Sponsored by Spectra Group
———————————————————————————————————————————————————————————————————————————————————————————————————————————————-
05 Sept 24. DOD Official Says Partnerships Are Key to U.S. Cyber Strategy. Partnerships are critical to the Defense Department’s proactive cyber defense strategy, a senior official said yesterday.
Army Lt. Gen. William J. Hartman, deputy director of U.S. Cyber Command, said DOD’s ability to synchronize across agencies and with a range of foreign partners provides the U.S. with an asymmetric advantage in defending against a range of adversaries.
Hartman said Cybercom remains focused on aligning with geographic combatant commanders and government partners to support regional cybersecurity strategies.
Cybercom has also maintained close ties with key foreign partners using small team deployments throughout the globe. The teams aim to carry out defense operations, and Hartman said the demand for these deployments continues to grow.
“When you have smart young Americans that are working with a smart young foreign partner, nothing demonstrates more that the United States cares about cybersecurity,” Hartman said during a panel discussion at the Billington Cybersecurity Summit in Washington.
The Cybercom deputy director added that the demand for these engagements will likely not dissipate soon, and DOD’s ability to leverage technology and partnerships to continue to scale global engagements will be critical.
“Our adversaries have to know that we’re serious and that the ecosystem that they require in order to execute operations is not safe,” he said. “We’re going to work with allies and partners, and we’re going to do everything we can to get after them. We are most effective when we do that across the government and private industry.” (Source: U.S. DoD)
04 Sept 24. Murmurs of Murmansk. A deployed GT-01 Murmansk-BN system is seen here with all four of its jamming antennas. The Russian military is believed to use the system to target US and allied high frequency radios and networks. Recent reports state that an unknown number of Murmansk-BN systems have been acquired by Iran.
The Islamic Republic of Iran has received GT-01 Murmansk-BN communications jamming systems from Russia.
Media reports in early August disclosed that Russia has delivered its GT-01 Murmansk-BN Communications Jamming (COMJAM) system to Iran. The reports did not disclosed how many systems have been acquired although another article did hint that several have been delivered. These Murmansk-BN systems are not the first Russian Electronic Warfare (EW) capabilities acquired by Iran. As Armada has reported, Iran’s Cobra-V8 is thought to be a local version of Russia’s 1RL257E Krasukha-4 electronic warfare system. We have also disclosed that Iran has acquired Russia’s IL222M Avtobaza-M EW platform.
Murmansk-BN
Official Russian language documents seen by Armada, and sources close to the Russian EW industry, have provided indications of the Murmansk-BN’s capabilities. The system is mobile and housed on six trucks. Four trucks each accommodate one of the system’s 32-metre/m (102-feet/ft) high antennas. The antenna trucks are typically spaced across a 90-degree arc with 35m (114ft) of spacing between each. One truck houses the command post and another the generator which produces 400 kilowatts of power. Targets for the Murmansk-BN include High Frequency (HF: three megahertz/MHz to 30MHz) radios and networks. Emphasis is placed on targeting beyond line-of-sight HF skywave emitters. Effective ranges of between 5,000 kilometres/km (2,699 nautical miles/nm) and 8,000km (4,318nm) have been quoted for the Murmansk-BN.
Targets
The Murmansk-BN entered service with the Russian military in 2016. At least one system is thought to equip each of the Russian Army’s four independent electronic warfare brigades. A single system is likely to furnish the 15th Electronic Warfare Brigade which is directly subordinate to the Russian general staff. Armada has learned that a key target for the Murmansk-BN is the US military’s High Frequency Global Communications System (HFGCS). The HFGCS carries voice traffic across HF links and is a key channel for the carriage of Emergency Action Messages (EAMs). EAMs contain Command and Control (C2) information regarding the US nuclear deterrent. Attacking the HFGCS would be a key target of the Murmansk-BN in periods of high tension and war with the US and North Atlantic Treaty Organisation (NATO). Jamming HFGCS transmissions could help deprive US and NATO nuclear forces of C2 information. HF is also used for NATO and allied Link-11 (two megahertz to 29.9MHz, 225MHz to 399.975MHz) Tactical Datalink (TDL) traffic. Link-11 is a TDL which supports maritime operations.
Iran and Murmansk-BN
It is not surprising that the Iranian military has chosen to acquire the GT-01 Murmansk-BN. Tensions remain high between the Islamic Republic, Israel and the latter’s allies. On 13th April, Iran performed a large, combined missile, rocket and uninhabited aerial vehicle attack against targets in Israel. These attacks were launched from Iran and by Iranian proxies in Iraq, Lebanon and Yemen. A coordinated response by Israeli, US and allied air defences blunted the severity of Iran’s attack which resulted in no fatalities.
The success of the air defence effort was due in part to robust and resilient communications. While the precise details of the networks used have not been revealed, it would not be surprising if they included Link-11. The TDL would have assisted the battle management of the air defence effort. The Iranian military has an interest in degrading Link-11 should it find itself once again crossing swords with Israel and her allies. Meanwhile, Iran’s ongoing clandestine nuclear weapons programme makes the Islamic Republic a potential nuclear target. Any use of these weapons by Iran could bring a response in kind from Israel, the United States and/or their NATO nuclear-armed allies. Blunting the efficiency of the HFGCS is clearly in Iran’s interests.
Degrading US and allied HF networks maybe easier said than done. The US nuclear deterrent uses several communications links for EAM traffic. This is done to ensure redundancy so that the degradation or elimination of one network does not stop the flow of Emergency Action Messages. Link-11, and its Link-22 successor which uses the same frequencies, are both secure networks. While Murmansk-BN maybe effective against unsecured HF links, encrypted and secure networks may present challenges. Nonetheless, the recent Murmansk-BN acquisition illustrates that Iran’s appetite for Russian EW materiel shows little sign of abating. (Source: Armada)
05 Sept 24. September Spectrum SitRep. Concurrent Technologies’ new TR MDx/6sd plug-in card has been designed in accordance with SOSA standards and can support capabilities such as multispectral sensing and mission control.
Play your cards right
Concurrent Technologies has launched its new TR MDx/6sd plug-in card which the company says is developed in alignment with SOSA (Sensor Open Systems Architecture) technical standards. A press release announcing the news revealed that the plug-in card “has enhanced features, including a wider operating temperature range, reduced weight, advanced networking capability and secure on-board storage.” The company told Armada in a written statement that the TR MDx/6sd “features a lightweight build and prime performance across thermal range, 40GBASE-KR4 or 100GBASE-KR4 Primary Ethernet Data plane and support for FIPS 140-3.” The statement continued that the new plug-in card can equip “land and airborne platforms that require multispectral sensing and mission control capabilities.”
US Army contract for SIGINT work
CACI International has been awarded a contract worth $416 m to “design, produce and deliver complex, customised radio frequency systems for US Army Signals Intelligence missions,” according to a press release. The news was revealed in early August. According to the press release, the company is to provide software, hardware and expert analysis to this end. The work forms part of the Exploit, Enhance, Enable and Influence Tactical Exploitation of National Capabilities (E3IT) initiative for the army. In addition, the company will help the force address evolving risks through SIGINT data analysis. Armada send CACI International questions concerning the contract, but received no response by the time this article went to press. (Source: Armada)
04 Sept 24. Northrop Grumman, L3Harris lock horns for Polish F-16 EW package. The two American firms are pitching competing electronic warfare platforms that they hope will be part of Warsaw’s planned upgrade from Block 50 configuration F-16s to Block 70. As Poland looks to make significant upgrades to its F-16 fleet, two American firms here are vying to offer their electronic warfare suites as part of the broader package.
