli CEO recruits Muslim hackers to fight Hamas in cyberwarfare (The Jerusalem Post)

 Personal Information of 45,000 Individuals Stolen in Idaho National Laboratory Data Breach (Securityweek)

Ten Years Later, New Clues in the Target Breach (krebsonsecurity)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Microsoft takes down the Storm-1152 cybercrime operation. “GambleForce” is a newly discovered threat actor.  The SVR exploits a JetBrains TeamCity vulnerability. US Postal Service impersonation. Malicious ads associated with Zoom. An update on the cyberattack against Kyivstar. Apache issues a Struts 2 security advisory. The FCC adopts new data breach rules.  In our latest Threat Vector segment, David Moulton and Palo Alto Networks Madeline Sedgwick discuss the skills and methods necessary for understanding threat actor intent and behaviors. And the State Department's Global Engagement Center is under fire.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On the Threat Vector segment with Palo Alto Networks Unit 42’s David Moulton, hear about decoding cyber adversaries. David discusses unveiling intent and behavior in the world of threat hunting with Madeline Sedgwick.

Microsoft disrupts cybercrime operation selling fraudulent accounts to notorious hacking gang (TechCrunch+)

New hacker group GambleForce targets government and gambling sites in Asia Pacific using SQL injections (Group-IB)

Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally (Joint Advisory)

Malvertisers zoom in on cryptocurrencies and initial access (MalwareBytes)

Russian hacker group claims responsibility for Kyivstar cyberattack (The Kyiv Independent) 

New Critical RCE Vulnerability Discovered in Apache Struts 2 - Patch Now (The Hacker News)

FCC Adopts Updates to Data Breach Rules, Sets Up Privacy Battle (Bloomberg Law)

State Dept.’s Fight Against Disinformation Comes Under Attack (The New York Times)

In this Threat Vector segment, David Moulton and Palo Alto Networks Madeline Sedgwick discuss the skills and methods necessary for understanding threat actor intent and behaviors. Madeline, a Senior Cyber Research Engineer and Threat Analyst for the Cortex Xpanse team at Palo Alto Networks, shares insights into how analyzing adversary behavior helps in anticipating threats and avoiding guesswork. They discuss the value of understanding both system dynamics and human behavior in cybersecurity, emphasizing that cyber adversaries are limited by the same laws of internet physics.

Please share your thoughts with us for future Threat Vector segments by taking our brief survey.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin. 

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The UK faces a looming threat of a catastrophic ransomware attack. The Senate confirms a new National Cyber Director. The rivalry between malware groups BatLoader and FakeBat. BazarCall phishing attack and its unusual use of Google Forms. A serious vulnerability threatens K-12 student data. Spiderman game developer Insomniac Games becomes the latest ransomware victim. Today’s guest is Tim Starks from the Washington Post’s Cybersecurity 202 with China’s influence operations in Taiwan, along with a look back at 2023. We'll touch on Microsoft's Patch Tuesday and why outdated password policies are still a problem.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Today’s guest is Tim Starks from the Washington Post’s Cybersecurity 202. Tim and Dave discuss China’s influence operations in Taiwan, along with a look back at 2023. 

UK at high risk of ‘catastrophic ransomware attack’, report says (The Guardian)

Roll Call Vote 118th Congress - 1st Session  (United States Senate)

How Does Access Impact Risk? (IST)

API and App Security: Q3 2023 Snapshot (ThreatX)

The Kids Aren’t Alright: Vulnerabilities in Edulog Portal Revealed K-12 Student Location Data (tenable)

Press and pressure: Ransomware gangs and the media (Sophos)

BazarCall Attack Leverages Google Forms to Increase Perceived Credibility (Abnormal)

Two Competing, Russian-Speaking Cybercrime Groups Attack Employees from 23 Companies in the Manufacturing, Software, Legal, Retail, and Healthcare Sectors Using Malicious Google Ads (esentire)

Spider-Man 2 developer Insomniac Games hit by Rhysida ransomware attack  (cyberdaily)

Microsoft Patch Tuesday December 2023 (Sans)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

A cyberattack on Ukraine's largest telecom operator. Ukraine's GUR claims a hit on Russia's tax service, while the fate of the ALPHV/BlackCat group remains shrouded in mystery. The Air Force disciplines members over a classified documents breach, and Apple releases urgent security updates. From Spain, a significant arrest in the Kelvin Security hacking group. On today’s Industry Voices segment, my conversation with Andre Durand,  CEO and Founder of Ping Identity, on digital experiences, brand trust and loyalty, behaviors and attitudes towards security, authentication and fraud. Plus, a cautionary tale about burning bridges.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On today’s Industry Voices segment, we speak with Andre Durand, the CEO and Founder of Ping Identity. Andre discusses the state of digital experiences. Ping recently commissioned a study to better understand the changing sentiments around digital experiences, brand trust and loyalty, behaviors and attitudes towards security, authentication and fraud, as well as digital wallets and the use of decentralized identity.

Ukraine’s Mobile Operator Kyivstar Facing ‘Powerful’ Cyberattack (Bloomberg)

Ukraine's top mobile operator hit by biggest cyber attack of war so far (Reuters)

GUR says it has hacked servers of Russian tax service (Interfax-Ukraine)

ALPHV/BlackCat Site Downed After Suspected Police Action (Infosecurity Magazine)

BlackCat ransomware site down amidst rumours of law enforcement action (Computing)

No confirmation on rumored ALPHV/BlackCat site takedown by law enforcement (SC Media)

Cloudflare 2023 Year in Review (Cloudflare)

Bitsight and Google collaborate to reveal global cybersecurity performance (Bitsight)

15 Air National Guardsmen disciplined in Discord server leak (C4ISRNET)

Apple emergency updates fix recent zero-days on older iPhones (Bleeping Computer)

Kelvin Security hacking group leader arrested in Spain (Bleeping Computer)

Cloud engineer gets 2 years for wiping ex-employer’s code repos (Bleeping Computer)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices