FBI wants more ransomware victims to report attacks

1 big thing: FBI reaches out to ransomware victims

Illustration of binary code under a box trap

Russian hackers used new malware to target Ukrainian energy sector

2. New malware targeted Ukrainian energy sector

Illustration of an electrical power tower in the shape of a lightning bolt.

Developers are in high demand in the cybercrime underworld

3. A different type of hiring spree

Illustration of keyboard letters spelling "Helped Wanted"

4. Catch up quick

5. 1 fun thing

Two photos of Barry (left) and Lola (right) the cats

I'm truly devastated by the news that Philz Coffee is leaving the D.C. market. Sure, it's just a simple drip coffee shop, but I appreciate the simplicity! 

📬 Have thoughts, feedback or scoops to share? codebook@axios.com

Today's newsletter is 1,317 words, a 5-minute read.

Thanks to Peter Allen Clark for editing and Khalid Adad for copy editing this newsletter.

If you like Axios Codebook, spread the word.

Codebook

A master lock with ones and zeroes instead of the regular numbers.

blue

Decode key cybersecurity news and insights. With Sam Sabin.

Axios Codebook

Cybersecurity hiring remains strong amid tech layoffs

1 big thing: Cybersecurity hiring remains strong amid tech layoffs

Illustration of a lone keyboard key with a briefcase icon on it. 

2. CISA's game plan to secure K-12 schools

Illustration of a laptop with the screen made out of a bookshelf.

3. Apple brings privacy lessons to stores

Image of people passing by an Apple store

Happy Tuesday! Welcome back to Codebook. 

This is very niche, but it is Oscars nominations day: I am obsessed with the very weird yet successful campaign a small indie film made in the last few weeks to get a nomination. If you need a short break today, I encourage you to dive into it. It's a fun one.

📬 Now, back to cyber: Have thoughts, feedback or scoops to share? codebook@axios.com

🔓 Situational awareness: League of Legends developer Riot Games said Tuesday that hackers stole the source code for some of its most popular games in a recent breach.

Today's newsletter is 1,279 words, a 5-minute read. 

1 big thing: NSO tries to make its case in D.C.

Photo illustration of NSO chief executive Yaron Shohat with images of the NSO logo and the Capitol Building

2. Exclusive: Russian hackers target ambassadors

Illustration of a lock in the colors of the Russian flag.

3. Charted: Nearly 2,000 data compromises

😎 TGIF, everyone. Welcome back to Codebook. 

Not sure about y'all, but I'm relieved Friday is here. What a week! 

📬 But first: Have thoughts, feedback or scoops to share? codebook@axios.com

Today's newsletter is 1,433 words, a 5.5-minute read.

Trying to find a safe way to TikTok

1 big thing: Trying to find a safe way to TikTok

Animated illustration of text-in-progress ellipsis made up of periods stylized like the TikTok logo. 

What to know about the VMware server attacks

2. What to know about the VMware server attacks

Illustration of top down view of opened laptops in a grid pattern.

3. Catch up quick

4. 1 fun thing 

🎉 I'm writing to y'all from the annual Axios retreat. As such, today's newsletter is a bit shorter. 

📬 Have thoughts, feedback or scoops to share? codebook@axios.com.

Today's newsletter is 1,286 words, a 5-minute read.

1 big thing: ACLU brings FISA fight to court

Illustration of a silhouetted scales of justice, with the plates moving up and down.

Pro-Russian hacktivist group is only getting started, experts warn

2. Officials say Killnet's only getting started

Illustration of a computer mouse's wire as a fuse. 

3. The week in cybersecurity research

Animated illustration of a microscope view with cursors wiggling around like bacteria.

5. 1 fun thing 

😎 TGIF, everyone. Welcome back to Codebook.

Thank you to everyone who sent in their coveted pet pics this week — it made writing today's newsletter a whole lot easier 👀.

Today's newsletter is 1,494 words, a 5.5-minute read. 

National

A ransomware campaign exploiting VMware servers around the world sent security personnel into a fury over the weekend. 

Driving the news: Reports started to surface late last week detailing a "global ransomware hacking attack," as Reuters described it, targeting a years-old vulnerability in VMware's popular ESXi machines. 

