CyberWire Daily N2K Networks

Europol and partners shut down 13 terrorist websites.  A data breach at the LA County Department of Public Health affects over two hundred thousand. The Take It Down act targets deepfake porn. The Five Eyes alliance update their strategies to protect critical infrastructure. VMware has disclosed two critical-rated vulnerabilities in vCenter Server. The alleged heads of the "Empire Market" dark web marketplace are charged in Chicago federal court. A new malware campaign tricks users into running malicious PowerShell “fixes.”Researchers thwart Memory Tagging Extensions in Arm chips. A major e-learning platform discloses a breach. On our Industry Voices segment, we are joined by Guy Guzner, CEO and Co-Founder of Savvy to discuss "Reimagining app and identity security for SaaS." Clearview AI offers plaintiffs a piece of the pie. 
Our 2024 N2K CyberWire Audience Survey is underway, make your voice heard and get in the running for a $100 Amazon gift card. Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
On our Industry Voices segment, we are joined by Guy Guzner, CEO and Co-Founder of Savvy to discuss "Reimagining app and identity security for SaaS."

Selected Reading
Europol Taken Down 13 Websites Linked to Terrorist Operations (GB Hackers)
Los Angeles Public Health Department Discloses Large Data Breach (Infosecurity Magazine)
New AI deepfake porn bill would require big tech to police and remove images (CNBC)
Five Eyes' Critical 5 nations focus on adapting to evolving cyber threats to boost critical infrastructure security, resilience (Industrial Cyber)
VMware by Broadcom warns of critical vCenter flaws (The Register)
Empire Market owners charged for enabling $430M in dark web transactions (Bleeping Computer)
From Clipboard to Compromise: A PowerShell Self-Pwn (Proofpoint US)
Arm Memory Tag Extensions broken by speculative execution (The Register)
Star ed-tech company discloses data breach (Cybernews)
Clearview AI Is So Broke It’s Now Offering Lawsuits Plaintiffs A Cut Of Its Extremely Dubious Future Fortunes (Techdirt)

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Introducing The Future of Technology and Manufacturing from Technically Speaking: An Intel Podcast.
Follow the show: Technically Speaking: An Intel Podcast
The manufacturing process is a carefully orchestrated system where each step is as important as the next. But oftentimes there is limited real-time inspection of parts, and defects are detected too late or missed. Enter Eigen Innovations, the Intel-supported AI system that allows workers to be more efficient and helps manufacturers avoid losing money on returns and recalls of defective products. In this episode, Eigen executive Jon Weiss discusses what’s next at the intersection of manufacturing and technology, including the crucial role Intel will play in an essential industry that drives the global economy.

Learn more about how Intel is leading the charge in the AI Revolution at intel.com/AIeverywhere
See omnystudio.com/listener for privacy information.
DISCLAIMER: Please note, this is an independent podcast episode not affiliated with, endorsed by, or produced in conjunction with the host podcast feed or any of its media entities. The views and opinions expressed in this episode are solely those of the creators and guests. For any concerns, please reach out to team@podroll.fm.

Spanish authorities snag a top Scattered Spider hacker. HC3 issues an alert about PHP. WIRED chats with ShinyHunters about the breach affecting Snowflake customers. Meta delays LLM training over European privacy concerns. D-Link urges customers to upgrade routers against a factory installed backdoor. A new Linux malware uses emojis for command and control. Vermont’s Governor vetoes a groundbreaking privacy bill. California fines Blackbaud millions over a 2020 data breach. Guest Patrick Joyce, Proofpoint's Global Resident CISO, sharing some key challenges, expectations and priorities of chief information security officers (CISOs) worldwide. N2K’s CSO Rick Howard for a preview of his latest CSO Perspectives podcast episode on The Current State of XDR: A Rick-the-Toolman episode.  Be sure to change those virtual locks. 
Our 2024 N2K CyberWire Audience Survey is underway, make your voice heard and get in the running for a $100 Amazon gift card. Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest
Guest Patrick Joyce, Proofpoint's Global Resident CISO, sharing some key challenges, expectations and priorities of chief information security officers (CISOs) worldwide. You can learn more from their 2024 Voice of the CISO report. 

CSO Perspectives 
Dave is joined by N2K’s CSO Rick Howard for a preview of his latest CSO Perspectives podcast episode on The Current State of XDR: A Rick-the-Toolman episode. You can find the accompanying essay here. If you are not an N2K CyberWire Pro subscriber, you can catch the first half of the episode as a preview here. 

