Microsoft Recall updates, Russian orgs deal with networking software updates, SSL.com certificate issuance vulnerability - Cybersecurity Headlines

Summary6 min read

Cyber Security Headlines - April 23, 2025
Hosted by Sarah Lane, CISO Series

1. Microsoft Recalls Copilot Plus PC Due to Security Flaws

Timestamp: [00:00]

Sarah Lane kicks off the episode by discussing Microsoft's recent decision to recall its Copilot Plus PCs. Initially launched in 2023, the Copilot feature was designed to enhance user experience by automatically capturing screenshots of user activity and compiling them into a searchable database. However, significant security vulnerabilities emerged:

Lack of Proper Encryption: Sensitive data, including credit card numbers, were stored without adequate encryption.
Default Activation: The feature was enabled by default, leading to widespread user dissatisfaction and privacy concerns.

In response, Microsoft is rolling out an updated version of Copilot Plus PCs with several critical improvements:

Enhanced Encryption: Ensuring that all captured data is securely encrypted.
Opt-In Activation: Users now must explicitly enable the feature, giving them greater control over their privacy.
Data Filtering: Implementing measures to filter out and protect sensitive information from being captured.

Sarah notes, "People hate that. An updated version is rolling out now on Copilot Plus PCs with improvements like encryption, opt-in activation and some filtering for sensitive data" ([00:00]).

2. Russian Organizations Targeted by Sophisticated Backdoor Attacks

Timestamp: [02:15]

The episode delves into a report by Kaspersky on a sophisticated backdoor attack targeting Russian organizations. The malware was ingeniously disguised as updates for VIPnet, a secure networking software used across government, finance, and industrial sectors. Key elements of the attack include:

Distributed LZH Archive Files: These contained a legitimate executable, a malicious loader, and an encrypted payload.
Command and Control Connection: Once deployed, the backdoor connected to a command and control server, facilitating data theft and the introduction of additional malware.

Kaspersky emphasizes the importance of layered security defenses to mitigate such threats, stating, "The attackers used distributed LZH archive files containing a legitimate executable, a malicious loader and an encrypted payload, which ultimately deploys a backdoor connected to a command and control server" ([02:15]).

3. SSL.com Addresses Certificate Issuance Vulnerability

Timestamp: [05:30]

SSL.com has been scrambling to patch a critical vulnerability in its domain control validation process. This flaw allowed nearly a dozen Mis-issued Digital Certificates (MIS) for seven legitimate domains, including Alibaba Cloud's Aliyun.com. The breach was exploited by a researcher who created a fake DNS record, tricking SSL.com into issuing certificates without proper verification of domain ownership.

In response:

Revocation of Fraudulent Certificates: All compromised certificates have been revoked to prevent misuse.
Disabling Flawed Validation Method: SSL.com has halted the vulnerable validation process to safeguard against future exploits.
Ongoing Investigations: The company continues to investigate the breach to ensure comprehensive security measures are in place.

Sarah summarizes, "A researcher exploited the flaw by creating a fake DNS record, tricking SSL.com into issuing certificates without proper domain ownership verification" ([05:30]).

4. Russia's Cyber Sabotage Attempts Against Dutch Critical Infrastructure

Timestamp: [09:45]

Sarah highlights alarming reports from the Dutch Military Intelligence and Security Service (MIVID) about Russian state-sponsored attackers attempting cyber sabotage against Dutch critical infrastructure over the past two years. This marks the first known cyber sabotage attempts targeting control systems in the Netherlands.

Key Points:

Whole-of-Society Approach: Russia is increasingly integrating cyber operations with broader societal tactics, posing a significant threat to NATO allies.
Threat to Control Systems: Attempts focused on disrupting essential services within government and infrastructure sectors.
Call for Enhanced Defenses: Dutch defense officials stress the necessity to bolster both military and cybersecurity capabilities to counter these threats effectively.

The MIVID warns, "Russia is increasingly using a whole of society approach to cyber operations, which poses a threat to NATO allies" ([09:45]).

5. AI Accelerates Exploit Development Post-Vulnerability Disclosure

Timestamp: [12:50]

The discussion moves to the impact of large language models (LLMs) like OpenAI's GPT-4 and Anthropic's Claude Sonet 3.7 on cybersecurity. Researchers at ProDefense showcased how AI can rapidly analyze code patches, identify security vulnerabilities, and generate proof-of-concept attack scripts. This automation significantly reduces the time defenders have to respond to newly disclosed vulnerabilities.

