CISA says Super Tuesday ran smoothly. The White House sanctions spyware vendors. The DoD launches its Cyber Operational Readiness Assessment program. NIST unveils an updated NICE Framework. Apple patches a pair of zero-days. The GhostSec and Stormous ransomware gangs join forces. Cado Security tracks a new Golang-based malware campaign. Google updates its search algorithms to fight spammy content. Canada's financial intelligence agency suffers a cyber incident. On our Industry Voices segment, our guest Amitai Cohen, Attack Vector Intel Lead at Wiz joins us to discuss cloud threats. Moonlighting on the dark side. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
On our Industry Voices segment, our guest Amitai Cohen, Attack Vector Intel Lead at Wiz and host of their Crying Out Cloud podcast, joins us to discuss cloud threats. Learn more in Wiz's State of the AI Cloud report. 

Selected Reading
No security issues as Super Tuesday draws to a close, CISA official says (The Record)
Biden administration sanctions makers of commercial spyware used to surveil US (CNN Business)
US DoD launches CORA program to revolutionize cybersecurity strategy (Industrial Cyber)
Unveiling NICE Framework Components v1.0.0: Explore the Latest Updates Today! (NIST)
Update your iPhones and iPads now: Apple patches security vulnerabilities in iOS and iPadOS (Malwarebytes)
Watch out, GhostSec and Stourmous groups jointly conducting ransomware attacks (Security Affairs)
Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware (Bleeping Computer)
Google is starting to squash more spam and AI in search results (The Verge)
Cyberattack forces Canada’s financial intelligence agency to take systems offline (The Record)
Cyber Pros Turn to Cybercrime as Salaries Stagnate (Infosecurity Magazine)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

No cyber blues on Super Tuesday.

In honor of  Women's History Month, please enjoy this episode of the Palo Alto Networks' Unit 42 podcast, Threat Vector, featuring David Moulton's discussion with Wendi Whitmore about the evolving threat landscape. 

In this conversation, David Moulton from Unit 42 discusses the evolving threat landscape with Wendi Whitmore, SVP of Unit 42. Wendi highlights the increasing scale, sophistication, and speed of cyberattacks, with examples like the recent Clop ransomware incident, and emphasizes that attackers, including nation-state actors and cybercriminals, are leveraging AI, particularly generative AI, to operate faster and more effectively, especially in social engineering tactics.
To protect against these threats, businesses must focus on speed of response, automated integration of security tools, and operationalized capabilities and processes. The conversation underscores the importance of staying vigilant and leveraging technology to defend against the rapidly changing threat landscape.
Theat Group Assessments https://unit42.paloaltonetworks.com/category/threat-briefs-assessments/

Please share your thoughts with us for future Threat Vector segments by taking our ⁠brief survey⁠.

Join the conversation on our social media channels:
Website: ⁠⁠https://www.paloaltonetworks.com/unit42⁠⁠
Threat Research: ⁠⁠https://unit42.paloaltonetworks.com/⁠⁠
Facebook: ⁠⁠https://www.facebook.com/LifeatPaloAltoNetworks/⁠⁠
LinkedIn: ⁠⁠https://www.linkedin.com/company/unit42/⁠⁠
YouTube: ⁠⁠@PaloAltoNetworksUnit42⁠⁠
Twitter: ⁠⁠https://twitter.com/PaloAltoNtwks⁠⁠

About Threat Vector
Unit 42 Threat Vector is the compass in the world of cyberthreats. Hear about Unit 42’s unique threat intelligence insights, new threat actor TTPs, real-world case studies, and learn how the team works together to discover these threats. Unit 42 will equip listeners with the knowledge and insight to proactively prepare and stay ahead in the ever-evolving threat landscape.

PALO ALTO NETWORKS
Palo Alto Networks enables your team to prevent successful cyberattacks with an automated approach that delivers consistent security across the cloud, network, and mobile. ⁠http://paloaltonetworks.com⁠

From Nation States to Cybercriminals: AI's Influence on Attacks with Wendi Whitmore [Threat Vector]

Is the ALPHV gang pulling up a twenty two million dollar rug? Meta platforms are experiencing outages.  Ukraine claims a cyberattack on the Russian Ministry of Defense. Malicious phishers hope to hook hashes. TeamCity users are warned of critical vulnerabilities. The Discord leaker pleads guilty. AmEx suffers a third-party data breach. Amazon is flooded with fake copycat publications. Our guest is Deputy Assistant Director Cynthia Kaiser from the FBI Cyber Division to discuss Volt Typhoon. And, Dude, she is just not that into you.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Guest Deputy Assistant Director Cynthia Kaiser from the FBI Cyber Division joins us to discuss Volt Typhoon.

