Bill would call on White House to develop its own list of APT groups

A bill that passed the House Foreign Affairs committee Tuesday calls on the White House to develop a publicly available list of APT groups identified by the U.S. government.

A bill approved Thursday by the House Foreign Affairs Committee calls on the White House to develop a publicly available list of advanced persistent threat (APT) groups identified by the U.S. government.

In broad strokes, the “Cyber Deterrence and Response Act of 2018” seeks to establish a strategy that allows the country to act in response to attacks by foreign hackers. The bill, sponsored by Rep. Ted Yoho, R-Fla., would make policy changes and create new controls on how the executive branch can increase costs on adversaries that target U.S. companies or government agencies in cyberspace.

The legislation also calls for a comprehensive and uniform list of foreign hacking groups, to give government agencies common terminology when discussing certain cyberthreats.

Such a list would be the first of its kind. Published regularly in the Federal Register, it could include input from multiple different federal agencies — a notable stipulation since there typically are discrepancies between organizations on how to attribute various attacks to threat groups.

For example, even within the U.S. intelligence community, there is some disagreement over how to refer to malicious cyber-activities or if they should be grouped together under single entities. An agency’s ability to track a threat group will dictate its own understanding of the attackers’ origin.

Commonly, APT group names are created by the private sector. Some of the well-known groups are Russian-linked “APT28” or “Fancy Bear,” the Chinese-linked “APT1” or “CommentPanda,” and North Korea-linked “Lazarus Group” or “Hidden Cobra.”

Because of language in the legislation, the list would not include U.S.-linked or likely allied-linked hacking groups, like the infamous NSA-associated “Equation Group.” That group was first cataloged by Moscow-based cybersecurity company Kaspersky Lab. Instead, the federal list would only include groups and individual hackers that are deemed a threat to the U.S.

In a statement from Yoho’s office, the congressman said: “Not all threats to our national security are kinetic. More and more, countries who wish to weaken the United States and disrupt our way of life are using keyboards and the internet … My Cyber Deterrence and Response Act will shine a light on these countries and create a framework that not only deters but provides the proper response for their actions. It is vital that when these attacks happen, they are exposed, pulled out of the shadows, and punished accordingly.”

Legislation would designate ‘critical cyber threat actors,’ direct sanctions against them

The bill is a bid at further deterring cyberattacks, a sentiment with growing focus on the Hill and in the Trump administration.

While White House demands deterrence, Trump shrugs

Intelligence bill would elevate ransomware to a terrorist threat

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure