CISA's Commvault warning, updated Killnet returns, fake VPN malware

Summary

Cyber Security Headlines - Episode Summary

Podcast Information:

• Title: Cyber Security Headlines
• Host/Author: CISO Series
• Description: Daily stories from the world of information security. To delve into any daily story, head to CISOseries.com.
• Episode: CISA’s Commvault Warning, Updated Killnet Returns, Fake VPN Malware
• Release Date: May 26, 2025

---

1. CISA Warns Commvault Clients of Targeted Cyber Campaigns

Speaker: Steve Prentiss
Timestamp: [00:00]

CISA has issued a critical warning to clients of Commvault, a prominent data management firm, regarding ongoing cyber threats targeting their cloud applications. This alert follows a February data breach, disclosed by Commvault and revealed by Microsoft, where a nation-state actor accessed application credentials used by some Commvault customers to authenticate with Microsoft 365.

Key Points:

• Targeted Environment: Attackers are focusing on Commvault’s applications hosted on Microsoft Azure.
• Nature of Attack: Exploitation of Software as a Service (SaaS) applications with default settings and elevated permissions.
• Vulnerability Concerns: The primary target appears to be Commvault's M365 backup solution, Metallic, raising alarms about widespread vulnerabilities within similar cloud infrastructures.

Quote:
"The agency believes this is part of a broader campaign aimed at exploiting software as a service applications with default settings and elevated permissions." – Steve Prentiss [00:00]

2. Resurgence of Russian Hacker Group Killnet

Speaker: Steve Prentiss
Timestamp: [02:30]

Killnet, a Russian hacker group, has re-emerged after a period of inactivity. They claim responsibility for hacking Ukraine’s drone tracking system to support Russian military efforts—a statement echoed in Russian media but yet to be independently verified.

Key Points:

• Timing and Motivation: Their return coincides with Russia's Victory Day, suggesting a strategic move to bolster propaganda efforts.
• Shift in Operations: Analysts note that Killnet now appears less ideologically driven and may function more as a for-hire cybercrime entity, seeking both reputation and financial gain.
• Broader Implications: The activities could be part of a wider Russian information operation amidst ongoing diplomatic negotiations involving the US, Russia, and Ukraine.

Quote:
"Analysts suggest this reappearance may be more about re-establishing relevance than executing a specific anti-Ukraine operation." – Steve Prentiss [02:45]

3. Malware Campaign Using Fake VPN and Browser Installers

Speaker: Steve Prentiss
Timestamp: [05:00]

Rapid7 researchers have identified a sophisticated malware campaign utilizing counterfeit software installers that masquerade as legitimate tools like Let's VPN and QQ Browser. These malicious installers deliver the WinOS 4.0 framework, specifically targeting Chinese-speaking environments.

Key Points:

• Malware Delivery: The campaign employs a multi-stage, memory-resident loader named Katena (C-A-T-E-n-a).
• Target Demographics: Chinese-speaking users are the primary focus, indicating strategic planning by a capable threat actor.
• Long-term Strategy: The attackers demonstrate meticulous long-term planning, suggesting persistence and high-level operational capabilities.

Quote:
"The cybersecurity company is calling out the careful long-term planning apparently by a very capable threat actor." – Steve Prentiss [05:10]

4. European Operation Endgame Takedowns Ransomware Infrastructure

Speaker: Steve Prentiss
Timestamp: [07:45]

Operation Endgame, a coordinated effort by Europol and Eurojust, successfully dismantled significant ransomware infrastructure across Europe. Conducted from May 19th to 22nd, the operation resulted in the takedown of 300 servers and 650 domains, alongside the issuance of 20 international arrest warrants.

Key Points:

• Collaboration: The operation involved agents from multiple EU countries, the US, the UK, and Canada.
• Financial Impact: Authorities seized approximately €3.5 million in cryptocurrency.
• Targeted Malware: Focus was on initial access malware used by threat actors to infiltrate systems before deploying ransomware like Ryuk and Conti.

Quote:
"The operation targeted initial access malware used by threat actors to infiltrate systems prior to ransomware deployment." – Steve Prentiss [07:50]

5. AI-Generated TikTok Videos Facilitate Click Fix Attacks

Speaker: Steve Prentiss
Timestamp: [10:15]

Trend Micro researchers have uncovered a new malware campaign where cybercriminals utilize AI-generated TikTok videos to deceive users into executing malicious commands. These "click fix" attacks aim to install Vidar malware and steal sensitive information.

Key Points:

• Modus Operandi: Videos mimic legitimate tools like Capcut and Spotify, offering unsolicited commands to enhance user experiences.
• Viral Potential: One video claiming to boost Spotify features has amassed nearly 500,000 views and over 20,000 likes.
• AI Involvement: The uniformity in video design and narration suggests extensive use of AI to automate the attack vector.

Quote:
"The videos are all very similar in design and narration and appear to be largely AI generated." – Steve Prentiss [10:20]

6. FBI Alerts Law Firms to Luna Moth Extortion Tactics

Speaker: Steve Prentiss
Timestamp: [13:00]

The FBI has issued a warning to U.S. law firms about an extortion gang known as Silent Ransom Group or Luna Moth. Over the past two years, this group has targeted law firms using callback phishing and social engineering tactics to gain unauthorized access to corporate networks, leading to ransomware attacks by groups like Ryuk and Conti.

Key Points:

• Attack Techniques: Utilization of remote access session requests via email or malicious webpages.
• Operational Strategy: Once access is granted, employees are coerced into performing seemingly legitimate tasks overnight, facilitating further infiltration.
• Impact: This method has provided a gateway for significant ransomware incursions affecting sensitive legal data.

Quote:
"The FBI describes their attack style as directing an employee to join a remote access session either through an email sent to them or navigating to a webpage." – Steve Prentiss [13:05]

7. Quackbot Leader Indicted in the U.S.

Speaker: Steve Prentiss
Timestamp: [15:30]

Rustam Rafaelich Galyamov, a Russian national, has been indicted in the United States for his role in developing and operating the QuackBot malware since 2008. His actions have led to the infection of hundreds of thousands of computers globally, creating a vast botnet that was exploited across various industries, including healthcare, insurance, and technology.

Key Points:

• Criminal Activities: Galyamov and his co-conspirators sold access to QuackBot-infected machines to other cybercriminals, facilitating ransomware attacks from families like Black, Basta, Cactus, Conti, and Revil.
• Industry Impact: Organizations across multiple sectors have been affected, underscoring the widespread reach and damage of QuackBot operations.
• Legal Proceedings: The indictment is based on newly unsealed charges highlighting the extensive criminal network.

Quote:
"Galyamov and his co-conspirators allegedly sold access to Quackbot infected machines to other cybercriminals who deployed ransomware families such as Black, Basta, Cactus, Conti and Revil." – Steve Prentiss [15:35]

8. Google Chrome Updates Enhance Password Security

Speaker: Steve Prentiss
Timestamp: [18:00]

Google is integrating a new feature into its Chrome browser’s password manager, aimed at strengthening user security by automatically updating compromised passwords. This feature detects compromised credentials during sign-in and offers to generate and apply a strong replacement password seamlessly.

Key Points:

• Automatic Protection: The password manager will prompt users to fix compromised passwords by generating secure alternatives without manual intervention.
• Target Audience: Currently geared towards developers to optimize their websites in preparation for the feature’s official rollout.
• User Convenience: Designed to minimize friction and ensure account security without requiring users to navigate complex settings or abandon processes.

Quote:
"Google says the feature has not yet been formally launched for end users and that it is mainly geared towards developers so that they can optimize their websites for the time that the feature launches." – Steve Prentiss [18:05]

9. Upcoming Events: Super Cyber Friday and Week in Review

Speaker: Steve Prentiss
Timestamp: [20:45]

Looking ahead, the CISO Series is excited to announce "Super Cyber Friday," featuring discussions on "Hacking Provable Security." This event will focus on critical thinking approaches to surpass traditional security ratings and questionnaires. Scheduled for Friday at 1 PM Eastern, it will be followed by the "Week in Review" show at 3:30 PM Eastern, featuring guest Steve Knight, former CISO at Hyundai Capital America.

Key Points:

• Event Access: Listeners can join both shows via the Events page on CISO Series.
• Engagement: The host encourages listeners to share their thoughts and feedback via email at [e-mail].
• Continuous Programming: Cybersecurity headlines are updated every weekday, with in-depth stories available at cisoseries.com.

Quote:
"It's never too late to start thinking about Friday and this Friday we are back with another episode of Super Cyber Friday, where the topic will be Hacking Provable Security, an hour of critical thinking on how to go beyond security ratings and questionnaires." – Steve Prentiss [20:50]

---

Conclusion:

This episode of "Cyber Security Headlines" provided an in-depth overview of current threats and responsive measures within the cybersecurity landscape. From CISA’s warnings and the resurgence of Killnet to sophisticated malware campaigns and significant law enforcement actions, the discussion highlighted the evolving nature of cyber threats and the importance of proactive security measures. Additionally, updates from major players like Google underscore the ongoing advancements in protecting user data. The upcoming events promise further insightful discussions, ensuring listeners remain informed and prepared in the dynamic field of information security.

For more detailed stories and updates, visit CISO Series.

