person holding black iphone 5 — Photo by Privecstasy on Unsplash

According to five people familiar with the situation, the U.S. government has pushed new, increased funding into three VPN companies, nthLink, Psiphon, and Lantern, since the start of the Ukraine war to help Russians sidestep censors and access Western media.

A U.S. government-funded nonprofit organization, the Open Technology Fund (OTF), gave the VPN companies at least $4.8 million in U.S. funding between 2015 and 2021. However, the sources say that since February, the total funding allocated to the companies has increased by almost half in order to cope with the rise in demand in Russia. The funding flows through the U.S. Agency for Global Media (USAGM), a federal agency that oversees U.S. government-backed broadcasters, including Voice of America and Radio Free Europe/Radio Liberty, as well as via the Washington-based OTF, which is funded entirely by the U.S. government and overseen by the USAGM.

Posters advertising nthLink and other U.S.-government-backed VPNs, as well as independent Russian-language media outlets, have appeared in Moscow since the start of the war, according to three people familiar with the matter. (James Pearson and Chris Bing / Reuters)

Ivana Stradner 🇺🇦 @ivanastradner

Since Putin introduced his draconian law that censors social media, I’ve been writing and advocating for 🇺🇸 support for VPN in Russia to bypass 🇷🇺 censorship. God bless America. Next step: provide more info on Tor (many ppl still don’t know about it there) reuters.com/world/exclusiv…

Exclusive: U.S. targets Russia with tech to evade censorship of Ukraine newsThe U.S. government has pushed new, increased funding into three technology companies since the start of the Ukraine conflict to help Russians sidestep censors and access Western media, according to five people familiar with the situation.reuters.com

A new model for revolutionary groups seeking to wage asymmetrical warfare is emerging in Belarus with the opponents of the authoritarian government of Alexander Lukashenko, including a group that fashions themselves as the Cyber Partisans, finding new ways to wage asymmetrical warfare.

Lukashenko’s opponents started by breaking into the websites of the government and state news agencies. Since then they’ve begun to branch into cyberattacks that result in physical damage, a type of activity long the preserve of nation-states. The Cyber Partisans brought down the train system in Belarus with a ransomware attack shortly after Russia started sending troops through the country. Now they and other Belarusian dissidents see their fight as a mission against both Lukashenko and Russian President Vladimir Putin. (Ryan Gallagher / Bloomberg)

Pavel Latushka @PavelLatushka

”Cyber Partisans @cpartisans exert huge pressure on the Lukashenko regime”. Read my & other comments in the Bloomberg @business article ⬇️ Bloomberg - Are you a robot?bloom.bg

Since the end of May, the 280,000 people living in the occupied port city of Kherson in Ukraine and surrounding areas have faced constant online disruptions as internet service providers are forced to reroute their connections through Russian infrastructure.

Multiple Ukrainian ISPs are now forced to switch their services to Russian providers and expose their customers to the country’s vast surveillance and censorship network, according to senior Ukrainian officials and technical analysis. Moreover, as an additional step in the “Russification” of Ukraine, new unbranded mobile phone SIM cards using Russian numbers are being circulated in the region, further pushing people towards Russian networks. At the heart of the rerouting is Miranda Media, the operator in Crimea that appeared following the region’s annexation in 2014. Among “partners” listed on its website are the Russian security service known as the FSB and the Russian Ministry of Defense. (Matt Burgess / Wired)

780th Military Intelligence Brigade (Cyber) @780thC

Since the end of May, the 280,000 people living in the occupied port city and its surrounding areas have faced constant online disruptions as internet service providers are forced to reroute their connections through Russian infrastructure. wired.com/story/ukraine-… @WIRED

Russia Is Taking Over Ukraine’s InternetIn occupied Ukraine, people’s internet is being routed to Russia—and subjected to its powerful censorship and surveillance machine.wired.com

In preparation for the Supreme Court’s looming repeal of its landmark Roe v. Wade decision, Senator Elizabeth Warren (D-MA) has announced sweeping legislation, the Health and Location Protection Act, to ban the sale of location and health data.

