← Cybersecurity Today
Cybersecurity Today
Mark's and Spencer Data Breach, Vulnerable Routers, Fortinet Exploits, and New Ransomware Threats
00:08:38
In this episode of Cybersecurity Today, host Jim Love covers recent cybersecurity incidents including a data breach at Mark's and Spencer, the FBI's alert on outdated routers being exploited, and critical Fortinet vulnerabilities actively used in...
Loading summary
Transcript1 lines
- [00:00]
Jim Love
Marks and Spencer confirms that customer personal data was accessed in a recent hack. The FBI warns of 13 outdated routers hijacked by hackers, Fortinet patches, a zero day in FortiVoice actively exploited in targeted attacks and joy o rapture unforeseen ransomware reaches the cpu welcome to Cybersecurity today. I'm your host, Jim Lof. Marks and Spencer has confirmed that hackers accessed personal customer data during a cyber attack that has disrupted its operations since late April. The breach, which occurred over the Easter weekend, compromised information including names, dates of birth, home and email addresses, phone numbers, household details and even online order histories. But importantly, Marks and Spencer stated that no usable payment card details were or account passwords were accessed. The attack has been linked to the cybercrime group Dragon Force, known for ransomware and extortion tactics. Marks and Spencer's online ordering systems remain offline and the company is not specified when services will resume. Customers are being prompted to reset their passwords as a precaution. And Marks and Spencer's advises vigilance against potential phishing attempts and emphasizes it will never request personal account information via unsolicited communications. The UK's National Cyber Security center is collaborating with Mark Spencer and law enforcement to investigate the incident. The old saying if it ain't broke, don't fix it might not apply to routers. It turns out that some of those old reliable Linksys routers may might be a significant security risk. The FBI has issued an urgent alert regarding 13 older router models being actively exploited by cybercriminals. These devices, primarily from Linksys Cradlepoint and Cisco, have reached their end of life and are no longer receiving security updates, making them vulnerable to malware attacks. For many larger companies, we would hope this wouldn't be an issue. Replacement should be done for any network device that is no longer supported. But for smaller companies or home offices this could be a real threat. So the Linksys E1200E2500, E1000, E4200, E1500E300E3200E1550WRT320N, WRT310N and WRT610N are are affected. From Cradlepoint, the E100 series is, and from Cisco, the M10 series. Hackers are exploiting these outdated routers using variants of the Moon malware. The malware allows attackers to gain unauthorized access, turning compromised routers into proxy nodes for malicious activity such as data theft and cyber attacks. Once infected, these routers can be controlled remotely, often without the owner's knowledge. Some signs of compromise might include unusual overheating, frequent Internet disconnections, unexpected changes in router settings, or appearance of unknown devices on your network. If you own one of the affected models, the FBI is strongly advising replacing it with a newer model that regularly receives security updates, but if not, at least ensure that you disable remote administration, access your router settings and turn off remote management features to at least try to prevent unauthorized access. Fortinet has issued a critical fix for a zero day vulnerability CVE 2025 32,756 affecting its 40 voice enterprise phone systems after confirming the flaw was actively exploited in real world attacks. The the vulnerability is a stack based buffer overflow that allows unauthenticated attackers to remotely execute code by sending specially crafted HTTP requests. Fortinet's product security team discovered the issue following the attacker's activities, including network scans, system crash log deletions to cover their tracks, and FCGI debugging being toggled on to log credentials from the system or SSH login attempts to the company has released patches and advises administrators to disable the HTTP or HTTPs administrative interfaces as a temporary mitigation. This is the latest in a string of critical security issues affecting Fortinet products. Last month, the Shadow Server foundation reported on 16,000 Internet exposed Fortinet devices that were compromised using a new simlink backdoor back that provides threat actors with read only access to sensitive files on now patched devices hacked in previous attacks. Earlier this year, Fortinet patched another vulnerability, CVE202524472, an authentication bypass flaw in Fort iOS and Forti proxy that allowed attackers to gain Super Admin access. The company has urged all customers to audit systems for signs of compromise and apply patches immediately. Organizations relying on 40 voice or other impacted Fortinet products, including 40 mail, 40 NDR, 40 recorder and 4D camera, should act quickly. The nature of the exploit and its confirmed use in the wild makes this vulnerability especially high risk for unpatched systems. And finally, a cybersecurity researcher has developed a proof of concept demonstrating that ransomware can be embedded directly into a computer's CPU via Micro Code updates, potentially bypassing all traditional security measures. Christian Beek, a senior director at cybersecurity firm Rapid7, created the POC inspired by a critical flaw in AMD's Zen processors. The flaw, previously identified by Google researchers, allows attackers to modify the RD RAND instruction, enabling the injection of custom microcode. Bics approach involves weaponizing microcode updates, a low level layer between hardware and machine code typically used by chip makers to fix bugs and improve CPU reliability to hide ransomware payloads within the processor itself. While microcode updates are generally exclusive to CPU manufacturers, Beak's research indicates that injecting custom microcode, although challenging, is actually feasible. His poc, which he has no plans to release publicly, demonstrates how such an attack could render traditional security technologies ineffective. As the malware operates beneath the software layer, the development underscores the evolving sophistication of cyber threats. Beak references the Black Lotus Boot kit known for compromising UEFI firmware and infecting systems protected by secure boot and as a precedent for such low level attacks. Additionally, leaked chat logs from the Conti Ransomware Group in 2022 revealed efforts to develop ransomware capable of installing directly into the UEFI firmware, highlighting a trend towards more persistent and stealthy malware. The ability to embed ransomware at the CPU level would represent a significant escalation in cyberattack capabilities, potentially allowing malware to survive system reboots, hardware replacements, and even software reinstalls. This research serves as a warning to both chip manufacturers and PC manufacturers about the need to address vulnerabilities at the hardware level and to develop defenses against such deeply embedded threats. And on that happy note, that's our show. We're always interested in your opinion and you can contact us at editorialechnewsday. You can find me on LinkedIn or if you're watching this on YouTube, you know what to do. Leave a comment under the video. I'm your host Jim Love. Thanks for listening.