CyberWire Daily

In today's podcast we hear about Yingmob's HummingBad Android malware, what it's up to and where it might be headed. We also learn about Eleanor, a Mac OS-X backdoor masquerading as a document conversion app, and we hear about the shifting form of the pseudo-DarkLeech ransomware campaign. The ThinkPwn zero-day may have a wider scope than originally thought. Observers wonder whether ISIS may be ove...

In today's podcast we look at ISIS's shifting tactics in cyberspace, and the civilized world's response to them. OurMine continues to market its "services" by compromising celebrity accounts through recycled credentials. Two new ransomware varieties--"Satana" and "Zepto"--make their appearance, and researchers track (without attribution) the spoor of MNKit and SBDH malware. A researcher releases,...

In today's podcast we discuss Internet-of-things threats, not only botnets assembled from compromised security cameras, but also medical device hacking (with Conficker) as a way of stealing patient information. More insurance sector breaches appear to be in progress, too. The Sprashivai social network is compromised. The Infy espionage infrastructure is taken down (but may return—they often do). N...

In today's podcast we hear about DarkOverlord and the data he's selling online. Guccifer 2.0 returns to blogging, and says he's not working for the Russians, but CrowdStrike, ThreatConnect, and SecureWorks present evidence to suggest otherwise. Thompson-Reuters says it's contained the World-Check database leak. Oculus' Twitter account is briefly hijacked (now restored to company control). Point-of...

In today's podcast, we note that in the wake of the ISIS bombings in Istanbul, security services around the world are looking for online intelligence that might help prevent future terror attacks. Another wave of SWIFT fraud appears to have hit--this time the victims are banks in Ukraine and Russia. Ransomware updates (including the unwelcome return of Locky), notes on smishing, and a review of so...

In today's podcast we get an update on the Russian threat group that hit the DNC. A hacker claims to have nine million health insurance records for sale on the dark web. Too many medical devices are vulnerable to Windows 7 and XP exploits. What scared the Nuclear exploit kit's operators. The IRS takes down its e-filing PIN system, and OPM acknowledges its breach affected tens of millions more than...

In today's podcast we offer a quick survey of the vast and spreading Ransomware landscape. (And talk about some other bits of cybercrime as well, but if Willie Sutton were alive today, and had an Internet connection, he'd be into ransomware.) Brexit's implications remain under study and speculation, but many see a shift in the tech startup scene in the general direction of Berlin. Most observers h...

In today's podcast we discuss the implications of Brexit, and we talk with someone whose researchers predicted it from social media analytics. GhostSquad strikes, apparently, for ISIS, and LizardSquad DDoSes Overwatch for the lulz. Some old threats come back (some never really left). US Cyber Command is operational against ISIS. The importance of low-power WAN for the IoT. State Department email i...

In today's podcast we hear that Brexit's trending in Twitter as British voters go to the polls—the results will have interesting implications for security and the security industry. Tech support scammers put down their phones and pick-up their pop-ups. Some mixed news on ransomware. Markus Rauschecker from the Center for Health and Homeland Security mulls laws of war for cyberspace. ZScaler's Deep...

In today's podcast we talk about Android malware loose in the wild, crimeware-as-a-service (both ransomware and banking Trojans). We hear about the growing consensus that Russian intelligence services were responsible for the DNC hack, and we note the latest report: those services also seem to have pwned the Clinton Foundation. Critical infrastructure jitters persist. Analysts look at cyber insura...

In today's podcast we hear about trends in cyber espionage and ransomware. We also learn more about the DNC hack, which looks more like a Russian operation (and Guccifer 2.0 goes a little bit public and looks a lot less plausible as a lone hacktivist). XDedic looks bigger (but may be out of its stolen server-time business). GSA has a new cyber SIN, and the US Secret Service wants cyber triage tool...

In today's podcast we review the bidding over responsibility for the DNC hack—most observers still think signs point toward Moscow. Wikileaks promises more DNC documents to come. Suspicions revive that the Cyber Caliphate may be a false-flag operation and other notes on the difficulty of attribution. Dridex may be present in some SWIFT-related bank fraud. Angler seems gone for good (but replaced b...

