Urgent iOS update, CISA officials on administrative leave, newspaper operations impacted

Summary

Cyber Security Headlines Summary Hosted by Lauren Verno, CISO Series
Release Date: February 11, 2025

---

1. Urgent iOS Update Fixes Critical USB Security Flaw

Timestamp: [00:00]

Lauren Verno opens the episode discussing a pressing update from Apple. On February 11, 2025, Apple released an urgent patch addressing a zero-day vulnerability identified in iOS and iPadOS version 4.2.18. This flaw allowed attackers to disable USB restricted mode, a security feature that prevents unauthorized forensic data extraction from devices.

Key Points:

• Vulnerability Details: The USB restricted mode bypass was due to an authorization issue within Apple's OS logic, making even recently updated devices susceptible.
• Impact: Disabling this mode exposed devices to potential data extraction, undermining the security measures intended to protect user data.
• Origin of the Flaw: Discovered by Citizens Lab, the flaw was reportedly exploited in highly sophisticated attacks, likely orchestrated for nation-state surveillance endeavors.

Notable Quote: Lauren Verno states, “An extremely sophisticated attack likely for nation-state surveillance was responsible for exploiting this flaw” ([00:00]).

---

2. CISA Officials Placed on Administrative Leave

Timestamp: [02:15]

The podcast transitions to a developing story involving the Cybersecurity and Infrastructure Security Agency (CISA). Several members of CISA’s election security team have been placed on administrative leave, particularly those focused on combating misinformation and disinformation.

Key Points:

• Reason for Administrative Leave: The move appears to be a response to pressure from the Trump administration to reduce CISA’s involvement in countering election-related falsehoods.
• Implications: This reduction in focus could severely impact smaller jurisdictions, as former election security lead Kim Wyman warns that these areas might become more susceptible to misinformation campaigns.
• CISA’s Role: Historically, CISA has played a crucial role in safeguarding elections from foreign interference and supporting local election officials.

Notable Quote: Kim Wyman warns, “Shutting down these efforts will hit citizen smaller jurisdictions the hardest, leaving them more vulnerable to misinformation” ([02:15]).

---

3. Cyberattack Disrupts Operations of Newspaper Giant Lee Enterprises

Timestamp: [04:45]

Lee Enterprises, one of the largest newspaper groups in the United States with a daily circulation exceeding 1.2 million and a digital reach of 44 million, confirmed experiencing a significant cyberattack on February 3rd.

Key Points:

• Impact of the Attack: The cyberattack caused extensive outages, disrupting both printing and delivery operations. Journalists were unable to access essential files, and VPNs were rendered non-functional.
• Data Compromise: While Lee Enterprises has not yet confirmed if any data was breached, the company cautions that the investigation is ongoing and may take several weeks.
• Historical Context: This incident marks Lee Enterprises' second major cyberattack in recent years, following a 2020 breach attributed to Iranian hackers.

Notable Quote: According to Believing Computer, the attack resulted in “chaos across the printing group, with VPNs not working and journalists unable to access files” ([04:45]).

---

4. UK Military Streamlines Cyber Recruits Training

Timestamp: [07:30]

Addressing the global cybersecurity skills shortage, the UK's Ministry of Defence (MOD) has announced a significant overhaul in its recruitment and training process for cyber specialists.

Key Points:

• Training Adjustment: The basic training duration has been halved from 10 weeks to four weeks, followed by an intensive three-month cyberspecialist training program.
• Incentives for Recruits: Successful candidates will receive a starting salary that surpasses that of other military recruits. They will be assigned roles focused on securing military networks or conducting cyber operations as part of the National Cyber Force.
• Future Plans: The MOD plans to expand this initiative by 2026 to further address the growing demand for cybersecurity expertise.
• Rationale: The MOD has reported facing over 90,000 sub-threshold cyberattacks in the past two years, underscoring the urgent need for skilled cyber professionals.

Notable Quote: Verno explains, “The initiative aims to address a critical skill shortage as the MOD says it has faced more than 90,000 sub-threshold attacks in the past two years” ([07:30]).

---

5. Global Operation Dismantles Phobos Ransomware Gang

Timestamp: [10:20]

A coordinated international law enforcement effort has successfully disrupted the Phobos ransomware group, resulting in the arrest of four European suspects in Thailand and the shutdown of eight dark web sites associated with the gang.