While it’s still unclear exactly what Warsaw will require of its upgrade, meant to bring its aircraft from the Block 50 configuration to the more advanced Block 70, Northrop Grumman says it has pitched the AN/ALQ-257 Integrated Viper Electronic Warfare Suite (IVEWS), while L3Harris is offering the AN/ALQ-254(V)1 Viper Shield.
Both companies told Breaking Defense at the MSPO show today that Poland plans on making a selection for a new EW package in the next six months. (Poland’s Ministry of Defense did not immediately respond to an after-hours request for comment.)
IVEWS, the US Air Force’s F-16 EW program of record, uses an ultra wideband architecture designed to detect, identify and counter radio frequency threats. It is also “four times more sensitive and [able to offer] four times wider range than any previous system employed” in the fourth-generation aircraft, said Charles Blanks, fixed wing survivability manager at Northrop Grumman. “That allows detection of all of the new generation and future generation threats that have moved out of the typical electronic spectrum” of the past.
He added that the system “is needed on fourth-generation fighters against near-peer threats out there now, and Poland, more than any other country, knows [those threats] are on the doorstep.”
As it happens, IVEWS was formally cleared today to begin US Air Force F-16 flight testing, after three years of system level and anechoic chamber testing, mainly out of the Joint Preflight Integration of Munitions and Electronic Sensors (J-PRIMES) facility. Blanks claimed that based on those sorts of tests, which also included interference tests, IVEWS was credited with a “98 percent success rate.”
James Ryan, director of business development at L3Harris, said “a lot of different solutions are currently in play, [and] ours [Viper Shield] is the most mature of the group.” He stressed the system is the “only fully funded solution that is currently in production, and we’re looking forward to the selection [decision] from Poland.”
EXCLUSIVE: US giving Poland another $2B to buy American-made weapons
Viper Shield is an all-digital EW suite for the F-16 that, according to L3Harris company literature, offers “enhanced system performance, a smaller form factor, reduced weight and easier future upgrades.”
Ryan said Viper Shield meets all technical requirements set out by Warsaw and has been previously ordered by “multiple” export orders.
At a platform level, Poland has still to define the scope of the F-16 upgrade, but various reports in February said that it is preparing to strike an agreement with the US government. Northrop’s Blanks said that Warsaw had initially evaluated other EW solutions, but it has since “narrowed” the competitive field to IVEWS and Viper Shield. (Source: Breaking Defense.com)
04 Sep 24. Asia-Pacific: New highly sophisticated malware points to risks stemming from Chinese-nexus groups. Earlier on 4 September, the cyber security company Trend Micro reported that the Chinese-nexus group ‘Earth Lusca’ is using a new highly sophisticated backdoor (‘KLTVdoor’), likely as part of an ongoing cyber operation. The malware provides Earth Lusca with full control over compromised systems, allowing the group to manipulate files, to execute commands and to scan open ports remotely. Additionally, KLTVdoor’s code and communication mechanisms are highly obfuscated, which is likely intended to evade detection and hinder malware analysis. Notably, KLTVdoor’s command-and-control (C2) infrastructure comprises over 50 servers, pointing to possible large-scale future operations, as well as possible shared ownership among other Chinese-affiliated actors. Furthermore, the operation has reportedly thus far only targeted a trading company based in China, indicating that the malware is possibly still in its development phase. Earth Lusca has previously targeted government, technology and telecommunications sectors (mostly in Asia), underscoring the elevated security risks facing these sectors in the medium term. (Source: Sibylline)
02 Sep 24. Global: New ransomware operation points to elevated financial, disruption risks for organisations. On 2 September, international news outlets reported on the emergence of a new ransomware-as-a-service (RaaS) operation, ‘Cicada3301’, which has been targeting global VMware ESXi servers since June. The group reportedly first gains access to targeted organisations using stolen credentials for the remote access software ScreenConnect. Cicada3301 then encrypts a system’s files and downloads a ransom note, exfiltrating sensitive data from compromised systems prior to encryption in double extortion attacks. Cicada3301 also deletes the system’s data snapshots to further hinder data recovery, highlighting the group’s high sophistication and experience, as well as the widespread impact of its operations. Notably, the tactics, techniques and procedures (TTPs) on show resemble those of the defunct ransomware group ‘ALPHV’, which ceased operations in March. This suggests there is a possible overlap between the two groups. We assess this new RaaS operation will raise financial and disruption risks for global organisations in the short-to-medium term. (Source: Sibylline)
04 Sep 24. Northrop Grumman Corporation’s (NYSE: NOC) AN/ALQ-257 Integrated Viper Electronic Warfare Suite (IVEWS) has completed U.S. Air Force testing in the service’s Joint Preflight Integration of Munitions and Electronic Sensors (J-PRIMES) facility.
