← Cybersecurity Headlines
Cybersecurity Headlines
Week in Review: Qilin adds lawyers, Iranian spearphishing campaign, Microsoft Direct Send hack
00:25:11
Loading summary
Transcript37 lines
- [00:00]
Host
From the CISO series, it's Cybersecurity Headlines. Ransomware Group adds Lawyer button to its app. Have you ever heard of Microsoft Direct Send? Well, the bad guys have and maybe it's time to copyright your face. These are some of the stories that my colleagues and I have selected from this past week's cybersecurity headlines. And now we're looking forward to some insight, some opinion and some expertise from our semiannual guest, Bill Harmer, Information Security Advisor at Craft Ventures, coming back for your third appearance. Of course, for that we have to give you the three Timer Gold Star Award, the most prestigious award aside from the four or five and six timer awards, but it's right up there. It's one of the top 10 awards that we can give here on the week Interview show. So Bill, aside from the honor of receiving the three stars, how was your week in cybersecurity?
- [00:56]
Bill Harmer
Week's been good. It's been super busy this week. Met with probably about almost a dozen startups. So it's been yeah busier start to the summer than I thought it would have been.
- [01:09]
Host
That that to me sounds good. Any I can't wait to get some of that startup energy on the show here. That enthusiasm that Bill, I know you bring each and every time you were on the show. Also enthusiastically I have to thank our sponsor for today, Threat Locker Zero Trust Endpoint Protection Platform. Speaking of enthusiasm, what I love to see what gives me energy each and every time are the people in our chat room. I already C.J. williams and CCL getting in there, having a good time, getting ready to make some insightful comments or some snarky comments. They do occasionally happen. If you want to join their fine ranks, you can go to the events page@csoseries.com look for the week in review image and click on that or just subscribe to us on YouTube. We are there almost every Friday unless there's a holiday at 3:30pm Eastern, which is the time just about right now. So please come on, join us, have some fun. If you can't join us live, send us an email feedbackisoseries.com with your comments on the news of the week or about just feedback for the show. We'd love to share some of those on the show. We're going to jump into the news here. Just a quick reminder that all of Bill's opinions are in fact his own, not necessarily those of an employer of friends of family past and present. It's a straight Bill. So just be cool with that and we'll Have a good time. We've got 20 minutes, so let's jump in. First up here. Quillen adds call lawyer feature to pressure for larger ransoms in the face of increasing resistance and non cooperation from ransomware victims generally. The Quillen ransomware as a service group is now offering the novel feature of legal counsel for its affiliates to help them put more pressure on victims to pay up. According to Israeli cybersecurity company Cyber Reason, this new feature takes the form of a call lawyer button on the affiliate panel. This feature allows an affiliate. You can't. This is. This is just those darn threat actors in those darn threat actor news. This feature allows an affiliate ransomware group to bring a lawyer into negotiations with its victims lawyer taking advantage of the fact that many companies wish to avoid legal proceedings and will therefore potentially at least comply more readily. So, Bill, no question that even in legitimate business dealings, you know, the prospect of lawyer enough generally means a lot of expense. It's easy to see how the mere threat of including them in a ransomware negotiation might make a victim think twice. This goes well beyond something like physical cybersecurity. I'm curious, what advice would you give CISOs on this topic when they have to go talk to their C suite colleagues? Hey, the threat actors are threatening to call lawyers.
- [03:45]
Bill Harmer
I honestly had to read this one twice because I kept thinking, how did the threat actors get my lawyer's number? Because I'm going to hide it from my lawyer. Maybe. But they're bringing in their own lawyer. Honestly, I think if it happens as a ciso, welcome it and see who shows up.
- [04:06]
Host
Yeah, I mean, that is. Well, I'm wondering from the perspective of like professional ransomware negotiators. Right. Like, that's not uncommon to bring those in. Like, I would love to see what their experience with this is. Is this an empty threat? Is this. Oh, we have a chat bot that is trained on, you know, on law and stuff like that, so it can passively, you know, go off. Is this just a lawyer that has a very loose ethics policy? It's.
- [04:33]
Bill Harmer
Yeah.
- [04:34]
Host
I would be fascinated to learn to dig into this because it would be.
