Stoli U.S. bankrupts, German Crimenetwork seized, FBI telecom advisory

Summary

Cyber Security Headlines Summary

Podcast Title: Cyber Security Headlines
Host/Author: CISO Series
Episode Title: Stoli U.S. Bankrupts, German Criminal Network Seized, FBI Telecom Advisory
Release Date: December 4, 2024

---

1. Stoli U.S. Files for Bankruptcy Following Ransomware Attack

Timestamp: [00:00]

The episode opens with a significant development in the corporate cybersecurity landscape. Sean Kelly reports that Stoli Group's U.S. subsidiaries, Stoli USA and Kentucky Owl, have filed for bankruptcy after a severe ransomware attack in August disrupted their operations.

Key Points:

• Impact on Operations: The ransomware attack crippled the companies' IT systems, including their Enterprise Resource Planning (ERP) platform, forcing a shift to manual processes for crucial functions like accounting.
• Financial Repercussions: The disruption hindered the ability to provide financial reports to lenders, leading to claims of default on a substantial $78 million debt.

Notable Quote: Chris Caldwell, President and CEO of Stoli Group subsidiaries, stated:
"The ransomware incident severely disrupted our IT systems, forcing us to revert to manual operations and ultimately leading to our inability to meet our financial obligations."
[00:35]

---

2. Seizure of Germany’s Largest Dark Web Marketplace: Crime Network

Timestamp: [02:15]

German authorities successfully dismantled the country's largest dark web marketplace, initially known as Crime Network. Established in 2012, the platform facilitated various illicit activities, including the sale of stolen data, drugs, and services like document forging.

Key Points:

• User and Revenue Statistics: The marketplace boasted over 100,000 users and 100 registered sellers, generating approximately €73 million ($98 million) in Bitcoin and Monero since 2018.
• Financial Gains: The site earned at least €5 million through subscription and transaction fees.
• Law Enforcement Action: Authorities arrested a 29-year-old operator, known online as Techman, suspected of administering the platform for several years.

Notable Quote: A spokesperson from German authorities remarked:
"Taking down Crime Network is a significant blow to the dark web's infrastructure in Germany, disrupting numerous criminal operations that relied on this marketplace."
[03:10]

---

3. FBI Advises Telecoms to Enhance Security Amid Chinese Espionage Campaign

Timestamp: [06:45]

The FBI issued a critical advisory to telecommunication companies, urging them to strengthen their security measures in response to ongoing threats from the Chinese-backed hacking group Salt Typhoon.

Key Points:

• Targeted Entities: Notable telecom giants such as AT&T, Verizon, and Lumen Networks have been infiltrated by Salt Typhoon.
• Espionage Objectives: The attacks are part of a broader Chinese espionage effort targeting U.S. officials and systems that could identify Chinese individuals under U.S. surveillance.
• Recommended Actions: The FBI and Cybersecurity and Infrastructure Security Agency (CISA) advised deploying robust encryption and implementing centralized, consistent monitoring across telecom networks.
• International Collaboration: The guidance was issued in collaboration with security agencies from New Zealand, Australia, Canada, and the UK.

Notable Quote: An FBI official stated:
"Salt Typhoon remains a persistent threat within telecommunications infrastructures, and immediate action is required to mitigate potential espionage and surveillance risks."
[07:30]

---

4. Europol Dismantles Encrypted Chat Service “Matrix”

Timestamp: [09:20]

Europol announced the shutdown of Matrix, a sophisticated encrypted messaging service implicated in international drug and arms trafficking, as well as money laundering.

Key Points:

• Service Features: Matrix offered encrypted messaging, secure calls, video sharing, and an anonymous web browser, supported by over 40 servers primarily located in Germany and France.
• Law Enforcement Actions: Authorities dismantled the server infrastructure and arrested three individuals believed to operate the platform.
• Asset Seizures: Approximately €650,000 in cash and cryptocurrencies were seized, along with four vehicles and over 970 mobile phones.