Implications:

Faster Exploit Creation: AI tools can swiftly develop working exploits, tightening the window for defenders to patch vulnerabilities.
Shrinking Reaction Time: Cybersecurity teams must enhance their response strategies to keep pace with the accelerated threat landscape.

Experts caution, "AI could analyze code patches, identify security flaws and generate proof of concept attack scripts, quickly reducing a defender's response time" ([12:50]).

6. Ransomware Strikes Two Major Healthcare Organizations

Timestamp: [16:20]

Two prominent U.S. healthcare organizations, Bell Ambulance in Wisconsin and Alabama Ophthalmology Associates, have confirmed data breaches resulting from ransomware attacks, affecting over 100,000 individuals each.

Details:

Bell Ambulance: Targeted by the Medusa ransomware group, the breach exposed personal information such as names, Social Security numbers, and medical data of 114,000 individuals.
Alabama Ophthalmology Associates: Attacked by the "Beyond the On" group, compromising data for more than 131,000 people.

These incidents underscore the persistent threat ransomware poses to critical healthcare infrastructure and the sensitive personal data they manage.

7. Marks and Spencer Navigates Cybersecurity Incident

Timestamp: [20:10]

Retail giant Marks and Spencer has acknowledged a cybersecurity incident following customer reports of service outages and disruptions. While the physical stores, website, and apps remain operational, certain in-store systems, including payment terminals and order pickups, have been temporarily affected.

Response Measures:

Engagement of External Experts: Marks and Spencer has enlisted cybersecurity professionals to address and mitigate the incident.
Notification to Authorities: Relevant authorities have been informed to ensure appropriate regulatory actions and support.
Lack of Disclosure on Attack Nature: The company has not revealed specific details about the nature of the attack or whether customer data was compromised.

Sarah notes, "The company has brought in external cybersecurity experts and notified authorities, but has not disclosed the nature of the attack or if its customer data was compromised" ([20:10]).

8. Fog Ransomware Group Escalates Attacks with Doge Ransom Notes

Timestamp: [23:00]

Trend Micro reports a surge in attacks by the Fog ransomware group, which has targeted over 100 victims since January. The group's tactics have evolved to include:

Phishing Emails: Attackers send emails containing malicious files disguised as pay adjustment zip archives to infiltrate systems.
Double Extortion Tactics: Fog employs double extortion, where victims are not only forced to pay for decryption but also face threats of data leaks.

Security Recommendations:

Strong Backup Practices: Regularly backing up data to mitigate the impact of ransomware attacks.
System Patching and Segmentation: Keeping systems updated and segmented to prevent widespread compromise.
Phishing Training: Educating employees to recognize and avoid phishing attempts.

Trend Micro advises, "Researchers warn Fog has adopted double extortion hacks and recommend strong backup, patching, segmentation and phishing training to defend against future attacks" ([23:00]).

9. UN Warns of Global Spread of Asian Cyber Scam Operations

Timestamp: [26:40]

A recent UN report highlights the alarming expansion of organized cyber scam operations originating from Southeast Asia. These operations are now spreading to regions with weaker law enforcement, including Africa and Latin America. Key activities of these scam centers involve:

Romance Scams: Exploiting individuals by forming deceptive romantic relationships to extract money.
Fake Investments: Promising lucrative investment opportunities that are fraudulent.
Illegal Gambling: Running unauthorized gambling operations to launder money and defraud participants.
Advanced Tools Utilization: Leveraging AI, deepfakes, and underground marketplaces to enhance scam efficacy and evade detection.

The report underscores the resilience and adaptability of these criminal networks, highlighting the need for global cooperation to combat their activities effectively.

Sarah summarizes, "These so called scam centers make money from things like romance scams, fake investments and illegal gambling, with criminals using newer tools like AI, deepfakes and underground markets" ([26:40]).

Conclusion

Sarah Lane wraps up the episode by emphasizing the importance of staying informed about the evolving cybersecurity landscape. She encourages listeners to visit CISOseries.com for in-depth stories behind the headlines and to stay tuned for daily updates on the latest in information security.

This summary encapsulates the key discussions and insights from the "Cyber Security Headlines" podcast episode released on April 23, 2025, providing a comprehensive overview for those who couldn't tune in.

