Transcript
A (0:00)
Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them at meter.com CST.
B (0:19)
Fortinet firewalls breached, an 11 year old Linux bug opens up root access, a ransomware boss pleads guilty and leaked passwords are everywhere in retune. This is Cybersecurity Today and I'm your host David Shipley. Let's get started. Our first story is another serious incident involving Fortinet Fortigate firewalls, and it's still developing. Security firm Arctic Wolf reports automated attacks targeting Fortigate devices where attackers are creating rogue accounts, granting themselves VPN access, and exporting firewall configuration files within seconds. The campaign began January 15th and appears to exploit an unknown vulnerability tied to Fortigate's single sign on feature. The speed of the activity strongly suggests automation rather than manual intrusion. What's especially concerning is that the attacks closely resemble activity observed last month following the disclosure of a critical Fortinet authentication bypass flaw that allowed attackers to bypass SSO protections entirely. At this stage, it's unclear whether the current attacks are fully addressed by existing patches or whether attackers are exploiting a patch bypass. Multiple Fortinet customers report suspicious activity even on systems believed to be up to date. CISA previously added the related vulnerability to its known Exploited Vulnerabilities catalog, ordering federal agencies to patch within days. Fortinet has not yet publicly commented on this latest wave of attacks. Our second story involves a critical Linux vulnerability that went unnoticed for nearly 11 years. A flaw in the GNU INET UTILS telnet Daemon, tracked as CVE202624061, allows attackers to bypass authentication and log in directly as root. The vulnerability carries a CVSS score of 9.8 out of 10 and affects all versions of GNU Inet Utils from 2015 through 2026. The issue stems from improper handling of the user environment variable. TelnetD passes user supplied values directly to the system login process without sanitization. A specially crafted value causes the login process to skip authentication entirely. The vulnerability was introduced by a code change in March 2015 and remained undetected until it was responsibly disclosed earlier this month. Threat intelligence shows active scanning and exploitation attempts already underway, originating from multiple countries. All observed sources have been flagged as malicious. Mitigations include disabling TelnetD entirely, restricting access to Telnet ports, and applying any vendor patches as Linux distributions release them Our third story brings a rare courtroom conclusion to a ransomware case, and it's an unusual one. A Russian national living in the United States has pleaded guilty to leading a ransomware operation that targeted at least 50 victims over a four year period. Iannis Alexandrovich Andropenko admitted to conspiracy to commit computer fraud and abuse, as well as conspiracy to commit money laundering. He faces up to 25 years in US prison, significant fines, restitution to victims and asset forfeiture. What sets this case is that Andropentico conducted many of his attacks while living openly in Florida and California. After his arrest in 2024, he was granted pre trial release, a rare decision in ransomware cases. Court records show repeated violations of his release conditions, including arrests related to substance abuse. Investigators linked his activity to multiple ransomware strains with confirmed losses of at least 1.5 million. Seized assets include millions in cryptocurrency, cash and luxury vehicles. Sentencing has not yet been scheduled. Our final story today highlights widespread credential exposure across the retail sector. A new industry report finds more than 70% of major retailers, nearly 60% of wholesalers, and over half of supply chain organizations have exposed login credentials visible online. Exposed credentials remain one of the most reliable entry points for attackers, enabling account takeover, lateral movement and supply chain compromise. Retail and wholesale organizations rely on large interconnected technology ecosystems, meaning a single compromised account can cascade across vendors, partners and logistics systems. The findings underscore persistent weaknesses in credential hygiene, password reuse and third party access management issues that continue to fuel breaches across the sector. I've been your host, David Shipley. That's the News for Friday, January 23rd. I'll be back on the news desk on Monday. If you enjoy the show, please tell others. Consider leaving a review and remember to like and subscribe. We'd love to continue to reach more people and we need your help. Thanks for listening.