Cyber Security Headlines: China Hacks Treasury, Russian Tanker Sabotage, Lumen Ejects Typhoon
Hosted by CISO Series | Release Date: January 3, 2025

In this episode of Cyber Security Headlines, host Steve Prentiss delves into three major cybersecurity incidents shaping the landscape in early 2025. From state-sponsored hacking activities targeting U.S. financial systems to sophisticated sabotage of undersea data cables by Russian operatives, and significant defensive actions taken by major telecom companies against persistent threats, this episode provides an in-depth analysis of current cybersecurity challenges and responses.

1. Beijing-Linked Hackers Penetrate U.S. Treasury Systems

Steve Prentiss opens the episode by discussing a severe cybersecurity breach involving state-sponsored Chinese hackers targeting the U.S. Treasury Department.

Steve Prentiss [00:00]: "Beijing linked hackers penetrated U.S. treasury systems according to a letter sent from the U.S. treasury to congressional lawmakers on Monday."

Key Points:

• Incident Overview: A Chinese state-sponsored Advanced Persistent Threat (APT) group compromised U.S. Treasury Department workstations and accessed classified documents at the Office of Foreign Assets Control.
• Discovery and Response: The breach was identified on December 8 by Beyond Trust, revealing that the attackers obtained a security key enabling remote access to employee systems.
• Impact Details: The Treasury did not disclose the number of affected workstations or the specific types of documents accessed. However, the compromised service has been taken offline, and there is no current evidence of ongoing unauthorized access.

Steve Prentiss [00:02]: "The Department had been notified on December 8 by Beyond Trust that a foreign actor had obtained a security key that allowed it to remotely gain access to employee workstations and the classified documents stored on them."

Implications: This breach underscores the persistent threat posed by state-sponsored cyber actors targeting critical financial infrastructure. The lack of detailed information about the scope of the breach highlights the challenges in fully assessing and mitigating such sophisticated attacks.

2. Russian Tanker Suspected of Undersea Data Cable Sabotage

The episode continues with a critical incident involving maritime sabotage allegedly orchestrated by Russian entities, targeting vital undersea data cables in the Baltic Sea.

Steve Prentiss [00:05]: "Yesterday's episode of Cybersecurity Headlines briefly mentioned that Finnish authorities seized a Russian ship after it allegedly damaged several submarine cables in the Baltic Sea."

Key Points:

• The Vessel: The seized ship, Eagle S, is an oil tanker suspected of intentionally dragging its anchor to sever multiple undersea cables, including the Estlink II power cable and four telecommunications cables.
• Operational Details: Eagle S departed from a Russian port on December 25 before the suspected sabotage. Finnish authorities conducted a helicopter boarding, apprehending seven suspects without immediate arrests.
• Evidence of Espionage: Reports from Lloyds List reveal that Eagle S was equipped with spying devices uncommon for a standard merchant vessel. These included equipment for monitoring NATO naval and aircraft communications and deploying sensor-type devices in the English Channel.

Steve Prentiss [00:06]: "A report from the shipping journal Lloyds List describes the Eagle S as loaded with spying equipment unusual for a merchant ship, used to monitor NATO naval and aircraft radio communications and to drop sensor type devices in the English Channel."

Implications: This incident highlights the escalating tactics used by nation-states to disrupt and gather intelligence on critical communication infrastructures. The involvement of a commercial oil tanker in such activities raises concerns about the blending of civilian and military assets in cyber-espionage efforts.

3. Lumen Ejects Salt Typhoon Group from Its Network

Steve Prentiss then addresses significant defensive measures taken by major telecom giant Lumen against a persistent China-linked APT group known as Salt Typhoon.

Steve Prentiss [00:08]: "Following revelations last week that a ninth telecom company had been penetrated by the China linked APT Group, Salt Typhoon, Lumen announced this week that the group had been ejected from and locked out of the Lumen network."

Key Points:

• Incident Background: Salt Typhoon, identified as a China-linked APT group, had penetrated nine telecom companies, raising alarms about widespread vulnerabilities.
• Lumen's Response: Upon discovery, Lumen conducted an independent forensic analysis confirming the removal of the Chinese actors from their network.
• Data Integrity: Mark Molson, Lumen's spokesperson, assured that there is no evidence of customer data being accessed during the breach.

Mark Molson: "An independent forensic analysis confirmed the company ejected the Chinese actors from its network, adding that there is no evidence that customer data was accessed."

Implications: Lumen's proactive response and assurance regarding customer data protection demonstrate effective incident management and the importance of swift action in mitigating the impact of cyber intrusions. This case also emphasizes the ongoing threat posed by Salt Typhoon to the telecommunications sector.

4. Biden Administration Finalizes Rule to Block Sale of Americans' Bulk Data to Adversaries

Transitioning from active threats, the episode highlights significant policy developments aimed at safeguarding American data from adversarial states.

