← Cybersecurity Headlines
Cybersecurity Headlines
Salt Typhoon expands, AI-powered ransomware, Anthropic warns of vibe-hacking
00:07:39
Loading summary
Transcript3 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines.
- [00:07]
B
These are the cybersecurity headlines for Thursday, August 28, 2025. I'm Rich Stroffelino FBI warns of expanded Chinese hacking campaign A joint advisory from five Eyes allied security agencies as well as the Czech Republic, Finland, the Netherlands and Poland warned that efforts by Salt Typhoon have expanded, now hitting at least 200 organizations across 80 countries. These attacks were allegedly aided by three private companies that provided services to China's People's Liberation army and the Ministry of State Security. Part of the reason there was a wide spread of victims is that these companies were allowed to choose their own targets. While Salt Typhoon notably gained long term access to US Telecoms. This advisory warned that the expanded attacks show a broad indiscriminate targeting of critical infrastructure AI powered ransomware is a thing now in it was only a matter of time news Researchers at ESET discovered a work in progress ransomware dubbed Promptlock. This is written in Golang and uses the Openweight GPT OSS 20B model from OpenAI. Prompt Lock uses hard coded prompts to generate LUA scripts dynamically. These scripts are then used for operations like file enumeration, inspection exfiltration and ultimately encryption. The researchers caution that promptlocked in its current form isn't exactly practical, requiring a local install of Ollama with significant hardware resources to actually run, and it also requires poor network segmentation to allow for communication to an external server. Still, mark your calendar. AI powered ransomware will only get better after today Anthropic warns about Vibe hacking the AI company released a new threat intelligence report, which warns that agentic AI systems are being weaponized. The report profiled a threat actor using CLAUDE code to run a data extortion operation end to end that hit at least 17 organizations across a variety of verticals in about a month. Anthropic's Claude chatbot was used for everything from technical consultation to crafting psychologically targeted extortion demands. The report also detailed the use of CLAUDE by North Korean IT workers to get jobs at Fortune 500 US companies and saw ads for romance scams using its chatbot on Telegram, while Anthropic created new controls to prevent similar types of abuse that it profiled in the report. It warned that these examples it found likely reflect consistent patterns of behavior across all frontier AI models. Swedish municipalities impacted by suspected ransomware Miliodota is an HR software provider used by about 200 Swedish municipal governments. Its CEO Eric Hallen confirmed that threat actors are attempting to extort the company saying. Seemingly as part of a ransomware attack, several regional governments confirmed that they used meliodota to handle medical information and other sensitive employee data. Swedish Minister for Civil Defense Carl Oskar Bohlen stressed that the scope of the incident is still under investigation, but said the government plans to present a new cybersecurity bill to Parliament in the near future. And now, thanks to today's episode sponsor Profit Security SOC Analyst Burnout is real. Repetitive tasks, poor tooling and constant alert noise are driving them out. Profit Security fixes this. Their agentic AI analyst handles alert triage and investigation work that 69% of cybersecurity leaders say is the best use for AI in the SoC. Say goodbye to burnout and hello to efficiency. Check out ProfitSecurity AI that's P R O P H E T Security AI US DoD using software maintained by Russians A new report from Hunted Labs found that the open source tool fastglob is solely maintained by a Russian based Yandex employee. This useful tool allows developers to perform actions on a group of files without extra code. It's such a useful tool that the US Department of Defense uses it in at least 30 pre built software packages as well as about 5,000 other projects globally, seeing about 70 million downloads per week. Hunted Lab's researchers found no malicious code in Fast Glob and contacted the DOD's Office of the Chief Information Officer three weeks prior to publishing findings. Over the summer, the Department of Defense issued a memo directing DoD staff to not procure any hardware or software susceptible to adversarial foreign influence. Citric's RCE flaw Under active exploitation, Citrix released updates for netscaler, ADC and gateway devices to address a vulnerability that allows for remote code execution. The Shadow Server foundation reports that There are over 28,000 vulnerable devices online, with about 35% located in the U.S. citrix did not provide any other mitigations, workarounds or indicators of compromise. CISA and Citrix found evidence that these are already being exploited by malicious actors and and the flaw has been added to the known exploited vulnerabilities catalog. Federal agencies have until August 28th to patch blind Eagle sinks its talents into Colombia. Researchers at Recorded Future published details about a campaign by the group Blind Eagle, which primarily targets the Colombian government from May 2024 to July 2025. These attacks were carried out by five distinct clusters using different infrastructure and operations, but showing some overall common tactics based around using cracked remote access Trojans, dynamic domain providers and legitimate Internet services for staging, as well as using Spear Phishing lures posing as government agencies. Blind Eagle has been active since 2018, typically targeting victims in South America for financial gain. When NDA stands for New Download Attack, researchers at Checkpoint detailed a new campaign where threat actors delivered malware to American industrial and tech firms to create disguised as non disclosure agreements. These threat actors initially approach victims through their contact US forms, posing as potential business partners and keeping up communication for several weeks. Eventually, they ask the firm to sign an NDA sent as a zip archive but containing a custom malware called mixshell. This appears to be a highly tailored approach. In some instances, the threat actors sent completely innocuous zip files, seemingly depending on the victim's IP address and browser information. The threat actors also set up fake websites using domains tied to real US Businesses for added veracity. Staying on top of regulations is a headache for every ciso. But this isn't just about compliance. What happens when regulations disrupt the sales process? That's what we'll be digging into on this week's episode of Defense In Depth. Look for the episode how to deal with last minute compliance requirements. Wherever you get your podcasts, and if you have some thoughts about the news from today or about the show in general, be sure to reach out to us@feedbacksoseries.com we would love to hear from you. Reporting for the CISO series, I'm Rich Stravalino reminding you to have a super sparkly day.
- [07:23]
A
Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines. Don't.