Sponsored by Spectra Group
—————————————————————————————————————————————————————————————————————————————————————————————————————————————
18 Dec 24. Northrop Grumman Corporation (NYSE: NOC) has been selected as the prime contractor to deliver nuclear command, control and communications (NC3) aircraft for the U.S. Navy’s Take Charge And Move Out (TACAMO) mission. The Northrop Grumman-led industry team will deliver the E-130J to relieve the U.S. Navy’s current E-6B Mercury fleet of the TACAMO mission.
- Northrop Grumman has invested more than $1bn in digital engineering and manufacturing capabilities that will assist in rapidly designing, building, testing and sustaining the E-130J.
- The company has been a key industry partner with the U.S. Navy as a prime aeronautics manufacturer for decades by serving as the prime contractor on the U.S. Navy’s E-2D Advanced Hawkeye and the MQ-4C Triton as well as providing support for the E-6B Mercury TACAMO fleet.
- The effort will incorporate Northrop Grumman’s technology leadership in advanced manufacturing, agile design, digital engineering and weapon system integration expertise to take advantage of Day One readiness across the Northrop Grumman-led industry team.
Jane Bishop, vice president and general manager, global surveillance division, Northrop Grumman: “Our performance on Navy programs like the E-2D and E-6B prove we deliver on what we promise, and we will bring this expertise in helping the Navy deliver the E-130J on time and optimized for this strategically important mission.”
The U.S. Navy’s TACAMO mission provides connectivity between the National Command Authority and U.S. nuclear forces. The Navy currently operates a fleet of E-6B Mercury aircraft to provide survivable, reliable and endurable airborne command, control and communications between the National Command Authority and U.S. forces. The E-130J will modernize this critical strategic deterrent mission.
Northrop Grumman’s E-130J TACAMO industry team of Lockheed Martin Skunk Works ®; Raytheon; Crescent Systems, Inc; and Long Wave Inc. has vast knowledge and expertise in delivering critical command and control and nuclear enterprise capabilities to meet the U.S. Navy’s E-130J TACAMO requirement.
Northrop Grumman is a leading global aerospace and defense technology company. Our pioneering solutions equip our customers with the capabilities they need to connect and protect the world, and push the boundaries of human exploration across the universe. Driven by a shared purpose to solve our customers’ toughest problems, our employees define possible every day.
18 Dec 24. DOD Releases Chemical and Biological Defense Program Enterprise Strategy. The Department of Defense released today, the 2024 Chemical and Biological Defense Program (2024 CBDP) Enterprise Strategy. It replaces the 2020 CBDP strategy and positions the Department to ensure the total force to carry out its missions in the face of advanced chemical and biological threats. Taking its lead from the 2022 National Defense Strategy, this strategy prioritizes delivery of operationally relevant chemical and biological defense (CBD) capabilities at speed and scale, to sustain and strengthen U.S. deterrence against the People’s Republic of China as the pacing challenge and Russia as the acute threat. The new strategy reinforces other strategic guidance including the 2023 Strategy for Countering Weapons of Mass Destruction, inaugural National Defense Industrial Strategy, and the Biodefense Posture Review. It also calls for tighter integration of CBD capabilities with international Allies and partners to ensure our combined armed forces can deter or prevail against advanced chemical and biological threats.
“Strategic competition and rapid technological changes are making chemical and biological threats harder to defend against and increasingly attractive to adversaries,” said Ian Watson, deputy assistant secretary of defense for chemical and biological defense. “This strategy creates the urgency and change necessary to continue to outpace our adversaries and the threat.”
The CBDP develops chemical and biological defense material capabilities for all the Military Services. DoD is increasingly prioritizing CBD modernization to ensure the Joint Force is equipped to carry out all its missions in the face of chemical and biological threats.
To deliver operationally relevant CBD capabilities at speed and scale, the strategy aligns the Department’s efforts in four ways:
- Generate material solutions that increase decision space, reduce initial operational impact, and rapidly restore combat power.
- Pursue technical enablers and innovative approaches that accelerate capability delivery at sufficient scales.
- Posture the Chemical and Biological Defense Program around delivering operationally relevant capabilities at speed and scale.
- Leverage and expand interagency, international, industry, and academic partners.
