New Ransomware As A Service Threats: Cyber Security Today for March 10, 2025

Summary

Cybersecurity Today: New Ransomware As A Service Threats
Hosted by Jim Love
Release Date: March 10, 2025

---

Overview

In the March 10, 2025 episode of Cybersecurity Today, host Jim Love delves into the evolving landscape of ransomware threats, the resilience of cybercriminal operations, and emerging vulnerabilities in both hardware and artificial intelligence systems. The episode provides comprehensive updates on new ransomware groups, innovative attack vectors, critical hardware vulnerabilities, and the looming privacy concerns associated with agentic AI. Through expert analysis and insightful discussions, Love underscores the necessity for robust cybersecurity measures in an increasingly risky digital environment.

---

1. Emergence of Spear Wings: Filling the Void Left by Noberis and Lockbit

Jim Love opens the episode by addressing recent disruptions in the ransomware as a service (RaaS) ecosystem. Following the takedowns of major players like Noberis and Lockbit by international law enforcement, a new group named Spear Wings has rapidly emerged to fill the resulting void.

• Growth and Operations:
  Spear Wings leverages the Medusa malware to execute extensive cyberattacks. Since its inception in early 2023, the group has expanded swiftly, now listing nearly 400 victims on its data leak site with ransom demands ranging from $100,000 to $15 million. "Attacks surged by 42% between 2023 and 2024, with the trend persisting into 2025," Love notes (05:30).

• Operational Model:
  There is ongoing debate about whether Spear Wings operates strictly as a RaaS entity, renting out its software and fulfillment services to other attackers. Their consistent tactics suggest either a centralized operational model or tight collaboration with a limited number of affiliates. This raises questions about the scalability and autonomy of their operations.

• Attack Methodologies:
  Spear Wings predominantly gains initial access by exploiting unpatched vulnerabilities in publicly facing applications, particularly Microsoft Exchange servers. Once infiltrated, they employ remote management tools such as Simple Help, Anydesk, and Mesh Agent to maintain persistent access and facilitate lateral movement within networks.

  A notable tactic employed by Spear Wings is the "bring your own vulnerable driver" approach. This involves deploying signed yet inherently vulnerable drivers to disable security software, thereby evading detection systems. Their attacks span various sectors, including healthcare, finance, and government organizations.

• Double Extortion Strategy:
  Spear Wings utilizes a double extortion strategy, where they first exfiltrate sensitive data before encrypting systems. This dual-threat approach puts immense pressure on victims to comply with ransom demands, as failure to do so results in the public release of stolen data on their leak site.

• Implications and Insights:
  The rise of Spear Wings underscores the resilience and adaptability of ransomware operations. Love emphasizes, "As much as we can applaud successes for international law enforcement, we can never really let our guard down" (15:45). He further argues that as long as ransomware remains profitable, new groups will continue to emerge, suggesting that outlawing ransom payments might be a necessary measure to disrupt this lucrative business model.

---

2. Akira Ransomware Group's Innovative Use of Unsecured Webcams

The episode transitions to the Akira Ransomware group, which has pioneered a novel attack method to bypass traditional security measures:

• Initial Access and Evasion:
  Akira gains access to target networks through exposed remote access solutions, deploying Anydesk for persistent access and data exfiltration. When traditional endpoint detection and response (EDR) systems detect and quarantine ransomware payloads on Windows servers, Akira adapts by seeking alternative entry points.

• Exploiting IoT Devices:
  The group identifies Internet of Things (IoT) devices such as webcams and fingerprint scanners that lack robust security measures. They exploit vulnerabilities in these devices, particularly those running Linux-based operating systems compatible with Akira's Linux ransomware variant.

• Execution Technique:
  To circumvent EDR protections, Akira mounts Windows Server Message Block (SMB) network shares of the organization's devices onto the compromised webcam. They then execute the Linux encryptor directly from the webcam, successfully encrypting files across the victim's network without detection. Love highlights the sophistication of this method: "Devices are often not monitored by the security team. If we needed a wake-up call to get the US to secure IoT devices within our networks, this has got to be it" (22:10).

• Recommendations:
  Addressing such sophisticated attack vectors requires implementing network segmentation, conducting regular security audits of connected devices, and ensuring continuous monitoring. Love stresses the importance of comprehensive security strategies that encompass all network-connected devices, as the traditional separation between systems is becoming obsolete.

---

3. Vulnerabilities in ESP32 Microcontrollers Expose Global IoT Devices

Next, Love discusses a significant hardware vulnerability discovered in ESP32 microcontrollers, widely used for Wi-Fi and Bluetooth connectivity in over a billion devices globally.

• Research Findings:
  Spanish researchers from Tarlogic Security presented their findings at Rooted Con in Madrid. They uncovered undocumented commands in the ESP32 chip that could allow attackers to spoof trusted devices, access unauthorized data, and potentially establish persistent control over affected systems.

