Daily Drop (611): Phasa-35: Pseudo-Satellite, DPRK APT: Spanish Aerospace, RU: Taliban, Myanmar: UAS, FTX, APT34 Targets Saudi Arabia, China: Latin America, FBI: Energy Sector, Data Centers: Atomic

09-30-23

Saturday, Sep 30, 2023 // (IG): BB // Financial Enabler PODCAST // Coffee for Bob

BAE Systems' Phasa-35: The Future of Pseudo-Satellites

Bottom Line Up Front (BLUF): BAE Systems has successfully tested its new spy aircraft, the Persistent High Altitude Solar Aircraft (Phasa-35). This lightweight, solar-powered aircraft is designed to fly at high altitudes for extended periods, functioning similarly to a pseudo-satellite. Its capabilities could offer an alternative to traditional satellites, providing persistent and cost-effective imagery and communications.

Analyst Comments: The successful testing of the Phasa-35 highlights the potential of high-altitude, solar-powered aircraft to serve as alternatives to traditional geostationary satellites. The ability of such aircraft to remain airborne for extended periods offers both military and commercial sectors a cost-effective solution for persistent surveillance and communication. As technology advances, the integration of pseudo-satellites like the Phasa-35 could revolutionize the fields of surveillance, communication, and data collection.

FROM THE MEDIA: BAE Systems announced the completion of a significant test for its new spy aircraft, the Phasa-35. This aircraft, developed by BAE Systems’ subsidiary Prismatic Ltd., is designed to operate at high altitudes for extended durations. Powered by small electric engines and equipped with long solar-panel wings, the Phasa-35 can remain airborne for weeks or even months. The aircraft's design, with a wingspan of 115 feet and a weight of just 331 pounds, allows it to reach altitudes of 66,000 feet, approximately twice the cruising altitude of commercial aircraft. The Phasa-35's test flight took place in July 2023 at a US military range in New Mexico. Military strategists in both the US and UK are exploring the potential of High Altitude Pseudo-Satellites (HAPS) like the Phasa-35 as alternatives to traditional satellites. These aircraft can carry compact sensors or cameras, enabling them to monitor specific areas for extended periods.

READ THE STORY:  IE

Lazarus Group Strikes Again: Spanish Aerospace Firm Breached

Bottom Line Up Front (BLUF): Hackers linked to North Korea's Lazarus Group targeted a Spanish aerospace company using a sophisticated spear-phishing campaign. Posing as a recruiter from Meta on LinkedIn, the attackers tricked employees into downloading malicious files, leading to a breach of the company's network.

Analyst Comments: The Lazarus Group's recent attack underscores the evolving and sophisticated tactics employed by nation-state actors in cyber espionage. The use of social engineering, particularly through professional networks like LinkedIn, highlights the need for heightened awareness and training among employees across sectors. The introduction of the advanced LightlessCan malware indicates that the Lazarus Group continues to innovate and refine its tools, posing a significant threat to global organizations. Given the strategic importance of aerospace companies and the potential intelligence they hold, it's likely that such targeted attacks will persist.

FROM THE MEDIA: The North Korea-affiliated Lazarus Group has been identified as the perpetrator behind a cyber-espionage attack on an unnamed aerospace company in Spain. The attack was discovered by researchers at the security company ESET. The modus operandi involved reaching out to employees of the targeted company on LinkedIn, and impersonating a recruiter from Meta. The employees were deceived into opening malicious files disguised as coding challenges or quizzes. Once these files were opened, they installed a backdoor on the victim's device, granting the hacker’s espionage capabilities. The malware used in this attack, named LightlessCan, is noted for its sophistication and represents a significant evolution from its predecessor, BlindingCan.

READ THE STORY:  The Record // THN

A Glimpse into the Technological Frontlines of Myanmar's Resistance

Bottom Line Up Front (BLUF): A young engineer, pseudonymously known as "3D", is leveraging 3D printing technology to produce weapons, primarily drones, for Myanmar's rebels fighting against the military dictatorship. These drones, inspired by similar efforts in Ukraine, are seen as a countermeasure to the military's aerial dominance.

