Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:06)
These are the cybersecurity headlines for Tuesday, March 18, 2025. I'm Lauren Verno 23,000 repositories targeted in popular GitHub action A supply chain attack on the widely used GitHub action compromised CP CI CD secrets in build logs for over 23,000 repositories. Attackers hijacked a GitHub personal access token to inject malicious code that exposed secrets in publicly accessible workflow logs, though there's no evidence the data was exfiltrated. GitHub removed and restored the repository on March 15 after eliminating the malicious commitment, but the incident raised concerns about broader supply chain risk for open source projects. Now users are recommended to rotate secrets during the attack's timeframe, review workflows, and ensure projects use a secure tagged version of the action. Apache Tomcat RCE exploit hits servers, no authentication Required A critical RCE vulnerability in Apache Tomcat is being actively exploited, allowing attackers to hijack servers using a simple put request with a base 64 encoded Java payload. Now the flaw, which requires no authentication, stems from Tomcat's default session persistence and partial put support, making it easy to execute and difficult to detect. Now while patches have been released, a bulletin release on Wall ARM warns this is just the beginning as attackers may soon escalate tactics to deploy backdoors and modify configurations. Microsoft 365 users targeted in New BEC Campaigns A fresh batch of malicious Campaigns are exploiting Microsoft 365's trusted infrastructure to launch phishing campaigns that bypass security controls and facilitate account takeovers. These business email compromise campaigns target users using two different brand impersonation campaigns. Now the first abuses misconfigured Microsoft tenants to send fraudulent billing emails, tricking victims into calling fake support centers. Now the other campaign uses malicious OAuth apps, impersonating Adobe and DocuSign to steal credentials and deliver malware. Supply chain attack hits 100 plus auto dealerships over a hundred car dealership websites were compromised by a supply chain attack where hackers injected malicious click fix code through the LES automotive video service. The attack tricked visitors into copying and executing a malicious command, ultimately infecting them with the SEC Top RAT Remote access Trojan via PowerShell. Researchers warn that ClickFix, a growing social engineering tactic, has been used for years, but there has been a surge in the technique over the past several months thanks to today's episode sponsor, Delete Me. Data brokers bypass online safety measures to sell your name, address and Social Security numbers to scammers. Deleteme Delete scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information and completing opt outs and removals. With over 100 million personal listings removed, Deleteme is your trusted privacy solution for online safety. Get 20% off your delete me plan when you go to JoinDeleteMe.com CISO and use the promo code CISO at checkout. The only way to get 20% off is to go to JoinDeleteMe.com CISO and enter the code CISO. And by the way, the CISO series just launched a new podcast, Security. You should know we've got more details at the end of the episode. Thousands of WordPress vulnerabilities exposed Close to 8,000 vulnerabilities were discovered in the WordPress ecosystem last year, 7,966 to be exact, with the overwhelming majority 96% affecting plugins and a much smaller portion impacting themes. While most of these vulnerabilities were considered low or medium severity, 43% could be exploited without authentication and nearly half were cross site scripting flaws. Security firm patchstack noted that many vulnerabilities, especially in abandoned plugins, remain on patch after public disclosure, leaving them active and exploitable on websites. The firm also noted that many plugin developers were slow to address the issues. Ransom Hub and Sock Ghoulish team up A match made in hacker heaven the Ransom Hub group has partnered with the operator of the fake Updates malware as a service framework, Sock Ghoulish, to launch a multi stage attack on US Government organizations as well as the banking and consulting sectors. Now the attack begins with compromised websites delivering malicious Sock Ghoulish payloads which then deploy Ransom Hub ransomware. While the majority of these attacks have affected the US Government, reports of attacks on Japan and Taiwan have also emerged. Ransomware rebrand for El Dorado Researchers have linked the Blacklock ransomware group to the notorious El Dorado, confirming that Blacklock is a rebrand of the earlier threat actor. Since resurfacing, Blacklock has executed 48 attacks in the first two months of 2025, with a focus on high value sectors like construction and real estate. Known for its flexibility, the group uses fast encryption techniques and destructive wipers targeting both government agencies and private industries. Blacklock has retained El Dorado's technical foundation but improved its encryption speeds and attack strategies, quickly becoming one of the most notorious ransomware groups of the year. UK sees surge in social media account compromises UK social media and email account compromises increased by 57% in 2024, with nearly £1 million, or $1.3 million in victim losses. That's according to Action Fraud. The most common tactics involved investment fraud, ticket fraud and on platform chain hacking, where fraudsters impersonate victims to scam their contacts. Action Fraud and Meta have launched a campaign encouraging users to enhance security by incorporating basic cyber hygiene, including using unique passwords and enabling two factor authentication. As a security practitioner, you want to learn about new cybersecurity solutions on the market, but you don't want to get immediately sucked into the sales funnel. That's why we designed Security youy should know. In 15 minutes, you get answers about how to prove the value of a specific vendor solution to company leadership, get pricing info, and get answers to a bevy of questions posed by our security expert guest. Check it out now. @ciso series.com I'm Lauren Vernow reporting for the CISO Series.