Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire a joint advisory warns of Fancy Bear targeting Western logistics and technology firms A non profit hospital network in Ohio suffers a disruptive ransomware attack. The Consumer Financial Protection Bureau drops plans to subject data brokers to tighter regulations. Krebs on security and Google Block a record breaking DDoS attack campaign rerouted employee paychecks Atlassian Patches Multiple high severity Vulnerabilities A Wisconsin telecom provider confirms a cyber attack caused a week long outage. VMware issues a security advisory addressing multiple high risk vulnerabilities. Prosecutors say a 19 year old student from Massachusetts will plead guilty to hacking PowerSchool. Our guest is Rob Allen, Chief Product Officer at ThreatLocker, discussing deliberate simplicity of fundamental controls around zero trust and oversharing your call location data. It's Wednesday, May 21, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief.
Rob Allen (2:28)
Foreign.
Dave Bittner (2:35)
Thanks for joining us here today. It's great as always to have you with us. A joint cybersecurity advisory from the U.S. and allied agencies warns of ongoing cyber espionage by Russia's GRU unit 26165, also known as APT28 or Fancy Bear, targeting Western logistics and technology firms, especially those supporting Ukraine. Active since 2022. The campaign employs tactics like password spraying, spear phishing and exploiting vulnerabilities in Microsoft Exchange and Winrar. Targets include transportation hubs, defense contractors, IT services and air traffic systems across NATO countries. The GRU has also compromised IP cameras near Ukrainian borders to monitor aid deliveries. Organizations are urged to enhance monitoring, threat hunting and network defenses against these persistent threats. Kettering Group, a non profit hospital network in Ohio, suffered a ransomware attack attributed to the Interlock Group. The incident caused a system wide technology outage disrupting access to electronic health records and patient care Systems across its 14 hospitals and over 120 outpatient facilities. All elective procedures were canceled and the call center was rendered inaccessible. Emergency services remained operational, but ambulances were diverted to other facilities, prompting neighboring Premier Health to declare a code Yellow due to increased patient volumes. The attackers threatened to leak stolen data unless a ransom is paid. Kettering Health is collaborating with cybersecurity experts to investigate and restore systems. Additionally, reports emerged of scammers impersonating Kettering staff to solicit payments. The organization has suspended all payment related calls and advises patients to report suspicious contacts to law enforcement. The Consumer Financial Protection Bureau has dropped plans to classify certain data brokers as credit bureaus, a move that would have subjected them to tighter regulations. Proposed In December of 2023, the rules aim to curb the sale of American sensitive data by requiring accuracy, transparency and limiting data sales to legitimate uses like credit or employment checks. But the CFPB has now deemed further rulemaking not necessary or appropriate. Critics warn this leaves Americans vulnerable as brokers often collect data from apps or telcos, sometimes exposing users at protests or clinics. Several data breaches have highlighted the risks, with billions of records stolen from poorly secured brokers. While the US backs off regulation, the UK is still evaluating stricter oversight. CFPB's future remains uncertain amid political pressure, Krebson Security was targeted on May 12 by a record breaking DDoS attack peaking at 6.3 terabits per second, 10 times larger than the infamous 2016 Mirai botnet assault. The attack, mitigated by Google's Project Shield, lasted less than a minute but marked the biggest attack Google has ever handled. Security experts link the attack to the Asuru botnet, a network of hijacked IoT devices like routers and DVRs. Isuru's operators exploit weak passwords and software flaws, selling attack services on Telegram under the handle Forky for up to $600 per week. This botnet has been rented out since at least August 2024. Law enforcement has seized some of its related domains, but the threat remains active. With major web services still struggling to counter such powerful assaults, a phishing campaign rerouted employee paychecks by tricking users into entering credentials on fake mobile specific payroll sites. According to ReliaQuest, attackers used Google Ads and SEO poisoning to lure victims searching for HR portals on mobile devices. Clicking these ads led to fake Microsoft login pages designed to harvest credentials. Once compromised, attackers accessed SAP SuccessFactor accounts and changed direct deposit details, diverting paychecks to their own accounts. The attack used a proxy network of hijacked home routers to mask the attackers locations and evade detection. Real time monitoring tools helped attackers act before credentials could be reset. RelayaQuest recommends using multi Factor Authentication alerts for deposit changes, employee education and proactive threat intelligence to combat these mobile targeted phishing campaigns that bypass corporate network defenses. Atlassian's May 2025 Security Bulletin reveals eight high severity vulnerabilities impacting several data center and server products. The flaws found through bug bounties, testing and library scans could lead to denial of service attacks and privilege escalation if left unpatched. Notably, Bamboo and Confluence Data center are exposed to a Tomcat Coyote bug, causing memory leaks and crashes from malformed HTTP 2 headers. Confluence also faces a stack overflow risk via the xstream library. Fisheye Crucible is vulnerable to a denial of service flaw in JSON Smart, while JIRA software and service management are at risk from neti's SSL handler bug. Additionally, a privilege escalation issue threatens JIRA products, enabling attackers to gain unauthorized access. Users are urged to patch immediately to secure enterprise environments. Wisconsin telecom provider Cellcom confirmed a cyber attack caused a week long outage affecting voice and text services in Wisconsin and Upper Michigan. While some services have been restored, full recovery is expected by week's end. The company's CEO assured customers they had protocols in place and they're working with cybersecurity experts and authorities to resolve the issue. Cellcom stated no sensitive customer data appears compromised as the breach impacted a network segment without personal information. Though the company has not disclosed the attack type, the scope suggests ransomware may be involved, though no group has claimed responsibility. Cellcom emphasized its cautious, deliberate approach to recovery and pledged to provide updates on restoration efforts and the ongoing investigation. VMware has issued a security advisory urging immediate action on multiple high risk vulnerabilities across its virtualization products. Top priority is a critical VCenter server flawless that allows unauthenticated attackers to execute arbitrary commands and take control of the host. Admin interfaces should be restricted to trusted networks. Other notable flaws affect VMware Cloud foundation, including a directory transversal issue and information disclosure risk and information disclosure risks both exploitable via simple Network access to port 443. Additional vulnerabilities impact ESXi Workstation and Fusion, including denial of service bugs and a cross site scripting flaw. VMware has released patches for all affected systems and recommends organizations review and apply updates promptly to minimize risk of exploitation. Federal authorities say Matthew Lane, a 19 year old student from Massachusetts, will plead guilty to hacking PowerSchool, a major education software firm serving over 60 million students. Lane used stolen credentials from a contractor to access PowerSchool systems stealing sensitive data on students and teachers. He then issued a ransom demand in December, threatening to leak the data unless paid. Nearly $2.9 million in Bitcoin power School confirmed it paid, though the amount remains undisclosed. Lane, linked to the Shiny Hunters hacking group, is also accused of trying to extort a telecom company. He will plead guilty to charges including unauthorized access to protected computers and aggravated identity theft. Federal prosecutors call it a significant win in what may be the largest breach of US School children's data to date. Coming up after the break, my conversation with Rob Allen from Threat Locker. We're discussing deliberate simplicity of fundamental controls around zero trust and over sharing your call location data. Stick around.