The Department of Justice (DOJ) seized two domain names used in a spearphishing campaign on Friday in accordance with court orders issued in the Eastern District of Virginia as part of efforts to disrupt the threat actors’ malicious cyber activity.

“Law enforcement remains an integral part of the U.S. government’s broader disruption efforts against malicious cyber-enabled activities, even prior to arrest, and we will continue to evaluate all possible opportunities to use our unique authorities to act against such threats,” John Demers, assistant attorney general for DOJ’s national security division, said in a statement published Tuesday.

The spearphishing campaign was the subject of a joint cybersecurity advisory that the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued on Friday. CISA and the bureau warned that the campaign was aimed at government agencies, non-governmental and intergovernmental organizations.

According to the advisory, the hackers used a compromised user account from email marketing software company Constant Contact to send phishing emails that purported to come from the U.S. Agency for International Development to over 7,000 accounts across about 350 agencies, NGOs and IGOs.

DOJ said the cyberthreat actors secured persistent access by downloading the malicious Cobalt Strike software tool after a recipient clicked on the hyperlink in the spearphishing email and used the seized domains to control the tool implanted on victims’ networks.

The National Security Division’s counterintelligence and export control section and the U.S. Attorney’s Office for the Eastern District of Virginia are working with the FBI’s Washington field office and cyber division to further investigate the campaign.

If you want to know more about the latest updates about the Cybersecurity Maturity Model Certification, then check out Potomac Officers Club's CMMC Forum coming up on June 16th. 

CMMC Accreditation Body Chairman Karlton Johnson will serve as the keynote speaker for the Forum to provide his overview and vision of the CMMC Rollout as well as the top priorities for the board and how industry feedback will help to improve the vision behind how the organization develops for the first 100 days.

To register for this virtual forum and view other upcoming events, visit the POC Events page.

The Department of Health and Human Services' (HHS) Biomedical Advanced Research and Development Authority (BARDA) has partnered with the nonprofit Global Health Investment Corp. (GHIC) on a program meant to advance the use of venture capital practices to facilitate investments in medical technologies that could help prevent pandemics and other public health emergencies.

GHIC is expected to get from BARDA a minimum of $50 million over five years and up to $500 million over a decade through the BARDA Ventures program as it establishes a global health security fund to engage the investment community, HHS said Tuesday.

“Pathogens and health security threats constantly evolve and change. To effectively combat them, we need new and innovative ways to tap into the most novel and impactful ideas in the entrepreneurial community,” said BARDA Director Gary Disbrow. 

“BARDA Ventures will rise to the challenge by engaging that community and leveraging both public and private funds to change the way we prepare for health security threats of the future,” Disbrow added.

GHIC will work with companies to help them develop and commercialize technologies that could help address health security threats and allow private investors to co-fund such tech platforms. The nonprofit organization will use the financial returns generated by medical tech systems to sustain the BARDA Ventures program and support future reinvestment opportunities.

The BARDA Division of Research, Innovation and Ventures will support the agency’s Ventures program with GHIC. Launched in 2018, DRIVe focuses on sensors and artificial intelligence-based technology systems to address health security threats and is teaming up with 37 companies through federal contracts. It is supporting early-stage companies in their product development efforts through its network of 13 accelerators.

The National Telecommunications and Information Administration (NTIA) has issued a request for public comments on NTIA’s approach to developing the minimum elements for a software bill of materials (SBOM) to comply with an executive order meant to improve U.S. cybersecurity. 

 The executive order signed by President Biden in May in response to recent breaches directs NTIA to release a list of elements of an SBOM to help advance transparency in the software supply chain, according to a Federal Register notice scheduled to be published Wednesday.

SBOM is “a formal record containing the details and supply chain relationships of various components used in building software,” according to the EO. 

NTIA said it is proposing potential elements of an SBOM: data fields, support for automation and operational considerations. For data fields, “baseline component information” such as supplier name, component name and dependency relationship should be tracked to understand the third-party components used in building software. 

NTIA is asking interested stakeholders about other elements that should be considered in the development, distribution and use of SBOMs, additional use cases that can inform the SBOM’s element and how issues such as software identity and software as a service and online services should be considered in defining SBOM elements. 

Comments are due 15 days after the date of publication of notice on Federal Register.

If you want to know more about the latest updates about the Cybersecurity Maturity Model Certification, then check out Potomac Officers Club's CMMC Forum coming up on June 16. To register for this virtual forum and view other upcoming events, visit the POC Events page.

The Air Force Research Laboratory has opened a new facility designed to train airmen for performance in altitudes with high pressure.

Four computer-controlled altitude chambers compose AFRL's research altitude chamber facility, where airmen undergo physiology training for high-pressure scenarios, the laboratory said Friday. The U.S. Air Force held a ribbon-cutting ceremony on May 27 to celebrate RAC's opening.

The facility supports AFRL's 711th Human Performance Wing, which helps airmen enhance physiological performance via medical technology. AFRL works with Naval Medical Research Unit – Dayton to pursue this task, which uses state-of-the-art facilities including RAC.

“Aerospace physiology research and training, here in the RAC and in our other facilities, is essential to the readiness of our aircrews and their missions,” said Darrell Phillipson, acting director of AFRL’s human performance wing.