Transcript
A (0:02)
You're listening to the Cyberwire Network, powered by N2K. Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows, and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproof.IO to see how leading teams are transforming their GRC programs. A Texas telecom confirms a nation attack A global outage disrupts Azure and Microsoft 365 services malicious npm packages steal sensitive data from Windows, Linux and macOS systems. Hacktivists have breached multiple critical infrastructure systems across Canada. Major chip makers spill the tea TP link home routers fall under federal scrutiny Cloud Atlas targets Russia's agricultural sector Israel's cloud computing deal with Google and Amazon allegedly includes a secret winking mechanism the FCC tamps down on overseas robocalls. Our guest is Mike Anderson from Netscope discussing why CIOs should think like HR leaders when considering agentic AI and Danes draw the line at digital doppelgangers It's Thursday, October 30th, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here. It's great to have you with us. Hackers linked to an unnamed nation state infiltrated the network of Ribbon communications and remained undetected for nearly a year, the Texas based telecom company confirmed. Ribbon disclosed in an SEC filing that attackers gained access in December 2024 and were discovered only last month. The breach affected three small customers, and while investigators found no evidence that sensitive or government data was compromised, several older customer files were accessed. Ribbon said it has hardened its network and continues working with outside experts. The incident underscores growing risks to telecom providers that support government and critical infrastructure clients, with researchers warning that such firms have become high value espionage targets. The company has not identified the nation state involved. Yesterday, Microsoft suffered a widespread global outage, disrupting Azure and Microsoft 365 services after an Azure front door configuration change triggered a DNS failure. The disruption prevented customers, including healthcare organizations and critical infrastructure operators, from accessing portals like Azure. Intune and Exchange. Authentication failures locked many employees out of company networks, with reports of downtime from sectors including transportation and government. Microsoft initially blamed a DNS issue, later confirming an inadvertent configuration change as the root cause. Engineers blocked further updates, rolled back systems to a stable state, and rerouted traffic to healthy infrastructure. Early this morning, Microsoft confirmed mitigation and recovery. The outage follows a recent AWS DNS failure, emphasizing ongoing fragility in cloud service dependencies. 10 malicious npm packages impersonating popular software libraries were found stealing credentials and sensitive data from Windows, Linux and macOS systems. Researchers at Socket said the fake packages uploaded July 4 use typo squatting and multiple obfuscation layers to evade detection, amassing nearly 10,000 downloads upon installation. A hidden post install script launched an obfuscated loader that displayed a fake Captcha before downloading a 24 megabyte information stealer built with PI installer. The malware targeted browser data system keyrings, SSH keys and authentication tokens, exfiltrating them to an attacker controlled server. Despite being reported, the malicious packages remain live on NPM Developers who installed them are urged to remove infections and rotate credentials immediately. The Canadian Centre for Cybersecurity has warned that hacktivists have breached multiple critical infrastructure systems across Canada Canada, manipulating industrial controls and creating potentially dangerous conditions. Recent incidents affected a water treatment plant, an oil and gas company and a grain facility, disrupting operations and triggering false alarms. Authorities say these opportunistic attacks sought publicity and public distrust rather than causing physical damage. The warning highlights the risk of exposed industrial control systems like PLCs and SCADA devices. Organizations are urged to restrict Internet access to ICS components, enforce VPN and multi factor authentication, and follow national cybersecurity readiness goals. Though no severe damage occurred, officials warn the incidents expose serious vulnerabilities in Canada's critical infrastructure. A new hardware based exploit known as T fail has broken key protections in trusted execution environments from Intel, AMD and Nvidia technologies that safeguard confidential data in cloud, AI and blockchain systems. Researchers showed that by inserting a small device between a memory chip and motherboard, and with kernel level access, attackers can defeat trusted execution environments within minutes. The flaws stem from deterministic encryption, which allows repeated ciphertext patterns exploitable for replay attack. Despite chipmakers claims of secure enclaves all exclude physical attacks from their threat models, leaving widespread misconceptions about their guarantees. The findings reveal that even low cost physical attacks can compromise T's across industries, exposing sensitive workloads once thought secure. Experts warn organizations to reassess reliance on T's for private computation, especially in untrusted or remote environments. More than half a dozen US Federal agencies have supported a Commerce Department proposal to ban sales of TP Link home routers, citing national security concerns over the company's ties to China. The interagency review, backed by Homeland Security, Defense and Justice concluded that TP Link systems US Products could still be influenced by Chinese government directives through its former parent, TP Link Technologies. TP Link disputes the claim, saying it's a fully American company with independent operations. If enacted, the ban would affect over one third of US Home routers, marking one of the largest consumer tech prohibitions in history. The proposal remains under commerce review. Amid US China trade tensions, with critics warning TP Link devices could expose sensitive U.S. data or or be manipulated through software updates. State backed hacker group Cloud Atlas has launched a new cyber espionage campaign targeting Russia's agricultural sector ahead of a major industry forum in Moscow. Researchers at F6 say attackers used phishing emails disguised as official event materials to exploit an old Microsoft Office flaw. The campaign mirrors previous Cloud Atlas attacks on Russian agro and defense entities, showing continued use of outdated vulnerabilities and social engineering. Active since 2014, Cloud Atlas remains a persistent espionage threat across eastern Europe. In 2021, Israel secured a $1.2 billion cloud computing deal project Nimbus with Google and Amazon that included a secret winking mechanism to discreetly alert Israel if its data was handed to foreign law enforcement, the Guardian reports. According to leaked government documents, the system used coded payments tied to country dialing codes, enabling Israel to detect data disclosures despite gag orders. The contract also prohibits Google and Amazon from restricting Israel's access to cloud services, even over human rights concerns. Israeli officials designed the arrangement to protect data sovereignty and ensure uninterrupted access amid global scrutiny of its use of cloud technology in military operations. Legal experts say the mechanism could breach secrecy laws in the US or other jurisdictions. Both companies deny evading legal obligations or breaching international law. The deal highlights Israel's extensive control over its government and military data and raises questions about tech firms accountability in global surveillance. The FCC has approved a new rule expanding caller ID requirements to curb the surge in robocalls, especially those originating overseas. The measure broadens the definition of caller identity information, mandates providers to verify caller names, and requires alerts when calls come from abroad or misuse US Area codes. Providers must also display verified caller names and additional data such as logos or call purposes. Officials say the rule enhances transparency and may help deter fraudulent international calls. Coming up after the break, Mike Anderson from NETSCOPE discusses why CIOs should think like HR leaders and Danes draw the line at digital doppelgangers. Stick around. And now a word from our sponsor. ThreatLocker, the powerful zero trust enterprise solution that stops ransomware in its tracks. Allow listing is a deny by default software that makes application control simple and fast. Ring fencing is an application containment strategy, ensuring apps can only access the files, registry keys, network resources and other applications they truly need to function. Shut out cybercriminals with world class endpoint protection from Threat locker what's your 2am security worry? Is it do I have the right controls in place? Maybe are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows. Using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber Mike Anderson is Chief Digital and Information Officer at Netscope. I recently got together with him to discuss why CEOs should think more like HR leaders when considering agentic AI.