China hacks Treasury, Russian tanker sabotage, Lumen ejects Typhoon

Summary

Cyber Security Headlines: China Hacks Treasury, Russian Tanker Sabotage, Lumen Ejects Typhoon
Hosted by CISO Series | Release Date: January 3, 2025

In this episode of Cyber Security Headlines, host Steve Prentiss delves into three major cybersecurity incidents shaping the landscape in early 2025. From state-sponsored hacking activities targeting U.S. financial systems to sophisticated sabotage of undersea data cables by Russian operatives, and significant defensive actions taken by major telecom companies against persistent threats, this episode provides an in-depth analysis of current cybersecurity challenges and responses.

---

1. Beijing-Linked Hackers Penetrate U.S. Treasury Systems

Steve Prentiss opens the episode by discussing a severe cybersecurity breach involving state-sponsored Chinese hackers targeting the U.S. Treasury Department.

Steve Prentiss [00:00]: "Beijing linked hackers penetrated U.S. treasury systems according to a letter sent from the U.S. treasury to congressional lawmakers on Monday."

Key Points:

• Incident Overview: A Chinese state-sponsored Advanced Persistent Threat (APT) group compromised U.S. Treasury Department workstations and accessed classified documents at the Office of Foreign Assets Control.
• Discovery and Response: The breach was identified on December 8 by Beyond Trust, revealing that the attackers obtained a security key enabling remote access to employee systems.
• Impact Details: The Treasury did not disclose the number of affected workstations or the specific types of documents accessed. However, the compromised service has been taken offline, and there is no current evidence of ongoing unauthorized access.

Steve Prentiss [00:02]: "The Department had been notified on December 8 by Beyond Trust that a foreign actor had obtained a security key that allowed it to remotely gain access to employee workstations and the classified documents stored on them."

Implications: This breach underscores the persistent threat posed by state-sponsored cyber actors targeting critical financial infrastructure. The lack of detailed information about the scope of the breach highlights the challenges in fully assessing and mitigating such sophisticated attacks.

---

2. Russian Tanker Suspected of Undersea Data Cable Sabotage

The episode continues with a critical incident involving maritime sabotage allegedly orchestrated by Russian entities, targeting vital undersea data cables in the Baltic Sea.

Steve Prentiss [00:05]: "Yesterday's episode of Cybersecurity Headlines briefly mentioned that Finnish authorities seized a Russian ship after it allegedly damaged several submarine cables in the Baltic Sea."

Key Points:

• The Vessel: The seized ship, Eagle S, is an oil tanker suspected of intentionally dragging its anchor to sever multiple undersea cables, including the Estlink II power cable and four telecommunications cables.
• Operational Details: Eagle S departed from a Russian port on December 25 before the suspected sabotage. Finnish authorities conducted a helicopter boarding, apprehending seven suspects without immediate arrests.
• Evidence of Espionage: Reports from Lloyds List reveal that Eagle S was equipped with spying devices uncommon for a standard merchant vessel. These included equipment for monitoring NATO naval and aircraft communications and deploying sensor-type devices in the English Channel.

Steve Prentiss [00:06]: "A report from the shipping journal Lloyds List describes the Eagle S as loaded with spying equipment unusual for a merchant ship, used to monitor NATO naval and aircraft radio communications and to drop sensor type devices in the English Channel."

Implications: This incident highlights the escalating tactics used by nation-states to disrupt and gather intelligence on critical communication infrastructures. The involvement of a commercial oil tanker in such activities raises concerns about the blending of civilian and military assets in cyber-espionage efforts.

---

3. Lumen Ejects Salt Typhoon Group from Its Network

Steve Prentiss then addresses significant defensive measures taken by major telecom giant Lumen against a persistent China-linked APT group known as Salt Typhoon.

Steve Prentiss [00:08]: "Following revelations last week that a ninth telecom company had been penetrated by the China linked APT Group, Salt Typhoon, Lumen announced this week that the group had been ejected from and locked out of the Lumen network."

Key Points:

• Incident Background: Salt Typhoon, identified as a China-linked APT group, had penetrated nine telecom companies, raising alarms about widespread vulnerabilities.
• Lumen's Response: Upon discovery, Lumen conducted an independent forensic analysis confirming the removal of the Chinese actors from their network.
• Data Integrity: Mark Molson, Lumen's spokesperson, assured that there is no evidence of customer data being accessed during the breach.

Mark Molson: "An independent forensic analysis confirmed the company ejected the Chinese actors from its network, adding that there is no evidence that customer data was accessed."

Implications: Lumen's proactive response and assurance regarding customer data protection demonstrate effective incident management and the importance of swift action in mitigating the impact of cyber intrusions. This case also emphasizes the ongoing threat posed by Salt Typhoon to the telecommunications sector.

---

4. Biden Administration Finalizes Rule to Block Sale of Americans' Bulk Data to Adversaries

Transitioning from active threats, the episode highlights significant policy developments aimed at safeguarding American data from adversarial states.

