Transcript
Dave Bittner (0:02)
You're listening to the CyberWire Network.
Chris Hare (0:04)
Powered by N2K.
Sponsor Voice (0:09)
This episode is brought to you by Indeed. We're driven by the Search for Better. But when it comes to hiring, the best way to search for a candidate isn't to search at all. Don't search. Match with Indeed. Use Indeed for scheduling, screening and messaging Search so you can connect with candidates faster. Listeners of this show will get a $75 sponsored job credit to get your jobs More visibility@ Indeed.com SBO terms and conditions apply.
Dave Bittner (0:40)
Ransomware, supply chain attacks and zero day exploits can strike without warning, leaving your business's sensitive data and digital assets vulnerable. But imagine a world where your cybersecurity strategy could prevent these threats. That's the power of the ThreatLocker zero trust endpoint protection platform. Robust cybersecurity is a non negotiable to safeguard organizations from cyberattacks. ThreatLocker implements a proactive, deny by default approach to cybersecurity, blocking every action process end user unless specifically authorized by your team. This least privilege methodology mitigates the exploitation of trusted applications and ensures protection for your organization. 2473655 IT professionals are empowered by Threat Locker Application Allow Listing, Ring Fencing, Network control and EDR solutions, enhancing their cybersecurity posture and streamlining internal IT and security operations. To learn more about how ThreatLocker can help mitigate unknown threats in your digital environment and align your organization with respected compliance frameworks, visit threatlocker.com Researchers ID a new Mirai based botnet Android devices get their first round of updates for the new year. Criminals exploit legitimate Apple and Google services in sophisticated voice phishing attacks. Japan attributes over 200 cyberattacks to the Chinese hacking group Mirror Face. A PayPal phishing scam exploits legitimate platform functionality. SonicWall addresses critical vulnerabilities in its Sonic OS software. CISA warns of active exploitation of vulnerabilities in Mitel mycollab, a new government backed labeling program hopes to help consumers choose more secure devices. On today's certbyte segment, Chris Hare and Steven Burnley unpack a question from N2K's ISC2 certif certified in cybersecurity Practice Test and streaming license plate readers. No password required. It's Wednesday, January 8, 2025. I'm Dave Buettner and this is your CyberWire Intel Brief. Thank you for joining us here once again today. Great to have you with us. Security researchers have identified a new Mirai based botnet offensively named Gay Femboy, which uses zero Day exploits to target industrial routers and smart home devices. Discovered by Quanxin XLab In February of 2024, the botnet evolved from a standard Mirai variant to a sophisticated threat. IT exploits over 20 vulnerabilities, including a zero day flaw in four faith routers and unassigned vulnerabilities in Niterbit routers and Weimar home devices. With about 15,000 active IPs across China, Russia, the U.S. iran and Turkey, the botnet launches frequent DDoS attacks, peaking in late 2024. Its targets span multiple sectors and even XLAB researchers were attacked after registering command and control domains for analysis. Lacking DDoS mitigation, XLAB eventually ceased their investigation to avoid further disruptions. Google has released its first Android security updates for 2025 addressing 36 vulnerabilities, including five critical remote code execution bugs in the system component. The Update, split into two parts, begins with fixing 24 issues in Android's Framework, Media Framework and System components. The critical RCE flaws affect Android versions 12 through 15. The second patch resolves an additional 12 vulnerabilities in Imagination Technologies, MediaTek and Qualcomm components, covering all 36 flaws. Google also patched a critical RCE bug in Pixel Devices baseband subcomponent. While there's no evidence of exploitation in the wild, Google urges users to update promptly. Android Automotive OS and Wear OS devices will also receive patches. Cybercriminals are exploiting legitimate Apple and Google services in sophisticated voice phishing attacks, as revealed by Krebs on Security. These scammers trick users into believing they're interacting with Apple or Google by sending notifications, emails, and account recovery prompts using spoofed identities. One case involved a cryptocurrency investor who lost $4.7 million after scammers used Google Assistant and fake recovery emails to deceive him. The scammers leveraged Apple's support line to generate legitimate account confirmation prompts, reinforcing their authenticity. A leaked phishing panel video demonstrates how scammers