Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Netflix will air NFL’s Christmas games, a major step for streaming service

Sam Feist, longtime CNN executive, will become CEO of C-SPAN

Michael Cohen testimony ties Donald Trump to hush money payment

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

Best Places to Work in the Federal Government 2023

A hō’ike in Virginia celebrates Hawaiian life

Think you can build a gold-medal U.S. gymnastics team? Try it.

The 34 best things to do in D.C. this weekend and next week

Rating every game on the Commanders’ 2024 schedule

8 best things to do with kids in the D.C. area this weekend 

Look to the cloud to protect the life documents saved on your computer

Can you spot bad financial advice on TikTok? Take our quiz.

5 myths about Social Security as the program faces a funding crisis

Voters key to past Democratic wins are skeptical and undermotivated

Trump’s ‘they’re out to get me’ campaign and its enablers

Biden campaign accepts invite to a vice-presidential debate 

Senators studied AI for a year. Critics call the result ‘pathetic.’

Cruise settles with person dragged under one of its robotaxis

Google’s AI answers could come back to bite it

6 Airbnb red flags to spot before you make a booking mistake

Cruise ships to return to Baltimore two months after bridge collapse 

Some cruise prices are about to get a little more clear

Carolyn Hax: Fiancé plans to have a baby with someone else

Ask Amy: I’m scared of my adult stepson who keeps losing his temper

Ask Sahaj: I live with my parents and generational trauma ‘runs the house’

Who is Robert Fico? What to know about Slovakia’s leader who was shot.

Middle East conflict live updates: U.S.-built pier anchored in Gaza; ICJ hears Rafah is ‘endgame’ in Gaza destruction

Slovakia’s Fico in serious condition; suspect charged with attempted murder

The Post’s choices in Northern Virginia’s U.S. House primaries

States see legalized sports betting as a tax windfall — but at what cost?

Haiti’s plight is a case study in the ‘responsibility to protect’

President Joe Biden Joint Chiefs and Combatant Commanders 

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! We won’t publish Monday for the Juneteenth holiday. That means we’ll see you next on Tuesday, when I’ll be one year older (and hopefully wiser).

Was this forwarded to you? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/">Sign up here.</a>

Below: An unlikely duo reportedly considers purchasing NSO’s assets, and the E.U. bans equipment made by Chinese telecom companies from its internal networks. First:

Clop’s exploitation of the MOVEit vulnerability claims government victims

Chris Ratcliffe

The <a href="https://www.washingtonpost.com/politics/2023/06/07/cyberdefenders-respond-hack-file-transfer-tool/">wait is over</a> for the big fallout to arrive from a ransomware gang mass-exploiting a vulnerability in the MOVEit Transfer file-sharing tool. And U.S. government agencies are on the growing victim list.

That fallout is pretty mixed, overall. There are worrisome elements to some of what’s happening, but there are also reasons to think things aren’t as bad as other similar, past incidents, according to cybersecurity experts and authorities.

A senior Cybersecurity and Infrastructure Security Agency official said that only a “small number” of U.S. agencies have been impacted by an attack campaign likely carried out by the ransomware gang known alternately as Clop or Cl0p. And CISA Director Jen Easterly said the hackers didn’t appear to acquire “specific, high-level information” from the agencies.

On the other hand, those government compromises reportedly include a government-managed radioactive waste storage site, and the known victim count beyond government agencies was at approximately 50 as of Thursday night, <a href="https://twitter.com/BrettCallow/status/1669492225296977921">by one count</a> — with the hackers saying they had hundreds of victims. And there’s a chance that other hackers might have exploited, or might soon exploit, the vulnerability.

And that’s only part of the implications — which span the not-so-bad, worse and less clear.

In terms of severity, Easterly told reporters, the attacks don’t compare to one of the biggest to hit federal agencies — the SolarWinds campaign <a href="https://www.washingtonpost.com/politics/2021/03/18/cybersecurity-202-senate-panel-delves-into-solarwinds-hack/">discovered in 2020</a>. “Although we are very concerned about this campaign … this is not a campaign like SolarWinds that presents a systemic risk to our national security,” she said Thursday.

A U.S. official speaking on the condition of anonymity because of the matter’s sensitivity said agencies have been aware of the issue for weeks and have taken steps to mitigate it. The senior CISA official said they weren’t aware of any agencies currently running unpatched versions of MOVEit at the moment. (CISA ordered federal agencies to patch the software around two weeks ago.)

There also isn’t evidence of the Russian-speaking Clop gang coordinating with Moscow, the CISA official said. And the official wasn’t aware of any impact on U.S. military branches or the intelligence community at this time. Sean Lyngaas of CNN <a href="https://www.cnn.com/2023/06/15/politics/us-government-hit-cybeattack/index.html">first reported</a> that government agencies were affected.