Key Points:

• Financial Extortion: Phobos hackers extorted approximately $16 million in Bitcoin from over 1,000 victims, including at least 17 Swiss companies.
• Methodology: Authorities conducted synchronized raids across multiple countries, seizing laptops, cryptocurrency wallets, and other critical evidence.
• Extradition Efforts: Swiss officials are actively seeking the extradition of key members linked to high-profile attacks on organizations such as the United Nations Development Program and Japanese tech giant NYDIC Corp.

Notable Quote: The operation led to the “arrest of four European suspects and the takedown of eight dark web sites” ([10:20]).

---

6. US Hacker Sentenced for $37 Million Crypto Theft

Timestamp: [13:00]

Indiana resident Evan Light has been sentenced to 20 years in federal prison for his role in a massive cryptocurrency theft scheme.

Key Points:

• Criminal Activities: Light hacked into an investment holdings company’s servers, exploiting a stolen identity to access data from hundreds of clients. This breach allowed him to drain 571 accounts and launder funds through mixing services and gambling websites.
• Financial Impact: Prosecutors revealed that Light stole over $37 million in cryptocurrency during this incident alone, adding to millions previously stolen, bringing the total to approximately $80 million.
• Charges and Sentencing: Light faces significant prison time due to the scale and sophistication of his operations.

Notable Quote: Prosecutors highlighted that Light “accessed client data of hundreds of other clients, which he then used to drain 571 accounts and laundered the funds” ([13:00]).

---

7. Hacker Pleads Guilty for SEC's X Account Breach

Timestamp: [15:50]

An Alabama man has pleaded guilty to orchestrating a SIM swapping attack that compromised the Securities and Exchange Commission’s (SEC) X account.

Key Points:

• Attack Mechanics: The perpetrator, Air Council, used a fraudulent ID to hijack the SEC’s phone number, allowing him to reset the X account password. This breach enabled his co-conspirators to control the account.
• Impact on Markets: The impersonation led to a fake Bitcoin ETF approval post, briefly causing Bitcoin prices to surge.
• Legal Consequences: In exchange for his confession, Council faces up to five years in prison, with sentencing scheduled for May.

Notable Quote: Verno summarizes, “Air Council used a fraudulent ID to take over the SEC's phone number, reset the X account password, and grant access to co-conspirators” ([15:50]).

---

8. Georgia Hospital Hit by Ransomware Attack

Timestamp: [18:30]

Memorial Hospital and Manor, a rural medical facility in Bainbridge, Georgia, has reported a severe ransomware attack that compromised the personal and health information of 120,000 individuals.

Key Points:

• Data Breach Details: The ransomware group known as Embargo Ransomer claimed responsibility, stating they stole 1.15 terabytes of data, including Social Security numbers, medical records, and insurance details. Some of this data has been made publicly available.
• Community Impact: For context, Bainbridge’s population was just over 14,000 according to the 2023 census, highlighting the extensive reach of the breach.
• Company Response: Memorial Hospital and Manor are offering a year of free identity protection to affected individuals and report no evidence of data misuse at this time.

Notable Quote: The hospital conveyed, “There's no evidence of misuse of the data at this time” ([18:30]).

---

Conclusion

Lauren Verno wraps up the episode by emphasizing the critical nature of staying informed on emerging cybersecurity threats and developments. She encourages listeners to visit CISOseries.com for detailed stories and insights behind each headline.

---

Note: This summary encapsulates the key discussions and insights from the "Cyber Security Headlines" podcast episode released on February 11, 2025. For a more comprehensive understanding, listeners are encouraged to refer to the full episode available through the CISO Series platform.

