← Cybersecurity Headlines
Cybersecurity Headlines
Apple Airplay-Enabled Devices Can Be Hacked, Google tracked 75 zero days, France ties Russian APT28 hackers to 12 cyberattacks
00:08:06
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Wednesday, April 30, 2025. I'm Sarah Lane. Millions of Apple AirPlay enabled devices can be hacked via Wi Fi researchers at Cybersecurity firm Oligo have disclosed airborne a set of vulnerabilities in Apple's AirPlay SDK that expose millions of third party devices such such as smart TVs, speakers and CarPlay systems to remote code execution over shared WI fi. Apple has patched its own hardware, but Oligo warns many third party vendors may have not, which poses risk for lateral movement, network persistence and potential surveillance. Google tracked 75 zero days exploited in the wild in 2024 According to Google's Threat Intelligence Group, 75 zero day vulnerabilities were exploited in the wild in 2024. That's down from 98 in 2023, but above 2022's total, pointing to an upward trend in zero day activity over the past four years. Most exploits still target end user platforms, but there's an increase in attacks on enterprise technologies, especially security and networking appliances, which make up over 60% of enterprise targeted 0 days. The group attributes more than half of all known exploits to cyber espionage actors. France ties Russian APT28 hackers to 12 cyber attacks on French orgs France has officially blamed the Russian state backed hacking group APT28, tied to the GRU, for 12 cyber attacks on French entities since 2021, including targets in government, defense, aerospace and research. The French Foreign Ministry denounced the attacks as breaches of UN norms, while the National Cybersecurity Agency ANSI reported that AP28 used phishing, email service exploits and low cost anonymous infrastructure. Marks and Spencer breach linked to scattered spider ransomware attack we reported last week that British retailer Marks and Spencer was experiencing outages, believing computer sources now say it's a ransomware attack linked to the Scattered Spider threat group. The attackers reportedly gained access as early as February, stealing the NTDS DIT Active Directory database and and on April 24th deployed DragonForce ransomware to encrypt VMware XE hosts, disrupting operations including payment systems and online orders. Marks and Spencer has enlisted CrowdStrike, Microsoft and Fenix24 to aid in investigation and recovery. Huge thanks to our sponsor ThreatLocker. ThreatLocker is a global leader in zero trust endpoint security, offering cybersecurity controls to protect protect businesses from zero day attacks and ransomware. Threat Locker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit threatlocker.com CSO that's threadlocker.com CISO the Electronic Frontier foundation, or EFF, along with more than 400 cybersecurity and election security experts, has publicly urged the US administration to drop its investigation into former CESA director Chris Krebs. In an open letter, the signatories warn that targeting Krebs and his employer, Sentinel One, for contradicting election fraud claims undermines the infosec community's independence and discourages truthful nonpartisan security reporting. Nova Scotia energy provider takes some servers offline following cyber incident Nova Scotia Power disclosed that it experienced a cyber attack on April 25th affecting parts of its Canadian IT infrastructure, including its customer care center and online portal. No disruption occurred to power generation or grid operations, but the company isolated impacted servers to contain the incident. The nature of the attack has not been confirmed, but Emira, Nova Scotia Power's parent company, says it's working with law enforcement and cybersecurity experts to investigate and recover. Physical operations and international subsidiaries remain unaffected. Sentinel One reports that China linked Apt Group Purple Haze attempted reconnaissance on its infrastructure and high value clients, indicating targeted cyber espionage with potential for future attacks. The group, known to be tied to apt 15, is said to have used tools like the Go reshell, backdoor and shadowpad malware, also seen in broader China Nexus campaigns. SentinelOne also detected over 1,000 job applications from North Korea linked fake Personas, including attempts to infiltrate its Sentinel Labs intelligence team. House passes bill to study routers national security risks the US House representatives passed the Routers act, which mandates the Department of Commerce to study national security risks posed by routers and modems controlled by foreign adversaries, namely China. Lawmakers have emphasized that securing U.S. communications networks is a critical role in national infrastructure. This builds on previous efforts to remove untrusted equipment following cybersecurity threats, such as the SALT Typhoon hacker group's exploitation of telecom networks. Watch out for any Linux malware sneakily evading Cisco watching Antivirus A new proof of concept program, Curine, highlights a blind spot in Linux security tools that rely on syscall monitoring. The Iorene interface, introduced in Linux kernel 5.1, lets applications bypass traditional systems calls for I O operations, which many antivirus tools rely on to detect threats. As IO arena operates outside the Cisco path, malware exploiting IT may evade detection by tools like Falco, Tetragon and Microsoft Defender. Armo, which developed the proof of concept, calls it a major blind spot and suggests that solutions like updating antivirus tools or disabling Ioaring altogether. Google disabled it in Chrome os after spending $1 million on related bug bounties. Make sure to check out our latest episode of Security. You should know we just released a new episode with Threat Locker, looking into what they're doing to help control elevated privileges in your environment. Look for the show over@cisoseries.com or wherever you get your podcasts. I'm Sarah Lane reporting for the CISO series, and we will talk to you next time.
- [07:50]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.