Transcript
A (0:02)
You're listening to the Cyberwire network. Powered by N2K.
B (0:14)
The DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot at Thales. They know cybersecurity can be tough and you can't protect everything, but with Thales you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales T H A L E S Learn more at the open source community heads off a major NPM supply chain attack the Treasury Department sanctions cyber scam centers in Myanmar and Cambodia. Scammers abuse iCloud calendar invites to send callback phishing emails. Researchers discover a new malware variant exploiting exposed docker APIs. Phishing attacks abuse the Axios user Agent and Microsoft Direct Send feature. Plex warns users of a data breach. Researchers flag a surge in scans targeting Cisco ASA devices. CISA delays finalizing its Incident reporting rule. The GAO says federal cyber workforce figures are incomplete and unreliable. Our guest is Kevin McGee, global director of Cybersecurity Startups at Microsoft Security, discussing cybersecurity education and going back to school and AI earns its own Darwin Awards. It's Tuesday, September 9th, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here. It is great to have you with us. A major supply chain attack targeting the NPM ecosystem was stopped thanks to the rapid response of the open source community. Attackers compromised the NPM account of well known developer Josh Junon, also known as Kicks, publishing malicious versions of widely used packages such as Chalk and stripansi. The malware acted as a crypto clipper, swapping wallet addresses or hijacking transactions to steal cryptocurrency. The malicious packages were live for only a few hours before NPM and maintainers removed them. Researchers noted that the attack chain was sophisticated, but losses were minimal, estimated at just $20 to $66 thanks to Fast community detection. Reports show developers flagged the threat within 15 minutes, with some packages taken down in under an hour. Experts stressed that while any compromise is serious, this was not the biggest supply chain attack ever. Instead, it highlighted the strength of open source collaboration in preventing widespread damage. The U.S. treasury Department has sanctioned individuals and companies tied to cyber scam centers in Myanmar and Cambodia that have defrauded Americans of over $10 billion. The measures target Burmese, Cambodian and Chinese nationals running forced labor compounds where victims are trafficked, abused and forced to carry out scams in Myanmar. Sanctions focus on SH Coco, a hub run by military leaders of the Karen national army who profit by tracking workers and supporting scam operations in Cambodia. The crackdown hit casino linked scam centers tied to Chinese gangs and billionaire Tri fiip. Officials said these sanctions aimed to disrupt industrial scale fraud while combating human trafficking and modern slavery in the region. Apple has issued a warning after scammers were found abusing iCloud calendar invites to send callback phishing emails disguised as purchase notifications. The scheme embeds fake payment alerts, such as a $599 PayPal charge, into the Invites Notes field. Since these messages come from Apple's legitimate servers, they bypass spam filters and appear authentic. Victims are urged to call fraudulent numbers where attackers attempt to trick them into downloading malicious software. Experts advise treating calendar invites with the same caution as suspicious emails. Researchers at Akamai have discovered a new malware variant exploiting exposed docker APIs, evolving from a campaign first seen in June. Unlike the earlier strain that deployed a cryptominer, the updated version now blocks external API access, gains host level control, and installs persistence tools, indicating preparation for larger operations. The malware uses a Go based binary dropper, scans for other vulnerable servers and spreads itself, suggesting early botnet development. It also removes competing crypto miner containers to dominate infected systems. Notably, the code includes inactive routines for Telnet and Chrome's remote debugging, hinting at future expansion. Akamai's honeypot analysis revealed indicators of compromise tied to Tor domains and and webhook addresses. Security experts warn that attackers are shifting from quick profits toward infrastructure building, urging Docker users to secure APIs and monitor activity closely. RelayaQuest has reported a sharp surge in phishing attacks abusing the Axios user agent and Microsoft's Direct Send feature. Between June and August of this year, Axios driven phishing activity jumped 241%, accounting for nearly 24% of all malicious user agent traffic, 10 times higher than any other agent. Axios enabled Campaigns had a 58% success rate compared to just 9% for other incidents, with success, climbing to 70% when paired with Direct Send. Initially aimed at executives in finance, healthcare and manufacturing, the attacks now target regular users. Axios, a lightweight HTTP client, allows attackers to easily intercept, replay and manipulate HTTP requests, bypassing MFA and hijacking session tokens. Its legitimacy helps it evade filters, unlike more suspicious tools. ReliaQuest urged organizations to disable Direct Send if possible, tighten email security and train users to recognize phishing red flags. Popular streaming platform Plex has warned users of a data breach in which attackers accessed emails, usernames, hashed passwords and authentication data from one of its databases. The company stressed that the breach was contained and the risk of cracked passwords is low, but urged users to reset their passwords immediately and sign out of all connected devices. Plex has blocked the attacker's access, launched a security review and advised customers to watch for phishing attempts. The number of affected users remains undisclosed. Cybersecurity researchers have flagged a surge in scans targeting Cisco ASA devices, raising concerns of a possible upcoming vulnerability. Gray Noise observed two major spikes in August, with up to 25,000 IPs probing ASA login portals and Cisco iOS telnet SSH onewave, largely driven by a Brazilian botnet, used Chrome like user agents and focused on US Systems. Similar spikes often precede new flaw disclosures. Admins are urged to apply patches, enforce MFA and restrict direct access. CISA has delayed finalizing its rule requiring critical infrastructure operators to report major cyber incidents until May 2026, seven months past the original deadline. The rule, mandated by the Cyber Incident Reporting for Critical infrastructure act of 2022, requires reporting cyber attacks within 72 hours and ransomware payments within 24. Officials say the delay allows more time to streamline requirements, reduce industry burden and harmonize with other federal regulations. Lawmakers and industry groups welcomed the extension if it ensures stakeholder input is incorporated. Though some criticized CISA's lack of progress, the law, inspired by attacks like the Colonial Pipeline hack, will have wide impact across sectors once implemented. The GAO says federal cyber workforce figures are incomplete and unreliable. Across 23 civilian agencies, it counted at least 63,934 full time cybersecurity employees costing $9.3 billion annually, plus just over 4,000 contractors costing $5.2 billion. But most agencies lack quality data 22 reported only partial or no contractor data 19 had no data quality checks 17 lacked standard criteria for who qualifies as a cyber employee. GAO faulted the ONCD and OMB for lacking plans to improve data, noting a Key Working Group paused in February, and it's unclear if it resumed after Sean Cairncross August Confirmation GAO recommended closing data gaps, standardizing roles, improving reporting quality, and assessing workforce effectiveness. While Biden Era initiatives began in 2023, their current priority is uncertain, hindering sound staffing and security decisions. Coming up after the break, Kevin McGee, global director of Cybersecurity Startups at Microsoft Security, discusses cybersecurity education as we head back to school. School and AI earns its own Darwin Awards. Stay with us. Compliance regulations, third party risk, and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you're thinking there has to be something more efficient than spreadsheets, screenshots, and all those manual processes, you're right. GRC can be so much easier and it can strengthen your security posture while actually driving revenue for your business. You know, one of the things I really like about Vanta is how it takes the heavy lifting out of your GRC program. Their trust management platform automates those key areas compliance, internal and third party risk, and even customer trust so you're not buried under spreadsheets and endless manual tasks. Vanta really streamlines the way you gather and manage information across your entire business. And this isn't just theoretical. A recent IDC analysis found that compliance teams using Vanta are 129% more productive. That's a pretty impressive number. So what does it mean for you? It means you get back more time and energy to focus on what actually matters, like strengthening your security posture and scaling your business. Vanta GRC Just imagine how much easier trust can be. Visit vanta.com cyber to sign up today for a free demo that's V A N T a dot com CYBER.