Steve Prentiss [00:10]: "The Biden administration finalized a rule to block sale of Americans bulk data to adversaries. This rule, first proposed as an executive order last February and finalized last Friday, means that companies will no longer be able to sell sensitive data about Americans to countries of concern."

Key Points:

• Affected Countries: The rule targets sales of sensitive American data to Russia, China, Iran, North Korea, Cuba, and Venezuela.
• Purpose: According to the U.S. Department of Justice, such data could be exploited for espionage, blackmail, influence campaigns, and other malicious activities.

Implications: This policy move represents a strategic effort to curb the flow of American personal and sensitive data to nations with adversarial relationships, thereby reducing the risk of data being used for geopolitical manipulation or cyber-attacks.

---

5. Malicious NPM Package Deploys Quasar RAT

The discussion shifts to software supply chain security, focusing on a newly identified malicious package within the Node Package Manager (NPM) ecosystem.

Steve Prentiss [00:12]: "A researcher from the Security platform Socket is warning of a malicious package on the NPM that is Node Package Manager registry, which appears as a library for detecting vulnerabilities in Ethereum smart contracts, but actually drops an open source remote access trojan called Quasar Rat onto developers systems."

Key Points:

• Package Details: The malicious package, deceptively named Ethereum Vuln Contract Handler, masquerades as a tool for vulnerability detection in Ethereum smart contracts.
• Malware Deployment: Upon installation, it deploys Quasar RAT, an open-source Remote Access Trojan first appearing on GitHub in July 2014, notorious for its use in cybercrime and espionage.
• Threat Impact: This type of supply chain attack can compromise the integrity of development environments, leading to unauthorized access and data exfiltration.

Implications: The emergence of such malicious packages underscores the critical need for rigorous scrutiny of dependencies in software development. It highlights the vulnerabilities inherent in widely used package repositories and the potential for significant security breaches through seemingly innocuous libraries.

---

6. OWASP Top 10 for 2025

Looking ahead, the episode discusses the upcoming Open Web Application Security Project (OWASP) Top 10 list for 2025, providing insights into evolving web application security risks.

Steve Prentiss [00:15]: "With its data collection phase having been scheduled to end by the end of December 2024, the organization plans to release its list in early 2025."

Key Points:

• Methodology Enhancements: The 2025 update incorporates a refined approach to data collection, leveraging insights from security vendors, consultancies, and bug bounty programs. It emphasizes not just the frequency of vulnerabilities but also their impact on multiple applications.
• Expected Top Risks: The top three risks are anticipated to remain consistent with the 2021 list—Broken Access Control, Cryptographic Failures, and Injection.
• Rank Movements: Security Misconfiguration and Identification and Authentication Failures are expected to rise in the rankings, while Exposed Sensitive Data is projected to enter the top ten for the first time, positioned at sixth place.

Aditya Sawant [Referenced by Steve Prentiss [00:17]]: "This gives a clearer picture of real-world impact."

Implications: The OWASP Top 10 serves as a critical framework for organizations to prioritize and address the most significant web application security risks. The anticipated changes reflect the dynamic nature of cyber threats and the necessity for continuous adaptation in security strategies.

---

7. Large-Scale Supply Chain Attack Using Generative AI

The episode concludes with a forward-looking analysis on the potential for large-scale supply chain attacks facilitated by generative AI technologies.

Crystal Morin [00:19]: "She anticipates seeing highly successful supply chain attacks in 2025 that originated with an LLM generated spearphish."

Key Points:

• Attack Vector Evolution: Cybercriminals are leveraging Large Language Models (LLMs) to create sophisticated spear-phishing campaigns without the need to develop their own AI models. Instead, they exploit stolen credentials to jailbreak existing models.
• Impact Scope: While not predicting complete shutdowns of business operations, Crystal Morin highlights that these AI-generated attacks will enhance the sophistication of social engineering efforts.
• Primary Concern: The amplified effectiveness of spear-phishing and social engineering campaigns represents a significant security challenge for organizations in 2025.

Crystal Morin [00:19]: "She calls spear phishing and social engineering her greatest security concern for 2025."

Implications: The integration of generative AI into cyberattack strategies marks a significant escalation in the complexity and potential success of social engineering tactics. Organizations must prioritize advanced training, awareness programs, and robust verification processes to mitigate these evolving threats.

---

Conclusion

This episode of Cyber Security Headlines provides a comprehensive overview of the multifaceted cybersecurity threats facing organizations and governments globally. From state-sponsored intrusions and maritime sabotage to policy reforms and emerging AI-driven attack vectors, the discussions underscore the critical need for proactive and adaptive security measures. By highlighting both current incidents and future projections, the episode equips listeners with valuable insights to navigate the increasingly complex cyber threat landscape.

For more detailed coverage and continuous updates, visit CISOseries.com.

