Transcript
Dave Buettner (0:02)
You're listening to the Cyberwire network powered by N2K. Now a word about our sponsor, the Johns Hopkins University Information Security Institute. The JHU ISI is home to world class interdisciplinary experts dedicated to developing technologies to protect the world's vast online systems and infrastructure and working closely with US Government research agencies and industry partners. The Institute offers dual degree and joint programs in computer science and Health informatics and has been designated as a Center of Academic Excellence in Cyber Research. Learn more at isi.jhu.edu Europol dismantles the Manson cybercrime market Operation Destabilize stops two major Russian speaking money laundering networks New details emerge on China's attacks on US Telecoms Black Lotus Labs uncovers a covert campaign by the Russian based threat actor Secret Blizzard. Cisco issues patches for a high impact bootloader vulnerability Trend Micro researchers uncovered Earth Minotaur targeting Tibetan and Uyghur communities Payroll pirates target HR Payroll Society to redirect employee funds Pegasus spyware may be more prevalent than previously believed. Our guest today is John France, CISO at ISC2, with insights from the ISC2 2024 workforce study and how businesses can lose customers one tip at a time. It's Thursday, 12-5-20. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Happy Thursday. Thank you for joining us. It is great to have you with us. Europol announced the dismantling of the Manson Market cybercrime marketplace and a network of phishing websites. The investigation, first launched in 2022, revealed Manson Market facilitated the sale of stolen personal and financial data, including bank account information sorted by region and balance. Scammers also operated fake online shops to steal payment details for resale on the marketplace. Authorities seized over 50 servers and 200 terabytes of evidence, with arrests made in Germany and Austria. Visitors to Manson Market's site are now greeted with a notice stating law enforcement possesses all user information. This takedown follows recent operations against Crime Network, a major German speaking illegal marketplace, and Matrix, an encrypted messaging service used by criminals. Europol monitored Matrix for three months before shutting it down, demonstrating continued efforts to disrupt cybercrime infrastructure across Europe. The UK's National Crime Agency, the NCA, has dismantled two major Russian speaking money laundering networks, Smart and TGR, in Operation Destabilize. These networks laundered millions for cyber criminals, including the Ryuk Ransomware Group, and helped Russian elites bypass sanctions. They operated in 30 countries, collecting cash in one location and transferring equivalent amounts, often as cryptocurrency elsewhere. The NCA made 84 arrests and seized £20 million in cash and crypto. Key figures include smart leader Ekaterina Zanova and TGR boss George Rossi, both sanctioned by the U.S. treasury. The operation delivered a blow to the network's operations, severely impacting their finances. NCA Director Rob Jones emphasized the UK is no haven for money laundering, disrupting these schemes at every level. In an update, Deputy National Security Adviser Ann Neuberger said the Chinese hacking campaign that compromised at least eight U.S. telecom firms and affected dozens of countries. Salt Typhoon targeted senior US Government officials, political figures and private individuals, enabling Beijing to access phone calls and text messages. Though no classified information was compromised, ongoing risks remain as affected companies work to fully expel the hackers. The breach, believed to have started one or two years ago, appears regionally focused and impacts a low couple dozen countries. The FBI and CISA have issued guidance urging telecom firms to enhance encryption, centralize systems and monitor networks to mitigate risks. China denied the allegations, accusing the US of cyberattacks. The White House emphasized that improved cybersecurity standards similar to those implemented after the Colonial Pipeline ransomware attack are critical to preventing future intrusions. The FBI, CISA and allied agencies are urging the use of end to end encryption following revelations that China's Salt Typhoon Group exploited these backdoors in public telephone networks. CISA's Jeff Green emphasized the need for encrypted communications to secure networks long term. Senators Ron Wyden and Eric Schmidt highlighted vulnerabilities in unencrypted DoD communications, advocating for Matrix, a decentralized E to EE platform used by NATO allies and the US Navy. Matrix offers enhanced security and digital sovereignty over centralized systems like Microsoft Teams. Obviously this is a different Matrix than the one we previously mentioned that was being used by German cybercriminals. Black Lotus Labs uncovered a covert campaign by the Russian based threat actor Secret Blizzard, also known as Turla, targeting Pakistani actor Storm 0156. Over two years, Secret Blizzard infiltrated 33 command and control servers operated by Storm 0156, known for espionage under the side Copy and Transparent tribe clusters. Secret Blizzard gained access in December of 2022, embedding their malware 2Dash and Statuzi into Afghan government networks by mid 2023. By April of 2023, they infiltrated Pakistani operators, workstations, acquiring data on Storm tools, credentials and exfiltrated intelligence, expanding operations. In 2024, they appropriated and repurposed Storm 0156's malware, including Crimson Rat, previously used against Indian government and military targets. This allowed Secret Blizzard to exfiltrate additional data from prior operations, showcasing their expertise in hijacking adversarial infrastructure. Lumen Technologies credited Microsoft Threat Intelligence team for their collaboration in addressing this threat. Cisco has issued patches for a high impact vulnerability in its NXOS software bootloader that could allow attackers to bypass image signature verification and load unverified software. Exploitation requires physical access or administrative privileges, but no authentication. Over 100 device models are affected with no workarounds available. Cisco has released patches and plans to address all devices by month's end except for discontinued switches. No active exploitation of this vulnerability has been reported, but users are urged to update promptly. Trend Micro researchers uncovered Earth Minotaur, a group using the updated Moonshine exploit kit to target vulnerabilities in Android instant messaging apps, primarily impacting Tibetan and Uyghur communities. Moonshine, now with over 55 servers, exploits Chromium based browser flaws and delivers the Dark Nimbus backdoor to both Android and Windows devices. Dark Nimbus targets apps like WeChat, posing a cross platform threat. Researchers emphasize the importance of regular software updates to mitigate these attacks and protect against Moonshine's evolving capabilities. The threat analysis team at Silent Push have uncovered an extensive phishing campaign by a group they call the Payroll Pirates, targeting HR payroll systems to redirect employee funds using domains spoofing major organizations like Workday, Kaiser Permanente and New York Life. Attackers lure victims to fake HR pages through malicious search ads. Once inside employee portals, scammers use stolen credentials to alter banking details. For fund redirection, the group utilizes website builders like Mobberize and popular registrars, creating hundreds of domains linked to dedicated IP ranges. Silent Push identified evolving tactics including phishing campaigns targeting unemployment portals and credit unions. An investigation by Iverify revealed significant insights into mobile threats, highlighting the hidden prevalence of spyware like Pegasus. Through scans of 2,500 user devices, the investigation uncovered seven Pegasus infections showing compromises spanning years and affecting devices running multiple iOS versions. This challenged the perception that spyware primarily targets only high profile individuals like journalists or government officials. Pegasus, developed by NSO Group, uses sophisticated methods like zero click attacks and exploits operating system vulnerabilities to achieve full device control. The investigation's results, 2.5 infections per 1,000 scans, suggest that spyware is more common than previously thought. The research emphasizes the need for broader scalable detection to uncover threats often hidden from traditional security measures. By examining a larger sample, the findings offer a clearer example of the scope of mobile device compromise in an evolving threat landscape. Coming up after the break, my conversation with John France, CISO@ISC2. He shares insights from the ISC2 2024 workforce study and how businesses can lose customers one tip at a time. Stay with us.