← Cybersecurity Headlines
Cybersecurity Headlines
North Korean crypto theft, Microsoft rolls out back up, four charged in global scheme
00:09:07
Loading summary
Transcript1 lines
- [00:00]
Lauren Verno
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Tuesday, August 12, 2025. I'm Lauren Verno. North Korean crypto theft three IT specialists secretly working for North Korea allegedly stole around US$1 million in cryptocurrency from a New York company by exploiting a vulnerability in its wallet system. Now the criminals used a fake Malaysian ID to get hired and they laundered the stolen tether tokens through multiple blockchains over three months. Now the FBI seized the funds in July and is holding them while the Department of Justice seeks to return the money to the company. The Rewards for Justice program is offering US$5 million for information disrupting similar North Korean operations. Microsoft Rolls out PC backup during attck Microsoft just opened a limited public preview for Windows 365 Reserve, a new service that gives employees temporary access to cloud PCs when their main devices fail or get hit by a cyber attack. Now you get up to 10 days per year of access with pre configured desktops that come ready with your company's apps and security policies. Now the preview is invite only for now, but once you're in, users can log in from any device through a browser or Windows app, keeping work flowing while it sorts out the problem. US charges 4 in 100 million global fraud scheme 4 high ranking members of a Ghana based criminal organization have been charged in connection with a massive fraud scheme that stole more than 100 million USD through romance scams and business email compromise attacks. Prosecutors say the group, which operated between 2016 and 2023, tricked businesses into wiring funds to using spoofed email accounts and forged authorization letters while also targeting individuals in online romance scams. One suspect remains at large while the others face decades in prison. Wikipedia loses UK legal challenge Wikipedia's operator lost its legal challenge against the UK's Online Safety act, which could force the site to verify users if classified as a Category 1 platform. Now the Wikimedia foundation warned that such rules would threaten volunteer privacy, expose contributors to risks like data breaches, and hurt Wikipedia's ability to operate freely. Now the court dismissed the challenge, but left the door open for review once Wikipedia's category is decided on. It's also important to note this ruling only applies in the UK and doesn't directly affect Wikipedia operations or policies in other countries, including the us. A huge thanks to our episode sponsor Vanta. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs. We rely on point in time checks, but more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get started at vanta.com headlines that's V A N T A dot com headlines Credit union hack exposes 172,000 Conex Credit Union, one of the largest in Connecticut, says hackers got into its systems in early June and access personal and financial data for 172,000 people. The breach lasted just a day but may have exposed names, account numbers, debit card details, Social Security numbers and even government IDs. Now, while there's no sign anyone's accounts or funds were touched, Conex is warning members to watch out for scam calls and texts from people pretending to be employees. Known Exchange flaw leaves thousands still exposed more than 29,000 Microsoft Exchange servers remain unpatched against a high severity flaw we first reported last week that lets attackers escalate privileges in connected Exchange online environments. Now the vulnerability, which affects Exchange Server 2016, 2019 and the subscription based edition in hybrid setups, was disclosed in April alongside a Microsoft hotfix. But scans show thousands are still exposed, over 7,200 in the US alone. CISA has ordered federal agencies to patch or discontinue vulnerable servers by Monday, warning the bug could lead to total domain compromise. Pen testers wanted Ransomware gang hiring if you know a pen tester looking to trade in their white hat, the bad guys are hiring. And for legal purposes, I don't mean that seriously, but the Medusa Locker ransomware gang is openly recruiting new penetration testers on its Tor leak site. The group, which runs as a ransomware as a service operation, wants candidates skilled in targeting ESXi, Windows and ARM systems with direct access to corporate networks preferred. Like legitimate pen testers, these hires will map and exploit vulnerabilities, but for the purpose of maximizing ransom payouts, not fixing security gaps. Google pays out biggest Chrome bug bounty yet A researcher known as Mickey has brought home Google's biggest payout to date, earning 250,000 USD, more than double the second largest reward. Now he discovered a high severity Chrome vulnerability that lets attackers escape the browser sandbox and execute system commands. The flaw found in Chrome's Mojo Inter process communication system was patched in May and praised by Google for its complexity and the quality of the exploit demonstration. Large language models can do a lot of things, but they are hardly infallible. We continue to see stories emerge of organizations relying on the output of LLMs without any human review, resulting in consequences ranging from humorous to disastrous. So how do we build in human in the loop verification when the scale of LLM output can be so daunting? That's one of the segments we're digging into on on this week's episode of the CISO Series podcast. Look for the episode impressive. Our AI is approaching 1.9of accuracy wherever you get your podcast. And if you have some thoughts on the news from today or about the show in general, be sure to reach out to us@feedbackisoseries.com we'd love to hear from you. I'm Lauren Verno reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.