- [04:37]
Bill Harmer
The new form of ambulance chaser. Like, it would just. It would make ambulance chasers look moral and ethical.
- [04:44]
Host
I love the idea of like ransomware as a service, like commercials. Like, have you breached an organization? You know, call now. So the.
- [04:54]
Bill Harmer
This is one of those things that, where you look at it and you just like. I kind of applaud the creative ideas that are coming out of this space. Like, it's just it keeps it interesting, I guess.
- [05:07]
Host
We are seeing so many ways of, it's, it's just like where can we cause pain? Where is there like an organizational pain point that we can tip the ledger into? Not worth it to not pay. Right.
- [05:18]
Bill Harmer
In hr.
- [05:19]
Host
Yeah, bring it, bring in hr. Bring in like more legal, like just any kind of way you can tip that just a little bit. Probably pays fairly big dividends, especially if it's a dubious lawyer in quotes. We're seeing some love and some incredulity in our chat from this. TJ Williams. I thought it was a joke. Tj. We had to read it twice too. It's quite exceptional. Next up here. Iranian Backed Spear Phishing Campaign seeks out Cybersecurity Experts A new spear phishing campaign has been targeting Israel based journalists, cybersecurity experts and computer science academics. This involves emails and WhatsApp messages from people posing as assistants to technology executives or researchers seeking to coax the target into joining a meeting. The topic of the meeting is the need for assistance on an AI based threat detection system to counter a surge in cyber attacks targeting Israel. The messages point to a fake Gmail login page or Google Meet invitation. So Bill, I mean we're not talking about a new technique here. We've reported on similar ones before. Even just this week we had, you know, fake zoom calls requiring click fix type repairs to microphone audio. Now of course, though, there's this interesting element of the urgency of war. A call to action for experts come to the table, add their skills to a very real conflict here. It's easy for people to be caught like this. And I have to think as the stakes get higher, how do you put in the speed bumps you need for critical thinking when there's that type of urgency?
- [06:46]
Bill Harmer
This is a tough one because in times of war, in times of crisis, that's the time to attack. And they're looking for the distracted mind. They're looking for somebody who's more and rightfully so more concerned with the safety of their family than maybe what's happening today. And it's the time where you also have to turn around and dig in for the diligence. You have to this is where policy, like not systems, not tools, but policy and procedure are so critical because if you can fall back to that and simply follow the policy and it becomes natural to you, you will have less likely, you're less likely to fall for something like this.
- [07:24]
Host
Yeah. And I have to think having that organizational buy in. Right. So that the it's not Cybersecurity being the bad guy, right? And doing this like this is top down, you know, you have authority to, to say, hey, take the time to do this. Don't just immediately click or know that that's the risk that your organization is willing to take. And like you said, base your policy around the risk that you're willing to take on in this situation.
- [07:48]
Bill Harmer
Exactly, yeah.
- [07:50]
Host
All right, Next up here. NHS confirms patient death linked to ransomware attack. The June 2024 cyber attacks on London hospitals caused more than just a data breach. Britain's National Health Service now says a patient's death was directly linked to the incident. NHS explains the attack impacted the amount of time it took hospitals to perform critical blood tests. The resulting delays were identified as one of the contributing factors in, in the patient's death. The hackers also compromised data belonging to over 900,000 patients, including sensitive medical details that still haven't been fully disclosed. So this too, unfortunately not a new story, A new type of story. In fact, it's the fourth separate story we presented on our daily cybersecurity headline show since we started in 2020. Shout out to our producer Steve, for doing the homework, finding all of those stories. But the question is, who is most affected by learning that people are dying from ransomware and what benefits or dangers would such, I guess, reporting present?
- [08:47]
Bill Harmer
I think, you know, if you look at the wording in that, right, one of the contributing factors, it didn't say it was the contributing factor or even the majority contributing factor. So it was, it was something in there. I think this is a hyperbolic approach to trying to get perhaps more funding for nhs, get the service, the systems upgraded and manage it through, could be going that direction. But also if you look at it, 900,000 patient data, 900 data of 900,000 patients affected and this was contributing in one death and one is always too many. But when you are looking at that kind of scale, it shows that there's some resiliency within the organization. They've obviously done some things correct to be able to manage the other patients that were there. This one fell through and I would always want, before I pass judgment on something like this, want to find out what were the other contributing factors.
