← Cybersecurity Today
Cybersecurity Today
Scattered Spider Targets US Insurance, Microsoft Zero-Day, Major Database Breach, and AI Poison Pill
00:11:14
In this episode, host Jim Love delves into recent cybersecurity threats and breakthroughs. The notorious Scattered Spider hacker group has shifted its focus to US insurance companies after attacking UK retailers earlier this year. Microsoft's...
Loading summary
Transcript1 lines
- [00:00]
Jim Love
A notorious hacker group Scattered Spiders now hunting US Insurance companies Microsoft urges immediate Windows updates After confirming an active zero day attack. A mystery database exposes 184 million passwords and a musician strikes back at AI companies with an audio poison pill that sabotages the AI. This is cybersecurity Today. I'm your host Jim Love. The cyber criminals behind some of the year's biggest retail breaches have found their next target American insurance companies. Google's Threat Intelligence team is warning that the notorious Scattered Spider group has shifted focus to the insurance sector after devastating UK retailers. John Holtquist, the chief analyst at Google Threat Intelligence Group, told Bleeping Computer, we are now seeing incidents in the insurance industry. The insurance industry should be on high alert. Here's what makes Scattered Spider particularly dangerous. They hunt sector by sector. After systematically targeting UK retailers like Marks and Spencer, Co Op and Harrods earlier this year, they've now crossed the Atlantic to focus on U.S. insurance firms. The group's signature move is sophisticated social engineering attacks that bypass even mature security programs. They typically target help desk and call center employees using aggressive language and impersonation tactics to trick workers into providing access credentials or resetting authentication. Once inside, Scattered Spider, also known as Octopus, UNC3944 and several other aliases, deploys ransomware, including Ransom Hub, Keelin and Dragon Force. In the final stages of their attacks, Google recommends insurance companies immediately review their help desk authentication procedures, educate employees about social engineering tactics, and implement rigorous identity controls for password resets and multi factor authentication registration. The sector focused hunting pattern means this threat is far from random. It's a coordinated campaign targeting an industry that holds a vast amount of sensitive customer data. Microsoft is urging Windows users to install security updates immediately after confirming attackers are actively exploiting a zero day vulnerability that enables complete system takeover. The company's June patch Tuesday addresses 66 vulnerabilities, including CVE2025 33053, a flaw in Windows WebDAV that Microsoft confirms is under active attack. Attackers can execute malicious code when users click on specially crafted URLs. More concerning is CVE2025 33 073, a Windows SMB vulnerability with public proof of concept code already available. This flaw allows attackers to gain system level access over networks without any user interaction, making it especially dangerous, according to security researchers. Both vulnerabilities grant complete control over vulnerable systems. The SMB flaw is particularly worrying since SMB is a core Windows protocol used for file sharing across virtually all Windows networks. The Update package includes 10 critical vulnerabilities total affecting Windows, SharePoint and Office applications. Security experts emphasize immediate deployment given in the combination of active exploitation and publicly available attack code. Cybersecurity firm Action One warns, given the high privilege level and ease of exploitation, this flaw poses a significant risk to Windows environments. Updates are available through Windows Update for all supported Windows versions, including Windows 10, Windows 11, and Windows Server editions. Cybersecurity researchers have discovered an unprotected database containing over 184 million records, including email addresses, passwords and login credentials stored in plain text, with no clear indication of who owns the compromised data. Researcher Jeremiah Fowler found the exposed database in May, revealing credentials tied to major platforms including Apple, Google, Facebook and Microsoft, along with government and financial services. What makes this breach particularly concerning is the complete lack of identifying information about the database's origin. Fowler told Wired magazine that as far as the risk factor here, this is way bigger than most of the stuff I find because this is direct access into individual accounts. This is a cybercriminal's dream working list. In a sample of 10,000 records, Fowler identified compromised accounts from Netflix, PayPal, Amazon and Apple. A keyword search revealed 187 mentions of bank and 57 references to wallet, suggesting extensive financial exposure. And perhaps Most alarmingly, were 220 email addresses