Apple backdoor spat, Sarcoma hits Unimicron, Sault Tribe attacked

Summary

Cyber Security Headlines - Episode Summary Hosted by CISO Series Release Date: February 14, 2025

---

1. Apple Backdoor Spat: U.S. Lawmakers vs. UK Directive

In today's episode, host Steve Prentiss delves into the escalating tensions between U.S. lawmakers and the United Kingdom over Apple's encryption practices. Senators Ron Wyden and Andy Biggs have taken a strong stance, urging the newly appointed National Intelligence Director Tulsi Gabbard to "push the United Kingdom to revoke its order requiring Apple to grant access to encrypted user data" (00:06).

Key Points:

• UK's Directive: The UK has mandated Apple to create a backdoor into its Advanced Data Protection System, which currently encrypts iCloud data so securely that even Apple cannot access it.
• Lawmakers' Concerns: The directive is seen as a threat to American privacy. Wyden and Biggs argue that forcing Apple to compromise its encryption undermines user security and privacy.
• Potential Fallout: If the UK does not retract the order, U.S. lawmakers are considering reevaluating the deep intelligence-sharing ties between the two allies, highlighting the fragile nature of international cybersecurity cooperation.

Implications: This conflict underscores the global struggle between maintaining user privacy through robust encryption and the demands of law enforcement agencies to access data for combating serious crimes like terrorism and child exploitation.

---

2. Sarcoma Ransomware Assaults Unimicron

The episode highlights a significant cybersecurity breach targeting Unimicron, a leading Taiwan-based manufacturer of printed circuit boards (PCBs). The Sarcoma ransomware group, a relatively new threat actor, has claimed responsibility for this attack.

Key Points:

• Nature of the Attack: Sarcoma has stolen approximately 377 gigabytes of SQL files from Unimicron's systems. They have threatened to leak all the stolen data if the ransom is not paid by next week.
• Impact on Unimicron: As one of the world's largest PCB manufacturers, Unimicron's operations span Taiwan, China, Germany, and Japan. The breach could disrupt the supply chain for products used in LCD monitors, computers, peripherals, and smartphones.
• Threat Actor Profile: Sarcoma's emergence signals a new wave of ransomware threats targeting critical infrastructure and large-scale manufacturers, posing significant risks to global technology and manufacturing sectors.

Conclusion: The Unimicron breach exemplifies the growing sophistication of ransomware groups and the vulnerability of essential manufacturing industries to cyber extortion.

---

3. Ransomware Attack Disrupts Michigan's Sioux Tribe Operations

A severe ransomware attack has crippled the Sioux Saint Marie Tribe of Chippewa in Michigan, affecting vital services across the community.

Key Points:

• Scope of the Attack: Initiated on Sunday morning, the attack has disrupted multiple computer and phone systems within the tribal administration. This has led to temporary closures of health centers, businesses, and casinos.
• Immediate Effects: Tribe Chairman Austin Lowes stated, "As a result, many departments and businesses were forced to close temporarily" (00:06). The health division, serving 44,000 members, has been particularly hard hit, jeopardizing essential health services.
• Recovery Efforts: Officials are optimistic about resolving the issue within a week but are preparing for a prolonged recovery period if necessary.

Impact: This incident highlights the vulnerability of tribal and indigenous communities to cyber threats and the critical importance of robust cybersecurity measures to protect essential services.

---

4. Russian Threat Actor Seashell Blizzard Expands Globally

Microsoft's latest report sheds light on the evolving tactics of the Russian threat actor group Seashell Blizzard. Originally focused on Ukraine and Eastern Europe, the group is now targeting high-value entities worldwide, including the UK, US, Canada, and Australia.

Key Points:

• Specialist Initial Access Subgroup: This subgroup exploits vulnerabilities in remote access technologies such as ConnectWise, Screen Connect, and Fortinet 40 client software to establish long-term persistence on compromised systems.
• Attack Methodology: They utilize direct scanning and third-party internet scanning services to identify and exploit vulnerabilities in internet-facing infrastructure.
• Global Reach: The shift to high-value global targets indicates a broader strategy to infiltrate diverse sectors and increase the group's influence and impact.

Quote: "This is done with the goal of establishing long-term persistence on the affected systems," explains the Microsoft report (00:06).

Implications: The expansion of Seashell Blizzard underscores the dynamic nature of cyber threats and the necessity for continuous vigilance and adaptive security strategies.