Clop has said it will delete any government data. That’s a sign that ransomware gangs are scared of drawing government attention, said Tom Bossert, the former homeland security adviser in President Donald Trump’s White House.

“The aggressive takedowns of ransomware groups by the U.S. government appears to be having a positive effect,” Bossert, now president and chief strategy officer at the Trinity Cyber firm, told me. “They’re so afraid they’d be taken down, that they put out a statement.”

Easterly referred to the attack as “opportunistic,” something that Chris Yule, director of threat research at the cyber company Secureworks’ Counter Threat Unit, backed up in an email.

“This attack took place by mass-exploiting vulnerable systems, so was opportunistic in nature — it’s unlikely the group has purposely targeted government agencies,” he told me. “They’ve promised to not publish any government data they may have inadvertently got their hands on and so are unlikely to make any money from it. But even if they don’t publish it publicly, the data is still in the wrong hands and that will be a concern for those impacted organizations.”

Of course, it’s never great when hackers are hitting big, important targets. But some parts of the MOVEit story make it especially bad.

Progress Software, the company that makes MOVEit, <a href="https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023">revealed another critical vulnerability</a> on Thursday.

If Clop is exploiting the vulnerability, then it’s probable U.S. cyber adversaries like the governments of China, Iran, North Korea and Russia are exploiting it too, Bossert said. “Our most sophisticated adversaries most likely, almost assuredly, used it to gain and keep access, a kind of beachhead into our critical networks,” he said.

The two known U.S. government victims are at the Energy Department, <a href="https://federalnewsnetwork.com/cybersecurity/2023/06/energy-department-among-several-federal-agencies-hit-by-moveit-breach/">one of which</a> is reportedly the radioactive waste site that <a href="https://www.bloomberg.com/news/articles/2023-06-15/us-national-lab-nuclear-waste-site-hit-by-cyberattack?sref=Vi7wu7Hv#xj4y7vzkg">the department manages</a>.

“The U.S. Department of Energy (DOE) takes cybersecurity and the responsibility to protect its data very seriously,” spokesperson Chad Smith said via email.

“Upon learning that records from two DOE entities were compromised in the global cyberattack on the file-sharing software MOVEit Transfer, DOE took immediate steps to prevent further exposure to the vulnerability and notified” CISA, Smith continued. “The Department has notified Congress and is working with law enforcement, CISA, and the affected entities to investigate the incident and mitigate impacts from the breach.”

The hackers are asking for an awful lot of money, <a href="https://twitter.com/cglyer/status/1669150711441915906">tweeted Christopher Glyer</a>, principal security researcher at Microsoft Threat Intelligence.

The list of known victims keeps growing to include big organizations like <a href="https://www.baltimoresun.com/maryland/baltimore-city/bs-md-ci-johns-hopkins-hospital-university-data-breach-20230615-jzew75i24ffynivcenegtc3dda-story.html">Johns Hopkins University</a>, <a href="https://therecord.media/shell-impacted-in-clop-ransomware-attack">Shell</a> and <a href="https://www.bbc.com/news/technology-65877210">Ernst &amp; Young</a>. And Clop has <a href="https://www.bleepingcomputer.com/news/security/clop-ransomware-gang-starts-extorting-moveit-data-theft-victims/">begun extorting its victims</a>.

Sometimes it’s a bit of a mystery whether something is going badly or well. In early June, the cyber firm Censys found 3,000 MOVEit hosts exposed to the internet. About a week later, it had dropped to 2,600. Censys also <a href="https://censys.io/moveit-an-industry-analysis/">broke down those numbers</a> by industry and geography.

“The thinking there is, maybe some of them got attacked and were pulled offline,” Emily Austin, a researcher at the company, told me. “Maybe some of those were mitigation moves. We don’t exactly know the breakdown there.”&nbsp;

And maybe the fallout isn’t entirely over yet, either. Said Austin: “It doesn’t seem like maybe the worst we’ve ever seen, but I think we haven’t seen the worst of it yet.”

Ellen Nakashima contributed to this report.

Russian national arrested, charged for role in LockBit ransomware attacks

Andrew Harnik

A Russian national was <a href="https://www.justice.gov/opa/pr/russian-national-arrested-and-charged-conspiring-commit-lockbit-ransomware-attacks-against-us">arrested</a> in Arizona and charged with participating in notorious LockBit ransomware attacks against victims in the United States and around the world, <a href="https://cyberscoop.com/lockbit-russian-national-arrested/">AJ Vicens reports for CyberScoop</a>.

Ruslan Magomedovich Astamirov, 20, was taken into custody Wednesday, according to the outlet. The announcement marks the third instance of a Russia-affiliated individual arrested in connection to LockBit activities.