- During a series of rigorous tests, AN/ALQ-257 IVEWS was subjected to accurate representations of complex radio frequency spectrum threats in the J-PRIMES anechoic chamber.
- The system demonstrated the ability to detect, identify and counter advanced radio frequency threats while operating safely with other F-16 systems.
- The successful completion of this regimen allows AN/ALQ-257 IVEWS to begin flight testing on Air Force F-16 aircraft.
Experts: U.S. Air Force Colonel Michael Rigoni, director, F-16 International Electronic Warfare Systems: “J-PRIMES marks the culmination of three years of extensive U.S. government IVEWS system-level testing that’s encompassed multiple Integration Demonstrations and Applications Lab (IDAL) events, flight demonstration on a surrogate platform during NORTHERN LIGHTNING 2021, Laboratory Intelligent Validated Emulator (LIVE) closed-loop testing and full integration into the Hill Air Force Base F-16 Block 50 avionics system integration lab. I am optimistic the upcoming operational assessment flight test events will yield positive results and look forward to seeing this important capability continue to mature for U.S. and international F-16 operators around the world.”
James Conroy, vice president, navigation, targeting and survivability, Northrop Grumman: “Building on multiple IDAL events, flight demonstration on a surrogate platform and LIVE closed loop testing, this successful completion of J-PRIMES testing confirms the maturity of IVEWS and its readiness to protect the U.S. and international F-16 fleets.”
Details: The AN/ALQ-257 Integrated Viper Electronic Warfare Suite (IVEWS) is designed to give F-16 electronic warfare capabilities on a par with fifth-generation aircraft, significantly enhancing survivability for operations in contested and congested electromagnetic spectrum environments. Its ultra-wideband suite can detect, identify and counter advanced radio frequency threats, including millimeter wave systems. IVEWS’s full pulse-to-pulse interoperability with the AN/APG-83 SABR AESA radar provides capability without compromise. It was selected as the U.S. program of record for F-16 electronic warfare in 2019.
02 Sep 24. Global: Exploitation of zero-day vulnerability points to raised risks from North Korean-nexus groups. On 30 August, the technology company Microsoft reported that the North Korean-nexus group ‘Citrine Sleet’ exploited a zero-day vulnerability (CVE-2024-7971) to target financial and cryptocurrency organisations. The vulnerability affects Chrome browsers and enables threat actors to execute code remotely on compromised systems. Citrine Sleet possibly employed social engineering tactics to direct potential victims to a malicious actor-controlled domain. The group then exploited CVE-2024-7971, showcasing its remote code execution capabilities by deploying a rootkit on compromised systems. Notably, Citrine Sleet also deployed sandbox evasion code during execution to avoid detection by security mechanisms. The rootkit provides the group with prolonged access and control over compromised Windows operating systems, highlighting the elevated sophistication of the group’s tactics. Citrine Sleet is likely targeting financial institutions for illicit profit to bolster North Korea’s weapons and missiles programmes, thus sustaining elevated risks for global financial institutions in the long term. (Source: Sibylline)
30 Aug 24. Cyber Update Key points.
- The exploitation of a zero-day vulnerability to infiltrate downstream customer networks will sustain elevated supply chain risks stemming from the Chinese state-sponsored group ‘Volt Typhoon’ (see Sibylline Cyber Daily Analytical Update – 27 August 2024 and our Technical analysis below).