You can read the full strategy on the DoD website here: chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://media.defense.gov/2024/Dec/18/2003615893/-1/-1/0/CHEMICAL-AND-BIOLOGICAL-DEFENSE-PROGRAM-ENTERPRISE-STRATEGY-2024.PDF
The Office of the Assistant Secretary of Defense for Nuclear, Chemical, and Biological Defense Programs (OASD(NCB)) leads DoD efforts to ensure a safe, secure, and effective U.S. nuclear deterrent. As the world returns to Great Power competition and the recognition that threats against the United States, its allies, and its interests are both proliferating and becoming more difficult to challenge, OASD(NCB) is at the forefront of U.S. efforts to sustain and modernize the nuclear deterrent. From the operational, to the administrative, to the speed of response and production, OASD(NCB) is reshaping the way DoD meets and responds to weapons of mass destruction threats. (Source: U.S. DoD)
18 Dec 24. Turkey: Defence entities face heightened cyber espionage risks from South Asian threat group. On 17 December, the cyber security firm Proofpoint reported that the cyber espionage group ‘Bitter’ targeted Turkish defence entities with new malware (‘MiyaRAT’) in November. The campaign began via spear phishing emails containing a malicious RAR archive file. If opened, the MiyaRAT is downloaded alongside ‘WmRAT’, a previously observed Bitter malware. MiyaRAT is capable of data exfiltration, remote control and command execution, among other functions. Notably, this malware campaign is only deployed sporadically against specific high-value targets, pointing to the targeted nature of the operation. Bitter is a suspected South Asian cyber espionage group that tends to target government bodies and organisations across all of Asia, indicating a potential expansion in the group’s victim pool. As such, we assess there will be heightened cyber espionage risks facing defence entities in Turkey in the medium term. (Source: Sibylline)
17 Dec 24. US Army to begin SIGINT integration into Terrestrial Layer System. US Army’s Program Executive Office Intelligence, Electronic Warfare and Sensors (PEO IEW&S) is on pace to begin integration of signals intelligence (SIGINT) capability aboard the Terrestrial Layer System (TLS) by boreal spring 2026.
The SIGINT capability will be integrated into Stryker-based TLS Brigade Combat Team (TLS BCT) and the TLS Echelons Above Brigade (TLS EAB) version of the system, according to Program Executive Officer IEW&S US Army Brigadier General Ed Barker.
The first of these demonstrations, focused on the TLS BCT platform, have been tentatively slated for the April or May 2026 timeframe, he said during a December roundtable at Fort Belvoir, Virginia.
The TLS family of systems is designed as an integrated SIGINT, electronic warfare (EW), and cyber warfare system for army units. The TLS BCT provides combat commanders “with electromagnetic attack and offensive cyber warfare options to deny, degrade, disrupt, or otherwise manipulate the targeted force”, a PEO IEW&S fact sheet stated.
The TLS EAB variant is based on the BCT version of the system but allows TLS operators the ability to “digitally interface with brigade, division, corps, unified action partners, and mission command systems” during combat operations, according to the fact sheet. Once fielded, the TLS EAB will be aligned at the battalion level to “support information superiority, targeting, and long-range precision fires” missions, the fact sheet stated. As integration work progresses on the SIGINT capability for the TLS BCT and TLS EAB systems, it remains unclear whether the newest platform variant, the TLS BCT Manpack, will receive similar SIGINT capabilities. (Source: Janes)
17 Dec 24. US Army to field key EW programme by 2026. A critical electronic warfare (EW) programme, designed to improve situational awareness for combat units within the electromagnetic spectrum (EMS), could be headed to the field as early as 2026. Led by Product Manager Electronic Warfare Integration (PdM-EWI), the army’s Spectrum Situational Awareness System (S2AS) programme has been tagged for rapid prototyping beginning in fiscal year (FY) 2025. Designed to work in conjunction with the Electronic Warfare Planning and Management Tool (EWPMT), S2AS is to be the army’s “dedicated [EMS] situational awareness system … to provide the [combat] commanders with real-time [EMS operations] situational awareness”, according to a service fact sheet. The S2AS could also help determine whether signal degradation could be the result of army systems creating interference across the EMS, the fact sheet noted. The programme “is going to help us see ourselves, manage our [EMS] footprint, and understand when we are being jammed”, according to Program Executive Officer Intelligence, Electronic Warfare and Sensors (PEO IEW&S) Brigadier General Ed Barker. In terms of fast-tracking S2AS prototyping, “we have seen the technology out there, and we firmly believe we will be able to move out really quickly on that”, Brig Gen Barker said during a December briefing at Fort Belvoir in Virginia. To that end, army officials conducted a test and evaluation event in mid-December for S2AS, where three mature prototype systems were being run on service networks to ensure successful integration into current command-and-control (C2) platforms. (Source: Janes)
16 Dec 24. DoD Releases Version 4.3 Update to Online Cyber Resilient Weapon Systems Body of Knowledge for Engineering Workforce. The Department of Defense (DoD) announced the release of Version 4.3 of the Online Cyber Resilient Weapon Systems Body of Knowledge (CRWS-BoK) today, a free resource designed to support the public and private sector workforces in designing, engineering, and safeguarding secure cyber resilient systems.
