The United States’ Cybersecurity and Infrastructure Security Agency (CISA) is exploring a protective email service (PES) that can be used to make Federal Civilian Executive Branch (FCEB) email safer. 

In October 2017, the Department of Homeland Security took action against the spoofing of domains and organizations by mandating DMARC or domain-based message authentication, reporting and conformance standards by all federal agencies in its Binding Operational Directive 18-01. 

Now, CISA is asking the cybersecurity industry for feedback on ways to bolster protective email services through threat hunting and incident response. 

Through independent agency the General Services Administration, CISA has released a request for information (RFI) to discover the protective email service capabilities among vendors. 

“One of CISA’s key missions is to protect federal networks and protect the Federal Civilian Executive Branch (FCEB) .gov domain enterprise from threats while strengthening cyber-defenses. To that end, CISA is exploring a Protective Email Service (PES) to execute its mission to protect FCEB email traffic and to conduct threat hunting and incident response,” states CISA in its RFI. 

The objectives of the PES include detecting and preventing federal enterprise email from being used as a vector for malicious threat actors against itself and non-federal entities and the ability to leverage CISA’s and FCEB entity data holdings in cyber-investigation, prevention, mitigation and incident response activities.

The request details three potential approaches to email shielding services along with a set of core and general capabilities. Vendors are asked to outline the risks they face and what they are doing to make email safer and share recommendations. 

“Feedback will assist the government in refining solution design, use cases, and functional requirements, provide insight into scalability of the potential service(s), assist the government in determining industry segmentation by capability and size, and provide insights into the current offerings of PES the federal and corporate landscape in developing a potential acquisition strategy,” stated CISA.

Questions about the RFI must be submitted by 2 pm EST on December 1. The deadline for responses to the RFI is 2 pm EST on December 20.

Private equity firm Clearlake Capital Group LP has agreed to acquire Californian tech company Quest Software from its current owner, Francisco Partners. 

The terms of the planned transaction have not been disclosed. However, Quest has been valued at $5.4bn, including debt, according to unnamed sources quoted by The Wall Street Journal.

A statement announcing the acquisition was released earlier today. It revealed that current CEO of Quest, Patrick Nichols, will remain at the helm after the acquisition has been completed to lead the existing executive management team. 

“IT teams worldwide rely on Quest to help them solve critical challenges that enable business growth and address crucial strategic initiatives. Quest has evolved to become a market leader in identity-centric cybersecurity, data intelligence and IT operations management, and I want to thank Francisco Partners for helping Quest realize this vision,” said Nichols.

“Our new partnership with Clearlake will accelerate Quest’s momentum as a leader and innovator as we increase our investment pace in our core product roadmaps, cloud/SaaS offerings, and global presence. We will continue to expand our customer base as computing environments and related management, modernization, and security challenges, become more complex.”

Quest was founded in 1987 and is headquartered in Aliso Viejo. The company currently has more than 50 offices in 24 countries. 

In 2012, Quest was acquired by computer manufacturer Dell for $2.36bn in a deal that saw the formation of Dell Software. Four years later, Dell sold its software division to Francisco Partners and Elliott Management Corporation.

Quest relaunched itself as the independent company Quest Software in November 2016.

“We are proud of the tremendous progress Quest has made since re-launching as an independent company, and I want to recognize Patrick Nichols and the management team for strong execution,” said Dipanjan Deb, co-Founder and CEO of Francisco Partners. 

Clearlake’s principal, Paul Huber, and one of the firm’s partners, Prashant Mehrotra, said they believe Quest is “well-positioned to capitalize on emerging growth trends in identity-centric cybersecurity, data intelligence and IT operations management software markets.”

The transaction is expected to close in the first quarter of 2022, pending customary regulatory approvals.

A cyber-attack which paralyzed Iran’s gas stations last month was launched by Israeli operatives, as tension between the Middle East rivals continues to escalate, according to a new report.

Two unnamed US defense officials attributed the October 26 attacks to Israel, according to the New York Times. It may have been timed to coincide with nationwide protests in Iran two years ago, which resulted from a hike in fuel prices at the pump.

This time, not only did hackers take thousands of gas stations out of action for nearly two weeks, but they also hijacked billboards in major cities to post messages encouraging citizens to complain to supreme leader Ali Khamenei.

Pumps reportedly had to be reset manually, which accounted for the long delays.

