← Cybersecurity Headlines
Cybersecurity Headlines
ShinyHunters hits Vietnam, Petya-NotPetya copycat appears, CISA wants CVE
00:08:44
Loading summary
Transcript1 lines
- [00:00]
A
From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, September 15, 2025. I'm Steve Prentiss. Shiny Hunters Hits Vietnam National Credit Information center the attack was confirmed by the Vietnam Cyber Emergency Response Team and RE Security's Hunter team was able to acquire samples of leaked data, much of which is connected to other financial institutions in Vietnam. This attack is believed to be an exploit of an End Day vulnerability. Quote A known but unpatched flaw in End of Life software used by the Credit Information center. Because the software was no longer supported, no security patches were available, leaving the system especially vulnerable. End quote Shiny Hunters did not extort the bank, but simply listed the data for sale on a dark web forum. Hybrid PETIA is a Petia not PETIA Copycat with UEFI Secure Boot Bypass According to a post in Welive Security from ESET Research, Hybrid petia, in addition to being a copycat, now adds the capability of compromising UEFI based systems and weaponizing a CVE numbered flaw to bypass UEFI Secure Boot on outdated systems. This new ransomware was uploaded to VirusTotal this past February and encrypts the master file table, which contains important metadata about all the files on NTFS formatted partitions. ESET has seen no signs of Hybrid PETIA being used in the wild yet and says it does not exhibit the aggressive network propagation seen in the original not Petia CISA officials call on lawmakers to extend cyber information sharing law A top CISA official, Nick Anderson, CISA's executive assistant director for Cybersecurity, speaking at the Billington Cybersecurity Summit in Washington, says he is urging Congress to renew the 2015 Cybersecurity Information Sharing act before it expires on September 30. The law encourages private companies to voluntarily share threat intelligence with the government. Renewal legislation has advanced in the House but has yet to reach a full vote, while the Senate is only beginning to circulate its own version, led by Homeland Security Committee Chair Rand Paul. With limited time left, lawmakers may extend the measure temporarily by attaching it to a short term government funding bill to prevent disruption. Great Firewall suffers its biggest leak ever On September 11, researchers confirmed that more than 500 gigabytes of internal documents, source code, work logs and internal communications from the so called Great Firewall were dumped online, including packaging repos and operational runbooks used to build and maintain China's national traffic filtering system. End quote this leak exposed details of Tangzhou, a commercial censorship platform developed by Chinese firm gege. Originally built on HP and Dell servers and later on Chinese hardware, Tangzhou functions as a turnkey, a great firewall in a box. Deployment records show it was installed across 26 data centers in Myanmar, capable of handling 81 million simultaneous TCP connections and integrated at national exchange points for large scale blocking and filtering. Additional reporting by Wired and Amnesty International reveals exports to Pakistan, Ethiopia and Kazakhstan where it supports mass surveillance and lawful intercept systems. Huge thanks to our sponsor Drata leading security teams Trust Safebase by Drata to turn Trust into a growth engine. Their enterprise grade Trust center puts your security posture in one secure customer facing portal, giving buyers instant visibility into your company's continuous controls, certifications and policies with AI powered questionnaire assistance. Blast through inbound security questionnaires in minutes instead of days, automate cross functional workflows and eliminate friction. This means less manual work and faster deal cycles. Win with Trust. Learn more@safebase IO that is s a f e b a s e IO Cyber attacks against schools driven by a rise in student hackers, says UK agencies the United Kingdom's Information Commissioner's Office ICO warned on Thursday that student hackers motivated by dares are driving an increasing number of cyber attacks and data breaches affecting schools, end quote the agency said it identified, quote, a worrying pattern in the 215 insider threat breach reports from the education sector between January 2022 and August 2024, with 57% of incidents caused by students who are likely motivated by dares, notoriety, financial gain, revenge and rivalries. The UK's National Crime Agency believes that one out of every five children in Britain aged between 10 and 16 has in illegal activity online. The 215 breaches described by the ICO in the education sector were caused by what was described as poor data protection practices, including staff accessing data without a legitimate need, by devices being left unattended or by students being allowed to use staff devices, end quote French tech company reveals critical vulnerability CISA has issued a warning regarding the ongoing exploitation of a critical remote code execution flaw in Delmia Aprizo, which is a joint manufacturing operations, management and manufacturing execution solution from the French company Dassault, that is D A S S A U L T. The vulnerability has a CVE number and a critical severity score of 9.0. Enterprises across a wide range of industries around the world use Del Mia Aprizo to schedule production, for quality management, to allocate resources, to deal with warehouse management and for integration between production equipment and business applications. End quote FBI Issues Flash Alert Regarding Salesforce Gangs the Flash Alert is intended to disseminate indicators of compromise associated with the recent malicious cyber activities by cybercriminal groups UNC6040 and UNC6395, which are responsible for a rising number of data theft and extortion intrusions. End quote these groups have been behind the numerous Salesforce related scams that have occurred this year. The FBI quote, advises organizations to strengthen defenses against cybercriminals targeting Salesforce and other systems. Recommended measures include training call center staff to recognize phishing attempts, enforcing MFA and applying the principle of least privilege with AAA systems to limit user actions and to investigate and vet indicators prior to taking action such as blocking End quote CISA Seeks Control over CVE CISA has published a two page summary of its vision for the future of the CVE. According to Nicholas Anderson, CESA's new executive assistant director for cybersecurity, the CVE's desire, through its Board of Directors to, quote, transition to a nonprofit entity with true international coordination, rigorous and transparent governance, and multiple funding sources from public, private and nonprofit organizations end quote does not sit well with sisa, who foresees conflicts of interest with that model. This, he says, quote, reinforces the need for CISA to take a more active role in the long term stewardship of the CVE program, end quote if you have some thoughts on the news from today or about the show in general, please be sure to reach out to us@feedbackisoseries.com we would love to hear from you, Steve I'm Steve Prentiss reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.