- [09:43]
Host
Yeah, this could be part of a wide ranging, you know, in any kind of tragedy like this. And yeah, we were talking before the show that while, yes, these are, these headlines still grab our attention in a, in a world where we're completely numb to millions of people losing data in data breaches, ransomw impacting, you know, thousands of, you know, multiple municipalities at once and stuff like that. That these, that this can still raise eyebrows. That this is not completely commonplace to your point is actually a testament to the resiliency that we're seeing. Maybe not strictly speaking from a cybersecurity perspective just because of the sheer challenges for healthcare organizations, for all organizations, but particularly with healthcare. But yeah, just the terms of, hey, we have policy in place that we can go pen and paper if we need to. We have fallbacks that we need to. Yes, we may have to put out non critical services for a while. We've certainly seen that with a number of providers having to do that for a while, you know, internationally. But yeah, the fact that there are those backups in place makes these headlines still exceptional and I think that is notable.
- [10:51]
Bill Harmer
Yeah. And I hope that the death part never becomes normal to us.
- [10:56]
Host
Yeah, I hope that it is always an eyebrow raising that that is the standard that we need to hold for any kind of cyber attack. For sure. Yeah, that will definitely be a sea change when that isn't get reported on the show. All right, before I move on to our next story, I have to spend a few moments and thank our sponsor for today. Threat locker alert fatigue, false positives, analyst burnout. You know the drill. What if you could stop threats before they run? Threat locker gives CISOs what they've been asking for. Real control at the execution layer. Only approved apps, scripts and executables run, period. Known good is enforced, everything else denied by default. Ring fencing and storage control keep even trusted tools in their lane. So PowerShell doesn't become a weapon. And yes, it works at scale. Granular policies, fast rollout built for modern infrastructure. You don't need more alerts. You need fewer chances for malware to make a move. ThreatLocker helps you flip the model from detect and respond to deny and verify. Go to threatlocker.com CISO to schedule your free demo and close the last gap in your zero trust strategy before it's exploited. That's T-H-R-E-A-T-L-O-C-K-E-R.com CISO all right, next up here, I'm going to call this for maybe the facepalm story of the week here. I'm just already calling this here. Microsoft 365 direct send abused for phishing campaigns so Direct send is a little known Microsoft 365 feature that allows on premises devices, applications or cloud services. So that's like everything to send emails through a tenant. Smart Host as if they originated from the organization's domain. It's designed for use by printers, scanners and other devices that need to send messages on behalf of the company. It also does not require any authentication. Just going to leave that out there. Researchers at Varonis have announced that a phishing campaign that exploits this feature is targeting more than 70 organizations across all industries, with 95% of the victims based in the U.S. it runs through a PowerShell command. To mitigate this, Varonis recommends enabling the Reject Direct Send setting in the Exchange Admin center, which Microsoft included in April 2025. So, Bill, I'm curious, have you heard of Direct Send? And as a ciso, what goes through your mind when you learn about unknown technology such as this buried inside a platform that's used by, I don't know, everyone. Also, printers are evil. Once again, please go out.
- [13:38]
Bill Harmer
No, I didn't know about it because quite honestly, I did not think in 2025 that any company could be this delusional or irresponsible or reprehensible in doing something like this. You know, the whole, we're got to make our passwords longer, stronger, more complex now we need to have multi factor authentication and it's got to be out of band and all this stuff that gets piled on and you got the whole front end of Microsoft doing face analysis for login with hello, that they would put something like this. Now it doesn't surprise me. It's Microsoft. I mean, that's, that's the sad part. But, but I like, if I found this in my environment as a ciso, I would be looking at a contract to see if I could go after them and sue them for this because that is, this is just unacceptable.
- [14:35]
Host
This almost sounds like this is the kind of thing that, where it's like, oh, this was in Excel, but it was a leg. We left it in as a legacy feature. But you have to enable it and stuff like that. But not just, hey, it's just, it's owned by people. You have to, you have to turn off the reject this insecure feature as if it's some sort of horrible negative to turn this off.
- [14:55]
Bill Harmer
Yep. Yeah, it's, it's, you know, honestly. Yeah, we can vote facepalm right now because there's just nothing I have seen this week that is this egregious.
