Deputy National Security Adviser for Cyber Anne Neuberger is traveling to Europe today for a week of meetings with U.S. partners on cyber issues, including the defense of Ukraine, senior administration officials told reporters.
Neuberger will start in Brussels w/ meetings w/ EU counterparts & NATO officials on cyber resilience, a sr admin official said, "including deterring, disrupting, and responding to further Russian aggression against Ukraine, neighboring states, and in our respective countries."
After Brussels, Neuberger will travel to Warsaw for meetings with Polish officials and reps from Baltic govts.
She'll also meet with reps from the "Bucharest Nine" group of eastern NATO allies, and she'll meet virtually with French and German officials.
Goal is to ensure that U.S. and partners "are prepared for any cyber-related contingency and prepared to respond in the current environment," SAO said.
They'll also discuss "how we will coordinate and support Ukraine, and each other, in the event that cyberattacks occur."
U.S. has been "working closely with Ukrainians to harden their defenses, and we will continue to do so," SAO said.
At the same time, "we are realistic about what we can achieve, and also focused on ensuring we have incident response capacity available to them, if needed."
The Biden administration has been discussing cyber incident response support with European allies, in case they need to collectively surge resources to help Ukraine respond to cyberattacks from Russia, the SAO said.
SAO: "While there are not currently any specific credible threats to the U.S. homeland, we are mindful of the potential for Russia to consider escalating its destabilizing actions in ways that may impact others outside of Ukraine."
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Attacks targeted Ukraine, Lithuania, Latvia, Poland, and Germany, as well as Belarusian journalists and dissidents.
In research presented at @CYBERWARCON, Mandiant said it's attributing these attacks to Belarus based on technical evidence and the fact that the targets are "most consistent with Belarusian interests."
Some Belarusians targeted before disputed 2020 election were later arrested.
Mandiant said it had “sensitively sourced technical evidence” that the operation was based in Minsk, as well as “separate technical evidence” specifically linking the Belarusian military to the campaign.
New: FBI Cyber Division chief Bryan Vorndran told House Oversight in written statement for the record that Biden admin is “troubled” that cyber incident reporting mandate doesn’t set up simultaneous reporting to CISA *and* FBI.
Going beyond what he said at the still-ongoing hearing, Vorndran's statement says the current legislation “fails to recognize the critical expertise and role” of DOJ/FBI.
Both CISA and the FBI “should immediately receive all information mandated to be reported,” Vorndran wrote.
Needless to say, this could throw a wrench into the plan to pass the painstakingly crafted incident reporting mandate that is in the House NDAA and is expected to be folded into the Senate NDAA soon.
I've asked the legislation's sponsors if they'll rework the provisions.
New: The hackers behind a watering-hole campaign against targets in the Middle East may be using software from the Israeli spyware firm Candiru, recently targeted by U.S. export restrictions, according to @ESET: subscriber.politicopro.com/article/2021/1…
In research being presented today at @CYBERWARCON, ESET experts say an IP address linked to Candiru in a recent @citizenlab report has ties to two of the malicious domain names in the watering-hole attacks.
These watering-hole attacks spoofed websites of Yemen’s parliament & interior ministry, Iran’s foreign ministry, Syria’s electricity ministry, @MiddleEastEye, and Hezbollah-linked TV channels.
Fake sites delivered malware that exploited web browser vulnerabilities.
The House Oversight Committee is about to convene a hearing on ransomware attacks with @ncdinglis, CISA's Brandon Wales, and FBI's Bryan Vorndran: oversight.house.gov/legislation/he…
📅🎂🎉 It's @CISAgov's third birthday. "Cyber is, to a large extent, where it's at nowadays," then-President Donald Trump said as he signed the CISA establishment bill into law. subscriber.politicopro.com/article/2018/1…
@CISAgov Two years and one day after creating CISA (i.e. one year ago tomorrow), Trump fired CISA's director, @C_C_Krebs, for debunking his election fraud lies, throwing CISA into the partisan Trump-era turmoil that it had successfully avoided since its creation. politico.com/news/2020/11/1…
A year after Krebs' firing, CISA is on firmer footing and playing a key role in the implementation of Biden's sweeping cyber EO.
Just this morning, CISA released EO-mandated "playbooks" to guide agencies' responses to vulnerabilities and cyberattacks. cisa.gov/news/2021/11/1…
Scoop: Senate HSGAC is working on a bill that combines the House's industry-friendly cyber incident reporting legislation w/ a bunch of programs to tackle ransomware.
Raises Qs about what happens to Warner/Rubio/Collins bill, which industry doesn't like.
* The House Homeland incident reporting legislation, with some tweaks and additions
* "Due diligence requirement" for companies facing ransom demands
* Ransomware task force
* "Ransomware vulnerability warning pilot program"
Due diligence req:
Before paying a ransom, a company would have to determine whether it could recover from the attack “through other means,” including by seeing if experts have published a decryption tool that works for them.