Transcript
A (0:02)
You're listening to the Cyberwire Network, powered by N2K.
B (0:14)
From phishing to ransomware, cyber threats are constant. But with Nordlayer, your defense can be too. Nordlayer brings together secure access and advanced threat protection in a single, seamless platform. It helps your team spot suspicious activity before it becomes a problem by blocking blocking malicious links and scanning downloads in real time, preventing malware from reaching your network. It's quick to deploy, easy to scale, and built on zero trust principles so only the right people get access to the right resources. Get 28% off on a yearly plan at nordlayer.com cyberwire daily with code CYBERWIRE28 that's nordlayer.com CyberWire Daily Code CYBERWIRE28 that's valid through December 10, 2025. The US and allies sanction Russian bulletproof hosting providers the White House looks to SUE states over AI regulations. The U.S. border Patrol flags citizens suspicious travel patterns. Lawmakers seek to strengthen the SEC's cybersecurity posture. A new Android Banking Trojan captures content from end to end encrypted apps. A hidden browser API raises security concerns. Fortinet patches a zero day A Philippine former mayor gets life in prison for scam center human trafficking. Our guest is Cliff Crossland, CEO and co founder@scanner.dev discussing why security data lakes are ideal for AI in the sock and green energy gets hijacked for a blockchain side hustle. It's Thursday, November 20th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief.
C (2:30)
Foreign.
B (2:35)
Thanks for joining us here today. It's great as always to have you with us. The United States, United Kingdom and Australia announced new sanctions against Russian bulletproof hosting providers that support ransomware gangs and broader cybercrime operations. Bulletproof hosting providers lease infrastructure to threat actors and ignore takedown requests, enabling phishing campaigns, malware delivery, command and control operations, illicit content hosting and distributed denial of service attacks. The U.S. treasury's Office of Foreign Assets Control, designated media land and three affiliated companies, noting the group's links to ransomware operations, including Lockbit, Blacksuit and Play. Three Media Land executives were also sanctioned with with UK officials stating that one, Alexander Volosevic, has worked with groups such as EvilCorp and Black Basta. OFAC additionally sanctioned ISA Group LLC, previously targeted in July, as well as Hypercor Limited and related support entities. Five Eyes cybersecurity agencies issued accompanying guidance urging defenders to use threat intelligence to traffic analysis, boundary filtering and stronger customer verification. The sanctions freeze assets and expose intermediaries to secondary penalties. The Trump administration is preparing an executive order that would direct the Justice Department to sue states that pass laws regulating artificial intelligence, according to a draft reviewed by the Washington Post. The move follows a failed Republican Senate effort to block state AI rules amid concerns about risks to jobs, children and energy consumption. The order argues that state regulations interfere with interstate commerce, though legal experts say this likely exceeds presidential authority. It would also create a federal task force to review state AI laws and allow the Commerce Department to withhold broadband funding from states deemed out of line. Trump continues to push for a single national AI standard, though several Republican governors and lawmakers object to federal preemption. The Associated Press reports that the U.S. border Patrol is running a secretive surveillance program that tracks millions of American drivers and flags suspicious travel patterns. The system uses a vast network of license plate readers and algorithms to analyze where vehicles come from, where they go and what routes they take. Alerts lead to whisper or wall stops where local police pull drivers over for minor infractions, then question and search them without revealing Border Patrol's role. Cameras are often hidden in traffic equipment and extend far beyond the traditional 100 mile border zone, reaching deep into major metro areas. Civil liberties experts say this mass data collection and pattern analysis raises serious Fourth Amendment and free movement concerns. A bipartisan pair of Georgia lawmakers, Democrat David Scott and Republican Barry Loudermilk, have reintroduced the SEC Data Protection act of 2025 to strengthen the securities and Exchange Commission's cybersecurity posture. The bill would require the SEC to adopt modern data protection protocols aligned with federal and National Institute of Standards and Technology best pract, create uniform policies for handling sensitive market information and improve internal accountability, the lawmakers say. Rising cyber attacks and recent government breaches underscores the need for updated safeguards, warning that outdated frameworks risk undermining trust in the US financial system. The measure, which would take effect one year after enactment previously stalled in 2020. The SEC declined to comment. A newly identified Android banking trojan named Sternus can capture content from end to end. Encrypted apps like Signal, WhatsApp and Telegram by reading messages directly from the device screen after decryption. Researchers at ThreatFabric say the malware, still in development but already fully functional, targets European financial accounts using region specific HTML overlays to steal credentials. Sternus supports full device takeover through Android accessibility abuse and real time remote control via an AES encrypted Websocket VNC channel. It spreads through malicious APKs designed as Chrome or Premix box apps, though its distribution method remains unclear. After installation, it establishes encrypted connections with its command and control server, gains device administrator privileges, blocks removal attempts, and can silently conduct actions such as transfers by hiding activity behind fake system update screens. Elsewhere, researchers at Trustwave Spider Labs have identified a new Brazil focused banking trojan called Eternidad Stealer that marks an escalation in the region's cybercrime activity. The malware spreads through WhatsApp using a Python based worm to hijack accounts, steal contact lists and send personalized malicious messages. An accompanying installer deploys a Delphi built stealer that activates only on systems using Brazilian Portuguese and targets banking, fintech and cryptocurrency apps with credential harvesting overlays. Eternidad also uses hard coded email credentials to retrieve fresh command and control details via imap, improving resilience. Additional scripts perform reconnaissance and evade antivirus tools. Researchers trace the infrastructure to interconnected domains, observing more than 450 connection attempts from 38 countries, mainly from desktop systems. Despite the malware's Brazil centric design, researchers at squarex have uncovered an undocumented system level API inside the Comet AI browser that allows its hidden embedded extensions to run arbitrary commands and launch applications, bypassing protections enforced by mainstream browsers for more than a decade. The custom MCP API found in Comet's analytics extension can be invoked directly from Perplexity AI and could be exploited through common techniques such as compromised extensions, cross site scripting or phishing. Squarex demonstrated how a spoofed extension used the API to execute WannaCry on a device. Because Comet conceals its embedded extensions, users cannot disable them, and squarex warns that other extensions may also gain access to the API. Analysts say the finding reinforces enterprise reluctance toward AI browsers and highlights the need for transparency, independent audits and user control. A newly patched Fortaweb Zero Day is being actively exploited despite its medium CVSS 6.7 rating. The flaw allows authenticated attackers to execute unauthorized OS commands via crafted HTTP requests or CLI input stemming from improper command neutralization. Trend Micro's Jason McFadyen discovered the issue, which affects multiple fortaweb versions and fixes are now available. It follows last week's silent patch of a separate critical fortaweb path traversal flaw, which allowed unauthenticated command execution and has also seen reported exploitation. A Philippine trial court has sentenced former Bamban mayor Alice Guo to life imprisonment for human trafficking following a police raid that uncovered a scam center employing hundreds of trafficked foreign and local workers. Authorities later identified Guao, who had run for office, as a Filipino citizen as Chinese national Guo Hua Ping. The Presidential Anti Organized Crime commission called the ruling both a legal and moral victory. Seven others were also convicted and the facility was ordered forfeited to the state. Guo, removed from office in 2024 and captured in Indonesia after fleeing Senate hearings, faces additional charges including graft and money laundering. Her case has intensified national scrutiny of Chinese linked criminal activity and the now banned Philippine Offshore Gaming Operators sector. Coming up after the break break Cliff Crossland from Scanner.dev discusses why security data lakes are ideal for AI in the SOC and green energy gets hijacked for a blockchain side hustle. Stick around. Foreign.