Microsoft updates Update, LexisNexis leak, cyber insurance premiums

Summary

Cyber Security Headlines - Podcast Summary

Podcast Title: Cyber Security Headlines
Host/Author: CISO Series
Release Date: May 29, 2025
Episode Topics: Microsoft Updates, LexisNexis Leak, Cyber Insurance Premiums

1. Microsoft Launches New Update Orchestration Platform

Timestamp: [00:06]

Rich Stroffelino opens the episode by discussing Microsoft's latest initiative to streamline update management for organizations. Microsoft has initiated a private preview of a new update orchestration platform built on top of Windows Update. This platform aims to unify updates for all applications, drivers, and Windows components within an organization.

Key Features:

• Unified Update Management: Organizations can leverage WinRT APIs or PowerShell commands to onboard their updates seamlessly.
• Optimized Performance: The new model is designed to plan downloads and updates in a way that minimizes bandwidth usage, user downtime, and CPU load.
• Enhanced Visibility: Users will be able to view the history of all updates directly in the Settings app, alongside official Windows updates.

Rich noted, “No word on Microsoft's timetable to publicly launch the tool,” leaving listeners anticipating further announcements.

2. LexisNexis Data Breach Affects 364,000 Individuals

Timestamp: [00:05]

The podcast shifts focus to a significant data breach reported by LexisNexis, which has impacted approximately 364,000 individuals. On April 1, an unknown third party reported unauthorized access to company information. Despite an internal investigation revealing no breach of LexisNexis systems, it was discovered that some data stored on GitHub was accessed.

Affected Data Includes:

• Names
• Contact Details
• Social Security Numbers
• Driver’s License Numbers

Regulatory filings from Maine, South Carolina, and Vermont indicated that the data was initially accessed on December 25, 2024. Currently, LexisNexis has found no evidence of data misuse but has pledged to provide two years of credit monitoring to those impacted.

3. Surge in Cyber Insurance Premiums

Timestamp: [00:04]

Cyber insurance is experiencing a notable uptick, with premium volumes expected to double by 2030. According to Bloomberg, Munich Reag projects the global cyber insurance market to grow from $16.3 billion in 2025 to approximately $30 billion by 2030.

Insights:

• Rising Cybercrime Costs: Cybersecurity Ventures estimates that hacking crimes resulted in $9.5 trillion in losses in 2024, with most risks remaining uninsured.
• Low Coverage Rates: Beasley PLC reports that less than half of Fortune 100 companies and under 10% of SMEs currently hold cyber insurance policies.

Rich highlights the stark contrast between the vast cybercrime losses and the relatively low penetration of cyber insurance, emphasizing the growing importance of such coverage.

4. India’s Stricter Surveillance Equipment Regulations

Timestamp: [00:07]

India has introduced stringent regulations for importing Internet-connected CCTV models effective from April 9, 2025. All imported CCTV cameras must undergo a comprehensive assessment of their hardware, software, and source code in government labs before they can be sold in India.

Key Requirements:

• Tamper-Proof Enclosures: Ensuring physical security against unauthorized access.
• Advanced Malware Detection: Implementing robust software defenses against cyber threats.
• Encryption Usage: Mandatory encryption to protect data integrity and privacy.

Reuters reports that these regulations are partially a response to China's expanding surveillance capabilities. A recent meeting on April 3 with executives from surveillance equipment companies like Hanhua, Motorola, Bosch, Honeywell, and Xiaomi revealed their inability to meet the certification requirements. Consequently, India is facing a backlog, with only 35 applications approved out of 342 pending as of May 28. The limited capacity of 15 labs accommodating 28 applications at a time has exacerbated the delay.

5. New Botnet Targets ASUS Routers

Timestamp: [00:06]

Security researchers at Graynoise have uncovered a new botnet named Ashush, which has been active since March 2025. This botnet specifically targets SoHo (Small Office/Home Office) routers from brands such as Asus, Cisco, D-Link, and Linksys.

Attack Method:

• Exploiting Command Injection Flaw: Utilizes an old vulnerability to inject a threat actor-controlled SSH public key.
• Persistence Mechanism: Enables listening on TCP port 53282, ensuring the botnet remains active despite configuration changes or firmware updates.

Findings:

• 9,000 Infected Routers: A significant number of ASUS routers have been compromised.
• Minimal Malicious Activity: Although the number of infections is high, the malicious requests remain limited at this stage.
• Unclear Objectives: The long-term goals of Ashush's operators are yet to be determined.

