Loading summary
Dave Bittner
You're listening to the Cyberwire network, powered by N2K. And now a brief message from our sponsor, DropZone AI. Is your SoC drowning in alerts? With legitimate threats sitting in queues for hours or even days? The latest SANS SOC survey report reveals alert fatigue and limited automation are SOC Team's greatest barriers. Drop Zone AI, recognized by Gartner as a cool vendor, directly addresses these challenges through autonomous recursive reasoning investigations, quickly eliminating false positives, enriching context, and enabling analysts to prioritize real incidents faster. Take control of your alerts and investigations with DropZone AI. A phishing campaign targets nearly 12,000 GitHub repositories the BlackLock ransomware group is one to watch. A federal judge orders reinstatement of workers at CISA. Over 100 car dealership websites suffer a supply chain attack and Hellcat breaches. Jaguar Land Rover researchers uncover a major vulnerability affecting RSA encryption keys. A life Insurance Co. Notifies 355,000 individuals of a December 2024 data breach. A researcher releases a decryptor for Akira Ransomware. A new mapping database aims to help NGOs and high risk individuals find security tools. Tim Starks from cyberscoop joins me with news that trade groups worry over renewal of a vital cyber law and a fundamental shift of our understanding of hash tables. It's Monday, March 17, 2025. I'm Dave Pittner and this is your Cyberwire Intel Brief. Thanks for joining us here today. Happy St Patrick's Day for those who celebrate. It is always great to have you with us. A phishing campaign has targeted nearly 12,000 GitHub repositories with fake security alert issues, tricking developers into authorizing a malicious OAuth app called Git Security App. The fake alerts claim suspicious activity was detected from Iceland, urging users to update passwords and enable two factor authentication. However, all links lead to an OAuth authorization page that grants attackers full access to repositories, user profiles, discussions and workflows. The attack, first spotted by researcher Luke4M, is ongoing, though GitHub appears to be responding. Users who mistakenly authorize the app should revoke access in GitHub settings, check for unexpected GitHub actions, and rotate credentials. The malicious campaign directs stolen credentials to sites hosted on Render. Developers should remain vigilant against such phishing attempts. The Blacklock Ransomware Group has attacked over 40 organizations in early 2025, making it one of the most active ransomware as a service operators targeting construction, real estate, IT service providers and government agencies. The group employs fast encryption and leak sites for extortion using Golang for cross platform attacks. Blacklock leverages ChaCha20 and RSA OAEP encryption emerging from the rebranded Eldorado Group. It recruits key players known as traffers to aid attacks. Organizations should enhance their cybersecurity measures to combat this growing ransomware threat. A US federal judge temporarily blocked the Trump administration's effort to fire thousands of federal employees, including over 400 from the Department of Homeland Security and 130 from the Cybersecurity and Infrastructure Security Agency. Judge James Breidar ordered reinstatement by March 17, pending a lawsuit by 20 state attorneys general. Concerns over cybersecurity and national security have emerged, with experts warning that mass layoffs weaken defenses. The White House called the rulings judicial overreach. DHS contractors like penetration tester Christopher Chenoweth reported terminations affecting Red Team operations. CISA denied laying off its Red Team, stating contract changes were made for efficiency. The Office of Personnel Management and the Department of Government Efficiency have not commented on the firings. Over 100 car dealership websites were compromised in a supply chain attack after threat actors infected LES Automotive, a shared video service. The attackers deployed the click fix technique, tricking users into executing malicious commands via fake recaptcha prompts. This method, increasingly used by cybercriminals, has spread information stealers and malware. Security researcher Randy McCoyne found the attack distributing Secto Rat via PowerShell. The injected JavaScript contained Russian comments suggesting dynamic script manipulation. Microsoft recently warned of similar attacks in hospitality. Elsewhere in the automotive world, the Hellcat ransomware group breached Jaguar Land Rover using stolen Atlassian in JJIRA credentials, exposing 700 internal documents and employee data on hacking forums. The threat actor Ray claimed responsibility, while another hacker, Apts, leaked an additional 350GB of sensitive data. The stolen information includes development logs, tracking data and proprietary source code, raising concerns over intellectual property theft and potential targeted attacks. Hellcat, known for exploiting JIRA vulnerabilities, has previously targeted Telefonica and Schneider Electric. Experts urge organizations to enforce multi factor authentication and credential rotation to prevent similar breaches. Security researchers have uncovered a major vulnerability affecting RSA encryption keys, with approximately 1 in 172 online certificates susceptible to compromise due to poor random number generation. Key Factor security analyzed over 75 million RSA certificates, finding 435,000 vulnerable due to shared prime factors allowing attackers to break encryption using simple greatest common Divisor calculations. IoT devices are particularly at risk, with 50% of compromise