VPN brute-force attacks, water utilities bill, LockBit developer extradited

Summary

Cyber Security Headlines - Episode Summary Hosted by CISO Series | Release Date: March 17, 2025

In this episode of Cyber Security Headlines, host Steve Prentiss delves into the latest developments in the world of information security. Covering a range of critical topics from sophisticated cyber attacks to legislative efforts enhancing cybersecurity infrastructure, this episode provides an in-depth analysis of the current cybersecurity landscape. Below is a detailed summary of the key discussions, insights, and conclusions presented.

---

1. Black Basta's Automated VPN Brute-Force Tool: Bruted B R U T E D

Timestamp: [00:00]

Steve Prentiss opens the episode by addressing the emergence of a new automated brute-force framework named Bruted B R U T E D, developed by the ransomware group Black Basta. Discovered by a researcher from Eclecticiq, a threat intelligence platform provider, this tool specifically targets edge networking devices such as firewalls and VPNs.

Key Points:

• Targeted Technologies: The tool is designed to breach devices from prominent vendors including SonicWall, Palo Alto Networks, Cisco, Fortinet, Citrix, Microsoft, and WatchGuard.
• Operational Timeline: Evidence from Black Basta’s leaked internal chat logs indicates the tool has been in use since at least 2023.

Notable Quote:

"Black Basta has been operating with this tool for over two years, demonstrating their commitment to compromising critical network infrastructure." – Steve Prentiss [00:45]

Implications: The deployment of Bruted B R U T E D underscores the escalating sophistication of ransomware groups in automating attacks against vital network components, posing significant risks to organizational security.

---

2. Bipartisan Senate Bill Enhances Cybersecurity for Water Utilities

Timestamp: [02:30]

Prentiss discusses the reintroduction of the Cybersecurity for Rural Water Systems Act by Senators Catherine Cortez Masto (Nevada) and Mike Rounds (South Dakota). This bipartisan initiative aims to bolster the cybersecurity measures of water and wastewater systems across the United States.

Key Points:

• Program Expansion: The bill seeks to update and expand the Department of Agriculture's Circuit Rider program, which provides technical assistance to rural water systems.
• Current Vulnerability: A press release highlights that only 20% of U.S. water and wastewater systems have basic cyber protections in place.

Notable Quote:

"Ensuring that our water systems are secure is not just about protection—it's about safeguarding public health and safety." – Steve Prentiss [03:15]

Implications: By enhancing support and resources for rural water utilities, the legislation aims to mitigate risks associated with cyber threats, thereby protecting essential services from potential disruptions.

---

3. Extradition of LockBit Developer Rostislav Panev to the U.S.

Timestamp: [04:50]

The episode covers the extradition of Rostislav Panev, allegedly the developer of the LockBit ransomware, from Israel to the United States. Panev now faces 40 charges related to multiple LockBit ransomware attacks.

Key Points:

• Charges: Panev is accused of deploying ransomware attacks that have affected numerous organizations, including possession of credentials for the LockBit developer repository.
• Connection to Other Criminals: He reportedly sent direct messages to Dmitry Yurovich Koroshev, the suspected primary administrator of LockBit, who remains at large.

Notable Quote:

"Panev's capture and extradition mark a significant step in the fight against ransomware networks operating across borders." – Steve Prentiss [05:30]

Implications: This development signifies ongoing efforts by international law enforcement to dismantle ransomware operations by targeting key developers and leaders within these criminal enterprises.

---

4. Microsoft’s Recent Windows Update Causes USB Printers to Print Random Text

Timestamp: [07:20]

Prentiss addresses a recent issue stemming from Windows updates that affect dual-mode printers supporting both USB print and IPP over USB protocols. This problem impacts users of Windows 10 and 11, excluding the latest Windows 11 24H2 version.

Key Points:

• Issue Description: Users may experience printers outputting random text, data, and unusual characters unexpectedly.
• Resolution: Microsoft has provided a rollback fix for this known issue and plans to address it in a future update.

Notable Quote:

"While seemingly minor, such glitches can disrupt business operations and highlight the complexities of ensuring seamless hardware-software integration." – Steve Prentiss [08:05]

Implications: This incident underscores the importance of rigorous testing in software updates, especially concerning hardware compatibility, to prevent inadvertent disruptions in users' daily operations.

---

5. Malicious PYPI Packages Exploiting Cloud Tokens

Timestamp: [09:40]

The conversation shifts to a concerning trend identified by researchers at Reversing Labs, who have uncovered a campaign targeting users of the Python Package Index (PYPI) repository with malicious packages designed to steal cloud access tokens.