tricked a musician into revealing his Apple credentials. A phishing group dubbed Crypto Chameleon also targeted cryptocurrency exchanges and high profile individuals, including billionaire Mark Cuban, who lost $43,000 in crypto. These groups rely on leaked data, phishing kits, and tools like autodoczers to refine targets. Despite their innovation, internal betrayal and law enforcement remain persistent threats to these criminal operations. Japan has attributed over 200 cyber attacks since 2019 to the Chinese hacking group Mirror Face, targeting national security and advanced technology data. The attacks focused on the foreign and defense ministries, the space agency and private sector entities, using tactics like phishing emails, referencing geopolitical topics and exploiting VPN vulnerabilities. Notable incidents include breaches at JAXA and disruptions at Nagoya's port and Japan Airlines. Experts urged Japan to strengthen cybersecurity as it enhances defense cooperation with the US and allies elsewhere in Japan. Cassio confirmed a ransomware attack in October compromised the personal data of nearly 8500 individuals, including 6500 employees, 1900 business partners and 91 customers. Data exposed included names, email addresses and sensitive information like taxpayer IDs and birth dates. The Russia linked underground ransomware gang claimed responsibility, stealing over 200 gigabytes of data. Cassio attributed the breach to phishing and declined to negotiate with the attackers. While most systems are restored, some services remain offline. No credit card data was compromised. Fortinet's FortiGuard Labs has uncovered a sophisticated PayPal phishing scam exploiting legitimate platform functionality. Scammers use genuine looking emails with valid sender addresses to direct users to PayPal's login page under the guise of investigating a payment request. The attack leverages a Microsoft 365 test domain and distribution lists to send legitimate PayPal money requests, bypassing traditional phishing checks through Microsoft 365's sender rewriting scheme. Victims unknowingly link their PayPal accounts to the scammers, granting attackers potential control over finances. Unlike traditional phishing, this scam uses authentic emails and URLs, making detection harder. Fortinet's CISO Carl Windsor emphasized the need for vigilance, urging users to verify URLs, avoid unsolicited links, and enable two factor authentication. The scam highlights the critical role of cybersecurity awareness in protecting against increasingly sophisticated attacks. SonicWall has issued a security advisory addressing four critical vulnerabilities in its Sonic OS software, affecting various firewall models and cloud platforms. These include a weak pseudo random number generator, improper authentication in SSL vpn, a server side request forgery flaw, and Privilege escalation in Gen7 cloud platforms with CVSS scores ranging from 6.5 to 8.2. These vulnerabilities could allow attackers to bypass authentication, escalate privileges, or establish unauthorized connections. SonicWall urges immediate updates and limiting SSL VPN and SSH management access to trusted sources. No exploitation in the wild has been reported. CISA has warned of active exploitation of two vulnerabilities in Mitel MyCollab, the first a critical path traversal flaw with a CVSS of 9.8, the second a low severity issue with a score of 2.7. The critical bug allows unauthorized administrative actions, while the low severity flaw requires admin credentials and cannot modify files or escalate privileges. Mitel addressed the critical flaw and mitigated the other in MyCollab version 9.8 SP2. CISA urges organizations to patch by January 28, per federal mandates. To mitigate potential risks, the US government is launching the Cyber Trustmark Initiative, a voluntary labeling program to help consumers identify smart devices with robust cybersecurity protections. Devices like baby monitors, security cameras, fitness trackers, and smart appliances can carry the label if they meet federal cybersecurity standards. The label includes a shield logo and QR code for detailed security information, such as whether manufacturers provide software updates. Major brands like Amazon, Google and Samsung are participating with labeled products expected later this year. The initiative, led by the FCC and inspired by the Energy Star program, aims to inform consumers while encouraging manufacturers to improve device security. With the average home containing 21 connected devices, this program seeks to reduce vulnerabilities that cybercriminals could exploit. Coming up after the break on today's CertBytes segment, Chris Hare Stephen Burnley Unpack a question from N2K's ISC2 certified in cybersecurity practice test and streaming license plate readers. No password required. Stay with us.