Selected Reading
Alleged Scattered Spider ringleader taken down in Spain after law enforcement crackdown (ITPro)
US HC3 issues alert on critical PHP vulnerability impacting healthcare sector (Industrial Cyber)
Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake (WIRED)
Meta Pauses European GenAI Development Over Privacy Concerns (Infosecurity Magazine)
Hidden Backdoor in D-Link Routers Let Attacker Login as Admin (GB Hackers)
New Linux malware is controlled through emojis sent from Discord (Bleeping Computer)
Vermont governor rejects state’s tough data privacy bill (The Record)
Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (The Record)
Former IT employee gets 2.5 years for wiping 180 virtual servers (Bleeping Computer) 

Share your feedback.
We want to ensure that you are getting the most out of the podcast. Please take a few minutes to share your thoughts with us by completing our brief listener survey as we continually work to improve the show. 

Want to hear your company in the show?
You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Rick Howard, The CSO, Chief Analyst, and Senior Fellow at N2K Cyber, discusses the current state of “eXtended Detection and Response” (XDR) with CyberWire Hash Table guests Rick Doten, Centene’s VP of Security, and Milad Aslaner, Sentinel One’s XDR Product Manager.
References:
Alexandra Aguiar, 2023. Key Trends from the 2023 Hype Cycle for Security Operations [Gartner Hype Cycle Chart]. Noetic Cyber.
Daniel Suarez, 2006. Daemon [Book]. Goodreads.
Dave Crocker, 2020. Who Invented Email, Email History, How Email Was Invented [Websote]. LivingInternet.
Eric Hutchins, Michael Cloppert, Rohan Amin, 2010, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains [Paper] Lockheed Martin Corporation.
Jon Ramsey, Mark Ryland, 2022. AWS co-announces release of the Open Cybersecurity Schema Framework (OCSF) project [Press Release]. Amazon Web Services.
Nir Zuk, 2018. Palo Alto Networks Ignite USA ’18 Keynote [Presentation]. YouTube.
Raffael Marty, 2021. A Log Management History Lesson – From syslogd(8) to XDR [Youtube Video]. YouTube.
Raffael Marty, 2021. A history lesson on security logging, from syslogd to XDR [Essay]. VentureBeat.
Rick Howard, 2020. Daemon [Podcast]. Word Notes.
Rick Howard, 2021. XDR: from the Rick the Toolman Series. [Podcast and Essay]. CSO Perspectives, The CyberWire.
Rick Howard, 2023. Cybersecurity First Principles: A Reboot of Strategy and Tactics [Book]. Goodreads.
Staff, n.d. Open Cybersecurity Schema Framework [Standard]. GitHub.
Staff, 2019. What is EDR? Endpoint Detection & Response Defined [Explainer]. CrowdStrike.
Staff, 2020. Log Formats – a (Mostly) Complete Guide [Explainer]. Graylog.
Stephen Watts, 2023. Common Event Format (CEF): An Introduction [Explainer]. Splunk.
Thomas Lintemuth, Peter Firstbrook, Ayelet Heyman, Craig Lawson, Jeremy D’Hoinne, 2023. Market Guide for Extended Detection and Response [Essay]. Gartner.
Learn more about your ad choices. Visit megaphone.fm/adchoices

Senior VP of Cyber Operations at KnowBe4, Rosa Smothers, talks about her career as an early cybersecurity professional in what she describes as the Wild, Wild West to her path through government intelligence work. Rosa shares how she always knew she wanted to be involved with computers and how being a big Star Trek nerd and fan particularly of Spock and Uhura helped shape her direction. Following 9/11, Rosa wanted to work for the government and pursue the bad guys and she did just that completing her bachelor's degree and starting in the Defense Intelligence Agency as a cyber threat analyst focusing on extremist groups. She joined the CIA and worked on things you see in the movies, things that are science fictionesque. Rosa recommends talking with people to get your feet wet to find your passion. We thank Rosa for sharing her story with us.
Learn more about your ad choices. Visit megaphone.fm/adchoices

This week, we are joined by a Security Researcher from SpyCloud Labs, James, who is discussing their work on "Unpacking Infostealer Malware: What we’ve learned from reverse engineering LummaC2 and Atomic macOS Stealer." Infostealer malware has become highly prevalent, with SpyCloud tracking over 50 families and finding that 1 in 5 digital identities are at risk.
This research analyzes the workings and intentions behind infostealers like LummaC2 and Atomic macOS Stealer, focusing on the types of data extracted and the broader security implications.
The research can be found here:

Reversing LummaC2 4.0: Updates, Bug Fixes

Reversing Atomic macOS Stealer: Binaries, Backdoors & Browser Theft

How the Threat Actors at SpaxMedia Distribute Malware Globally


Learn more about your ad choices. Visit megaphone.fm/adchoices