Analyst Comments: The integration of 3D printing in Myanmar's resistance movement underscores the transformative role of technology in modern warfare. While the drones offer a glimmer of hope for the rebels, their effectiveness remains to be proven on a larger scale. The situation also raises concerns about the accessibility and potential misuse of 3D printing technology in conflict zones worldwide.

FROM THE MEDIA: Since the military coup in February 2021, Myanmar has witnessed intensified civil conflicts. In response to the military's brutal crackdowns, "3D" joined the Karenni Nationalities Defence Force (KNDF) and began using his 3D printer to create weapons for the resistance. Initially producing 3D-printed rifles, he shifted focus to drones after recognizing the plastic firearms' limitations on the battlefield. His drone, the Liberator-MK1, can carry explosives and is seen as a potential game-changer in the asymmetrical warfare the rebels are engaged in. However, technical challenges and the risk of detection by the military remain significant hurdles.

READ THE STORY:  Wired

FBI Alerts Energy Sector of Heightened Cyber Threats from China and Russia

Bottom Line Up Front (BLUF): The FBI has alerted the energy industry about an anticipated increase in cyber targeting by Chinese and Russian hackers due to global changes in energy supply chains. These changes, including the rise in U.S. exports of liquefied natural gas (LNG) and shifts favoring the U.S. in the global crude oil supply chain, make U.S. energy infrastructure more attractive for foreign cyber intrusions.

Analyst Comments: The FBI's warning serves as a stark reminder of the evolving cyber threat landscape, especially in sectors crucial to national security and the economy. As global energy dynamics shift, the U.S. energy sector becomes an even more attractive target for state-sponsored hackers. It's imperative for energy companies to bolster their cybersecurity measures, stay updated on threat intelligence, and collaborate with government agencies to mitigate these evolving threats.

FROM THE MEDIA: The FBI's recent notification to the energy sector underscores the potential cyber threats posed by Chinese and Russian hackers in light of global energy supply changes. Key factors driving this increased threat include the U.S.'s growing role in LNG exports, changes in the global crude oil supply chain, Western pressures on Russia's energy supply, and China's dependence on oil imports. While the alert does not specify any particular advanced persistent threat (APT) groups or specific incidents, it emphasizes the continuous efforts by Chinese and Russian hackers to probe U.S. systems and exploit vulnerabilities. Brian Harrell, a former DHS official, highlighted that utilities face daily low-level intrusion attempts from both nations. These intrusions help adversaries understand system intricacies and enhance their attack capabilities. The FBI's warning also points out that since 2020, state-sponsored Chinese hackers have targeted U.S. networks to steal intellectual property and gain access to critical infrastructure.

READ THE STORY:  The Record

Russia's Diplomatic Dance with the Taliban: A Bid for Influence in Afghanistan

Bottom Line Up Front (BLUF): Russia is actively engaging with the Taliban, hosting talks focused on regional threats and the creation of an inclusive government in Afghanistan. This move underscores Moscow's intent to maintain its influence in Central Asia, even as it confronts the West in other regions, notably Ukraine.

Analyst Comments: Russia's active engagement with the Taliban indicates a strategic move to solidify its influence in Central Asia, especially in the wake of perceived Western failures in the region. Moscow's willingness to host and negotiate with the Taliban, despite not officially recognizing them, showcases its pragmatic approach to foreign policy. The situation also highlights the complex geopolitical landscape in Central Asia, with major powers like Russia seeking to fill the vacuum left by the U.S. and NATO's withdrawal. The long-term implications of these engagements remain uncertain, but they undoubtedly shape the future dynamics of the region.