Selected Reading
Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment  (WIRED)
Ukraine claims it hacked Russian Ministry of Defense servers (Bleeping Computer)
Hundreds of orgs targeted with emails aimed at stealing NTLM authentication hashes (Help Net Security)
TeamCity Users Urged to Patch Critical Vulnerabilities (Infosecurity Magazine)
Pentagon leak defendant Jack Teixeira pleads guilty, faces years in prison (Reuters)
American Express credit cards exposed in third-party data breach (Bleeping Computer)
Tech writer Kara Swisher has a new book. Enter the AI-generated scams. (Bleeping Computer)
Retired Army officer charged with sharing classified information about Ukraine on foreign dating site (CBS News) 

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Change Healthcare hackers cash in $22 million ransom.

Cyber Initiative and Special Projects Fellow at the Hewlett Foundation Monica Ruiz shares her career development from aspirations of being a weather woman to her current role as a grantmaker and connector in cybersecurity. Monica discusses how her international study experience changed her outlook and brought her to the field of security. She shares the difficulties she faced as a woman of color when when not that many people look like you, and how she used that as her reason to move forward and better the cybersecurity field through her work. Our thanks to Monica for sharing her story with us. 

Encore: Monica Ruiz: Moving ahead when not many look like you. [Policy]

The US healthcare sector is struggling to recover from a cyberattack. Russia listens in via Webex. The former head of NCSC calls for a ransomware payment ban. An Indian content farm mimics legitimate online news sites. The FTC reminds landlords that algorithmic price fixing is illegal. FCC employees are targeted by a phishing campaign. Experts weigh in on NIST’s updated cybersecurity framework. Police shut down the largest German-speaking cybercrime market. Guest Mike Hanley, Chief Security Officer and the Senior Vice President of Engineering at GitHub, shares insights with Ann Johnson of Afternoon Cyber Tea. And celebrating the most inspiring women in cyber.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
CyberWire Guest
Guest Mike Hanley, Chief Security Officer and the Senior Vice President of Engineering at GitHub, shares insights with Ann Johnson of Afternoon Cyber Tea. You can hear their full discussion here, and tune in to Microsoft Security’s Afternoon Cyber Tea every other Tuesday on the N2K’s CyberWire Network.  

Selected Reading
Health-care hack spreads pain across hospitals and doctors nationwide (Washington Post)
Russia’s chief propagandist leaks intercepted German military Webex conversation (The Record)
Cyber ransoms are too profitable. Let’s make paying illegal (The Times UK)
News farm impersonates 60+ major outlets: BBC, CNN, CNBC, Guardian… (Bleeping Computer)
Price fixing by algorithm is still price fixing (Federal Trade Commission)
FCC Employees Targeted in Sophisticated Phishing Attacks (SecurityWeek)
Industry Reactions to NIST Cybersecurity Framework 2.0: Feedback Friday (SecurityWeek)
Germany takes down cybercrime market with over 180,000 users (Bleeping Computer)
Exceptional Women Recognised for Contribution to Cyber Industry at Most Inspiring Women in Cyber Awards 2024 (IT Security Guru)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Cyberattack causes a code red on US healthcare.

Product Manager in Anti-Fraud Solutions at SpyCloud, Pattie Dillon shares her journey from raising her family to specializing in the anti-fraud space. Upon reentering the workforce, Pattie worked on identity verification and developed a system with privacy concerns in mind. She moved to work in gift cards and was exposed to money laundering. Traveling along the fraud spectrum, Pattie learned about underground data and feels that this data can be leveraged to actually prevent and fight online fraud. Pattie believes if you don't try, you'll never know. We know we appreciate Pattie sharing her story with us.