Ransomware gangs appear to be targeting a vulnerability that VMware patched two years ago — limiting the potential impact to only those who missed that system update.

French and Italian officials, among others, issued alerts late last week and over the weekend warning about an active ransomware campaign targeting unpatched servers. 

Why it matters: Roughly 2,400 VMware ESXi servers have been hit with the ransomware worldwide, according to BleepingComputer. 

The largest number of affected servers is in France, followed by the U.S. and Germany, per Reuters.

VMware says it has more than 400,000 customers, and it has cited figures saying analysts believe that 80% of virtualized workloads run on VMware technology. 

What they're saying: A spokesperson at the Cybersecurity and Infrastructure Security Agency told Axios the agency is working "to assess the impacts of these reported incidents and providing assistance where needed." 

A VMware spokesperson said the ransomware attacks appear to be targeting "end-of-general-support or significantly out-of-date products by leveraging known vulnerabilities previously addressed and disclosed in VMware security advisories." 

Between the lines: Now is the time for companies to assess whether they use this specific VMware product — and if so, to immediately patch their systems, Avi Sinai, vice president of research and development at Israeli cloud security firm Perimeter 81, told Axios.

"Hundreds of vulnerabilities are found every day. If you have time to patch your servers, then you're good." Sinai said. "If not ... you must patch as soon as possible. Otherwise, even junior hackers can find a way to hack your system and then ask for ransom." 

The intrigue: VMware's ESXi servers allow people to host virtualized, cloud-based computers on physical devices, giving them access to multiple operating systems via one server.

While moving to the cloud has been hailed as a surefire way to protect organizations, the current ransomware attack is an example of the security downfalls if administrators don't know how to properly patch or manage their cloud networks, Sinai added. 

Be smart: Each organization running cloud computing security infrastructure should establish a regular patching schedule to avoid a similar exploitation of years-old, already resolved security vulnerabilities.

Sign up for Axios’ cybersecurity newsletter Codebook here.

U.S., Italian, French and other government officials are monitoring the situation.

Cybersecurity

A ransomware campaign exploiting VMware servers around the world sent security personnel into a fury over the weekend. Driving the news: Reports started to surface late last week detailing a &quot;global ransomware hacking attack,&quot; <a class="gtmContentClick" data-vars-link-text="as Reuters described it" data-vars-click-url="https://www.reuters.com/world/europe/italy-sounds-alarm-large-scale-computer-hacking-attack-2023-02-05/" data-vars-content-id="2f07775c-3510-4565-b610-ff72eac622ce" data-vars-headline="What to know about the VMware server attacks" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.reuters.com/world/europe/italy-sounds-alarm-large-scale-computer-hacking-attack-2023-02-05/" target="_blank">as Reuters described it</a>, targeting a years-old vulnerability in VMware&#x27;s popular ESXi machines.

From the Valley to D.C., Big Tech players like Facebook, Google and Amazon are under more scrutiny than ever as new technology develops and privacy and antitrust concerns grow in lockstep with companies’ ambitions.

Technology

It's not just regulators and lawmakers struggling to make sense of cybersecurity concerns about TikTok — even your Codebook author can't figure out which are overhyped and which are valid. 

What's happening: It's now been about a month since I purchased a burner phone solely for TikTok. 

I've loved the app since 2019, when dancing to the Home Depot theme song was its biggest trend. From travel and meal-prepping tips to cat videos to absurd Gen Z trends, it's just a fun place to be.

I got the burner phone idea from veteran tech journalist Kara Swisher, who did the same thing nearly three years ago.

I always thought those hollering about TikTok's potential for abuse were either out of touch or overzealous China hawks. But TikTok parent company ByteDance's admission last year that it had tracked the location of U.S. journalists convinced me to rethink my use. 

Why it matters: TikTok reached 1 billion monthly active users in just five years, far more quickly than most U.S. social media apps, adding more urgency to U.S. officials' attempts to regulate the app.

And Pew Research estimates that about a quarter of U.S. adults under the age of 30 now get their news on TikTok. 

The big picture: TikTok comes with a unique set of regulatory considerations because of its China-based parent company. 

