CyberWire Daily: “Biden vs. Trump: A Tale of Two Cybersecurity Strategies”
Released on November 19, 2024
Host/Author: N2K Networks

Introduction

In this episode of CyberWire Daily, N2K Networks delves into the contrasting cybersecurity strategies of former President Donald Trump and current President Joe Biden. The discussion navigates through policy shifts, emerging threats, and the evolving landscape of cyber defense in the United States. Additionally, the episode covers significant cybersecurity incidents, updates on ransomware activities, and an in-depth interview with Asaf Dahan from Palo Alto Networks on North Korean cyber threats.

I. Biden vs. Trump: Divergent Cybersecurity Strategies

The episode opens with an analysis of the anticipated overhaul of U.S. cybersecurity policy under a potential second Trump administration. Drawing insights from Eric Geller’s article in Wired, the discussion highlights how Trump's approach is set to prioritize business interests, aggressive offensive measures, and deregulation. This stands in stark contrast to Biden's focus on corporate accountability, spyware restrictions, and AI safeguards.

Key Points:

• Regulatory Changes: Trump is expected to dismantle Biden-era regulations on critical infrastructure cybersecurity, citing industry burdens. This includes weakening rules affecting rail, aviation, and water systems, shifting towards voluntary compliance and incentives.

  “Trump is poised to expand military cyber operations, emphasizing accountability for Chinese and Russian cyberattacks.”
  — Eric Geller, Wired

• Spyware and AI Policies: Under Trump, spyware regulations are likely to favor market growth over human rights, benefiting firms like NSO Group. AI regulations requiring transparency and safety measures may be repealed to encourage innovation.

• Military Cyber Operations: Expectation of enhanced roles for Cyber Command, potentially forming a separate military cyber branch to counteract adversarial cyber activities more effectively.

• Corporate vs. Military Focus: The Trump administration may deprioritize corporate accountability and AI safety in favor of military-led cyber initiatives, aligning more closely with corporate interests and reducing overall regulatory oversight.

II. Escalating Cyber Threats in the US Energy Sector

An editorial from Cyberscoop by Sachin Bansal and Brian Harrell emphasizes the increasing cybersecurity threats faced by the U.S. energy sector. As the sector integrates complex supply chains, clean energy technologies, and digital systems, vulnerabilities proliferate, particularly through third-party vendors.

Key Insights:

• Third-Party Risks: A KPMG report reveals that third-party risk accounts for 45% of breaches in the energy sector, significantly higher than the global average of 29%.

  “The shift to greener, software-driven energy grids introduces additional risks, with renewable energy companies scoring lowest on cybersecurity metrics.”
  — Sachin Bansal & Brian Harrell, Cyberscoop

• Regulatory Responses: Initiatives by the Department of Energy and the Federal Energy Regulatory Commission aim to enhance supply chain security through revised standards and cybersecurity principles.

• Resilience Building: Emphasis on government-industry collaboration to secure the supply chain, adopting consistent frameworks, and fostering transparency to bolster cybersecurity resilience.

III. Palo Alto Networks Addresses Critical Vulnerabilities

Palo Alto Networks has patched two significant zero-day vulnerabilities exploited in Operation Lunar Peak. These vulnerabilities pertain to:

1. Authentication Bypass Flaw: Allows attackers to gain administrative access via the PAN-OS management interface.
2. Privilege Escalation Issue: Enables root access, posing severe risks to firewall management interfaces.

The Cybersecurity and Infrastructure Security Agency (CISA) has added these flaws to its Known Exploited Vulnerabilities catalog, urging organizations to apply the necessary fixes by December 9.

IV. Ransomware Threats: SafePay, Akira, and Embargo Groups

The ransomware landscape continues to evolve with several active groups intensifying their operations:

• SafePay Ransomware Group:

  • Victim Count: 22 victims as of November.
  • Tactics: Utilizes Remote Desktop Protocol (RDP) access to encrypt files and exfiltrate data, incorporating strategies from other ransomware groups like alfv and BlackCat.
  • Technical Details: Employs tools such as WinRAR and FileZilla for file transfers, with a Cyrillic-based kill switch to avoid attacks in CIS countries.

• Akira Ransomware Group:

  • Recent Activity: Leaked data from 32 new victims in a single day last week.
  • Operational Model: Functions as ransomware-as-a-service, impacting over 350 organizations globally and earning an estimated $42 million.
  • Targets: Primarily U.S.-based organizations, including business services and critical infrastructure.

