← Cybersecurity Headlines
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series. It's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Monday, August 25, 2025. I'm Steve Prentiss Malicious Go module steals credentials via Telegram Researchers at cybersecurity firm Socket are warning of a malicious Go module that presents itself as a brute force tool for SSH that is secure Shel but actually contains functionality to exfiltrate credentials. It does this by sending the target IP address, username and password to a hard coded Telegram bot controlled by the threat actor. The package is named golang randomipssh bruteforce and has been linked to a now discontinued GitHub account. The researchers also said the Go module works by scanning random IPv4 addresses for exposed SSH services on TV TCP port 22, then attempting to brute force the service using an embedded username password list and exfiltrating the successful credentials to the attacker. End quote Mirai based botnet resurfaces targeting systems globally Researchers at Fortiguard Labs are tracking a new botnet campaign which exploits known flaws in Draytek, TP Link, Raisecom and Cisco and which exhibits evolved tactics and renewed activity. End quote the botnet, whose name is a homophobic slur, uses code from the basic Mirai variant and integrates N Day and Zero day exploits. It has been hitting four Faith brand industrial routers and as well Neterbit routers and Weimar smart home devices. Its operators have also been launching DDoS attacks against the researchers who are tracking it. Silk Typhoon hackers exploit cloud trust to hack downstream customers in addition to its very well known cyber espionage activities, the group named Murky Panda, also better known as Silk Typhoon and Hafnium, has also been observed exploiting trusted relationships in cloud environments in order to gain initial access to the networks and data of downstream customers. A new report from CrowdStrike shows how the group takes advantage of the fact that cloud providers are sometimes granted built in administrative access to customer environments. End Quote CrowdStrike adds quote breaches via trusted relationships are rare, but they are less monitored than more common vectors such as credential theft. By exploiting these trust models, Murky Panda can more easily blend in with legitimate traffic and activity to maintain stealthy access for long periods. End quote FTC warns tech companies against complying with European and British censorship laws Federal Trade Commission Chairperson Andrew Ferguson has written to the chief executives of major tech firms criticizing what he calls foreign attempts at censorship and efforts to countermand the use of encryption to protect American consumers data. He continues that compliance could be considered a violation of Section 5 of the Federal Trade Commission act, which prohibits unfair or deceptive practices in commerce, adding American consumers do not reasonably expect to be censored to appease a foreign power and may be deceived by such actions. End quote. Huge thanks to our sponsor Profit Security Ever feel like your security team is stuck in a loop of alert fatigue and manual investigations? Meet Profit Security. Their Agenti SOC platform automates the tedious stuff, triaging, investigating and responding to alerts so your analysts can focus on real threats, think 10 times faster response times and a smarter way to secure your business. Learn more at ProfitSecurity AI that is P R O P H E DT Security AI electronics manufacturer data IO suffers ransomware attack data IO, sometimes spelled D A T A then I O produces electronics used in vehicles, customer devices and charging stations for electric vehicles with their client list, including Tesla, Panasonic, Amazon, Google and Microsoft. The company suffered a ransomware attack on August 16, which impacted shipping, manufacturing, production and other support functions. A report was sent to federal regulators on Thursday evening and the company is now waiting for a third party investigation to conclude before notifying potential data breach victims. House lawmakers seek to change federal cyber job education requirements the act would be called the Cybersecurity Hiring Modernization Act. It has been put forward by Representatives Nancy Mace, Republican for South Carolina, and Chantel Brown, Democrat for Ohio. Mace is chair of the House Oversight, Cybersecurity, Information Technology and Government Innovation Subcommittee, and Brown is a ranking member of the same committee. The act would prioritize skills based hiring over educational requirements for cyber jobs at federal agencies, and this would be done to ensure ensure the federal government has access to a broader pool of qualified applicants in the face of urgent cybersecurity challenges, mace stated, we need to make sure our federal agencies hire the most qualified candidates, not just those with traditional degrees. App designed to keep women safer is hacked and breached following up on a story we covered in July, the Women Only Tea dating advice app suffered a massive data breach, exposing highly sensitive youth or data. Initially, it was reported that hackers accessed a legacy storage system leaking 72,000 images, including 13,000 selfies and driver's licenses. These were meant for immediate deletion after verification. The crisis deepened, however, when a Researcher uncovered over 1.1 million private direct messages from 2023 through 2025, revealing intimate conversations and personal identifiers. T suspended its messaging feature on July 29 and enlisted cybersecurity experts, but these experts condemned its weak protections. The company behind the app is now facing 10 class action lawsuits and calls for App Store removal. It is, however, offering affected users identity theft and credit monitoring services China Exits the Internet for an Hour Activist group Great Firewall Report noted that the entire country of China cut itself off from the Internet for just over an hour last Wednesday. This was done by disrupting all Traffic to TCP port 443, the standard port used for carrying HTTPs traffic. Not only did this prevent China's citizens from reaching websites hosted outside China, it also blocked other services that rely on Port 443, such as those used by Apple and Tesla to connect to offshore serv that power some of their basic services. Reporters at the Register cannot identify an obvious reason for the blockage, suggesting China was either testing its ability to block Port 443, which Beijing might see as a useful capability, or someone messed up. End quote. Even though it's Monday, it is never too late to grab your calendar or tell your agentic AI to join us on Friday for the Week in Review Show. Every week we welcome a CISO or similar cybersecurity expert to discuss the biggest news stories of the week. It's always a compelling and entertaining half hour as host Rich Stroffolino engages with our guest and with our regular group of online participants. You can be one of those too. This week we are looking forward to chatting with the brilliant, wonderfully opinionated and always entertaining Jonathill Johnson, CEO and Founder at Nemertis. So make sure to join us Friday 3:30pm Eastern Time to watch us live and to join in on the YouTube channel. Go to the events page@cisoseries.com to register. And if you have some thoughts on the news from today or about the show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you. Steve I'm Steve Prentiss reporting for the CISO series.
- [09:10]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.