APTs using Gemini, India's Tata cyberattack, new WhatsApp spyware

Summary

Cyber Security Headlines – Episode Summary Hosted by CISO Series | Released on February 3, 2025

---

In this episode of Cyber Security Headlines, hosted by Steve Prentiss from the CISO Series, several critical developments in the realm of information security are dissected and analyzed. The episode delves into advanced persistent threats (APTs) leveraging AI tools, a significant ransomware attack on India's Tata Technologies, and the emergence of new spyware targeting WhatsApp users. Additionally, the episode touches upon other notable cybersecurity incidents and industry updates, providing listeners with a comprehensive overview of the current threat landscape.

---

1. APTs Leveraging Google's Gemini AI

Google's Threat Intelligence Group has identified that government-linked Advanced Persistent Threat (APT) groups from over 20 countries are utilizing Gemini, Google's AI tool, not for developing new AI-driven cyberattacks but to enhance their productivity. The primary uses of Gemini include:

• Shortening Preparation Periods: Assisting in coding tasks for developing malicious tools and scripts.
• Vulnerability Research: Facilitating research on publicly disclosed vulnerabilities.
• Target Reconnaissance: Gathering details on target organizations and devising methods to evade detection.
• Privilege Escalation & Network Reconnaissance: Aiding in escalating privileges and conducting internal reconnaissance within compromised networks.

The top four countries identified with APT groups using Gemini are Iran, China, North Korea, and Russia.

Steve Prentiss (B) [00:06]: "Google describes APTs using Gemini primarily for what they call productivity gains, rather than to develop new AI-enabled cyber attacks."

This utilization of Gemini underscores the dual-edged nature of AI technologies, where tools designed for productivity can be repurposed for malicious intents, thereby heightening the sophistication and efficiency of cyber threats.

---

2. Ransomware Attack on India's Tata Technologies

Tata Technologies, a subsidiary of Tata Motors, which provides services to automotive, aerospace original equipment manufacturers (OEMs), and industrial machinery companies, recently suffered a ransomware attack. Key details include:

• Impact Scope: The attack affected a limited portion of Tata Technologies' IT infrastructure.
• Ransomware Group: The specific ransomware group responsible has not been disclosed.
• Data Breach Status: There is no confirmation on whether any data was stolen during the incident.

Steve Prentiss (B) [02:30]: "India's Tata Technologies suffers ransomware attack. The company has not revealed the name of the ransomware group involved or if data has been stolen."

This incident highlights the ongoing vulnerability of even large, established companies to targeted ransomware attacks, emphasizing the need for robust cybersecurity measures across all levels of infrastructure.

---

3. New Zero-Click WhatsApp Spyware

Meta, the parent company of WhatsApp, has confirmed the disruption of a new zero-click spyware campaign targeting journalists and other individuals. Key points include:

• Spyware Origin: The spyware is developed by Paragon Solutions, an Israeli company known for its surveillance software, Graphite.
• Acquisition: Paragon Solutions was acquired by the US-based investment group AE Industrial Partners in a deal valued at $500 million in December.
• Functionality: The spyware allows for remote code execution and device modification without any user interaction, posing significant privacy and security risks.
• Clientele: Graphite is marketed to government clients for combating digital threats, positioning Paragon as a provider of ethically based surveillance tools.

Steve Prentiss (B) [04:00]: "This spyware comes from an Israeli company known as Paragon Solutions and the campaign was stopped by Meta in December."

The emergence of such sophisticated spyware underscores the escalating arms race in cyber surveillance technologies, where the line between ethical use and abuse becomes increasingly blurred.

---

4. Additional Cybersecurity Developments

a. Barclays Bank Outage

An unexpected outage at Barclays, the UK's largest bank, was reported as a technical issue rather than a cyberattack. The outage affected both online and branch operations, coinciding with a critical financial period—the payday and tax return deadlines.

Steve Prentiss (B): "Barclays bank outage was not cyber attack, but remains unexplained."

b. FDA and CISA Warning on Patient Monitors

The FDA and CISA have issued a warning regarding a backdoor in Contec CMS 8000 patient monitors used in US hospitals. This vulnerability could allow remote code execution and device manipulation, potentially jeopardizing patient safety.

c. Globe Life Data Breach Notification

Globe Life is notifying approximately 850,000 customers about a potential data breach following an extortion attempt targeting independent agency databases. While it's unclear if data was compromised, the company is proactively offering credit monitoring services.

d. Regional Healthcare Data Breaches

• Connecticut's Community Health Center: Over 1 million patient records were exposed due to a cyberattack discovered on January 2nd.
• California's North Bay Healthcare Corporation: Just over half a million individuals' health-related data were stolen in an attack claimed by the Embargo group.

e. Operation Heart Blocker

US and Dutch authorities dismantled a business email compromise fraud network known as Hart Sender, operated by a Pakistani group led by Saim Raza. The operation resulted in the closure of 39 websites facilitating phishing toolkits and fraud-enabling tools.

---

5. Community and Educational Initiatives

The episode also highlights upcoming community events such as the Super Cyber Friday show, an interactive session featuring discussions on hacking, security effectiveness, and risk reduction strategies. Hosted every Friday at 1 PM Eastern, this event aims to engage cybersecurity professionals through conversations and interactive activities.

Steve Prentiss (B) [06:50]: "If you want to join in on the fun, head on over to our events [e-mail] to register."