Encore: Pattie Dillon: Take the leap. [Anti-fraud] [Career Notes]

This week we are joined by, Selena Larson from Proofpoint, who is discussing their research, "Bumblebee Buzzes Back in Black." Bumblebee is a sophisticated downloader used by multiple cybercriminal threat actors and was a favored payload from its first appearance in March 2022 through October 2023 before disappearing.
After a four month hiatus, Proofpoint researchers found that the downloader returned. Its return aligns with a surge of cybercriminal threat activity after a notable absence of many threat actors and malware. 
The research can be found here: 

Bumblebee Buzzes Back in Black 

The return of a malware menace. [Research Saturday]

A court orders NSO Group to hand over their source code. The Five Eyes reiterate warnings about Ivanti products. Researchers demonstrate a generative AI worm. Fulton County calls LockBit’s bluff. SMS codes went unprotected online. Golden Corral serves up a buffet of personal data. Ransom demands continue to climb. A US Senator calls on the FTC to investigate auto industry privacy practices. Dressing up data centers. Our guest is Dominic Rizzo, founder and director of OpenTitan and CEO at zeroRISC, discussing the first open-source silicon project to reach commercial availability. And Cops can’t keep their suspects straight. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Guest is Dominic Rizzo, founder and director of OpenTitan and CEO at zeroRISC, discussing the first open-source silicon project to reach commercial availability. You can find the press release here. 

Selected Reading
Five Eyes Warn of Ivanti Vulnerabilities Exploitation, Detection Tools Insufficient (Infosecurity Magazine)
A leaky database spilled 2FA codes for the world’s tech giants (TechCrunch)
Report: Average Initial Ransomware Demand in 2023 Reached $600K (Security Boulevard)
Here Come the AI Worms (WIRED)
Golden Corral restaurant chain data breach impacts 183,000 people (Bleeping Computer)
Hackers stole 'sensitive' data from Taiwan telecom giant: ministry(Tech Xplore)
CISA adds Microsoft Streaming Service bug to its Known Exploited Vulnerabilities catalog (Security Affairs)
Senator asks FTC to investigate automakers’ data privacy practices (The Record)
Looking good, feeling safe – data center security by design (Data Center Dynamics)
Cops visit school of 'wrong person's child,' mix up victims and suspects in epic data fail (The Register)
OpenTitan® Partnership Makes History as First Open-Source Silicon Project to Reach Commercial Availability (lowRISC)
Creating Connections: Embracing change. (N2K Women in STEM newsletter) 

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

WhatsApp's legal triumph cracks the spyware vault.

Iran-Linked Cyber-Espionage Targets Middle East's Aerospace and Defense. SpaceX is accused of limiting satellite internet for US troops. Savvy Seahorse' Floods the Net with Investment Scams. GUloader Malware draws on a crafty graphic attack vector. Repo confusion attacks persist. European consumer groups question Meta’s data collection options. Allegations of Russia targeting civilian critical infrastructure in Ukraine. Cisco patches high-severity flaws. The US puts a Canadian cyber firm on its Entity List. On the Threat Vector segment, we have a conversation between host David Moulton and Michael "Siko" Sikorski, Unit 42's CTO and VP of Engineering, discussing Unit 42's 2024 Incident Response Report. And the counter-productive messaging in anti-piracy campaigns. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
On the Threat Vector segment, we have a conversation between host David Moulton, Director of Thought Leadership at Palo Alto Networks Unit 42,  and Michael "Siko" Sikorski, Unit 42's CTO and VP of Engineering, discussing the Unit 42's 2024 Incident Response Report. 

Selected Reading
Suspected Iranian cyber-espionage campaign targets Middle East aerospace, defense industries (The Record)
US tells Musk to allow service in Taiwan (Taipei Times)
SpaceX Refutes Claim It’s Withholding Starshield in Taiwan (Bloomberg) 
Beware the Shallow Waters: Savvy Seahorse Lures Victims to Fake Investment Platforms Through Facebook Ads (infoblox)
GUloader Unmasked: Decrypting the Threat of Malicious SVG Files  (McAfee Blog)
Over 100,000 Infected Repos Found on GitHub (Apiiro)
Rights groups file GDPR suits on Meta's pay-or-consent model (The Register)
Russia Attacked Ukraine's Power Grid at Least 66 Times to ‘Freeze It Into Submission’ (WIRED)
Cisco Patches High-Severity Vulnerabilities in Data Center OS  (SecurityWeek)
Network intelligence company Sandvine banned from trading in the US  (SC Media)
Intimidating anti-piracy warnings have the opposite effect on men, new study says (TechSpot)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Iran's cyber quest in Middle Eastern aerospace.

President Biden is set to sign an executive order restricting overseas sharing by data brokers. US Federal agencies warn of exploited Ubiquiti EdgeRouters. A new ransomware operator claims to have hacked Epic Games. A cross-site scripting issue leaves millions of Wordpress sites vulnerable. The Rhysida ransomware group posts a multi-million dollar ransom demand on a Children’s Hospital in Chicago. Mandiant tracks Chinese threat actors targeting Ivanti VPNs. The former head of DHS weighs in on a federal cyber insurance backstop. Domain Registrars offer bulk name blocking for brands. Our guest is Magpie Graham, Principal Adversary Hunter Technical Director at Dragos, reviews the key findings of Dragos’ Cybersecurity Year in Review report. Cameo celebrities are taken out of context for political gains.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Guest Magpie Graham, Principal Adversary Hunter Technical Director at Dragos, reviews the key findings of Dragos’ Cybersecurity Year in Review report. You can download a copy of the report here. To hear the full interview with Magpie, check out Control Loop. 

Selected Reading
Biden Executive Order Targets Bulk Data Transfers to China (GovInfo Security)
FBI Alert: Russian Hackers Target Ubiquiti Routers for Data, Botnet Creation (HACKREAD)
Fortnite game developer Epic Games allegedly hacked (Cyber Daily)
LiteSpeed Cache Plugin XSS Flaw Exposes 4M+ Million Sites to Attack (Cyber Security News)
Ransomware gang seeks $3.4 million after attacking children’s hospital (The Record)
Chinese Cyberspies Use New Malware in Ivanti VPN Attacks (SecurityWeek)
A Cyber Insurance Backstop (Schneier on Security)
Cyberwar Podcast with Kate and Alex - Special Guest Michael Chertoff 
Registrars can now block all domains that resemble brand names (BleepingComputer)
Cameo is being used for political propaganda — by tricking the stars involved (NPR)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Protecting American data.

NIST’s Cybersecurity Framework gets an upgrade. ONCD makes a case against memory-related software bugs. A recent cyberattack targets Canada's Royal Canadian Mounted Police. US dethrones Russia as top target in cyber breaches. Caveat podcast cohost Ben Yelin discusses remedies in the generative AI copyright cases.And, Reggaeton Be Gone, a creative way to deal with your neighbors’ music choices. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Ben Yelin, cohost of Caveat podcast and Program Director, Public Policy & External Affairs at University of Maryland Center for Health and Homeland Security, thinking about remedies in the generative AI copyright cases. You can find the Lawfare article Ben references here.  

Selected Reading
NIST Releases Version 2.0 of Landmark Cybersecurity Framework (NIST)
After decades of memory-related software bugs, White House calls on industry to act (The Record) 
Canada's RCMP, Global Affairs Hit by Cyberattacks (SecurityWeek)
A cyber attack hit the Royal Canadian Mounted Police (Security Affairs) 
UK email mistake put ‘lives at risk’ for Afghans who had worked with British military (The Record) 
Russia and Belarus targeted by at least 14 nation-state hacker groups, researchers say (The Record) 
Number of data breaches falls globally, triples in the US (TechSpot)
Steel giant ThyssenKrupp confirms cyberattack on automotive division (Bleeping Computer)
The Change Healthcare cyberattack is still impacting pharmacies. It's a bigger deal than you think (Fast Company)
US Pharmacy Outage Triggered by 'Blackcat' Ransomware at UnitedHealth Unit, Sources Say (US News and World Report) 
Getting Ahead of Cybersecurity Materiality Mayhem (Security Boulevard) 
Raspberry Pi maker builds device to hack neighbor's Bluetooth speakers that were streaming annoying music (TechSpot)
Reggaeton Be Gone (Hackster.io)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Out with the old, in with the new.

LockBits reawakening. China&#39;s ramp up to safety for vital sectors. Data leak leaves China feeling exposed. Malware hidden by North Korea in fake developer job listings. UK Watchdog rebukes firm for biometric scanning of staff at leisure centers. SVR found adapting for the cloud environment. DOE proposes cybersecurity guidelines for the electric sector. Wideness of breach in the financial industry revealed. Moving on to better things. Things are looking up in the cybersecurity startup ecosystem. UK&#39;s National Cyber Security Centre announced they are launching a Cyber Governance Training Pack for boards. N2K’s President Simone Petrella talks with Elastic&#39;s CISO Mandy Andress about the CISO role and the intersection of cybersecurity, law, and organizational strategy. And, there’s a facial recognition battle going on at Waterloo, the University of Waterloo that is. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Simone Petrella, N2K’s President, talks with Mandy Andress, Elastic&#39;s CISO, about the CISO role and the intersection of cybersecurity, law, and organizational strategy.

Selected Reading
LockBit Ransomware Gang Resurfaces With New Site (SecurityWeek)
LockBit ransomware gang attempts to relaunch its services following takedown (The Record) 
China to increase protections against hacking for key industries (Reuters)
The I-Soon data leak unveils China&#39;s cyber espionage tactics, techniques, procedures, and capabilities. (N2K CyberWire)
Fake Developer Jobs Laced With Malware (Phylum Blog)
Data watchdog tells off outsourcing giant for scanning staff biometrics despite &#39;power imbalance&#39; (The Register) 
SVR cyber actors adapt tactics for initial cloud access (National Cyber Security Centre)
New DOE-Funded Initiative Outlines Proposed Cybersecurity Baselines for Electric Distribution Systems (Energy.gov) 
LoanDepot says about 17 million customers had personal data and Social Security numbers stolen during cyberattack (TechCrunch)  	
	Actual filing to Office of Maine Attorney General: Data Breach Notifications - Consumer Protection (Maine.gov) 
U-Haul data breach affects 67,000 customers in US and Canada (AZ Central)
	Actual filing to Office of Maine AG: Data Breach Notifications - Consumer Protection (Maine.gov)  
Funding Down, Optimism Up: The Bright Spots For Cybersecurity Startups In 2024 (Forbes)
NCSC to Offer Cyber Governance Guidance to Boards (InfoSecurity Magazine) 
&#39;Facial recognition&#39; error message on vending machine sparks concern at University of Waterloo (CTV News) 

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve t

LockBit reloaded: Unveiling the next chapter in cybercrime.

Director of Security Engineering at Marqeta and Host of Hacker Valley Studio podcast Chris Cochran describes his transitions throughout the cybersecurity industry, from an intelligence job with the Marine Corps, to starting the intelligence apparatus for the House of Representatives, then on to leading Netflix's threat intelligence capability. Chris points out that when pivoting to different roles and responsibilities, you must rely on your own strengths to move forward and bring value to your work Our thanks to Chris for sharing his story with us.

Encore: Chris Cochran: Rely on your strengths in the areas of the unknown. [Engineering] [Career Notes]

Assaf Dahan and Daniel Frank from Palo Alto Networks Cortex sit down with Dave to talk about their research "Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor." From late 2020 to late 2022, Unit 42 researchers discovered an active campaign that targeted several web hosting and IT providers in the United States and European Union.
The research states "They have further deepened their foothold in victims’ environments by mass deployment of web shells, which granted them sustained access, as well as access to internal resources of the compromised websites."
The research can be found here:
Manic Menagerie 2.0: The Evolution of a Highly Motivated Threat Actor

Web host havoc: Unveiling the Manic Menagerie campaign. [Research Saturday]

The FTC fines Avast over privacy violations. ConnectWise's ScreenConnect is under active exploitation. AT&T restores services nationwide. An Australian telecom provider suffers a data breach. EU Member States publish a cybersecurity and resilience report. Microsoft unleashes a PyRIT. A new infostealer targets the oil and gas sector. A cyberattack cripples a major US healthcare provider. Our guest is Kevin Magee from Microsoft Canada with insights on why cybersecurity startups in Ireland are having so much success building new companies there. And  a USB device is buzzing with malware.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Guest Kevin Magee from Microsoft Canada talks about recently meeting 15 cybersecurity startups in Ireland and finding out why they are having so much success building new companies there. 

