Washington Post hacked, WestJet suffers cyberattack, Texas DoT breach

Summary

Cyber Security Headlines - June 16, 2025

Host: Steve Prentiss
Podcast: CISO Series
Title: Cyber Security Headlines
Release Date: June 16, 2025

---

Overview

In this episode of Cyber Security Headlines, Steve Prentiss delves into the latest and most pressing cybersecurity incidents, encompassing high-profile hacks, ransomware evolutions, sophisticated phishing campaigns, significant vulnerabilities, and strategic shifts in governmental cybersecurity practices. This comprehensive summary highlights the key discussions, insights, and conclusions drawn from the episode, complete with notable quotes and timestamps for reference.

---

1. Washington Post Hacked

Incident Summary: The Washington Post has fallen victim to a targeted hacking incident aimed at several of its journalists, particularly those involved in national security and economic policy, including reporters focusing on China.

Details:

• Unauthorized access was gained to journalists' Microsoft accounts, potentially allowing intruders to access work emails.
• Source: A reporter spoke with Reuters about the possible involvement of a foreign government in the intrusion.
• Anubis ransomware was implicated, enhancing the attack's severity by introducing a wiper module that destroys files beyond recovery.

Notable Quotes:

• Steve Prentiss mentions, "[00:00]...journalists at the Post have reportedly stopped using email for their most sensitive conversations and use encrypted messaging apps like Signal instead."
• Steve emphasizes the Washington Post's response, stating, "the Washington Post has wisely decided to force all employees to reset their login credentials" ([00:45]).

Insights:

• The move to encrypted messaging apps highlights the increasing awareness and proactive measures taken by media organizations to safeguard sensitive communications.
• The introduction of a wiper module by ransomware groups like Anubis signifies a shift towards more destructive cyberattacks, pushing victims towards quicker ransom payments.

---

2. Anubis Ransomware Evolves

Incident Summary: Anubis ransomware, known for its aggressive affiliate programs, has enhanced its malware with a wiper module, escalating the threat by ensuring data destruction irrespective of ransom payments.

Details:

• Trend Micro researchers discovered the wiper feature in recent Anubis samples.
• The wiper aims to increase pressure on victims to pay the ransom by making data recovery impossible even if the ransom is paid.
• Clarification was made that this Anubis should not be confused with another Android ransomware sharing the same name.

Notable Quotes:

• Steve Prentiss explains, "Anubis... will destroy a victim's files, making recovery impossible even if the ransom is paid" ([03:10]).

Insights:

• The addition of destructive capabilities to ransomware like Anubis underscores the escalating arms race between cyber attackers and defenders.
• Organizations must bolster their defenses and backup strategies, as the traditional ransomware model of paying for data recovery becomes less viable.

---

3. Discord Invite Link Hijacking Campaign

Incident Summary: A sophisticated campaign targets Discord users through hijacked invite links, deploying the Skuld information stealer and the AsyncRAT remote access Trojan.

Details:

• Checkpoint researchers noted that attackers exploit Discord's vanity link registration to redirect users to malicious servers.
• The campaign employs click-fix phishing techniques, multi-stage loaders, and time-based evasion methods to stealthily deliver malware.
• The Skuld stealer is customized to target cryptocurrency wallets, enhancing the financial motive behind the attacks.

Notable Quotes:

• Steve highlights, "attackers hijacked the links through vanity link registration, allowing them to redirect users from trusted sources to malicious servers" ([06:20]).
• He further adds, "they use the click fix phishing technique along with multi-stage loaders and time-based evasions to stealthily deliver AsyncRAT and Skuld" ([06:45]).

Insights:

• The exploitation of widely used platforms like Discord for distributing malware demonstrates the need for enhanced security measures within communication tools.
• Users must remain vigilant about the sources of invite links and consider implementing additional verification steps before clicking on suspicious links.