keys linked to a major network equipment manufacturer. Despite warnings, many devices still use weak RSA keys, posing threats to critical systems like medical equipment and industrial controls. Researchers urge manufacturers to improve entropy sources and follow cryptographic best practices to mitigate risks. New Era Life insurance companies is notifying 355,000 individuals of a December 2024 data breach, the largest health data breach reported by a health plan this year. The Texas based insurer discovered unauthorized access between December 9th and 18th of last year, during which sensitive personal and health data, including names, insurance IDs and medical details was copied. Some Social Security numbers were also compromised. The company is offering free credit monitoring and enhancing security measures. Several law firms are investigating potential class action lawsuits. Security researcher Johannes Nugroho released a decryptor for the Linux variant of Akira ransomware, leveraging GPUs to brute force encryption keys. Akira generates keys using timestamp based seeds, making decryption difficult but not impossible. Nigroho used cloud based RTX 4090 GPUs to crack the keys in about 10 hours. His tool, available on GitHub, allows free file recovery, though its effectiveness may vary. Users are advised to back up encrypted files before attempting decryption, as errors could cause data corruption. A global nonprofit named Common Good Cyber has launched a mapping database to help NGOs and high risk individuals find security tools. The database, featuring 334 Public Interest Security Services, is categorized into six Govern, Identify, Protect, Detect, Respond and Recover. Supported by the UK FCDO and the EU Institute for Security Studies, the initiative aims to improve CyberSecurity for over 10 million NGOs worldwide. Cyber threats against nonprofits are rising, with 32% of charities reporting incidents in 2024. Past attacks include breaches at free cycle and maternal and family health services. Common Good Cyber, founded by the Global Cyber alliance, stresses that cybersecurity should be accessible to all. The UK's NCSC has also issued guidance for charities emphasizing the sector's vulnerability to digital threat. Coming up after the break, Tim Starks from cyberscoop joins me with news that trade groups worry over renewal of a vital cyber law and a fundamental shift in our understanding of hash tables. Stay with us. We've all been there. You realize your business needs to hire someone yesterday. How can you find amazing candidates fast? Well, it's easy. Just use Indeed when it comes to hiring, indeed is all you need. Stop struggling to get your job post noticed. Indeed. Sponsored Jobs helps you stand out and hire fast. Your post jumps to the top of search results so the right candidates see it first. And it works. Sponsored jobs on Indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring here at N2K CyberWire. Many of my colleagues here came to us through Indeed. Plus with sponsored jobs. There are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility@indeed.com cyberwire just go to indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need. Do you know the status of your compliance controls right now? Like right now? We know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off. It is always my pleasure to welcome back to the show Tim Starks. He is a senior reporter at cyberscoop. Tim, it's great to have you back.
Tim Starks
Yeah. It's been a minute. Hi, Dave.
Dave Bittner
It has. And speaking of being a minute, it feels like stories are coming at us a mile a minute. You know, your beat is Washington D.C. and all the goings on there. You wrote a story recently about some trade groups who were worrying about information sharing without some critical infrastructure, without a panel, but also some stuff having to do with cisa. Can you unpack that for us?
Tim Starks
Yeah. Two different things, but related. One of the things that's happened in the Trump administration that some people would consider hasty, one of one of a few is that they got rid of a host of DHS advisory panels, one of which happened to be a panel focused on critical infrastructure protection, that wasn't just advisory. It actually had some legal authorities that protected communications between the government and industry sectors and industry sectors between themselves. Also at this one particular panel, they got rid of it. And a bunch of the trade groups were like, wait, wait, wait, wait. We need that. That's good. There was some sympathy to say, okay, sure, you can get rid of some advisory panels. There are an awful lot of them. Maybe if you get rid of this, you can replace it with something else. So there's a little bit of conciliatory. But the gist was this is really. And we need it. The other thing related in both of these things without they say information sharing on cyber will really decline is the. I used to call it the OG CISA, but everybody's been calling it the 2015 CISA. So I just. But it's a cybersecurity information sharing act that is expiring later this year, and that provides even stronger legal protections for communications, I mean, protections against lawsuits, antitrust exemptions, stuff that is the foundation of a lot of other information sharing that goes on in the federal government on cyber. And it's not clear what the path is for that bill. But the trade groups were making the argument, we need these things, otherwise we're going to suffer. We're not going to be sharing as much information between ourselves. We're not going to be sharing as much information with the government, and vice versa.
