The beginning of an international consensus on AI governance may be emerging from Bletchley Park.

Bletchley Declaration represents a consensus starting point for AI governance. Lazarus Group prospects blockchain engineers with KANDYKORN. Boeing investigates ‘cyber incident’ affecting parts business. NodeStealer’s use in attacks against Facebook accounts. Citrix Bleed vulnerability exploited in the wild. MuddyWater spearphishes Israeli targets in the interest of Hamas. India to investigate alleged attacks on iPhones. Tim Starks from the Washington Post on the SEC’s case against Solar Winds. In today’s Threat Vector segment David Moulton from Unit 42 is joined by Matt Kraning of the Cortex Expanse Team for a look at Attack Surface Management. And Venomous Bear rolls out some new tools.

On the Threat Vector segment, David Moulton, Director of Thought Leadership for Unit 42, is joined by Matt Kraning, CTO of the Cortex Expanse Team. They dive into the latest Attack Surface Management Report.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/210

Threat Vector

Read the Attack Surface Management Report.

Please share your thoughts with us for future Threat Vector segments by taking our brief survey.

To learn what is top of mind each month from the experts at Unit 42 sign up for their Threat Intel Bulletin. 

Selected reading.

The Bletchley Declaration by Countries Attending the AI Safety Summit, 1-2 November 2023 (GOV.UK)

US Vice President Harris calls for action on "full spectrum" of AI risks (Reuters) 

Elastic catches DPRK passing out KANDYKORN (Elastic Security Labs)

North Korean Hackers Targeting Crypto Experts with KANDYKORN macOS Malware (The Hacker News)

Lazarus used ‘Kandykorn’ malware in attempt to compromise exchange — Elastic (Cointelegraph) 

An info-stealer campaign is now targeting Facebook users with revealing photos (Record)

Mass Exploitation of 'Citrix Bleed' Vulnerability Underway (SecurityWeek)

MuddyWater eN-Able spear-phishing with new TTPs | Deep Instinct Blog (Deep Instinct) 

Centre's Cyber Watchdog CERT-In To Probe iPhone "Hacking" Attempt Charges (NDTV.com)

Over the Kazuar’s Nest: Cracking Down on a Freshly Hatched Backdoor Used by Pensive Ursa (Aka Turla) (Unit 42)

Learn more about your ad choices. Visit megaphone.fm/adchoices