FROM THE MEDIA: Russian officials announced their commitment to continue assisting Afghanistan both independently and through the U.N. World Food Program. The recent talks, held in the Russian city of Kazan, involved Taliban representatives and centered on regional threats and the establishment of an inclusive Afghan government. Russian Foreign Minister Sergey Lavrov criticized Western nations for their "complete failure" in Afghanistan, urging them to take primary responsibility for the country's reconstruction. Since their takeover in August 2021, the Taliban have reimposed strict interpretations of Islamic law, leading to international hesitancy in recognizing them as Afghanistan's legitimate rulers. The U.N. has stated that recognition of the Taliban is unlikely given their severe restrictions on women and girls. Despite this, Russia has been actively engaging with the Taliban since 2017, emphasizing the importance of an inclusive government and a positive human rights record for international recognition.

READ THE STORY:  NBC NEWS

FBI Highlights Surge in Dual Ransomware Attacks on U.S. Firms

Bottom Line Up Front (BLUF): The FBI has issued a warning about a rising trend where U.S. companies are targeted by two different ransomware attacks in quick succession. This tactic, observed since July 2023, involves deploying two distinct ransomware variants on the same victim, amplifying the potential damage and complicating recovery efforts.

Analyst Comments: The emergence of dual ransomware attacks underscores the evolving sophistication of cybercriminal tactics. By deploying multiple ransomware variants on the same target, attackers can maximize disruption and increase the likelihood of ransom payment. Organizations must remain vigilant and proactive in their cybersecurity measures, continuously updating and refining their defenses to counter such advanced threats.

FROM THE MEDIA: The U.S. Federal Bureau of Investigation (FBI) has alerted businesses to a new trend where cyber criminals deploy two different ransomware variants against the same victim, sometimes within a span of 48 hours to 10 days. The variants identified include AvosLocker, Diamond, Hive, Karakurt, LockBit, Quantum, and Royal. This dual attack strategy results in a combination of data encryption, exfiltration, and financial losses due to ransom payments. The second attack on an already compromised system can cause significant harm to the victim entities. While dual ransomware attacks have been observed as early as May 2021, the recent surge is notable. Factors contributing to this shift include the exploitation of zero-day vulnerabilities and the rise of initial access brokers in the ransomware ecosystem. Organizations are urged to bolster their defenses, maintain offline backups, monitor remote connections, enforce multi-factor authentication, and segment networks to mitigate the spread of ransomware.

READ THE STORY:  THN

The Rise, Fall, and Potential Rebirth of FTX

Bottom Line Up Front (BLUF): Amidst the impending trial of Sam Bankman-Fried (SBF), founder of the collapsed crypto exchange FTX, a group of creditors is considering the possibility of relaunching the platform without its controversial figurehead. Despite the challenges, there's a belief that the exchange, which once boasted a $32 billion valuation, still holds potential value.

Analyst Comments: The story of FTX and Sam Bankman-Fried is a testament to the volatile nature of the crypto industry and the challenges of navigating its regulatory and reputational minefields. The FTX 2.0 Coalition's efforts to revive the exchange highlight the enduring belief in the platform's potential, even in the face of significant adversity. Whether or not FTX can be successfully relaunched remains to be seen, but the endeavor underscores the resilience and adaptability of the crypto community.

FROM THE MEDIA: Sam Bankman-Fried, the founder of the FTX crypto exchange, is set to face trial in New York on charges of conspiracy and fraud related to the platform's downfall. The exchange's bankruptcy has left numerous creditors, including Pat Rabbitte, in limbo, with their funds tied up in the legal proceedings. Before its collapse, FTX, under SBF's leadership, achieved a staggering $32 billion valuation in just three years. Bankman-Fried was often compared to financial giants like Warren Buffet and was dubbed the "Michael Jordan of crypto." However, the exchange's downfall and subsequent allegations have severely tarnished his reputation. In the aftermath, a group of FTX creditors, naming themselves the FTX 2.0 Coalition, began discussions on Telegram about the potential of restarting the exchange without SBF's involvement.