---

4. Grafana Account Takeover Vulnerability

Incident Summary: A critical vulnerability in Grafana has left over 46,000 internet-facing instances exposed to potential account takeovers.

Details:

• The vulnerability, identified by Ox Security, is a client-side open redirect flaw allowing malicious plugin execution.
• Despite a patch released by Grafana Labs on May 21, a significant number of instances remain unpatched.
• The flaw impacts multiple versions of the Grafana platform, making it a widespread threat.

Notable Quotes:

• "More than 46,000 Internet-facing instances of Grafana remain unpatched and exposed to a client-side open redirect vulnerability" ([09:15]).
• Steve stresses the urgency, "this flaw has a CVE number and impacts multiple versions of the Grafana platform" ([09:30]).

Insights:

• The slow adoption of patches by a third of accessible Grafana instances highlights the persistent challenge of ensuring timely updates in the software supply chain.
• Organizations relying on Grafana for data analytics and monitoring must prioritize patch management to mitigate the risk of account takeovers and data breaches.

---

5. WestJet Cyberattack

Incident Summary: Canadian airline WestJet is currently investigating a cybersecurity incident affecting some of its internal systems and mobile application, leading to blocked access for several users.

Details:

• The attack has not yet compromised flight operations, which remain safe and unaffected.
• WestJet is collaborating with law enforcement agencies to address the incident.
• Specific details about the nature and extent of the breach are yet to be disclosed.

Notable Quotes:

• Steve reports, "Canadian airline WestJet is containing a cyber attack... which has blocked access for several users" ([12:05]).
• He reassures listeners, "flight operations remain safe and unaffected" ([12:20]).

Insights:

• The incident underscores the aviation sector's vulnerability to cyber threats and emphasizes the importance of robust incident response strategies to maintain operational integrity.
• Continued monitoring and transparent communication are crucial for maintaining customer trust during such breaches.

---

6. Danish Government Shifts from Microsoft to Open Source

Incident Summary: Denmark's tech modernization agency is transitioning from Microsoft software to open-source alternatives like LibreOffice to attain digital sovereignty and reduce dependence on U.S. technology firms.

Details:

• Over half of the agency's staff will move to LibreOffice within the next month, aiming for full adoption by autumn.
• The shift also aims to mitigate costs associated with aging Windows 10 systems, which are losing support in October.
• The initiative is part of broader steps taken by cities like Copenhagen and Aarhus, driven by financial, political, and competitive considerations.
• LibreOffice, developed by the Berlin-based Document Foundation, offers a comprehensive suite of office tools.
• Microsoft has yet to comment on the transition.

Notable Quotes:

• Steve highlights, "Denmark's tech modernization agency plans to replace Microsoft products with open-source alternatives like LibreOffice to reduce reliance on US tech firms" ([14:50]).
• He quotes Digitalization Minister Caroline Stade Olsson, stating, "the move also aims to avoid costs tied to aging Windows 10 systems" ([15:10]).

Insights:

• The Danish government's move reflects a growing trend among nations to seek greater control over their digital infrastructure by embracing open-source solutions.
• This transition may set a precedent for other governmental bodies considering similar shifts to enhance cybersecurity and independence from foreign technology providers.

---

7. Texas Department of Transportation (DOT) Data Breach

Incident Summary: The Texas DOT has identified unauthorized access to its crash records information system, resulting in the theft of nearly 300,000 crash reports containing sensitive personal and insurance information.

Details:

• The breach was detected on May 12, involving a compromised account used to download the records.
• The stolen data includes Personally Identifiable Information (PII), insurance details, injury reports, and incident narratives.
• Affected individuals have been notified and advised to remain vigilant against related fraudulent communications.

Notable Quotes:

• Steve reports, "Authorities at the Texas Department of Transportation have announced the discovery of unusual activity... involving its crash Records Information system" ([17:30]).
• He emphasizes the impact, "the records include pii, but also information about insurance policies, injuries sustained during crashes, as well as the narratives of the incidents" ([17:50]).