Launched in May of 2021 by the Office of the Under Secretary of Defense’s System Security (SysSec) team, the CRWS-BoK has continued to evolve through regular updates, enhancing functionality, engagement, and collaboration. The latest version introduces several key upgrades and improvements, including:
- Enhanced resource viewing: Users can now view resources they have rated, promoting greater engagement and feedback.
- Simplified email management: Users can unsubscribe from emails directly from the email footer, improving communication preferences.
- Expanded nomination capabilities: Users can now nominate Engineering Design Patterns for inclusion in the CRWS-BoK, in addition to resources such as documents and videos.
- Section 508 Compliance Updates: The CRWS-BoK is now fully compliant with the Revised Section 508 of the Rehabilitation Act of 1973, ensuring accessibility for people with disabilities.
- Visual and interface enhancements: The platform has been updated with new graphics and security features to improve the overall user experience.
The SysSec team is committed to refining the CRWS-BoK to ensure it remains an essential resource for system security engineering (SSE) and science and technology (S&T) professionals, with the goal of advancing cyber resilience. By collaborating with SSE and S&T professionals, the Research and Engineering (R&E) community can foster assured resilient missions, systems, and components.
Through the CRWS-BoK, the DoD aims to promote innovation and best practices in secure cyber resilient engineering (SCRE), enabling the nation’s SSE and S&T workforces to develop systems that can successfully operate in the face of persistent cyber threats. To learn more and register for a free account, visit the CRWS-BoK at https://www.crws-bok.org/.
About USD(R&E)
The Under Secretary of Defense for Research and Engineering (USD(R&E)) is the Chief Technology Officer of the Department of Defense. The USD(R&E) champions research, science, technology, engineering, and innovation to maintain the United States Military’s technological advantage. Learn more at www.cto.mil, follow us on X (formerly Twitter) @DoDCTO, or visit us on LinkedIn at https://www.linkedin.com/company/ousdre(Source: U.S. DoD)
16 Dec 24. BigBear.ai and Proof Labs Collaborate to Develop Cyber Resilient On-Orbit (CROO) Solution for the Department of the Air Force. BigBear.ai (NYSE: BBAI), a leading provider of AI-powered decision intelligence solutions for defense and national security, today announced a collaboration with Proof Labs Inc to deliver an advanced cyber resiliency solution for the Department of the Air Force (DAF). Proof Labs Inc, as the prime contractor, was awarded the AFWERX Small Business Innovation Research (SBIR) Direct-to-Phase II contract to develop the Cyber Resilient On-Orbit (CROO) solution, with BigBear.ai supporting as a sub-contractor. The CROO solution will incorporate BigBear.ai’s SpaceCREST technology, a comprehensive digital twin capability that serves as a real-time monitor and alerting system of a satellite network’s cyber infrastructure. This project aims to enhance the security of the U.S. Air Force (USAF) and the U.S. Space Force (USSF) on-orbit assets through Artificial Intelligence/Machine Learning (AI/ML) cyber intrusion detection.
“Proof Labs is excited to collaborate with BigBear.ai to develop and deliver an advanced intrusion detection system utilizing artificial intelligence for the Air Force Research Laboratory (AFRL) Space Cyber Resiliency program,” said Ricardo Aguilar, Co-Founder & CEO of Proof Labs Inc. “This work combines Proof Labs’ innovation with BigBear.ai’s expertise in AI-driven analytics to enhance the cybersecurity of critical space assets. The integration of innovative technologies will support USAF’s and USSF’s mission to maintain resilient and secure space capabilities.”
BigBear.ai will train the CROO’s AI/ML against a wide range of simulated cyberattacks, covering well-established tactics and procedures. The CROO solution will analyze, evaluate, and classify the behavior of USSF satellite systems in normal operation, versus while under the influence of simulated cyberattacks.
BigBear.ai will then integrate these advanced machine learning algorithms for continuous live monitoring and real-time anomaly and intrusion detection. These algorithms will monitor select USSF space assets’ cyber environments to detect and alert USSF of potential threats in real-time.