Notable Quote: A Europol spokesperson commented:
"The takedown of Matrix disrupts a key channel used by criminals to coordinate and execute illicit activities across borders."
[10:05]

---

5. Legacy Cisco Vulnerability Actively Exploited

Timestamp: [12:00]

Cisco has alerted its customers about an actively exploited vulnerability in its Adaptive Security Appliance (ASA) WebVPN login page. The vulnerability, known since 2014, allows unauthenticated remote attackers to execute cross-site scripting (XSS) attacks.

Key Points:

• Vulnerability Details: The flaw in input validation can be exploited to inject malicious scripts, potentially compromising user sessions and data integrity.
• Current Exploitation: Cisco identified active exploitation attempts in November and urged customers to update to the latest software release as there are no available workarounds.
• Broader Implications: This incident underscores the challenges organizations face in managing and patching legacy systems amidst evolving security priorities.

Notable Quote: A Cisco representative noted:
"This longstanding vulnerability highlights the critical need for organizations to maintain up-to-date security measures and promptly address known threats."
[13:15]

---

6. FTC Bans Data Brokers Gravy Analytics and Mobile Walla

Timestamp: [15:40]

The Federal Trade Commission (FTC) has prohibited data brokers Gravy Analytics and Mobile Walla from collecting, using, and selling sensitive location data of American citizens.

Key Points:

• Violation Details: The brokers were found violating the FTC Act by aggregating and selling location data that could be used to track individuals to sensitive areas such as healthcare facilities, military bases, and religious sites.
• Data Collection Methods: Mobile Walla collected location data by bidding for personalized ads on mobile devices and retaining tracking information, while Ventel, a subsidiary, sold this data to businesses and government agencies, including the IRS, DEA, and FBI.
• Regulatory Requirements: The companies must cease selling or using sensitive location data and establish comprehensive sensitive data location programs to comply with the ban.

Notable Quote: An FTC official stated:
"Protecting sensitive location data is paramount, and data brokers must adhere to strict guidelines to ensure individuals' privacy and security are not compromised."
[17:10]

---

7. Misconfigured Web Application Firewalls Expose Security Risks

Timestamp: [19:00]

A report from Zafran reveals that nearly 40% of Fortune 100 companies utilizing Content Delivery Networks (CDNs) for Web Application Firewall (WAF) services may have misconfigurations exposing backend servers to potential attacks.

Key Points:

• Exposure Statistics: Zafran identified 2,028 domains across 135 companies with at least one backend server exposed despite WAF protection.
• Potential Threats: Exposed servers are vulnerable to denial-of-service (DoS) and ransomware attacks.
• Root Causes: Failures in following best practices, such as thorough web request validation, IP address filtering, and implementing encrypted TLS connections between CDN providers and backend servers.
• Shared Responsibility: While organizations must adhere to security protocols, CDN providers also bear responsibility for offering adequate risk mitigation measures and designing systems to prevent common misconfigurations.

Notable Quote: A Zafran researcher commented:
"Both customers and CDN providers must collaborate to ensure that WAFs are correctly configured and effective in safeguarding backend infrastructure."
[20:45]

---

8. Cyber-Unsafe Employee Practices Increase Organizational Risks

Timestamp: [23:30]

A recent study by CyberArk surveyed over 14,000 employees across various industries, revealing concerning trends in workplace cybersecurity practices.

Key Findings:

• Device Security: 80% of employees access workplace applications from personal devices lacking essential security controls.
• Privilege Mismanagement: One-third of respondents have the ability to alter sensitive data without proper controls, and approximately 30% can authorize large financial transactions independently.
• Credential Reuse: Nearly half reuse the same login credentials across multiple work applications, and 36% extend this practice to personal applications.
• Policy Bypassing: Around 65% admitted to circumventing cybersecurity policies for personal convenience.
• Risk Implications: These behaviors significantly heighten the risk of data leaks and breaches within organizations.