- The identification of a new backdoor, ‘HZ Rat’, points to elevated security risks for Chinese messaging platform users (see Sibylline Cyber Daily Analytical Update – 28 August 2024).
- The ransomware group ‘BlackByte’ is exploiting a new software vulnerability, which will elevate security and financial risks for multiple sectors (see Sibylline Cyber Daily Analytical Update – 29 August 2024 and our Technical analysis below).
- A new backdoor will increase espionage risks for global firms stemming from Iranian state-sponsored groups (see Sibylline Cyber Daily Analytical Update – 30 August 2024).
Technical analysis of weekly stories
The Chinese state-sponsored group Volt Typhoon has been exploiting a zero-day vulnerability (CVE-2024-39717) in the third-party security management platform Versa Directory since at least June. The group first obtains access to targeted systems via an internet exposed port used by a platform’s services. Volt Typhoon then exploits CVE-2024-39717 to deploy the custom ‘VersaMem’ web shell (disguised as a PNG image) onto compromised systems. VersaMem enables the threat actors to harvest the plaintext credentials of legitimate users via Versa’s authentication functionality, subsequently allowing Volt Typhoon to breach an organisation’s system. VersaMem is also stored and executed in the compromised system’s memory, thereby enhancing the threat actors’ ability to evade detection by traditional security tools. Notably, the threat actors primarily target internet and managed service providers (ISPs and MSPs) to widen their target pool by moving into downstream customer networks. Additionally, Volt Typhoon is only able to gain access to targeted systems that neglect to implement the vendor’s system-hardening and firewall guidelines, highlighting the importance of timely and strict security policies.
The cyber criminal group BlackByte is exploiting a VMware ESXi vulnerability (CVE-2024-37085) to deploy ransomware against manufacturing, transport, technology and public administration sectors. The threat actors infiltrate organisations via the legitimate login credentials for their virtual private network (VPN) services. Compromising VPN services notably allows the threat actors to access targeted systems through insecure third-party tools and to obfuscate their activity. This campaign marks a possible shift in their tactics, techniques and procedures (TTPs), as BlackByte typically exploits software vulnerabilities as initial attack vectors rather than using legitimate login credentials. Upon initial access, the threat actors hijack administrative-level accounts to create additional accounts on compromised ESXi hosts. BlackByte then exploits CVE-2024-37085 to bypass authentication processes and to establish elevated administrative privileges to modify configurations and access system data. The group subsequently deploys ransomware and the custom exfiltration tool ‘ExByte’ to encrypt and exfiltrate data. Notably, the ransomware is able to self-propagate within compromised systems as it contains stolen credentials in its code, highlighting the highly targeted nature of this malware. This further underscores the group’s rapid adaptability and high sophistication. BlackByte exploits CVE-2024-37085 within days of publication.
Some non-exhaustive recommendations to mitigate against these threats include:
- Monitor devices and networks for suspicious activity.
- Add available Indicators-of-Compromise (IoCs) to your organisation’s security detection systems to detect potentially malicious samples on the network.
- Routinely check for newly created user accounts and other abnormal files. Audit existing user accounts, often rotating credentials.
- Adopt behaviour-based end-point detection and response (EDR) solutions, prioritising the detection of the initial stages of a compromise.
- Ensure adequate security monitoring and detection capabilities, particularly for all external-facing services and devices; include personal devices connected to corporate networks or applications.
- Conduct cyber hygiene awareness courses for users, enabling them to recognise and report phishing and other types of social engineering.
