Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K and now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire Researchers uncover a major privacy violation involving tracking scripts from Meta and Yandex, A compliance automation firm discloses a data breach Puma bot stalks vulnerable IoT devices the RamNet Banking Trojan gets repurposed for ICS intrusions. The North Face suffers a credential stuffing attack. Kaspersky says the Black Owl team is a cyber threat to Russia. CISA releases ICS advisories An Indian grocery delivery startup suffers a devastating data wiping attack. The UK welcomes their new cyber and electromagnetic command. Our guest is Rohan Pinto, CEO of One Cosmos, discussing the implications of AI deepfakes for biometric security and the cybersecurity sleuths at Sophos Unravel a curious Caper It's Wednesday, June 4th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Researchers have uncovered a major privacy violation involving tracking scripts from Meta and Yandex embedded in millions of websites, Ars Technica reports. These scripts exploit legitimate browser features to link web activity with identities in Android apps like Facebook, Instagram and Yandex. This bypasses Android security model and browser privacy protections, effectively breaking the sandbox that separates web and app data. Meta began this tracking in 2023, while Yandex has used similar methods since 2017. The abuse involves covert communication via local ports and misused protocols like WebRTC. Although meta and Yandex claim no sensitive data is collected, the technique de anonymizes users even in private browsing. Chrome, DuckDuckGo, Brave and Vivaldi have introduced partial fixes, but researchers warn these are temporary. They urge platform level reforms to control local port access and enhance transparency. Google says they're investigating, and both Meta and Yandex say they've paused the feature. However, the issue does underscore ongoing risks in how mobile ecosystems handle privacy and app browser interactions. Vanta, a compliance automation firm, disclosed a data breach incident affecting fewer than 4% of its customers, although potentially impacting hundreds of organizations. The breach stemmed from a product code change that broke data isolation in Vanta's multi tenant platform, leading to cross customer data leakage. As a result, a subset of data from under 20% of third party integrations with was exposed and shared bidirectionally between accounts. Leaked information included employee names, roles, security configurations, MFA usage and integration details. While the number of affected individuals remains undisclosed, Vanta confirmed all impacted customers have been notified. The issue was identified on May 26 with full remediation expected today. Vanta supports compliance with frameworks like SoC2, ISO 27001, HIPAA and GDPR, making the incident especially sensitive for its security conscious Clientele. Researchers at Polyswarm have uncovered a stealthy new Linux based botnet called PumaBot, targeting vulnerable IoT devices, especially surveillance systems. Written in Go, PumaBot differs from typical malware by using curated IP lists from command and control servers. Instead of scanning the Internet broadly, this targeted approach helps it avoid detection. Pumabot brute forces SSH credentials to gain access, with a particular focus on devices from Pumatronics, a surveillance equipment maker. Once inside, it establishes persistence by disguising itself as legitimate services like Redis or MySQL and embeds into system directories to survive reboots. Its main goal is cryptocurrency mining executing tools like XMRig to generate illicit profits. The malware also gathers system data and sends it back to attackers who maintain inventories of infected devices. Puma Bot's emergence underscores growing IoT risks tied to default credentials and weak security practices. Honeywell's latest security report reveals a sharp rise in ransomware attacks targeting industrial organizations, with over half of 2024's SEC reported incidents affecting operational technology. More notably, data from Honeywell's SMX USB scanning solution uncovered nearly 1,800 unique threats among 31 million scanned files, including 124 previously unseen. The standout malware was Win32 worm Ramnet, responsible for 42% of all detections and showing a staggering 3,000% spike in the fourth quarter of 2024 versus quarter two. Ramnet, originally a banking trojan, appears to be repurposed to extract industrial control system credentials. Its surge aligns with the widespread use of Windows based ICS platforms, making it a potent threat via USB borne infections. Honeywell's cybersecurity lead Paul Smith suggests that its effectiveness in stealing credentials and use of built in system tools may explain its dominance, whether by accident or targeted design. On April 23, outdoor apparel brand the North Face suffered a credential stuffing attack where hackers used stolen