T-Mobile confirms breach, AnnieMac data stolen, NewGlove malware threat

Summary

Cyber Security Headlines Summary
Episode: T-Mobile Confirms Breach, AnnieMac Data Stolen, NewGlove Malware Threat
Host: Steve Prentice
Release Date: November 18, 2024

---

1. T-Mobile Confirms Telecom Breach

In today's episode, Steve Prentice opens by addressing the confirmed breach at T-Mobile. He reports that T-Mobile has officially acknowledged a cyberattack carried out by Chinese threat actors, aligning with a broader wave of telecom breaches recently observed.

Key Points:

• The breach is part of a large-scale attack targeting individuals involved in government or political activities.
• According to the Wall Street Journal, T-Mobile stated that "its systems and data have not been impacted in any significant way and they have no evidence of impacts to customer information" (00:30).
• There are reports suggesting that the attackers exploited vulnerabilities in Cisco routers, which are critical for routing internet traffic. However, Cisco has dismissed these claims, asserting, "there were no indications that their equipment was breached during these attacks" (01:00).

Implications: This incident underscores the persistent threats posed by state-sponsored actors and highlights the importance of securing critical network infrastructure to prevent unauthorized access.

---

2. AnnieMac Data Stolen

Steve Prentice then shifts focus to the data breach at Annie Mac, formally known as the American Neighborhood Mortgage Acceptance Company.

Key Points:

• Between August 21st and 23rd, an "unknown intruder viewed and/or copied some customer data," including names and Social Security numbers (02:15).
• Representatives from Annie Mac have reported that, to date, there is "no evidence to suggest that data has been abused on the dark Web" (02:45).

Implications: While the immediate risk of data misuse appears low, the exposure of sensitive personal information such as Social Security numbers remains a significant concern for affected individuals and emphasizes the need for robust data protection measures.

---

3. NewGlove Infostealer Malware Bypasses Chrome’s Cookie Encryption

The discussion moves to the emergence of a new malware threat known as "NewGlove," identified by researchers at Gen Digital.

Key Points:

• NewGlove is a stealer malware capable of bypassing Google Chrome’s application-bound encryption to extract browser cookies (03:30).
• Described as "relatively simple and containing minimal obfuscation or protection mechanisms," indicating it is likely in early development stages (04:00).
• The malware employs a common social engineering tactic, tricking victims into installing it via fake error windows displayed within HTML files attached to phishing emails (04:30).

Implications: The simplicity of NewGlove suggests that it may be accessible to less skilled attackers, potentially increasing its prevalence. Organizations should enhance their phishing defenses and educate users about recognizing deceptive emails to mitigate this threat.

---

4. NSO Group Continues to Exploit WhatsApp Post-Lawsuit

Steve Prentice highlights ongoing activities of the NSO Group despite legal challenges.

Key Points:

• A recent court filing from the Northern District of California’s Oakland Division reveals that NSO Group continued to develop and deploy additional malware targeting WhatsApp even after being sued by the platform (05:15).
• Despite WhatsApp's efforts to disable known exploits in May 2019, NSO Group "then developed a new malware vector that continued using WhatsApp as an installation vector through at least May 2020," the filing states (05:45).
• This behavior contradicts NSO Group's previous assertions that its customers had control over how the spyware was used (06:15).

Implications: The persistent exploitation of WhatsApp by NSO Group underscores the challenges in regulating and controlling sophisticated spyware vendors. It also raises concerns about the security of messaging platforms against state-sponsored surveillance.

---

5. New Windows Zero-Day Activated by Mouse Clicks

A recent vulnerability in Microsoft Windows has been addressed, with details provided by Clear Sky researchers.

Key Points:

• The flaw, assigned a CVE number, is classified as medium severity and has been patched by Microsoft (07:00).
• Exploitation requires minimal user interaction, such as deleting or right-clicking a file, to trigger the vulnerability (07:30).
• The vulnerability affects the MSHTM engine used by the Edge browser in Internet Explorer mode, enabling threat actors to perform pass-the-hash attacks and authenticate as the targeted user (08:00).
• Microsoft's advisory from November 12th warns that even actions like selecting or inspecting a file, without executing it, could activate the vulnerability (08:30).

Implications: This zero-day vulnerability highlights the importance of regular software updates and cautious user behavior when interacting with files, even seemingly harmless actions like right-clicking.

---

6. Twitch Faces Data Breach Fine in Turkey

Steve Prentice discusses the data breach incident involving Twitch, as investigated by Turkey's Personal Data Protection Board.