Notable Quote: A CyberArk analyst stated:
"Human factors remain one of the weakest links in cybersecurity, and it's imperative that organizations implement stricter controls and foster a culture of security awareness."
[25:00]

---

9. Cisco Vulnerability and Legacy Security Challenges

Timestamp: [28:15]

Expanding on earlier discussions, Sean Kelly emphasizes the ongoing issue of legacy vulnerabilities, such as Cisco's 2014 ASA WebVPN flaw, being exploited despite the passage of time. He highlights the critical need for organizations to prioritize patch management and allocate resources effectively to address such persistent threats.

---

Conclusion

The episode of Cyber Security Headlines delivered a comprehensive overview of pressing cybersecurity incidents and trends, ranging from corporate bankruptcies due to ransomware to significant law enforcement actions against dark web marketplaces. The discussions underscored the multifaceted nature of cybersecurity threats, encompassing technical vulnerabilities, regulatory challenges, and human factors. As organizations navigate this complex landscape, the insights provided emphasize the importance of robust security measures, proactive threat management, and fostering a security-conscious culture among employees.

---

For more detailed stories and daily updates, visit CISOseries.com.

Transcript

[Sean Kelly]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Wednesday, December 4, 2024. I'm Sean Kelly. Stolie files for bankruptcy in US after ransomware attack On Friday, Stulley Group's US companies filed for bankruptcy following a ransomware attack it suffered back in August. Chris Caldwell, the president and CEO of Stoli Group subsidiaries Stoli USA and Kentucky Owl, said the incident severely disrupted IT systems, including its ERP platform, and forced the company to resort to manual operations for key processes such as accounting. The incident also prevented the Stoli US Subsidiaries from providing financial reports to lenders who claimed the two companies had defaulted on a $78 million debt. Police see's largest German online Criminal Marketplace German authorities have taken down the country's largest dark web marketplace, unoriginally named Crime Network. Crime Network was established in 2012 and enabled criminals to post stolen data and sell drugs and illicit services such as document forging. The site had over 100,000 users and 100 registered sellers who raked in approximately 93 million euros, equating to $98 million. The site had over 100,000 users and one hundred registered sellers who raked in approximately 73 million euros in Bitcoin and Monero since 2018. The marketplace itself earned at least $5 million over the same period through monthly subscription and transaction fees. Police also arrested a 29 year old, known online as Techman, who was suspected as serving as Crime Network's administrator for several years. FBI advises telecoms to boost security following Chinese hacking campaign Since October, we've been covering ongoing reports that China backed hacking group Salt Typhoon was reportedly in the networks of AT&T, Verizon and Lumen, among others. These attacks are thought to be part of a broad Chinese espionage campaign targeting U.S. officials and also wiretap systems that might identify Chinese individuals under U.S. surveillance. On Tuesday, U.S. government officials warned that Salt Typhoon is still inside networks of some phone and Internet providers. Additionally, on Tuesday, the FBI and CISA issued guidance to telecommunication companies to bolster their defenses through deployment of encryption as well as centralized and consistent monitoring. The government's guidance was issued jointly with security agencies and organizations in New Zealand, Australia, Canada and Britain. Police shutter Matrix encrypted chat service. On Tuesday, Europol announced that French and Dutch law enforcement dismantled the sophisticated encrypted messaging service linked to international drug and arms trafficking and money laundering, authorities said. Matrix has its own operating system and various apps for encrypted messaging, secure calls, video and voice sharing, and anonymous web browser. Its infrastructure consisted of more than 40 servers across several countries, with the majority based in Germany and France. Law enforcement dismantled those servers and announced the arrest of three suspects who allegedly operated the platform. Police also seized roughly €650,000 in cash and cryptocurrencies, confiscated four vehicles and more than 970 mobile phones and now we'd like to thank today's episode sponsor Vanta. As third party breaches continue to rise, companies are increasingly vigilant, which means more time spent on manual security reviews. With Vanta questionnaire automation, security and compliance teams can complete security reviews up to five times faster, giving you time back to focus on running your security and