READ THE STORY:  Wired

APT34 Targets Saudi Arabia with Advanced Cyber Espionage Tools

Bottom Line Up Front (BLUF): Suspected Iranian hacking group, APT34, has initiated a new cyber espionage operation targeting victims in Saudi Arabia using a newly discovered malware, Menorah. This malware is designed for advanced cyber espionage, with capabilities to upload, execute, and download files on compromised systems.

Analyst Comments: The introduction of the Menorah malware indicates APT34's continuous evolution and commitment to developing sophisticated cyber espionage tools. Their focus on Saudi Arabia, as evidenced by the recent campaign, underscores the geopolitical tensions and cyber warfare landscape in the Middle East. Organizations, especially those in the targeted sectors, should remain vigilant and bolster their cybersecurity measures to counter such advanced threats. Given APT34's history and the capabilities of Menorah, it's likely that the group will continue its espionage activities, refining its tactics and tools in response to cybersecurity defenses.

FROM THE MEDIA: APT34, also known by aliases such as OilRig, Cobalt Gypsy, and Helix Kitten, is believed to be based in Iran and has been active since at least 2014. Historically, their operations have focused on Middle Eastern countries, particularly targeting government organizations and businesses in sectors like finance, energy, and telecommunications. In their latest campaign, which began in August, the group employed phishing emails to infect victims, primarily in Saudi Arabia, with the Menorah malware. This new malware bears similarities to the SideTwist backdoor previously used by APT34 but boasts enhanced features and improved stealth capabilities.

READ THE STORY:  The Record // THN

The AI Revolution in Esports: A Glimpse into the Future of Digital Sports

Bottom Line Up Front (BLUF): The integration of Artificial Intelligence (AI) in gaming is rapidly transforming the esports landscape, making the digital realm feel increasingly lifelike. With esports making its debut as a medal discipline at the Asian Games, the influence of AI and the massive following of esports, especially in China, signal a shift towards a more digital-centric future for sports.

Analyst Comments: The rapid growth and acceptance of esports, coupled with the advancements in AI, are indicators of a changing paradigm in the world of sports. While the mainstream reaction to esports has been mixed, its undeniable popularity, especially among the younger generation, cannot be overlooked. The integration of AI in gaming offers a glimpse into a future where the lines between the digital and real worlds might blur. The potential for AI to revolutionize traditional sports, both for players and spectators, is vast. However, the unchecked growth of AI also brings with it concerns about control, ethics, and unforeseen consequences. As we stand at this crossroads, it's crucial to approach the fusion of AI and sports with caution, ensuring that the human element remains central to the experience.

FROM THE MEDIA: Esports recently marked a significant milestone with its inclusion in the Asian Games in Hangzhou. The event witnessed a massive turnout, with games predominantly centered around combat and base-capturing themes. The success of the event, combined with the advancements in AI, suggests that esports might soon find its place in the 2028 Olympics. AI's role in gaming has been revolutionary, creating a digital environment that is dynamic and responsive. This not only impacts the gaming world but also has implications for traditional sports. The potential for AI to offer a tailored, immersive experience for spectators is immense, and this could reshape how sports are consumed in the future. The recent esports events in Hangzhou, backed by China's significant influence in the domain, indicate a shift towards a future where digital and traditional sports might converge.

READ THE STORY:  The Guardian

US Warns Latin America of China's Cyber Influence

Bottom Line Up Front (BLUF): US Homeland Security Secretary Alejandro Mayorkas has cautioned Latin American leaders about the potential cybersecurity risks associated with accepting Beijing's low-cost technology investments and infrastructure partnerships. The US perceives these investments as potential avenues for China to conduct cyber operations in the region.

Analyst Comments: The US's warning to Latin American leaders underscores the geopolitical tensions and concerns surrounding China's global tech and infrastructure ambitions. As Beijing continues to expand its influence through strategic investments, countries are faced with the challenge of balancing economic benefits with potential security risks. The US's proactive approach to engaging with Latin American nations indicates its commitment to countering China's influence and ensuring the cybersecurity of the region.