Key Points:

• Package Characteristics: Approximately half of the malicious packages include the word "TIME" in their titles (e.g., Time Check Server), while others incorporate "client" to mimic legitimate cloud client functionalities.
• Targeted Services: The packages aim to compromise credentials for services like Alibaba Cloud, Amazon Web Services, and Tencent Cloud.
• Download Metrics: These packages have been downloaded over 14,000 times, indicating a significant reach.

Notable Quote:

"Cybercriminals are increasingly leveraging trusted repositories like PYPI to distribute malware, making vigilance more crucial than ever for developers." – Steve Prentiss [10:15]

Implications: The exploitation of PYPI highlights the vulnerability of widely-used development platforms to malicious actors, emphasizing the need for enhanced package verification and monitoring mechanisms.

---

6. Sentence Upheld for Former Uber Cyber Executive Joe Sullivan

Timestamp: [12:10]

Prentiss touches on the legal proceedings involving Joe Sullivan, the former Chief Security Officer of Uber, who was convicted of obstruction of justice in 2023. Sullivan is appealing his sentence, which was upheld by a U.S. federal judge.

Key Points:

• Charges: Sullivan faces 40 charges related to the LockBit ransomware attacks, including obstruction of justice for attempting to cover up a 2016 security incident at Uber.
• Defense Arguments: Sullivan contends that the district court erred in rejecting his proposed jury instructions and in accepting a guilty plea from an alleged hacker involved in the case.

Notable Quote:

"The court's decision underscores the judiciary's stance on holding cybersecurity executives accountable for mishandling security breaches." – Steve Prentiss [13:00]

Implications: This case serves as a precedent for the accountability of cybersecurity professionals and leaders in managing and reporting security incidents within their organizations.

---

7. Denmark Issues Warning on European Telecom Cyber Threats

Timestamp: [14:25]

The episode highlights a threat assessment released by the Cybersecurity Agency of Denmark, which warns of increased state-sponsored cyber espionage targeting Europe's telecommunications sector.

Key Points:

• Target Focus: The telecommunications sector remains a prime target for espionage activities, with no specific attribution to groups like Salt Typhoon in Europe.
• Government Response: Denmark expresses concern that European governments may lack the political will to publicly attribute these cyber threats, even if actors like China are identified.

Notable Quote:

"The silent nature of these cyber espionage activities poses a unique challenge, as public attribution requires substantial evidence and political consensus." – Steve Prentiss [15:00]

Implications: The warning emphasizes the persistent threats faced by critical infrastructure sectors in Europe and the complexities involved in addressing and publicly attributing state-sponsored cyber activities.

---

8. Yap Island Suffers Ransomware Attack Highlighting Global Cybercrime Reach

Timestamp: [16:40]

Prentiss concludes the episode with a report on a ransomware attack against Yap, a small island nation in the Federated States of Micronesia. The attack forced the shutdown of all computers in Yap’s government health agency, disrupting health services.

Key Points:

• Attack Impact: Occurred on March 11, affecting government health systems and slowing down service delivery due to the shutdown of computer networks.
• Geographical Significance: Yap’s remote location underscores that no region, regardless of size or isolation, is immune to cybercrime threats.

Notable Quote:

"The attack on Yap serves as a stark reminder that cyber threats are a universal challenge, transcending geographical and infrastructural boundaries." – Steve Prentiss [17:25]

Implications: This incident highlights the necessity for robust cybersecurity measures even in smaller, seemingly less targeted regions, as cybercriminals continuously expand their reach globally.

---

Conclusion

Steve Prentiss wraps up the episode by reiterating the importance of staying informed about the evolving cyber threat landscape. He encourages listeners to visit CISOseries.com for more detailed stories and announces the launch of their new podcast, Security You Should Know, which features security vendors addressing expert panelists' questions.

Final Note:

"Staying ahead in cybersecurity requires continuous learning and adaptation. Make sure to leverage the resources available to protect your organizations effectively." – Steve Prentiss [18:10]

---

This episode of Cyber Security Headlines provides a comprehensive overview of significant cybersecurity incidents, legislative efforts, and emerging threats, offering valuable insights for professionals and enthusiasts alike to navigate the complex world of information security.

