April 6th, cybers.

China is doing some big stuff in AI and it is making the Google cloud people notice. I don’t know the domain anywhere near enough to have even an uninformed opinion.

Quentin Hardy @qhardy

.@jackclarkSF ’s AI newsletter is not for the faint hearted, but there’s something there all the time.

---

Belarus is a hostile country for the Russian military. There are a lot of ways that cyber could enrich these campaigns as well. It will be interesting to see what develops.

Michael Weiss 🌻🇺🇸🇮🇪 @michaeldweiss

Hilarious. Belarusian moles within the KGB have shared with Ukraine the personal phone numbers of looting Russian soldiers looking to send their stolen wares back to Russia.

motolko.helpHajun Project published the data of Russian marauder soldiers, who may be involved in crimes on the territory of UkraineHajun Project published names, phone numbers and contents of parcels of Russian soldiers.

---

Another dark net market got busted. Hydra this time. It’s always interesting to see how the police located the servers, the operators and the dealers.

Catalin Cimpanu @campuscodi

German officials announce the seizure of the Hydra dark web marketplace bka.de/DE/Presse/List…

---

Some political changes might make the surveillance of cloud computing more transparent.

Elizabeth Goitein @LizaGoitein

Tomorrow the House Judiciary Committee will mark up the NDO Fairness Act, a bipartisan bill from @RepJerryNadler and @RepFitzgerald. The bill takes an important first step toward curing a major problem with how modern surveillance works—but more will be needed. 1/14

Elizabeth Goitein @LizaGoitein

Tomorrow the House Judiciary Committee will mark up the NDO Fairness Act, a bipartisan bill from @RepJerryNadler and @RepFitzgerald. The bill takes an important first step toward curing a major problem with how modern surveillance works—but more will be needed. 1/14

Elizabeth Goitein @LizaGoitein

Today, the government obtains our private information from the third parties that hold our data—internet service providers, cell phone companies, and others. Subpoenas and court orders are served on the companies, not the customers. 3/14

---

UK government released some documents about the cyber capability of the Russian intelligence services.

Gareth Corfield @GazTheJourno

Neat factsheet about Russia's FSB spy agency's hacking capabilities and history, published by MI6's parent govt dept @FCDOGovUK

ncsc.gov.ukWeekly Threat Report 1st April 2022The NCSC’s weekly threat report is drawn from recent open source reporting.

---

Russia is haemorrhaging GRU/SVR cover jobs.

Shashank Joshi @shashj

My rough count of expulsions of Russian officials from the US & Europe since the invasion of Ukraine. Mostly alleged undeclared intelligence officers, but not all. I make that more than 310 from Europe alone—more than double the Skripal total, triple the UK expulsions of 1971.

---

A Ukrainian ISP was compromised via physical coercion of an employee, a tactic more typically associated with bank robberies. The details are left to the imagination, but there’s plenty of circumstantial evidence to support torture and credible death threats.

The insider threat vector is maturing. More outsourcing of low level support roles; threat actors capable of offering — and paying — large sums of money for access, or malicious services (more on this later);

Kevin Collier @kevincollier

In a Zoom presser earlier today, UKR Telecom CIO Kirill Goncharuk said the hack on his ISP started with compromised credentials from an employee in a territory Russia recently occupied. Declined to address the potential implication that the employee was physically coerced.

---

The non existent cyber war is pretty active.

Raphael Satter @razhael

Why do Russian hackers keep breaking into Ukrainian social media sites and servers to push fake “surrender” news that doesn’t fool anyone? @kateconger’s take, which quotes @bread08 & @VZhora, is worth reading.

nytimes.comHackers’ Fake Claims of Ukrainian Surrender Aren’t Fooling Anyone. So What’s Their Goal?Experts say the hackers’ intentions might not be to actually trick anyone, but to erode confidence in Ukrainian media outlets and institutions.

---

The non existent cyber war has always been pretty active.

Dan Black @DanWBlack

Excited to share this important analysis of Russia’s cyber operations in Ukraine with my boss @DavidCattler. The broad consensus that Russian cyber operations have either been nonexistent or ineffective is simply not true

foreignaffairs.comThe Myth of the Missing CyberwarRussia’s hacking succeeded in Ukraine—and poses a threat elsewhere, too.

---

Cybercom says they’re helping Ukraine.

780th Military Intelligence Brigade (Cyber) @780thC

Cyber Command chief: U.S. has ‘stepped up’ to protect Ukraine’s networks therecord.media/cyber-command-… @TheRecord_Media

therecord.mediaCyber Command chief: U.S. has ‘stepped up’ to protect Ukraine’s networksU.S. Cyber Command chief Gen. Paul Nakasone said Tuesday that his organization has “stepped up” its efforts to strengthen Ukraine’s networks and cyber defenses against Russian digital attacks since Moscow began its invasion in February.

---

Hints of early counter cyber operations to degrade the capacity of the Russian cyber forces.

Sean Lyngaas @snlyngaas

NEW -- > AG Merrick Garland says that Justice Department has disrupted GRU-controlled botnet that had infected thousands of devices "The Russian government has recently used similar infrastructure to attack Ukrainian targets," Garland said in prepared remarks ... More to come

HostileSpectrum @HostileSpectrum

DOJ acknowledgement in filings unsealed today of technical CCO against CYCLOPS BLINK is an important piece of the puzzle of Russian cyber ops concurrent to Ukraine conflict. GRU attributed capability was lost just as it was needed most by adversary. What else remains unknown?

HostileSpectrum @HostileSpectrum

USG and Allies poke a sharp stick into the eye of SANDWORM / VOODOO BEAR's new CYCLOPS BLINK. Bravo Zulu. https://t.co/KR4bsfP3HR https://t.co/WRfz830MP4

NSA Cyber @NSACyber

New #malware, Cyclops Blink, is detailed in the @NCSC, @FBI, @CISAgov, and @NSAGov advisory. Use the guidance to patch devices to be free of it.

ncsc.gov.ukNew Sandworm malware Cyclops Blink replaces VPNFilterJoint advisory published by the UK and US identifies a new malware known as Cyclops Blink that could be used to remotely access networks.

---

Good news. Tanks now safe against cyber. In related news, tanks are vulnerable to cyber??

Lukasz Olejnik @lukOlejnik

Tanks are vulnerable to cyberattacks. Imagine this. "U.S. Army’s Ground Vehicle Systems Center announced a successful demonstration of a new system designed to defend ground vehicles against cyber attacks" dvidshub.net/news/413996/gv…