Document converter warning, Resurge exploits Ivanti, Blacklock hackers exposed

Summary

Cyber Security Headlines Summary: Document Converter Warning, Resurge Exploits Ivanti, Blacklock Hackers Exposed

Podcast: Cyber Security Headlines by CISO Series | Release Date: March 31, 2025 | Host: Steve Prentiss

In the March 31, 2025 episode of "Cyber Security Headlines," host Steve Prentiss provided listeners with an in-depth analysis of the latest threats and incidents in the cybersecurity landscape. The episode covered a range of topics, including rising online scams, advanced malware threats, ransomware group exposures, significant data breaches in the healthcare sector, and emerging phishing operations. Below is a comprehensive summary of the key discussions, complete with notable quotes and timestamps.

---

1. FBI Alerts on Free Online Document Converter Scams

Overview: The episode opened with a warning from the FBI regarding an increase in scams involving free online document converter tools.

Key Points:

• The FBI’s Denver field office has observed a surge in scams where fraudulent document converters either deliver malware—such as ransomware—or facilitate identity theft.
• These fake tools often perform their advertised functions (e.g., converting Word documents to PDFs) but at significant hidden costs to users.
• Consumers are urged to be cautious with downloads from unverified sources and to report suspicious activities to the Internet Crime Complaint Center (ic3.gov).

Notable Quote:

Steve Prentiss (00:00): "The FBI warns that these fake file converters may do the job as advertised, but at quite a cost."

---

2. Resurge Malware Exploits Ivanti Vulnerability

Overview: Prentiss discussed the emergence of a new malware strain, Resurge, targeting a previously patched vulnerability in Ivanti Connect Secure appliances.

Key Points:

• CISA Warning: The Cybersecurity and Infrastructure Security Agency (CISA) has issued alerts about Resurge, which appears to be derived from the Spaun Chimera malware variant.
• Capabilities: Resurge can survive system reboots and includes functionalities like rootkit dropper, backdoor, bootkit proxy, and tunneler.
• Exploited Vulnerability: It targets a stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA gateways, potentially allowing remote code execution.
• Patch Status: Although Ivanti patched this vulnerability in January 2025, the existence of Resurge underscores the importance of timely patch management.

Notable Quote:

Steve Prentiss (00:11): "CISA is warning of a new malware called Resurge that is capable of surviving reboots and contains capabilities of a rootkit dropper, backdoor bootkit proxy, and tunneler."

---

3. Blacklock Ransomware Group Exposed

Overview: The ransomware group Blacklock, formerly known as El Dorado, has been compromised through a vulnerability in their data leak site.

Key Points:

• Exposure Details: Threat hunters from RE Security exploited a misconfiguration in Blacklock’s data leak site, allowing access to configuration files, credentials, and command history.
• Operational Failures: The breach revealed net IP addresses associated with Blacklock’s infrastructure, which were previously concealed behind Tor Hidden Services.
• Significance: This incident is described as one of the most significant operational security failures for the Blacklock ransomware group.

Notable Quote:

Steve Prentiss (00:23): "This misconfiguration led researchers to clear Net IP addresses related to their network infrastructure behind Tor Hidden Services."

---

4. Oracle Health Patient Data Breach

Overview: A major data breach at Oracle Health has compromised patient data across multiple U.S. hospitals and healthcare organizations.

Key Points:

• Nature of the Breach: The attack involved the theft of patient data from legacy servers, executed by an unidentified threat actor.
• Impact: The breach affects multiple healthcare institutions, raising concerns about patient privacy and data security.
• Company Background: Oracle Health, formerly Cerner, provides electronic health records and business operations systems. After being acquired by Oracle in 2022, its systems were migrated to Oracle Cloud.
• Current Status: Oracle Health has not publicly disclosed the breach, but Bleeping Computer has confirmed the incident through private communications and interviews.

Notable Quote:

Steve Prentiss (00:29): "Oracle Health has not yet publicly disclosed the incident, but in private communications sent to impacted customers and from conversations with those involved, Bleeping Computer has confirmed that patient data was stolen in the attack."

---

5. Hackers Target Taiwan with Fake Messaging Apps

Overview: Cybercriminals are targeting Taiwan by distributing malware through fake instant messaging applications.

Key Points:

• Malware Details: The malware, named PJob RAT, is an Android remote access trojan that allows attackers extensive control over infected devices, including data theft and disabling battery optimizations to ensure continuous operation.
• Delivery Method: PJob RAT was distributed via malicious apps named Sangal Lite and CChat, which mimicked legitimate messaging platforms.
• Distribution Channels: These fake apps were available for download on multiple WordPress sites, which have since been taken offline.
• Campaign Status: No recent activity has been observed, suggesting the campaign may have ended.

Notable Quote:

Steve Prentiss (00:47): "PJob RAT is an Android remote access trojan that gives attackers greater control over infected devices, allowing them to steal data from various applications."

---

6. Microsoft Removes Windows 11 Microsoft Account Bypass

Overview: Microsoft has taken steps to eliminate the option to bypass using a Microsoft account during the installation of Windows 11.

Key Points:

• Previous Functionality: An NRO_CMD script in Windows 11 preview builds allowed users to skip signing in with a Microsoft account.
• Current Changes: Microsoft has removed this script from the latest Insider Dev Preview builds, indicating that the requirement to use a Microsoft account will be enforced in production builds.
• User Impact: This change mandates that all users must have a Microsoft account to install Windows 11, regardless of their preference.

Notable Quote:

Steve Prentiss (00:57): "This change basically forces all users to have a Microsoft account whether they want one or not."

---

7. Sam's Club Investigates Alleged Klopp Ransomware Attack

Overview: Sam's Club, a Walmart-owned membership warehouse club, is investigating a potential ransomware attack attributed to the Klopp ransomware gang.

Key Points:

• Attack Details: The breach, which occurred in December, involved a software exploit, though no stolen data has been publicly leaked by the attackers.
• Ransomware Group Activity: Klopp has accused Sam's Club of neglecting security measures and has a history of targeting other companies, including Rackspace Technology.
• Broader Impact: Klopp has claimed responsibility for hacking approximately 170 companies by exploiting zero-day vulnerabilities in Clio file transfer software.

Notable Quote:

Steve Prentiss (01:05): "Sam's Club has been listed as one of the victims of a software exploit and breach that occurred in December."

---

8. Morphing Meerkat: New Phishing-as-a-Service Operation

Overview: A new phishing-as-a-service (PhaaS) platform named Morphing Meerkat has been identified, leveraging advanced techniques to evade detection.

Key Points:

• Operational Mechanics: Morphing Meerkat uses the DNS over HTTPS protocol to obscure its activities and evade traditional detection methods.
• Capabilities: It analyzes DNS email exchange records to identify targets, email providers, and dynamically serves spoofed login pages for over 114 email brands in multiple languages, including English, Spanish, Russian, and Chinese.
• Service Offering: As a PhaaS platform, Morphing Meerkat provides a comprehensive toolkit for launching scalable and evasive phishing attacks with minimal technical expertise required.
• Targeted Providers: The platform can spoof sender names and addresses for major email services like Gmail, Outlook, and Yahoo.

Notable Quote:

Steve Prentiss (01:12): "Morphing Meerkat... provides a complete toolkit for launching effective, scalable and evasive phishing attacks that require minimal technical knowledge."

---

Conclusion:

The March 31, 2025 episode of "Cyber Security Headlines" delivered critical insights into the evolving threat landscape. From the FBI’s warnings about online scams and the rise of sophisticated malware like Resurge to the exposure of major ransomware groups and significant breaches in the healthcare sector, the episode underscored the necessity for robust cybersecurity measures. Additionally, the emergence of advanced phishing platforms like Morphing Meerkat highlights the need for continuous vigilance and adaptive security strategies.

For listeners seeking more detailed information on these topics, the full stories and analyses are available on CISOseries.com.

Transcript

[Steve Prentiss]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, March 31, 2025. I'm Steve Prentiss. FBI warns of increase in free online document converter scams the agency's Denver field office says it is seeing an increase in scams involving free online document converter tools which ultimate either deliver malware, including ransomware, to users computers or facilitate identity theft. They explain that these fake file converters and download tools may indeed do the job as advertised, such as converting a Word document to a PDF, but at quite a cost. The agency further warns consumers to be cautious with downloads and to report suspected incidents to ic3.gov resurge malware exploits Ivanti flaw CISA is warning of a new malware called Resurge that is targeting a now patched security flaw in Ivanti Connect Secure appliances. Seemingly derived from the Spaun Chimera malware variant, the file is capable of surviving reboots and contains capabilities of a rootkit dropper, backdoor bootkit proxy and tunneler. The vulnerability that it exploits is a stack based buffer overflow vulnerability affecting Ivanti Connect Secure, Policy Secure and ZTA gateways that could result in remote code execution. This flaw was patched by Ivanti in January of this year. Blacklock hackers exposed through leak site vulnerability the ransomware group Blacklock, once known as El Dorado, has been infiltrated by threat hunters from RE Security who have uncovered crucial information information about how the group operates. The threat hunters said they found a security vulnerability in the group's data leak site, which made it possible to extract configuration files and credentials as well as the history of commands executed on the server. End quote this misconfiguration led researchers to clear Net IP addresses related to their network infrastructure behind Tor Hidden Services. End quote it is being described as one of the biggest operational security failures of Blacklock ransomware. Oracle Health breach compromises patient data at US Hospitals this breach is apparently unrelated to the Oracle Cloud federated SSO login breach that we have been covering in recent days. This one at Oracle Health impacts multiple US Healthcare organizations and hospitals and involves a threat actor who stole patient data from legacy servers. According to Bleeping Computer. Oracle Health has not yet publicly disclosed the incident, but in private communications sent to impacted customers and from conversations with those involved, Bleeping Computer has confirmed that patient data was stolen in the attack. End quote Oracle Health used to be known as Cerner C E R N E R and is a healthcare software as a service company offering electronic health records and business operations systems to hospitals and healthcare organizations. After being acquired By Oracle In 2022, Cerner was merged into Oracle Health, with its systems migrated to Oracle Cloud. End quote Huge thanks to our sponsor Qualys. Overwhelmed by noise in your cybersecurity processes? Cut through the clutter with Qualys Enterprise truerisk Management. Quantify your cyber risk in clear financial terms and focus on what matters most. Actionable insights help you prioritize critical threats, streamline remediation and accelerate risk reduction while effectively communicating impact to stakeholders. Empower your cybersecurity strategy with tools that drive faster, smarter and more efficient risk management. Your secure future starts today with Qualys Enterprise True risk management. Visit qualys.cometm for more information. That is Q U A L Y S Hackers target Taiwan with malware laden fake messaging apps the malware in question is named P Job RAT and was being delivered through malicious instant messaging apps named Sangal Lite and cchat, which had been designed to resemble legitimate platforms. This is according to a report published Thursday by cybersecurity firm Sophos. They state the apps were available for Download on multiple WordPress sites, which have since been taken offline. Pjob RAT is an Android remote access trojan that gives attackers greater control over infected devices, allowing them to steal data from various applications, and even includes disabling battery optimization to ensure they run continuously in the background. The campaign seems to have come to an end since no recent activity has been observed. Microsoft removes Windows 11 account bypass According to Bleeping Computer, Microsoft has removed the bypass NRO CMD script from Windows 11 preview builds, which allowed users to bypass the requirement to use a Microsoft account when installing the operating system. Having been introduced in the latest Windows 11 Insider Dev Preview build, this means the change will likely be coming to production builds. The change basically forces all users to have a Microsoft account whether they want one or not. Sam's Club Investigates alleged Klopp Ransomware attack the Walmart owned membership warehouse club chain has been listed as one of the victims of a software exploit and breach that occurred in December. The Klopp ransomware gang has not leaked any data allegedly stolen from the club, but has accused the club of ignoring security. The ransomware group leaked files from Rackspace Technology and listed around 170 companies that were allegedly hacked via zero day vulnerabilities in the Clio file transfer software. Morphing Meerkat pops up with easy email spoofing Morphing Meerkat is the name of a newly discovered phishing as a service operation that uses the DNS over HTTPs protocol to evade detection. It also leverages DNS email exchange records to identify victims, email providers, and to dynamically serve spoofed login pages for more than 114 email brands as a Phishing As a service platform, it provides a complete toolkit for launching effective, scalable and evasive phishing attacks that require minimal technical knowledge. It can deliver this to service providers that include Gmail, Outlook, and Yahoo in multiple languages, including English, Spanish, Russian, and even Chinese, and can even spoof sender names and addresses. If you haven't checked it out yet, be sure to give a listen to our brand new show entitled Security youy Should Know. Each episode features a security vendor talking with two security experts answering the questions we all want to know about new solutions. This week we're highlighting Pentera and what they are doing to help you prioritize security gaps. Look for the [e-mail] I'm Steve Prentiss reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.