CyberWire Daily – Episode Summary: "CISA Shrinks While Threats Grow" Release Date: April 11, 2025
Host: Dave Bittner, N2K Networks

Introduction

In today's episode of CyberWire Daily, host Dave Bittner delves into a range of pressing cybersecurity issues, from significant staffing cuts at the Cybersecurity and Infrastructure Security Agency (CISA) to evolving cyber threats posed by state-backed hacking groups. The episode also features an insightful interview with Johannes Ulrich, Dean of Research at the SANS Technology Institute, discussing the implications of AI in cybersecurity.

CISA Faces Major Staffing Reductions

CISA Shrinks Amid Growing Threats

At the outset, Dave Bittner addresses the Trump administration's plans to reduce CISA's workforce by approximately 1,300 positions, slashing about half of its full-time staff and 40% of its contractors. These cuts are reportedly a response to the White House's frustration over CISA's perceived role in moderating conservative content.

• Key Impacts:
  • Significant reductions anticipated at the National Risk Management Center and the Stakeholder Engagement Division.
  • Downsizing of CISA's Threat Hunting Team.
  • Potential shifts of responsibilities to the Cybersecurity Division.

Officials have indicated that the precise scope and timeline of these cuts remain undecided and subject to change. Additionally, the administration is promoting early retirements and buyouts, offering incentives up to $25,000, and considering political appointments for regional directors.

Quote:

“[...] the exact scope and timeline remain undecided and could change.”
— Dave Bittner [00:02]

Sean Planky, the CISA director nominee, faces confirmation delays as Senator Ron Wyden blocks his appointment over transparency concerns.

State-Sponsored Cyber Threats Escalate

Russian Hacking Group Gamarudon Targets Ukraine

The episode highlights increased cyber activities by the Russian state-backed hacking group Gamarudon (Shukworm), which has been targeting a Western military mission in Ukraine. Between February and March 2025, the group utilized an upgraded version of their Gamma Steel malware to exfiltrate sensitive data.

• Tactics Used:
  • Deployment via removable drives with malicious shortcut files.
  • Shift towards PowerShell-based tools and increased obfuscation.
  • Use of legitimate services like PowerShell and curl over Tor for stealthy data exfiltration.
  • Establishment of persistence through Windows registry keys.

Symantec notes that despite the group's relatively unsophisticated methods, their evolving tactics pose a growing threat.

Quote:

“Gamerdon's tactics are evolving, making the group a growing threat despite its relatively unsophisticated methods.”
— Dave Bittner [05:00]

China Admits to Volt Typhoon Cyberattacks

In a significant development, Chinese officials indirectly admitted to cyberattacks on U.S. infrastructure linked to the Volt Typhoon campaign during a secret December 2024 meeting in Geneva. The U.S. delegation interpreted this admission as a warning regarding American support for Taiwan.

• Volt Typhoon Details:
  • Targeted critical U.S. sectors using zero-day exploits.
  • Remained undetected in parts of the electric grid for 300 days.
  • Affected sectors include communications, energy, and transportation.

The meeting also addressed the SALT Typhoon campaign, which compromised telecom data from senior officials. While Volt Typhoon is viewed as a serious provocation, SALT Typhoon is considered typical cyber espionage. Both nations continue to escalate mutual cyberattack accusations.

Quote:

“Both nations continue to escalate mutual CyberAttack accusations.”
— Dave Bittner [06:30]

Global Initiatives and Policy Developments

US Joins Global Spyware Restrictions Agreement

The United States has joined an international agreement under the Pall Mall process, an initiative launched by the United Kingdom and France in February to combat the misuse of commercial spyware. This follows a voluntary code of practice signed by 21 countries aimed at regulating cyber intrusion capabilities and curbing abuses targeting civil society.

• Objectives:
  • Separate responsible vendors from those linked to human rights violations.
  • Address scandals in Poland, Mexico, and Greece involving spyware misuse.

Human rights advocates have lauded the move as a bipartisan effort toward responsible spyware governance.

Quote:

“Human rights advocates praise the move as a bipartisan step toward responsible spyware governance.”
— Dave Bittner [07:45]

Significant Data Breaches and Vulnerabilities

Data Breach at Laboratory Services Cooperative

Laboratory Services Cooperative (LSC), a nonprofit supporting reproductive health labs, confirmed a data breach affecting 1.6 million individuals. The breach occurred in October 2024, compromising sensitive data such as personal IDs, medical records, and insurance details. Most affected individuals had lab work done through select Planned Parenthood centers.

• Response Measures:
  • LSC is offering credit and identity protection services.
  • No stolen data has appeared on the Dark Web so far.
  • An ongoing investigation involves federal law enforcement and cybersecurity experts.

