Author Archives: Chris Bing

Hackers linked to North Korea targeted U.S. ICS companies, breached energy firm

Posted on by

Hackers possibly linked to North Korea were able to successfully gain access to the corporate network of at least one U.S.-based energy company in recent months, according to multiple sources with knowledge of a recent intelligence report on the matter. Six sources tell CyberScoop the report notes that hackers were found actively targeting a handful of U.S. companies that rely on industrial control systems. Less than 10 companies were targeted with phishing emails as part of this apparent information gathering campaign — including one known breach — leading analysts to believe the effort is targeted and well-organized, a person with knowledge of the malicious cyber activity said. The activity was originally identified by at least two different private cybersecurity companies. The Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) is aware of the activity and in recent weeks shared information with some partners. NBC News obtained […]

The post Hackers linked to North Korea targeted U.S. ICS companies, breached energy firm appeared first on Cyberscoop.

Continue reading Hackers linked to North Korea targeted U.S. ICS companies, breached energy firm→

‘Highly active’ Hamas-linked hackers found spying on Palestinian political group

Posted on by

A “highly active” group of hackers, which some analysts believe may be linked to Hamas, are spying on Palestinian government employees, security services, university students and Fatah party politicians by infecting smartphones with malware, according to research conducted by mobile security firm Lookout. The espionage campaign is part of a broader effort by the hacker group, previously dubbed “Two-tailed Scorpion” by security researchers, to remotely collect information about Palestinians related in some way to the political process, including those individuals who may discuss, share or otherwise receive sensitive material on their mobile phones. Fatah and Hamas represent the two largest political parties of the State of Palestine, a contested territory that spans two separate areas, the West Bank and Gaza Strip — bordering on Israel, Jordan and Egypt. The two political organizations continuously clash with one another to control the state. Between 2006 and 2007, their rivalry led to an armed conflict […]

The post ‘Highly active’ Hamas-linked hackers found spying on Palestinian political group appeared first on Cyberscoop.

Continue reading ‘Highly active’ Hamas-linked hackers found spying on Palestinian political group→

Time is running out to approve state officials to receive cybersecurity intel ahead of elections

Posted on by

With just about a month left before the polls open in New Jersey and Virginia for gubernatorial elections, the Department of Homeland Security is racing to vet state officials who have applied for the ability to receive classified briefings and other information related to potential cyber-intrusions into election systems, people familiar with the matter tell CyberScoop. In August, the DHS began reaching out to chief election officials in every state to begin the process of obtaining clearances. While the nominees for these clearances are usually the secretary of state or similar high-ranking office-holders, some supporting staff have also sought clearances. The processing for each of these applications varies by person and as a result, there’s no average wait time. Over the last several months, however, DHS has been able to issue “interim” clearances when necessary within 30 days of an application, officials told CyberScoop. Final clearance approvals are taking much longer, the officials said. People […]

The post Time is running out to approve state officials to receive cybersecurity intel ahead of elections appeared first on Cyberscoop.

Continue reading Time is running out to approve state officials to receive cybersecurity intel ahead of elections→

Trump administration will shine light on VEP with public charter

Posted on by

The Trump administration plans to launch a “public charter” to add transparency and clarity to the Vulnerabilities Equities Process (VEP), a policy that guides when and if the U.S. government will tell a software vendor about digital flaws they’ve discovered in their products that could be otherwise used for espionage or intelligence operations. “We are in the process of a policy decision-making group that’s reviewing it, endorsing it, and then we will be able to push it out,” Joyce said Wednesday at the Cambridge Cyber Summit about the charter. “What we’re trying to carefully weigh is having those capabilities, to be able to use them for national security, while at the same time making sure that it’s not a major liability for our economy, for the international community, for our national security.” In an interview with CyberScoop, Joyce said the public charter would provide some new information concerning the number […]

The post Trump administration will shine light on VEP with public charter appeared first on Cyberscoop.

Continue reading Trump administration will shine light on VEP with public charter→

FBI issues flash alert on Apache Struts vulnerability

Posted on by

Law enforcement is just beginning to understand the damage caused by a single, highly publicized software vulnerability that was labeled as a key reason credit reporting agency Equifax suffered a disastrous data breach earlier this year. The FBI is asking for help from the private sector to identify and track a group that recently was found to target older versions of the open source web application framework Apache Struts. The vulnerability, which was originally disclosed in March, remains present inside hundreds of corporate networks. Apache Struts is especially popular within the U.S.’s three big credit reporting agencies. More than 145 million people were affected by the Equifax breach. This call for information comes in the form of an FBI Flash alert sent Sept. 29 and obtained by CyberScoop. The flash alert, labeled “TLP:AMBER,” provides technical indicators related to a recent, unnamed corporate breach involving a hacker exploiting a remote code execution vulnerability in Apache […]

The post FBI issues flash alert on Apache Struts vulnerability appeared first on Cyberscoop.