• Implications:
  Given the ESP32 chip's prevalence in numerous IoT devices, this vulnerability poses a substantial threat. Compromised devices could serve as entry points for broader network intrusions, making it imperative for manufacturers to scrutinize and disclose all functionalities within their hardware components.

• Mitigation Strategies:
  To address these vulnerabilities, Love recommends firmware updates that disable unused features, segmenting IoT devices within networks, and advocating for independent and rigorous security assessments by purchasers. He commends the researchers, stating, "Hats off to these researchers" (30:25).

---

4. Privacy and Security Risks of Agentic AI

In the final segment, Love brings attention to warnings issued by Signal President Meredith Whitaker regarding the privacy and security risks associated with agentic AI—AI systems capable of performing tasks autonomously without direct user input.

• Concerns Raised:
  Whitaker emphasizes that while agentic AI promises enhanced convenience, it requires extensive access to personal data, including browsing histories, credit card details, calendars, and messaging apps. She warns that these AI-powered assistants typically process sensitive information in the cloud, heightening the risk of data breaches and unauthorized access.

  Whitaker states, "People might think they're just getting a helpful assistant, but they are actually signing up for pervasive data collection" (37:50).

• Integration with Secure Platforms:
  Integrating AI tools into secure messaging platforms like Signal could undermine privacy protections by granting these assistants access to encrypted conversations. This integration poses a fundamental challenge to maintaining user privacy.

• Expert Opinions:
  AI pioneer Yoshua Bengio echoes Whitaker's concerns, cautioning that the rapid development of artificial general intelligence (AGI) could introduce further security vulnerabilities if not properly regulated. Both experts advocate for stronger oversight of AI development to prevent widespread privacy erosion.

• Advocacy and Recommendations:
  Love highlights that privacy advocates warn users may inadvertently sacrifice their digital autonomy in exchange for the convenience offered by automation. He underscores the need for balanced regulation to ensure that advancements in AI do not compromise individual privacy and security.

---

Conclusion

Jim Love concludes the episode by reiterating the persistent and evolving nature of cybersecurity threats. Despite significant strides by law enforcement in disrupting major ransomware groups, the emergence of new entities like Spear Wings and innovative attack methods from groups like Akira demonstrate that the threat landscape remains highly dynamic. Additionally, hardware vulnerabilities and the integration of AI into everyday applications introduce new vectors for potential exploitation.

Love emphasizes the importance of comprehensive and adaptive cybersecurity strategies, including regular updates, rigorous security assessments, network segmentation, and vigilant oversight of emerging technologies. As the digital realm continues to expand, staying informed and proactively addressing vulnerabilities is paramount to safeguarding sensitive data and maintaining operational integrity.

For further insights, listeners are encouraged to reach out with comments, questions, or tips at [e-mail].

---

Notable Quotes:

• "Attacks surged by 42% between 2023 and 2024, with the trend persisting into 2025." — Jim Love (05:30)
• "As much as we can applaud successes for international law enforcement, we can never really let our guard down." — Jim Love (15:45)
• "Devices are often not monitored by the security team. If we needed a wake-up call to get the US to secure IoT devices within our networks, this has got to be it." — Jim Love (22:10)
• "People might think they're just getting a helpful assistant, but they are actually signing up for pervasive data collection." — Meredith Whitaker (37:50)
• "Hats off to these researchers." — Jim Love (30:25)

---

Note: Timestamps are indicative and based on the transcript provided.

Transcript

[Jim Love]