Loading summary

Transcript1 lines

[00:00]
Sarah Lane
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Wednesday, April 23, 2025. I'm Sarah Lane. Microsoft Recall on Copilot Plus PC testing the security and privacy implications Microsoft's recall feature was first announced back in 2023, automatically capturing screenshots of everything that you do on your PC and creating a searchable database of that activity. But it had security flaws. Data wasn't properly encrypted, sensitive information like credit card numbers was stored and it was enabled by default. People hate that. An updated version is rolling out now on Copilot Plus PCs with improvements like encryption, opt in activation and some filtering for sensitive data. Russian Organizations targeted by backdoor masquerading as secure networking software Updates Recently Kaspersky uncovered a sophisticated backdoor attack targeting Russian organizations across government, finance and industrial sectors. The malware impersonated updates for Secure networking software VIPnet. Attackers then used distributed LZH archive files containing a legitimate executable, a malicious loader and an encrypted payload, which ultimately deploys a backdoor connected to a command and control server, allowing data theft and additional malware. Kaspersky emphasizes the need for layered security defenses to counter such threats. SSL.com scrambles to patch certificate issuance vulnerability a vulnerability in SSL.com's domain control validation process allowed nearly a dozen MIS issued digital certificates for seven legitimate domains and including Alibaba Cloud's Aliyun.com a researcher exploited the flaw by creating a fake DNS record, tricking SSL.com into issuing certificates without proper domain ownership verification. SSL.com has since revoked the fraudulent certificates, disabled the flawed validation method and continues investigations. Russia Attempting cyber Sabotage attacks against Dutch Critical Infrastructure Russian state sponsored attackers have attempted cyber sabotage against Dutch critical infrastructure over the past two years. This is according to the Dutch Military Intelligence and Security Service, or MiVID. It represents the first known cyber sabotage attempts against control systems in the Netherlands. The MIVID warns that Russia is increasingly using a whole of society approach to cyber operations, which poses a threat to NATO allies. Dutch defense officials emphasize the need to strengthen military and cybersecurity capabilities, huge thanks to our sponsor Dropzone AI. Is your security team spending too much time chasing alerts instead of stopping threats? Dropzone AI modernizes your security operations by handling the routine investigations that consume your team's day organizations. Using DropZone's AI, AI SOC analysts handle significantly more alerts without growing their team. You can see how at RSAooth ESE 60 large language models like OpenAI's GPT4 and Anthropic's Claude Sonet 3.7 are accelerating the time that it takes to create working exploits after a vulnerability disclosure. So a researcher at ProDefense demonstrated that AI could analyze code patches, identify security flaws and generate proof of concept attack scripts, quickly reducing a defender's response time. Experts warn that this rapid automation is also shrinking reaction windows for cybersecurity teams. Two health care orgs hit by ransomware confirmed data breaches impacting over 100,002 U.S. health care organizations, Bell Ambulance in Wisconsin and Alabama Ophthalmology Associates, confirmed data breaches impacting over 100,000 people each after ransomware attacks. Bell Ambulance's breach is tied to the Medusa ransomware group, including names, Social Security numbers and medical information for 114,000 individuals. Alabama Ophthalmology Associates is said to be targeted by the beyond the on group and saw similar data compromised for more than 131,000 people. Retail giant Marks and Spencer confirmed it's managing a cybersecurity incident following customer reports of outages and service disruptions. While physical stores, the website and apps are operational, some in store systems including payment terminals and order pickups are temporarily affected. The company has brought in external cybersecurity experts and notified authorities, but has not disclosed the nature of the attack or if its customer data was compromised. Fog hackers troll victims with Doge ransom notes Trend Micro reports that the Fog ransomware group has ramped up attacks hitting over 100 victims since January. Attackers now reportedly use phishing emails containing a malicious file disguised as a pay adjustment zip archive to infect systems. Researchers warn Fog has adopted double extortion hacks and recommend strong backup, patching, segmentation and phishing training to defend against future attacks. UN researchers warn that Asian scam operations are spreading across the world. A UN report warns that organized crime groups based in Southeast Asia are expanding cyber scam operations globally, moving into Africa, Latin America and other regions. These so called scam centers make money from things like romance scams, fake investments and illegal gambling. Increased crackdowns have pushed them into areas with weaker law enforcement, with criminals using newer tools like AI, deepfakes and underground markets evolving into crime as a service networks. Check out the latest episode of Security youy Should Know just dropped Today we spoke with Threat Locker about what they are doing to secure endpoints in a hybrid world. Look for the episode wherever you get your podcasts. I'm Sarah Lane reporting for the CISO series and we will talk to you next time. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines. It.