---

Conclusion

This episode of Cyber Security Headlines offers a comprehensive overview of the latest threats and incidents in the cybersecurity landscape. From the innovative yet concerning use of AI by APT groups to significant ransomware attacks and the proliferation of advanced spyware, the discussions underscore the evolving challenges faced by organizations worldwide. Additionally, the episode emphasizes the importance of proactive measures, community engagement, and continuous education in combating these dynamic threats.

For a deeper dive into these stories and more, listeners are encouraged to visit CISOseries.com.

---

Notable Quotes:

• Steve Prentiss (B) [00:06]: "Google describes APTs using Gemini primarily for what they call productivity gains, rather than to develop new AI-enabled cyber attacks."

• Steve Prentiss (B) [02:30]: "India's Tata Technologies suffers ransomware attack. The company has not revealed the name of the ransomware group involved or if data has been stolen."

• Steve Prentiss (B) [04:00]: "This spyware comes from an Israeli company known as Paragon Solutions and the campaign was stopped by Meta in December."

• Steve Prentiss (B) [06:50]: "If you want to join in on the fun, head on over to our events [e-mail] to register."

---

For more detailed coverage and daily updates on cybersecurity news, visit CISOseries.com.

Transcript

[A]

From the CISO series. It's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Monday, February 3, 2025. I'm Steve Prentiss. Google describes APTS using Gemini AI researchers at Google's Threat Intelligence Group say they have detected government linked APT groups that are using Gemini primarily for what they call productivity gains, rather than to develop new AI enabled cyber attacks. As an example, Google says Gemini can help them shorten the preparation period in coding tasks for developing tools and scripts, research on publicly disclosed vulnerabilities, finding details on target organizations and searching for methods to evade detection, escalate privileges or run internal reconnaissance in a compromised network. Google has identified APT groups for more than 20 countries that are using this technique, with the top four being Iran, China, North Korea and Russia. India's Tata Technologies suffers ransomware attack this subsidiary of Tata Motors provides services to Automotive and Aerospace OEMs as well as industrial machinery companies. It confirmed that the ransomware attack impacted a limited part of its IT infrastructure. The company has not revealed the name of the ransomware group involved or if data has been stolen. Meta confirms new zero click WhatsApp spyware Representatives from WhatsApp, a company owned by Meta, has announced the disruption of another campaign that used spyware to target journalists and others. This spyware comes from an Israeli company known as Paragon Solutions and the campaign was stopped by Meta in December. This is another zero click application. Paragon is the maker of surveillance software called Graphite that is offered to government clients in order to combat digital threats. It was acquired by US based investment group AE Industrial Partners in December in a deal worth $500 million. Its website claims it provides customers with ethically based tools to disrupt intractable threats as well as cyber and forensic capabilities to locate and analyze digital data. Barclays bank outage was not cyber attack, but remains unexplained an outage that occurred on Friday at the UK's largest bank Barclays is being described as a technical issue and not an attack. According to Down Detector, some outages were still present yesterday Sunday and these were impacting both online and in branch activities. The outages compounded a problem in that Friday is a payday for many UK workers and last Friday in particular was the deadline for self assessment tax returns. Thanks to Today's episode's sponsor, ThreatLocker. ThreatLocker is a global leader in zero trust Endpoint security, offering cybersecurity controls to protect businesses from zero day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and to start your free trial, visit threatlocker.com that is T H R E A T locker.com FDA and CISA Warn of Backdoor in Popular Patient Monitor used by US Hospitals this warning applies to a popular line of patient monitors sold by Chinese company contact within the firmware of the Contec CMS 8000, which is used to display information such as vital signs including temperature, heartbeat and blood pressure. The backdoor may allow remote code execution and device modification, with the ability to alter its configuration, introducing risk to patient safety since a malfunctioning patient monitor could lead to an improper response to patient vital signs. Contact devices are sold widely in the US and the European Union and may also be relabelled under different brands by resellers. Globe Life to warn Thousands of potential data Theft following up on a story we covered last October, the insurance firm is warning around 850,000 of its customers of a data breach following an extortion attempt by hackers on databases maintained by a small number of independent agency owners. The company has not been able to confirm if the threat actor actually acquired data from these databases at the targeted agencies, which related to approximately 5,000 individuals originally and so out of an abundance of caution, it is issuing voluntary notifications to and credit monitoring services for approximately 850,000 additional individuals whose information was also stored in the relevant databases. Two Regional Healthcare Systems Report Data Breaches Connecticut's Community Health center and California's North Bay Healthcare Corporation have both filed notifications regarding breaches that occurred last year which exposed large amounts of patient data. Community Health center, which runs dozens of facilities and clinics across Connecticut, said just over 1 million current and former patients had data stolen during a CyberAttack discovered on January 2nd. The North Bay attack, which occurred between January and April of last year and which was claimed by the embargo group in April, has impacted just over half a million people through health related data theft. U.S. and Dutch authorities dismantled domains linked to business email compromise fraud network. The takedown, named Operation heart blocker, closed 39 websites selling phishing toolkits and fraud enabling tools and was operated by a group known as Saim Raza. Since at least 2020. The name for this collective group was Hart Sender. Saim Raza also provided YouTube training on how to use the tools and this campaign was based in Pakistan. Have you ever wished there was an hour long show on Fridays that provided an interactive conversation around salient cybersecurity topics while also offering the ability to play fun games and win prizes. Well, then you're in luck. Our Super Cyber Friday show does just that each and every Friday at 1pm Eastern, 10am Pacific. This week, we'll be talking about hacking, security effectiveness and breaking down how to find out if your security tooling is actually helping reduce risk. If you want to join in on the fun, head on over to our events [e-mail] to register. I'm Steve Prentiss, reporting for the CISO series.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.

[B]

It.