Transcript
A (0:00)
From the CISO series, it's Cybersecurity Headlines.
B (0:07)
These are the cybersecurity headlines for Tuesday, January 7, 2025. I'm Lauren Verno. Wallet Drainer Malware Makes Major Impact in case you weren't keeping up with the impact of Wallet drainer malware in 2024, don't worry, not many of us were. A new report found close to 500 million was stolen through the malicious cryptocurrency scams. The report from Scam sniffer found a 67% increase from the previous year, with over 332,000 victims. The largest single thefts included over 55 million and 32 million, which occurred in August and September, despite the highest activity being recorded in Q1 US telecom breach list grows 3 more communication companies, Charter Communications Consolidated Communications in Windstream have joined the list of those impacted by the SALT Typhoon breach. Now that's according to the Wall Street Journal. A White House official announced the breach last month stated stating that Chinese hackers targeted nine US telecom companies, though it remains unclear whether these three are part of the initial nine or additional victims. As of this recording, AT&T, Verizon, Lumen and T Mobile are the four communication providers that have confirmed being impacted by the attack. Urgent Warning on Moxa Router vulnerabilities Moxa has disclosed two critical vulnerabilities in its industrial networking devices, impacting several models of routers and network security appliances. The flaws allow attackers to escalate privileges to root and execute arbitrary commands, with one exploitable remotely without authentication. While Moxa has released patches for many affected devices, Some models, like NAT102 and on cell LTE 4 Series, require direct support or have no patch available. The company advises immediate action, including limiting network exposure, restricting SSH access, and deploying intrusion detection systems to mitigate the risk. Android Infosteeler Masquerades as Telegram Premium An Android malware named Firescam is posing as a Telegram Premium app to steal sensitive data and maintain persistent control over infected devices. Distributed through a phishing site impersonating Rustor, a Russian app store, the malware uses a multi stage infection process and requests extensive permissions to intercept notifications, messages and app data while preventing legitimate updates. Stolen information is exfiltrated to a Firebase database and transmitted via a command and control server, leveraging legitimate services to evade detection. Thanks to today's episode sponsor Nudge Security who's using AI tools in your Org? Find out today with Nudge Security. Nudge Security discovers every gen AI tool ever used in your org, even those you've never heard of. For each tool, you'll see who introduced it, who else is using it, where it's integrated into other tools and and a vendor security profile. Visit nudgesecurity.com AI and get your free gen AI inventory today. That's nudgesecurity.com AI new eager B variant lands globally the Eager Bee malware is just that, and Eager B, a new variant of the malware previously linked to Chinese state backed groups, is now targeting ISPs and government entities in the Middle East. Known for its stealth and in memory operations, the malware features advanced plugins for file manipulation, remote access, service control and network monitoring, all orchestrated via a plugin manager attributed to the coughing down threat group. The malware has connections to earlier attacks exploiting the proxy logon vulnerability targeting Southeast Asian organizations the Cyber attacks that just keep giving we all know hackers don't take the day off, even during the holidays. Two US School districts in Maine and Tennessee fell victim to attacks over Christmas and New Year's, a time when cybercriminals know it staffing will be low. South Portland Public Schools in Maine, which serves 3,000 students and nearly 600 employees, detected a breach that led them to take their network offline and although no data was compromised, the attack did cause significant disruption. Meanwhile, Rutherford County Schools in Tennessee, which serves more than 50 51,000 students, revealed in late December they had been dealing with a quote, network and systems disruption since the Thanksgiving holiday. That attack did lead to employee personal information being stolen. Tenable issues Nessus Update 2 tenable Nessus agents have been disabled after it was discovered they would go offline when installing a faulty update. The affected versions 10 and 10 were disabled, with Tenable releasing version 10 to resolve the issue and resume plugin feed updates advising customers to either update to the new version or actually downgrade to the prior version. Organizations using agent profiles are also instructed to reset and manually update the plugins to restore functionality. Argentina Airport Security Compromised Hackers have reportedly compromised Argentina's Airport Security payroll system, gaining access to personal and financial data of officers and civilian staff. The attackers use a vulnerability in Banco Nation's systems, which processes the payroll to withdraw small amounts from employees salaries under false labels ranging from 2,000 to 5,000 pesos, which is about 100 to 245American dollars. The airport security force has blocked some services in response and launched an internal cybersecurity campaign, though it remains unclear if the attack was financially or or politically motivated. We still struggle to identify and manage hardware once it reaches its point of usefulness or end of life. There's often no stated expiration date up front. After years of ownership, the manufacturers will let you know by no longer supporting with patch updates the now very vulnerable equipment. Do we need to change how cybersecurity sunsets hardware? That's one of the segments we're digging into in the latest episode of the CISO Series podcast. We just published our new episode today@cisoseries.com so look for EW. How long has this router been in the fridge? Wherever you get your podcast, I'm Lauren Verno reporting for the CISO Series.