6. Dark Partners Exploits Through Fake Websites

Timestamp: [00:07]

Cybersecurity researcher Gongzha has identified a threat group known as Dark Partners, which employs deceptive tactics to distribute malware. This group creates fake websites that impersonate legitimate applications and services, including:

• Cryptocurrency Platforms
• VPN Services
• Payment Processors
• Remote Desktop Solutions

Malware Distribution:

• Download Buttons: These mimic legitimate service downloads but instead deliver malware loaders like Payday, Poseidon, and Luma.
• Data Harvesting: The malware attempts to scrape crypto wallet information and utilizes a Google Calendar link to retrieve C2 (Command and Control) server addresses.

Additional Tactics:

• On Windows platforms, Dark Partners uses code signing certificates, though currently, none of these certificates are valid.
• The group also operates faux Bitdefender websites, which redirect users to install malicious executables like Venomrat, StormKitty, and Silent Trinity. These tools provide persistent remote access, crypto wallet theft, and a framework for prolonged device control.

The researchers suspect that Dark Partners may be aiming to resell access to infected devices, indicating a shift towards more profitable, long-term cybercriminal activities.

7. North Korean Laptop Farms in the US

Timestamp: [00:07]

The Wall Street Journal featured a profile on Christina Chapman, a 50-year-old operator of a laptop farm in the United States. These farms are exploited by North Korean operators to infiltrate US companies under the guise of remote workers.

Operation Details:

• Chapman was recruited via LinkedIn to represent a company that placed overseas IT workers, while in reality, North Korean operatives were conducting similar schemes on platforms like Upwork and Fiverr.
• Unwittingly, Chapman managed the domestic aspects, including setting up online connections, facilitating paychecks, handling tax and identification forms, and maintaining the laptops that North Koreans used to access US networks.

Impact:

• CrowdStrike has identified roughly 150 instances of North Korean workers infiltrating customer networks through these laptop farms, with operations observed in at least eight locations.
• The scheme also involved hiring Americans to provide mailing addresses, perform liveliness checks, and conduct job interviews to maintain the façade.

Legal Proceedings:

• The FBI raided Chapman’s residence in October 2023.
• Chapman has pleaded guilty to wire fraud and money laundering and is scheduled for sentencing on July 16.

8. Prevalence of Resume Fabrications Among Cybersecurity Professionals

Timestamp: [00:04]

A recent survey reveals that 72% of cybersecurity professionals admit to taking creative liberties on their resumes. This alarming statistic raises questions about the pressures and motivations driving qualified individuals to embellish their credentials.

Discussion Points:

• Job Market Competition: Intense competition for cybersecurity roles may compel professionals to enhance their resumes to stand out.
• Skill Gaps: Some candidates might overstate their expertise to compensate for actual deficiencies in their skill sets.
• Career Advancement: Individuals may seek to fast-track their careers by presenting themselves as more experienced or proficient than they are.

Rich Stroffelino hints at an in-depth discussion on this topic in the latest episode of Defense In Depth, exploring the underlying reasons and potential impacts of such unethical practices in the cybersecurity field.

Conclusion

This episode of Cyber Security Headlines covered a broad spectrum of critical issues affecting the cybersecurity landscape in 2025. From Microsoft's efforts to streamline update management and significant data breaches to the burgeoning cyber insurance market and sophisticated cyber threats, the podcast provided a comprehensive overview of the current state of information security. Additionally, discussions on regulatory challenges in India, the rise of botnets, and the exploitation of remote work platforms by North Korean operatives highlighted the multifaceted nature of contemporary cyber threats. The survey on resume fabrications underscored the human element and ethical considerations within the cybersecurity profession.

For more detailed insights and daily updates on cybersecurity, listeners are encouraged to visit CISOSeries.com.

Transcript

[CISO Series]

From the CISO series. It's Cybersecurity Headlines.

[Rich Stroffelino]

