Dave Buettner (0:02)

You're listening to the CyberWire network, powered by N2K. Hey everybody, Dave here. I want to talk about our sponsor, LegalZoom. You know I started my first business back in the early 90s and oh what I would have done to have been able to have the services of an organization like LegalZoom back then. Just getting all of those business ducks in a row. All of that technical stuff, the legal stuff, the registrations of the business, the taxes, all of those things that you need to go through when you're starting a business, the hard stuff, the stuff that sucks up your time when you just want to get that business launched and out there. Well, LegalZoom has everything you need to launch, run and protect your business all in one place and they save you from wasting hours making sense of all that legal stuff. Launch, run and protect your business. To make it Official today@legalzoom.com you can use promo code CYBER10 to get 10% off any LegalZoom business information product, excluding subscriptions and renewals that expires at the end of this year. Get everything you need from set up to success@legalzoom.com and use promo code CYBER10. That's legalzoom.com and promo code CYBER10. Legalzoom provides access to independent attorneys and self service tools. Legalzoom is not a law firm and does not provide legal advice except where authorized through its subsidiary law firm, LZ Legal Services LLC. Pundits predict Trump will overhaul US cybersecurity Policy experts examine escalating cybersecurity threats facing the US energy sector. Palo Alto Network's patches apparently zero days, Akira and SafePay ransomware groups claim dozens of new victims. A major pharmacy group is pressured to pay a $1.3 million ransomware installment. Threat actors are exploiting Spotify playlists and podcasts. An alleged Phobos ransomware admin has been extradited to the US rapper Razzle Khan gets 18 months in prison for her part in the Bitfinex cryptocurrency hack. On today's threat vector, David Moulton speaks with Asaf Dahan, director of threat research at Palo Alto Network's Cortex Team, about the rising cyber threat from North Korea and Swiss scammers send snail mail. It's Tuesday, January 19th, 2024. I'm Dave Buettner and this is your Cyberwire intel briefing. A second Trump administration is expected to overhaul U.S. cybersecurity policy, prioritizing business interests, aggressive offensive measures and deregulation over the Biden era of focus on corporate accountability spyware restrictions and AI safeguards In an article for Wired, Eric Geller writes that Trump is likely to dismantle Biden's regulatory efforts on critical infrastructure cybersecurity, citing industry burdens. Rules impacting rail, aviation and water systems could be scrapped or weakened with a shift toward voluntary compliance and incentives. Efforts like CISA's disinformation campaigns and AI safety initiatives focused on societal harms may also end, reflecting Trump's emphasis on free speech and reduced regulation. Spyware policies are expected to favor market growth over human rights concerns, benefiting firms like NSO Group. AI regulations requiring transparency and safety measures may be repealed, favoring innovation over safeguards. Trump is poised to expand military cyber operations, emphasizing accountability for Chinese and Russian cyberattacks. Cyber command could see enhanced roles, including potentially forming a separate military cyber branch. Policies blocking Chinese tech could also resurface. Initiatives pushing companies to design secure software and accept liability for vulnerabilities may stall, while slogans like secure by design may persist. New regulations are unlikely, reflecting the administration's alignment with corporate interests. CISA's Cybersecurity Incident Reporting rules could be scaled back, exempting sectors or limiting required disclosures. Ultimately, Trump's cybersecurity agenda may favor deregulation and military action while sidelining corporate accountability, spyware restrictions and emerging AI safety policies. In an editorial for cyberscoop, Sachin Bansal, president of Security Scorecard, and Brian Harrell, former assistant secretary for infrastructure protection at the Department of Homeland Security, say the US Energy sector faces escalating cybersecurity threats as it integrates complex supply chains, clean energy technologies and digital systems. National Security Advisor Jake Sullivan recently highlighted the critical need for supply chain security as vulnerabilities in software and third party vendors present significant risks to vital infrastructure. A KPMG report revealed that third party risk accounts for 45% of breaches in the sector, compared to a global average of 29%. The shift to greener, software driven energy grids introduces additional risks, with renewable energy companies scoring lowest on cybersecurity metrics. Coupled with the potential for foreign exploitation, particularly by China, these factors underscore the urgency of a unified strategy. Efforts to enhance resilience include the Department of Energy's supply chain cybersecurity principles, supported by major firms like ge, Vernova and Siemens. Regulators such as the Federal Energy Regulatory Commission are revising standards to address supply chain risks. Meanwhile, the White House is exploring cybersecurity ratings for infrastructure sectors. However, challenges remain. Attacks such as the Colonial Pipeline ransomware incident show how breaches in IT systems disrupt operations. Utilities struggle with the resources and expertise to counter growing threats, the authors say. A collective effort between government and industry is vital to secure every link in the supply chain. By adopting consistent frameworks, measuring progress and fostering transparency, the energy sector can bolster cybersecurity resilience, safeguarding critical infrastructure and global stability. Palo Alto Networks has patched two zero day vulnerabilities exploited in Operation Lunar Peak. The first is a critical authentication bypass flaw allowing attackers to gain admin access via the Pan OS management interface. The second is a privilege escalation issue enabling root access. These vulnerabilities targeted exposed firewall management interfaces and have been addressed in Pan OS updates. CISA has added the flaws