The US and Israel yesterday announced a new bilateral partnership designed to tackle ransomware.

The move comes as part of the new US-Israeli Task Force launched on Sunday slated to cover Fintech Innovation and Cybersecurity more broadly.

Its participants are currently working on a Memorandum of Understanding (MoU) to support joint activities, including information sharing in threat intelligence, security guidance and regulations.

Also mooted are staff training, study visits and cross-border competency-building initiatives such as cybersecurity exercises linked to finance and investment flows.

The task force will launch a series of technical exchanges on policy, regulation and outreach to ensure robust cybersecurity is built into fintech innovation early. It will also work on advancing compliance with anti-money laundering, counter-terrorist financing and nuclear proliferation financing.

There were very few details on how the two countries plan to tackle ransomware specifically, even though the Treasury trumpeted this as the headline aspect of the new bilateral agreement.

“Harnessing both the power of international cooperation and of technology innovation will position us to support economic competitiveness, prosperity and to combat global threats including ransomware,” said deputy secretary of the Treasury, Wally Adeyemo.

“As the global economy recovers and ransomware and other illicit finance threats present a grave challenge to Israel and the US, increased information exchanges, joint work and collaboration on policy, regulation, and enforcement are critical to our economic and national security objectives.”

The deal comes just weeks after a virtual Counter-Ransomware Initiative hosted by the White House last month and attended by representatives from the EU and 30 other countries, including Israel.

While the US is regularly touted as the number one target for ransomware actors, Israel is coming under increasing fire from its rivals in the Middle East.

In May, multiple companies were hit by suspected Iranian group ‘Networm,’ while earlier this month, another Tehran-backed outfit, BlackShadow, leaked sensitive data from hundreds of thousands of medical patients and members of an online LGBTQ collective.

The US authorities have released a new industrial control systems (ICS) alert urging impacted organizations to patch key middleware or risk denial of service and remote code execution attacks.

The Cybersecurity and Infrastructure Security Agency (CISA) pointed to a series of vulnerabilities impacting open-source and proprietary implementations of the Object Management Group (OMG) Data-Distribution Service (DDS).

The bugs are found in multiple vendors’ equipment: CycloneDDS, FastDDS, GurumDDS, OpenDDS, Connext DDS Professional, Connext DDS Secure, Connext DDS Micro, and CoreDX DDS.

“CISA is issuing this advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks,” it said. “Successful exploitation of these vulnerabilities could result in denial-of-service or buffer-overflow conditions, which may lead to remote code execution or information exposure.”

While the affected products have been updated by most of the vendors, CISA warned that it had not yet received a response from Korean firm Gurum Networks, and urged impacted customers to contact it directly.

As well as apply the relevant patches, organizations were also told to air-gap ICS devices and systems, or at least to isolate them from business networks and place them behind a firewall. VPNs were also recommended for secure remote access.

CISA’s readiness to alert ICS customers about security flaws can be linked to the Biden administration’s focus on enhancing critical national infrastructure security across the US.

The risk to such systems has increased as they’ve acquired connectivity. This is increasingly important from an operational perspective, especially with many employees working remotely, but also opens the door to remote attackers.

Patching can also be problematic in these industrial environments as control systems are business-critical and therefore difficult to take offline while updates are tested.

Among the OMG DDS vulnerabilities highlighted by CISA were stack- and heap-based buffer overflow, amplification, write-what-where condition, and improper handling of syntactically invalid structure/length parameter inconsistency.

The FBI has fixed a misconfigured web portal that allowed hacktivists to send thousands of fake emails to recipients.

News emerged over the weekend that individuals were receiving emails purporting to come from the Department of Homeland Security (DHS) Network and Analysis Group, but which had been sent from a @ic.fbi.gov account.

According to screenshots shared on Twitter, they warned of “exfiltration of several of your virtualized clusters in a sophisticated chain attack” — blaming a noted security researcher for the ‘attack.’

In an update on Sunday, the Feds claimed a software configuration error allowed the actor to temporarily hijack the agency’s Law Enforcement Enterprise Portal (LEEP) to send the emails.

“LEEP is FBI IT infrastructure used to communicate with our state and local law enforcement partners. While the illegitimate email originated from an FBI-operated server, that server was dedicated to pushing notifications for LEEP and was not part of the FBI’s corporate email service,” it explained.

“No actor was able to access or compromise any data or PII on the FBI’s network. Once we learned of the incident, we quickly remediated the software vulnerability, warned partners to disregard the fake emails, and confirmed the integrity of our networks.”

The scam spam run appears to have been an attempt to troll security researcher Vinny Troia, claiming that he was responsible for the non-existent attacks and colluded with extortion gang TheDarkOverlord.

Troia shared screenshots indicating that the weekend spam run was likely the work of an individual linked to the @pompompur_in Twitter account. 

In one exchange of messages he shared, the Twitter user expressed dismay that Troia’s account had accrued more followers because of the incident.