Podcast Summary: Cybersecurity Today Host: Jim Love
Episode: Hijacker Scams, Ransomware Attacks, and Summer Travel Threats
Release Date: May 30, 2025

1. Introduction

In this episode of Cybersecurity Today, host Jim Love delves into the latest cybersecurity threats impacting businesses and individuals alike. The discussion encompasses sophisticated hijacker scams targeting law firms, significant data breaches in municipal systems, evolving ransomware tactics, essential backup strategies, and the surge in cyber threats during the summer travel season.

2. Hijacker Scams Targeting Law Firms

Jim Love opens the discussion by highlighting an FBI warning about an advanced scam targeting U.S. law firms. Cybercriminals, specifically the Luna Moth criminal group (also known as Silent Ransom Group or SRG), are exploiting the trust within organizations to perpetrate multimillion-dollar extortion schemes.

• Methodology:
  "Criminals posing as internal IT staff create fake help desk websites that look legitimate and use real remote access tools like Anydesk or Splashtop that companies actually use," explains Love. These tools are typically trusted within organizations, allowing scammers to bypass security software undetected.

• Evolution of the Scam:
  Initially leveraging callback phishing, Luna Moth has advanced their tactics by directly calling employees. According to Love, *"SRG will then direct the employee to join a remote access session either through an email it sends to them or navigating to a webpage" (05:30). Once access is granted, employees are misled into performing seemingly legitimate overnight tasks, facilitating the installation of malicious software.

• Financial Impact:
  "Luna Moth demands ransoms ranging from 1 million to $8 million, depending on the size of the company," notes Love, referencing data from cybersecurity firm Eclectic IQ. The high stakes are driven by the sensitive nature of legal data, making law firms prime targets.

• Red Flags and Prevention:
  The FBI advises organizations to watch for unsolicited IT support calls, suspicious emails about fake subscriptions, and unexpected requests to install remote access software. Reporting incidents promptly can aid in tracking and mitigating these threats.

3. Massive Data Breach in Sheboygan, Wisconsin

The podcast addresses a significant data breach incident in Sheboygan, Wisconsin, where hackers accessed sensitive information of approximately 67,000 residents.

• Incident Details:
  Love recounts, "Hackers breached the City's systems on October 31, 2024, with the Chort ransomware gang claiming responsibility in November," initially downplaying the extent of the breach. However, a later cybersecurity investigation revealed that personal data, including Social Security numbers and state IDs, was indeed compromised (12:15).

• Response and Impact:
  The city has since notified affected individuals and is offering one year of identity protection services. This breach not only affected Sheboygan's residents but also contractors and visitors, highlighting the widespread impact of such attacks.

• Chort Ransomware Group:
  Emerging in November 2024, Chort has targeted various governmental and educational institutions, demonstrating a pattern of attacking entities that manage sensitive data. Love emphasizes, "Initial assessments often underestimate the scope of data theft, leading to delayed and revised breach notifications months after the fact" (16:45).

• Non-Payment of Ransom:
  While Sheboygan officials have not explicitly stated they did not pay the ransom, indications suggest a refusal to negotiate, aligning with broader trends of non-payment to discourage ransom demands.

4. Ransomware Threat in Abilene, Texas

Abilene faces a looming ransomware threat from the Keelin ransomware group, which has compromised 47.7 gigabytes of municipal data.

• Attack Specifics:
  Keelin has set a ransom deadline of May 27 for Abilene to pay an undisclosed amount. Failure to comply could result in the public release of sensitive municipal information (20:10).

• Strategic Importance of Abilene:
  Selected for Project Stargate—the largest AI investment in U.S. history—Abilene's data centers are highly valuable targets, potentially attracting nation-state actors.

• Keelin's Tactics:
  "The group's previous attacks have exposed everything from personal records to internal communications," says Love, highlighting the comprehensive nature of their data theft.

• Protection Recommendations:
  Cybersecurity experts urge municipalities to bolster their defenses, develop robust incident response plans, and assume that attacks are inevitable to minimize potential damage.

5. The 32110 Backup Strategy: A Timely Reminder

Amid the rising threat of ransomware, Jim Love introduces the 32110 backup strategy as a critical defense mechanism.

• Breakdown of the Strategy:

  • 3 Copies of Critical Data: Ensure redundancy.
  • 2 Different Media Types: Prevent single points of failure.
  • 1 Offsite Copy: Protect against local disasters.
  • 1 Offline or Air-Gapped Backup: Safeguard against network-based attacks.
  • 0 Errors through Regular Testing: Validate backups to ensure integrity (25:00).

• Benefits:
  The layered approach of the 32110 strategy addresses various failure points inherent in basic backup systems. For instance, "Ransomware can infect network-connected backups, but it can't touch offline copies," explains Love, emphasizing the importance of isolating backup data.

• Implementation Challenges:
  Traditional backup methods, such as using a single USB drive, are inadequate against sophisticated attacks. The 32110 strategy requires a more comprehensive and proactive approach to data protection.

• Cost-Benefit Analysis:
  Investing in robust backup infrastructure is portrayed as essential survival planning, especially for organizations where downtime can result in significant financial losses.

6. Surge in Cyber Threats During Summer Travel Season

The episode concludes with an exploration of the unprecedented wave of cyber scams targeting summer travelers, driven by a surge in travel activities.

• Scope of the Threat:
  Pre Crime Labs reported over 7,500 fake travel domains registered in the first three months of 2025, targeting 86 major travel brands (28:30). The primary victims are vacationers planning summer getaways, with hotels and vacation rentals being the most targeted sectors.

• Advanced Scam Techniques:
  Scammers are no longer limited to phishing emails. They now employ AI-powered chatbots, fake mobile apps, and invitation-only booking platforms to deceive travelers. For example, "Some scammers registered 17 identical domains on the same day using AI generation algorithms," notes Love, illustrating the scale and sophistication of these operations.

• High-Value Vacation Targets:
  Religious pilgrimages like India's Maha Kumbh Mela and the Hajj Pilgrimage, along with luxury resort bookings, are prime targets. These events attract significant travel demand and, consequently, offer lucrative opportunities for scammers.

• Red Flags for Travelers:

  • Deals that seem too good to be true.
  • Websites with broken links or irrelevant content.
  • Booking platforms requesting unusual personal information or upfront payments for ancillary services.

• Protective Measures:
  Cybersecurity experts advise travelers to:

  • Book only through verified websites.
  • Avoid clicking on invitation codes from unknown sources.
  • Use unique passwords for each travel booking platform.

Notable Quotes:

• "Ransomware can infect network connected backups, but it can't touch offline copies." — Jim Love (25:45)
• "Lawyers are prime targets, likely due to the highly sensitive nature of the legal industry data." — Jim Love (04:20)
• "Scammers are particularly targeting high value vacations such as religious pilgrimages and luxury resort bookings." — Jim Love (29:15)

Conclusion

In this episode of Cybersecurity Today, Jim Love provides a comprehensive overview of current cybersecurity threats, emphasizing the need for robust defense mechanisms like the 32110 backup strategy and heightened vigilance during high-risk periods such as the summer travel season. By highlighting real-world incidents and evolving tactics of cybercriminals, the podcast serves as a crucial resource for organizations and individuals aiming to safeguard their data and digital identities in an increasingly perilous cyber landscape.