Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire the DOJ files to seize over $7 million linked to illegal North Korean IT workers the FBI warns of bad box malware targeting IoT devices. Researchers uncover a major security flaw in Chrome extensions. ESET uncovers Iranian hackers targeting Kurdish and Iraqi government officials. Hitachi, Acronis and Cisco patch critical vulnerabilities. 20 suspects are arrested in a major international CSAM takedown. Hackers exploit a critical flaw in roundcube webmail. Our guest today is Ian Bramson, global head of industrial cybersecurity at Black and Veatch, exploring how organizations can close the cyber attack readiness gap and chatgpt logs are caught in a legal tug of war.
Ian Bramson (2:02)
Foreign.
Dave Bittner (2:08)
It's Friday, June 6, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today and happy Friday. Great as always to have you with us. The U.S. department of justice has filed a civil forfeiture complaint to seize over $7.7 million in cryptocurrency linked to North Korean IT workers who use stolen identities to gain illegal remote employment. These workers, often based in China and Russia, secretly funneled earnings to fund North Korea's weapons program, skirting US Sanct. The scheme was allegedly orchestrated with Sim Hyun Seop, a foreign trade bank rep, and Kim Sang man, head of Cheong, a Ministry of Defense linked firm. The IT workers laundered funds through tactics like chain hopping, token swapping and buying NFTs. The action is part of a broader crackdown DPRK Revgen domestic enabler initiative targeting North Korea's global revenue networks and their US enablers. The FBI and DOJ are leading the investigations. The FBI is warning about Bad Box 2.0, a malware campaign that's infected over 1 million consumer IoT devices worldwide, found mostly on low cost Android based TVs, tablets and projectors often made in China. Bad Box 2.0 turns these gadgets into residential proxies for cybercriminals. The malware comes preloaded or is installed during setup via malicious apps or firmware updates. Once infected, devices can be used for ad fraud, credential stuffing and masking criminal traffic. Despite earlier disruptions, the botnet continues to grow. Most infections are in Brazil, the U.S. mexico and Argentina. The FBI urges consumers to avoid unofficial app stores, monitor home network traffic, keep devices updated, and disconnect any suspected compromised devices to halt the malware's activity. Researchers have uncovered a major security flaw in Chrome extensions affecting over 15 million users. The issue centers around developers hard coding sensitive credentials directly in their JavaScript code, things like API keys, authentication tokens and cloud access secrets. Since Chrome extension code is public, these credentials are easily accessible to attackers. Exposed secrets include Google Analytics, Azure, speech APIs and even AWS keys. The risks range from corrupting analytics data to incurring massive cloud costs or exposing broader infrastructure. Symantec found the problem across multiple high profile extensions, including those from Avast and Equatio. This points to a widespread issue in extension development. Convenience often overrides secure coding practices. Attackers could exploit these keys to spam devices, hijack cloud resources, or even pivot into connected systems with elevated permissions. Iran Linked hackers identified as Bladed Feline have been conducting a years long cyber espionage campaign targeting Kurdish and Iraqi government officials, according to eset. Believed to be a subgroup of Iran's oil rig, Bladed Feline has operated since at least 2017, initially breaching the Kurdistan Regional Government and later expanding to Iraq's central government and even a telecom provider in Uzbekistan. The group uses custom malware like Xamaron, Whisper and primecache to spy on systems, exfiltrate data and maintain remote access. Entry points likely include exploited server vulnerabilities and web shells. Researchers say the campaign likely supports Iran's geopolitical goals by monitoring the KRG's Western ties and countering US influence in Iraq. Oil Rig has a history of targeting critical sectors and using compromised networks for supply chain attacks. Hitachi Energy has patched two critical vulnerabilities in its Relion 670, 650 series and SAM 600 IO devices, which are widely used in power grid protection and control. The flaws could allow remote attackers to trigger memory corruption, risking grid stability. Hitachi Energy has released targeted updates and recommends users upgrade to secure revisions. No public exploitation has been reported, but mitigation steps are advised for older systems. Acronis Cyber Protect users are urged to update immediately due to multiple critical vulnerabilities including three with the highest CVSS score of 10.0. These flaws allow attackers to bypass authentication, access sensitive data and escalate privileges. Updates have been available for a month if updating isn't possible right away, restrict network access and monitor systems for suspicious activity. Cisco has patched 12 vulnerabilities across its products, including a critical flaw in cloud deployment of Identity Service engine. This bug affects aws, Azure and Oracle Cloud ISE instances where shared credentials are improperly generated, allowing attackers to access sensitive data or modify configurations. No workarounds exist and proof of concept code is public. Cisco also addressed two high severity SSH flaws in its IMC and Nexis Dashboard fabric controller, which could allow unauthorized access or man in the middle attacks. Additionally, nine medium severity bugs were patched across various Cisco communication and management tools. Two have public proof of concept code, though no active exploitation is reported. Cisco strongly urges users to apply updates immediately. An international law enforcement operation has led to the arrest of 20 suspects involved in producing and distributing child sexual abuse material. Launched after Spanish police uncovered messaging groups sharing CSAM in late 2024, Operation Vibora identified 88 suspects globally. Interpol and Europol coordinated efforts across the Americas, Europe, Asia and Oceania. Spain arrested seven individuals, including a teacher and healthcare worker. Ten more were arrested in Latin America, including three in El Salvador and a teacher in Panama. Additional arrests occurred in Europe and the US. This operation follows earlier global actions against CSAM platforms, including Operation Stream, which dismantled the dark website Kidflix, and another that targeted AI generated csam. These efforts have collectively identified hundreds of suspects and seized thousands of devices. Cybersecurity company fears off reports that hackers are now exploiting a critical post authentication remote code execution flaw in roundcube webmail. The bug, present for over a decade, was patched on June 1, but attackers quickly reverse engineered the fix and began selling a working exploit online. Dubbed email Armageddon. The flaw stems from unsanitized session variables leading to PHP object injection. Despite requiring login access, attackers claim credentials can be extracted from logs, brute forced or obtained via csrf. Roundcube is widely used by hosting providers and organizations across government, education and tech sectors. With over 1.2 million instances online, the attack surface is significant. Security researchers urge immediate Patching Given the vulnerability's severity, CVSS score of 9.9 and the ACT of exploitation in the wild. Coming up after the break, my conversation with Ian Bramson, global head of industrial cybersecurity at Black and Veatch. We're exploring how organizations can close the cyber Attack readiness gap and chatgpt logs are caught in a legal tug of war. Stay with us. Compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you've ever found yourself drowning in spreadsheets, chasing down screenshots, or wrangling manual processes just to keep your GRC program on track, you're not alone. But let's be clear. There is a better way. Banta's trust management platform takes the headache out of governance, risk and compliance. It automates the essentials from internal and third party risk to consumer trust, making your security posture stronger. Yes, even helping to drive revenue. And this isn't just nice to have. According to a recent analysis from IDC, teams using Vanta saw a 129% boost in productivity. That's not a typo, that's real impact. So if you're ready to trade in chaos for clarity, check out Vanta and bring some serious efficiency to your GRC game. Vanta GRC how much easier trust can be? Get started at vanta.com cyber Ian Bramson is global head of industrial Cybersecurity at Black and Veatch. I recently spoke with him about how organizations can close the cyber attack readiness gap.