---

5. Final Draft Malware Exploits Microsoft API for Espionage

Elastic Security Labs has identified a new espionage campaign targeting the Foreign Ministry of an unnamed South American nation using bespoke malware known as Final Draft.

Key Points:

• Malware Operation: The malware, named PathLoader, facilitates the introduction of an encrypted shell code called Final Draft into the memory of a newly spawned MSPaint EXE process. It operates on both Windows and Linux systems.
• Targeted Organizations: Beyond the Foreign Ministry, telecommunications organizations and universities in Southeast Asia have also been targeted.
• Espionage Goals: The sophisticated nature of Final Draft suggests it is designed for covert information gathering and long-term surveillance.

Conclusion: The use of Final Draft highlights the increasing sophistication of state-sponsored cyber espionage tools and the ongoing battle to secure sensitive governmental and institutional information.

---

6. Zacks Faces Potential Data Breach Impacting Millions

Zacks, a U.S.-based investment research firm, is reportedly suffering from another data breach. The incident, which allegedly occurred in June 2024, saw threat actors releasing data last month.

Key Points:

• Data Compromise: The breach is said to affect 12 million accounts, with the leaked database now available on the "Have I Been Pwned?" platform.
• Data Overlap: According to Troy Hunt of "Have I Been Pwned?", "93% of the email addresses mentioned in this most recent haul were already in the Have I Been Pwned database from previous breaches, including those not affiliated with Zacks" (00:06).
• Threat Actor Tactics: Experts suggest that attackers may have scraped information from various services to compile a comprehensive database linked to Zacks-associated user information.

Implications: This breach emphasizes the persistent risk of data aggregation from multiple sources, increasing the potential damage even when most data was previously compromised.

---

7. Astaroth Phishing Kit Bypasses Two-Factor Authentication

A new phishing tool named Astaroth has emerged on cybercrime platforms, boasting the capability to bypass two-factor authentication (2FA) through reverse proxy techniques.

Key Points:

• Advanced Bypass Mechanism: Astaroth uses session hijacking and real-time credential interception to compromise accounts on platforms like Gmail, Yahoo, and Office365.
• Operational Strategy: It employs an EvilGINX-style reverse proxy, positioning itself between users and legitimate login pages to capture sensitive information such as usernames, passwords, 2FA tokens, and session cookies.
• Effectiveness Against 2FA: Unlike traditional phishing kits that struggle with 2FA, Astaroth's real-time interception allows attackers to hijack active sessions almost instantaneously, rendering 2FA ineffective.

Expert Insight: Cybersecurity expert Jason Sirocco warns, "This approach renders 2FA ineffective, as attackers can instantly assume control of compromised accounts" (00:06).

Recommendation: Users are advised to adopt more secure authentication methods and remain vigilant against sophisticated phishing attempts that exploit session-based vulnerabilities.

---

Upcoming Event

Steve Prentiss invites listeners to join the "Week in Review" show scheduled for later today at 3:30 PM Eastern. Doug Mayer, VP and Chief Information Security Officer at WCG, will provide expert commentary on the week's cybersecurity news. Participation and comments are encouraged via the CISO Series YouTube live channel. Registration details are available on the events page at cisoseries.com.

---

For more detailed stories and continuous updates, visit cisoseries.com.

---

Timestamp Reference:

• 00:06 – Steve Prentiss introduces the episode and discusses the Apple backdoor spat.
• 07:47 – Outro segment promoting daily cybersecurity headlines.

Transcript

[Unknown Host]

From the CISO series, it's Cybersecurity Headlines.

[Steve Prentiss]

