Author Archives: Chris Bing

Bill would call on White House to develop its own list of APT groups

Posted on by

A bill that passed the House Foreign Affairs Committee Tuesday calls on the White House to develop a publicly available list of advanced persistent threat groups named by the U.S. government. In broad strokes, the bill — the “Cyber Deterrence and Response Act of 2018‘ — seeks to establish a cyber deterrence strategy for which the government can act on after the country’s been attacked by foreign hackers. The bill was introduced by Rep. Ted Yoho, R-Fla. Included in the bill are various policy changes and new controls on how the executive branch can increase costs on adversaries if they target U.S. companies or government agencies in cyberspace. Among its many recommendations, the bill calls for a comprehensive and uniform list of foreign hacking groups, so that there’s at least common terminology across government when discussing certain cyberthreats. Such a list would be the first of its kind. Housed within the Federal Register, […]

The post Bill would call on White House to develop its own list of APT groups appeared first on Cyberscoop.

Continue reading Bill would call on White House to develop its own list of APT groups→

As the military’s cyber units change guard, a battle over control rages on

Posted on by

During a time of rapid change for the U.S. military’s top cyberwarfare teams, the current version of the 2019 defense bill is challenging the president’s ability to exert his authority with regards to those units. The White House is protesting a series of measures in the newly Senate-approved 2019 National Defense Authorization Act that seek to legislate how and when President Donald Trump can direct generals to launch cyberattacks. That effort comes while the U.S. Air Force, Navy, Army and Marines welcome new leaders to take charge of their respective cyber forces. Hanging in the balance is how the U.S. operates in cyberspace, which most developed countries now define the fifth domain of warfare, adding to land, air, sea and space. Amendments introduced in the NDAA would require the executive branch to develop and adhere to a cyberwarfare strategy document that draws lines around what types of malicious foreign activity should result in […]

The post As the military’s cyber units change guard, a battle over control rages on appeared first on Cyberscoop.

Continue reading As the military’s cyber units change guard, a battle over control rages on→

Lawmakers demand answers in wake of strange OPM identity fraud lawsuit

Posted on by

With mystery swirling around an identity theft case where prosecutors have claimed the perpetrators used personal information included in the Office of Personnel Management breach, two lawmakers are pushing the government for more information. A pair of letters sent this week by Sen. Mark Warner, D-Va., and Rep. Gerry Connolly, D-Va., to the heads of the Department of Justice and OPM issues a number of questions about the alleged identity fraud charges. The Virginia lawmakers are especially interested in learning how the defendants acquired the data. On June 18, the Eastern District of Virginia announced that a Maryland woman had pleaded guilty to identity theft charges. That press release initially said the data used in that crime was from the OPM breach. On June 21, the district issued a correction to their press release, stripping any mention of the breach. Virginia is home to the single largest population of federal […]

The post Lawmakers demand answers in wake of strange OPM identity fraud lawsuit appeared first on Cyberscoop.

Continue reading Lawmakers demand answers in wake of strange OPM identity fraud lawsuit→

FireEye denies ‘hack back’ claims detailed in new book

Posted on by

The company that authored a watershed report on how Chinese hackers operate is pushing back against claims in a new book that the research was conducted through the use of illegal offensive hacking techniques. In “The Perfect Weapon: War, Sabotage, and Fear in the Cyber Age,”  New York Times national security correspondent David Sanger writes that the U.S.-based cybersecurity firm Mandiant penetrated a Chinese military cyber unit after it hacked into one of its customer’s systems in order to nail down attribution. According to Sanger, while Mandiant observed Chinese hackers breaching a client several years ago, they used it as an opportunity to target the attackers’ systems, which allowed access to a video camera that exposed the hackers’ faces:  [Then CEO Kevin Mandia] was certain the hackers were part of Unit 61398, but he also knew that accusing the Chinese military directly would constitute a huge step for his company. Over seven years, he […]

The post FireEye denies ‘hack back’ claims detailed in new book appeared first on Cyberscoop.

Continue reading FireEye denies ‘hack back’ claims detailed in new book→

In private briefings, U.S. government raises concerns over Huawei and ZTE

Posted on by

The U.S. government has been quietly warning technology companies about the security risks posed by doing business with Huawei and ZTE, two Chinese telecommunications firms that are closely linked with China’s government. Sen. Marco Rubio, R-Fla., told CyberScoop Thursday at a national security conference that the government is holding classified briefings to warn private companies of the intelligence concerns. He said the companies that have been briefed are aware of the concerns, but are also “prioritizing market access.” “I think it’s important for us to do what we can to warn people about the threat,” Rubio said. “I think some of those companies are aware of [the intelligence concerns], but they make the decision that they’ll worry about that later. They want access to 1.3 billion people.” The news comes as the Trump administration is trying to persuade lawmakers to drop their opposition to a trade deal that would revive ZTE’s access […]

The post In private briefings, U.S. government raises concerns over Huawei and ZTE appeared first on Cyberscoop.