to its known exploited Vulnerabilities catalog, urging fixes by December 9 to mitigate risks. The SafePay cybercrime operation, a new ransomware group deploying Lockbit based malware, has claimed 22 victims as of November of this year, according to Huntress. The group exploits Remote desktop protocol access to encrypt files and exfiltrate data. SafePay's ransomware is derived from a well documented lockbit variant and incorporates tactics from other groups like alfv, blackcat, including UAC bypasses and Living off the Land binaries for privilege escalation. Huntress identified vulnerabilities in SafePay's Tor site, enabling deeper insights into its operations. SafePay employs tools like WinRAR for archiving stolen data and FileZilla for file transfers, often uninstalling them afterward to cover their tracks. The ransomware includes a Cyrillic language based kill switch to avoid attacks in the Commonwealth of Independent States countries. Meanwhile, the Akira Ransomware group leaked data from 32 new victims in a single day last week, according to Cyber Int. Active Since March of 2023, Akira operates as a ransomware as a service and has impacted over 350 organizations globally, earning an estimated $42 million targeting business services, critical infrastructure and other sectors. Akira primarily focuses on U S based organizations, but also attacks entities in Canada, Europe and beyond. Cyber Int reports that most victims were directly added to Akira's leaks sections on its Tor site, bypassing the usual news section. This aggressive activity, which aligns with trends of escalating ransomware operations, mirrors similar mass victim disclosures by groups like Lockbit. Akira's rapid growth and record breaking victim counts indicate its expanding influence in the global cybercrime ecosystem. The Embargo Ransomware group is pressuring American Associated Pharmacies to pay a second $1.3 million installment of an alleged 2.6 million doll ransomware deal after already receiving the first payment. The group, which claims to have stolen one and a half terabytes of data, has threatened to leak the information by midweek if the payment isn't made. Embargo accuses AAP of prioritizing system restoration over customer data protection. Embargo's tactics include double extortion, a common strategy among ransomware gangs, researchers note. Embargo targets various sectors worldwide and has increasingly targeted health care, including Georgia's Memorial Hospital and Manor. Embargo, which surfaced this year, denies political affiliations, focusing instead on opportunistic attacks. Experts warn of potential class action suits and growing risks without stronger privacy laws. To deter such cybercrime threat, actors are exploiting Spotify playlists and podcasts to promote pirated software, game cheats, spam links and dubious websites, leveraging Spotify's strong reputation and SEO presence to boost visibility. Using targeted keywords and links in titles and descriptions, scammers direct users to malware laden sites or fake surveys. Some playlists, like one advertising a Sony Vegas Pro crack and Spammy podcasts, use synthesized speech to lure users into clicking links, leading to ad heavy or malicious sites. These tactics extend to promoting game cheats and pirated ebooks. Cybercriminals often exploit third party podcast distribution services to bypass platform safeguards. Spotify has removed some flagged content and emphasized its rules against malicious practices, but the challenge of combating such spam campaigns persists. Russian national Evgeny Sitsyn, age 42, has been extradited to the US to face charges related to administrating the Phobos ransomware, according to the Department of Justice. Accused of running a ransomware as a Service Scheme since 2020, sits in allegedly developed and sold Phobos ransomware to affiliates who targeted over 1,000 victims worldwide, including schools and hospitals, extorting over $16 million. Affiliates used stolen credentials to encrypt and exfiltrate data, pressuring victims to pay ransom. Sitsen faces up to 120 years in prison if convicted. Heather Razalkan Morgan, a self proclaimed rapper and entrepreneur, was sentenced to 18 months in prison for assisting her husband, Ilya Lichtenstein, in laundering Bitcoin stolen during the infamous 2016 Bitfinex cryptocurrency hack. Liechtenstein, who received a five year sentence, stole over 119,000 Bitcoin worth $71 million then and now, valued at $10.8 billion. Morgan, aware of the fund's illicit origins since 2020, helped conceal them through financial accounts, virtual currency exchanges and mixers like Bitcoin Fog. Prosecutors recommended leniency, citing her clean record and limited personal gain. Coming up after the break. Today's Threat Vector David Moulton speaks with Asaf Dahan about the rising cyber threat from North Korea. Stay with us. And now a word from our sponsor, Know before it's all connected and we're not talking conspiracy theories when it comes to infosec tools, effective integrations can make or break your security stack. The same should be true for security awareness training. KnowBe4, provider of the world's largest library of security awareness training, provides a way to integrate your existing security stack tools to help you strengthen your organization's security culture. KnowBe4's security coach uses standard APIs to quickly and easily integrate with your existing security products from vendors like Microsoft, CrowdStrike and Cisco. 35 vendor integrations and Counting Security Coach analyzes your security stack alerts to identify events related to any risky security behavior from your users. Use this information to set up real time coaching campaigns targeting risky users based on those events from your network, endpoint identity or web security vendors. Then coach your users at the moment the risky behavior occurs, with contextual security tips delivered via Microsoft Teams, Slack or email. Learn more@knowbefore.com SecurityCoach that's knowbefore.com SecurityCoach and we thank KnowBe4 for sponsoring our show. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off. On today's segment from the Threat Vector, podcast host David Moulton speaks with Asaf Dahan, director of Threat Research at Palo Alto Network's Cortex Team. They're discussing the rising cyber threat from North Korea.