These are the cybersecurity headlines for Thursday, May 29, 2025. I'm Rich Stroffelino. Microsoft Wants to Update all the Things Microsoft opened a private preview for a new update orchestration platform that operates on top of Windows Update. This aims to unify updates for all apps, drivers and Windows components for an organization. Organizations can use WinRT APIs or PowerShell commands to onboard their updates. The new model will plan downloads and updates to minimize bandwidth, user downtime and CPU usage. This will also show the history of all updates in the Settings app alongside official Windows updates. No word on Microsoft's timetable to publicly launch the tool. LexisNexis breach impacts 364,000 people the prominent analytics company disclosed that its LexisNexis risk solutions business received a report from an unknown third party about accessing company information on April 1. An investigation found that the company itself didn't suffer a breach of its systems, but that some data, which was held in GitHub, was acquired by an unknown third party. This information includes names, contact details, Social Security numbers and driver's license numbers. Regulatory filings in Maine, South Carolina and Vermont disclose that this GitHub data was initially accessed on December 25, 2024. The company has found no signs of misuse and will offer impacted victims two years of credit monitoring. Cyber Insurance premium volume expected to double Bloomberg reports that the insurance company Munich Reag expects the global cyber insurance market to hit $16.3 billion in 2025 and roughly double to $30 billion by 2030. Cybersecurity Ventures estimates that hacking crimes resulted in $9.5 trillion in losses in 2024, with the vast majority of those risks uninsured. The insurer Beasley PLC estimates that less than half of the Fortune 100 and less than 10% of SMEs have a cyber policy. Surveillance Industry clashes with Indian regulations Late last year, India created new regulations that require all Internet connected CCTV models imported after April 9, 2025 to submit hardware, software and source code for assessment in government labs before being sold in the country. The rules require CCTV cameras sold in India to have tamper proof enclosures, strong malware detection and use encryption. Although the regulations do not call out any specific country sources speaking to and documents seen by Reuters attest that these rules were in part a response to China's surveillance capabilities. An April 3 meeting with surveillance gear executives including Hanhua, Motorola, Bon Bosch, Honeywell and Xiaomi told government officials they weren't ready to meet certification requirements. The government declined a request to delay the regulations at the meeting. India currently has 15 labs that can review 28 applications at a time, but as of May 28, there were 342 applications pending. And since testing began, labs have approved just 35 applications and only one from a foreign country. And now, thanks to our sponsor ThreatLocker, ThreatLocker is a global leader in zero Trust Endpoint security, offering cybersecurity controls to protect businesses from zero day attacks and ransomware. ThreatLocker operates with a default deny approach to reduce the attack surface and mitigate potential cyber vulnerabilities. To learn more and start your free trial, visit threatlocker.com CISO that's T H R E A T L O c k e r.com CISO botnet hits ASUS routers Security researchers at Graynoise discovered a novel botnet dubbed Ashush, operating a campaign since mid March 2025 targeting SoHo routers from Asus, hence the name, as well as Cisco D Link and Linksys on Asus routers. Specifically, the campaign exploits an old command injection flaw to add a threat actor controlled SSH public key and enable listening on TCP port 53282. This allows for persistence across configuration changes and firmware updates. The Researchers identified over 9,000 infected ASUS routers, although so far malicious requests have been minimal. It's unclear what the operational goal of the botnet is long term. Dark Partners Dropping info stealers Cybersecurity researcher Gongzha discovered a threat group dubbed Dark Partners. This group fakes websites to impersonate dozens of apps and other tools, including seven cryptocurrency platforms, VPN services, payment processors, and remote desktop solutions. These pages all provide a simple download button to these services, but instead deliver malware loaders like Payday or the infostealers Poseidon and Luma. These attempt to scrape crypto wallet information and use a Google Calendar Link to retrieve C2 server addresses. On Windows, Dark Partners uses code signing certificates, but as of this recording, none are valid. Faux BitDefender site delivers real malware in other spoofed site news, researchers at Domain Tools discovered a campaign that uses a spoofed version of Bitdefender's antivirus download page for Windows. But instead of legitimate tooling, it redirects visitors to the StoreInstaller EXE file, which installs Venomrat, StormKitty, and Silent Trinity malware. Combined, the three provide persistent remote access, attempts to steal crypto wallet information, and provides a framework for long term control. While this might seem like another campaign to quickly grab crypto credentials like we just covered, the researchers say the total malware bundle shows signs of looking to resell access to the infected device. US Laptop Farms enabling North Korean Remote Jobs the Wall Street Journal profiled Christina Chapman, a 50 year old operator of a laptop farm used by North Korean operators to infiltrate as remote workers in US companies. Chapman was approached on LinkedIn to be the US face of a company placing overseas IT workers, with North Koreans operating similar schemes on Upwork and fiverr. Notably, Chapman wasn't aware that she was working for North Korea. These farmers set up domestic online connections, facilitate paychecks, send along tax and identification forms, and maintain the laptops that North Koreans log into. CrowdStrike identified roughly 150 cases of North Korean workers operating on customer networks, and laptop farms have been seen in at least eight. These operators also hired Americans to provide domestic mailing addresses, pass liveliness checks and conduct job interviews. The FBI raided Chapman's home back in October 2023 and she pleaded guilty to wire fraud and money laundering charges and is set for sentencing on July 16. A survey found 72% of cybersecurity professionals took creative liberties on their resumes. Why do so many otherwise qualified professionals feel forced to spice up their resumes to get a gig? That's what we're talking about on our latest episode of Defense In Depth. Look for why cybersecurity professionals lie on their resumes. Wherever you get your podcasts and if you have some thoughts on the news from today or just about the show in general, be sure to reach out to [e-mail] we'd love to hear from you and profile your emails on our weekend Review show. Reporting for the CISO series, I'm Rich Strofolino, reminding you to have a super sparkly day.

[CISO Series]

Cybersecurity headlines are available every weekday. Head to CISO series.com for the full stories behind the headlines.