Dave Bittner
Well, speaking of cisa, the administration has named their nominee for new CISA director. I think it's nice to see that he comes to the nomination with some credentials.
Tim Starks
Yeah, this is, you know, there are probably too many cyber Seans in the world between Sean Plankey, who's the pick for sissa, Sean Cairncross, who was the pick for Office of National Cyber Director, and that. Okay. Reporter for cnn, Shawn Lingus. The idea, though, is that if you look at Sean Cranecross, you and I discussed this nomination, you could be concerned that he has no cyber experience. None. Maybe he's touched it here and there, but no major cyber experience. Sean Planke has a deep resume on cyber private sector most recently, but he's worked at the nsc, he's worked on cyber at Cyber Command, he's worked the Department of Energy, he's worked at the Coast Guard. I mean, he worked at the Navy on cyber. Like, the guy has a lot, a lot of experience. And if you were, you know, worried about a lot of the things that are happening in the Trump administration on cyber being so off the path of what we're used to. He is someone who, you know, seems to be loyal to the Republican agenda and the Trump agenda, but at the same time has, has deep credentials. And that's a little, that's a little different in some cases. I mean, if you look at some of the other nominees, you have people who, who don't understand the definitions of the terms of the things that they're going to be running the agency for. This guy's, this guy's going to know what, what, what's going on. He's going to understand the issues big time.
Dave Bittner
Well, I, I thought, you know, in light of that. And then also we just recently saw, I believe it was DHS said, please don't fire cyber security people in your cuts.
Tim Starks
Right, yeah. That said that DHS might have said it as well, but I saw that OMB had said that.
Dave Bittner
Okay, okay. Yeah. But just that message, is this a walk back? You know, is this a realization as the feedback is coming in and more and more people are saying to the administration, hey, this is actually really important? I mean, are those the kinds of things that you're hearing in the comments, the folks you're talking to?
Tim Starks
Certainly there have been some discussions I've had with people behind the scenes who are involved in all of this saying we need to be really careful about not getting rid of cyber personnel. How much that message is going to reverberate through the entire administration, I do not know. It does seem like, at least in part, the discussions that are public now about this have said we need to keep on hand actual cyber operational people who are responsible for protecting the federal government in those agencies. That was a point of emphasis how much that means CISA won't suffer cuts. CISA being more of a broader policy focused agency. I think that's an open question. If you look at the fact that if there was a shutdown, they had put out guidance saying, hey, if there's a shutdown, you know, we, we would keep about a thousand some odd people from CISA on hand out of, you know, 3,500. That maybe gives you a little indication of, of how much of a part of the. Consider that. I mean, I think it's actually not that far off from the, from the Biden administration's guidance in terms of the, the actual sheer numbers. So I think we're getting some hints of some commitment to cybersecurity personnel, but it's a question of how much of a commitment and how and where. I think those are the open questions.
Dave Bittner
Yeah, it's hard to keep up, isn't it?
Tim Starks
Dave? No, I can't.
Dave Bittner
Well, my heart goes out to you, Tim. Thanks. Tim Starks is senior reporter at cyberscoop. Tim, thanks so much for taking the time for us.
Tim Starks
Thanks to you, sir.
Dave Bittner
Tired of investigation tools that only do one thing at a time? Spending more time juggling contracts with data vendors than actually investigating Maltego changes that for good. Get one investigation platform, one bill to pay, and all the data you need in one place. It comes with curated data and a full suite of tools to handle any digital investigation. Connect the dots so fast cybercriminals won't even have time to Google what Maltego is. See the platform in action@maltego.com and finally, # tables are one of the most fundamental data structures in computing, allowing for fast storage and retrieval of information. They play a critical role in cybersecurity, enabling efficient database lookups, cryptographic functions, and even firewall operations. Their efficiency hinges on how quickly they can insert, locate or delete data, something researchers have studied for decades. In 2021, Andrew Krapivin, then an undergraduate at Rutgers University, stumbled upon a paper about tiny pointers. He didn't think much of it at the time, but two years later, as he explored ways to make pointers more memory efficient, he unexpectedly discovered a new kind of hash table, one that shattered long held assumptions in computer science. Without realizing it, Krapivin had disproved a 40 year old conjecture by Turing Award winner Andrew Yao, which stated that the worst case time to insert or search for an item in a nearly full hash table could never be faster than X, where x represents how close the table is to 100% full. Krapivin's new hash table, however, achieved an exponential improvement in time complexity. Skeptical at first, his former professor Martin Farosh Colton brought in William Kazmal from Carnegie Mellon University to validate the discovery. They confirmed that not only had Krapiven refuted Yao's conjecture, but he had also uncovered an even more surprising Some hash tables can achieve constant time research regardless of how full they are. This contradicted another of Yao's long standing assumptions. Krapivin, now at the University of Cambridge, along with Farak, Koltin and Khushmaul, published their findings in January of this year. While practical applications remain to be seen, their work fundamentally changes how computer scientists understand hash tables, one of the most essential tools in cybersecurity and data storage. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.
Tim Starks
Foreign.
Dave Bittner
Cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with Threat Locker, the cyber security solution trusted by businesses worldwide. Threat Locker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant.
CyberWire Daily: A Reel Disaster for GitHub
Release Date: March 17, 2025
Host: Dave Bittner | Contributor: Tim Starks (Cyberscoop)
On March 17, 2025, CyberWire Daily reported a significant phishing campaign targeting nearly 12,000 GitHub repositories. The malicious operations involved fake security alert issues designed to deceive developers into authorizing a rogue OAuth application named "Git Security App".
Mechanism of Attack:
Response and Mitigation:
Notable Insight:
The BlackLock Ransomware Group has emerged as one of the most active ransomware-as-a-service (RaaS) operators in early 2025, targeting over 40 organizations across various sectors including construction, real estate, IT services, and government agencies.
Tactics and Techniques:
Impact and Recommendations:
A pivotal legal development occurred when Judge James Breidar temporarily blocked the Trump administration's attempt to terminate thousands of federal employees, including over 400 from the Department of Homeland Security (DHS) and 130 from the Cybersecurity and Infrastructure Security Agency (CISA).
Legal Context:
Concerns Raised:
Notable Discussion:
Over 100 car dealership websites fell victim to a sophisticated supply chain attack targeting LES Automotive, a shared video service provider.
Attack Details:
Broader Implications:
Researchers uncovered a significant vulnerability affecting RSA encryption keys, revealing that approximately 1 in 172 online certificates are susceptible to compromise due to inadequate random number generation.
Findings:
Recommendations:
New Era Life Insurance Company disclosed a data breach affecting 355,000 individuals in December 2024, marking the largest health data breach reported by a health plan this year.
Breach Details:
Response Measures:
Security researcher Johannes Nugroho has developed and released a decryptor for the Linux variant of Akira ransomware, utilizing GPUs to brute-force encryption keys.
Technical Breakdown:
User Advisory:
Common Good Cyber, a global nonprofit, has unveiled a mapping database designed to assist NGOs and high-risk individuals in identifying appropriate security tools.
Database Features:
Objective:
Expert Commentary:
In an insightful segment, host Dave Bittner converses with Tim Starks, a senior reporter at Cyberscoop, regarding concerns among trade groups over the renewal of critical cyber laws and the future direction of the Cybersecurity and Infrastructure Security Agency (CISA).
Key Topics Discussed:
DHS Advisory Panels: The Trump administration's elimination of several DHS advisory panels, including one focused on critical infrastructure protection, has raised alarm among trade groups. These panels previously held legal authority to safeguard communications between the government and industry sectors.
Cybersecurity Information Sharing Act (CISA):
Nomination of CISA Director:
Potential Reversals on Cyber Personnel Cuts:
Conclusion of Discussion:
In a fascinating development, recent academic research has refuted a longstanding conjecture by Turing Award winner Andrew Yao regarding hash tables.
Research Highlights:
Collaborative Validation:
Future Implications:
Dave Bittner ([00:02]): "Developers should remain vigilant against such phishing attempts."
Tim Starks ([14:18]): "We need to keep on hand actual cyber operational people who are responsible for protecting the federal government in those agencies."
Tim Starks ([16:31]): "He [Sean Planke] seems loyal to the Republican agenda but has deep credentials."
Tim Starks ([18:38]): "We're getting some hints of some commitment to cybersecurity personnel, but it's a question of how much of a commitment and where."
This episode of CyberWire Daily provided a comprehensive overview of significant cybersecurity incidents and developments as of March 17, 2025. From large-scale phishing campaigns and ransomware threats to pivotal legal decisions impacting federal cybersecurity personnel, the discussions underscored the evolving landscape of cyber threats and the critical need for robust defense mechanisms. The insightful dialogue with Tim Starks shed light on the intricate interplay between government policies and cybersecurity infrastructure, highlighting ongoing challenges and the pursuit of effective information-sharing frameworks.
For further details on today's stories, visit thecyberwire.com.
Produced by Alice Carruth, Liz Stokes, and mixed by Trey Hester. Executive Producer: Jennifer Ibin. Publisher: Peter Kilpe.