Our cyber word(s) of the week: Password spray attack
(Source: Sibylline)
30 Aug 24. Global: New malware highlights elevated espionage risks from Iranian state-sponsored groups. On 28 August, the technology company Microsoft reported that the Iranian state-sponsored group ‘Peach Sandstorm’ used a new custom backdoor (‘Tickler’) in several cyber espionage operations between April and July. Peach Sandstorm specifically targeted the education sector to acquire command-and-control (C2) infrastructure. It also targeted the government, satellite and defence sectors to gather strategic intelligence. The group used social engineering techniques and password spray attacks to gain access to targeted systems and to hijack Microsoft user accounts. Peach Sandstorm subsequently deployed the Tickler backdoor to establish persistence, to capture database information, to move laterally and to install remote management tools. Notably, Peach Sandstorm’s use of password spray attacks and new custom malware highlights the continuous development and sophistication of its capabilities. Another Iranian state-sponsored group, ‘Smoke Sandstorm’, also recently used similar tactics in its cyber operations, thus elevating the espionage risks facing the aforementioned global sectors from Iranian state-sponsored groups. (Source: Sibylline)
29 Aug 24. U.S. Intelligence Community Expands Private Sector Collaboration. The U.S. Intelligence Community (IC) is intensifying its efforts to collaborate with the private sector through a series of strategic initiatives aimed at enhancing national security capabilities. Director of National Intelligence (DNI) Avril Haines announced these measures during her address at the Intelligence and National Security Summit in Bethesda, Maryland, underscoring the growing need for intelligence agencies to access specialized expertise and technological innovations available in the private sector.
Haines emphasized the necessity for a “systemic, strategic, whole-of-IC approach” in fostering government-industry partnerships. This approach is driven by the recognition that private companies possess unique skills and knowledge in critical areas such as artificial intelligence, cybersecurity, space, and supply chain management of rare earth elements—domains where the government needs more in-house expertise. To facilitate this, the Office of the Director of National Intelligence (ODNI) has established an Office of Partnership Engagement, which will spearhead these collaborative efforts.
Key among the new initiatives is the revision of performance evaluations for intelligence officers to include objectives related to private sector engagement. This reflects a broader push to integrate private sector collaboration into the daily operations of intelligence agencies. Additionally, the ODNI is developing a curriculum focused on emerging technologies, which will train acquisition professionals on how to effectively leverage innovations from private firms.
The initiatives also include practical measures to improve information sharing between the intelligence community and private companies. For instance, the IC is working to downgrade certain classified information to make it accessible to private sector partners. A library of cleared intelligence products for the private sector is also being developed, mirroring successful models like the NSA’s Cybersecurity Collaboration Center, which facilitates information exchange on cyber threats.
Public-private partnerships have become increasingly critical since the September 11 attacks, with private firms often providing the technology and tools needed to counter threats. However, Haines acknowledged that these new efforts might face initial challenges, requiring patience and ongoing refinement. (Source: https://www.sofx.com/)
—————————————————————————————————————————————————————————————————————————————————————————————————————————————–
Spectra Group (UK) Ltd
Spectra Group (UK) Ltd, internationally renowned award-winning information security and communications specialist with a proven record of accomplishment.
Spectra is a dynamic, agile and security-accredited organisation that offers secure Hosted and Managed Solutions and Cyber Advisory Services with a track record of delivering on time, to spec and on budget.
With over 15 years of experience in delivering solutions for governments around the globe, elite militaries and private enterprises of all sizes, Spectra’s platinum and gold-level partnerships with third-party vendors ensure the supply of best value leading-edge technology.
Spectra was awarded the prestigious Queen’s Award for Enterprise (Innovation) in 2019 for SlingShot.
In November 2017, Spectra Group (UK) Ltd announced its listing as a Top 100 Government SME Supplier by the UK Crown Commercial Services.
Spectra’s CEO, Simon Davies, was awarded 2017 Businessman of the Year by Battlespace magazine.
Founded in 2002, the Company is based in Hereford, UK and holds ISO 9001:2015, ISO 27001:2013 and Cyber Essentials Plus accreditation.
————————————————————————————————————————————————————————————————————————————————————————————————————————————————