The CyberWire Daily

China allegedly targets US critical infrastructure, while a small Irish village goes without water due to an Iranian CyberAv3ngers attack. The EU sets a global precedent with new AI regulations. Unraveling the latest maneuvers of the Lazarus Group. The Sandman APT's links to Chinese cyber threats. "5Ghoul" vulnerabilities represent  a new challenge in telecom security. The deceptive dangers of the MrAnon infostealer in a booking app. The GRU's phishing tactics lead to the spread of Headlace malware. On today’s Solution Spotlight segment, Kristie Grinnell from DXC Technology talks with N2K’s President Simone Petrella about DXC’s “All in on Cyber” program. And 23andMe's controversial update to its terms and conditions.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On today’s Solution Spotlight segment, Kristie Grinnell from DXC Technology talks with N2K’s President Simone Petrella about DXC’s “All in on Cyber” program. Kristie is DXC’s Senior Vice President and Chief Information Officer. 

China’s cyber army is invading critical US services (Washington Post) 

Hackers hit Erris water in stance over Israel (Western People)

FBI: Cyberattack against Aliquippa water authority was a targeted 'escalation' on overlooked technology (Post Gazette)

White House aide says Iranian hack of US waterworks is call to action (C4ISRNet)

EU reaches deal on landmark AI bill, racing ahead of US (Washington Post) 

Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang (Cisco Talos)

Sandman APT | China-Based Adversaries Embrace Lua (SentinelOne)

5Ghoul  : Unleashing Chaos on 5G Edge Devices (Singapore University of Technology and Design)

MrAnon Stealer Spreads via Email with Fake Hotel Booking PDF (Fortinet) 

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware (Security Intelligence)

23andMe changes terms of service amid legal fallout from data breach (Axios)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber analyst, Tracy Maleeff, shares her unexpected journey from the library to cybersecurity and offers advice for those both seeking to make a change and those doing the hiring. It's not just about the invitation, it's more than that. Our thanks to Tracy for sharing her story with us. 

Learn more about your ad choices. Visit megaphone.fm/adchoices

You can learn more about AWS in Orbit at space.n2k.com/aws.

Baptiste Tripard is the Chief Marketing Officer at Alteia. Aiga Stokenberga is the Senior Transport Economist at the World Bank.

We explore how Alteia and the World Bank are leveraging AWS's cloud, AI, and space capabilities to monitor critical road networks at scale to support large scale infrastructure investments. From road networks to bridges, they share real-world applications that are making a difference in emerging economies.

AWS in Orbit is a podcast collaboration between N2K and AWS to offer listeners an in-depth look at the transformative intersection of cloud computing, space technologies, and generative AI. You can learn more about AWS in Orbit at space.n2k.com/aws.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our weekly intelligence roundup, Signals and Space, and you’ll never miss a beat. And be sure to follow T-Minus on LinkedIn and Instagram.

AWS Aerospace and Satellite

AWS re:Invent

Alteia and the World Bank assess and enhance road infrastructure data quality at scale using AWS

We want to hear from you! Please complete our short survey. It’ll help us get better and deliver you the most mission-critical space intel every day.

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

Please send your pitch to [email protected] and include your name, affiliation, and topic proposal.

T-Minus is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Dana Behling, researcher from Carbon Black, sharing their work on "Hunting Vulnerable Kernel Drivers." The Carbon Black Threat Analysis Unit (TAU) discovered 34 unique vulnerable drivers, six of which allow kernel memory access, accepting firmware access.

TAU reported the issues to the vendors whose drivers had valid signatures at the time of discovery, but only two vendors fixed the vulnerabilities. TAU is calling for more comprehensive approaches in the future than the current banned-list method used by Microsoft. The research states "By exploiting the vulnerable drivers, an attacker without the system privilege may erase/alter firmware, and/or elevate privileges."

The research can be found here:

• Hunting Vulnerable Kernel Drivers

Learn more about your ad choices. Visit megaphone.fm/adchoices

Legal action against Star Blizzard's FSB operators. A critical Bluetooth vulnerability has been discovered. How the GRU faked celebrity videos in its Doppelgänger campaign. The persistence of Log4j vulnerabilities. Lack of encryption as a contributor to data loss. Supply chain breaches plague the energy sector. Our guest is Allan Liska, creator of a new comic book featuring the adventures of Johnny Dollar, a hard-nosed cyber insurance investigator. And Russian activists make clever use of QR codes.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Guest Allan Liska, creator of Green Archer Comics, shares the first installment in a new comic book series: "Yours Truly, Johnny Dollar #1." The series follows the adventures of Johnny Dollar, a hard-nosed cyber insurance investigator, as he takes on ransomware attacks, insider threats and more. The series is based on a popular radio serial of the same name that ran from 1949 through 1962, now reimagined for the digital age.

Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns (CISA)

The cyberattacks also allegedly took aim at U.S. energy networks and American spies. (Wall Street Journal)

Russian Star Blizzard hackers linked to efforts to hamper war crimes investigation (The Guardian)

U.S. Takes Action to Further Disrupt Russian Cyber Activities (US Department of State)

Rewards for Justice (Rewards for Justice)

Two Russian Nationals Working with Russia’s Federal Security Service Charged with Global Computer Intrusion Campaign (US Department of Justice)

United States and the United Kingdom Sanction Members of Russian State Intelligence-Sponsored Advanced Persistent Threat Group (US Department of Treasury)

Critical Bluetooth Flaw Exposes Android, Apple & Linux Devices to Takeover (DarkReading)

Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics (Recorded Future)

Russian influence and cyber operations adapt for long haul and exploit war fatigue (Microsoft)

State of Log4j Vulnerabilities: How Much Did Log4Shell Change? (Veracode)

ESG Report Operationalizing Encryption and Key Management (Fortanix)

Russian opposition activists use QR codes to spread anti-Putin messages (The Record)

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our 5 question survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Unpacking LogoFAIL's threat to Windows and Linux. The US DHS's new healthcare cybersecurity strategy, and dual Russian influence campaigns. A look at supply chain risks, increased bot activity in retail, Meta's end-to-end encryption in Messenger and Android's Autospill vulnerability. On today’s Industry Voices segment, we welcome Todd Thorsen, CISO from CrashPlan, with insights on data resiliency. And the discovery of an alleged software 'kill switch' in Polish trains.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

On today’s Industry Voices segment, we welcome Todd Thorsen, CISO from CrashPlan. Todd discusses data resiliency.

 In an era where ransomware and malicious attacks are relentless, even the most secure organizations are not immune. These attacks can cripple organizations financially, operationally, and damage their reputation and compliance standing. My guest today is Todd Thorsen, CISO from CrashPlan. In this sponsored Industry Voices segment, we delve into crucial strategies for bolstering data resiliency.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/232

Just about every Windows and Linux device vulnerable to new LogoFAIL firmware attack (Ars Technica) 

CISA, NSA, FBI and International Cybersecurity Authorities Publish Guide on The Case for Memory Safe Roadmaps (CISA) 

The Case for Memory Safe Roadmaps (Joint release)

HEALTHCARE  SECTOR CYBERSECURITY (US Department of Health and Human Services)

HHS releases cybersecurity strategy for health care sector (American Hospital Association)

Fake Taylor Swift Quotes Are Being Used to Spread Anti-Ukraine Propaganda (WIRED)

Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics (Recorded Future)

Britain summons Russian ambassador over years-long FSB cyberespionage campaign (Reuters)

NCSC exposes Russian cyber attacks on UK political processes (ComputerWeekly)

Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns (NCSC)

Defending Democracy (NCSC)

The State of Supply Chain Defense: Annual Global Insights Report (BlueVoyant)

2023 Holiday Bad Bot Report (Kasada)

Facebook and Messenger to automatically encrypt messages (BBC)

Your mobile password manager might be exposing your credentials (TechCrunch)

Dieselgate, but for trains – some heavyweight hardware hacking (BadCyber)

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Governments target push notification metadata. Dissecting the latest GRU cyber activities. A look at  Russia's AI-powered Doppelgänger influence campaigns, and how cyber warfare is evolving beyond the battlefield. We've got updates on the Adobe ColdFusion vulnerability, the expanding 23andMe data breach, and insights into the financial impacts of ransomware. Our guest is Camille Stewart Gloster, Deputy National Cyber Director for Technology & Ecosystem Security from the Office of the National Cyber Director at the White House. Plus, discover how the TSA is embracing AI for future security. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

Our guest is Camille Stewart Gloster, Deputy National Cyber Director, Technology & Ecosystem Security from the Office of the National Cyber Director at the White House. Camille shares her views on women in cybersecurity, their efforts in diversity, equity and inclusion and what she sees for the future.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/231

Governments spying on Apple, Google users through push notifications - US senator (Reuters) 

Obfuscation and AI Content in the Russian Influence Network “Doppelgänger” Signals Evolving Tactics (Recorded Future)

Russian AI-generated propaganda struggles to find an audience (CyberScoop)

How cybersecurity teams should prepare for geopolitical crisis spillover (CSO)

Russia’s Fancy Bear launches mass credential collection campaigns (CSO)

The Dragos Community Defense Program Helps Secure Industrial Infrastructure for Small Utilities (Dragos)

Threat Actors Exploit Adobe ColdFusion CVE-2023-26360 for Initial Access to Government Servers (CISA)

CVE-2023-26360 Detail (NIST)

SEC on 23andMe breach (SEC) 

Share your feedback.