Steve Prentiss [00:10]: "The Biden administration finalized a rule to block sale of Americans bulk data to adversaries. This rule, first proposed as an executive order last February and finalized last Friday, means that companies will no longer be able to sell sensitive data about Americans to countries of concern."

Key Points:

• Affected Countries: The rule targets sales of sensitive American data to Russia, China, Iran, North Korea, Cuba, and Venezuela.
• Purpose: According to the U.S. Department of Justice, such data could be exploited for espionage, blackmail, influence campaigns, and other malicious activities.

Implications: This policy move represents a strategic effort to curb the flow of American personal and sensitive data to nations with adversarial relationships, thereby reducing the risk of data being used for geopolitical manipulation or cyber-attacks.

5. Malicious NPM Package Deploys Quasar RAT

The discussion shifts to software supply chain security, focusing on a newly identified malicious package within the Node Package Manager (NPM) ecosystem.

Steve Prentiss [00:12]: "A researcher from the Security platform Socket is warning of a malicious package on the NPM that is Node Package Manager registry, which appears as a library for detecting vulnerabilities in Ethereum smart contracts, but actually drops an open source remote access trojan called Quasar Rat onto developers systems."

Key Points:

• Package Details: The malicious package, deceptively named Ethereum Vuln Contract Handler, masquerades as a tool for vulnerability detection in Ethereum smart contracts.
• Malware Deployment: Upon installation, it deploys Quasar RAT, an open-source Remote Access Trojan first appearing on GitHub in July 2014, notorious for its use in cybercrime and espionage.
• Threat Impact: This type of supply chain attack can compromise the integrity of development environments, leading to unauthorized access and data exfiltration.

Implications: The emergence of such malicious packages underscores the critical need for rigorous scrutiny of dependencies in software development. It highlights the vulnerabilities inherent in widely used package repositories and the potential for significant security breaches through seemingly innocuous libraries.

6. OWASP Top 10 for 2025

Looking ahead, the episode discusses the upcoming Open Web Application Security Project (OWASP) Top 10 list for 2025, providing insights into evolving web application security risks.

Steve Prentiss [00:15]: "With its data collection phase having been scheduled to end by the end of December 2024, the organization plans to release its list in early 2025."

Key Points:

• Methodology Enhancements: The 2025 update incorporates a refined approach to data collection, leveraging insights from security vendors, consultancies, and bug bounty programs. It emphasizes not just the frequency of vulnerabilities but also their impact on multiple applications.
• Expected Top Risks: The top three risks are anticipated to remain consistent with the 2021 list—Broken Access Control, Cryptographic Failures, and Injection.
• Rank Movements: Security Misconfiguration and Identification and Authentication Failures are expected to rise in the rankings, while Exposed Sensitive Data is projected to enter the top ten for the first time, positioned at sixth place.

Aditya Sawant [Referenced by Steve Prentiss [00:17]]: "This gives a clearer picture of real-world impact."

Implications: The OWASP Top 10 serves as a critical framework for organizations to prioritize and address the most significant web application security risks. The anticipated changes reflect the dynamic nature of cyber threats and the necessity for continuous adaptation in security strategies.

7. Large-Scale Supply Chain Attack Using Generative AI

The episode concludes with a forward-looking analysis on the potential for large-scale supply chain attacks facilitated by generative AI technologies.

Crystal Morin [00:19]: "She anticipates seeing highly successful supply chain attacks in 2025 that originated with an LLM generated spearphish."

Key Points:

• Attack Vector Evolution: Cybercriminals are leveraging Large Language Models (LLMs) to create sophisticated spear-phishing campaigns without the need to develop their own AI models. Instead, they exploit stolen credentials to jailbreak existing models.
• Impact Scope: While not predicting complete shutdowns of business operations, Crystal Morin highlights that these AI-generated attacks will enhance the sophistication of social engineering efforts.
• Primary Concern: The amplified effectiveness of spear-phishing and social engineering campaigns represents a significant security challenge for organizations in 2025.

Crystal Morin [00:19]: "She calls spear phishing and social engineering her greatest security concern for 2025."

Implications: The integration of generative AI into cyberattack strategies marks a significant escalation in the complexity and potential success of social engineering tactics. Organizations must prioritize advanced training, awareness programs, and robust verification processes to mitigate these evolving threats.

Conclusion

This episode of Cyber Security Headlines provides a comprehensive overview of the multifaceted cybersecurity threats facing organizations and governments globally. From state-sponsored intrusions and maritime sabotage to policy reforms and emerging AI-driven attack vectors, the discussions underscore the critical need for proactive and adaptive security measures. By highlighting both current incidents and future projections, the episode equips listeners with valuable insights to navigate the increasingly complex cyber threat landscape.

For more detailed coverage and continuous updates, visit CISOseries.com.