• Embargo Ransomware Group:

  • Current Incident: Pressuring American Associated Pharmacies (AAP) to pay a second $1.3 million installment following an initial payment.
  • Method: Engages in double extortion by threatening to leak 1.5 terabytes of stolen data.
  • Sector Focus: Increasingly targets healthcare institutions, including Georgia's Memorial Hospital and Manor.

V. Exploiting Spotify Playlists and Podcasts for Malware Distribution

Cybercriminals are leveraging Spotify's platform to disseminate malware through playlists and podcasts. By embedding QR codes and malicious links within titles and descriptions, scammers direct users to malware-laden sites or fake surveys. These tactics include promoting pirated software, game cheats, and ebooks.

Mitigation Efforts:

• Spotify's Response: The platform has removed flagged content and reinforced its rules against malicious practices. However, combating such spam campaigns remains challenging due to the exploitation of third-party distribution services.

VI. Legal Actions: Extraditions and Sentencing in Cybercrime

Significant legal actions highlight the ongoing battle against cybercrime:

• Extradition of Evgeny Sitsyn:

  • Charges: Administering the Phobos ransomware, running a ransomware-as-a-service scheme since 2020.
  • Impact: Phobos ransomware targeted over 1,000 victims worldwide, extorting over $16 million.
  • Potential Penalty: Up to 120 years in prison if convicted.

• Sentencing of Heather Razalkan Morgan:

  • Involvement: Assisted her husband in laundering Bitcoin stolen during the 2016 Bitfinex cryptocurrency hack.
  • Sentence: 18 months in prison for her role in concealing illicit funds through financial accounts and cryptocurrency mixers.

VII. In-Depth: North Korean Cyber Threats (Threat Vector Interview)

A significant portion of the episode features an in-depth interview with Asaf Dahan, Director of Threat Research at Palo Alto Networks' Cortex Team, hosted by David Moulton.

Key Discussion Points:

• North Korean Cyber Operations:

  • Historical Context: The 2014 Sony Pictures hack marked North Korea's entry into high-profile cyber attacks, driven by both political motives and financial gain.

    “North Korean threat actors are not script kiddies. They are a major cyber force to be reckoned with...”
    — Asaf Dahan [17:31]

• Financial Motivation: Unlike other nation-state actors primarily driven by espionage or sabotage, North Korean hackers are significantly motivated by financial gain to support the impoverished nation under extensive sanctions.

  “The financial motivation of the North Korean threat actors that really sets them apart... makes them more relevant to more organizations worldwide.”
  — Asaf Dahan [17:31]

• Notable Operations:

  • 2014 Sony Hack: Aimed at halting the release of a movie parodying the assassination of Kim Jong Un.
  • 2016 Bangladesh Bank Heist: Attempted to steal $1 billion, ultimately failing due to a typo, although $80 million was illicitly obtained.

• Strategic Evolution: Over the years, North Korea has developed a more cohesive cyber warfare strategy, focusing on bank heists and financial cybercrimes to generate revenue.

• Defensive Challenges:

  • Human Factor: Asaf emphasizes that human behavior remains the weakest link in cybersecurity defenses, with social engineering being a primary method of attack.

    “The technology is great... but the one thing that is still very challenging is the human aspect of cybersecurity attacks.”
    — Asaf Dahan [23:06]

  • Mitigation Strategies: Raising awareness, conducting extensive social engineering training, and leveraging technologies like Large Language Models (LLMs) and Generative AI for both offensive and defensive purposes.

Conclusion of Interview: David and Asaf underscore the importance of understanding the multifaceted nature of North Korean cyber threats, emphasizing that combating these sophisticated actors requires both technological solutions and robust human-centric defenses.

Closing Remarks

The episode concludes by highlighting emerging cyber threats, including the use of traditional mail for malware distribution in Switzerland and legal assurances for iPhone users against certain scams. The CyberWire Daily stresses the importance of continuous vigilance and adaptive strategies in the face of evolving cyber threats.

Notable Quotes:

• “North Korean threat actors are not script kiddies. They are a major cyber force to be reckoned with...”
  — Asaf Dahan [17:31]

• “The technology is great... but the one thing that is still very challenging is the human aspect of cybersecurity attacks.”
  — Asaf Dahan [23:06]

Final Notes

For a comprehensive understanding of the discussed topics, including the full Threat Vector interview, listeners are encouraged to access the complete episode through their preferred podcast platforms or visit CyberWire Daily.