Transcript

[Steve Prentiss]

From the CISO series, it's Cybersecurity Headlines these are the cybersecurity headlines for Monday, March 17, 2025. I'm Steve Prentiss. Black Basta creates tool to automate VPN brute force attacks Bruted B R U T E D is the name of an automated brute forcing framework designed to breach edge networking devices like firewalls and vpn' it was discovered by a researcher from threat intelligence platform maker Eclecticiq following an examination of the ransomware gang's leaked internal chat logs. This discovery suggests that Black Basta has been using this at least since 2023, and it was designed to target technologies from SonicWall, Palo Alto Networks, Cisco, Fortnet, Citrix, Microsoft and Watchguard. Bipartisan Senate bill offers improved cybersecurity for water utilities this bill is being reintroduced by Senators Catherine Cortez Masto of Nevada and Mike Rounds of South Dakota after previous legislation was stalled during the 118th Congress. Named the Cybersecurity for Rural Water Systems act, the bill would update and expand the Department of Agriculture's Circuit Rider program, which provides technical assistance to rural water systems. A press release announcing the bill states that just 20% of water and wastewater systems across the US have basic cyber protections. Lockbit developer extradited from Israel and appears in New Jersey court Following up on a story we covered last December, 51 year old Rostislav Panev, who is accused of being the developer of the Lockbit ransomware, has been brought to the US to face 40 charges relating to dozens of Lockbit ransomware attacks. Attacks. The Justice Department had been pressing for Panev's extradition since unsealing an indictment against him in December. Aside from being caught with credentials for a Lockbit developer repository, Panev is also accused of sending direct messages to Lockbit's suspected primary administrator Dmitry Yurovich Koroshev, who is still at large. Recent Windows update makes USB printers print random text this problem may affect some connected dual mode printers that support both USB print and IPP over USB protocols, said Microsoft. The problem arises from Windows Updates released since January 29 and applies to Windows 10 and Windows 11 versions, the exception being the latest Windows 11 24H2, which is not impacted. You might observe that the printer unexpectedly prints random text and data, including network commands and unusual characters, said Microsoft. A fix is already available through a known issue rollback and will also be repaired in a future update thanks to our episode's sponsor, Deleteme. Data brokers bypass online safety measures to sell your name, address and Social Security number to scammers Deleteme scours the web to find and remove your private information before it gets into the wrong hands by scanning for exposed information and completing opt outs and removals. With over 100 million personal listings removed, Deleteme is your trusted privacy solution for online safety. Get 20% off your DeleteMe plan when you go to join DeleteMe.com CISO and use promo code CISO at checkout. The only way to get 20% off is to go to join Deleteme and enter the code CISO C I S O One more thing to note, the CISO series has just launched a new podcast called Security. You should know. We have more details at the end of this episode. Malicious PYPI packages steal cloud tokens Researchers from Reversing Labs are warning of a campaign targeting users of the Python Package Index repository that is pypy, with bogus, bogus libraries masquerading as time related utilities but harboring hidden functionality to steal sensitive data such as cloud access tokens. Time related means that half of the package files include the word TIME in their titles, such as Time Check Server get these time related packages were used to upload data to the threat actor's infrastructure, while another set, many of which have the word client in their names, consists of packages implementing cloud client functionalities for several several services like Alibaba Cloud, Amazon Web Services and Tencent Cloud. The researchers say these packages altogether have been downloaded over 14,000 times. Sentence upheld for former Uber Cyber executive Joe Sullivan, the former chief security officer of Uber who was convicted of obstruction of justice charges in 2023, was appealing several aspects of his sentence and charges, arguing that the district court made several mistakes in rejecting two of his proposed instructions to the jury regarding one of the charges and unfairly allowing the guilty plea signed by one of the hackers into the case. End quote. Sullivan was given three years probation by a US federal judge in 2023 after a federal jury convicted him of two charges related to his attempted cover up of a 2016 security incident at Uber, where hackers stole the personal details of 57 million customers and the personal information of 6 Denmark warns of Europe telecom threat the Cybersecurity Agency of Denmark made this statement in a threat assessment published last Thursday warning of an increase in state sponsored cyber espionage activities targeting the telecommunications sector in Europe. Although no direct mention of salt typhoons activities in the US Was made in the statement, nor has there been any confirmation of salt typhoon activity in Europe, the Danish agency stated there have been several attempts at cyber espionage against the European telecommunications sector in the past few years, and it worries that European governments may lack the political incentives to make a public attribution even if China is identified as responsible. End quote Micronesian Island Suffers Cyberattack to show that nowhere on Earth is safe from cybercrime, the tiny island nation of Yap has suffered a ransomware attack attack forcing the shutdown of all computers in its government health agency. Yap is one of the four states of the Federated States of Micronesia and is located in the middle of the Pacific Ocean, roughly equidistant between the Philippines and Guam. Health officials from the island announced the attack, which occurred on March 11 on Facebook, stating that their health services are still continuing but are slower due to systems having been taken offline. We are thrilled to announce the launch of our brand new show, Security youy Should Know. Each episode features one security vendor answering questions from two of our security expert panelists. It's a 15 minute show to give you the answers you need about a specific vendor solution. You can check it out wherever you get your podcasts or [e-mail] Steve I'm Steve Prentiss reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.