Microsoft Entra lockouts, wine tasting malware, job scam solution

Summary

Cyber Security Headlines - Episode Summary

Title: Microsoft Entra Lockouts, Wine Tasting Malware, Job Scam Solution
Host: Steve Prentiss, CISO Series
Release Date: April 21, 2025

---

1. Microsoft Entra Lockouts Caused by New Security Feature Rollout

Overview:
A significant disruption occurred due to the rollout of Microsoft's new security feature within Microsoft Entra ID. The introduction of the Mace credential revocation app led to widespread account lockouts across numerous organizations.

Key Points:

• Issue Details:
  Administrators observed a surge in false positives triggered by the Mace app's leaked credentials detection mechanism. Surprisingly, the affected accounts had unique passwords, were protected by Multi-Factor Authentication (MFA), and showed no signs of actual compromise.

• Impact:
  Overnight on Friday, the app began sending out alerts that resulted in the locking out of large numbers of users. A Reddit thread highlighted the extensive reach, citing over 20,000 notifications sent to a managed detection and response provider.

• Microsoft's Response:
  Microsoft communicated to one affected organization that the lockouts stemmed from issues related to the Mace app rollout, acknowledging the unintended consequences of the new security measure.

Notable Quote:

"Admins report false positives triggered by the app's leaked credentials detection, despite affected accounts having unique passwords, MFA protection and no signs of compromise." — Steve Prentiss [02:15]

---

2. Wine Tasting Malware: APT29's Sophisticated Phishing Campaign

Overview:
A new phishing tactic has emerged, orchestrated by the Russian state-sponsored threat actor APT29. This campaign specifically targets high-ranking European and Middle Eastern diplomats and officials.

Key Points:

• Phishing Method:
  The attacks disguise themselves as email invitations to wine tasting events, purportedly sent from an unnamed European Ministry of Foreign Affairs.

• Malware Deployment:
  The invitation, when opened, triggers the download of a malware payload named Grape Loader, concealed within a ZIP archive titled "Wine Zip."

• Mechanism of Action:
  Upon execution, Grape Loader gains persistence by modifying the Windows registry, ensuring the malicious executable (Wine.exe) launches with every system reboot.

Notable Quote:

"This invite naturally triggers the deployment of malware, this time called Grape Loader, hidden inside a zip archive named Wine Zip." — Steve Prentiss [05:47]

---

3. Evolution of Job Scams: North Korean Operatives Shift Focus to Europe

Overview:
Due to increased difficulty in executing job-related scams within the United States, North Korean operatives have redirected their efforts towards Europe, particularly the United Kingdom.

Key Points:

• Scam Tactics:
  Scammers pose as employers offering remote work opportunities, aiming to extract sensitive data and financial gains.

• Operational Support:
  These operatives often collaborate with local conspirators who provide physical addresses and reside within the target country, adding legitimacy to their scams.

• Expert Insight:
  John Hultquist, Chief Analyst at Google's Threat Intelligence Group, emphasized the vulnerability within HR departments:

  "Many of the remedies are in the hands of the HR department, which usually has very little experience dealing with a covert state adversary." — John Hultquist [15:30]

  He further advised that verification processes, such as requiring interviews to be conducted in person or via video calls, can effectively disrupt these scams.

Notable Quote:

"This scheme usually breaks down when the actor is asked to go on camera or to come into the office for an interview." — John Hultquist [16:05]

---

4. Malicious Chrome Extensions with Hidden Tracking Capabilities

Overview:
A concerning discovery was made involving 57 hidden Chrome extensions that have amassed over 6 million installs, embedding dangerous tracking functionalities.

Key Points:

• Functionality of Malicious Extensions:
  These extensions monitor browsing activities, access cookies, and possess the ability to execute remote scripts, posing significant privacy and security threats.

• Distribution Methods:
  Unlike traditional extensions, these malicious ones don't appear in Chrome Web Store searches and are typically installed via direct URLs. They are often masqueraded as internal tools but can be exploited by threat actors to bypass detection.

• Research Findings:
  John Tuckner from Secure Annex identified the issue while examining the Fire Shield Extension Protection, an obfuscated extension sending collected data to an external API. The distribution channels include deceptive ads and malicious websites.

Notable Quote:

"These hidden extensions do not appear in Chrome Web Store searches and can only be installed via direct URLs, often used for internal tools but possibly exploited by threat actors to avoid detection." — Steve Prentiss [22:10]

---

5. Cisco WebEx Vulnerability: Remote Code Execution via Malicious Links

Overview:
Cisco has identified and issued security patches for a high-severity vulnerability in the WebEx application that allows unauthenticated attackers to execute remote code.