Continue reading In private briefings, U.S. government raises concerns over Huawei and ZTE→

Trump administration picks new leader for Vulnerabilities Equities Process board

Posted on by

The White House has selected a new leader to head a secretive government group that helps decide which software vulnerabilities should be kept for intelligence gathering purposes or widely released to the public. National Security Council (NSC) senior director Grant Schneider has been named chair of the Vulnerability Equities Process (VEP) board, a National Security Council spokesperson told CyberScoop. Schneider is also currently serving as the acting federal chief information security officer. His appointment comes as recent White House cybersecurity coordinator Rob Joyce left 1600 Pennsylvania Avenue in May. He is now serving as a senior adviser at the National Security Agency. Joyce was instrumental in a public charter released last year that brought transparency to the process, by which the U.S. government determines to either withhold or disclose information to tech companies about newly discovered flaws in their software. The charter originally named Joyce as the head of the multi-agency […]

The post Trump administration picks new leader for Vulnerabilities Equities Process board appeared first on Cyberscoop.

Continue reading Trump administration picks new leader for Vulnerabilities Equities Process board→

Senate to review fusion center plan to deter Russian cyberattacks

Posted on by

Members of the Senate Intelligence Committee said Wednesday they would consider plans offered by a Obama administration official to fight back against Russian aggression in cyberspace. Victoria Nuland, a former U.S. ambassador to NATO, told lawmakers that it would be pragmatic for the country to consider a new “fusion center” to deter foreign election meddling similar to what occurred in 2016. The approach Nuland described would look like the counter-terrorism model pursued by the U.S. government in the aftermath of the Sept. 11, 2001 terror attacks. “On the President’s direction and with Congressional support, the Trump Administration could immediately establish a multi-agency Fusion Center, modeled on the National Counter Terrorism Center [(NCTC)] but smaller in size, to pull together all the information and resources of our government to identify, expose and respond to state-sponsored efforts to undermine American democracy through disinformation, cyberattack, and abuse of the internet,” Nuland said. Senior […]

The post Senate to review fusion center plan to deter Russian cyberattacks appeared first on Cyberscoop.

Continue reading Senate to review fusion center plan to deter Russian cyberattacks→

Chinese hacking group resurfaces, targets U.S. satellite companies and systems

Posted on by

A Chinese-linked hacking group began targeting at least two different U.S.-based satellite companies, a Defense Department contractor and another private firm that sells geospatial imaging technology in late 2017, according to new research by Symantec. The focused hacking campaign appears to have been originally launched around the same time as talks about a U.S.-China trade war — which is now in full swing — were heating up late last year. Symantec discovered and notified the U.S. government about the malicious cyber activity roughly four months ago, according to Jon DiMaggio, a senior threat intelligence analysts with Symantec, who led the investigation. Tuesday’s findings show that the attackers, dubbed “Thrip” by analysts, have reemerged after they seemingly went underground for more than two years. The group stopped operations after a historic political agreement in 2015 between then U.S. President Barack Obama and Chinese President Xi Jinping. That agreement sought to deter cyber-enabled […]

The post Chinese hacking group resurfaces, targets U.S. satellite companies and systems appeared first on Cyberscoop.

Continue reading Chinese hacking group resurfaces, targets U.S. satellite companies and systems→

Russian-linked group tied to Winter Olympics attack is now targeting biochemical researchers

Posted on by

A wave of sophisticated spear phishing emails captured by Moscow-based Kaspersky Lab suggests that the same Russian-linked hacking group responsible for a historic cyberattack on the 2018 Winter Olympics is now targeting biochemical research and domestic financial organizations. Dubbed the “Sandworm Group” by security analysts, the attackers gained notoriety earlier this year when a destructive hacking tool aimed at the IT network attached to the Winter Olympics caught the attention of multiple intelligence agencies. That tool, known as “Olympic Destroyer,” allowed for malware to spread within multiple confined IT environments, quickly deleting boot records and other forensic artifacts while also simultaneously siphoning off sensitive user credentials. CyberScoop previously reported that Sandworm had hacked into the 2018 Olympic games primary IT provider, Atos, months before the event began. One related phishing email that uses a booby trapped Microsoft Word document explicitly mentions a biochemical threat research conference held in Switzerland, which is organized by Spiez Laboratory. […]

The post Russian-linked group tied to Winter Olympics attack is now targeting biochemical researchers appeared first on Cyberscoop.

Continue reading Russian-linked group tied to Winter Olympics attack is now targeting biochemical researchers→

Russian-linked group tied to Winter Olympics attack is now targeting biochemical researchers

Posted on by

A wave of sophisticated spear phishing emails captured by Moscow-based Kaspersky Lab suggests that the same Russian-linked hacking group responsible for a historic cyberattack on the 2018 Winter Olympics is now targeting biochemical research and domestic financial organizations. Dubbed the “Sandworm Group” by security analysts, the attackers gained notoriety earlier this year when a destructive hacking tool aimed at the IT network attached to the Winter Olympics caught the attention of multiple intelligence agencies. That tool, known as “Olympic Destroyer,” allowed for malware to spread within multiple confined IT environments, quickly deleting boot records and other forensic artifacts while also simultaneously siphoning off sensitive user credentials. CyberScoop previously reported that Sandworm had hacked into the 2018 Olympic games primary IT provider, Atos, months before the event began. One related phishing email that uses a booby trapped Microsoft Word document explicitly mentions a biochemical threat research conference held in Switzerland, which is organized by Spiez Laboratory. […]

The post Russian-linked group tied to Winter Olympics attack is now targeting biochemical researchers appeared first on Cyberscoop.

Continue reading Russian-linked group tied to Winter Olympics attack is now targeting biochemical researchers→