Russian army map malware, edge tech attack report, Commvault flaw

Summary

Cyber Security Headlines - April 25, 2025

Hosted by the CISO Series

---

1. Russian Army Targeted by Android Malware in Mapping App

In today’s episode, Steve Prentiss opens with a concerning development in military cybersecurity. Cybersecurity Expert reports that the Russian army has fallen victim to a sophisticated Android malware attack embedded within a mapping application. At 00:17, the expert reveals, “A new Android malware has been found hidden in Trojanized versions,” specifically targeting the Alpine Quest Pro mapping app used by Russian soldiers for operational planning.

The malware, distributed through Telegram and Russian app catalogs as a free, cracked version, effectively masquerades as the legitimate Alpine Quest Pro to evade detection. As Prentiss elaborates at 00:38, “Mimics the legitimate app's full functionality to avoid suspicion.” Discovered by the Russian antivirus firm Dr.Web, the spyware steals sensitive information such as phone numbers, contacts, geolocation data, and documents, while also monitoring movements in real-time. This capability poses a significant threat by potentially exposing military operations, especially as it targets location logs and files shared via Telegram and WhatsApp.

The genuine Alpine Quest app is widely utilized for offline GPS mapping, making this attack particularly alarming due to its deep integration into critical military operations.

---

2. Surge in Exploitation of Edge Device Vulnerabilities

Moving forward, Steve Prentiss discusses the alarming trends in cyberattacks on edge devices. Referencing Mandiant's MTrends report, it is highlighted that in 2024, exploiting security flaws in edge devices like VPNs, firewalls, and routers accounted for one-third of all initial attack methods. The report underscores that nearly half of all observed exploitations were directed at these critical devices, with many attacks leveraging zero-day vulnerabilities.

The Cybersecurity Expert emphasizes at 01:15, “Attackers are increasingly exploiting security flaws in edge devices like VPNs, firewalls, and routers.” These devices, intended to secure networks, often lack robust third-party security support, rendering organizations vulnerable. The trend has notably impacted major companies and government agencies, with a marked increase in espionage activities attributed to Russian and Chinese actors, as noted by Google's Threat Intelligence Group at 01:48.

---

3. Critical Commvault Command Center Vulnerability

A significant security alert pertains to the Commvault Command Center, as discussed by Watchtower Labs. At 02:05, the Cybersecurity Expert warns of a critical vulnerability within this web-based user interface designed for data protection and recovery tasks. Assigned a CVE number and a CVSS score of 9.0, this flaw allows remote attackers to execute arbitrary code without authentication, potentially leading to full system compromise.

Steve Prentiss clarifies at 02:16, “It allows remote attackers to execute arbitrary code without authentication.” The vulnerability affects the 11.38 innovation release and was initially reported on April 7th, with an official advisory from Commvault released on April 17th. This exposes organizations to heightened risks, emphasizing the need for immediate patching and stringent security measures.

---

4. Linux IO Uring Creates Security Blind Spots for Rootkits

The episode delves into a major security flaw within the Linux kernel's IO uring interface. ARMO researchers have identified that IO uring allows rootkits to evade detection by bypassing traditional system calls through shared ring buffers. Introduced in Linux 5.1 to enhance asynchronous input/output operations, this mechanism inadvertently creates a critical blind spot for enterprise security tools primarily focused on monitoring syscalls.

At 03:01, the Cybersecurity Expert explains, “Most security tools focus on monitoring syscalls and overlook IO uring, creating a critical blind spot.” ARMO demonstrated the vulnerability with a proof-of-concept rootkit named Curing, highlighting the severe threat it poses. In response, Google has preemptively disabled IO uring by default on Android and Chrome OS to mitigate risks. Steve Prentiss underscores the gravity at 03:27, “The flaw underscores a hidden vulnerability in Linux runtime security environments,” calling attention to the urgent need for enhanced monitoring strategies to secure Linux-based systems.