There are also suggestions that the attackers accessed secret government data on international oil sales stored on air-gapped computers – hinting that they may have had inside help.

Just days later, suspected Iranian hackers breached and leaked personal information on hundreds of thousands of Israeli patients and users of LGBTQ site Atraf, which now appears to have been a retaliatory attack.

The sensitive information stored by Atraf could be particularly distressing for victims if leaked, as in some cases, it contained data including HIV status, sexual preferences and nude photos.

It’s unclear whether the Black Shadow group blamed for these attacks is directly state-backed or assembled from freelancers. However, it’s another example of an escalating shadow war between the two countries of which innocent civilians increasingly find themselves in the middle.

The report warned that such escalations might become the norm and expand to the US and its allies if talks to resurrect a nuclear deal with Iran collapse.

Two drug dealers have been sentenced to 18 years behind bars after police eavesdropped on their encrypted communications to build vital evidence against them.

Scott Russo, 31, and 26-year-old Jack Tilbury, both from Essex, were arrested around a year ago as part of Operation Venetic – which was launched after the EncroChat platform popular with organized criminals was cracked by police last year.

The two men reportedly purchased a van with a secret compartment capable of storing up to 30kg of cocaine.

Encrypted messages seen by investigators at the Metropolitan Police and the UK’s National Crime Agency (NCA) showed that Tilbury collected 8kg from a lorry parked in a layby in Kent in June 2020.

The two are then said to have dealt the drugs in large amounts in the local area.

Tilbury was arrested on December 2 last year, at which time officers found 2kg of cocaine under a cot, alongside weighing scales. Russo went on the run but was subsequently arrested eight days later in Southend.

The two are said to have pleaded guilty to drugs offenses at Basildon Crown Court earlier this month and were sentenced on Friday.

Their convictions follow two more in August, stemming from Operation Venetic. Earlier this month, another individual was extradited to Germany where he faces trial on suspicion of serious drugs offenses.

They were made possible after international police cracked EncroChat and intercepted messages sent by its estimated 60,000 users worldwide. It’s still unclear exactly how they did so, although French police were said to have been investigating the platform since 2017.

As of July 2020, nearly 800 individuals had been arrested on suspicion of offenses related to organized crime. In the UK alone, £54m was seized in raids on EncroChat users.

International law enforcers have arrested over 1,000 suspects and seized nearly $27m in criminal funds associated with online fraud and money laundering, according to Interpol.

The global policing organization said its Haechi-II operation took place over four months from June to September 2021, bringing together investigators from 20 countries plus Hong Kong and Macao.

The crackdown allowed police to close 1660 cases and block 2350 bank accounts linked to illegal activity, according to Interpol. That was done in many cases via a new global mechanism piloted during the campaign, known as the Anti-Money Laundering Rapid Response Protocol (ARRP).

In one case, ARRP reportedly led to the rapid interception of $8m headed to Chinese bank accounts after a Colombian textiles firm was defrauded in a sophisticated business email compromise (BEC) scam.

According to Interpol, 94% of the money was blocked in record time, saving the firm from bankruptcy.

“Intercepting the illicit proceeds of online financial crimes before they disappear into the pockets of money mules is a race against time and we have worked closely with the attorney general’s office to move as decisively as possible,” said Jorge Luis Vargas Valencia, director general of the Colombian National Police.

The operation also targeted criminals engaged in romance scams, investment fraud and other types of online fraud, revealing ten new criminal modus operandi to investigators.

In one case, police in Colombia requested a Purple Notice — an intra-police information sharing system — after coming across mobile malware disguised as popular Netflix show “Squid Game.” The malicious code was designed to harvest financial information and subscribe to premium services without the user’s knowledge.

“Online scams like those leveraging malicious apps evolve as quickly as the cultural trends they opportunistically exploit,” said José De Gracia, assistant director of criminal networks at Interpol.

“Sharing information on emerging threats is vital to the ability of police to protect the victims of online financial crime. It also lets police know that no country is alone in this fight. Operation Haechi-II shows that we can successfully strike back against this threat when we act together.”

The campaign is part of a three-year Interpol initiative to crack down on financial crime, sponsored by South Korea. It follows the Haechi-I operation, which led to the arrest of 585, the closure of over 1600 bank accounts and the seizure of $83m in funds headed to suspected criminals.