Transcript

[Lauren Verno]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Tuesday, February 11, 2025. I'm Lauren Verno. Urgent iOS update fixes critical USB security Flaw Even if you just updated your Apple phone to the latest version, go ahead and do it again. On Monday, Apple released an urgent patch for a zero day vulnerability in iOS and iPad OS 4-2-18 that allowed attackers to disable USB restricted mode unlocked devices now discovered by Citizens Lab. The flaw was used in a quote, extremely sophisticated attack likely for nation state surveillance. USB restricted mode introduced to block forensic tools from extracting data, could be bypassed due to an authorization issue in Apple's OS logic. CISA officials placed on administrative leave now this is a developing story. Several members of CISA's election security team were placed on administrative leave late last week, primarily those working on misinformation and disinformation efforts. That's according to cyberscoop. The move follows the Trump administration's pressure to scale back CISA's role in countering election related falsehoods, despite the agency's past efforts to combat foreign influence and assist local election officials. Former election security lead Kim Wyman warns that shutting down these efforts will hit citizen smaller jurisdictions the hardest, leaving them more vulnerable to misinformation. As of this recording, CISA has not responded to CyberScoop's request for comment. Cyberattack disrupts newspaper giants operations Extra, extra. Read all about it. Lee Enterprises, one of the largest newspaper groups in the US with a daily circulation of over 1.2 million and a digital reach of 44 million, confirmed a cyber attack on February 3rd that caused widespread outages and disrupted operations including printing and delivery. The company has not yet determined if any data was compromised, but warned that the ongoing investigation could take weeks. According to Believing Computer, the attack caused, quote, chaos across the printing group, with VPNs not working and journalists unable to access files. This marks the second major cyber incident for Lee Enterprises in recent years, following a 2020 breach linked to Iranian hackers. UK military drops basic training requirements for cyber recruits In a move to fill a growing need, the UK's Ministry of Defence is fast tracking cyberspecialists by cutting basic training from 10 weeks to four, followed by three months of cyberspecialist training. As an added bonus, successful applicants will earn a starting salary far higher than their fellow recruits and will either work on securing military networks or or conducting cyber operations against adversaries as a part of the National Cyber Force. Now with plans to expand in 2026. The initiative aims to address a critical skill shortage as the MOD says it has faced more than 90,000 sub threshold attacks in the past two years, thanks to today's episode sponsor Vanta. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs we rely on point in time checks. But more than 9,000 companies have continuous visibility into their controls with Vanta. Vanta brings automation to evidence collection across over 35 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get started at vanta.com/headlines that's V A N T A dot com slash headlines Global Sting takes down Phobos ransomware hackers A global law enforcement operation targeting the Phobos ransomware gang has led to the arrest of four four European suspects in Thailand and the takedown of eight bases dark web sites. The hackers allegedly extorted 16 million in Bitcoin from over 1000 victims, including at least 17 Swiss companies. Authorities across multiple countries Coordinated raids seizing laptops, cryptocurrency wallets and other evidence. Swiss officials sought extradition for the high profile ransomware group linked to attacks on organizations like the United Nations Development Program and Japanese tech giant NYDIC Corp. US hacker sentence for 37 million in crypto theft at just 22 years old, Indiana resident Evan Light was sentenced to 20 years in federal prison for hacking an Investment holdings company servers and stealing over 37 million in cryptocurrency. Using a stolen identity of an invested holdings client, Light accessed client data of hundreds of other clients, which he then used to drain 571 accounts and laundered the funds through mixing services and gambling sites. Prosecutors say he previously stole millions more, bringing the total amount stolen to to a whopping $80 million. Hacker behind SCC X account breach pleads guilty Speaking of crypto scams, an Alabama man has pleaded guilty to hijacking the SEC's X account in a January 2024 SIM swapping attack, enabling a fake Bitcoin ETF approval post that briefly sent Bitcoin's prices soaring. The man behind the attack, Air Council, used a fraudulent ID to take over the SEC's phone number, reset the X account password and grant access to co conspirators who paid him $50,000 in Bitcoin he now faces up to five years in prison, with sentencing set for May. Georgia Hospital hit by ransomware Memorial Hospital and Manor, a small rural hospital in Bainbridge, Georgia, is notifying 120,000 individuals that their personal and health information was stolen in a November 2024 ransomware attack, with leaked data now publicly available. To put this into perspective, a 2023 census estimated that the city of Bainbridge had just over 14,000 residents. The embargo Ransomer gang claimed responsibility, saying it stole 1.15 terabytes of data, including Social Security numbers, medical records and insurance details. The hospital is offering a year of free identity protection, but but says there's no evidence of misuse of the data at this time. Buzzwords might have value in cybersecurity marketing, but they don't do anything to help translate cybersecurity concepts to the business. So how can CISOs build a better lexicon that can connect with other leaders in an organization? That's one of the things we're breaking down this week on the CISO Series podcast. Look for the episode titled Zero Trust Purple Team DevSecOps Mesh A CASB Journey through the Identity Fabric. Wherever you get your podcast, I'm Lauren Verno reporting for the CISO Series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines. Don't.