In today's podcast we continue to follow the developing story of the Democratic National Committee hack (Russia denies responsibility, but CrowdStrike stands by its attribution). DNC chair Wasserman Schultz says no financial information was lost, and on cue Guccifer 2.0 produces some. The FBI continues its probe of possible ISIS connections to the Orlando killings. Researchers describe an approach...

In today's podcast we look at developments in the Panama Papers case. A "lone hacker" going by "Guccifer 2.0" claims the DNC hack, but CrowdStrike stands by its attribution to Russian intelligence. Investigators look at Orlando shooter Mateen's online history. Anonymous hits ISIS in cyberspace, and so does US JTF-Ares. xDedic is the latest black market: it deals in server access. Telegram denies b...

In today's podcast, we follow up on Russian intelligence services' hacks of the US Democratic National Committee, and their connection with other cyber espionage campaigns. We hear about more Chinese government industrial spying. ISIS claims to the Orlando shooter as one of its own as the civilized world continues to grope toward an understanding of ISIS information operations. More breaches add m...

In today's podcast, we talk about the breaking news concerning Russia's hack of the DNC, with insights from STEALTHbits Technologies' Adam Laub. We discuss the state of the investigation into what, if any, role online inspiration played in the Orlando gunman's massacre. North Korea appears to have engaged in a long-running campaign of cyber espionage against the South. The Molerats' failure to cle...

In today's podcast we recap what's known publicly about ISIS inspiration of the apparent jihadist massacre at an Orlando gay club, and consider speculation about ISIS's and its rivals' information operations as ISIS loses territory on the ground. Social media security concerns persist, ransomware's criminal market sees some ups and downs, and we learn about encryption keys from Quintessence Labs....

In today's podcast we hear from the experts on how old data breaches can cross-contaminate users' other accounts. Point-of-sale problems seem ready to grow in the recent Wendy's incident. Ransomware's shifting landscape sees Locky's distribution botnet vanish (for unclear reasons), Crysis replace TeslaCrypt, and CryptXXX jump exploit kits. Some startups get some nice VC rounds. We hear about the l...

In today's podcast we follow the latest news and trends with respect to ransomware, now the hottest commodity on the black market, and still able to fetch between $15,000 and $20,000 an extortion. Twitter credentials join VK's in the criminal souk; both sets may have been harvested via earlier breaches in other social media sites. NATO looks into cyber collaboration, workforce development, innovat...

In today's podcast we hear about trends in phishing, ransomware, and distributed denial-of-service—and none of those trends are particularly good. We hear why some ransomware may keep coming back after it's been removed. US bank regulators warn financial institutions to mind their security manners in the wake of the SWIFT-related fraudulent transfers, and investigation into the Bangladesh Bank hac...

In today's podcast we discuss another in the long-running series of big social media breaches, this one in VK. Password re-users are advised to change not only their credentials, but their ways. Vulnerabilities are reported in Facebook features, and in Ubee VoIP routers. Dale Drew from Level 3 Communications explains that cyber attack traffic in Latin America is up. Raytheon's Dave Amsler shares t...

In today's podcast we follow developments in the SWIFT-related Bangladesh Bank fraud case—more observers buy into the view that North Korea was involved. Many see anti-racketeering measures being adapted to cyberspace, with businesses improving their security by reducing their attackers' return-on-investment. Pakistani hackers spearphish Indian civil servants and install espionage backdoors. Anti-...

In today's podcast we review some notes on alleged North Korean involvement in fraudulent SWIFT transfers, and on new US sanctions. We take a look at various corners of the cyber criminal underground, including commodification of both malware and stolen data. Big claims for artificial intelligence are going to involve some big litigation, too. And we hear, again, about the vulnerability of data-at...

In today's podcast we hear about online censorship in China, and an espionage campaign directed against Taiwan. RiskIQ finds that many large companies are riding for the same fall Mossac Fonseca took with the Panama Papers. We talk to Trustwave about that alleged Windows zero-day being sold by cyber criminals, and we hear about some smaller potatoes in the ransomware market. Industry news highligh...

In today's Podcast, we hear about Citizen Lab's discovery of an apparent cyber espionage campaign operating under journalistic cover (and targeting journalists). We discuss the state of the black market for both zero-days and stolen data, and get some recommendations for identity protection from the experts. Venafi talks about the implications of the coming SHA-1 expiration, Joe Carrigan from John...