Insights:

• The breach highlights the vulnerability of government databases housing extensive personal information, necessitating enhanced security measures.
• Victims are at heightened risk for identity theft and insurance fraud, underscoring the importance of proactive monitoring and protective actions following such incidents.

---

8. UK Undersea Cable Security Report

Incident Summary: A report from the China Strategic Risks Institute criticizes the UK's preparedness against undersea cable sabotage, revealing that the majority of alleged sabotage incidents are linked to Chinese and Russian entities.

Details:

• Between January 2021 and April 2025, 10 out of 12 reported incidents of undersea cable sabotage involved vessels connected to China or Russia.
• Submarine cables are critical to 99% of intercontinental data transmission, vital for civilian and defense infrastructure.
• The report asserts that the UK's defense infrastructure is inadequately equipped to counter these grey zone tactics.

Notable Quotes:

• Steve notes, "10 out of 12 incidents of alleged undersea cable sabotage between January 2021 and April 2025... were directly linked to China or Russia" ([20:40]).
• He underscores the vulnerability, "without these cables, much of the economy... would cease to function" ([21:05]).

Insights:

• The strategic importance of undersea cables as backbone infrastructure for global communications and economic activities necessitates robust protective measures.
• The report calls for the UK to enhance its defense capabilities to mitigate risks posed by state-linked entities employing undersea sabotage as a form of cyber warfare.

---

Conclusion

This episode of Cyber Security Headlines offers a comprehensive overview of significant cybersecurity events, highlighting the evolving nature of threats and the critical responses required across various sectors. From media institutions and government agencies to private enterprises, the discussions emphasize the imperative for proactive security measures, timely patch management, and strategic shifts towards more resilient and independent technological infrastructures.

Key Takeaways:

• The integration of destructive capabilities into ransomware necessitates stronger backup and recovery strategies.
• Exploitation of popular platforms like Discord for malware distribution calls for improved security protocols within such services.
• Persistent vulnerabilities and delayed patch adoption in software platforms like Grafana pose substantial risks to organizations.
• Strategic moves by governments towards open-source solutions reflect a growing emphasis on digital sovereignty and cybersecurity resilience.

For a deeper dive into each of these topics, listeners can explore the full stories available at CISOseries.com.

Transcript

[Steve Prentiss]