- [15:08]
Host
Yeah. T.J. williams. Yeah, an easy fix now that we have that setting since April. But still. Yes, tj, but still. But still, indeed. All right, moving on to our next story. Judge warns of constant attacks on PACER system. The Public Access to Court Electronic records, or PACER platform, allows judges and lawyers to file court documents electronically. However, monetization is desperately needed to fend off constant attacks from increasingly sophisticated hackers. Federal Judge Michael Scooter told members of the House Judiciary committee that about 200 million harmful cyber events were prevented from penetrating court local area Networks in fiscal 2024, which is a lot of events. Documents at risk included sealed indictments, names of cooperating witnesses and arrests, and search warrants. He added that external experts and members of his committee have concluded that PACER is unsustainable due to cyber risk and must be replaced with a more modern system in the coming years. Do its increasing vulnerability to hacks. I worked in a law firm right out of college for a couple of years. Nothing fancy, but just so. If you're not familiar with it, PACER is the backbone of like the entire legal system. It's any court document if you want to see what happened in court, if you want any access to documents, it is like one of the most primary things also generates a lot of money because they charge per page. But Bill, this story combines the best of the prepare before you need it theme as well as the neglected critical infrastructure theme that often populates the show. Given the current trend for cutting back on agencies and public departments of all kinds, do you feel that PACER will become another sitting duck for APTS or even opportunistic breaches?
- [16:47]
Bill Harmer
Oh, 100%. It's, it's absolutely going to be because if, if you can get in there and compromise anything that could be used in an evidentiary proceeding, if you can disrupt the court system and our court systems are massively overloaded. Like we just, you know the term sue is like a, it's a daily use term in the news today. So you know tech debt has always been our problem. But when you're dealing with a public service infrastructure that doesn't have a profit loss, doesn't have, you know, its budget is at the whim of whoever's in charge and they start cutting back. This, this bodes horribly for what may happen and what probably will happen because government is always increasing incredibly slow in things done anyways. So even if they were to decide today to start upgrading it, you know this is a multi billion dollar decade long upgrade and what they upgrade to will be already out of date.
- [17:49]
Host
Yeah the. And and just again this is, this is not just viewing it's filing. It's like there's some like a breach of pacer. I cannot tell you like just the inefficiency, just an availability of PACER would have major financial impacts on law firms. Like, I can't. Like it's literally the tab you always have when you work at a law firm, ccl. Yeah, Sometimes easier to start from scratch. I mean, I mean, you want to talk about, you know, something that would. I 100% agree with you. But also the practicalities of that are so again, this is. It just runs so deep. It is kind of a Gordian knot for so much of this, which threat actors seem more than happy to sever for their own benefit, I guess so. There we go. Our last story here today. Denmark proposes personal copyright to combat deepfake exploitation. The Danish government is planning on going to battle against the unauthorized use of AI generated deepfakes by changing copyright law to ensure that everybody has the right to their own body, facial features and voice. This is believed to be the first law of its kind in Europe. The Danish culture minister, Jacob Engelschmitt, his name is my name too, said he hoped the bill before Parliament would send an unequivocal message that everybody had the right to the way they looked and sounded, including my own terrible singing there. So, Bill. Such a move has a definite Blade Runner vibe to it. But copyright law overall has become a complex issue, maybe even a lost cause, depending on which stakeholder you're talking to. All sorts of intellectual property is increasingly easy to distribute and copy. Don't copy that floppy, perhaps the most notable example of that. This is also subject to the whims of each country's own legal system. But at the same time, you know, we've seen things like GDPR seem to have retained some bite and influence kind of global policy to a certain extent. I'm curious, what are your thoughts on this?
- [19:44]
Bill Harmer
My first question is what happens with twins and triplets? Right? Like.
- [19:49]
Host
Oh my gosh. Yeah, go. Go right to it.
