Transcript
Anika Gupta (0:02)
You're listening to the Cyberwire network, powered by N2K.
Dave Bittner (0:12)
And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire Researchers discover what may be China's largest ever data leak CrowdStrike cooperates with federal authorities following last year's major software bug. A researcher discovers over half a million sensitive insurance documents exposed online. Microsoft offers free cybersecurity programs to European governments. The FBI chronicles the play Ransomware gang Google warns a threat group is targeting Salesforce customers. A former Biden cybersecurity official warns that US Critical infrastructure remains highly vulnerable to cyber attacks. The State Department offers up to $10 million for information on the Redline Info Stealer malware. Our guest is Anika Gupta, Chief product Officer of Rubrik on the challenges of managing security across systems and some FDA workers want to put their new Elsa AI on Ice. It's Thursday, June 5th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief. Thanks for joining us here today. Great as always to have you with us. In what may be China's largest data leak ever, over 4 billion personal records totaling 631 gigabytes were exposed from an unsecured database. The leak includes sensitive financial data, WeChat and Alipay information, ID numbers, addresses and more, potentially affecting hundreds of millions of users. CyberNews and researcher Bob Dychenko discovered 16 data collections containing massive databases with hundreds of millions of records each. The data appears to be meticulously compiled, likely for surveillance or profiling purposes. The database was quickly taken offline, leaving no clear attribution or recourse for victims. Experts warn the data could fuel phishing fraud, blackmail or state level espionage. This leak dwarfs previous Chinese breaches and underscores the severe privacy risks at play. CrowdStrike is cooperating with federal authorities following the major software bug last July that knocked millions of computers offline. In a recent SEC filing, the company revealed that the Justice Department and SEC are investigating the incident as well as CrowdStrike's revenue recognition practices and reporting of annual recurring revenue. Other agencies and third parties have also requested information, with some customers threatening legal action. The July 19 outage, triggered by a flaw in the Falcon software, disrupted flights, backend systems and user devices. CrowdStrike disclosed the update alongside its fiscal quarter one report showing a swing to a loss and a weaker outlook due to ongoing costs from the incident. Shares dropped 5.3% following the news, though the stock remains up 35% over the last year. Last month, researcher JLT discovered a misconfigured cloud server exposing over 571,000 sensitive insurance documents belonging to Triangle Insurance in the U.S. the records, dating from 2006 to April 2025, included health claim forms, declaration pages and decision letters. Despite an initial email alert sent on May 8, Triangle didn't respond, likely due to spam filters. The researcher then enlisted the help from ogowasright@data breaches.net who successfully contacted the company on May 12. The exposure was secured by the following day. Triangle's COO later confirmed the fix and thanked the researcher. The company is now investigating the issue with its software vendor, has notified its regulator and may inform affected individuals, depending on findings. The server had been exposed since at least July 2021 Microsoft has launched a free cybersecurity program for European governments to strengthen defenses against AI powered cyber threats, many linked to state backed actors from Russia, China, Iran and North Korea. The initiative focuses on improving intelligence sharing and preventing attacks. Microsoft President Brad Smith emphasized using AI defensively, noting tools can still detect AI driven threats. Microsoft also monitors the use of its AI to block cybercriminals. Notable recent threats include deepfakes targeting Ukraine's president and Slovakia's 2023 election. Since emerging in 2022, the Play ransomware gang has hit over 900 organizations, making it one of the most dangerous active cybercrime groups, according to a new FBI advisory. This is a sharp rise from 300 attacks reported in its first year. The group targets organizations across the Americas and Europe, often using email or phone threats to pressure victims into paying ransoms. Play frequently exploits flaws in the Simple Help remote monitoring tool and customizes its ransomware for each attack to evade detection. High profile victims include cities like Oakland and Dallas county and even the Swiss government. The FBI also noted possible links between Play and North Korean hackers, suggesting collaboration in some breaches. The group remains highly active, especially against U S based organizations. Google has warned that threat group UNC6040 is targeting Salesforce customers in a widespread voice phishing and data extortion campaign. The group impersonates IT support staff in phone calls, tricking employees into approving access for a modified Salesforce data loader app. This unauthorized tool allows attackers to exfiltrate sensitive data, which is later used for extortion. Around 20 organizations across sectors like education, retail and hospitality in the Americas and Europe have been hit. UNC6040 often leverages social engineering alone. No salesforce vulnerabilities were exploited. Once inside, they move laterally to platforms like Microsoft 365 and Okta. The group claims ties to Shiny Hunters and shows overlap with tactics used by the. COM Collective, including Scattered Spider. Google highlights this as part of a rising trend of attackers targeting IT support roles for initial access. At the AI Expo for national competitiveness, former Biden cybersecurity official Anne Neuberger warned that U.S. critical infrastructure remains highly vulnerable to cyberattacks. She said, I do not have confidence that any part of our infrastructure couldn't be brought down. Citing outdated tech, Internet exposed systems and weaker defenses for operational technology, Neuberger emphasized using AI to identify flaws in legacy systems, including through digital twins for testing. She also stressed the importance of allied intelligence sharing, referencing past cooperation with Israel and Asian partners on threats like election interference and North Korean crypto theft. Now a Stanford lecturer, Neuberger called ongoing federal cyber staffing cuts troubling, but sees AI as a chance to rethink cyber defense, focusing on patching the most critical vulnerabilities before adversaries like China or Russia exploit them. The U.S. state Department is offering up to $10 million for information on foreign government backed hackers using the Redline infostealer malware or on its suspected creator, Russian national Maxim Alexandrovich Rudomatov. This reward, part of the Rewards for Justice program, targets individuals involved in cyberattacks against U.S. critical infrastructure. Rudomitov, charged in October, allegedly managed Redline's infrastructure and laundered payments via crypto. The reward also applies to any associates or state linked use of the malware. Redline and Meta malware platforms were disrupted during Operation Magnus, a joint international effort involving Dutch authorities and Eurojust, leading to server seizures and arrests. Eset helped map 1200 related servers and released a tool for detecting infections. Rudomitov remains at large and faces up to 35 years in prison if convicted. Coming up after the break, my conversation with Anika Gupta from Rubrik. We're discussing the challenges of managing security across systems and some FDA workers want to put their new ELSA AI on ice. Stick around compliance regulations, third party risk and Customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you've ever found yourself drowning in spreadsheets, chasing down screenshots, or wrangling manual processes just to keep your GRC program on track, you're not alone. But let's be clear, there is a better way. Vanta's trust management platform takes the headache out of governance, risk and compliance. It automates the essentials from internal and third party risk to consumer trust, making your security posture stronger. Yes, even helping to drive revenue. And this isn't just nice to have. According to a recent analysis from IDC, teams using Vanta saw a 129% boost in productivity. That's not a typo, that's real impact. So if you're ready to trade in chaos for clarity, check out Vanta and bring some serious efficiency to your GRC game. Vanta GRC how much easier trust can be? Get started at vanta.com cyber Anika Gupta is Chief Product Officer at Rubrik. I caught up with her recently to discuss the challenges of managing security across systems.