Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:12)
Ever wished you could rebuild your network from scratch to make it more secure, scalable and simple? Meet Meter, the company reimagining enterprise networking from the ground up. Meter builds full stack zero trust networks including hardware, firmware and software, all designed to work seamlessly together. The result? Fast, reliable and secure connectivity without the constant patching, vendor juggling or hidden costs. From wired and wireless to routing, switching, firewalls, DNS security and vpn, every layer is integrated and continuously protected in one unified platform. And since it's delivered as one predictable monthly service, you skip the heavy capital costs and endless upgrade cycles. Meter even buys back your old infrastructure to make switching effort, transform complexity into simplicity and give your team time to focus on what really matters, helping your business and customers thrive. Learn more and book your demo@meter.com cyberwire that's M E T E R.com cyberwire. Venezuela's state oil company blames a cyber attack on the U.S. an Iranian hacker group offers cash bounties for doxing Israelis. Germany's lower house of parliament suffers a major email outage. South Korea's E Commerce breach exposes personal information of nearly all of that nation's adults. Researchers report active exploitation of two critical Fortinet authentication bypass vaults vulnerabilities and three critical vulnerabilities in the free PBX VOIP platform. An auto industry credit reporting agency suffers a data breach. Google is shutting down its dark web reporting service. European law enforcement dismantles a Ukrainian fraud network. Our guest is Christian Beek, senior director of Threat Intelligence and analytics at Rapid7, discussing how attackers are accelerating exploitation, refining, ransomware and expanding nation state operations. And a pornhub breach proves the Internet Internet never forgets. It's Tuesday, december 16, 2025. I'm dave bittner and this is your cyberwire intel brief. Foreign. Thanks for joining us here today. It's great as always to have you with us. Venezuela's state oil company PDVSA reported a cyber attack on Monday and said operations were unaffected, though multiple sources said key systems remained down and oil cargo deliveries were suspended. PDVSA and the Oil Ministry blamed the United States, calling the incident part of efforts to seize control of Venezuela's oil sector. A company source said the disruption stemmed from a ransomware attack detected days earlier, with antivirus efforts crippling administrative systems. Oil production, refining and domestic distribution continued, but exports were hit, forcing staff to keep handwritten records and halting loading instructions. The incident comes amid rising U S, Venezuela tensions, including the recent U.S. seizure of a tanker carrying Venezuelan crude. As a result, exports have fallen sharply, millions of barrels remain stranded offshore and several tankers have turned back. An Iran linked hacker group known as Handala has launched a campaign offering cash bounties for information on more than a dozen Israelis it claims are involved in developing Israel's Patriot Arrow and David's Sling air defense systems. The group published photos and extensive personal details of engineers and technicians alongside explicit threats, including references to their families. A $30,000 bounty was offered for information on some targets, with additional lists offering $10,000 rewards. The data has spread widely on Arab media and Telegram, including via Hamas, though its accuracy has not been independently verified. The effort is part of Handala's broader Red Wanted doxxing campaign, which has targeted nearly 200 Israelis since October. The group is widely assessed to have ties to Iranian intelligence and a history of cyber and leak operations. Germany's lower house of parliament suffered a major email outage on Monday, leaving lawmakers without access for more than four hours and prompting suspicions of a targeted cyber attack. The disruption coincided with sensitive US Ukraine discussions hosted in Germany, raising concerns about timing and intent. While technical details remain undisclosed, senior lawmakers have acknowledged an ongoing investigation of According to Reuters, citing the Financial Times, the incident highlights persistent cyber risks to government institutions, particularly during periods of heightened geopolitical activity and diplomatic engagement. Coupang, South Korea's largest e commerce company and often compared to Amazon, suffered one of the country's largest data breaches, exposing personal information from up to 34 million user accounts. That's more than 90% of the working age population. The leak, which went undetected for nearly five months, included names, phone numbers and residential entry codes, but not credit card or government ID data. Authorities say. The alleged perpetrator was a former Coupang software developer who retained internal authentication credentials after leaving the company and accessed systems from overseas. The breach triggered lawsuits, police raids, multiple government investigations and the resignation of Kupang's South Korea CEO. Regulators are considering record fines, while public anger has intensified calls for tougher penalties over personal data protection failures. Researchers at Arctic Wolf report active exploitation of two critical Fortinet authentication bypass vulnerabilities beginning December 12th. The flaws allowed unauthenticated SSO logins via crafted SAML messages When ForticLoud SSO is enabled, leading to admin access and configuration exfiltration on Fortigate devices. Affected products include fortaos, fortaproxy, Forta Web and Forta Switch Manager. Arctic Wolf advises resetting credentials, restricting management interface access and upgrading immediately to patched versions. They note forticloud SSO may be enabled during device registration despite being disabled by default. Elsewhere, researchers at Horizon 3 AI disclosed three critical vulnerabilities in the free PBX VoIP platform that could be chained to fully compromise affected systems. The most severe allows authentication bypass when a non default web server authentication setting is enabled. Additional flaws include SQL injection and arbitrary file upload vulnerabilities that enable database access and remote code execution. While some issues were exploited in the wild, FreepBX has released patches across multiple versions. Organizations are urged to update immediately and ensure authentication settings remain on the default user manager option. 700 credit, a major credit reporting and identity verification provider for the North American automotive industry, disclosed a data breach affecting more than 5.8 million individuals. The incident was discovered on October 25 and traced to a compromised third party API tied to the company's Web application. Attackers accessed data collected from automotive dealers between May and October of this year, including names, addresses, dates of birth and Social Security numbers. The breach impacted the 700dealer.com application layer, but the company says its internal network and operations were unaffected. 700 credit reports no evidence so far of identity theft or data misuse and is notifying affected individuals. Google will shut down its Dark Web report feature on February 16th of next year, ending a service launched about 18 months ago to help users monitor stolen personal data. The tool will stop scanning for new breaches on January 16, with all stored data deleted a month later, Google acknowledged that while the feature alerted users when information like emails, phone numbers or Social Security numbers appeared in breach dumps, it failed to offer clear, actionable guidance on what to do next. User feedback, including complaints on Reddit, highlighted the lack of specificity about which accounts were at risk. Google says it will instead focus on existing security tools such as Security Checkup, Password Manager and password checkup, which provide more practical steps for protecting accounts. European law enforcement agencies have dismantled a large fraud network, operating call centers in Ukraine that scammed victims across Europe out of more than 10 million euros. Authorities from several countries supported by Eurojust, arrested 12 suspects and carried out 72 searches in Ukraine, seizing vehicles, weapons, cash, computers and forged identification. The network ran multiple call centers employing around 100 people and targeted more than 400 victims through bank and police impersonation scams, remote access fraud and in person cash collection. Employees were paid commissions of up to 7%, with promised bonuses that were never delivered. Officials say the operation highlights the continued scale of organized call center fraud across Europe. Coming up after the after the break, my Conversation with Christiane Beek from Rapid7. We're discussing how attackers are accelerating exploitation, refining ransomware and expanding nation state operations. And a pornhub breach proves the Internet never forgets. Stay with us. Foreign. What's your 2am Security worry? Is it, do I have the right controls in place? Maybe are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data, and simplifies your security at scale. And it fits right into your workflows. Using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently, and finally, get back to sleep. Get started@vanta.com cyber. That's V A N T A dot com cyber.