---

5. Decline in Government-Imposed Internet Shutdowns

Shifting focus to geopolitical cybersecurity measures, Cloudflare's Q1 2025 Internet Disruption Report reveals a significant decrease in government-imposed internet shutdowns. As Steve Prentiss reports, there have been 600 government internet shutdowns in the first quarter of 2025. These shutdowns are typically employed to suppress protests and exert control, often coinciding with elections or conflicts, especially in authoritarian regimes like Myanmar.

At 05:10, the Cybersecurity Expert notes, “Cloudflare's report shows no new shutdowns so far this year, a rare occurrence seen only in two other quarters over the past three years,” suggesting a potential shift in governmental approaches to controlling internet access. This trend, monitored alongside groups like NetBlocks, indicates a possible move towards more sustainable or less disruptive methods of maintaining control.

---

6. Marks & Spencer's Ongoing Cyber Incident Impacting Payment Systems

In the retail sector, Marks & Spencer continues to grapple with the repercussions of a recent cyber incident affecting their contactless payment systems. The Cybersecurity Expert details at 05:22, “The UK retailer says its contactless payment systems are still down following a cyber incident that occurred last week.” This disruption has led to the impairment of purchasing procedures such as Click and Collect and home deliveries.

At 05:48, Steve Prentiss highlights, “The retailer announced that some of its internal processes have been moved offline, which the Register suggests is consistent with a ransomware scenario.” This ongoing issue underscores the persistent threats retailers face from ransomware attacks, emphasizing the need for robust cybersecurity defenses and incident response strategies to minimize operational disruptions.

---

7. Darkula Enhances Phishing Capabilities with Generative AI

The podcast also covers enhancements in cybercriminal toolkits, specifically the China-based phishing-as-a-service platform Darkula. As reported by Netcraft, Darkula has integrated generative artificial intelligence into its cybercrime suite. At 05:58, the expert explains, “Darkula has released new updates to their cybercrime suite with generative artificial intelligence capabilities.”

Steve Prentiss adds at 06:15, “This addition lowers the technical barrier for creating phishing pages, enabling less tech-savvy criminals to deploy customized scams in minutes.” The integration of AI into phishing tools democratizes the ability to craft convincing scams, increasing the volume and sophistication of phishing attacks. This development poses a heightened threat landscape, necessitating advanced detection and mitigation strategies to counteract AI-enhanced phishing schemes.

---

8. Doubling of Third-Party Breaches According to Verizon

Lastly, the Verizon Data Breach Investigations Report highlights a disturbing trend in third-party breaches. The report indicates that the proportion of breaches involving third parties has doubled from 15% to 30% compared to the previous year. Steve Prentiss emphasizes at 06:30, “The proportion of breaches involving third parties rose from 15% in last year's data set to 30% in this year's report.”

The Cybersecurity Expert further explains that cybercriminals are increasingly targeting organizations such as accountants and law firms to reach their intended targets. Verizon attributes this surge to vendors and business partners expanding the attack surface by failing to enforce proper access controls and prevent credential misuse. At 07:06, the expert states, “Vendors and other business partners are expanding the attack surface by failing to enforce proper access controls, including preventing credential misuse.”

This doubling trend underscores the critical importance of robust third-party risk management and the implementation of stringent access controls to protect organizations from downstream security risks.

---

Conclusion

Today's Cyber Security Headlines covered a range of pressing issues, from advanced malware targeting military operations to the alarming rise in third-party breaches. The integration of AI into cybercriminal toolkits and persistent vulnerabilities in critical infrastructure like edge devices and Linux systems highlight the evolving threat landscape. Additionally, the decline in government-imposed internet shutdowns offers a glimmer of hope amidst global cybersecurity challenges. As organizations navigate these complex threats, the emphasis on proactive security measures and comprehensive risk management remains paramount.

---

For more detailed stories and updates, visit CISOseries.com.

Transcript

[Host]

From the CISO series, it's Cybersecurity Headlines.

