Loading summary
Transcript1 lines
- [00:00]
Hadaska Sorla
From the CISO series It's Cybersecurity Headlines these are the cybersecurity headlines for Wednesday, July 9, 2025. I'm Hadaska Sorla. In today's cybersecurity news, four members of President Trump's cabinet impersonated a scammer used artificial intelligence to impersonate Secretary of State Marco Rubio, Acting National Security Advisor Marco Rubio, acting USAID Administrator Marco Rubio and Acting Archivist of the United States Marco Rubio. Using voice mimicking tech and spoofed emails like Marco Rubiotate.gov, the impersonator tried reaching foreign ministers, a governor and a member of Congress via signal and voicemail. The State Department issued a warning on July 3rd. The FBI is investigating, presumably after figuring out which Marco Rubio to report to. Is this some kind of a game? Security researchers from Fortinet have identified a stealthy new botnet called Rondodocs, which is actively targeting Internet connected surveillance systems, routers and other Linux based devices in industries like utilities, transportation and telecom. Once inside, Rondo, Docs disables security tools, hides deep within the system to survive, reboots and renames key files to avoid detection. Its most distinctive trick? It disguises its malicious network traffic to look like common VPN connections or online gaming activity like Fortnite, Minecraft and Roblox, allowing it to bypass firewalls and blend in with normal Internet use. Infected devices are quietly added to a growing botnet used for launching denial of service attacks. There's no confirmed attribution yet. Batavia attacks Russian Industrial Companies Cybersecurity researchers at Kaspersky have uncovered a spyware campaign active since March, targeting Russian industrial companies. The operation, called Batavia, sends fake emails pretending to share contract documents. The messages include links that download malicious files. The files install spyware to steal data from the device and any connected USB drives and give the attackers a backdoor to come back later. Kaspersky says the phishing emails come from a domain controlled by the hackers and that each email contains a unique download link meant just for that victim, suggesting a very targeted and organized operation. So far, the identity of the attackers remains unknown. Series Finale SEC vs SolarWinds A spinoff of the original 2020 cyber thriller the Solarwinds hack. This legal drama wrapped quietly as The SEC and SolarWinds reached a settlement ending the agency's first breach related enforcement case when, without a prearranged deal, the SEC had accused the company and its CISO of misleading investors about cyber risks. Prior to the infamous breach. After the federal judge cut much of the case down, citing weak hindsight logic. The plot lost Steam disappointing fans much like the final season of Game of Thrones. Now, with a Sept. 12 deadline to finalize terms, both parties have agreed to a stay. Huge thanks to our sponsor Vanta. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks like like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and help you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get started at vanta.com headlines Google's Gemin Ay Ay as of July 7, 2025, Google's Gemini AI will be able to access Android apps like phone messages, WhatsApp, and more, even if you previously turned off Gemini Apps Activity. That setting only stop the AI from using your data for training, not from tapping into your apps. These permissions allow Gemini to interact with other apps on your behalf, send messages, make calls. I guess I don't have to have that awkward breakup conversation after all. To fully block Gemini's access, users must go into the settings and manually revoke permissions for each app. Google says Conversations won't be used for AI training if Activity is disabled, but they'll still be stored for up to 72 hours. Privacy advocates are raising concerns about the vague rollout and the fact that off it doesn't really mean off the patch release notes didn't mention malware. A malicious pull request to a popular Visual Studio code extension called Ethcode infected over 6,000 developers, according to cybersecurity firm Reversing Labs. On June 17, an attacker using a deceptive GitHub account submitted an update that added code to download malware. The attack planted a fake NPM package that executed hidden PowerShell scripts, likely aimed at stealing crypto or tampering with smart contracts. Microsoft removed the extension and published a clean version by June 28, 2025. This incident is the latest in a rising wave of supply chain attacks targeting open source tools. Extensions extended to exploit Hackers took advantage of a loophole in browsing extension systems by first publishing clean, legitimate looking extensions, then quietly pushing malicious updates months or even years later. The updates installed automatically without user input, allowing attackers to slip past Google and Microsoft security filters. Security firm Coy Security found 18 such extensions on the Chrome and Edge stores, disguised as harmless tools like emoji keyboards and color pickers. In total, the malware laced extensions reached over 2.33 million users, enabling spying on browsing activity, session hijacking, traffic redirection and credential theft, all while appearing perfectly trustworthy. This isn't just a breach. This is an M and S breach. In a follow up to their recent ransomware attack, UK based Marks Spencer has confirmed that it began with social engineering. On April 17, attackers impersonated an employee and convinced a third party IT provider to reset that user's password, giving them initial access. From there, the threat actors believed to be drag and force ransomware group linked to scattered spider infiltrated systems, encrypted servers and exfiltrated roughly 150 gigabytes of data. They used a double extortion strategy, threatening to leak the data if demands weren't met. M and S worked with professional negotiators and has not disclosed whether a ransom was paid. As of now, the stolen data has not appeared on any leak sites. Remember to subscribe to the ciso series on YouTube, LinkedIn or wherever you spend time online. We're always posting original video clips, demos of new and interesting solutions, podcast episodes and interviews. Just search for CISO series on your favorite platform of choice and and you'll find us. If you have some thoughts on the news from today or about the show in general, be sure to reach out to us@feedbacksoseries.com we'd love to hear from you. I'm Hadas Kasorla reporting for the CISO series. Stay Alert, Stay Patched, Stay hydrated. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines. Sam.