from.gov domains, raising potential national security implications. Unlike typical data breaches, where researchers can trace the source through company identifiers or employee records, this database contain no breadcrumbs indicating ownership. The mystery surrounding its origin makes it impossible to notify affected users or assess the full scope of exposure. The breach highlights broader cybersecurity vulnerabilities as attacks become more sophisticated. Security experts recommend immediate password changes, particularly for financial and email accounts. Users should always avoid password reuse across multiple platforms and enable multi factor authentication wherever it's available. Credit monitoring services suggest freezing credit files with all three major bureaus as an additional protective measure. The timing of this discovery underscores growing concerns about data security as cybercriminals increasingly target large scale credential databases for identity theft and financial fraud. Now, I normally don't do much cross posting between our tech news podcast hashtag trending, but this story has some implications we might want to start to think about. And as many of you might know, I'm also a musician, so it has an incredible interest as well. A professional musician who stopped releasing music after AI companies scraped his work without permission has developed a technological weapon to fight back. And he's not just protecting his own tracks. Beardley Jordan, who says he made A living as an independent musician for 25 years and watched tech companies train models on his copyrighted music and then generate inferior versions associated with his name, has responded by creating poisonify, an encoding method that not only makes music untrainable by AI, but actively degrades entire data sets. The technology works by embedding adversarial noise that's inaudible to humans but catastrophic for machine learning algorithms. When Jordan tested his Poison tracks on major AI music generators like Suno and Minimax Audio, the results were devastating. Systems either crashed entirely or produced what he describes as nightmare fuel. But Jordan's counterattack goes far beyond music protection. His demonstrations show that the same techniques can hijack voice assistants, making them respond to phantom commands hidden in classical music, or at one point tricking content classification systems into believing that explicit audio. And explicit is exactly what you think it is, is Christian folk music. Working with the University of Tennessee researchers, Jordan combined his approach with Harmony Cloak, another sabotage method that breaks AI's ability to detect melody and rhythm. The combination creates a feedback loop that makes AI models progressively worse at their jobs. And now Jordan is weaponizing his technique for widespread deployment. He's partnering with Symphonic Distribution to potentially offer their encoding as a service for other musicians, allowing artists to poison their uploads to streaming platforms automatically. Jordan is also employing psychological warfare. He's randomly encoding his music with real poison, fake poison, or no encoding at all, refusing to reveal which tracks contain what. This prevents AI companies from developing countermeasures. Artists may soon have a way to push back using technology without having to depend on copyright or IP laws. Jordan said artists may soon have a way to push back using technology without having to depend on copyright or IP laws, because those things have utterly failed us. After years of feeling powerless against venture capital funded AI companies, musicians now have a technological tool that fights fire with fire. There's a link to the YouTube video if you want to watch it. It's in the show notes at Tech Newsday ca under podcasts. We know that there's a resentment and a backlash that is possible against AI. And I'm not saying I support it, but I do understand how people can feel that way, especially if they're losing their income or career. So why is this valuable for a cybersecurity podcast? Well, while we normally concentrate on ways in which cyber crooks will attack systems, we may also have to prepare ourselves to deal with a sabotage of systems from activists who feel that AI needs to be opposed. And the unique ways of poisoning an AI are not the types of things we normally think of, but as this story points out, they're very real and could be a very big problem. And that's our show. Love. To hear what you think, you can reach me at editorialechnewsday ca. Or if you're watching this on YouTube, no need to poison anything. You can just drop a message into the comments. I'm your host, Jim Love. Thanks for listening. If you like the podcast, please tell a friend, send them a copy. And if you'd like to support the podcast, you can go to buymeacoffee. Com techpodcast. That's buymeacoffee. Com techpodcast. And well, buy me a coffee. I'm your host, Jim Love. Thanks for listening.