We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

The UK Government's denial of a cyber incident at Sellafield. There’s been a surge in Iranian cyberattacks on US infrastructure. Misuse of Apple's lockdown mode, the mysterious AeroBlade's activities in aerospace, and a clever "Disney+" scam. Plus The latest application security trends, and a new cybersecurity futures study. In our Industry Voices segment, On today’s Industry Voices segment, we welcome Matt Radolec, Vice President of Incident Response and Cloud Operations at Varonis explaining the intersection of AI, cloud and insider threats. And insights on resilience from the UK's Deputy PM.

On today’s Industry Voices segment, we welcome Matt Radolec. Matt is Vice President of Incident Response and Cloud Operations at Varonis. He talks about the  intersection of AI, cloud and insider threats.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/230

Sellafield nuclear site hacked by groups linked to Russia and China (The Guardian)

Response to a news report on cyber security at Sellafield (GOV.UK)

Guardian news article (Office of Nuclear Regulation)

Ministers pressed by Labour over cyber-attack at Sellafield by foreign groups (The Guardian)

US warns Iranian terrorist crew broke into 'multiple' US water facilities (The Register)

Florida water agency latest to confirm cyber incident as feds warn of nation-state attacks (The Record)

AeroBlade on the Hunt Targeting the U.S. Aerospace Industry (Blackberry)

Fake Lockdown Mode: A post-exploitation tampering technique (Jamf)

Disney+ Impersonated in Elaborate Multi-Stage Email Attack with Personalized Attachments (Abnormal Security)

Building Security in Maturity Model (BSIMM) report (Synopsis)

Deputy Prime Minister annual Resilience Statement (GOV.UK)

Learn more about your ad choices. Visit megaphone.fm/adchoices

The US and Israel attribute attacks on PLCs to Iran. Agent Raccoon backdoors organizations on three continents. XDSpy is reported to be phishing the Russian defense sector. Trends in digital banking fraud. Repojacking Go module repositories. Ann Johnson from Afternoon Cyber Tea speaks with Lynn Dohm, executive director of WiCyS, about the power of diverse perspectives. And when it comes to security, don't look to the stars.

Guest is Ann Johnson from Afternoon Cyber Tea talking with Lynn Dohm, executive director of WiCyS, about the power of diverse perspectives. Tune in to Microsoft Security’s Afternoon Cyber Tea podcast every other Tuesday on the N2K Network. You can hear Ann’s full interview with Lynn here. 

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/229

IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities (CISA)

Water and Wastewater Cybersecurity (CISA)

P2Pinfect - New Variant Targets MIPS Devices (Cado)

New Tool Set Found Used Against Organizations in the Middle East, Africa and the US (Palo Alto Networks Unit 42)

XDSpy hackers attack military-industrial companies in Russia (The Record)

Mobile Emulators Eclipse Bots in 2023 as Preferred Fraud Vector in North America (PR Newswire)

Hijackable Go Module Repositories (VulnCheck)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Bernard Brantley, CISO from Corelight sits down to share his inspiring career path with others. Bernard started at the very bottom of the tech stack, and shares how he was extremely unclear about what it was that he wanted to do in life and how he was going to get there. Ultimately he reached a point now where he has the self confidence and an incredible level of success that allows him to be authentic and proudly share his story. Bernard overcame dropping out of the military academy and was trying to figure out how he could take these big dreams and aspirations he had as a child and turn them into something fruitful as an adult. Working his way up from the bottom he is now sharing how he overcomes those days of adversity, saying "I spend minimum time trying to like spin my wheels or, kind of stay in frustration or a down period and, and really, uh, try as quickly as possible to move from, "hey, this was a tough day" to, to, into, "all right, uh, this was a tough day because maybe I didn't commit enough time in this area, or maybe I could have had a bit better conversation with this person." We thank Bernard for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices