Legacy Windows protocols expose theft, Fortra admits GoAnywhere defect, Taiwan claims surge in Chinese attacks

Summary

Cyber Security Headlines - Episode Summary

Podcast: Cyber Security Headlines
Host: Sara Lane (CISO Series)
Date: October 15, 2025
Episode Focus:
A concise roundup of the day’s most critical cybersecurity incidents, research findings, and evolving threats from around the globe.

---

Main Theme & Purpose

This episode delivers real-time updates on emerging security vulnerabilities, high-profile breaches, and cyberthreat trends, with expert commentary and actionable recommendations for infosec professionals. Key topics include legacy Windows protocol risks, active ransomware exploits, Chinese cyber campaigns targeting Taiwan, cutting-edge Android exploits, and a wave of impactful data breaches.

---

Key Discussion Points & Insights

Legacy Windows Protocols Still Expose Credential Theft

[00:14]

• Issue:
  • LLMNR and NetBIOS Name Service (NBT-NS) protocols in legacy Windows environments remain active attack surfaces even without software exploits.
• Tactics:
  • Attackers on the same local network can use tools like Responder to capture user credentials.
  • Captured username and password hashes are targets for cracking and relay attacks, facilitating unauthorized access and privilege escalation.
• Mitigations Recommended:
  • Disable LLMNR and NBT-NS.
  • Block UDP port 5355.
  • Enforce SMB signing.
  • Use Kerberos authentication.
• Quote:
  • “Attackers on that same local network can then capture usernames and password hashes using tools like Responder.” —Sara Lane [00:18]

Fortra Confirms Exploitation of GoAnywhere MFT Vulnerability

[00:53]

• Issue:
  • Fortra admits its GoAnywhere MFT secure file transfer software was actively exploited, following weeks of researcher and CISA reports.
• Concerns:
  • Attackers somehow obtained a private key thought to be exclusive to Fortra.
• Impact:
  • Vulnerabilities linked to ransomware campaigns, attributed to Microsoft-tracked group Storm-1175.
• Quote:
  • “The exploit’s success raises questions about how attackers accessed a private key believed to be held only by Fortra.” —Sara Lane [01:08]

Chinese Cyber Attacks Surge Ahead of Taiwan Elections

[01:22]

• Issue:
  • Taiwan reports an intensified campaign of cyberattacks and disinformation from China, as local elections approach.
• Scope:
  • 2.8 million attempted intrusions per day—a 17% increase over last year.
  • Over 10,000 fake social media accounts pushing 1.5 million pieces of pro-China or anti-government content, utilizing AI-generated materials.
• Attribution:
  • Described as “a coordinated state-level campaign involving China’s PLA and intelligence agencies.” —Sara Lane [01:55]

Android ‘Pic Snapping’ Exploit Exposes Screens

[02:27]

• Issue:
  • UC Berkeley and collaborators discover a side-channel attack ("pic snapping") on Android. It can capture any on-screen content—including two-factor authentication codes—without needing special permissions.
• Method:
  • Exploits Android’s rendering APIs and GPU compression.
  • Can target sensitive apps like Google Authenticator, Signal, Gmail, etc.
• Remediation:
  • Google pledges a comprehensive fix by December.
• Quote:
  • “Pic snapping… can steal anything displayed on a user screen, including 2FA codes, without special app permissions.” —Sara Lane [02:44]

Qantas Airline: Data Leak Impacts 5.7 Million

[04:16]

• Incident:
  • Data breach via third-party platform (Salesforce) exposes info for 5.7 million Qantas customers.
• Leaked by:
  • Scattered Lapses Hunters group after ransom denied.
• Exposed Data:
  • Names, emails, frequent flyer numbers, potential addresses, phone numbers, and birth dates (no credit cards or passports).
• Response:
  • Court order against data access and warnings to customers about phishing scams impersonating the airline.
• Quote:
  • “Qantas obtained a court order restricting access to the leaked data and warning customers of rising phishing scams impersonating the airline.” —Sara Lane [04:47]

TA585: New Phishing & RAT Tools Detected

[05:04]

• Actors:
  • Proofpoint identifies TA585, distributing Monster V2 RAT/stealer/loader malware.
• Capabilities:
  • Credential theft, crypto wallet grabs, browser data exfiltration, remote access, webcam capture, payload delivery.
• Phishing Campaigns:
  • Impersonates IRS, Small Business Administration, and GitHub, using compromised sites and fake captchas.

Asahi Ransomware Breach: Personal Data Impacted

[05:34]

• Incident:
  • Japanese brewery Asahi hit by Qilin Gang ransomware—employee records, contracts, ID cards stolen.
• Consequences:
  • 27 GB of files allegedly stolen, order systems offline, shipments delayed, financial reporting postponed.

Harvard University: 1.3TB Data Leak by CLOP

[06:03]

• Incident:
  • CLOP ransomware group claims to have leaked 1.3TB from an Oracle EBS vulnerability.
• Impact:
  • Attackers stole financial, HR, and operational data; only one administrative unit believed affected.
• Remediation:
  • Oracle released an emergency patch; incident stems from the use of an unpatched flaw in July.

---

Notable Quotes & Memorable Moments

• “Attackers on that same local network can then capture usernames and password hashes using tools like Responder.” —Sara Lane [00:18]
• “The exploit’s success raises questions about how attackers accessed a private key believed to be held only by Fortra.” —Sara Lane [01:08]
• “Pic snapping… can steal anything displayed on a user screen, including 2FA codes, without special app permissions.” —Sara Lane [02:44]
• “Qantas obtained a court order restricting access to the leaked data and warning customers of rising phishing scams impersonating the airline.” —Sara Lane [04:47]
• “Taiwan's National Security Bureau says that China has intensified cyber attacks and disinformation campaigns ahead of Taiwan's 2026 local elections.” —Sara Lane [01:22]

---

Timestamps for Important Segments

• Legacy Windows credential theft: [00:14]
• Fortra GoAnywhere exploitation: [00:53]
• Chinese attacks on Taiwan: [01:22]
• Android ‘Pic Snapping’ side-channel: [02:27]
• Qantas airline data breach: [04:16]
• TA585/Monster V2 RAT campaign: [05:04]
• Asahi ransomware breach: [05:34]
• Harvard CLOP data leak: [06:03]

---

Tone & Style

Sara Lane’s reporting is concise yet comprehensive, with an urgent, matter-of-fact delivery suited for a professional audience eager to stay ahead of fast-evolving threats.

---

Conclusion

This episode packed critical global developments: persistent network vulnerabilities, severe third-party and ransomware breaches, high-stakes state-driven cyber-campaigns, and advancing malware sophistication. Cybersecurity professionals are urged to be vigilant, prioritize updates and protocol deprecation, and stay informed as adversaries evolve their methods.

Transcript

[A]

From the CISO series. It's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Wednesday, October 15, 2025. I am Sara Lane Legacy Windows protocols still expose theft A Re Security study warns that Legacy Windows protocols LOMNR and netbios Name Service still expose networks to credential theft even without software exploits. Attackers on that same local network can then capture usernames and password hashes using tools like Responder. Once obtained, credentials can be cracked or reused in relay attacks to access corporate systems and escalate privileges. Researchers encourage disabling LLMNR and NBTNs, block UDP port 5355, enforce SMB signing and use Kerberos authentication. Portra admits exploitation of Go Anywhere defect Portra confirmed that a critical vulnerability in its Go Anywhere MFT file transfer software has been actively exploited. This is weeks after researchers and CISA independently verified attacks. Researchers from Watchtower, Rapid7 and Vulnchek say that the exploit's success raises questions about how attackers accessed a private key believed to be held only by Fortra. SISA says the flaw has been used in ransomware campaigns linked to Microsoft Track Group Storm 1175 Taiwan claims surge in Chinese attack efforts Taiwan's National Security Bureau says that China has intensified cyber attacks and disinformation campaigns ahead of Taiwan's 2026 local elections. Government networks reportedly face 2.8 million intrusion attempts daily this year. That is up 17% from 2024. The bureau identified more than 10,000 fake social media accounts spreading 1.5 million pieces of pro China or anti government content, including AI generated memes and videos. Officials describe the effort as a coordinated state level campaign involving China's PLA and and intelligence agencies. Pic snapping can steal everything on an Android screen. Researchers from UC Berkeley, UC San Diego, the University of Washington and Carnegie Mellon uncovered an Android exploit known as pic snapping that can steal anything displayed on a user screen, including two FA codes without special app permissions. The side channel attack abuses Android's rendering APIs and GPU compression to capture pixels from apps like Google Authenticator, Signal and Gmail. Google promises a full fix in December. Huge thanks to our sponsor Vanta. What is your 2am Security worry? Is it do I have the right controls in place or are my vendors secure? Or the really scary one? How do I get out from under these old tools and manual processes? Enter Vanta. Vanta automates manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Vanta's trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. Vanta also fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and get back to sleep. Get started at vanta.com headlines Qantas confirms released Customer Data the airline Qantas confirmed that published data stolen in a July attack that exposed information on around 5.7 million customers through that third party platform linked to Salesforce. The Scattered Lapses Hunters group leaked the data after Salesforce refused to pay ransom. Exposed details include names, emails, frequent flyer numbers and in some cases, addresses, phone numbers or birth dates, though no credit cards or passports appear to be compromised. Qantas obtained a court order restricting access to the leaked data and warning customers of rising phishing scams impersonating the airline. TA585 emerges with advanced attack infrastructure, researchers from Proofpoint reported. TA585, a cybercriminal group distributing Monster V2, a rat stealer loader that snatches credentials, crypto wallets and browser data and allows remote access, webcam capture and payload delivery. TA585 uses phishing campaigns, mimicking the IRS, the small business Administration and GitHub, exploiting the click fix method via compromised sites with fake captchas. Asahi breach continues Personal data feared exposed Japanese brewer Asahi confirmed that personal data may have been exposed. And in a September ransomware attack by the Qilin Gang, which disrupted ordering, shipping and call center systems, around 27 gigabytes of files, including employee records and contracts, were allegedly stolen with samples showing ID cards and other personal documents. The incident delayed shipments and forced manual order processing. Asahi also postponed its Q3 financial results. Harvard update 1.3 terabytes of data leaked Harvard University has confirmed it was targeted by the CLOP Ransomware Oracle E Business Suite campaign, with the group claiming to have leaked 1.3 terabytes of data, though Harvard says only an administrative unit appears to be affected. Attackers exploited a July patched EBS flawless stealing financial, HR and operational data. Oracle issued an emergency patch to fix the vulnerability. If you haven't checked out security youy should know you are missing out. It's a tight 15 minute podcast giving you the answers to all the questions you want to know when learning about a new vendor. This week's episode is a dive into Safebase and their Trust center platform. Look for it wherever you get your podcasts and if you have thoughts on the news from today or about our show in general. Be sure to reach out to [e-mail] we would love to hear from you. I'm Sarah Lane, reporting for the CISO series. This was fun. Stay classy. Planet Earth.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.