These are the cybersecurity headlines for Friday, February 14, 2025. I'm Steve Prentiss. U.S. lawmakers demand UK retraction of Apple backdoor Senators Ron Wyden and Andy Biggs are urging newly appointed National Intelligence Director Tulsi Gabbard to push the United Kingdom to revoke its order requiring Apple to GR access to encrypted user data. They warned that the directive threatens Americans privacy and suggested that if the UK refuses to back down, the US should reconsider its deep intelligence sharing ties with its ally. The confidential British order compels Apple to create a backdoor into its Advanced Data Protection System, which encrypts icloud stored data so securely that even Apple cannot access it. Authorities argue that this hinders investigations into terrorism, child exploitation and other serious crimes. The US Lawmaker's appeal highlights growing tensions over encryption, privacy and government surveillance, with potential implications for international cybersecurity cooperation. Sarcoma ransomware claims breach at giant circuit board maker Unimicron this breach is the handiwork of a relatively new operation with the delightful name of Sarcoma. The group has claimed responsibility for an attack against Unimicron, a Taiwan based manufacturer of printed circuit boards, otherwise known as PCBs. The group has already published samples of files allegedly stolen from the company's systems, with a threat to leak everything next week if no ransom is paid. The group claims to have 377 gigabytes of SQL files belonging to the Taiwanese company. Unimicron is one of the largest PCB manufacturers in the world, with plants and service centers in Taiwan, China, Germany and Japan. Its products are extensively used in LCD monitors, computers, peripherals and smartphones. Ransomware attack disrupts Michigan's Sioux Tribe operations A ransomware attack on the Sioux Saint Marie Tribe of Chippewa in Michigan has severely disrupted critical services including health centers, businesses and casinos. Tribe Chairman Austin Lowes stated that the incident began Sunday morning, affecting multiple computer and phone systems across tribal administration. As a result, many departments and businesses were forced to close temporarily. While officials hope to resolve the issue within a week, they are prepared for a longer recovery. The attack has had a particularly devastating impact on the tribe's health division, affecting essential services for its 44,000 members in Michigan's Upper Peninsula. Thanks to today's episode's sponsor, Vanta, do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs. We rely on point in time checks, but more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires five times faster with AI. Now that's a new way to GRC. Get started today at Vanta.com headlines that is V A N T A dot com headlines Russian threat actor Seashell Blizzard enlists Specialist Initial Access Subgroup According to a new report from Microsoft, the group, once known for attacks mostly on Ukraine and countries in Eastern Europe, is now setting its sights on high value targets globally, especially in the uk, the us, Canada and Australia. Its Specialist Initial Access subgroup takes advantage of vulnerabilities in remote access technologies including ConnectWise, Screen Connect and Fortinet 40 client software. The Microsoft report states that the subgroup discovers vulnerabilities in Internet facing infrastructure through direct scanning and the use of third party Internet scanning services and knowledge repositories. This is done with the goal of establishing long term persistence on the affected systems. Final Draft Malware uses Microsoft API for espionage through Windows and Linux Threat hunters at Elastic Security Labs are watching a campaign currently focusing on the Foreign Ministry of an unnamed South American nation with bespoke malware capable of granting remote access to infected hosts. End quote this group has also targeted a telecommunications organization and a university, both located in Southeast Asia. The procedure involves the execution of a malware named pathloader that makes way for an encrypted shell code named Final Draft and is subsequently injected into the memory of a newly spawned MSPaint EXE process and works on Windows and Linux systems. The researchers believe that this campaign is built for espionage. Zacks possibly suffers another data breach. This breach supposedly happened in June of 2024 with the threat actor releasing data last month January. Zacks is a U.S. based investment research company and the threat actors behind this breach claim to have access to the data of 12 million accounts. The leaked database has already been added to have I Been Pwned? However, Troy Hunt and his organization state that 93% of the email addresses mentioned in this most recent haul were already in the have I Been? Component database from previous breaches, including those not affiliated with Xax. Bleeping Computer also notes that quote There is the possibility of threat actors scraping the information from other services and compiling a database with user information associated with Xax. End quote Astaroth phishing kit bypasses 2fa with reverse proxy techniques a new phishing tool called Asteroth that is spelled A S T A R O T H has surfaced on cybercrime platforms and features advanced technology to bypass two factor authentication. First advertised in January of this year, Astaroth uses session hijacking and real time credential interception to compromise accounts on Gmail, Yahoo, Office365 and other platforms. Researchers at NeXT report that it operates via an evil Jinx style reverse proxy that is spelled E V I L G I N x, positioning itself between users and legitimate login pages to capture usernames, passwords, two FA tokens and session cookies. Unlike traditional phishing kits that struggle to bypass 2fa, Asteroth intercepts authentication tokens in real time, allowing attackers to hijack active sessions before security measures can respond. Cybersecurity expert Jason Sirocco warns that this approach renders 2fa ineffective, as attackers can instantly assume control of compromised accounts. Make sure to join us later today at 3:30pm Eastern for our Week in Review show. Doug Mayer, VP and Chief Information Security Officer at WCG, will be our guest, providing his expert commentary on the news of the week, and we encourage participation and comments through our YouTube live channel. Just go to the events [e-mail] to register. I'm Steve Prentiss reporting for the CISO series.

[Unknown Host]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the Headlines sat.