Transcript
Michelle Kellerman (0:02)
You're listening to the Cyberwire Network powered.
Narrator/Announcer (0:04)
By N2K.AI Adoption is exploding and security teams are under pressure to keep up. That's why the industry is coming together at the Data SEC AI Conference, the premier event for cybersecurity, data and AI leaders. Hosted by data security leader ciara. Built for the industry by the industry, this two day conference conference is where real world insights and bold solutions take center stage. Datasec AI25 is happening November 12th and 13th in Dallas. There's no cost to attend, just bring your perspective and join the conversation. Register now@datasecai2025.com CyberWire Fortra flags a critical flaw in its Go Anywhere managed file transfer solution Cisco patches a critical vulnerability Cloudflare thwarts yet another record DDoS attack Riceta ransomware gang claims the Maryland Transit cyber attack the new Obscura ransomware strain spreads via domain controllers Retailers use of generative AI expands attack Surfaces Researchers expose GitHub Actions misconfigurations with supply chain risk Mandiant links the new Brickstorm backdoor to a China based espionage campaign Kansas students push back against an AI monitoring tool Ben Yellen speaks with Michelle Kellerman, cybersecurity engineer for air and Missile Defense at Johns Hopkins University Applied Physics Lab. They're discussing women's health apps and the legal gray zone they create with HIPAA and senators push the FTC to regulate your brain WA It's Thursday, September 25, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. Fortra has issued an urgent warning about a critical flaw in its Go Anywhere Manage File Transfer solution. The vulnerability carries a maximum CVSS score of 10 and could allow attackers to seize full system control through command injection in the license servlet. Exploitation involves a forged license response signature, letting malicious code run during deserialization. Watchtower Labs says over 20,000 instances are exposed online, calling the bug a playground apt groups dream about. Experts warn the flaw's almost certain to be weaponized soon, echoing the widespread Go anywhere exploit by the Klopp gang in 2023. Fortra has released fixes and urges immediate upgrades. Administrators should also restrict public access to the admin console and monitor logs for suspicious activity. Cisco has released fixes for a critical vulnerability in the Simple Network Management protocol subsystem of iOS and iOS XE software. The flaw, caused by a stack overflow, could allow an authenticated remote attacker with low privileges to trigger denial of service or with higher privileges, execute arbitrary code as root exploitation requires valid credentials. All SNMP versions are affected. Cisco warns that attackers could exploit the bug by sending crafted SNMP packets over IP4 or IP6, potentially giving them full control of affected devices. No workarounds exist, though administrators can mitigate risk by restricting SNMP access and disabling certain object IDs. The only complete fix is upgrading to patched versions. Cloudflare says they mitigated the largest distributed denial of service attack ever recorded, peaking at 22.2 terabits per second and 11.6 billion packets per second. The 42nd volumetric assault generated traffic equivalent to streaming a million 4K videos at once or refreshing every webpage on earth more than once per second. Such packet floods can overwhelm firewalls and routers, even when bandwidth is available. The attack follows other record breaking incidents in recent months, with researchers linking earlier campaigns to the Isuru botnet. The Maryland Transit Administration has confirmed data was stolen during a cyberattack last month, and the Raisita ransomware gang is now claiming responsibility. According to cybersecurity firm Venarix, the group demanded 30 Bitcoin and released samples allegedly showing passports, driver's licenses and contracts, while MTA's core bus, subway and light rail systems were unaffected. Real time tracking and the mobility service for disabled riders were disrupted. An interim call system restored some functionality on August 29th. Officials have not disclosed how many people were impacted, citing an ongoing investigation. Maryland's Department of Information Technology is working with law enforcement and cybersecurity experts. In the meantime, MTA is advising residents to watch for phishing attempts, update software and enable multi factor authentication. Analysts at Huntress have identified a previously unseen ransomware variant, Obscura, after investigating an Aug. 29 incident. The malware, written in Go, was discovered on a victim's domain controller within the netlogon folder, enabling automatic replication across controllers and scheduled execution on multiple hosts. Obscura disables recovery by deleting shadow copies, requires administrative privileges to run and and aggressively terminates security and database processes before encrypting data. The ransom note claims data theft, demands negotiation within 240 hours and threatens public leaks. Encryption relies on Curve 25, 519, Key Exchange and ChaCha 20, researchers note. Obscura joins a wave of emerging ransomware families like Crux and Cephalus, reflecting frequent rebranding in the ecosystem. Huntress advises organizations to closely monitor domain controllers for suspicious file additions or group policy modifications and enforce strong detection on endpoints to catch early activity netscope's retail Sector threat analysis warns that the rapid adoption of generative AI tools is expanding attack services 95% of retailers now use Genai, with increasing reliance on private models and APIs. Sensitive data leaks are rising as employees upload source code, regulated data and credentials into unapproved cloud services and AI platforms. Attackers are also exploiting trusted cloud services like OneDrive, GitHub, and Google Drive to host malware, capitalizing on their credibility. Personal cloud apps like Facebook, LinkedIn, and Drive are pervasive in workplaces, creating overlapping vectors of risk. The report urges retailers to boost visibility, enforce strict data loss prevention and app policies, review HTTP and HTTPs download flows, and adopt solutions like remote browser isolation. In short, innovation in retail is outpacing security controls. The Orca Research pod has uncovered systemic risks in GitHub Actions stemming from misuse of the Pull request target trigger. Unlike the safer Pull request event, this trigger executes workflows in the base repository's context, exposing secrets and granting write enable tokens by default. Researchers demonstrated that insecure workflows could let attackers escalate from untrusted forked pull requests to remote code execution on both GitHub hosted and self hosted runners. Exploits included stealing API keys, pushing malicious code to trusted branches, and abusing overly permissive tokens for package uploads or PR manipulation. ORCA found critical misconfigurations in repositories maintained by Google, Microsoft, and other Fortune 500 firms, highlighting the supply chain risk when CI CD pipelines run untrusted code with excessive privileges. These issues were disclosed responsibly, but the findings underscore how a single forked PR could trigger a full repository compromise. Mandiant says a China linked threat group, UNC5221, is using a new backdoor called Brickstorm to infiltrate organizations and steal intellectual property. Since March of this year, responders have investigated numerous intrusions affecting law firms, SaaS, providers, and technology companies, with attackers targeting the inboxes of senior executives and individuals tied to U.S. national security and trade. Brickstorm, primarily deployed on Linux appliances without endpoint detection, enables persistence and lateral movement into VMware, VCenter, and ESXi hosts. Mandiant noted. The group adapts quickly, even deploying BricStorm after incident response had begun. Evidence suggests the hackers can extract and decrypt administrator credentials and leverage compromise routers for obfuscation. Mandiant warns the campaign's value extends beyond espionage, potentially feeding zero day development and downstream supply chain compromise. Students at Lawrence High School in Kansas say the AI powered monitoring tool Gaggle is chilling speech and intruding on Privacy. Adopted in 2023 at a cost of $160,000, Gaggle scans emails and documents for signs of self harm, violence or abuse, while officials credit it with preventing suicides. Students report false positives, art portfolios flagged as child pornography, essays misinterpreted as threats, and even records requests blocked. Lawsuits now accuse the District of unconstitutional surveillance. A 2024 investigation found more than 1200 flagged cases in under a year, most later deemed harmless. Critics warn the system outs LGBTQ students and undermines journalism, while defenders call it a vital safety net for overburdened staff. For students, the question remains, who is really watching? Coming up after the break, Ben Yellen speaks with Michelle Kellerman from the Johns Hopkins University Applied Physics Lab. They're discussing women's health apps and the legal gray zone that they create with HIPAA and senators push the FTC to regulate your brain waves. Stay with us. Foreign.