Quote:

“An investigation is ongoing, with federal law enforcement and cybersecurity experts involved.”
— Dave Bittner [09:15]

Metadata Theft from Amazon EC2 Instances

In March, a threat actor exploited server-side request forgery (SSRF) attacks to steal metadata from unsecured Amazon EC2 instances, as reported by F5 Labs. The attacker targeted EC2-hosted websites that exposed instance metadata, potentially leaking sensitive API credentials.

• Attack Details:
  • Campaign occurred from March 13th to March 25th.
  • Involved tens of thousands of GET requests from IPs associated with French firm FBW Networks SAS.
  • Exploitation methods included migrating from IMDS v1 to IMDS v2 or blocking requests to the metadata IP to mitigate risks.

Quote:

“F5 advises migrating from IMDS v1 to IMDS v2 or blocking requests to the metadata IP to mitigate future risks.”
— Dave Bittner [10:30]

WordPress Autokit Plugin Vulnerability

A critical vulnerability in the Autokit WordPress plugin, widely installed on over 100,000 sites, is being actively exploited. Security firm Defiant reports that the vulnerability allows attackers to bypass authentication and create admin accounts on unconfigured sites by exploiting a missing value check in API key validation.

• Implications:
  • Full site control achievable, including uploading malicious files or injecting spam.
  • Only unconfigured installations are at risk.
  • Users are urged to update to the latest version to patch the flaw.

Quote:

“Users are urged to update to the latest version to patch the flaw.”
— Dave Bittner [11:15]

Ivanti Products Remote Code Execution Flaw

A newly published analysis reveals a critical, unauthenticated remote code execution (RCE) flaw affecting Ivanti products, including Connect Secure, Policy Secure, Pulse Connect Secure, and ZTA gateways. The vulnerability stems from a stack-based buffer overflow in the web server binary via the X-Forwarded-For header.

• Exploitation Challenges:
  • Payload restrictions allow only digits and periods, forcing attackers to use heap, spray, and return-oriented programming (ROP) techniques.
  • The attack bypasses Address Space Layout Randomization (ASLR) through brute force methods.

Ivanti patched Connect Secure in February, with other product updates scheduled for April. Notably, Pulse Connect Secure is no longer supported. Given the public proof of concept and active exploitation, urgent patching or mitigation is critical.

Quote:

“Given the public proof of concept and active exploitation, urgent patching or mitigation is critical.”
— Dave Bittner [12:00]

Interview: Johannes Ulrich on Vibe Security and AI in Cybersecurity

Discussion Highlights:

In a candid conversation, Johannes Ulrich addresses the burgeoning trend of Vibe coding and Vibe security, where AI systems are leveraged to generate code and security measures based on problem descriptions without deep human understanding.

• Concerns Raised:
  • Reliance on AI Without Understanding: Ulrich warns that relying solely on AI-generated solutions can lead to vulnerabilities if developers do not fully understand the code or security measures implemented.
  • Audit and Oversight Necessity: Emphasizes the importance of human oversight in reviewing AI-generated code to ensure accuracy and security integrity.
  • Complexity and Double-Checking: Highlights the challenges in verifying AI outputs due to their complexity, potentially leading to unchecked errors.

Notable Quotes:

“If you don't know how to code, if you don't know what proper security looks like, how do you know if that firewall rule set that AI came up with [...] are actually correct?”
— Johannes Ulrich [16:30]

“They have to understand what's happening there. [...] You just blame the AI.”
— Johannes Ulrich [21:17]

Key Takeaways:

• Partnership Over Outsourcing: Ulrich advocates for a collaborative approach where developers use AI as a tool while maintaining ultimate responsibility and oversight.
• Importance of Specifications: Stresses that clear and comprehensive specifications are crucial for AI to generate accurate and secure outputs.
• AI as a Double-Edged Sword: While AI can enhance efficiency, it also introduces risks if not properly managed and understood by human developers.

Conclusion of Interview:

Ulrich underscores the necessity for developers to remain knowledgeable and vigilant when integrating AI into their workflows, ensuring that AI serves as an assistant rather than a replacement.

Conclusion

The episode of CyberWire Daily underscores a critical juncture in cybersecurity, marked by institutional changes, escalating state-sponsored threats, significant data breaches, and the complex integration of AI in security practices. As CISA undergoes substantial downsizing, the industry faces mounting challenges from sophisticated hacking groups and evolving vulnerabilities. Meanwhile, the conversation with Johannes Ulrich highlights the indispensable role of human expertise in an increasingly AI-driven cybersecurity landscape.

For a comprehensive overview of today's stories and further insights, listeners are encouraged to visit the CyberWire daily briefing at thecyberwire.com.

Produced by N2K Networks