Newsletters

Planned changes to the leadership of US Cyber Command (CYBERCOM) and the National Security Agency (NSA) will prioritise short-term cyber disruption operations at the expense of longer-term intelligence collection. 

The incoming Trump administration plans to end the current 'dual-hat' arrangement whereby both organisations are led by a single officer, according to The Record. The article says the proposal is in its early stages but there aren't any major impediments to the change. Essentially, it only requires that both the Secretary of Defense and the Chairman of the Joint Chiefs certify that the change wouldn't pose an 'unacceptable risk to the military effectiveness' of CYBERCOM. 

The change has been proposed before. President Obama supported a split way back in 2017, and it was again pushed just before the end of President Trump's first term. On that occasion, the plan was killed by then-chairman of the Joint Chiefs, General Mark Milley. 

The US Cybersecurity and Infrastructure Security Agency has sent out 2,131 pre-ransomware activity notifications to US organizations throughout the year.

The notifications were sent via a program named the Pre-Ransomware Notification Initiative (PRNI), which CISA launched in March of 2023.

The program uses tips received from the private sector to detect early ransomware activity and notify potential targets before their data is stolen or encrypted.

Threat actors have secretly abused a suspected zero-day in DrayTek routers since August of last year to hack devices, steal passwords, and then deploy ransomware on connected networks.

According to a joint report from Forescout and PRODAFT, the attacks were carried out by a threat actor known as Monstrous Mantis—believed to be linked to the Ragnar Locker ransomware group.

The attacker used the zero-day to extract and crack the passwords of DrayTek Vigor routers and then hand out the credentials to selected collaborators.

Germany's cybersecurity agency has sinkholed internet traffic originating from Germany and going to the command and control servers of the BADBOX malware group.

The malware was first spotted in October of last year by Human Security, a company specialized in detecting advertising fraud.

The BADBOX group assembled a botnet of over 280,000 systems by hiding its malware in malicious Android and iOS apps and inside the firmware of Android TV streaming boxes.

The US government and lawmakers are scrambling to deal with the ongoing compromise of US telecommunications companies by a Chinese espionage group dubbed Salt Typhoon. 

In the US, the campaign has compromised at least eight telecommunications companies and been ongoing for a year or more. The Cyber Safety Review Board examination of the incident has kicked off, but we already know the rough shape of what has happened. 

At some US telcos, the hackers were able to penetrate the portals used to submit court orders for interception requests, letting them see what phone numbers were being tasked. 

The Termite ransomware group is believed to be behind a wave of attacks exploiting an improperly patched vulnerability in Cleo file transfer products.

The attacks started on December 3 and have compromised at least ten organizations, according to security firm Huntress Labs.

The Termite group is exploiting a bug initially patched at the end of October that impacts Cleo file-transfer products such as Harmony, LexiCom, and VLTrader.

More than two years after it got caught spying on journalists and political rivals, the Greek government is still working at burying the investigation into what is now known as the Predatorgate scandal.

The incident, which rocked the Greek political scene, came to light in July 2022 when a security team of the European Parliament found traces of the Predator spyware on the phone of Nikos Androulakis, an EU MP and the president of Greece's second-largest opposition party (PASOK).

The surveillance operation was ordered by the ruling government, was conducted by the Greek national intelligence service, the EYP, and allegedly cost €7 million.

Romania's national security council (CSAT) has declassified two documents this week that reveal a coordinated propaganda campaign that boosted an obscure far-right and pro-Kremlin candidate into the country's first round of presidential elections.

The campaign, which mostly took place via TikTok, took Calin Georgescu from an unknown candidate who was only polling around 1% a month before the election to the winner of the first presidential election round, where he accounted for almost a quarter of all votes.

The documents did not formally attribute the operation, but in a subsequent statement this week, the US State Department said what every Romanian politician and regular citizen already said and knew—that this was Russia.

The 2016 US Presidential race has raised awareness of the role of hack and leak operations in election interference, but there is a far longer history of these operations affecting public policy.     

This week, Reuters reported that a consultancy working for Exxon Mobil was being investigated by the FBI over its alleged role in a hack and leak operation targeting environmental activists.

This is the latest instalment in Chris Bing and Raphael Satter's long-running Reuters investigation into the rise of the hack-for-hire industry and how it has been used to influence legal battles. Per Reuters:

The Polish government has detained and forcibly taken to testify in front of a parliamentary hearing over the former government's use of the Pegasus spyware.

Piotr Pogonowski led Poland's internal security agency, the ABW, from 2016 to 2020.

Under his watch, the agency bought and used the NSO Group's Pegasus spyware to spy on opposition leaders, journalists, and prosecutors investigating government corruption.