The CyberWire Daily

CISA issues joint Cybersecurity Advisory on Citrix Bleed. Law enforcement takes down "pig butchering" operations. Altman will return to OpenAI. Israeli honeypots deployed during the war. A renaissance in electronic warfare. And a response in the form of countermeasures. Ihab Shraim, Chief Technology Officer at CSC, shares how the growing popularity of AI is giving cybercriminals a new avenue to take advantage of some of the largest companies in the world. And online safety during the holidays.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/223

CISA issues joint Cybersecurity Advisory on Citrix Bleed. (CyberWire)

Cyber Scam Organization Disrupted Through Seizure of Nearly $9M in Crypto (U.S. Department of Justice)

China Rounds Up 31,000 Suspects in Sweeping ‘Pig-Butchering’ Crackdown (Wall Street Journal)

OpenAI Says Sam Altman to Return as CEO (Wall Street Journal)

Altman Agrees to Internal Investigation Upon Return to OpenAI (Information)

Sam Altman, OpenAI Board Open Talks to Negotiate His Possible Return (Bloomberg)

Before Altman’s Ouster, OpenAI’s Board Was Divided and Feuding (New York Times)

Altman Argued With OpenAI Board Member Toner Before Ouster (Information)

The Invisible War in Ukraine Being Fought Over Radio Waves (New York Times)

Exclusive: This pizza box-sized equipment could be key to Ukraine keeping the lights on this winter (CNN)

Commercial Flights Are Experiencing 'Unthinkable' GPS Attacks and Nobody Knows What to Do (Vice)

Shopping securely on Black Friday (and beyond). (CyberWire)

Learn more about your ad choices. Visit megaphone.fm/adchoices

OpenAI's continuing turmoil. Crypto firm sustains API attack. Konni campaign phishes with a Russian document as bait. LockBit's third-party compromise of Canadian government personnel data. Ukraine removes senior security officials under suspicion of graft. Dave Bittner sits down with Steve Winterfeld from Akamai to discuss emerging threats in the financial services sector. And Idaho National Laboratory sustains data breach.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/222

Company that created ChatGPT is thrown into turmoil after Microsoft hires its ousted CEO (AP News)

The Doomed Mission Behind Sam Altman’s Shock Ouster From OpenAI (Bloomberg)

Briefing: OpenAI Execs to Continue Discussions With Altman, Board: Memo (The Information)

OpenAI in ‘Intense Discussions’ to Quell Potential Staff Mutiny (Bloomberg)

Microsoft Wants to Work With Altman, No Matter What, Says CEO (Bloomberg)

Briefing: Microsoft CEO Nadella Says Altman Could End Up at Microsoft or OpenAI; Board Governance Should Change (The Information)

Sam Altman's AI 'mission continues' at Microsoft, future of OpenAI and ChatGPT uncertain (ZDNET)

OpenAI’s Customers Consider Defecting to Anthropic, Microsoft, Google (The Information)

OpenAI’s Board Approached Anthropic About Merger (The Information)

The Vast Majority of OpenAI Employees Ask the Board to Resign (The Information)

Konni Campaign Distributed Via Malicious Document (Fortinet Blog) 

Ukraine sacks top cyber defence officials amid graft probe (Reuters)

Two top Ukrainian cyber officials dismissed amid embezzlement probe (Record)

Ukraine fires top cybersecurity officials (TechCrunch)

Ukraine-Russia war: Ukraine sacks 'corrupt' cyber defence chiefs (The Telegraph)

Kronos Research halts trading amid $25M API key hack investigation (Cointelegraph)

Kronos Research Loses $26 Million in Unauthorized API Access Incident (Bitcoin News)

Canadian government discloses data breach after contractor hacks (BleepingComputer)

Idaho National Laboratory experiences massive data breach; employee information leaked online (East Idaho News)

Detailed data on employees of U.S. national security lab leak online (CyberScoop)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Leadership turmoil at OpenAI. Citrix Bleed vulnerability implicated in ransomware attacks. QakBot seems to have a successor. The FSB deploys LitterDrifter in cyberespionage against Ukraine. Russian security firm says China and North Korea are the source of most cyberattacks against Russia. Privateers and auxiliaries engage targets of opportunity. Ann Johnson from Afternoon Cyber Tea talks about leading edge cyber innovation with Nadav Zafrir. And alleged war crimes may include cyber operations conducted in support of other, conventional, kinetic war crimes.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/221

OpenAI announces leadership transition (OpenAI)

A statement from Microsoft Chairman and CEO Satya Nadella (The Official Microsoft Blog)

A timeline of Sam Altman’s ouster from OpenAI and Microsoft appointment (Reuters) 

Sam Altman leaves OpenAI: Everything you need to know (Computing)

OpenAI Employees Threaten to Quit Unless Board Resigns (Wall Street Journal)

Sam Altman to Join Microsoft Following OpenAI Ouster (Wall Street Journal)