“This project represents a significant step forward in safeguarding our nation’s space infrastructure,” said Robert Wedertz, Senior Vice President, Federal at BigBear.ai. “BigBear.ai’s SpaceCREST digital twin capability, further enhanced by custom machine learning and anomaly detection gained through this project, will provide DAF a powerful tool to help combat real-time cyber threats and ensure the resilience of our nation’s critical space assets.”
(Mandatory disclaimer) “The views expressed are those of the author and do not necessarily reflect the official policy or position of the Department of the Air Force, the Department of Defense, or the U.S. government.”
About BigBear.ai
BigBear.ai is a leading provider of AI-powered decision intelligence solutions for national security, digital identity, and supply chain management. Customers and partners rely on BigBear.ai’s artificial intelligence and predictive analytics capabilities in highly complex, distributed, mission-based operating environments. Headquartered in Columbia, Maryland, BigBear.ai is a public company traded on the NYSE under the symbol BBAI. For more information, visit https://bigbear.ai and follow BigBear.ai on LinkedIn: @BigBear.ai, and X: @BigBearai. To receive email communications from BigBear.ai, register here.
About Proof Labs Inc
Proof Labs provides cybersecurity solutions aimed at safeguarding critical military, aerospace, satellite, and national defense assets. Drawing from extensive research and hands-on experience in military communications, real-world national defense, and space projects, we work to mitigate the continuously evolving threat landscape. For more information, visit https://prooflabs.space/ (Source: BUSINESS WIRE)
16 Dec 24. US-China: New backdoor raises security, information theft risks from Chinese state-sponsored actor. On 12 December, the cyber security firm XLabs reported that the Chinese state-sponsored group ‘Winnti’ has been targeting firms in the US and China with a new backdoor (‘Glutton’) since December 2023. The campaign primarily targets IT services, social security agencies and web application developers. While the initial attack vector is unclear, Glutton aims to conduct various malicious activities including exfiltrating system information and credentials. Glutton is a modular backdoor where specific components in the backdoor can be activated to tailor attacks, underscoring its sophistication. However, Glutton has notably weak stealth and encryption capabilities, indicating the malware may be in a development stage. Additionally, Glutton was observed being used to target other cyber criminals, embedding the backdoor into software packages sold on the dark web to steal high-value sensitive information. We assess that the shift in Winnti’s victimology (compounded by Glutton’s likely ongoing development) will elevate security and information theft risks. (Source: Sibylline)
16 Dec 24. Cyber Update Key points.
- Additional data exfiltration by Chinese state-sponsored groups will likely be facilitated by ongoing access to US telecommunications networks and prolonged recovery efforts. This will elevate espionage and national security risks in the short term. There is also a realistic possibility that the group will propagate the infection via the software supply chain and conduct additional cyber attacks against critical national infrastructure (CNI) sectors.
- The scale and impact of the cyber espionage campaign against US telecommunications providers (first reported on in September) may expand, especially since investigations into cyber attacks are ongoing. Additional reports of compromises are likely in the coming months.
- The spike in cyber attacks against telecommunications providers heightens disruption risks to the broader US CNI amid geopolitical tensions amid increased botnet activity and the capability of Chinese state-sponsored actors to obtain and maintain access to targeted systems.
Context
On 4 December, the US deputy national security adviser for cyber and emerging technologies, Anne Neuberger, disclosed that the White House has created a Unified Coordination Group to respond to several Chinese state-sponsored cyber attacks against the US telecommunications sector. The attacks targeted eight high-profile US internet service providers (ISPs) and telecommunications providers in a concerted, large-scale cyber espionage campaign since at least 2022. The threat actors reportedly exploited access to the providers’ networks to monitor the communications of senior US government and political officials and steal sensitive information and corporate intellectual property (IP); this underscores the severe consequences and potential national security implications of this campaign. Mitigation efforts will highly likely take several months as they require the substitution of thousands of devices while Chinese state-sponsored groups reportedly still maintain access to the providers’ networks. We assess this will sustain elevated espionage and national security risks to US telecommunications and critical national infrastructure (CNI) sectors in the medium term amid ongoing bilateral tensions between China and the US. (Source: Sibylline)
13 Dec 24. Cyber Update Key points.
- A spike in cyber attacks has underscored the elevated security and disinformation risks facing Romania’s electoral system (see Sibylline Cyber Daily Analytical Update – 9 December 2024).
- A new ‘Termite’ ransomware operation points to the heightened financial and reputational risks facing global organisations via the software supply chain (see Sibylline Cyber Daily Analytical Update – 10 December 2024 and our Technical analysis below).
- Cyber criminal operations employing the malware variant ‘Androxgh0st’ underscores the elevated security and disruption risks facing global critical national infrastructure (CNI; see Sibylline Cyber Daily Analytical Update – 11 December 2024).