login details from other breaches to access customer accounts. Though payment data remained secure, personal details like contact info, shipping addresses and purchase history were exposed. The attackers exploited users tendency to reuse passwords across sites. The company responded by disabling compromised credentials, forcing password resets and urging customers to use unique passwords to reduce cross platform security risks. No internal systems were breached. The pro Ukraine hacker group BO Team, also known as Black Owl, has emerged as a major cyber threat to Russian institutions, according to Kaspersky. Active since early 2024, the group operates independently with its own tools, often targeting Russian government agencies and industries. A notable attack recently disrupted a third of Russia's national court filing system. BO Team gains access via phishing and delays actions to avoid detection. Unusual for hacktivists. Their toolkit includes backdoors like darkgate, Broken Door and Remcos, and they often delete backups or use Babuk ransomware for extortion. The group disguises malware as legitimate software and shares details of attacks on Telegram. Despite their pro Ukraine stance, BO Team works solo without ties to other hacktivist groups, setting them apart in Russia's threat landscape. CISA issued critical advisories for severe vulnerabilities in Schneider Electric and Mitsubishi Electric industrial products, threatening critical infrastructure like energy and manufacturing. The most serious flaw with A CVSS of 9.3 affects Schneider's now unsupported home automation devices, enabling remote code execution via buffer overflow. Another Schneider vulnerability allows local code execution in EcoStruxure software. Mitsubishi's Melsec IQF PLC's 4Face A CVSS 9.1 info disclosure flaw from improper input validation. CISA urges immediate mitigations, including firmware updates and network security enhancements. Indian grocery delivery startup kiranapro suffered a devastating cyber attack that wiped all its data, including app code and sensitive customer information. The Breach, discovered on May 26, occurred after hackers accessed root accounts on AWS and GitHub, likely via a former employee's credentials. The attack rendered KiranaPro's app unable to process orders, halting operations for its over 30,000 active users across 50 cities. Founded in December 2024, Kiranapro runs on India's open network for digital commerce and supports voice based grocery ordering in multiple languages. The startup had ambitious expansion plans, now stalled by the breach. Despite using Google Authenticator for multi factor authentication, hackers deleted all EC2 instances, leaving no logs or recovery options. Kirana Pro is pursuing legal action and investigating the incident with GitHub. The UK's Ministry of Defense has unveiled its Strategic Defense Review, emphasizing the critical role of the new Cyber and Electromagnetic command. This new domain integrates cyber operations and electromagnetic warfare, now recognized as foundational to modern military strategy. The Cyber EM Command will lead both offensive and defensive cyber missions, coordinate across services, and work alongside the National Cyber Force without overlapping authority. It will also anchor the UK's new digital targeting web, designed to connect military assets for rapid precision strikes. The government aims to have the command operational by year's end and will invest over £1 billion to support it. These moves come amid rising cyber threats and follow a damning report on UK military readiness. UK Defense Secretary John Healy promises to reverse years of decline by growing force size, expanding tech capabilities, and returning the military to a war ready posture by 2027. Coming up after the break, my conversation with Rohan Pinto, CTO of One Cosmos. We're discussing the implications of AI deep fakes for biometric security, and the cybersecurity sleuths at Sophos unravel a curious caper. Stay with us. Compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you've ever found yourself drowning in spreadsheets, chasing down screenshots or wrangling manual processes just to keep your GRC program on track, you're not alone. But let's be clear, there is a better way. Vanta's trust management platform takes the headache out of governance, risk and compliance. It automates the essentials from internal and third party risk to consumer trust, making your security posture stronger. Yes, even helping to drive revenue. And this isn't just nice to have. According to a recent analysis from IDC, teams using Vanta saw a 129% boost in productivity. That's not a typo, that's real impact. So if you're ready to trade in chaos for clarity, check out Vanta and bring some serious efficiency to your GRC game. Vanta GRC how much easier trust can be? Get started@vanta.com Cyber Rohan Pinto is CTO of One Cosmos. I recently caught up with him to discuss implications of AI deepfakes for biometric security.