Key Points:

• An investigation revealed a 125-gigabyte data leak affecting over 35,000 individuals in Turkey (09:00).
• The board criticized Twitch for inadequate security measures and insufficient risk and threat assessments prior to the breach (09:30).
• Twitch has been fined 1.75 million lira for inadequate security and an additional 250,000 lira for failing to report the breach promptly, totaling roughly US$58,000 (10:00).
• As of the episode's release, Twitch, owned by Amazon, has not issued any comment on the matter (10:30).

Implications: This incident serves as a cautionary tale for online platforms about the necessity of proactive security protocols and timely breach reporting to regulatory bodies to avoid substantial fines and reputational damage.

---

7. Deep Data Steals VPN Credentials Through Unpatched Fortinet Flaw

The episode covers a sophisticated malware campaign targeting VPN credentials via Fortinet vulnerabilities.

Key Points:

• The threat actor, known as Brazen Bamboo, exploits an unresolved flaw in Fortinet’s Windows clients to extract VPN credentials (11:00).
• Initially discovered by BlackBerry, the exploitation involves the Windows-based surveillance framework LightSpy, which targets various chat applications, including WhatsApp, Telegram, Signal, WeChat, Skype, and Microsoft Outlook (11:30).
• Since developing LightSpy in 2022, Brazen Bamboo has focused on stealth and persistent access, strategically targeting communication platforms to harvest data (12:00).

Implications: The exploitation of VPN credentials can grant attackers extensive access to secure networks, emphasizing the critical need for timely patching of known vulnerabilities and continuous monitoring of VPN infrastructure.

---

8. Google’s Predictions on Biggest Security Threats Facing Businesses in 2025

Concluding the episode, Steve Prentice relays Google’s Cybersecurity Forecast for 2025, highlighting emerging threats businesses should prepare for.

Key Predictions:

• AI-Driven Attacks: The use of artificial intelligence for phishing, vishing, social engineering, and creating deepfakes aimed at identity theft and fraud is expected to rise (13:00).
• Information Operations: AI will be leveraged to generate persuasive malicious content for nefarious purposes (13:30).
• Increased Activity from Nation-States: Russia, China, Iran, and North Korea are projected to escalate their cyber activities (14:00).
• Ransomware and Multifaceted Extortion: These will continue to be among the most disruptive forms of cybercrime (14:30).
• Stealer Malware Accessibility: Lower barriers to entry for less skilled actors, combined with compromised identities and reduced time to exploit vulnerabilities, will make stealer malware more prevalent (15:00).

Implications: Businesses must anticipate and adapt to these evolving threats by investing in advanced security measures, employee training, and robust incident response strategies to mitigate potential risks in the coming year.

---

Conclusion

Steve Prentice wraps up the episode by reinforcing the importance of staying informed about the latest cybersecurity threats and trends. He encourages listeners to visit CISOseries.com for in-depth stories behind these headlines and to participate in upcoming discussions, such as the Super Cyber Friday event focused on hacking and e-crime trends.

---

Notable Quotes:

• Steve Prentice (00:30): "T-Mobile has now confirmed that it was hacked as part of the wave of telecom breaches conducted by Chinese threat actors."

• ANIMAC Representative (02:45): "Currently, we have no evidence to suggest that data has been abused on the dark Web."

• Microsoft Advisory (08:30): "Minimal interaction with a malicious file could trigger this vulnerability."

---

This comprehensive summary encapsulates the key discussions and insights from the Cyber Security Headlines podcast episode, providing a valuable overview for listeners and those unable to tune in.