Continue reading FBI issues flash alert on Apache Struts vulnerability→

Research claims CCLeaner attack carried out by Chinese-linked group

Posted on by

Security researchers increasingly believe that an elite Chinese hacking group broke into British software maker Piriform to booby trap popular file cleaning program CCleaner, according to research and private analysis provided to CyberScoop. New research published Monday by Israeli cybersecurity startup Intezer Labs, authored by senior security researcher Jay Rosenberg, adds support to the conclusion that Chinese hackers tried to gain access to a small number of multinational telecommunications and technology companies. Check out my latest blog post on the stage 2 payload of the #ccleaner attack! Special thanks to @TalosSecurity and @kaspersky https://t.co/YgYjfE3Jo3 — Jay Rosenberg (@jaytezer) October 2, 2017 Although attributing a data breach to a specific hacker group remains an imperfect science, recently uncovered evidence contains technical indicators that overlap with those used by an advanced persistent threat (APT) group codenamed Axiom Group, security researchers at multiple cybersecurity firms told CyberScoop. In addition to Intezer Labs’ analysis, […]

The post Research claims CCLeaner attack carried out by Chinese-linked group appeared first on Cyberscoop.

Continue reading Research claims CCLeaner attack carried out by Chinese-linked group→

Recent NSA leaks show challenge of a software ‘solution’ for insider threats

Posted on by

Two recent thefts of NSA documents were made possible simply because workers who handled sensitive material decided to walk out the door with some of it, serving to highlight challenges facing the U.S. intelligence community as it seeks to implement, and in some cases create, next generation insider threat programs. Former U.S. intelligence officials tell CyberScoop the rudimentary nature of these incidents makes it extremely difficult to create programs that keep material secure without negatively impacting workforce morale. “It’s impossible to totally stop from what I can see,” said a former U.S. intelligence official who spoke on condition of anonymity to discuss their experience. “There’s just way too many people walking in and out for nothing to get stolen.” Newly released court documents provide details about recent leaks of classified documents to The Intercept, a national security focused news publication known for its work with Edward Snowden. A transcript of an interview with […]

The post Recent NSA leaks show challenge of a software ‘solution’ for insider threats appeared first on Cyberscoop.

Continue reading Recent NSA leaks show challenge of a software ‘solution’ for insider threats→

States want more from DHS after confusing update on 2016 election hacking activity

Posted on by

U.S. states targeted by Russian hackers last year are pushing back after the Department of Homeland Security provided what they say is inaccurate information about attempts to breach their election systems prior to Election Day. The election administrative offices in California, Wisconsin and Texas said this week that the information provided to them by DHS failed to prove that Russian hackers had either attempted or were successful in breaching state election systems, which includes products sold by contractors and used by states for voter registration and vote tabulation. People familiar with the matter told CyberScoop that the information provided by DHS last week is in fact accurate, but clearly incomplete. The evidence provided to states failed to give the necessary context needed to explain how certain activities aimed at adjacent, interconnected internet systems could impact election-related technology. A DHS spokesperson confirmed the department had in recent days provided clarifications to […]

The post States want more from DHS after confusing update on 2016 election hacking activity appeared first on Cyberscoop.

Continue reading States want more from DHS after confusing update on 2016 election hacking activity→

Banking-focused phishing scheme hits inboxes in wake of Equifax breach

Posted on by

A group of hackers has been sending specially tailored phishing emails to online banking customers, stoking fears among an online population that is increasingly concerned with how cybercriminals could leverage the data stolen from credit monitoring giant Equifax. This specific phishing campaign, identified by U.S. technology firm Barracuda Networks, focuses on a string of recent banking-related emails that began to hit inboxes shortly after Equifax was originally breached, but several weeks before the incident was first publicly disclosed Sept. 7. The campaign remains active. Although the scheme’s timing has caught researchers’ attention, it remains unclear whether the criminal operation was directly related to the Equifax breach. Security experts have warned that the Equifax breach could lead to fraudulent credit card charges for affected individuals. As a result, it’s no surprise that hackers are actively attempting to impersonate legitimate banking companies as they communicate with clients about suspicious account activity. Barracuda […]

The post Banking-focused phishing scheme hits inboxes in wake of Equifax breach appeared first on Cyberscoop.

Continue reading Banking-focused phishing scheme hits inboxes in wake of Equifax breach→

DHS, FBI promise to improve defense of election systems ahead of 2018 campaign season

Posted on by

The Department of Homeland Security is promising to better coordinate with state and local government officials in efforts to defend election systems from hackers in the upcoming 2018 congressional campaign season. The pledge, by acting Secretary Elaine Duke, comes after a chaotic 2016 cycle which saw hackers probe and in some cases breach voter registration databases in multiple states. There is no publicly available evidence to suggest that election results were significantly altered as a result of these intrusions. Duke spoke Wednesday on Capitol Hill alongside FBI Director Christopher Wray and Nicholas Rasmussen, director of the National Counterterrorism Center, in a congressional hearing focused on existing homeland security threats. At one point, lawmakers pressed Duke and Wray to answer how their individual agencies were preparing for possible cyberattacks against election systems in the coming year — especially those that could go further and potentially impact voting tallies. Duke highlighted the role DHS […]

The post DHS, FBI promise to improve defense of election systems ahead of 2018 campaign season appeared first on Cyberscoop.

Continue reading DHS, FBI promise to improve defense of election systems ahead of 2018 campaign season→