FROM THE MEDIA: Speaking at the Western Hemisphere Cyber Conference, Mayorkas expressed concerns over China's increasing influence in Latin America, particularly through its infrastructure projects and technology investments. He emphasized that while the low prices of Chinese technology might seem attractive, they come with long-term cybersecurity risks. The US is particularly wary of the potential for Chinese hardware, such as 5G networks, to be used as conduits for cyberattacks. The Biden administration's apprehensions stem from China's growing cyber capabilities and its interest in Latin American infrastructure. Recent reports from cybersecurity firms have highlighted instances where Chinese hackers targeted sectors related to Chinese infrastructure initiatives, like the Belt and Road Initiative. Mayorkas cited a 2017 cyberattack on Malaysia, likely in response to the country's contemplation of canceling a Chinese-backed project, as a cautionary example for Latin American nations.

READ THE STORY:  CyberScoop

Addressing the Electricity Demands of Modern Data Centers with Atomic Solutions

Bottom Line Up Front (BLUF): The increasing electricity demands of data centers are prompting operators to consider alternative power sources, including small nuclear reactors. However, the feasibility, safety, and practicality of such an approach remain subjects of debate.

Analyst Comments: The exploration of nuclear power as a potential solution for data center electricity demands reflects the industry's ongoing efforts to find sustainable and reliable power sources. As data centers continue to grow and consume more electricity, the need for alternative power solutions becomes more pressing. However, the adoption of nuclear power for data centers will require careful consideration of various factors, from safety to long-term sustainability. The industry will need to weigh the benefits of nuclear power against its challenges to determine its viability as a power source for data centers.

FROM THE MEDIA: The rapid expansion of data centers and their growing electricity consumption have raised concerns about power security among operators. While traditional power sources like the grid, batteries, and generators remain in use, there's a growing interest in exploring nuclear power as a potential solution. Small nuclear reactors are being considered as a possible steady or emergency power source for data centers. However, the idea of using nuclear power brings its own set of challenges, including concerns about the amount of fissile material involved. The Register's team, including data center expert Tobias Mann, security editor Jessica Hardcastle, host Iain Thomson, and government IT reporter Brandon Vigliarolo, delved into the topic, discussing the various aspects of nuclear power for data centers. Key considerations include the cost, safety protocols, design, placement, construction, fuel supply, decommissioning, and overall management of nuclear-powered data centers.

READ THE STORY:   The Register

Israeli Police Granted Use of Pegasus Spyware for Investigations

Bottom Line Up Front (BLUF): In the wake of recent shootings of Palestinian citizens, Israeli officials have permitted the police to utilize the Pegasus spyware for their investigations. This decision comes amid ongoing concerns about the ethical use and potential misuse of such surveillance tools.

Analyst Comments: The decision to reintroduce Pegasus for specific investigations underscores the delicate balance between security needs and privacy concerns. While the tool can offer valuable insights for law enforcement, its potential for overreach and misuse remains a significant concern. The global discourse around Pegasus highlights the broader challenges of regulating powerful surveillance tools in an era where digital privacy is increasingly under threat.

FROM THE MEDIA: Israeli law enforcement has been given the green light to employ the Pegasus spyware, developed by the Israeli company NSO Group, in their probe into the recent shootings of Palestinian citizens. Attorney General Gali Baharav-Miara clarified that while the tool can be used to monitor conversations, data extraction from targeted devices is prohibited. This move follows a 2022 scandal revealing that the police had used the spyware to monitor Israeli citizens, leading to a ban on its use, albeit with certain exceptions. The recent incidents under investigation involve the killing of six Palestinian citizens in two separate events. The police argue that the prohibition on spyware has hampered their crime-fighting capabilities, contributing to a rise in murders within Arab communities. Pegasus, known for its extensive surveillance capabilities, has been at the center of global debates due to its potential misuse against citizens, activists, and journalists. Israel has initiated committees to scrutinize the alleged domestic and global misuse of Pegasus.