[Steve Prentiss]

These are the cybersecurity headlines for Friday, April 25, 2025. I'm Steve Prentiss.

[Cybersecurity Expert]

Russian army targeted by Android malware hidden in mapping app A new Android malware has been found hidden in Trojanized versions.

[Steve Prentiss]

Of the Alpine Quest Pro mapping app.

[Cybersecurity Expert]

Reportedly used by Russian soldiers for oper planning. Distributed via Telegram and Russian app catalogs as a free cracked version, the spyware.

[Steve Prentiss]

Mimics the legitimate app's full functionality to avoid suspicion. Discovered by Russian antivirus firm Dr.

[Cybersecurity Expert]

Web, the malware steals sensitive data including.

[Steve Prentiss]

Phone numbers, contacts, geolocation and documents. It also monitors movements in real time.

[Cybersecurity Expert]

And targets location logs and files shared through Telegram and WhatsApp, potentially exposing military operations.

[Steve Prentiss]

The genuine Alpine Quest app is widely used for offline GPS mapping Attackers hit security device defects hard in 2024 attackers.

[Cybersecurity Expert]

Are increasingly exploiting security flaws in edge devices like VPNs, firewalls and routers. According to Mandian's latest MTrends report, in 2024, exploits accounted for one third of all initial attack methods, with the four most targeted vulnerabilities found in these critical devices. Many of these were zero day exploits.

[Steve Prentiss]

And nearly half of all observed exploitations targeted edge devices.

[Cybersecurity Expert]

These tools, meant to protect networks, often.

[Steve Prentiss]

Lack third party security support, making organizations vulnerable.

[Cybersecurity Expert]

Attacks have affected major companies and government agencies, with notable increases in espionage activity from Russian and Chinese actors, according to.

[Steve Prentiss]

Google's Threat Intelligence Group. Critical Commvault command center flaw warning Watchtower.

[Cybersecurity Expert]

Labs is warning of a critical vulnerability.

[Steve Prentiss]

In the Commvault Command Center, a web based user interface for data protection and recovery tasks. With a CVE number and a CVSS.

[Cybersecurity Expert]

Score of 9.0, it allows remote attackers.

[Steve Prentiss]

To execute arbitrary code without authentication. The flaw affects the 11.38 innovation release.

[Cybersecurity Expert]

Commvault has warned that the vulnerability could.

[Steve Prentiss]

Result in full system compromise.

[Cybersecurity Expert]

The flaw was reported on April 7th, and an official advisory was released by.

[Steve Prentiss]

Commvault on April 17th.

[Cybersecurity Expert]

Linux IE Security Blindspot can lead to.

[Steve Prentiss]

Rootkit attacks A major security flaw in.

[Cybersecurity Expert]

The Linux kernel's IO IRing interface, I.e. iOUs, allows rootkits to evade detection by.

[Steve Prentiss]

Enterprise security tools, according to researchers at Armo.

[Cybersecurity Expert]

Introduced in Linux 5.1 for faster asynchronous I o. The I o uring bypasses traditional system.

[Steve Prentiss]

Calls, using shared ring buffers to queue operations. Most security tools focus on monitoring syscalls.

[Cybersecurity Expert]

And overlook IO urine, creating a critical blind spot. ARMO demonstrated the risk with a proof.

[Steve Prentiss]

Of concept Rootkit named curing due to.

[Cybersecurity Expert]

The severity of the threat. Google has disabled IO urine by default on Android and Chrome os. The flaw underscores a hidden vulnerability in Linux runtime security environments.

[Steve Prentiss]

Huge thanks to our sponsor Dropzone AI.

[Cybersecurity Expert]

Alert investigation is eating up your security team's day. 30 to 40 minutes per alert adds up fast. DropZone AI's SOC analyst transforms its reality by investigating every alert with expert level thoroughness at machine speed.

[Steve Prentiss]

Their AI SoC analyst gathers evidence, connects.