Companies in China are under different rules than U.S. ones and can be compelled to turn over user data without much recourse.

FBI director Christopher Wray said during a public event in December that the bureau is concerned the Chinese government could manipulate the TikTok algorithm, and "if they want to, to use it for influence operations."

TikTok has also reportedly censored videos that mention Tibetan independence, the Uyghur genocide and other videos. (A TikTok spokesperson attributed these reports to user violations of other content moderation policies and said anti-Chinese government arguments are still prominent on the app.) 

The other side: However, since I got my burner phone, several security experts have told me in private conversations that I probably overreacted. 

Keeping TikTok on my phone isn't much different from having any other mobile app with questionable practices on my phone, they argue. 

A prime example is Twitter: The platform has temporarily suspended some journalists who report negatively about the company, and some have expressed concern about Elon Musk having access to DMs. 

A TikTok spokesperson also told Axios that U.S. user data is currently accessible only by Oracle Cloud and the TikTok U.S. data security team, which will soon be spun out into its own subsidiary. 

State of play: Navigating TikTok's cybersecurity concerns hasn't been easy for anyone involved — even security officials. 

For three years, the federal government has been struggling to figure out whether security concerns about TikTok make it too dangerous to operate in the country — or if there's a way to protect U.S. user data.

Meanwhile, several states, universities and lawmakers have already jumped ahead and banned its use. 

Former Cybersecurity and Infrastructure Security Agency assistant director for cybersecurity Bryan Ware told Axios his own kids use the app. "My kids — oh, my god — would they revolt or change their citizenship to Canada [if TikTok got banned]," said Ware, the current CEO of LookingGlass Cyber Solutions.

Though he'd "personally like to see us not using TikTok." 

Reality check: If the Chinese government wants to spy on the U.S., it doesn't need TikTok to do so. 

Chinese state-sponsored hackers exploited flaws in Microsoft Exchange servers, affecting 30,000 U.S. organizations, just two years ago. 

The recent news cycle around the Chinese surveillance balloon drifting across U.S. airspace is just the latest example. 

Between the lines: The average TikToker (e.g., my 16-year-old sister) probably doesn't need to run out and get a burner phone — but journalists, human rights activists and political dissidents have different considerations. 

The bottom line: I'll probably keep my burner phone for now. 

If anything, having to power up a separate phone to watch short videos has helped me become more mindful of my usage, and that's always a good thing. 

It's now been about a month since I purchased a burner phone solely for TikTok.

Top Stories

It&#x27;s not just regulators and lawmakers struggling to make sense of cybersecurity concerns about TikTok — even your Codebook author can&#x27;t figure out which are overhyped and which are valid. What&#x27;s happening: It&#x27;s now been about a month since I purchased a burner phone solely for TikTok.

A pro-Russian hacktivist group's low-level distributed denial-of-service attacks on U.S. critical infrastructure could be a precursor to more serious cyberattacks, health care and security officials warned this week. 

Driving the news: Killnet, a politically motivated Russian hacking group, briefly overloaded and took down the websites of some U.S. health care organizations on Monday.

The DDoS attacks came after Killnet threatened a long list of Western health care organizations last weekend in retaliation for continued NATO support of Ukraine.

The American Hospital Association said in a statement Tuesday that while "some of the named entities were in fact targeted," the "impact appears to have been minimal and temporary." 

The big picture: Killnet's threats and low-level DDoS attacks have typically been seen as more of a nuisance than an actual threat to U.S. infrastructure. 

But increasingly, organizations and security experts are warning that Killnet's members have more capabilities than their less-skilled attacks let on. 

What they're saying: "What you see now is distributed denial of service," Mike Hamilton, a hospital security adviser and chief information security officer at Critical Insight, told Axios. 

"What's coming after this could be a lot worse," he added. 

Catch up quick: Killnet took down the websites of several major U.S. airports and a handful of state government websites in October.

The intrigue: Russia is filled with capable, patriotic hackers who could join Killnet and steer the group to pursue more destructive attacks like malware wipers or ransomware, Hamilton said.

Details: The Health Sector Cybersecurity Coordination Center also warned about more advanced hackers joining Killnet in an alert this week.