“LockBit, which emerged in January 2020, was the most active ransomware variant in 2022 in terms of victims claimed on the group’s data leak site,” the report says, citing <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a">a June 14 advisory</a> from the CISA.&nbsp;

“Astamirov’s case will be tried out of New Jersey, which is handling the cases of two other men accused of participating in LockBit ransomware attacks: Mikhail Vasiliev, a dual Russian and Canadian national, was arrested in November, and Mikhail Pavlovich Matveev, also known as Wazawaka, was indicted in May for alleged roles in LockBit attacks along with other cyber activities,” Vicens writes.

“The LockBit conspirators and any other ransomware perpetrators cannot hide behind imagined online anonymity. We will continue to work tirelessly … to identify ransomware perpetrators and bring them to justice,” U.S. Attorney Philip R. Sellinger for the District of New Jersey said in a statement.&nbsp;

Hollywood producer and gum magnate mulling purchase of NSO assets

Sebastian Scheiner

A Hollywood producer and a gum magnate are considering purchasing notorious Israeli spyware firm NSO Group’s assets, <a href="https://www.theguardian.com/us-news/2023/jun/14/nso-group-spyware-pegasus-takeover">Stephanie Kirchgaessner reports for the Guardian</a>.

“Robert Simonds, a US financier whose credits include producing several Adam Sandler films, has been engaged in talks to acquire the blacklisted spyware company’s assets,” the report says, citing people familiar with the matter.

Additionally, Kirchgaessner writes: “A firm owned by Simonds’s friend, William ‘Beau’ Wrigley — who was an heir to his family’s chewing gum fortune and has since become involved in the cannabis industry — has conducted due diligence in connection to a possible NSO deal, according to a document seen by the Guardian.”

After it published its story on the potential deal, a Wrigley spokesperson told the Guardian that “Mr Wrigley evaluates many opportunities, all of which are strictly confidential. Mr Wrigley is not pursuing an investment in NSO.”

An NSO spokesperson said they were not aware of the plans, according to the report. Simonds didn’t respond to the outlet’s request for comment.

The development is one of several in which entities, including <a href="https://www.theguardian.com/world/2022/jun/14/nso-group-pegasus-us-l3harris">U.S. defense contractors</a>, have considered taking ownership of the company.

NSO last month underwent a lender-forced ownership change that aimed to keep the company operating despite immense global scrutiny, including <a href="https://www.washingtonpost.com/technology/2021/11/03/pegasus-nso-entity-list-spyware/?itid=lk_inline_manual_70">being blacklisted by the U.S.</a>, the Wall Street Journal <a href="https://www.wsj.com/articles/israeli-cyber-company-nso-group-has-new-ownership-after-u-s-blacklist-a2cda00a">previously reported</a>.

The development comes as Hanan Elatr, the wife of murdered journalist Jamal Khashoggi, sued NSO alleging the group infected her phone with the spyware to track her late husband, our colleague Dana Priest <a href="https://www.washingtonpost.com/technology/2023/06/15/khashoggi-nso-widow-lawsuit/">reports</a>.

It also comes amid scrutiny of spyware around the world. The E.U. on Thursday <a href="https://www.europarl.europa.eu/news/pt/press-room/20230609IPR96217/spyware-meps-call-for-full-investigations-and-safeguards-to-prevent-abuse">adopted a resolution</a> on spyware investigations and abuse.

E.U. bans Chinese telecom equipment from internal networks

Julien Warnand

The E.U. will ban equipment made by Chinese telecom companies Huawei and ZTE from its internal communications networks,<a href="https://www.bloomberg.com/news/articles/2023-06-15/eu-takes-more-aggressive-stance-on-huawei-as-china-tensions-rise"> Jillian Deutsch and Thomas Seal report for Bloomberg News</a>.

Deutsch and Seal write: “As part of an effort to crack down on Chinese equipment in critical infrastructure, European Union’s executive arm urged countries to phase out high-risk vendors” from telecom networks, according to<a href="https://ec.europa.eu/commission/presscorner/detail/en/IP_23_3309"> guidelines published Thursday</a>.

Huawei said it “strongly opposes and disagrees” with the E.U. announcement, which it said was “clearly not based on a verified, transparent, objective and technical assessment of 5G networks,” <a href="https://www.politico.eu/article/huawei-slams-commission-5g-report/">Politico Europe’s Antoaneta Roussi reports</a>.

The move comes as the E.U. faces increased pressure from U.S. counterparts to take a tougher stance on China, the report notes. The U.S. has previously<a href="https://docs.fcc.gov/public/attachments/DOC-365255A1.pdf"> taken action</a> against Huawei and ZTE, claiming they pose a security threat and could enable Chinese officials to conduct espionage or disrupt networks. The companies deny the allegations.