Transcript

[Steve Prentiss]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Friday, January 3, 2025. I'm Steve Prentiss. Beijing linked hackers penetrated U.S. treasury systems according to a letter sent from the U.S. treasury to congressional lawmakers on Monday, a Chinese state sponsored APT actor was responsible for what is being called a major incident that compromised U.S. treasury Department workstations and classified documents at the Office of Foreign Assets Control. The Department had been notified on December 8 by Beyond Trust that a foreign actor had obtained a security key that allowed it to remotely gain access to employee workstations and the classified documents stored on them. The letter did not specify the number of impacted workstations or the kind of documents accessed, and the Agency adds the compromised service has been taken offline and at this time there is no evidence indicating the threat actor has continued access to treasury information. End Quote Russian Tanker suspected of undersea data Cable Sabotage on yesterday's episode of Cybersecurity Headlines, we mentioned briefly that Finnish authorities seized a Russian ship after it allegedly damaged several submarine cables in the Baltic Sea. This story continues to unfold. The ship seized was the Eagle S, an oil tanker that departed from a Russian port on December 25 and which is suspected of intending intentionally dragging its anchor for several miles, resulting in the complete severing of multiple cables, including the estlink, two power cable and four telecommunications cables. Authorities from Finland boarded the ship by helicopter, having identified but not arrested seven suspects. The ship is being treated as a crime scene on suspicions that it is more than just an oil tanker. A report from the shipping journal Lloyds List describes the Eagle S as loaded with spying equipment unusual for a merchant ship ship and used to monitor NATO naval and aircraft radio communications and to drop sensor type devices in the English Channel. Lumen says it has locked the Salt Typhoon Group out of its network. More updates in the continuing Salt Typhoon story Following revelations last week that a ninth telecom company had been penetrated by the China linked APT Group, Salt Typhoon Lumen announced this week that the group had been ejected from and locked out of the Lumen network. Company spokesperson Mark Molson told TechCrunch that an independent forensic analysis confirmed the company ejected the Chinese actors from its network, adding that there is no evidence that customer data was accessed. End quote thanks to Today's episode sponsor ThreatLocker do zero day exploits and supply chain attacks keep you up at night? Well, worry no more. You can harden your security with ThreatLocker. ThreatLocker helps you take a proactive default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit threatlocker.com that is T H R E A T L O c k e r.com Biden administration finalizes rule to block sale of Americans bulk data to adversaries this rule, first proposed as an executive order last February and finalized last Friday, means that companies will no longer be able to sell sensitive data about Americans to countries of concern. These being Russia, China, Iran, North Korea, Cuba and Venezuela, which, according to the US Department of Justice, could be used for espionage, blackmail, influence campaigns and other malicious activities. End quote Malicious NPM package deploys Quasar Rat A researcher from the Security platform Socket is warning of a malicious package on the NPM that is Node Package Manager registry, which appears as a library for detecting vulnerabilities in Ethereum smart contracts, but which actually drops an open source remote access trojan called Quasar Rat onto developers systems. The heavily obfuscated package is named Ethereum Vuln Contract handler, all as one word. The quasar rat, which first appeared on GitHub in July 2014, has been used for cybercrime and cyber espionage by various threat actors over the past 10 years. Looking ahead to the OWASP top 10 for 2025 the Open Web Application Security Project, better known as OWASP, is hard at work putting together its list of its top 10 security risks for Web applications. With its data collection phase having been scheduled to end by the end of December 2024, the organization plans to release its list in early 2025. Security researcher Aditya Sawant, writing in Medium, says the 2025 update includes a refined approach to data collection, casting a wider net, pulling insights from security vendors, consultancies and bug bounty programs, as well as not just counting how many times a vulnerability appears, but also how many applications are affected by at least one instance of each vulnerability type. This, Sawant says, gives a clearer picture of real world impact. The top three risks are expected to be the same as they were in 2021 broken access control, cryptographic failures and injection. But Sawant anticipates security misconfiguration and identification and authentication failure to move up from lower positions, with exposed sensitive data appearing in sixth place for the first time. A link to Sawant's article is available in the show Notes to this episode. Large scale supply chain attack using generative AI is now possible. Crystal Morin, former intelligence analyst for the U.S. air Force and cybersecurity strategist at Sysdig, says she anticipates seeing high, highly successful supply chain attacks in 2025 that originated with an LLM generated spearfish. This, she says, is because cybercrime groups now know that they do not need to train their own LLMs when they can steal credentials and then jailbreak existing ones. She states that this is not pointing to a fully AI generated attack leading to business operations shutdown, but instead the focus will be on more sophisticated social engineering campaigns. She calls spear phishing and social engineering her greatest security concern for 2025. Make sure to join us later today at 3:30pm Eastern for our Week in Review show. Quincy Castro, CISO at Redis, will be our guest, providing his expert commentary on the news of the week. And we encourage participation and comments through our YouTube live channel. So just go to the events [e-mail] to register. Steve I'm Steve Prentice reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.