Cosponsored by a slate of Democratic senators, including Senators Bernie Sanders (I-VT) and Ron Wyden (D-OR), the legislation would bar “data brokers from selling or transferring location data and health data.” There are few limitations, making the bill one of the most strict proposals aimed at regulating data sales. The bill would empower the Federal Trade Commission, state attorneys general, and people hurt by an unlawful data sale to sue brokers found to have violated the law. The FTC would also receive an additional $1 billion over the next decade to aid in enforcing the law. (Makena Kelly / The Verge)

Related: The Record, Insider, The Hill, Yahoo!, Warren.Senate.gov

Elizabeth Warren @SenWarren

Data brokers rake in huge profits by collecting & selling Americans' sensitive data, including the location data of people visiting abortion clinics. With the Supreme Court poised to overturn Roe, I’ve got a new bill to protect Americans’ right to privacy.

Sweeping Legislation Aims to Ban the Sale of Location DataThe Health and Location Data Protection Act comes after Motherboard reported that brokers were selling location data on people visiting abortion clinics. The bill would give the FTC and individual people power to curb some of the worst abuses of such datavice.com

A joint investigation by Reveal, The Center for Investigative Reporting, and The Markup shows that Facebook is collecting ultra-sensitive personal data about abortion seekers and enabling anti-abortion organizations to use that data as a tool to target and influence people online, in violation of its own policies and promises.

Meta, Facebook’s parent company, prohibits websites and apps that use Facebook’s advertising technology from sending Facebook “sexual and reproductive health” data. But, using Blacklight, a Markup tool that detects cookies, keyloggers, and other types of user-tracking technology on websites, Reveal analyzed the sites of nearly 2,500 so-called “crisis pregnancy centers” with data provided by the University of Georgia and found that at least 294 shared visitor information, often highly sensitive information, with Facebook.

Crisis pregnancy centers pretend to help desperate pregnant people but are false fronts for anti-choice organizations hoping to steer those people away from abortions. Facebook spokesperson Dale Hogan said: “It is against our policies for websites and apps to send sensitive information about people through our Business Tools,” which includes its advertising technology. (Grace Oldham and Dhruv Mehrotra / Reveal)

Related: Gizmodo

Jeff Stone @jeffstone500

Facebook collects ultra-sensitive data about abortion seekers, enabling anti-abortion orgs to use that data as a tool to target and influence people online, in violation of its own policies and promises. Must-read @reveal @themarkup investigation.

Facebook and Anti-Abortion Clinics Are Collecting Highly Sensitive Info on Would-Be Patients - RevealThe social media giant gathers data from crisis pregnancy centers through a tracking tool that works whether or not a person is logged in to their Facebook account.revealnews.org

Eva @evacide

If you're one of those people who is working at Facebook hoping to change things from the inside, this is the thing you should be changing right now.

The Real Facebook Oversight Board @FBoversight

🔴 A joint investigation by the @themarkup with @reveal shows how "Facebook is collecting ultrasensitive personal data about abortion seekers" https://t.co/X0nFQV1wf1

The FBI used cell tower data earlier this year to link seven bank robberies in five states to a phone number used by a suspect named Fernando Enriquez and possible associates.

After cross-checking the phone number and the name with other police databases, the agency used that information to retrieve email addresses and Google, Instagram, and TikTok accounts belonging to Enriquez. The FBI said the email and social media account information unearthed a photo on TikTok of Enriquez standing in front of a Chevrolet SUV that resembled the getaway vehicle. Photographs also showed tattoos that appeared to match those from bank surveillance footage.

Based on this case, it appears the FBI believes it can get all kinds of information from Bytedance-owned TikTok, from messages to videos to location data, even if deleted by TikTok users. An FBI employee wrote in the Enriquez search warrant that “even if ... content is removed, locked or deleted, often social media companies retain the data on their information systems.” TikTok, the agent wrote, “appears to store data that has been made private, locked or deleted by users.” (Thomas Brewster / Forbes)

Alan Woodward @ProfWoodward

People still don’t understand the difference between deleted and erased in an IT context as explained by @iblametom

Your Deleted TikTok Content Can Still Be Used Against You By The FBISocial media companies in general aren’t clear on how long they keep information users thought they’d deleted, but TikTok is less transparent than others. Law enforcement is ready to take advantage.forbes.com

Researchers at Lookout detailed a previously unknown form of enterprise-grade Android surveillance ware, dubbed Hermit, that is being used by the government of Kazakhstan.

