Transcript
A (0:02)
You're listening to the Cyberwire network. Powered by N2K, the DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington, D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington, D.C. region is the beating heart of cyber innovation. Visit DMVrising.com to secure your spot. And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science in Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's CyberService Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. EDU MSSI the FTC warns one industry's online safety may be another's censorship A new bipartisan bill aims to reduce barriers to federal cyber jobs. Murky Panda targets government, technology, academia, legal and professional services in North America. MITRE updates their hardware weaknesses list Customs and Border Protection conducts a record number of device searches at US borders. A recent hoax exposes weaknesses in the cybersecurity community's verification methods. A Houston man gets four years in prison for sabotaging his employer's computer system. A Florida based provider of sleep apnea equipment suffers a data breach. Interpol dismantles a vast cyber criminal network spanning Africa. Brandon Karp shares his experience with fake North Korean job applicants and being a smooth talking English speaker can land you a gig in the cybercrime underworld. It's Friday, August 22, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. Happy Friday. The Federal Trade Commission warned US Tech companies that complying with European and UK online content rul could violate American law. FTC Chairman Andrew Ferguson said following foreign censorship efforts including the EU's Digital Services act and Britain's Online Safety act, may breach Section 5 of the FTC act, which prohibits unfair or deceptive practices. He argued Americans do not expect platforms to restrict speech to satisfy foreign governments and warned against weakening encryption protections. Ferguson cited British attempts to access Apple Icloud data as an example. The warning comes amid broader U.S. criticism of Europe's regulation of online speech. Ferguson invited tech executives to discuss how they'll balance global pressures with their legal obligations to American consumers. Lawmakers on the House cybersecurity subcommittee introduced the Cybersecurity Hiring Modernization act, aiming to reduce barriers to federal cyber jobs by prioritizing skills over degrees. Sponsored by Representative Nancy Mace, Republican from South Carolina, and Representative Chantel Brown, a Democrat from Ohio, the bipartisan bill seeks to expand the talent pool at a time of rising cyber threats. Mace said the bill would cut red tape and allow skilled applicants without four year diplomas to serve, while Brown called expanding the workforce imperative for secure systems. The bill directs the Office of Personnel Management to track and report changes to education requirements and collect data on new hires backgrounds. Agencies could still require degrees if mandated by law or if education is directly tied to job competencies. Since 2023, CrowdStrike has tracked murky Panda, a China linked cyber adversary targeting government, technology, academia, legal and professional services in North America. The group is highly cloud focused, conducting trusted relationship compromises and exploiting Internet facing appliances for initial access. They rapidly weaponize end day and zero day vulnerabilities including Citrix and Commvault flaws, and use tools like the Neo Rejorge, Web shell and their custom malware clouded hopefully to maintain persistence. Murky Panda has compromised SaaS, providers and Microsoft cloud solution partners to move laterally into downstream customers, often exfiltrating emails and sensitive documents. They employ strong operational security by altering logs and timestamps to avoid detection. CrowdStrike assesses their activity as espionage driven, aimed at intelligence collection, and warns that cloud heavy organizations remain especially vulnerable to these advanced operations. MITRE has released an updated CWE Most Important Hardware Weaknesses list, first published in 2021 to reflect evolving hardware security challenges. The 2025 version highlights 11 key weaknesses, including six new entries, while retaining five persistent flaws such as improper debug access and memory protection issues. Topping the list is CWE226 sensitive information in Resource Not Removed Before Reuse, which risks exposing data if memory or resources aren't properly cleared. MITRE stresses that hardware flaws propagate upward, limiting software and firmware mitigations. Customs and Border Protection is conducting record numbers of electronic device searches at US Borders, Wired reports. Between April and June of this year, officials search just under 15,000 devices, a 16.7% increase over the previous high in early 2022. CBP can inspect phones, laptops and cameras without a warrant, with searches divided