Selected Reading
FTC Order Will Ban Avast from Selling Browsing Data for Advertising Purposes, Require It to Pay $16.5 Million Over Charges the Firm Sold Browsing Data After Claiming Its Products Would Block Online Tracking (FTC)
Cybercriminal groups actively exploiting ‘catastrophic’ ScreenConnect bug (The Record)
AT&T services resume, company blames "incorrect process" (Data Center Dynamics)
230k Individuals Impacted by Data Breach at Australian Telco Tangerine (SecurityWeek)
EU releases comprehensive risk assessment report on cybersecurity, resilience of communication networks (Industrial Cyber)
Microsoft Releases Red Teaming Tool for Generative AI (SecurityWeek)
New Infostealer Malware Attacking Oil and Gas Industry (GB Hackers on Security)
UnitedHealth says Change Healthcare hacked by nation state, as US pharmacy outages drag on (TechCrunch)
Vibrator virus steals your personal information (Malwarebytes)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Crackdown on privacy leads to a multi-million dollar fine.

AT&T experiences a major outage. The LockBit takedown continues. An updated Doppelgänger is spreading misinformation. A roundup of critical infrastructure initiatives. Toshiba and Orange make a quantum leap. An eyecare provider hack comes into focus. A phony iphone repair scheme leads to convictions. In our Learning Layer segment, Sam Meisenberg shares the latest learning science research. And we are shocked - shocked! - to discover that phone chargers can be used to attack our devices. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
On this month’s Learning Layer segment, host Sam Meisenberg of N2K discusses learning science research. Sam breaks down research about quizzes and their impact on learner motivation and long term retention. Want to know more? Sam suggests you check out The Value of Using Tests in Education as Tools for Learning—Not Just for Assessment.

Selected Reading
AT&T, Verizon and T-Mobile customers hit by widespread cellular outages in U.S. (NBC News)
US Offering $10M for LockBit Leaders as Law Enforcement Taunts Cybercriminals (SecurityWeek)
LockBit Group Prepped New Crypto-Locker Before Takedown (Gov Info Security)
Ukraine arrests father-son duo in Lockbit cybercrime bust (Reuters)
Russian Cyberwarfare campaign (ClearSky Cyber Security)
US Coast Guard issues cybersecurity directive for Chinese-made cranes after Biden's Executive Order (Industrial Cyber) 
US agencies release joint fact sheet to strengthen cybersecurity in water and wastewater systems (Industrial Cyber) 
E-ISAC 2023 report highlights cybersecurity triumphs and challenges in electricity sector (Industrial Cyber) 
Toshiba and Orange test quantum encryption on traditional network (Computer Weekly)
Hack at Services Firm Hits 2.4 Million Eye Doctor Patients (Gov Info Security)
Chinese Duo Found Guilty of $3m Apple Fraud Plot (Infosecurity Magazine)
VoltSchemer attacks use wireless chargers to inject voice commands, fry phones (BleepingComputer) 

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

AT&T outage leaves major cities offline.

President Biden to sign EO to bolster maritime port security. Apple announces post-quantum encryption for iMessage. Malwarebytes examines the i-Soon data leak. Law enforcement airs LockBit’s dirty laundry. Varonis highlights vulnerabilities affecting Salesforce platforms. An appeals court overturns a $1 billion piracy verdict. NSA’s Rob Joyce announces his retirement. Anne Neuberger chats with WIRED.  A leading staffing firm finds its data for sale on the dark web. In our sponsored Industry Voices segment, Navneet Singh, VP of Marketing Network Security at Palo Alto Networks, discusses the transition to the cloud and shares some examples from healthcare. Hackers and hobbyists push back on the proposed Flipper Zero ban. 
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
On our Industry Voices segment, Navneet Singh, VP of Marketing Network Security at Palo Alto Networks, discusses the transition to the cloud and shares some examples in healthcare.

Selected Reading
Biden to sign executive order to give Coast Guard added authority over maritime cyber threats (CyberScoop)
Apple Announces 'Groundbreaking' New Security Protocol for iMessage (MacRumors)
A first analysis of the i-Soon data leak (Malwarebytes)
Cops turn LockBit ransomware gang's countdown timers against them (The Register)
Security Vulnerabilities in Apex Code Could Leak Salesforce Data (Varonis)
Court blocks $1 billion copyright ruling that punished ISP for its users’ piracy (Ars Technica)
NSA cyber director to step down after 34 years of service (Nextgov/FCW)
Anne Neuberger, a Top White House Cyber Official, Is Staying Surprisingly Optimistic (WIRED)
Critical flaw found in deprecated VMware EAP. Uninstall it immediately (Security Affairs)
Hackers Claim Data Breach at Staffing Giant Robert Half, Sell Sensitive Data (HackRead)
Save Flipper (Save Flipper)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

Anchoring security for US ports.