- The Chinese authorities are using the spyware ‘EagleMsgSpy’ for domestic surveillance operations, underscoring the surveillance and information-theft risks for Android mobile users (see Sibylline Cyber Daily Analytical Update – 12 December 2024).
- The emergence of new spyware variants has elevated the surveillance and information-theft risks stemming from the Russian advanced persistent threat (APT) group ‘Gamaredon’ (see Sibylline Cyber Daily Analytical Update – 13 December 2024 and our Technical analysis below).
Technical analysis of weekly stories
A new ransomware group, Termite, targeted the software-as-a-service (SaaS) vendor Blue Yonder in a ransomware attack in November. The attack disrupted operations across several high-profile businesses in the provider’s supply chain, impacting payroll, shipping and warehouse management systems for several weeks. Termite has claimed attacks against several organisations across the government, energy and manufacturing sectors. It is unclear how Termite first infects targeted systems. However, upon infection, an application programming interface (API) is leveraged to ensure that the Termite ransomware payload is the last process to be terminated in the attack, thereby maximising the time available for Termite to complete the encryption process. The ransomware then terminates all services on victims’ machines to minimise interruptions during the attack, highlighting the highly sophisticated and premeditated nature of this operation. Additionally, Termite deletes all back-up and deleted file copies to hinder recovery processes and to increase the likelihood that victims will pay a ransom. Termite then encrypts all the system’s files, blocking users’ access and demanding a ransom payment for financial profit. Termite has been active since mid-October and shares several similarities with the now-defunct ransomware operation ‘Babuk’, pointing to a possible re-branding of the group to maintain operations.
The Russian APT group Gamaredon is using two spyware variants (‘BoneSpy’ and ‘PlainGnome’) in an ongoing cyber surveillance campaign. The campaign targets Android mobile users and likely distributes the malicious applications via social engineering tactics. BoneSpy has been active since at least 2021 and was developed using code from the defunct Russian spyware ‘DroidWatcher’. BoneSpy is typically distributed via several malicious applications emulating battery monitoring and photo gallery services. It also displays several advanced information-gathering techniques and can be controlled via SMS messages, underscoring Gamaredon’s sophistication. PlainGnome emerged in January and displays limited obfuscation and detection-evasion techniques, suggesting that it is possibly still in its development phase. Unlike BoneSpy, PlainGnome acts as a malware dropper to deploy the main surveillance payload. Both spyware variants collect sensitive information from compromised systems, including call logs, contact lists, device location, images, messages and audio recordings of phone calls.
Some non-exhaustive recommendations to mitigate against these threats include:
- Monitor devices and networks for suspicious activity
- Add available Indicators-of-Compromise (IoCs) to your organisation’s security-detection systems to detect potentially malicious samples on the network
- Adopt behaviour-based end-point detection and response (EDR) solutions, prioritising the detection of the initial stages of a compromise
- Ensure adequate security monitoring and detection capabilities, particularly for all external-facing services and devices; this includes personal devices connected to corporate networks or applications
- Adopt and review network authentication services, including virtual private network (VPN) services and multi-factor authentication (MFA)
- Avoid downloading applications from untrusted third-party websites or via unsolicited messages and only use official websites and application stores to install applications and tools on devices
Our cyber word(s) of the week: Spyware. (Source: Sibylline)
—————————————————————————————————————————————————————————————————————————————————————————————————————————————–
Spectra Group (UK) Ltd
Spectra Group (UK) Ltd, internationally renowned award-winning information security and communications specialist with a proven record of accomplishment.
Spectra is a dynamic, agile and security-accredited organisation that offers secure Hosted and Managed Solutions and Cyber Advisory Services with a track record of delivering on time, to spec and on budget.
With over 15 years of experience in delivering solutions for governments around the globe, elite militaries and private enterprises of all sizes, Spectra’s platinum and gold-level partnerships with third-party vendors ensure the supply of best value leading-edge technology.
Spectra was awarded the prestigious Queen’s Award for Enterprise (Innovation) in 2019 for SlingShot.
In November 2017, Spectra Group (UK) Ltd announced its listing as a Top 100 Government SME Supplier by the UK Crown Commercial Services.
Spectra’s CEO, Simon Davies, was awarded 2017 Businessman of the Year by Battlespace magazine.
Founded in 2002, the Company is based in Hereford, UK and holds ISO 9001:2015, ISO 27001:2013 and Cyber Essentials Plus accreditation.
———————————————————————————————————————————————————————————————————————————————————————————————————————-