Transcript
Dave Buettner (0:02)
You're listening to the Cyberwire Network, powered by N2K. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect. Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com hackers linked to China and Iran are using AI to enhance cyber attacks An AI powered messaging tool for Slack and Discord is reportedly leaking user data. British engineering giant Smith's group suffers a cyber attack. Rockwell Automation details critical and high severity vulnerabilities. Researchers warn of new side channel vulnerabilities in Apple CPUs. The Hellcat ransomware gang looks to humiliate its victims. Spark rat targets macOS users and government entities. Flashpoint looks at flesh stealer malware Cybercriminals leverage trust in government websites. Our guest is Ivan Novikov, CEO at Walarm, sharing insights on the recent US Ruling that bars certain Chinese and Russian connected car tech from being imported into the US and QR code shenanigans. It's Wednesday, January 29, 2020. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Happy Wednesday and thank you for joining us here today. The Wall Street Journal, in an exclusive, says hackers linked to China, Iran and other foreign governments are using AI, including Google's Gemini Chatbot, to enhance cyberattacks. These groups leverage AI for tasks like writing malicious code, identifying vulnerabilities and researching targets. While Western officials have Long warned about AI's misuse, Google's new findings provide concrete examples of adversaries utilizing generative AI. Chinese and Iranian hacking groups are the most active users of Gemini, treating it as a research tool rather than a game changing cyberweapon. North Korean hackers use AI for job application cover letters aiding espionage efforts, while Russian groups use it sparingly for coding tasks. In contrast, researchers at Sophos conclude cybercriminals on underground forums remain largely skeptical about generative AI, with little evidence of its use in developing new exploits or malware. While some actors discuss ambitious AI applications, these remain theoretical. The primary concern is AI's potential misuse for automating tasks like spamming, mass mailing and data analysis. Rather than creating novel threats. Many cybercriminals see AI as overhyped and unsuitable for complex operations. For now, most are taking a wait and see approach, assessing how AI could integrate into their workflows over time. Meanwhile, China's Deep Seek AI with open source code raises concerns about unregulated misuse. US Intelligence officials warn that AI is becoming a crucial factor in global cyber and military strategies. Google urges tighter export controls and faster AI adoption in US Defense to maintain its technological edge. Structchat, an AI powered messaging tool for Slack and Discord, claims to prioritize privacy. However, researchers at Cybernews found an exposed Apache Kafka broker instance streaming user data without security measures. Despite multiple disclosure attempts, the leak remains open as of yesterday, posing a severe risk to users. The leak includes sensitive Slack data such as usernames, emails, conversations, team details and internal URLs. In just one hour, data from over 1,000 users across 200 companies was exposed. This information could be exploited for phishing, identity theft, or corporate espionage. Structchat, which uses OpenAI's ChatGPT for summaries, has not responded to inquiries. British engineering giant Smiths Group is working to restore systems following a cyberattack that led to unauthorized access. The company quickly isolated affected systems and activated business continuity plans. Smiths is collaborating with cybersecurity experts to assess the impact and comply with regulations. While the exact nature of the attack remains unclear, it may involve ransomware, as taking systems offline is a common response. No ransomware group has claimed responsibility. The company, with 15,000 employees worldwide, promises updates as needed. Rockwell Automation has released six security advisories detailing critical and high severity vulnerabilities in its products. In the Factory Talks software, critical flaws in View Machine Edition and High Severity issues in View Site Edition could allow remote and local attackers to execute commands or access system configurations. Other vulnerabilities include a critical SQLite flaw in Data Mosaic's private cloud, a denial of service issue in the ISE2 controller, and credential exposure in PowerFlex 755. While there's no evidence of active exploitation, CISA has issued advisories urging organizations to apply patches to protect industrial automation systems from potential threats. Security researchers from the Georgia Institute of Technology and Ruhr University Bauchem have discovered new side channel vulnerabilities in modern Apple processors that could leak sensitive information from Web browsers named FLOP and slap. These attacks exploit flaws in speculative execution, the same underlying issue behind Spectre and Meltdown. The attacks target M2 or A15 and newer Apple CPUs, which predict memory addresses and data values to speed up processing. However, mispredictions can expose sensitive information, potentially allowing attackers to bypass browsers, sandboxes and steal data in Safari and chrome via malicious JavaScript or web assembly code. The researchers disclosed SLAP in March of last year and FLOP in September. Apple acknowledged the flaws and pledged to address them, but no fixes have been released. The company stated that it does not see an immediate risk to users, though researchers warn of real world security implications. The Hellcat ransomware gang emerging in 2024 employs a ransomware as a service model but stands out for its humiliating tactics against victims. According to Cato researchers, Hellcat uses psychological pressure alongside standard double extortion, threatening to leak stolen data if ransoms aren't paid. Notable attacks include Schneider Electric, where hackers demanded $125,000 in baguettes instead of cash. They also leaked 40 gigabytes of sensitive data. Other targets include a US university, a French energy company and an Iraqi city government. Hellcat prioritizes public embarrassment over financial gain, selling access to compromise systems cheaply rather than demanding large ransoms. Their approach signals a potential evolution in cyber extortion, blending traditional financial motives with psychological warfare to pressure victims. Moving from cats to rats Researchers from Huntio have uncovered new Spark RAT operations, exposing its persistent use in cyber espionage against macOS users and government entities. Originally released on GitHub in 2022, Sparkrat is a cross platform remote access Trojan targeting Windows, macOS and Linux linked to North Korean cyber campaigns. Sparkrat has been distributed via fake meeting platforms and gaming sites. Researchers from Hunt and Kato Networks identified C2 servers in Korea and Singapore using port 8000 for communication. An Android apk linked to Sparkrat further extends its attack surface. Analysts recommend monitoring HTTP headers, JSON error messages and network traffic for detection. Hunt, Cato Networks and other cybersecurity researchers continue investigating SparkRat's evolving infrastructure and tactics to mitigate this growing threat. Researchers at Flashpoint look at fleshstealer, a credential stealing malware that first emerged in September of last year. Written in C, it uses encryption to evade detection and terminates itself if debugging is detected. It also avoids execution in virtual machine environments, preventing forensic analysis. Fleshstealer targets chromium and Mozilla based browsers, extracting credentials, crypto wallet data and two FA extensions from over 70 sources. It can reset Google cookies for further exploitation. The malware is lightweight and offers 24. 7 support for cybercriminals with logs decrypted directly on its web based control panel for nearly two years, cybercriminals have been quietly exploiting vulnerabilities in government websites, using their trusted.gov domains to launch phishing campaigns. According to Cofence Intelligence, attackers have turned these sites into weapons, leveraging them to host credential phishing pages, act as command and control servers and redirect unsuspecting users to malicious destinations. A particularly insidious tactic is the abuse of open redirects, where a compromised government site unknowingly forwards visitors to phishing links. Victims seeing a trusted government address click without hesitation only to land on pages designed to steal their credentials. The United States, Brazil, and Colombia have been among the hardest hit, with US government domains accounting for 9% of total cases. In most instances, these domains were exploited to bypass email security gateways like Microsoft ATP, proofpoint, and mimecast, ensuring phishing emails reached inboxes undetected. What's most alarming is how deliberate this campaign appears. Instead of opportunistically attacking any vulnerable site, cybercriminals first design their phishing campaigns and then seek out compromised government domains to give their attacks credibility. Their strategy is methodical, their execution precise. Coming up after the break, my conversation with Ivan Novikov, CEO at walarmonde. We're discussing the recent US Ruling that bars Chinese and Russian connected car tech and QR code shenanigans. Stay with us.