Operation Cronos leaves LockBit operations on borrowed time. An alleged leak reveals internal operations from the Chinese Ministry of Public Security. An Israeli airline thwarts communications hijacking attempts. The alleged Raccoon Infostealer operator has been extradited to the US. ConnectWise patches critical vulnerabilities. Schneider Electric confirms a Cactus ransomware attack. Alleged Maryland money launderers face indictments. Russian hackers target media outlets in Ukraine. Our guest is Tomislav Pericin, Chief Software Architect at Reversing Labs , on the rise of software supply chain attacks. and Tinder hopes to reel in the catfish.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Guest is Tomislav Pericin, ReversingLabs Chief Software Architect, talking about the rise of software supply chain attacks. Learn more in their 2024 State of Software Supply Chain Security Report. 

Selected Reading
Police arrests LockBit ransomware members, release decryptor in global crackdown (BleepingComputer)
U.S. and U.K. Disrupt LockBit Ransomware Variant (US Justice Department)
Chinese Ministry Of Public Security Breach: Data On GitHub (The Cyber Express)
Massive “i-Soon” leak reveals Chinese firm's hacking tools, targets, including NATO (The Stack)
I-S00N Leaked Chinese foreign government infiltration intel on Github : r/cybersecurity (Reddit)
Israeli Aircraft Survive “Cyber-Hijacking” Attempts (Infosecurity Magazine)
Raccoon Infostealer operator extradited to the United States (Malwarebytes)
Critical ConnectWise ScreenConnect vulnerabilities fixed, patch ASAP! (Help Net Security)
Schneider Electric confirms data was stolen in Cactus ransomware attack (IT Pro)
Maryland Busts $9.5 Million #BEC Money Laundering Ring (CyberCrime & Doing Time)
Several Ukrainian media outlets attacked by Russian hackers (The Record)
Tinder Expands ID Checks Amid Rise in AI Scams, Dating Crimes (Bloomberg)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

The reign of digital terror ends.

Kathy O’Donnell is the leader of Space Solutions Architecture for AWS Aerospace and Satellite. In this extended conversation, we dive into how AWS is supporting generative AI in the space domain. She walks us through some incredible case studies with AWS customers who are using generative AI and space technologies to improve life here on Earth.
Learn more about generative AI use cases for space at AWS re:Invent.
AWS in Orbit is a podcast collaboration between N2K Networks and AWS to offer listeners an in-depth look at the transformative intersection of cloud computing, space technologies, and generative AI. You can learn more about AWS in Orbit at space.n2k.com/aws.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our weekly intelligence roundup, Signals and Space, and you’ll never miss a beat. And be sure to follow T-Minus on LinkedIn and Instagram.
Selected Reading
AWS successfully runs AWS compute and machine learning services on an orbiting satellite in a first-of-its kind space experiment | AWS Public Sector Blog
AWS re:Invent 2022 - Accelerate Geospatial ML with Amazon SageMaker (AER204) 
AWS re:Invent 2023
Audience Survey
We want to hear from you! Please complete our 4 question survey. It’ll help us get better and deliver you the most mission-critical space intel every day.
Want to join us for an interview?
Please send your pitch to space-editor@n2k.com and include your name, affiliation, and topic proposal.
T-Minus is a production of N2K Networks, your source for strategic workforce intelligence. © 2023 N2K Networks, Inc.

AWS in Orbit: Leveraging generative AI to do more at the rugged space edge with AWS. [T-Minus]

In this episode of CyberWire-X, N2K’s CSO, Chief Analyst, and Senior Fellow, Rick Howard, is joined by Tim Miller, Technical Marketing Engineer for Panoptica, Cisco's Cloud Application Security solution, (Panoptica is the result of Cisco's incubation engine (Outshift) for new products and markets), and Kevin Ford, Esri’s CISO. They discuss the complexity reduction need that Cloud-Native Application Protection Platforms (CNAPPs) provide. Outshift by Cisco is our CyberWire-X episode sponsor.
To learn more about Cloud-Native Application Protection Platforms, check out Panoptica’s website at https://panoptica.app and consider attending the Cisco Live EMEA in Amsterdam, February 5-8, 2024.

Get Started

Download the App