Transcript

[Steve Prentice]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, November 18, 2024. I'm Steve Prentice. T Mobile Confirms Telecom Breach Hack T Mobile has now confirmed that it was hacked as part of the wave of telecom breaches that were conducted by Chinese threat actors, as we reported on Friday and earlier. According to the Wall Street Journal, the company says its systems and data have not been impacted in any significant way and they have no evidence of impacts to customer information. This hack was part of a large scale attack performed by China linked threat actors targeting individuals who are primarily involved in government or political activity. One report suggests the attacks came through vulnerabilities in Cisco routers responsible for routing Internet traffic, but Cisco has previously stated there were no indications that their equipment was breached due during these attacks. Customer data stolen from Annie Mac the American Neighborhood Mortgage Acceptance Company better known as Annie Mac has revealed that between August 21st and 23rd, an unknown intruder viewed and or copied in quote, some customer data. This data includes names and Social Security numbers. Representatives from ANIMAC have stated it currently has no evidence to suggest that data has been abused on the dark Web. New Glove infostealer malware bypasses Chrome's cookie encryption Researchers at security firm Gen Digital have identified a new stealer malware that can bypass Google Chrome's application bound encryption to steal browser cookies. The researchers call this malware relatively simple and containing minimal obfuscation or protection mechanisms, which suggests that it likely is still in early development stages. The new glove infostealer uses a common social engineering technique where potential victims get tricked into installing malware using fake error windows displayed within HTML files attached to the phishing emails. NSO Group continued to exploit WhatsApp even after lawsuit A recent court filing from the Northern District of California Oakland Division shows that Israel based NSO Group developed additional malware to use WhatsApp to infect victims even after WhatsApp had sued this leading spyware vendor over allegations that it violated federal and state anti hacking laws after Having detected NSO Group's malicious messages in May 2019, WhatsApp, owned by Meta, made changes to disable the exploit, but NSO Group quote, then developed a new malware vector that continued using WhatsApp as an installation vector through at least May 2020, end quote the filing also suggests that NSO Group continue to operate its spyware, contradicting past claims from the firm that its customers chose how to use it. Thanks to today's episode's sponsor, ThreatLocker, do zero day exploits and supply chain attacks keep you up at night. Well, worry no more. You can harden your security with ThreatLocker. ThreatLocker helps you take a proactive default deny approach to cybersecurity and provides a full audit of every action allowed or blocked for risk management and compliance. Onboarding and operation are fully supported by their US based support team. To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit threatlocker.com that is T H R E A T L O c k e r.com New Windows Zero day activated by mouse clicks this is a medium severity flaw with a CVE number and which has been recently patched by Microsoft, according to researchers at Clear Sky. It can be exploited with minimal interaction from the user such as deleting a file or right clicking on it. The exploit affects the MSHTM engine, which is used through web browser controlled by Edge in Internet Explorer mode. It allows threat actors to authenticate as the targeted user by performing pass the hash attacks. An advisory From Microsoft published November 12th states that minimal interaction with a malicious file by a user, such as selecting, inspecting, right click or performing an action other than opening or executing could trigger this vulnerability. Turkey finds Twitch for data breach this action comes from Turkey's Personal Data Protection Board, who launched an investigation after 125 gigabyte data leaks. The board found that Twitch had failed to take adequate security measures beforehand, addressing the issue only afterward. It also said risk and threat assessments had been insufficient. The breach in question affected over 35,000 individuals in Turkey, and the Data Protection board imposed a 1.75 million lira fine for inadequate security and a 250,000 lira fine for failing to report the breach, all of which converts to about US$58,000. Twitch, owned by Amazon, has not yet issued any comment. Deep data steals VPN credentials through unpatched Fortinet flaw and reveals significant persistence this malware comes courtesy of a threat actor known as Brazen Bamboo, who, according to a report from Velexity posted on Friday, is exploiting an unresolved security flaw in Fortinet's 40 clients for Windows. The goal is to extract VPN credentials. This was actually discovered earlier last week by BlackBerry, who detailed the Windows based surveillance framework as used by the China linked threat actor to harvest data from a range of chat apps including WhatsApp, Telegram Signal, WeChat, Skype and Microsoft Outlook, the BlackBerry threat researchers added in their report. Since their initial development of the LightSpy spyware implant in 2022. This attacker has been persist and methodically working on the strategic targeting of communication platforms with the emphasis on stealth and persistent access Google offers predictions on biggest Security Threats facing businesses in 2025 this is the time of year when everyone in the cybersecurity business offers their predictions for the new year. Google is early out of the gate with its Cybersecurity Forecast 2025 on its naughty list this year. In brief the use of AI for phishing, vishing, social engineering and deepfakes for identity theft fraud and for bypassing security measures AI for information operations, meaning the creation of persuasive content for nefarious purposes increased activity from the Big four Russia, China, Iran and North Korea ransomware and multifaceted extortion as the most disruptive form of cybercrime More info Stealer malware lower barriers to entry for less skilled actors, compromised identities and decreased time to exploit vulnerabilities. A link to this report is available in the show. Notes to this episode Remember to mark your calendar for this week's Super Cyber Friday discussion. This Friday we are going to spend an hour talking about hacking e crime trends. We talk a lot about individual attacks and vectors on this show, but on Super Cyber Friday we'll be taking a broader look to see if that can help in inform your security program. Head on over to our events [e-mail] to register to join us this Friday at 1:00pm Eastern, 10:00am Pacific. I'm Steve Prentice reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to csoseries.com for the full stories behind the headlines.