READ THE STORY:  The Record

Cybercriminals Adopt ASMCrypt Malware Loader to Evade Detection

Bottom Line Up Front (BLUF): Cybercriminals are leveraging a new crypter and loader named ASMCrypt, an evolution of the previously known loader malware, DoubleFinger. This new tool aims to load malicious payloads without detection from antivirus or endpoint detection and response systems.

Analyst Comments: The continuous evolution of malware and their methods of distribution underscores the dynamic nature of cyber threats. The adoption of new loaders like ASMCrypt highlights the need for robust cybersecurity measures and constant vigilance to detect and counter such threats. The intertwining of different malware families and their distribution methods further complicates the threat landscape, necessitating a multi-faceted approach to cybersecurity.

FROM THE MEDIA: ASMCrypt, once activated, establishes a connection with a backend service via the TOR network using hardcoded credentials. This facilitates the creation of custom payloads for cybercriminal campaigns. The malware cleverly conceals an encrypted blob within a .PNG image file, which is subsequently uploaded to an image hosting platform. This new loader's emergence underscores the increasing popularity of such tools among cyber adversaries. They serve as efficient malware delivery mechanisms, granting initial access to networks for a range of malicious activities, including ransomware attacks and data theft. Furthermore, collaborations between different loader groups have been observed, exemplified by the alliance between GuLoader and Remcos RAT. Another notable mention is the Lumma Stealer, an evolved version of known stealer malware like Arkei and Vidar, which is being distributed via deceptive websites.

READ THE STORY:  THN

Items of interest

State Department Report Highlights Beijing's Global Information Manipulation Efforts

Bottom Line Up Front (BLUF): China is significantly investing in disinformation, surveillance, and censorship strategies to shape global narratives in its favor. The State Department's recent report underscores the extent of these efforts and their implications for international relations.

Analyst Comments: China's aggressive investment in information manipulation strategies underscores its intent to shape global narratives in its favor. While the extent of these efforts is concerning, the resilience shown by democratic countries offers some hope. It's crucial for nations to remain vigilant and counter such disinformation campaigns to ensure a balanced and truthful global discourse.

FROM THE MEDIA: The Chinese government is channeling "unprecedented resources" into a broad spectrum of tactics aimed at manipulating information on the global stage, according to a new report released by the State Department. This surge in investment comes as China becomes more assertive in its international stance, leveraging information manipulation to further its interests. The report, produced by the department's Global Engagement Center, highlights several methods employed by Beijing. These methods, described as "deceptive and coercive," range from spreading false or biased claims to using advanced technology for tracking and suppressing criticism of China's policies or leadership. Specific tactics include the use of automated bot networks to boost posts by Chinese diplomats, state media employees acting as social media influencers, and the acquisition of satellite and telecommunications technologies to monitor and control online information.

READ THE STORY:  CBS NEWS

US: China Wants to Dominate Global Information Environment (Video)

FROM THE MEDIA: New U.S. State Department report highlights China's use of propaganda, disinformation and censorship to manipulate the global information environment.

U.S. accuses China of global media manipulation (Video)

FROM THE MEDIA: Dateline Philippines: China has been accused of manipulating global media and threatening to cause a sharp contraction in freedom of speech around the world.

These open-source products are reviewed by analysts at InfoDom Securities, providing possible context about current media trends related to the realm of cyber security. The stories selected cover a broad array of cyber threats and are intended to aid readers in framing key publicly discussed threats and overall situational awareness. InfoDom Securities does not endorse any third-party claims made in their original material or related links on their sites; the opinions expressed by third parties are theirs alone. For further questions, please contact InfoDom Securities at dominanceinformation@gmail.com.