into basic manual checks and more invasive advanced forensic extractions. Civil liberties advocates warn this unchecked authority has a chilling effect on travelers, including journalists and lawyers with sensitive data. Device searches have risen steadily over the past decade, from 8,500 in 2015 to over 46,000 in 2024. While CBP stresses searches affect less than 0.01% of travelers, critics say new investments in forensic tools may expand advanced inspections, raising further privacy concerns. A recent hoax has exposed weaknesses in how the cybersecurity community verifies information. A Telegram channel impersonating Europol announced a fake $50,000 reward for details on Keelin Ransomware, Oper Hayes and Xoracle. Many researchers and journalists initially reported the claim before Europol confirmed it was false. The imposters later admitted the stunt was designed to troll the community and highlight poor fact checking. The incident shows how easily misinformation can spread on platforms like Telegram and the risks of relying on unverified sources. While Europol quickly debunked the claim, the episode underscored the need for stronger verification practices, better communication from law enforcement and closer collaboration among journalists, researchers and officials to prevent future disinformation campaigns from misleading the cybersecurity ecosystem. A Houston man, Davis Liu, age 55, was sentenced to four years in prison and three years of supervised release for sabotaging his employer's computer systems, prosecutors said. Lou, longtime employee of Eaton Corporation, deployed malicious code in 2018 through 2019 after his role was reduced. He deleted co workers profiles, caused system crashes and created a kill switch named after himself that locked out thousands of users worldwide. The sabotage caused hundreds of thousands in damages. Lou faced up to 10 years and plans to appeal. CPAP Medical Supplies and Services, a Florida based provider of sleep apnea equipment, has disclosed a data breach affecting over 90,000 people, including US military members and families. Hackers accessed its systems in December 2024 for more than a week, potentially stealing Social Security numbers and protected health information. CPAP reported the breach to state authorities and hhs, but says there's no evidence of misuse. No ransomware group has claimed responsibility, raising speculation attackers may be avoiding publicity or that CPAP paid to Prevent data leaks. Interpol's Operation Serengeti 2.0 dismantled a vast cybercriminal network spanning Africa, leading to over 1200 arrests, the seizure of $97 million and the takedown of over 11,000 malicious infrastructures running from June through August of this year. The operation involved law enforcement from 18 African nations, the UK, private cybersecurity firms and nonprofits. Authorities estimate the network defrauded nearly 88,000 victims, causing $485 million in losses through ransomware scams and business email compromise. Highlights include dismantling illegal crypto mining centers in Angola, a $300 million investment scam in Zambia, and a multimillion dollar inheritance fraud in Cote Dilvore. Interpol praised growing global cooperation, noting the operation not only disrupted cybercrime but but also boosted prevention through partnerships like the Intercop Cybercrime Prevention Network. Coming up after the break, Brandon Karp shares his experience with fake North Korean job applicants and being a smooth talking English speaker can land you a gig in the cybercrime underworld. Stay with us. We've all been there. You realize your business needs to hire someone yesterday. How can you find amazing candidates fast? Well, it's easy. Just use Indeed when it comes to hiring Indeed is all you need. Stop struggling to get your job post noticed. Indeed's Sponsored Jobs helps you stand out and hire fast. Your post jumps to the top of search results so the right candidates see it first. And it works. Sponsored jobs on indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring. And here at N2K CyberWire, many of my colleagues here came to us through Indeed plus with Sponsored jobs. There are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data Worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility@indeed.com cyberwire just go to indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need. Foreign machine identities now outnumber humans by more than 80 to 1 and without securing them trust, uptime, outages and compliance are at risk. Cyber Arc is leading the way with the only unified platform purpose built to secure every machine identity, certificates, secrets and workloads across all environments, all clouds and all AI agents. Designed for scale, automation and quantum readiness, Cyber Arc helps modern enterprises secure their machine future. Visit cyberark.com machines to see how it is always my pleasure to welcome back to the show Brandon Karp, who used to be my boss.