Dozens of Staffers Quit OpenAI After Sutskever Says Altman Won’t Return (The Information)

AI to accelerate your security defenses (IBM)

OpenAI’s Board Set Back the Promise of Artificial Intelligence (The Information)

A New AI Lexicon: Existential Risk (AI Now)

Hackers Are Exploiting a Flaw in Citrix Software Despite Fix (Bloomberg)

Medusa ransomware gang claims Toyota Financial Services hack (Security Affairs) 

CitrixBleed Vulnerability Exploitation Suspected in Toyota Ransomware Attack (SecurityWeek) 

Yamaha and WellLife Network confirm cyber incidents after ransomware gang claims attacks (Record)

Are DarkGate and PikaBot the New QakBot? (Cofense)

Decrypting Danger: Check Point Research deep-dive into cyber espionage tactics by Russian-origin attackers targeting Ukrainian entities (Check Point Blog)

Malware Spotlight - Into the Trash: Analyzing LitterDrifter (Check Point Research) 

Russian APT Gamaredon uses USB worm LitterDrifter against Ukraine (Security Affairs) 

Russian Cyber Espionage Group Deploys LitterDrifter USB Worm in Targeted Attacks (The Hacker News) 

Remarks by Assistant Secretary Graham Steele at the Federal Insurance Office and NYU Stern Volatility and Risk Institute Conference on Catastrophic Cyber Risk and a Potential Federal Insurance Response (U.S. Department of the Treasury) 

Russian analysts point finger at China, North Korea over cyber activity (Record) 

How Pro-Ukrainian Hackers Have Undermined Russia's War Every Step Of The Way (WorldCrunch)

Ukraine says it has evidence of 109,000 Russian war crimes (POLITICO)

Learn more about your ad choices. Visit megaphone.fm/adchoices

Ian Blumenfeld, a Research Director from Two Six Technologies sits down to share his story with us. Ian begins his story by sharing he wanted to be a scientist, slowly he began to figure out and pinpoint more of what he liked about science, which ended up being math. Ian explains how math began to become a passion for him, and he eventually tried to pursue a career in it by teaching. He discovered teaching was not the thing for him and then started to move into the direction he wanted too, taking on more and more challenging roles until he landed where he is today. Ian says "If you're a smart person and you have skills in coding, you can swim. So it's okay to jump. It's okay to jump into the lake, you can swim. Something will get you out. You will have, you will be able to find a job. So, if you see something that looks cool, if you see something that advances you to the next stage of your career, if you have to take a little bit of a risk, it's okay." Ian wants to be someone who helped make the world a little better when it comes to code and wants to shares his desires and passions with the community. We thank Ian for sharing his story with us.

Learn more about your ad choices. Visit megaphone.fm/adchoices

In the dynamic field of cybersecurity, it’s well established that creating more opportunities for diversity and inclusion is essential for developing a highly skilled workforce. As an industry, we are starting to see the fruits of that labor, but there is a growing need for diverse leadership to nurture continuous innovation and resilience in cybersecurity.

As part of N2K’s 2023 Women in Cyber content series, we’re excited to host an engaging virtual panel discussion moderated by N2K's President Simone Petrella featuring insights, experiences, and strategies for advancing more women into leadership roles within the field.

This virtual discussion explores different areas including:

This panel discussion is a must-listen event for professionals, leaders, and aspiring cybersecurity experts who are committed to promoting diversity and empowering women to excel in cybersecurity leadership. Don't miss the opportunity to be part of this inspiring conversation and drive positive change in the industry.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Asheer Malhotra from Cisco Talos discussing their research and findings on "Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan." Cisco Talos' research team, released research attributing the work of the espionage-focused threat actor, YoroTrooper, to individuals based in Kazakhstan.

The research states "YoroTrooper attempts to obfuscate the origin of their operations, employing various tactics to make its malicious activity appear to emanate from Azerbaijan, such as using VPN exit nodes local to that region." They also found that the YoroTrooper continues to rely heavily on phishing emails that direct victims to credential harvesting sites.

The research can be found here:

• Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

Learn more about your ad choices. Visit megaphone.fm/adchoices

Buffy Wajvoda is the Global Leader for Space Solutions Architecture at AWS Aerospace and Satellite. In this extended conversation, we dive into how AWS is supporting cybersecurity in the space domain. You can learn more at AWS re:Invent.

AWS in Orbit is a podcast collaboration between N2K and AWS to offer listeners an in-depth look at the transformative intersection of cloud computing, space technologies, and generative AI. You can learn more about AWS in Orbit at space.n2k.com/aws.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our weekly intelligence roundup, Signals and Space, and you’ll never miss a beat. And be sure to follow T-Minus on LinkedIn and Instagram.