"This likely will result in entities Killnet targeted also being hit with ransomware or DDoS attacks as a means of extortion, a tactic several ransomware groups have used," the alert said. 

Yes, but: Killnet has struggled to pivot away from less impactful DDoS attacks, and there's no guarantee the group will pursue more sophisticated attacks. 

Be smart: Hospitals and other critical infrastructure should cut off as much internal access as possible to personal websites, including social media and email, to mitigate phishing threats that act as a gateway for more serious incidents, such as ransomware and malware wipers, Hamilton said. 

The politically motivated hacking group briefly took down the websites of some U.S. health care organizations Monday.

A pro-Russian hacktivist group&#x27;s low-level distributed denial-of-service attacks on U.S. critical infrastructure could be a precursor to more serious cyberattacks, health care and security officials warned this week. Driving the news: Killnet, a politically motivated Russian hacking group, briefly <a class="gtmContentClick" data-vars-link-text="overloaded and took down the websites" data-vars-click-url="https://www.dailymail.co.uk/health/article-11692945/Multiple-hospital-medical-websites-ongoing-cyberattack.html" data-vars-content-id="534b9889-7be1-40d0-8c4b-44aa36b46195" data-vars-headline="Pro-Russian hacktivist group is only getting started, experts warn" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.dailymail.co.uk/health/article-11692945/Multiple-hospital-medical-websites-ongoing-cyberattack.html" target="_blank">overloaded and took down the websites</a> of some U.S. health care organizations on Monday.

School districts in Tucson, Arizona, and Nantucket, Massachusetts, are responding to ransomware attacks on their networks this week — with at least one district canceling classes as it mitigates the impact.

Driving the news: Schools in Nantucket are closed Wednesday as the district works to understand the scope of a ransomware attack that hit their computers. 

The district also ended the school day early on Tuesday after the attack compromised the school system's computers, according to the Nantucket Current. 

The Tucson Unified School District — the largest school district in southern Arizona — said Tuesday night that it's been responding to a "data security incident" since Monday, but that schools are still "fully functioning." Local news reports indicate the incident is a ransomware attack. 

The big picture: Schools have been near constant ransomware targets for years due to IT budget constraints and a lack of dedicated resources.

The Cybersecurity and Infrastructure Security Agency released a plan last week to help K-12 schools strengthen their cybersecurity regimes, accounting for the resource and budget hurdles districts tend to face. 

By the numbers: Nantucket Public Schools is the fifth school district to be struck by ransomware this month, according to Emsisoft threat analyst Brett Callow. 

Emsisoft estimates that 45 schools districts contended with ransomware in 2022.

Details: Ransomware gang Royal is likely behind the attack in Tucson, according to a copy of the ransom note obtained by local TV station KOLD News. But it's still unclear who is behind the Nantucket schools attack. 

In Nantucket, the district has told staff and students not to use any school-issued devices because "they could compromise home networks," the Nantucket Current also reported. The district has more than 1,700 students. 

In Tucson, most administrative staff worked from home earlier this week after the attack crashed school WiFi networks, per the Arizona Republic.

Sign up for Axios’ cybersecurity newsletter Codebook here. 

Two U.S. school districts hit with ransomware attacks this week

Nantucket Public Schools canceled classes Wednesday as it responds the ongoing incident.

Illustration of a group of computers featuring chalkboards with equations on them

School districts in Tucson, Arizona, and Nantucket, Massachusetts, are responding to ransomware attacks on their networks this week — with at least one district canceling classes as it mitigates the impact.Driving the news: Schools in Nantucket are closed Wednesday as the district works to understand the scope of a ransomware attack that hit their computers.

The ACLU is suing the intelligence community in an attempt to potentially expose abuses of a warrantless surveillance program, just as Congress debates its existence.

Driving the news: The ACLU filed a complaint Friday, a copy of which was shared first with Axios, in the U.S. District Court for the Southern District of New York against the NSA, CIA, the DOJ and the Office of the Director of National Intelligence to compel the release of records related to surveillance.

In December, the ACLU filed a records request for recent opinions from the Foreign Intelligence Surveillance Court “that address novel or significant issues” in the government’s surveillance programs. The ACLU complaint alleges that no relevant agencies have produced a response to the request.

