Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:06)
These are the cybersecurity headlines for Tuesday, June 10, 2025 I'm Rich Stroffelino Brute forcing phone numbers linked to Google Accounts the security researcher known as brutecat published details about how they were able to obtain the recovery phone number attached to Google Accounts due to an error in the account recovery process. Brutecat first noticed this when they found the account recovery page still worked even with JavaScript disabled in the browser. The researcher paired two HTTP requests to verify if a recovery email or phone number was linked to a display name, and then used IPv6 address rotation to avoid rate limiting and pasting in a bot guard token. With JavaScript disabled to be able to create an attack chain for a brute force attack, the process to hit a specific number for an account varied from about 20 minutes in the US to about 5 seconds in Singapore. After disclosing the flaw, Google deprecated the username recovery form used in the attack. The Guardian launches secure messaging service the UK publication partnered with the University of Cambridge to launch this new secure messaging service, offering encrypted messaging directly to journalists from within its app. Journalists have long used end to end encrypted messaging, things like signal to communicate with sources. But secure messaging is designed to provide strong, plausible deniability by making every instance of the news organization's public mobile app behave the same way, whether it's used for secure communication or for normal news consumption. Using a backend called Coverdrop, the Guardian published the source code on GitHub so other organizations can adopt it as well. United Natural foods hit by cyberattack the company confirmed it discovered a cyberattack on June 5, 2025, according to an 8K filing with the US SEC. United Natural Foods is North America's largest publicly traded wholesale food distributor, with 53 distribution centers. The company proactively took some systems offline due to the attack, disrupting customer orders. At the same time, anecdotal posts on social media mentioned that some worker shifts have been canceled as well. No ransomware group took credit for the attack, and the company has not released further details about any data loss or what systems the attacker accessed. Pathwiper hits Ukrainian critical infrastructure Researchers at Cisco Talos identified a new wiper malware hitting Ukraine tied to Russian APTS. Dubbed PathWiper, the malware was initially deployed using an endpoint administration framework executing a Visual Basic script file. Once running, PathWiper maps all attached storage using System APIs. From there, it creates threads for each volume to overwrite file system components, including master boot records. Talos Researchers say PathWiper resembles a 2022 wiper linked to the Russian Sandworm group called hermetic wiper, although PathWiper shows more sophisticated targeting. And now, thanks to today's episode sponsor Vantage, is your manual GRC program slowing you down? There's something more efficient than spreadsheets, screenshots and manual processes. Vanta with Vanta GRC can be so much easier while also strengthening your security posture and driving revenue for your business. Vanta automates key areas of your GRC program, including compliance, risk and customer trust, and streamlines the way you manage information. The impact is real. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. Get back time to focus on strengthening security and scaling your business. Get started@vanta.com headlines that's V A N T A dot com headlines Russian companies hit with lock bit. You don't tug on Superman's cape. You don't spit into the wind. You don't pull the mask off an old lone Ranger. And you don't have your ransomware Affiliates attack Russia. Those used to be the rules. However, the Russian cybersecurity firm Positive Technologies identified a financially motivated group called Dark Gaboon, which has been doing just that, deploying Lockbit 3.0 ransomware. Unlike typical Lockbit affiliates, Dark Gaboon appears to operate entirely independently, using Russian language phishing emails with malicious attachments claiming to have legitimate financial documents. Researchers say the group has appeared to operate since at least 2023, but its use of open source tools in other parts of its attack chain has made attribution difficult. FBI keeps Leatherman in its back pocket FBI Director Kash Patel named agency veteran Brett Leatherman as assistant director and head of the cyber division during his 22 year career. Leatherman served as section chief for cyber investigations and deputy assistant director for the last three years, and he's been the FBI's public face for communications on major cyber incidents going back to the Colonial Pipeline attack. He takes over for Brian Vordran, who left the FBI to work as Microsoft's deputy ciso. Given the number of personal shakeups across government cybersecurity posts since January, this is a notable bit of continuity. NHS out for blood after cyberattack On June 9, the UK's National Health Service called for people to donate blood with supplies still disrupted from a ransomware attack against the pathology services provider Synovus last year. That attack disrupted the ability for healthcare organizations to quickly match blood types, resulting in increased usage of O type stocks. Because the blood supply is maintained by a relatively small number of consistent donors, stocks have remained in a very fragile position ever since, especially for the universal donor O type recorded. Future News reported that impacted patients were still not notified of what data was exposed in the attack as of May Cloudflare creates OAuth library with Claude Last week, Cloudflare published the open source OAuth 2.1 library, which was written almost entirely by Anthropic's Claude LLM. Notably, the company also published comprehensive documentation of the process and including a full prompt history. Due to the sensitive nature of the library, this wasn't an exercise in vibe coding, and human review was involved in all parts of the process. Software developer Max Mitchell reviewed the process, finding the LLM excelled when given a substantial code block to work off of with clear context and explanation of what needed to be changed. In all instances, the LLM excelled at generating documentation. However however the code needed human intervention for styling and other housekeeping tasks. Mitchell suggested looking at this the same as collaborating with another human developer, expecting a back and forth rather than one off, prompting success. Cloudflare tech lead Kenton Varda, who oversaw the project, came into it with a healthy dose of skepticism, but ended up saying I was trying to validate my skepticism. I ended up proving myself wrong. The capabilities of generative AI systems are impressive, but we need to be realistic about their constraints. This applies to the limits of the systems themselves, but also to our ability as humans to spot them. So how do we take advantage of these new capabilities without getting taken for a ride along the way? That's one of the questions we'll be trying to answer on this week's episode of the CISO Series podcast. Look for Aside from text, images and videos, Genai can't fool me wherever you get your podcasts. And if you have some thoughts about the news from today, or just about the show in general, be sure to reach out to us@feedbacksoseries.com we'd love to hear from you. Reporting from the CISO series, I'm Rich Stroffolino, reminding you to have a super sparkly day.