Cyber Security Headlines: September 4, 2025

Podcast: CISO Series – Cyber Security Headlines
Host: Hadas Kasorla
Episode Theme:
A quick-fire roundup of the most critical cybersecurity incidents and evolving threats dominating the fintech, enterprise, and public sectors, spotlighting clever heist prevention, new state-backed malware, ongoing supply chain fallout, and the relentless adaptation of threat actors.

Key Stories and Discussion Points

1. Fintech Heist Thwarted at Cinqia SA

• Summary:
  A sophisticated cybercriminal attempt to steal $130 million by exploiting Brazil’s Pix real-time payment system was quickly detected and contained by Cinqia SA, the Brazilian arm of Evertech.
• Key Details:
  • Breach was via stolen credentials from an IT vendor.
  • Immediate halting of Pix transactions following detection on Aug. 29.
  • Cybersecurity forensic experts brought in; some stolen funds already recovered.
  • Cinqia’s access to Pix is now revoked by regulators.
  • No customer data compromised, but financial/reputational impact still unclear.
• Memorable Quote:

  “No customer data appears affected, but the full financial and reputational impact is still under review.” (Hadas Kasorla, 01:00)

2. APT28 Deploys “Notdoor” Outlook Backdoor

• Summary:
  Russia’s state-backed APT28 has released a stealthy new malware—dubbed “Notdoor”—that activates only when triggered by a special email keyword in Microsoft Outlook, making it extremely difficult to detect.
• Key Details:
  • Sits dormant until receiving a trigger email (e.g., subject: "Daily Report").
  • Upon activation, it can steal data, execute commands, and erase all traces.
  • Stealth and control are key benefits for the hackers.
• Notable Moment:

  “They called it Not Door because of the use of the word nothing in the code and not because it’s not a door—because it’s totally a door. A backdoor.” (Hadas Kasorla, 02:24)

3. Salesloft-Drift Supply Chain Fallout Spreads

• Summary:
  The breach which affected companies through stolen OAuth tokens in the Salesloft/Drift/Salesforce supply chain continues to affect high-profile organizations.
• Key Details:
  • Cloudflare confirms attackers accessed Salesforce support and extracted 104 API tokens (since rotated).
  • Palo Alto Networks and Zscaler also impacted.
  • Attackers used stolen OAuth tokens between August 8–18.
  • More companies may be implicated as the investigation expands.
• Memorable Quote:

  “This is why we can’t have nice things.” (Hadas Kasorla, 03:12)

4. HexStrike AI: Red Team Tool Goes Rogue

• Summary:
  HexStrike AI, intended for defensive red teaming, is being exploited by threat actors to launch rapid, automated attacks on recently disclosed vulnerabilities—sometimes within minutes of disclosure.
• Key Details:
  • Orchestrates 150+ security tools via AI agents.
  • Built-in retry logic boosts attack success rates.
  • Used to flag and sell vulnerable systems to other criminals.
  • Cited exploits include Citrix Netscaler zero-days and n-days.
• Notable Quote:

  “By orchestrating more than 150 security tools through AI agents, it scans, crafts and delivers exploits on its own.” (Hadas Kasorla, 04:04)

5. FSB Operatives Indicted for Global Infrastructure Hacks

• Summary:
  US State Department offers up to $10 million for tips on three Russian FSB hackers from Center 16 (a.k.a. Berserk Bear, Blue Kraken, Dragonfly, etc.), linked to critical infrastructure attacks spanning over 130 countries.
• Key Details:
  • Targeted the US Nuclear Regulatory Commission and hundreds of other energy firms, 2012–2017.
  • Recently connected to Cisco router exploits in US networks.
  • Anonymous tips via the Rewards for Justice Tor Channel.
• Memorable Quote:

  “A bear, a Kraken and a Yeti walk into a breach...” (Hadas Kasorla, 05:02)

6. Iranian State-Backed “Homeland Justice” Phishing Campaign

• Summary:
  Global spear-phishing blitz targets embassies and major organizations using over 100 hijacked email accounts, masquerading as official documents to install persistent malware.
• Key Details:
  • Campaign sourced from Oman's Foreign Ministry in Paris among others.
  • Lures induce enabling of malicious macros in fake Word docs.
  • Attacks are attributed to Iran’s Ministry of Intelligence—not for profit, but espionage.
• Notable Moment:

  “Security researchers say the operation is espionage, not crime for profit, and attribute it to Iran’s Ministry of Intelligence.” (Hadas Kasorla, 06:02)

7. Dark Web Fake ID Marketplace Seized (Sort Of)

• Summary:
  US and Dutch law enforcement seized Verif Tools, a marketplace selling counterfeit IDs and financial documents—but the operators already relaunched the marketplace under a new domain.
• Key Details:
  • Verif Tools sold documents as cheaply as $9; netted $6.4 million since 2022.
  • Two dozen servers seized. Operators quickly reappear elsewhere.
• Notable Quote:

  “...in a twist that feels on brand, the operators have already relaunched the service under a new domain, giving the fake identity ring a fresh identity of their own.” (Hadas Kasorla, 07:04)

8. Android Patch: 120 Flaws Fixed, 2 Zero-Days

• Summary:
  Google’s Sept 2025 Android update patches an unprecedented 120 vulnerabilities, including two zero-days already in the wild.
• Key Details:
  • Zero-days affect the Android kernel (full device compromise) and runtime (privilege escalation with no user action).
  • Staged rollout to enable rapid response by different device makers.
  • Users urged to patch ASAP.
• Notable Quote:

  “The updates are being rolled out in two stages, giving device makers flexibility in deploying fixes across different hardware.” (Hadas Kasorla, 08:03)

Notable Quotes & Memorable Moments

• “No customer data appears affected, but the full financial and reputational impact is still under review.” (01:00)
• “They called it Not Door because of the use of the word nothing in the code and not because it’s not a door—because it’s totally a door. A backdoor.” (02:24)
• “This is why we can’t have nice things.” (03:12)
• “By orchestrating more than 150 security tools through AI agents, it scans, crafts and delivers exploits on its own.” (04:04)
• “A bear, a Kraken and a Yeti walk into a breach...” (05:02)
• “...in a twist that feels on brand, the operators have already relaunched the service under a new domain, giving the fake identity ring a fresh identity of their own.” (07:04)

Timestamps for Key Segments

• Fintech Heist Foiled — 00:30–01:30
• APT28 “Notdoor” Malware — 01:30–02:30
• Salesloft/Drift Fallout Continues — 02:30–03:30
• HexStrike AI Abused — 03:30–04:30
• Russian FSB Critical Infrastructure Attacks — 04:30–05:30
• Iranian Homeland Justice Phishing — 05:30–06:30
• Fake ID Marketplace Seizure & Rebirth — 06:30–07:30
• Android 120-Flaw Patch — 07:30–08:30

Tone and Style

Brisk, slightly sardonic, and deeply informed—a style that keeps even complex security topics accessible and engaging without sacrificing substance.

For full stories and links, visit cisoseries.com.