Latest cybersecurity reporting from selected sources.

Also, TLC gets schooled by Karakurt, and Cloudflare is offering free zero trust stuff to some small companies In brief Business email compromise (BEC) continues to be a multibillion-dollar threat, but it's evolving, with the FBI and other federal agencies warning that cybercriminals have started using spoofed emails to steal shipments of physical goods – in this case, food. …

And the corporations making the tools for stalking and harassment in the first place? Anyone? A bipartisan trio of US lawmakers has proposed a law that pledges as much as $22 million of public funding to help victims of tech-enabled domestic abuse.…

Tweeter, tailor, soldier, bye A Twitter employee who spied for the Saudi government and royal family has been sentenced to three and half years behind bars in America.…

Redmond and Cupertino criticized for slow and weak responses by Australian regulator Australia's e-safety commissioner, a government agency charged with keeping citizens safe online, has delivered a report on seven tech platforms' mechanisms to protect children from online sexual abuse – and found most don't respond quickly, or have the processes to do so well.…

Some are suspected of helping other banned suppliers get around sanctions The United States Department of Commerce has added 36 Chinese companies or subsidiaries to its list of companies that cannot import certain US technologies without a license, citing national security, foreign policy interests, and the possibility that some might help already banned companies to evade restrictions.…

How about right now? Right now is good The US National Institute of Standards and Technology (NIST) says it's time to retire Secure Hash Algorithm-1 (SHA-1), a 27-year-old weak algorithm used in security applications.…

Cops give denial-of-service sites an extra special denial of service Police around the globe have seized as many as 50 internet domains said to be involved in tens of millions of distributed-denial-of-service (DDoS) attacks worldwide. Seven people were collared during the swoop.…

Pitches storage, cloudy software compliance to twitchy EU customers thinking about GDPR Microsoft has confirmed that from the beginning of 2023, it will introduce an EU Data Boundary solution designed to help customers in the European Union and the European Free Trade Association comply with legislation including the General Data Protection Regulation (GDPR).…

Defendants allegedly 'discussed their scheme’ in recorded chats on Discord and Twitter that ‘they believed were private’ Eight braggadocious social media influencers fond of posing next to sportscars are facing charges from the US Securities and Exchange Commission (SEC) and Department of Justice (DoJ), who claim they manipulated their 1.5 million followers in order to help themselves to $100 million in "fraudulent profits."…

If you get email from 'Samantha Wolf', congrats: you're important enough to make a decent target An Iranian cyber espionage gang with ties to the Islamic Revolutionary Guard Corps has learned new methods and phishing techniques, and aimed them at a wider set of targets – including politicians, government officials, critical infrastructure and medical researchers – according to email security vendor Proofpoint.…

… a working Exchange inbox tree There's no end – or restored data – in sight for some Rackspace customers now on day 12 of the company's ransomware-induced hosted Exchange email outage.…

Handy tools to kill off security protections get Redmond's stamp of approval Microsoft says it has suspended several third-party developer accounts that submitted malicious Windows drivers for the IT giant to digitally sign so that the code could be used in cyberattacks.…

Nuclear, hypersonic hardware is one thing, but you can probably keep the quantum computer stuff, Vlad The US Department of Justice unsealed a 16-count indictment today accusing five Russians, an American citizen, and a lawful permanent US resident of smuggling export-controlled electronics and military ammunition out of the United States for the Russian government.…

It's not Amazon's fault buckets are exposed, but the loaded shotgun and your foot are all ready and waiting Amazon wants you to know that it's not to blame for the data you've exposed though its cloud storage service. AWS Simple Storage Service (S3) is, after all, simple.…

If you listen really closely, you can hear Mark Zuckerberg's excitement The US government's crackdown on TikTok continues, with the latest salvo being a bipartisan bill that would outright ban the popular social media app from doing business in the country.…

Something's broken, mom! Microsoft rolls out workaround while trying to come up with a fix Updates to Windows Server that were included in Microsoft's Patch Tuesday batch of fixes this week could trip up users who want to spin up new virtual machines in some Hyper-V hosts.…

Campaigners say it's unlikely to pass a test in the courts, though The EU has issued a draft decision agreeing that measures taken by the United States ensure sufficient protection for personal data to be transferred from the region to US companies.…

Yet more pain for the software formerly known as NetScaler The China-linked crime gang APT5 is already attacking a flaw in Citrix's Application Delivery Controller (ADC) and Gateway products that the vendor patched today.…

Plus there's a PoC exploit for this unpatched Cisco bug For its final Patch Tuesday of the year, Microsoft fixed one bug that's already been exploited and another that's publicly known, bringing its total patched to 49 vulnerabilities, six of which are rated critical.…

Databases, details of 'sexual proceedings in court' and more apparently pilfered from finance IT LockBit claims it was behind a cyber-attack on the California Department of Finance, bragging it stole data during the intrusion.…