Fighting cyber crime isn't always as glamorous as the public thinks it is — there are no Indiana Jones-style quests or high-speed car chases.

• But inside the stories of a forthcoming, cybersecurity-focused comic book anthology, anything can happen.

Driving the news: Tech experts Allan Liska, Anjuli R.K. Shere and Emily Crose are crafting the first comic book anthology made by cybersecurity professionals about cybersecurity professionals.

• Their new organization, Green Archer Comics, is accepting story ideas for the anthology until Feb. 15.
• Anyone in the cybersecurity community can submit a potential story — and some illustrative assistance is available for those who need it.

Why it matters: Getting non-techies interested in cybersecurity is a tough job (I'd know!). Experts tend to speak in highly technical terms or acronyms that the average person glazes over.

• Creating comics about cybersecurity could make the topic more approachable — and fun.

Catch up quick: Green Archer Comics is starting the anthology after the success of Liska's own comics released in the past year.

• Liska, an analyst at cybersecurity company Recorded Future, started with a cyber-focused, comic version of the old radio serial "Yours Truly, Johnny Dollar."
• In the original version, Johnny Dollar was a private detective fighting murderers and mobsters. Today, he's investigating ransomware crimes.
• Johnny Dollar was so successful that Liska started a second comic series, "The Clock." Between the two, he was able to crowdfund more than $12,000 to make his projects a reality.

What they're saying: "To me, this is a way to give back to the cybersecurity community that has really supported me in this venture," Liska told Axios.

• "When I hear other people say, 'Oh, I wish I could write a comic book' or 'I've always wanted to do something like this' — well, great, here's your chance."

The big picture: Liska started exploring his creative side last year after attending a panel at the RSA Conference about how cybersecurity professionals can tap their creativity.

• Liska couldn't draw, but he knew he could tell a story. So he enlisted the help of a few illustrators to bring his vision to life, including independent artists Marc Oliver and Dale Ray Deforest.

Details: Those interested in being part of the Green Archer Comics' anthology must submit an abstract and six panels from their script.

• The anthology will only accept submissions that are between two and five pages, and artwork is not necessary for the initial submission.
• Submissions also should fall into one of the eight content categories listed in the call for submissions, such as touching on a cybersecurity professional's daily life or providing "cautionary tales."
• Accepted submissions will receive $100 per page.

Between the lines: Green Archer Comics has received a "handful" of submissions in the week since it opened applications.

• "If you think your submission sucks, send it anyway," Liska said. "We want to work with you and help build a fun and interesting comic to share with the rest of the community."

What's next: If ideas are accepted, final submissions will be due March 10.

• Liska told Axios that the anthology is scheduled to be released at the annual SleuthCon in May.

With the crypto market down, the motivation for criminals to steal people's digital assets dropped significantly last year, Axios Crypto co-author Brady Dale writes.

Why it matters: While get-rich-quick scams will live on, they're less popular in crypto now that the market is down.

• Year-end numbers for 2023 from Chainalysis, the most widely known blockchain surveillance firm, show $24.2 billion in illegal activity for the year, or 0.34% of all transaction volume.

Of note: This number will almost certainly go up significantly as the firm learns of more activity confirmed to be criminal on chain from last year.

• The numbers for 2022 nearly doubled with further research in 2023.

Zoom out: That said, the numbers are down both in total and as a share of all volume.

What they're saying: "Scamming is most successful when markets are up, exuberance is high, and people feel like they are missing out on an opportunity to get rich quickly," Chainalysis wrote in its report on the year.

• That was not the sentiment in 2023.

The intrigue: One other factor may be hiding criminal activity volume from blockchain investigators: the changing nature of crime involving crypto assets.

• Chainalysis cites romance scams as a rising trend. These scams are impossible to see with blockchain analysis alone (unlike decentralized finance hacks, which are quite obvious).
• "We still believe insights into romance scams in particular suffer from underreporting. We hypothesize that the true damage of scamming is greater than what reporting to the FBI and our on-chain metrics show," the report notes.

Zoom out: As if preying on people's sadness to con them out of their money isn't bad enough, reporting by Bloomberg has convincingly linked the schemes to human trafficking.

Of note: More than 60% of Chainalysis' total, however, comes from funds going to sanctioned entities.

• That doesn't mean all that activity is actually crime. Many sanctioned entities also provide services to normal people in sanctioned countries, but there's no way to know what the proportions are.
• The Wall Street Journal learned about that distinction last fall.

It's time for the Biden administration and the rest of the cyber policy community to start talking about deterrence efforts to stop hackers, a former official said during a New America event Thursday.

Driving the news: I spoke with Nicole Tisdale, a former director at the White House's National Security Council and former House Homeland Security Committee staffer, during a fireside chat in D.C. on Thursday about what's on her radar in 2024.

• Deterrence, disinformation operations tied to global elections, and the human impact of cyberattacks should all be top of mind for cybersecurity experts this year, Tisdale said.

What they're saying: "We're going to have to be a lot more aggressive when it comes to deterrence," Tisdale said during the #ShareTheMicInCyber event.

• "There's all these signals that more and more is happening — the attacks are happening, the attack surface is getting larger, they're happening at scale," she added. "Defense is great, but defense without deterrence just means you're in this constant battle."

The big picture: Lawmakers and the Biden administration have done a good job of laying the foundation and road map for how the private sector and civil society can better respond and remain resilient to cyberattacks.

• Now, we're ready to focus on prevention — including sanctions, arrests and declassification of cyber intel, Tisdale said.

Details: Deterrence includes a mix of policies aimed at making malicious hackers' lives harder, sanctioning international gangs, attributing cyberattacks to specific entities, and declassifying information about how the group is launching operations, Tisdale said.

• Some lawmakers and the White House have started to discuss these topics, but Tisdale would love to see deeper conversations about when to pull these levies and in what manner.
• "Schools can be attacked, hospitals can be attacked, our wastewater and our water supply, all of these things can be attacked," she said. "If nothing is off-limits, when do we have this conversation about deterrence?"

Yes, but: Tisdale isn't saying that it's time for companies and private cyber defenders to start "hacking back" at the malicious hackers.

• "I would caution people against hacking back as the answer," Tisdale said. "Deterrence is a toolbox, and you have multiple tools in the toolbox."

Go deeper: The full recording from our conversation will be available online here in the coming days.

@ D.C.

🪖 An OpenAI executive said at the World Economic Forum that the company is now working with the Pentagon on a number of projects — reversing its original stance on military work. (Bloomberg)

😶‍🌫️ A recently created privacy court overseeing data flows between the U.S. and the EU isn't sharing much about the work it's actually doing, including its caseload or even its location. (Politico)

@ Industry

🤷🏻‍♀️ MOVEit was one of Progress Software's stronger-performing products in the second half of 2023 despite issues tied to a zero-day vulnerability discovered last spring, the company said in an earnings call this week. (Cybersecurity Dive)

🔐 Mastercard's chief privacy officer said she's working more closely with her company's cybersecurity team to ensure the company is complying with new regulations and staying ahead of AI advancements. (Wall Street Journal)

@ Hackers and hacks

🇷🇺 A Russia-linked cyber espionage group is advancing beyond phishing emails to using data-stealing malware, researchers at Google warned. (TechCrunch)

🤖 Security researchers have uncovered a flaw in several GPU brands and models found in popular generative AI products. (Wired)

👾 The LockBit ransomware gang claims it stole 5 terabytes of data from Taiwanese semiconductor maker Foxsemicon after briefly hijacking the company's website. (SiliconAngle)

I had a fun surprise over the weekend: When I went to see if another Sam Sabin still owned the domain name samsabin.com, I learned that the website had become a suspicious Chinese-language spam site.

• 📩 Naturally, as any paranoid journalist would, I panic-emailed a go-to domain name researcher, Marcello Salvati, to make sure this was just your run-of-the-mill spam website and nothing to worry out.

The good news: It's probably not about impersonating me specifically.

• Domain ownership records suggest the new owner is a U.S. shell company with ties to China, Salvati found. The Chinese government is known to bulk purchase domains to hold onto down the line, and it seems my name could have gotten wrapped up in one such sweep back in 2022.
• Some of the more than 800 domain names registered to the same person include drinkthiscup.com, longertrip.com and mydreamtools.com.
• Also, it doesn't appear the domain name is attached to any text files that would suggest it's sending emails using the domain in my name — which some nation-state hackers have been known to do.

The not-so-good news: Well, it seems I could soon be in a weird bidding war with suspected Chinese hackers to get my name back — stay tuned! 👀