Newsletters

SolarWinds executives have been formally warned by the US Securities and Exchange Commission that it plans to bring enforcement actions against them over the 2020 supply chain attack that involved compromise of the company's Orion software platform.

In its SEC filing this week, SolarWinds announced that "certain current and former executive officers and employees of the Company, including the Company’s Chief Financial Officer and Chief Information Security Officer received 'Wells Notices'". A Wells Notice indicates that SEC staff have recommended the commission pursue a civil enforcement action against the recipients because the SEC believes they may have broken US federal securities laws.

The filing doesn't make it exactly clear what the executives are thought to have done wrong, but SolarWinds' last quarterly report provides some clues. Back in October 2022, the company as a whole received its own Wells Notice, which alleged "violations of certain provisions of the U.S. federal securities laws with respect to our cybersecurity disclosures and public statements, as well as our internal controls and disclosure controls and procedures".

Back in 2014, a new attack named RowHammer upended the memory market and forced chip makers to rethink how they were manufacturing and what type of security features they were baking into DRAM chips.

The RowHammer attack—and all its variations—used super-fast read-write operations directed at a row of memory cells inside a DRAM chip to generate electrical disturbances that altered or corrupted data in nearby rows.

Throughout the years, chip vendors started placing memory rows at larger distances between each other and added software-level protections to detect when apps were accessing memory rows at super-high rates.

The European Union has issued its 11th package of sanctions against Russia for its invasion of Ukraine. Issued last Friday, the sanctions list was expanded with 71 individuals and 33 entities, including five Russian cybersecurity and IT companies such as Positive Technologies, NTC Vulcan, Echelon, Iteranet, and Poisk-IT.

EU officials say the companies provide IT services to support the activity of Russian intelligence services, such as developing hacking tools and data collection and analysis.

The biggest name on the list is Positive Technologies, one of Russia's largest cybersecurity companies. This is the second time the company has been sanctioned. It was also sanctioned by the US Treasury in April 2021 for providing hacking tools to the FSB and using its security conference as an FSB and GRU recruiting hub.

The Romanian government will hack back the command and control servers of foreign APT groups targeting the country, General Anton Rog, the head of CyberInt, the cyber division of the Romanian Intelligence Service, said this week at an IT conference in Bucharest.

Gen. Rog says the purpose of hack-back operations will be to acquire malware samples, share them with partners, and disrupt operations.

The agency's new approach is part of a new national cybersecurity strategy adopted in December 2021, which also contains an offensive component that would facilitate such operations.

The polite thing to do when your APT operation is discovered by your adversaries is to pack up, go home, and ready your next campaign. What you shouldn't do is escalate in response to discovery, dig in, and turn thousands of expensive email gateway appliances into boat anchors.

But this is exactly what a Chinese APT group did in response to one of its recent campaigns being rumbled.

Last week, Mandiant published a report attributing a recent "wide-ranging campaign" exploiting a Barracuda Email Security Gateway (ESG) vulnerability to a PRC cyberespionage actor it tracks as UNC4841.

Albanian law enforcement raided a refugee camp hosting members of Iranian opposition party Mujahedeen-e-Khalq (People's Mujahedin of Iran, or MEK) on suspicion of operating a "hacker center" that conducted cyber-attacks against foreign institutions.

The raids took place on Tuesday, June 20, and targeted a camp near the city of Manez in Western Albania.

The camp hosts around 3,000 MEK party members that were relocated to Albania in 2013 after their previous camp in Iraq came under attack from Iraqi and Iranian forces.

Microsoft has quietly confirmed that the recent outages of its Outlook, OneDrive, and SharePoint online services were caused by DDoS attacks carried out by a pro-Kremlin group named Anonymous Sudan (Storm-1359 in Microsoft's internal nomenclature).

That's quite the embarrassing statement from one of the world's top three cloud providers that, apparently, can't protect its own services.

In a blog post published late Friday, Microsoft seems to have been caught off guard by the group's choice of attack methodology.

The operators of the LockBit ransomware are believed to have made more than $91 million in ransom payments from more than 1,700 attacks targeting US organizations, according to CISA and the FBI.

The figure covers LockBit's entire lifespan since its official launch in January 2020, but it does not include ransom payments that have not been reported to the FBI or payments made by foreign companies.

Regardless, this puts LockBit right up there with the best-earning ransomware gangs of all time, trailing the likes of Ryuk, REvil, and Darkside. [obviously, based on limited visibility into the ecosystem]

An ODNI report into the US Intelligence Community's use of Commercially Available Information (CAI) has caused quite a stir, but most of the resulting press coverage has missed the forest for the trees.

It is a problem that the IC is using this information without any guiding policy. It is a much, much bigger problem that this information is being collected for sale in the first place.

The report examines how the IC is using CAI, what privacy and civil liberty protections cover its use, and makes recommendations about how this data should be used in the future. It defines CAI as information that can be bought by the public and excludes data that is commercially available only to governments.

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a new Binding Operational Directive (BOD) and has ordered federal civilian agencies to limit access from the internet to the management interfaces of networking equipment.

The new BOD 23-02 applies to routers, switches, firewalls, VPN servers, proxies, load balancers, and out-of-band server management interfaces such as the iLo and iDRAC.

It applies to management interfaces hosted on a multitude of protocols, ranging from HTTPS to SSH, SMB, RDP, and others.