Key Points:

• Vulnerability Details:
  The flaw arises from improper input validation in WebEx's custom URL parser, making it susceptible across all operating systems and configurations.

• Exploitation Method:
  Attackers can craft malicious meeting invite links that, when clicked by unsuspecting users, prompt the download of malicious files. This enables arbitrary command execution with user-level privileges.

• Urgent Recommendations:
  Given the low complexity of exploiting this vulnerability and the absence of available workarounds, Cisco strongly advises all users to apply the necessary updates immediately to mitigate potential risks.

Notable Quote:

"This flaw could allow remote attackers to perform unauthorized execution of functions on susceptible devices." — Steve Prentiss [25:50]

---

6. Innovative Payment Card Scam Leveraging Mobile NFC Technology

Overview:
Researchers at the Italian cybersecurity firm CLEFI have uncovered a novel scam targeting financial institutions by integrating social engineering, malware, and mobile Near Field Communication (NFC) technology.

Key Points:

• Scam Execution:
  The scam initiates with a fraudulent bank alert sent via text message. Victims are prompted to call a deceptive phone number where they are coerced into providing their PINs and removing any spending limits on their cards.

• Malware Functionality:
  Victims are then instructed to place their physical debit or credit cards near their infected mobile devices. The SuperCardX malware captures card details transmitted via NFC, allowing attackers immediate access to stolen funds outside conventional fraud channels.

• Impact Analysis:
  This method enables rapid exploitation of stolen data, posing a significant threat to traditional banking security measures that rely on delayed bank transfers.

Notable Quote:

"This allows the attacker to access the stolen funds instantly and potentially outside traditional fraud channels that typically involve bank transfers." — Steve Prentiss [28:40]

---

7. Data Breach at Parent Company of Hannaford and Stop and Shop

Overview:
The parent company of major grocery chains Hannaford and Stop and Shop, Ehold Delhisie USA, confirmed that a cyberattack in early November 2024 resulted in the theft of data totaling six terabytes.

Key Points:

• Attack Attribution:
  The Inc. Ransomware Gang Inc. has claimed responsibility for the breach, stating they exfiltrated six terabytes of information.

• Company Response:
  Representatives from Ehold Delhisie are diligently working to ascertain the specific nature and extent of the data stolen, emphasizing ongoing investigative efforts.

Notable Quote:

"Representatives from the affected company state that they are still working to determine specifically what was stolen." — Steve Prentiss [31:20]

---

8. Critical Flaw in ASUS AI Cloud Routers

Overview:
ASUS has identified a critical vulnerability in their AI Cloud routers, rated with a CVSS score of 9.2, which could allow remote attackers to execute unauthorized functions.

Key Points:

• Vulnerability Details:
  The flaw permits attackers to perform arbitrary command executions on vulnerable devices by exploiting the identified weakness.

• Affected Systems:
  All operating systems and configurations using ASUS AI Cloud routers built on firmware versions prior to 3.0.0.4 are at risk.

• Mitigation Measures:
  ASUS has released firmware updates addressing the vulnerability and advises users to:

  • Update to the latest firmware version.
  • Use distinct passwords for their wireless network and the router administration interface to enhance security.

Notable Quote:

"The issue has been addressed with firmware updates for branches in the 3.0.0.4 range, and ASUS reminds users to use different passwords for the wireless network and the router administration page." — Steve Prentiss [34:10]

---

Conclusion

Today's episode of Cyber Security Headlines delved into a range of critical security incidents and emerging threats, from widespread service disruptions caused by new security feature rollouts to sophisticated phishing campaigns and innovative malware scams. Hosts and experts emphasized the importance of prompt response measures, robust verification processes, and staying informed about the latest security patches to mitigate risks effectively. As cyber threats continue to evolve, staying vigilant and proactive remains paramount for organizations and individuals alike.

---

For more detailed stories behind these headlines, visit CISOseries.com.