The request and the complaint aim to probe Section 702 of the Foreign Intelligence Surveillance Act, which expires at the end of the year.

Zoom out: The Section 702 program allows intelligence agencies to conduct warrantless surveillance of non-U.S. citizens abroad. The Foreign Intelligence Surveillance Court annually reviews whether it is still operating legally.

But in 2021, the court "took the unusual step of extending its review" to study non-disclosed issues raised by the surveillance program, according to the ACLU's complaint. 

By law, the intelligence community and the Department of Justice are required to review, for possible release, any new opinions from the FISA court that include any “novel or significant” issues. But they have yet to release the opinions that resulted from the FISA court’s 2021 review.

Why it matters: The yet-to-be-published FISA court opinion could sway  lawmakers, administration officials and privacy advocates as they prepare for a contentious, ongoing debate over whether to renew Section 702. 

What they're saying: “These opinions are essential to an informed public debate, and the government should release them immediately," said Patrick Toomey, deputy project director for the ACLU's national security project, in a statement to Axios. 

"Section 702 has morphed into a domestic surveillance tool for the FBI," he added. "Before Congress votes on reauthorizing this law, Americans should know how the government wants to use these sweeping spying powers.”

Yes, but: While the ACLU is hoping the district court can expedite the release of what this FISA court opinion, it is possible government officials will heavily redacted the opinion ahead of any forced publication. 

Catch up quick: Intelligence officials are already preparing for a drawn-out fight to keep Section 702 intact. 

Gen. Paul Nakasone, leader of the National Security Agency and U.S. Cyber Command, argued last month that Section 702 has allow the U.S. to stop active terrorist plots, foreign ransomware attacks and planned cyber espionage schemes. 

State of play: Little is known publicly about how the intelligence community relies on Section 702 given the classified nature of their work.

Efforts to disclose more information to the public about both potential Section 702 victories and abuses will be central to intelligence officials'  and advocates' arguments. 

The intrigue: Civil liberties and privacy advocates, progressive Democrats and conservative Republicans are likely to express concerns about Section 702's ability to inadvertently sweep up Americans' electronic communications — which are later stored in a database that any intelligence agency can search through.

The Office of the Director of National Intelligence disclosed in an annual report in April that the FBI conducted as many as 3.4 million searches of Americans' data in 2021 that was previously collected through 702. 

What's next: The government will have 30 days to respond in court to the ACLU's complaint.

Editor’s note: This story has been corrected to state that the intelligence community and the Department of Justice are required by law to review for possible release any new opinions from the FISA court that include any “novel or significant” issues. (Not the FISA court itself.) It has also been clarified to say that the ACLU aims to compel the release of surveillance records, more than just expedite the process.

ACLU files lawsuit to uncover possible FISA surveillance abuses

The ACLU is seeking a Foreign Intelligence Surveillance Court opinion that could weigh on Section 702's fate.

The ACLU is suing the intelligence community in an attempt to potentially expose abuses of a warrantless surveillance program, just as Congress debates its existence.Driving the news: The ACLU <a class="gtmContentClick" data-vars-link-text="filed a complaint" data-vars-click-url="https://www.aclu.org/legal-document/702-fisc-foia-complaint" data-vars-content-id="cf481154-072f-4ba6-8786-1fe5116283c5" data-vars-headline="ACLU files lawsuit to uncover possible FISA surveillance abuses" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.aclu.org/legal-document/702-fisc-foia-complaint" target="_blank">filed a complaint</a> Friday, a copy of which was shared first with Axios, in the U.S. District Court for the Southern District of New York against the NSA, CIA, the DOJ and the Office of the Director of National Intelligence to compel the release of records related to surveillance.

Sam Sabin

Stories

What to know about the VMware server attacks

Trying to find a safe way to TikTok

Pro-Russian hacktivist group is only getting started, experts warn

ACLU files lawsuit to uncover possible FISA surveillance abuses

Two U.S. school districts hit with ransomware attacks this week

Newsletter editions

📵 TikTok burner phone

🏛 ACLU's FISA fight

☎️ FBI's ransomware plea

📲 NSO's trip to Washington

👔 Resilient cyber hiring