AWS re:Invent

The security attendee’s guide to AWS re:Invent 2023- AWS Blog

Viasat Deploys Resilient Tactical Edge Capability with AWS- YouTube

How We Sent an AWS Snowcone into Orbit- AWS Blog

How to improve your security incident response processes with Jupyter notebooks- AWS Blog 

Supporting security assessors in the Canadian public sector with AWS and Deloitte- AWS Blog

Establishing hybrid connectivity within a Canadian Centre for Cyber Security Medium Cloud reference architecture- AWS Blog  

Evolving cyber threats demand new security approaches – The benefits of a unified and global IT/OT SOC- AWS Blog

We want to hear from you! Please complete our short survey. It’ll help us get better and deliver you the most mission-critical space intel every day.

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at [email protected] to request more info.

Please send your pitch to [email protected] and include your name, affiliation, and topic proposal.

T-Minus is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices

Scattered Spider prompts warnings from CISA and the FBI. Phobos ransomware is an affiliate crimeware-as-a-service program. A "hack-for-hire" contractor. “Scama” in the C2C market. Our guest is Lee Clark from the RH-ISAC with a look at Holiday Season Cyber Threat Trends. Tim Eades from Cyber Mentor Fund shares recent trends in cyber venture capital, with tips on finding a good match. And the tempo of cyber operations in Russia's hybrid war.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/220

FBI and CISA Release Advisory on Scattered Spider Group (Cybersecurity and Infrastructure Security Agency | CISA) 

FBI warns on Scattered Spider hackers, urges victims to come forward (Reuters) 

U.S. officials urge more information sharing on prolific cybercrime group (CyberScoop) 

A deep dive into Phobos ransomware, recently deployed by 8Base group (Cisco Talos Blog) 

Understanding the Phobos affiliate structure and activity (Cisco Talos Blog)

Elephant Hunting | Inside an Indian Hack-For-Hire Group (SentinelOne) 

How an Indian startup hacked the world (Reuters) 

Scama: Uncovering the Dark Marketplace for Phishing Kits (Vade Secure)

Ukraine Tracks a Record Number of Cyber Incidents During War (Bank Info Security) 

Russia will target other countries for web attacks, Ukraine cyber defence chief warns (The Irish Times) 

Sandworm Linked to Attack on Danish Critical Infrastructure (Infosecurity Magazine) 

Why cyber war readiness is critical for democracies (Help Net Security) 

Learn more about your ad choices. Visit megaphone.fm/adchoices

Cyber safety for the holidays. Using regulatory risk to pressure a ransomware victim. A call for regulatory action against a supply chain threat. Rhysida malware: a warning and a description. Extending local breaches in Google Workspace. Protestware in open-source products. GRU's Sandworm implicated in campaign against Danish electrical power providers. Jason Meller, Founder & CEO of Kolide joins us as part of our sponsored Industry Voices segment to discuss the findings from The Shadow IT Report. In this Threat Vector segment, David Moulton sits down with Sama Manchanda, a consultant at Unit 42 to discuss the fascinating world of social engineering attacks. And donation scams: exploiting sympathy.

In this Threat Vector segment, David Moulton engages in an enlightening conversation with Sama Manchanda, a consultant at Unit 42. The duo embarks on an exploration of the fascinating world of social engineering attacks, delving into the distinct characteristics of phishing, smishing, and vishing.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/219

Please share your thoughts with us for future Threat Vector segments by taking our brief survey.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin. 

New Visa Report Tells Consumers to Stay Alert this Holiday Shopping Season (Business Wire)

Ransomware gang files SEC complaint over victim’s undisclosed breach (BleepingComputer)

11-14-2023 EFF Letter to FTC re: Malware on Android TV Set-Top Boxes (EFF)

#StopRansomware: Rhysida Ransomware (Cybersecurity and Infrastructure Security Agency | CISA)

Investigating the New Rhysida Ransomware (Fortinet Blog)

Analyzing Rhysida Ransomware Intrusion (Fortinet Blog)

The Chain Reaction: New Methods for Extending Local Breaches in Google Workspace (Bitdefender)

Protestware taps npm to call out wars in Ukraine, Gaza (ReversingLabs)

Russia's Sandworm Linked to Unprecedented Danish Energy Hack (Bloomberg).

Russian Hackers Linked to 'Largest Ever Cyber Attack' on Danish Critical Infrastructure (The Hacker News)

Denmark hit with largest cyberattack on record (Cybernews)

Attackers Exploit Crisis for Fraudulent Crypto Donations (Abnormal)

Learn more about your ad choices. Visit megaphone.fm/adchoices

In this episode of CyberWire-X, N2K’s CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined by guest Rohit Dhamankar, Fortra's Vice President of Product Strategy, and Hash Table member Steve Winterfeld, Akamai's Advisory CISO to discuss CISO initiatives such as vendor consolidation, automation, and attack surface management as a way to determine if it’s possible to achieve both increased security maturity and decreased operational load. This session covers common mistakes when adopting security technologies, including the pros and cons of AI, and how to better collaborate together.

Learn more about your ad choices. Visit megaphone.fm/adchoices