- [19:52]
Bill Harmer
Yeah, yeah. And it's interesting, you know, I kind of thought it seemed goofy when I first read it and then I started trying to think about it and thought there were places in there and actually CCL just threw up the one that said, what if I open open source my face you can then start. Well, it's selling your likeness and copy left your face. Yeah, yeah, exactly. So I think it's an interesting step into. Into what we may need to do in the future because, you know, you've heard me over the years talk about identity and how we sort of tie the meat sack to the digital identity. And part of that is going to be biometrics. Right. It's. It's going to be maybe DNA, maybe, you know, facial, all of it combined, whatever it is. So, you know, I'm. I'm gonna want. I'm gonna follow this one. I want to see where it goes. I'd like to see some of the arguments that come out for and against.
- [20:47]
Host
Yeah, it's one of those things where I completely understand, like they're using copyright, like as a model for this. But I also think that is by trying to make it relatable, I would rather just have a complete net new. Like this is notable enough that I don't need my face to be a book or a movie.
- [21:06]
Bill Harmer
More like this is a human law, you know, the individual human law.
- [21:10]
Host
Yeah. Like, I understand that as a framework, I think to help get people to understand it because it does make it much easier to wrap your head around if you're not a policy wonk or something like that. At the same time, I feel like perfect case example is twins. Right. Or something. You know, where you're going to run into weird exceptions. Schmooze. Talking about fair use in here. I can't. I can't even schmooze. You're getting at me. But yes, I. Again, a story I'm very interested in following up on. And I want to see if there's different approaches to this because I feel like at some point we're going to have to. Well, I guess we don't have to because we could just live in a dystopian nightmare. So there's that. But here's hoping we have some other alternatives to. To the Blade. The Blade Runner. Yeah. And Vikas says in their plastic surgery looks changed with age. What's the scope of the copyright then? That's again, that's a really. A really fantastic point. Yeah. Do you. Do you hold it for all iterations of your face? Do you have to file again as your face iterates over time? I'm going to facial iterations. Also the name of my synth pop band. So please come check that out. We're playing nowhere and, well, you can never hear us before we get out of here. Huge thank you to everyone that was contributing in our chat. Cracking me up. Just so awesome. Schmooze, ccl, Vikas, TJ Williams, and the big boss man, David Spark. Even getting in there. Thank you all so much for helping make the show a ton of fun, helping us brighten our day and bring up some great points too as well. Bill, before we get out of here, Just confirming the Microsoft direct send. Is that the face palm of the week? Is that 100%? We have to give the Picard face palm for that for sure. Yes. Okay. Yeah, Microsoft, I wish we could say we expected the Linux hippie in me feels justified just a little bit right in here. Bill, before we get out of here, where can people find you on the cyberspace? What are you up to? What do we need to let people know about?
- [23:10]
Bill Harmer
You can find me on LinkedIn as usual. And I have a new advisory firm that I've started this week called kill switch advisory, so www.killswitchadvisory.com Excellent.
- [23:20]
Host
And if you want to look them up on LinkedIn, it is. William Harmer is the URL that is the correct. Bill Harmer, Information Security Advisor over at Craft Ventures. Thank you so much for being on, for lending your wisdom, your wit and just your fabulous nature to this show. For this particular face iteration. We're particularly grateful to have you on. Thanks a lot, Bill.
- [23:41]
Bill Harmer
My pleasure.
- [23:42]
Host
Thanks also to our sponsor, Threat Locker Zero Trust Endpoint Protection Platform, and thanks to our audience once again. You know we always can't get everything up on the screen, but we're looking at it. We deeply appreciate it and we hope you can join us again for our next show. And if you again, if you can't join us, live feedback@cisoseries.com let us know what you think of the show, what we can do better. Remember, when I'm talking about ccl, this is a person in our chat that we're talking about. It's not an acronym for cybersecurity standard or something like that. Just want to make that clear. If you want to join us next week, too bad because it's 4th of July. But we'll be back in two weeks for another episode of the week in Review starting at 3:30pm Eastern. Go set off a sparkler or something or just throw something on the Grill at 3:30 next week to register to join us. You can join us on YouTube, you can go to our events page@ciso series.com find more information there. It will be a fun time. In the meantime, you can still get your daily news fix every single day through cybersecurity headlines. Give us about six minutes, we'll get you all caught up until the next time we meet. For myself, for our glorious producer, Steve Prentice, for Bill, for all of us in the CISO series, here's wishing you and yours to have a super sparkly day. Cybersecurity headlines are available every weekday head to CISO series.com for the full stories behind the headlines. It.