Hermit is believed to have been developed by Italian spyware vendor RCS Lab S.p.A. and Tykelab Srl. RCS Lab is a developer that is known to have past dealings with Syria and operates in the same market as NSO Group. The discovery of Hermit is said to be the first time a current client of RCS Lab’s mobile spyware has been publicly identified. (Duncan Riley / Silicon Angle)

Related: Lookout

Thomas Brewster @iblametom

Only illness prevented me from covering this excellent Lookout report on Android malware allegedly made by RCS Lab, an Italian spyware developer

Lookout Uncovers Android Spyware Deployed in KazakhstanLookout Threat Lab researchers have uncovered enterprise-grade Android surveillanceware used by the government of Kazakhstan within its borders. Based on our analysis, the spyware is likely developed by Italian spyware vendor RCS Lab S.p.A.lookout.com

Cisco told customers this week to patch a critical vulnerability (tracked as CVE-2022-20798) that could allow attackers to bypass authentication and login into the web management interface of Cisco email gateway appliances with non-default configurations.

The flaw was found in the external authentication functionality of virtual and hardware Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager appliances. Cisco's Product Security Incident Response Team (PSIRT) said it's not aware of any publicly available exploits for this security bug or malicious use of the vulnerability in the wild. (Sergiu Gatlan / Bleeping Computer)

Related: The Hacker News

A competition to win free beer for Father's Day circulating on WhatsApp is a scam, Heineken has said. The scam suggests the first 5,000 respondents will receive a free fridge of beer in return.

A message that offers the chance to win one of 5,000 coolers full of lager and links to a fake quiz-style competition is a phishing lure to trick victims into clicking a malicious link or entering personal information like bank details. (Jennifer Meierhans / BBC News)

Related: The Register, Daily Mail, Geekspin, Irish News, Forbes, The Scottish Sun

House appropriators put forth a proposal that boosts funding for the Cybersecurity and Infrastructure Security Agency (CISA) to $2.93 billion for CISA, more than $400 million above what the agency requested this year in budget proposals.

Those extra dollars are heavily skewed towards augmenting the agency’s cyber capabilities, with $235 million allocated for general cybersecurity operations and an additional $46 million for its other core mission, infrastructure security. (Derek Johnson / SC Media)

Related: The Record, Fedscoop

Officials paid more than $400,000 to ransomware attackers following an attack by a group called Quantum on the Glenn County, California Office of Education and school districts.

Quantum originally demanded a ransom of $1 million but negotiators were able to lower the amount after it became clear to the attackers that the county’s assets and cyber insurance were not sufficient to cover their demands. As part of the negotiations, Quantum assured the county that it would delete all files and provide proof of deletion, provide an explanation of how they gained access to the network and what they did in there, provide a complete list of all files taken, guarantee that they would not attack the district again, and would not sell any of the data that had been stolen. (Dissent Doe / Databreaches.net)

Brett Callow @BrettCallow

An education office in California paid a $400k ransom demand, having negotiated it down from >$1 million. 1/4

Dissent Doe, PhD @PogoWasRight

SCOOP: Glenn County Office of Education paid $400k ransom after #ransomware attack: https://t.co/bn5osx6N1K #quantum cc @douglevin @brettcallow

Researchers at F5 Labs say that a new strain of Android malware called MaliBot has been spotted in the wild targeting online banking and cryptocurrency wallet customers in Spain and Italy, just weeks after a coordinated law enforcement operation dismantled FluBot.

The trojan steals credentials and cookies, bypasses multi-factor authentication (MFA) codes, and abuses Android's Accessibility Service to monitor the victim's device screen. Moreover, Malibot is capable of weaponizing its access to the Accessibility API to defeat Google's two-factor authentication (2FA) methods, such as Google prompts, even in scenarios where an attempt is made to sign in to the accounts using the stolen credentials from a previously unknown device. (Ravie Lakshmanan / The Hacker News)

Related: F5 Labs, ZDNet

Researchers at Sophos say that a threat actor known as Blue Mockingbird targets Telerik UI vulnerabilities to compromise servers, install Cobalt Strike beacons, and mine Monero by hijacking system resources.

The attackers are leveraging CVE-2019-18935, a critical severity (CVSS v3.1: 9.8) deserialization that leads to remote code execution in the Telerik UI library for ASP.NET AJAX. Moreover, Blue Mockinbird is leveraging vulnerable Microsoft IIS servers that used Telerik UI in May 2020, by which time a year had passed since security updates were made available by the vendor. (Bill Toulas / Bleeping Computer)

Related: Sophos

Metacurity

U.S. Has Stepped Up Funding for VPN Companies…