compliance programs. Over 8,000 global companies like Zoom Info, Smart Recruiters and Noibu use Vanta to save time on security reviews. Visit Vanta.com to learn more about Questionnaire automation. That's v A n decade old Cisco Vulnerability under Active Exploit Cisco is warning customers that an input validation vulnerability in its Adaptive Security Appliance or ASA WebVPN login page is now actively being exploited by threat actors. Cisco documented the bug back in 2014 and exploitation could allow an unauthenticated remote attacker to launch cross site scripting attacks. Cisco discovered exploitation attempts in November and said customers should upgrade to a fixed software release. The company added that there are no workarounds for the issue. This issue highlights how implementing legacy security fixes can get lost in the sea of security priorities that organizations are facing. 2. Data brokers banned by the FTC the Federal Trade Commission announced Tuesday that it's banning data brokers Gravy analytics and Mobile Walla from collecting, using and selling sensitive location data of Americans. The agency alleged the brokers violated the FTC act by collecting and selling information that could be used to track people to healthcare facilities, military bases, religious sites, labor union gatherings and other sensitive locations. The FTC says mobilewalla collected info by bidding to show people personalized ads on their mobile devices and then retaining tracking info identifying them. Mobilewalla's subsidiary Ventel, collected location data from otherwise ordinary mobile apps, then sold data to other businesses and government agencies and including the IRS, DEA and FBI. The companies must comply with the FDC's ban by never selling, disclosing or using sensitive location data in any product or service, and must establish a sensitive data location program. Misconfigured WAFs heighten security risks According to a report From Zafran, nearly 40% of Fortune 100 companies leveraging their content delivery network providers for web application firewall services may be exposing backend servers refers to attacks. WAFs act as intermediaries between users and web applications, inspecting traffic for an array of threats and blocking malicious activity. In total, Zafran found 2028 domains belonging to 135 companies, exposing at least one supposedly WAF protected server. This means attackers could access the servers over the Internet to launch attacks like denial of service and ransomware. The researchers explained that the issues stem from organizations not following best practices, including adequately validating web requests to back end origin servers, filtering IP addresses, and establishing encrypted TLS connections between the CDN provider and their servers. While some responsibility does lie with customers, the researchers said, quote, CDN providers who offer WAF services share some responsibility as well for failing to offer customers proper risk avoidance measures and for not building their networks and services to circumvent many misconfigurations in the first place. Cyber unsafe employees increasingly put their orgs at risk A new study from CyberArk surveyed more than 14,000 employees across a variety of industries and shows that 80% of respondents access workplace applications from personal devices that lack key security controls. Additionally, the study found that privileged access often extends beyond IT admins. One third of respondents are able to alter sensitive data without controls, and roughly 30% can approve large financial transactions on their own. Nearly half of respondents admitted to reusing the same login credentials for multiple work applications, while 36% used the same credentials for both work and personal applications. Finally, about 65% admitted to bypassing cybersecurity policies for personal ease. All these practices heighten the risk of organizations falling victims to leaks and other data breaches. And that does it for today's cybersecurity headlines. But don't forget to register for our great slate of live stream events happening this Friday, December 6, starting at 1pm Eastern, 10am Pacific with Super Cyber Friday, we'll be talking about hacking the AI supply chain. An hour of critical thinking about what's new and familiar about securing the foundations of your AI applications. Then later on Friday at 3:30pm Eastern, 12:30 Pacific, we'll be running down the top cyber news stories of the week. During our Week in Review show, we'll be getting expert insights from our guest, Edward Fry, Head of Security at Luminary Cloud. While you're with us, don't forget to drop your own hot takes and questions into our lively chat. Just head on over to csoseries.com and click on Events to Register. Thank you for listening to the podcast that brings you more of the top cyber news stories and more cowbell. I'm Sean Kelly, Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.