From the CISO series, it's Cybersecurity Headlines These are the cybersecurity headlines for Monday, June 16, 2025. I'm Steve Prentiss. Washington Post investigates hacking incident on journalists emails A source speaking with Reuters has stated that there has been a possible unauthorized targeted intrusion affecting a few journalists, which the Wal Journal has said was potentially the work of a foreign government. Specifically, the reporters whose emails were targeted included members of the national security and economic policy teams, including some who write about China, End quote Staffers at the Washington Post have been told the intrusions compromised journalists Microsoft accounts and could have granted the intruder access to work emails. Graham Cluley, posting on LinkedIn, stated that in recent years, reporters at the Post have reportedly stopped using email for their most sensitive conversations and use encrypted messaging apps like Signal instead. Nonetheless, the Washington Post has wisely decided to force all employees to reset their login credentials. End quote Anubis ransomware adds wiper to destroy files beyond recovery following up on a story we covered in April, the Anubis ransomware as a service operation has now added a wiper module to its file, encrypting malware which will destroy a victim's files, making recovery impossible possible even if the ransom is paid. Anubis, which is not to be confused with an Android ransomware malware with the same name, made headlines this spring for its aggressive affiliates program. Researchers from Trend Micro found the wiper in recent samples, and they believe the feature was introduced to increase the pressure on the victim to pay quicker instead of stalling negotiations or ignoring them altogether. End quote Discord invite link hijacking campaign delivers infostealers Researchers from Checkpoint are describing this campaign as one that exploits a weakness in Discord's invitation system to deliver an information stealer called Skuld and the remote access Trojan Async Rat. They said attackers hijacked the links through vanity link registration, allowing them to redirect users from trusted sources to malicious servers. They then use the click fix phishing technique along with multi stage loaders and time based evasions to stealthily deliver Asyncrat and the customized Skuld stealer targeting Crypto wallets Account Takeover bug impacts over 46,000 grafana instances according to researchers at application security company Ox security. More than 46,000 Internet facing instances of the data analytics and monitoring app remain unpatched and exposed to a client side open redirect vulnerability that would allow for execution of a malicious plugin and account takeover. The flaw has a CVE number and impacts multiple versions of the Grafana platform. Grafana Labs released a patch on May 21 after having been informed by a bug bounty hunter, but Ox Security says more than a third of all Grafana instances reachable over the public Internet have not been patched. Huge thanks to our Sponsor Adaptive Security OpenAI's first cybersecurity investment as deepfake scams and gen AI phishing evolve, Adaptive equips security teams with AI powered phishing simulations featuring realistic personalized deepfakes and engaging security awareness training. Their new AI content creator turns threat intel and policy updates into interactive multilingual training. Instantly trusted by Fortune 500s and backed by Andreessen Horowitz and OpenAI, Adaptive helps you stay ahead of AI driven threats. Learn more at adaptivesecurity.com that is the two words adaptive security together.com Canadian airline WestJet is containing a cyber attack Canada's second largest airline is now investigating a cybersecurity incident impacting some of its internal systems and mobile app, which has blocked access for several users. End quote. The company is of course responding and working with law enforcement and stresses that flight operations remain safe and unaffected. No additional details are available as of this recording. Danish government agency announces planned switch from Microsoft software Denmark's tech modernization agency plans to replace Microsoft products with open source alternatives like LibreOffice to reduce reliance on US tech firms and achieve digital sovereignty. Over half the staff will transition to LibreOffice in the next month, with full adoption expected by autumn, according to Digitalization Minister Caroline Stade Olsson. The move also aims to avoid costs tied to aging Windows 10 systems, which lose support in October. LibreOffice, developed by the Berlin based Document foundation, offers a full suite of office tools. Similar steps have been taken by Copenhagen and Aarhus, citing financial, political and competitive concerns. Microsoft has not yet commented. Crash records stolen from Texas DOT Authorities at the Texas Department of Transportation have announced the discovery of unusual activity on May 12 involving its crash Records Information system. Their investigation states that a compromised account was used to access and download almost 300,000 crash reports, which the state is legally required to maintain. The records include pii, but also information about insurance policies, injuries sustained during crashes, as well as the narratives of the incidents. The department sent letters to victims to be vigilant for any communications related to past crash incidents. The UK is woefully unprepared for undersea cable sabotage, says Report following up on a story that we have been covering over the past few months, a report from the China Strategic Risks Institute showed that 10 out of 12 incidents of alleged undersea cable sabotage between January 2021 and April 2025. Out of these, eight of the suspected vessels were directly linked to China or Russia through flag, state registration or company ownership. As described in the Guardian, 99% of Intercontinental data transmission takes place through submarine cable systems, playing a vital role in civilian and defense infrastructure. Without these cables, much of the economy, from international banking and cloud computing to virtual communications and global logistics, would cease to function. The report continues to say that the UK's defence infrastructure is woefully inadequate in protecting against such grey zone tactics. End quote Remember to join us this Friday for Super Cyber Friday. We're tackling a big one this week, spending an hour talking about hacking what it takes to become a ciso. If you're in security leadership and want to know how people have gotten to the top, then you need to join us at 1pm Eastern. Be sure to head on over to our events [e-mail] to register. And if you have some thoughts on the news from today or about this show in general, please do reach out to [e-mail] we would love to hear from you. I'm Steve Prentice reporting for the CISO series. Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.