Transcript
Maria Varmazes (0:02)
You're listening to the Cyberwire Network powered.
Dave Bittner (0:04)
By N2K.
Sponsor/Advertisement Voice (0:12)
Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproof.IO to see how leading teams are transforming their GRC programs. And now a word from our sponsor, ThreatLocker, the powerful Zero Trust Enterprise Solution that stops ransomware in its tracks. Allow Listing is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy, ensuring apps can only access the files, registry keys, network resources and other applications they truly need to function. Shut out cybercriminals with world class endpoint protection from threat locker.
Maria Varmazes (1:34)
CISA says cooperation between federal agencies and the private sector remains steady. Long standing Linux kernel vulnerability in active ransomware campaigns confirmed A Chinese linked group targets diplomatic organizations in Hungary, Belgium and other European nations. A government contractor breach exposes data of over 10 million Americans luxury fashion brands fall victim to impersonation scams. Phishing shifts from email to LinkedIn. Advocacy groups urge the FTC to block Meta from using chatbot interactions to target ads. A man pleads guilty to selling zero days to the Russians Emily Austin, principal security researcher at Census, discusses why nation state attackers continue targeting critical infrastructure and when M and S went offline. Shoppers hit next Today is Friday, October 31, 2025. Happy Halloween, Maria. I'm Maria Varmazes, host of T Minus Space Daily here on the N2K CyberWire network, filling in today for Dave Buettner, and this is your Cyberwire Intel Briefing. Thanks for joining me today, everyone. Let's get into it. First up, despite the recent Expiration of the 2015 Cybersecurity Information Sharing act, according to Nick Anderson of the Cybersecurity and Infrastructure Security Agency, AKA cisa, cooperation between federal agencies and the private sector on cyber threat data sharing remains steady. Anderson credited the sustained collaboration to CISA's strong reputation and established long term partnerships, but emphasized that the lapsed authority is core and critical to managing national cyber risk. Lawmakers are seeking a 10 year renewal, though efforts have been repeatedly stalled in the Senate amid the ongoing US Government shutdown. National Cyber Director Shawn Cairncross also called the statute vital, urging swift reauthorization to preserve the trust and information exchange that underpins US Cybersecurity. Elsewhere, CISA and the NSA joined by Cyber Agencies in Australia and Canada released new guidance to help organizations secure Microsoft Exchange servers from attack. The advisory urges IT administrators to harden authentication, limit administrative access and enforce strong encryption and adopt zero trust principles. It strongly recommends decommissioning outdated or hybrid Exchange servers after migrating to Microsoft 365. Warning that unsupported systems pose major breach risks, the agencies outlined over a dozen key steps including enabling multi factor authentication, keeping servers patched using Kerberos instead of ntlm, enforcing transport layer security, and applying role based access controls. This guidance follows CISA's August Emergency Directive requiring federal agencies to rapidly address a critical exchange vulnerability. CISA has also confirmed that a high severity Linux kernel flaw is now being exploited in ransomware attacks, and the vulnerability is a use after free bug in the netfilternftables component, and it allows attackers to gain root level privileges. It affects major Linux distributions including Debian, Ubuntu, Fedora and Red Hat. This escalation flaw enables system takeover, lateral movement and data theft once root access is achieved. Organizations that are unable to patch are urged to block NF tables, restrict user namespaces, or load the Linux kernel runtime guard module. Arctic Wolf Labs has uncovered an active cyber espionage campaign by Chinese linked group UNC6384 targeting diplomatic organizations in Hungary, Belgium and other European nations in September and October 2025. The operation exploits a Windows shortcut vulnerability that was disclosed earlier this year. Combined with convincing phishing lures themed around European Commission and NATO events, the multi stage attack delivers Plug X remote access malware via DLL sideloading of legitimate Canon printer utilities. Researchers say that the campaign shows rapid adoption of newly disclosed flaws, advanced social engineering aligned with diplomatic calendars, and expansion beyond UNC6384's usual Southeast Asia focus. Arctic Wolf attributes the campaign with high confidence based on tooling tactics and infrastructure overlaps with prior operations. Government contractor Conduent has disclosed that a January cyber attack exposed personal data belonging to more than 10 million people across multiple US states. The breach investigation found that attackers had access to conduent systems from October 21 to January 13, stealing files that are tied to its government service contracts. Impacted states include Texas, Washington, South Carolina and others with compromised data such as Social Security numbers and health information. The SafePay ransomware gang claimed responsibility, saying that it stole eight and a half terabytes of data. Conduent says no stolen data has surfaced publicly, systems have been restored and law enforcement is investigating. That said, the company provides technology services for Medicaid, child support and EBT programs serving about 100 million U.S. residents. Researchers at Pre Crime Labs, which is part of B4AI, uncovered a surge in malicious domains impersonating luxury fashion brands ahead of the 2025 holiday season. Between mid August and late September they identified 1,330 domains with over 1,200 mimicking 23 major brands. These fraudulent sites exploit brand prestige to lure customers into scams and phishing attacks, causing both financial and reputational harm. Coordinated domain registrations, recurring email operators and exploitation of current events suggest an organized criminal network preparing large scale fraud campaigns. Hackers are exploiting LinkedIn to Phish finance executives with fake invitations to join a Commonwealth Investment Funds Executive Board aiming to steal Microsoft credentials. According to Push Security, victims receive LinkedIn messages containing malicious links that redirect through Google and Firebase to a fake LinkedIn Cloudshare site. The page ultimately displays a spoofed Microsoft login to harvest credentials and session cookies. Push warns that phishing now frequently occurs outside of email, with LinkedIn based attacks rapidly increasing in sophistication and volume. A coalition of more than 30 consumer and children's advocacy groups is urging the Federal Trade Commission to block Meta from using users chatbot interactions to target ads or personalize content. META plans to begin this practice on December 16th without opt in consent. The groups, including EPIC and the center for Digital Democracy, argue that the move violates section 5 of the FTC act on Unfair Practices. They call it an industrial scale privacy abuse, pressing the FTC to act decisively. Former L3Harris executive Peter Williams, aged 39, pleaded guilty to two counts of theft of trade secrets for selling eight US government developed zero day exploits to a Russian broker in exchange for millions in cryptocurrency. Prosecutors said that Williams stole the tools while working at Trenchant, which is an L3Harris subsidiary, and then sold them to a firm believed to be Operation Zero, which is a Russian platform advertising exploits for non NATO clients. This scheme, running from 2022 to 2025, caused approximately $35 million in losses and risked arming adversaries with advanced cyber capabilities. Williams faces up to 20 years in prison, fines exceeding $300,000 and $1.3 million. Sentencing is scheduled for January and stick around after the break when Dave Buettner is joined by Emily Austin, principal security researcher at Census, as they discuss why nation state attackers continue targeting critical infrastructure and when M and S will went offline. Shoppers hit next.