Transcript

[Steve Prentiss]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, May 26, 2025. I'm Steve Prentiss. CISA warns Commvault clients of campaign targeting cloud applications the agency is warning that hackers are targeting cloud environments used by clients of data management firm Commvault. The company had previously disclosed a February data breach revealed by Microsoft involving a nation state actor who accessed app credentials used by some Commvault customers to authenticate with Microsoft 365 CISA now reports ongoing cyber threat activity targeting Commvault's applications hosted in Microsoft Azure. The agency believes this is part of a broader campaign aimed at exploiting software as a service applications with default settings and elevated permissions. The attackers likely accessed client secrets, unique codes that link applications to servers, specifically targeting Commvault's M365 backup solution Metallic raising concerns about widespread vulnerability, Russian hacker group Killnet returns with slightly adjusted mandate the group has resurfaced after months of inactivity, claiming to have hacked Ukraine's drone tracking system to aid Russian forces, a claim promoted by Russian media but unverified by independent sources. The timing of the reappearance coincides with Russia's victory day, a key date for propaganda. Analysts suggest this reappearance may be more about re establishing relevance than executing a specific anti Ukraine operation. Cyber experts note that Killnet now seems less ideologically driven and more like a for hire cybercrime group seeking reputation and profit. Researchers view the heavily publicized activity as potentially part of a broader Russian information operation, especially amid ongoing diplomatic efforts involving the us, Russia and Ukraine. Fake VPN and browser Ensys installers used to deliver WinOS 4.0 malware Researchers at Rapid7 are warning of a malware campaign that uses fake software installers masquerading as popular tools like let's VPN and QQ Browser to deliver the WinOS 4.0 framework that is spelled W I n o s. This campaign, which was first detected by Rapid7 in February of this year, involves the use of a multi stage memory resident loader called Katena that is spelled C A T E n a. The company says the attacks appear to focus specifically on Chinese speaking environments, with the cybersecurity company calling out the careful long term planning apparently by a very capable threat actor. European Operation Endgame takes down key ransomware infrastructure this Operation Endgame refers to a campaign coordinated by Europol and Eurojust, which is the European Union Agency for Criminal Justice Cooperation the campaign executed from May 19th through to the 22nd and took down 300 servers and 650 domains and issued 20 international arrest warrants. Agents from numerous EU countries along with the US, the UK and Canada helped with this investigation, which started back in 2024 and culminated in the May takedowns. Authorities also seized 3.5 million euros in cryptocurrency. The operation targeted initial access malware used by threat actors to infiltrate systems prior to ransomware deployment, huge thanks to our sponsor ThreatLocker. ThreatLocker is a global leader in Zero Trust endpoint security, offering cybersecurity controls to protect businesses from zero day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and to start your free trial, visit threatlocker.com CISO that is T H R E A T L-O C K-E-R.com CISO AI generated TikTok videos push click fix attacks as described by researchers at Trend Micro, Cybercriminals are using TikTok videos to trick users into infecting themselves with Vidar and steal C information, stealing malware through click fix attacks. The messages aim to get viewers to run commands that promise to activate Windows and Microsoft Office, along with premium features in some legitimate software brands such as Capcut and Spotify. The videos are all very similar in design and narration and appear to be largely AI generated. One of these videos claims to provide instructions on how to boost your Spotify experience instantly and has reached almost 500,000 views with over 20,000 likes. Luna moth Extortion attacks targeting Law firms, says FBI the FBI has issued a warning about an extortion gang named Silent Ransom Group, which has been targeting US Law firms over the past two years using callback, phishing and social engineering attacks. This group is also known as Luna Moth, known for conducting bazaar call campaigns that provided initial access to corporate networks for Ryuk and Conti ransomware attacks. The FBI describes their attack style as directing an employee to join a remote access session either through an email sent to them or navigating to a webpage. Once the employee grants access to their device, they are told that work needs to be done overnight. End Quote Quackbot leader indicted in US the Russian national Rustam Rafaelich Galyamov, 48, is allegedly the individual who developed, deployed and controlled the QuackBot malware that is Q A K bot since its start in 2008, according to the newly unsealed indictments. The Quackbot gang infected hundreds of thousands of computers worldwide, ensnaring them in a botnet. Victim organizations belonged to a range of industries including healthcare, insurance, manufacturing, marketing, music, real estate, technology and telecommunications. Galliamov and his co conspirators allegedly sold access to Quackbot infected machines to other cybercriminals who deployed ransomware families such as Black, Basta, Cactus, Conti and Revil New Google Chrome extension updates breached passwords with one click A new feature in the Chrome browser lets its built in password manager automatically change a user's password when it detects the credentials to be compromised, according to its designers. When Chrome detects a compromised password during sign in, Google Password Manager prompts the user with an option to fix it, automatically generating a strong replacement and updating the password for the user. Google says the feature has not yet been formally launched for end users and that it is mainly geared towards developers so that they can optimize their websites for the time that the feature launches. End quote Google added Quote the goal of this feature is to, quote, reduce friction and help users keep their accounts secure without having to search for relevant account settings or abandon the process midway. End quote it's never too late to start thinking about Friday and this Friday we are back with another episode of Super Cyber Friday, where the topic will be Hacking Provable Security, an hour of critical thinking on how to go beyond security ratings and questionnaires. This starts at 1pm Eastern and is followed at 3:30pm Eastern by our Week in Review show. Steve Knight, former CISO at Hyundai Capital America, will be our guest, bringing his expertise on the news stories of the week. To join in on both shows, go to the Events page at CISO Series and if you have some thoughts on the news from today or about the Cybersecurity Headlines show in general, please be sure to reach out to us by [e-mail] we would love to hear from you. I'm Steve Prentiss reporting for the CISO Series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines. Sam.