Transcript

[Steve Prentiss]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, April 21, 2025. I'm Steve Prentiss. Widespread Microsoft Entra lockouts caused by new security feature rollout A widespread issue with Microsoft Entra ID's new Mace credential revocation app has caused mass account lockouts across organization organizations. Admins report false positives triggered by the app's leaked credentials detection, despite affected accounts having unique passwords, MFA protection and no signs of compromise. The alerts began overnight on Friday, locking out large numbers of users. A Reddit thread revealed an extensive impact, including over 20,000 notifications sent to a managed detection and response provider. Microsoft reportedly told one affected organization that the lockouts were due to a problem with the rollout of the Mace app, that is Mace Malware delivered through Diplomatic Wine Tasting Invites A new set of phishing attacks from Russian state sponsored threat actor APT29 is targeting high ranking European and Middle Eastern diplomats and officials under the guise of email invites for wine tasting events sent from an unspecified European Ministry of Foreign Affairs. This invite naturally triggers the deployment of malware, this time called Grape Loader, hidden inside a zip archive named Wine Zip. The malware gains persistence by modifying the Windows registry to ensure that the Wine exe executable is launched every time the system is rebooted. British companies told to hold in person interviews to thwart North Korea Job Scammers after finding it too difficult to pursue the job finding scam in the us, North Korean operatives are now focusing on Europe and especially the UK to seek out remote work with the goal of accessing sensitive data as well as cash. They are often assisted by co conspirators who hold physical addresses and who live in the country. John Hultquist, the chief analyst at Google's Threat Intelligence Group, told the UK news outlet the Guardian that many of the remedies are in the hands of the HR department, which usually has very little experience dealing with a covert state adversary. He added that companies need to do a better job checking physical identities and ensuring the person you're talking to is who they claim to be, end quote. He continues, this scheme usually breaks down when the actor is asked to go on camera or to come into the office for an interview. End quote. Chrome extensions with 6 million installs contain hidden tracking code A set of 57 hidden Chrome extensions installed by over 6 million users has been found with dangerous capabilities such as monitoring browsing activity, accessing cookies and potentially running remote scripts. These hidden extensions do not appear in Chrome Web Store searches and can only be installed via direct URLs, often used for internal tools but possibly exploited by threat actors to avoid detection. Researcher John Tuckner of Secure Annex discovered the issue while analyzing a suspicious obfuscated extension called Fire Shield Extension Protection, which sends collected data to an external API. These extensions may be distributed through ads and malicious websites. Huge thanks to our sponsor DropZone AI growing your MSSP client roster While your Alerts are multiplying, DropZone AI works alongside your team investigating alerts, just like your best human analysts would. Our AI SoC analyst cuts investigation time from an hour to minutes while handling five times more alerts per analyst. Unlike Complex Soar solutions, DropZone deploys quickly and adapts to your environment without the need for playbooks or coding, eliminate backlogs, reduce false positives, and deliver the detailed investigations your clients expect. Ready to scale your MSSP without scaling your team? Meet us at boothese60 sa Cisco WebEx bug lets hackers gain code execution via meeting links Cisco has issued security updates for a high severity vulnerability in the WebEx app that allows unauthenticated attackers to execute remote code via malicious meeting invite links. The flaw stems from improper input validation in the WebEx custom URL parser and affects all operating systems and configurations. Attackers can exploit the bug by tricking users into clicking a crafted link and downloading files, enabling arbitrary command execution with user level privileges. Discovered to be low complexity, this vulnerability poses significant risk and Cisco urges users to update immediately as there are no available workarounds to prevent exploitation. New payment card scam involves a phone call, some malware and a personal tap Researchers at the Italian cybersecurity firm CLEFI are warning financial institutions to watch for a scam that combines social engineering, previously undocumented malware and mobile phones, near field communication capabilities to compromise payment cards. End quote this scam, which is currently active in Italy, delivers malware dubbed SuperCardX. The scam starts with a bank fraud alert text message. Victims who call the phone number in the scam message are instructed to provide their pins and remove any spending limits on the card. The novel part of this scam is that the victim is then instructed to place their physical debit or credit card into the proximity of their infected mobile device. The SuperCard X malware then captures the card details transmitted by near field Communication nfc. Clefey's report states that this quote allows the attacker to access the stolen funds instantly and potentially outside traditional fraud channels that typically involve bank transfers. End quote the parent company of Hannaford and Stop and Shop Confirms data Stolen in a cyberattack following up on a story we covered last November, the Dutch food conglomerate Ehold Delhisie usa, the parent company of Stop and Shop, Hannaford Food, lion and Giant Food, now confirms that data was stolen during the cyber attack of early November 2024. Responsibility for this attack has been claimed by the Inc. Ransomware Gang Inc. Who claim to have stolen six terabytes of information. Representatives from the affected company state that they are still working to determine specifically what was stolen. ASUS confirms Critical flaw in AI Cloud routers this flaw, which has a CVSS score of 9.2, could allow remote attackers to perform unauthorized execution of functions on susceptible devices. The issue has been addressed with firmware updates for branches in the 3.0.0.4 range, and ASUS reminds users to use different passwords for the wireless network and the router administration page. End quote. Remember to register to join us for this week's Super Cyber Friday, where we'll be talking about hacking your risk how to determine what things actually matter to your specific organization to make you safer. Head on over to our events [e-mail] to register and check out the latest episode of Security. You should know we are talking with Conveyor about how they are improving customer security reviews. Look for it wherever you get your podcasts. I'm Steve Prentice reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to CISoseries.com for the full stories behind the headlines. It.