Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire an international law enforcement operation dismantles AVcheck Trump's 2026 budget looks to cut over 1,000 positions from CISA Cyber Command's defensive wing gains subunified command status A critical V bulletin vulnerability is actively exploited A creed takes over Russian markets as credential Theft kingpin Qualcomm patches three actively exploited zero days in its Adreno GPU drivers researchers unveiled details of a Cisco iOS XE zero day Microsoft warns a memory corruption flaw in the legacy JS script engine is under active exploitation. A closer look at the stealthy lactroductus loader on today's afternoon, Cyber T Anne Johnson speaks with Hugh Thompson, RSAC Program Committee chair and decoding AI hallucinations with physics it's Monday, June 2, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Happy Monday. It's great to have you with us. An international law enforcement operation has dismantled AvCheck, a major counter antivirus service exploited by cybercriminals to test malware against commercial antivirus software before deployment. The takedown, executed on May 27, involved the seizure of AvCheck's domains and servers, which now display seizure notices from the U.S. department of Justice, FBI, U.S. secret Service and Dutch police. Authorities also uncovered links between AvCheck and crypting services Cryptor Biz and Crypt Guru, which aid in obfuscating malware to evade detection. Cryptor Biz has been seized while Crypt Guru remains offline. This action is part of Operation Endgame, a broader initiative targeting cybercriminal infrastructure. Recent efforts under this operation have led to the dismantling of 300 servers and 650 domains associated with ransomware activities and the seizure of 3.5 million euros in cryptocurrency. Undercover agents facilitated the investigation by making purchases on these platforms confirming their use in Cybercrime and linking them to ransomware groups targeting entities in the US and abroad. The Trump administration's 2026 budget proposal aims to cut over 1,000 positions at the Cybersecurity and Infrastructure Security Agency, reducing its workforce from 3,700 to 2,600. The cuts, totaling nearly $500 million, impact all divisions, with the steepest reductions hitting stakeholder engagement and integrated operations. While the cybersecurity division would lose over 200 roles, other divisions like Mission Support and Emergency Communications face significant trims. DHS Secretary Kristi Noem cited the end of election security work as a reason, though that only accounts for 14 positions. The plan also slashes funding for cyber training, stakeholder engagement, and national risk efforts. Programs like chemical security and school safety would be phased out, shifting responsibilities to state and local agencies. Congressional approval is still required. The Joint Force Headquarters Department of Defense Information Network has been elevated to a subunified command under U.S. cyber Command and renamed the Department of Defense Cyber Defense Command. This move, directed by Congress and Secretary of Defense Pete Hegseth, reflects DCDC's growing role in defending the Pentagon's global network. While it doesn't grant new authorities or funding, it allows better alignment with strategic goals and resource access. Led by lieutenant general Paul Stanton, DCDC aims to shift from reactive to proactive defense, making it harder for adversaries to breach networks. This elevation follows cybercom's earlier move to upgrade its offensive Cyber National Mission force, putting both key cyber operations on equal footing as the US Boosts its digital defense posture. A critical V Bulletin vulnerability is being actively exploited shortly after its disclosure by researcher egidio Romano on May 23. V Bulletin is Internet forum software used to create and manage online discussion boards. Romano detailed a remote code execution flaw affecting versions 5.1 through 6.0.3 and shared proof of concept. Code exploits began hitting honeypots by May 25, using Romano's code to run system commands. Though apparently patched in April, no CVE was initially assigned, but now two CVEs have been issued. This marks the first major V Bulletin exploit wave since 2020. The Accrede infostealer is emerging as a dominant force in credential theft, according to a June 2 report from cybersecurity firm ReliaQuest. Following the May 2025 takedown of Lumasteeler, which had dominated Russian market with 92% of credential theft alerts in late 2024. Accrede has quickly surpassed other malware like Redline, Raccoon and Vidar. Russian market, a major dark Web platform for stolen credentials remains active and influential, with logs often recycled from other sources. In 2024, ReliaQuest issued over 136,000 alerts for customer domains appearing on the market, with most stolen credentials tied to SaaS and SSO accounts. The professional and information sectors were the hardest hit, with over 50,000 alerts already in 2025. The threat continues to grow. Qualcomm has released patches for 3 actively exploited 0 days in its Adreno GPU drivers affecting many chipsets. Two critical flaws reported by Google in January allow unauthorized command execution leading to memory corruption. A third high severity bug reported in March is a use after free flaw triggered during Chrome graphics rendering. Google's threat Analysis group warns these are under targeted exploitation. Qualcomm urges OEMs to deploy patches issued in May. In a related investigation, Google found spyware infections involving Serbian authorities exploiting another Qualcomm flawless. This continues a trend of GPU and DSP driver vulnerabilities being exploited for device access and persistent surveillance, underlining Qualcomm's critical role in mobile security. Researchers at Horizon 3 have published technical details about a critical Cisco iOS XE wireless LAN controller flaw, increasing the risk of imminent exploitation. The bug, disclosed by Cisco on May 7, allows unauthenticated remote attackers to upload files and execute arbitrary commands with root privileges via a hardcoded JWT secret. While no complete exploit script was released, Horizon 3's write up provides enough data for skilled attackers to build one. The flaw impacts several Catalyst 9800 controller models. When the out of band AP image download feature is enabled, attackers can bypass JWT validation, perform path traversal and overwrite system configs to achieve remote code execution. Cisco urges users to upgrade. Disabling the vulnerable feature serves as a temporary workaround to reduce exposure. Microsoft is warning of active exploitation of a memory corruption flaw in the legacy JScript engine patched in May 2025. The vulnerability, rated 7.5 CVSS, allows remote code execution if a user clicks a malicious URL in Microsoft Edge running Internet explorer mode. Though IE 11 is retired, some systems remain vulnerable. A GitHub proof of concept increases the risk of exploit development. Users should patch immediately and disable IE mode in Edge as a temporary safeguard. Researchers at Wardenshield examine Lactrodectus, a stealthy malware loader linked to the Lunar Spider group behind Iced id, which has quickly risen as a major cyber threat following the 2024 takedown of Iced ID and other botnets in Operation Endgame. Emerging in late 2023. Lactrodectus rapidly gained traction among threat actors TA577 and TA578, filling the void in the malware ecosystem. It spreads through phishing, emails and deceptive attachments, deploying DLL payloads. Designed for stealth, persistence and versatile malware delivery, Lactrodectus supports remote command execution, information theft, and installation of ransomware and infosteelers like Iced id, Quackbot, and Darkgate. Its obfuscation, sandbox evasion and encrypted communications make it difficult to detect. Over 44,000 infections were logged in less than a month, mostly targeting North America and Europe. With constant updates and advanced delivery tactics including fake CAPTCHAs and TikTok lures, lactrodectus is a top tier threat, demanding layered defenses, user awareness, and proactive incident response. Coming up after the break, Ann Johnson from Afternoon Cyber Tea speaks with Hugh Thompson, RSAC Program Committee Chair and Decoding AI hallucinations with physics Stay with us.