Hi. We have to have the talk. While our audience keeps growing, we continue to lose money on the podcasts. Why? Let's be honest. We suck at selling advertising. We don't turn it down, but we don't really work at selling it because in many ways we find we were always worried about whether it'll compromise our integrity, and it takes time that we could spend on the programming. So we've decided to see how much our audience wants these programs. And we're asking you, would you consider the equivalent of buying us a cup of coffee every month? If even a fraction of our audience did that, we'd have enough revenue to keep going and even expand some of our services. Now, I don't want to turn these podcasts into an NPR like begging for dollars any more than I want to fill them with ads. So I'm going to ask you today to go out to buymeacoffee.com techpodcast that's buymeacoffee.com TechPodcast and consider giving us like 5 bucks a month Canadian. If enough of you do that over the next day or so, we'll have enough money to keep going. That's it. Thanks a lot. We appreciate your listenership and we want to keep the program going. So. Buymeacoffee.com techpodcast and now back to our regularly scheduled programming. A new ransomware as a service group fills the void created by law enforcement takedowns. Researchers discover a back door in a popular Bluetooth chipset and signals president sounds the alarm on AI agents. This is Cybersecurity today. I'm your host, Jim Love. Recent successes by law enforcement have disrupted some of the big players in the ransomware as a service world, with Noberis and Lockbit being two of the biggest. But the void left by these players has been rapidly filled by new groups, including Spear Wings. Ransomware is a service leveraging the Medusa malware to conduct extensive cyber attacks. Since its inception in early 2023, Spearwing has rapidly expanded its operations, listing nearly 400 victims on its data leak site and demanding ransoms ranging from $100,000 to $15 million. Recent analysis indicates a significant uptake in Medusa ransomware incidents. Attacks surged by 42% between 2023 and 2024, with the trend persisting into 2025. Notably, the first two months of 2025 have already seen over 40 attacks, nearly doubling the figures from the same period in 2024. There is, however, some question about whether Spearwing really is a ransomware as a service operation. Renting its software and fulfillment to other attackers. The questions are raised because of the operations, the way they exhibit consistent tactics, techniques and procedures, which suggests either a centralized operational model or a very tight collaboration with a limited number of affiliates. The group primarily gains initial access by exploiting unpatched vulnerabilities in public facing applications, especially liking Microsoft Exchange servers post infiltration. They employ remote management tools like Simple Help, Anydesk and Mesh Agent for persistent access and lateral movement. A notable tactic is the bring your own vulnerable driver approach, where attackers deploy signed yet vulnerable drivers to disable security software, thereby evading detection. Spearwings attacks span various sectors, including health care, finance and government organizations. The group employs a double extortion strategy, exfiltrating sensitive data before encrypting systems to pressure victims into paying ransoms. Failure to comply results in the public release of stolen data on their leak site. The rise of Spearwing underscores the resilience of the world of ransomware, where major takedowns of large groups provide opportunities for emerging groups to fill the void. So as much as we can applaud successes for international law enforcement, we can never really let our guard down. Making the case for those who say that maybe paying ransoms should be outlawed because as long as there's a profit to be made, there will be groups to fill any void created so that even big victories by law enforcement will be short lived. The Akira Ransomware group has demonstrated a novel attack method by leveraging an unsecured webcam to circumvent endpoint detection and response, or EDR systems, leading to the successful encryption of a victim's network. Initially, Akira gained access to target networks through an exposed remote access solution, deploying the Anydesk remote management tool for persistent access and data exfiltration. Subsequent attempts to deploy ransomware on Windows servers are often thwarted by the organization's edr, which detects and quarantines the malicious payload. But undeterred, the attackers are scanning the networks for alternative entry points and identified several Internet of Things devices, including webcams and fingerprint scanners that lack adequate security measures. They then go on to exploit these vulnerable webcams running a Linux based operating system compatible with with Akira's Linux ransomware variant. To bypass EDR protections using webcam vulnerabilities, Akira has mounted Windows Server Message Block network shares of the organization's devices onto the webcam. Then they executed the Linux encryptor from the webcam, encrypting files across the victim's network without detection. Devices are often not monitored by the security team. If we needed a wake up call to get US to secure IoT devices within our networks, this has got to be it. Unmonitored and unpatched devices serve as backdoors for attackers to bypass traditional security measures. Implementing Network Segmentation Regular security audits of connected devices and continuous monitoring are essential steps to mitigate such sophisticated attack vectors, but any perceived separation between systems is a thing of the past. We need comprehensive security strategies that include all network connected devices. Security researchers have uncovered undocumented commands in the ESP32 microcontroller, a widely used chip enabling WI Fi and Bluetooth connectivity in over a billion devices globally. Manufactured by espressif, the ESP32's hidden functions could allow attackers to spoof trusted devices, access unauthorized data, and potentially establish persistent control over affected systems. Spanish researchers from tarlogic Security presented their findings at Rooted Con in Madrid. They demonstrated that exploiting these undocumented commands could enable adversaries to impersonate legitimate devices and bypass audit controls, thereby infecting critical systems. The ESP32 chip is integral to numerous Internet of Things devices, making this vulnerability particularly concerning. Compromised devices could serve as entry points for broader network intrusions, highlighting the necessity for manufacturers to scrutinize and disclose all functionalities within their hardware components. Once again, firmware updates disabling unused features above all, segmenting IoT devices are key steps to follow, but overall there is a critical need for vendors to improve hardware design and for purchasers to demand independent and rigorous security assessments. Hats off to these researchers. And finally, Signal President Meredith Whitaker has issued a stark warning about the privacy and security risks associated with agentic AI AI systems capable of performing tasks autonomously without direct user input. Whitaker emphasized that while these AI agents promise convenience, they require extensive access to personal data, including browsing histories, credit card details, calendars, and messaging apps. She raised concerns that these AI powered assistants would likely process sensitive information in the cloud, increasing the risk of data breaches and unauthorized access. Whitaker also warned that integrating such AI tools into secure messaging platforms like Signal could fundamentally undermine privacy protections by granting them access to encrypted conversations. People might think they're just getting a helpful assistant, but they are actually signing up for pervasive data collection. AI pioneer Yoshua Bengio echoed these concerns, cautioning that the rapid development of artificial general intelligence could introduce further security vulnerabilities if not properly regulated. Both experts underscored the need for stronger oversight of AI development to prevent widespread privacy erosion. And as companies race to develop AI assistants capable of handling complex tasks. Privacy advocates warn that users may be unknowingly sacrificing their digital autonomy in exchange for automation. And that's our show for today. You can reach me with comments, questions or [e-mail]. i'm your host, Jim Love. Thanks for listening.