[Cybersecurity Expert]

The dots across your security tools and.

[Steve Prentiss]

Delivers clear reports with recommended actions all in minutes. No playbooks to build, no code to write, just consistent, high quality investigations that.

[Cybersecurity Expert]

Free your team to focus on what matters.

[Steve Prentiss]

Stopping actual threats.

[Cybersecurity Expert]

Meet them at RSA at booth ESE.

[Steve Prentiss]

600 Government Internet shutdowns in the first quarter 2025 According to Cloudflare, governments worldwide.

[Cybersecurity Expert]

Appear to be reducing their use of Internet shutdowns to suppress protests and control.

[Steve Prentiss]

The company, along with other monitoring groups like NetBlocks, has tracked numerous shutdowns and.

[Cybersecurity Expert]

Website bans often linked to elections or conflict, with some going on for years.

[Steve Prentiss]

In authoritarian regimes like Myanmar.

[Cybersecurity Expert]

However, Cloudflare's Q1 2025 Internet Disruption Report shows no new shutdowns so far this year, a rare occurrence seen only in two other quarters over the past three.

[Steve Prentiss]

Years, suggesting a possible shift in government.

[Cybersecurity Expert]

Behaviour regarding Internet access.

[Steve Prentiss]

UK retailer Marks & Spencer still down following up on a story we brought.

[Cybersecurity Expert]

You on Wednesday, the UK retailer Marks and Spencer says its contactless payment systems are still down following a cyber incident.

[Steve Prentiss]

That occurred last week.

[Cybersecurity Expert]

As a result, purchasing procedures such as.

[Steve Prentiss]

Click and collect and home deliveries are affected.

[Cybersecurity Expert]

The retailer announced that some of its internal processes have been moved offline, which the Register suggests is consistent with a ransomware scenario.

[Steve Prentiss]

Darkula adds genai to phishing toolkit, further.

[Cybersecurity Expert]

Lowering the barrier for cybercriminals and likely coming as a surprise to no one.

[Steve Prentiss]

The China based phishing as a service platform Darkula. That is not Dracula. But Darkula has released new updates to their cybercrime suite with generative artificial intelligence capabilities, according to cybercrime detection company Netcraft.

[Cybersecurity Expert]

In a new report. This addition lowers the technical barrier for creating phishing pages, enabling less tech savvy.

[Steve Prentiss]

Criminals to deploy customized scams in minutes. Third party breaches double in a year.

[Cybersecurity Expert]

According to Verizon's Data Breach Investigations report.

[Steve Prentiss]

Released this past Wednesday.

[Cybersecurity Expert]

The proportion of breaches involving third parties rose from 15% in year's data set to 30% in this year's report. The report suggests cybercriminals are increasingly looking at organizations such as accountants and law.

[Steve Prentiss]

Firms as ways to reach their intended targets.

[Cybersecurity Expert]

Verizon adds that vendors and other business partners are expanding the attack surface by failing to enforce proper access controls, including preventing credential misuse.

[Steve Prentiss]

In particular, weak third party practices continue.

[Cybersecurity Expert]

To expose organizations to downstream risks.

[Steve Prentiss]

End Quote as usual, we've got a.

[Cybersecurity Expert]

Busy Friday of live streams today.

[Steve Prentiss]

It starts at 1pm with Super Cyber.

[Cybersecurity Expert]

Friday where the topic will be hacking your risk, an hour of critical thinking of all the things you look at.

[Steve Prentiss]

To find what is specifically important to you.

[Cybersecurity Expert]

Then at 3:30pm Eastern, we have our.

[Steve Prentiss]

Week in Review show.

[Cybersecurity Expert]

Bethany DeLude, CISO emeritus at the Carlyle Group, will be our guest providing her expert commentary on the news of the week.

[Steve Prentiss]

To join us for both, head on over to the events [e-mail] I'm Steve Prentiss reporting for the CISO Series.

[Host]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.