Meanwhile, the European Union’s industry chief, Thierry Breton, on Thursday urged more E.U. nations to join in restricting or banning the companies,<a href="https://www.reuters.com/business/media-telecom/eu-countries-decision-ban-huawei-zte-networks-justified-eus-breton-says-2023-06-15/"> Foo Yun Chee reports for Reuters</a>.

“To date, only 10 of them have used these prerogatives to restrict or exclude high-risk vendors,” Breton said in a news conference. “This is too slow, and it poses a major security risk and exposes the Union’s collective security, since it creates a major dependency for the E.U. and serious vulnerabilities.”

<a href="https://www.azcentral.com/story/news/politics/elections/2023/06/15/cyber-ninjas-texts-show-ceo-doug-logan-close-ties-trump-lawyer-christina-bobb/70314325007/" target="_blank">Cyber Ninjas CEO traded nearly 2,000 texts with current Trump lawyer on 'audits,' money (AZ Central)</a>

<a href="https://therecord.media/proposed-sec-cyber-rules-benefit-cybersecurity-community" target="_blank">Proposed SEC cyber rules would benefit ‘overall health of the cybersecurity ecosystem,’ report says (The Record)</a>

<a href="https://www.bloomberg.com/news/articles/2023-06-15/applied-materials-accuses-china-owned-rival-of-14-month-spy-spree?srnd=technology-vp" target="_blank">Top US chip gearmaker accuses China rival of 14-Month spy spree (Bloomberg News)</a>

<a href="https://www.businessinsider.com/ex-grindr-privacy-chief-company-shared-user-data-billions-nudes-2023-6" target="_blank">Grindr's ex-privacy chief accused top executives of shrugging off system bugs that retained 'billions' of user photos (Insider)</a>

<a href="https://www.washingtonpost.com/national-security/2023/06/15/jack-teixeira-indicted-discord-leaks/" target="_blank">Leak suspect indicted on new counts of mishandling classified material (Devlin Barrett and Shane Harris)</a>

<a href="https://apnews.com/article/barracuda-mandiant-cybersecurity-china-hackers-a52d1595c9108d2c58df11e38756600d" target="_blank">Chinese spies breached hundreds of public, private networks, security firm says (The Associated Press)</a>

<a href="https://www.bleepingcomputer.com/news/security/rhysida-ransomware-leaks-documents-stolen-from-chilean-army/" target="_blank">Rhysida ransomware leaks documents stolen from Chilean Army (Bleeping Computer)</a>

<a href="https://www.reuters.com/technology/new-zealands-smartpay-experiences-ransomware-attack-2023-06-16/" target="_blank">New Zealand's Smartpay hit with ransomware in latest antipodean cyberattack incident (Reuters)</a>

<a href="https://www.reuters.com/world/south-korea-us-hold-high-level-meeting-cyber-security-2023-06-16/" target="_blank">South Korea, U.S. to hold high-level meeting on cyber security (Reuters)</a>

<a href="https://fcw.com/congress/2023/06/relaunched-electric-grid-caucus-plans-highlight-security-tech-improvements/387590/" target="_blank">Relaunched electric grid caucus plans to highlight security, tech improvements (Federal Computer Week)</a>

Chetrice Mosley-Romero will conclude her service as Indiana’s first cybersecurity program director — effective June 19 — and will join CISA as the first cybersecurity state coordinator for Indiana.

Former Undersecretary of Defense for Intelligence Michael Vickers speaks at a Center for Strategic and International Studies event on <a href="https://www.csis.org/events/lessons-us-intelligence-and-special-operations">U.S. intelligence operations</a> at noon.

Thanks for reading. See you next week.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

George Washington University, BBA in business analytics

Georgetown University, MS in business analytics

David DiMolfetta researches The Cybersecurity 202 and The Technology 202, the morning newsletters at The Washington Post keeping readers up to date on cybersecurity and technology policy.

David DiMolfetta

washpost

The Washington Post

Relentless Hacking Is Turning All of Us Into Data Nihilists

Bloomberg

name

prism://prism.query/site-and-tag,/politics/powerpost,cybersecurity202&limit=20

Your daily guide to cybersecurity news and policy, by reporter Joseph Marks.

The Cybersecurity 202

A newsletter briefing on cybersecurity news and policy.

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/primary/cybersecurity.svg

https://newsletter-imgs.s3.amazonaws.com/prod/the-202s/secondary/cybersecurity.svg

Your daily guide to cybersecurity news and policy, by reporter Tim Starks.

prism://prism.query/site,/us-policy/cybersecurity-policy&limit=20

Cybersecurity Policy

prism://prism.query/site,/politics/powerpost&limit=20

The 202s

The 202s - The Washington Post

PowerPost, by The Washington Post, delivers essential intelligence for D.C. decision-makers.

THE 202s

/politics/powerpost/the-cybersecurity-202

The Cybersecurity 202;Cybersecurity Policy;THE 202s