Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K. Investigating is hard enough. Your tools shouldn't make it harder. Maltego brings all your intelligence into one platform and gives you curated data along with a full suite of tools to handle any digital investigation. Plus with on demand courses and live training, you your team won't just install the platform, they'll actually use it and connect the dots so fast cybercriminals won't realize they're already in cuffs. Maltego is trusted by global law enforcement, financial institutions and security teams worldwide. See it in action now@maltego.com China's famous sparrow is back A misconfigured Amazon S3 bucket exposes data from an Australian fintech firm. Researchers uncover a sophisticated Linux based backdoor targeting industrial systems, infiltrating the Blacklock Ransomware group's infrastructure solar inverters. In the security spotlight, credential stuffing gets automated CISA updates the known Exploited vulnerabilities catalog. The UK's NCA warns of online groups involved in sadistic cybercrime and real world violence. Authorities arrest a dozen individuals linked to the now defunct Ghost encrypted communication platform. Our guest is Tal Skverer, research team lead from Asterix, discussing the OWASP NHI Top 10 framework and remembering our friend Matt Stephenson. It's Thursday, March 27th, 2025. I'm Dave Bitt and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It is great to have you with us. The China linked hacking group Famous Sparrow has resurfaced after years of apparent inactivity targeting organizations in the U.S. mexico and Honduras, according to a March 26 report from ESET. Once known for exploiting the proxy logon flaw and focusing on hotels, the group has broadened its scope to include governments, research institutions and law firms. The group used upgraded versions of its signature Sparrow door backdoor and for the first time deployed the Shadow pad backdoor often associated with other Chinese APTs. Although Microsoft previously suggested Famous Sparrow as part of a larger cluster including Ghost Emperor and Salt Typhoon, ESET maintains it is a distinct group with limited overlap. The recent campaign began in June of last year through web shells on outdated Windows Server and Exchange systems. The tool set combined custom malware and shared resources tied to other Chinese Aligned Threat act, showing a renewed and evolving cyber espionage capability. Cybersecurity researcher Jeremiah Fowler uncovered a major data exposure involving Australian fintech Firm Vroom by UX, formerly DriveIQ, a misconfigured Amazon S3 bucket left 27,000 sensitive records, including driver's licenses, medical records, bank details and partial credit card numbers, publicly accessible without password protection or encryption. Fowler also found evidence of a MongoDB instance holding 3.2 million documents, raising additional security concerns. Vroom, an AI powered vehicle financing platform, quickly secured the exposed data and pledged a post incident review. The records dated from 2022 through 2025, highlighting ongoing risks in data handling. Fowler stressed the potential for fraud, including identity theft and social engineering, and urged fintech firms to adopt stronger security measures. He emphasized end to end encryption, regular audits and data minimization as key defenses. Researchers at Qianjin X Lab uncovered Orpah Crab, a sophisticated Linux based backdoor targeting or pack industrial systems tied to fuel services. Discovered in January 2024. The malware uses the MQTT protocol for covert command and control, blending in with legitimate traffic. It persists via startup scripts and encrypts configuration data. It also uses DNS over HTTPs to evade detection. Linked to the Cyber Avengers hacking group ORPA Crab may have compromised Gas Boy Fuel systems, posing risks to payment terminals and customer data. Earlier this month, cybersecurity firm Resecurity identified a critical vulnerability in the data leak site of Blacklock Ransomware, a ransomware as a service group active since March 2024. The flaw allowed Re Security's Hunter team to infiltrate Blacklock's infrastructure, gathering intelligence on their operations, network configurations and storage methods, including the use of mega accounts for exfiltrated data. The breach revealed that Blacklock had compromised at least 46 organizations across various sectors globally. Subsequent events in early 2025 suggest that rival ransomware group Dragonforce may have exploited similar vulnerabilities, leading to the defacement and shutdown of Blacklock's data leak site and associated projects. These developments underscore the dynamic and volatile nature of cybercriminal enterprises. Researchers at 4 Scout's Videri Labs uncovered 46 critical vulnerabilities in solar inverters from Sungrow, Growwatt, and SMA, three of the world's top manufacturers. These flaws could allow attackers to remotely execute code, hijack devices via cloud platforms, and even disrupt power grids by altering inverter output. One vulnerability in SMA's Sunny portal allows remote code execution through malicious file uploads. Grow Watt inverters are particularly exposed due to easily exploitable APIs, while Sungrow's architecture involves multiple vulnerabilities across components, including stack overflows and hard coded credentials. Exploiting these could let attackers control fleets of inverters, potentially destabilizing grid operations by coordinating power surges or drops. Beyond grid disruption, attackers could compromise user privacy, hijack smart devices, or launch ransomware attacks. All vendors have reportedly issued patches. The findings highlight the urgent need for stronger security in renewable energy infrastructure and the potential consequences of compromised smart energy systems. Credential stuffing A long standing cyber threat has become more dangerous with the rise of Atlantis aio, an advanced automation tool. This software allows attackers to test millions of stolen credentials rapidly across cloud platforms and email services requiring minimal expertise. Its modular design evades detection through rotating proxies and distributed login attempts. Abnormal Security reports that since early 2025, Atlantis AIO has gained popularity in underground forums, enabling both novice and advanced attackers to carry out large scale account compromises, data theft and fraud. CISA has added two critical sitecore CMS vulnerabilities to its known Exploited Vulnerabilities catalog due to confirmed active exploitation. The first allows unauthenticated remote code execution via a deserialization flaw in the sitecore Security anti CSRF module, while the second requires authentication but uses the same attack Vector. Both impact Sitecore versions up to 9.1.0. CISA has mandated that federal agencies patch affected systems by April 16th. Organizations should apply available fixes or implement temporary access restrictions immediately. The UK's National Crime Agency, the NCA, has issued a stark warning about the rise of calm networks online groups of sadistic, predominantly teen boys involved in cybercrime and real world violence. These loosely organized groups use social media and messaging platforms to share extremist, violent and child abuse content while engaging in crimes like phishing, sim swapping, ransomware and fraud. The NCA's latest National Strategic Assessment highlights a six fold increase in reported threats between 2022 and 2024. With thousands of offenders and victims in the UK and beyond, these networks often groom young girls, coercing them into self harm or abuse. While foreign actors, particularly from Russia, still dominate the cybercrime landscape, the rise in homegrown youth involvement is alarming. Offenders seek profit, status and notoriety. Recent convictions illustrate the danger and the NCA stresses these groups aren't hidden on the dark web. They thrive in mainstream digital spaces frequented by young users daily. Yesterday, Irish and Spanish authorities arrested 12 individuals linked to a high risk criminal network using the now defunct Ghost encrypted communication platform. Ghost, dismantled in September 2024 during a Europol led international operation, was used by organized crime groups to coordinate drug shipments between Spain and Ireland. Despite attempts to evade detection, investigators traced Ghost user accounts to the suspects who smuggled cocaine and marijuana using vehicles with hidden compartments and cloned license plates. Ghost, launched in 2015, offered ultra secure messaging through modified smartphones with layered encryption and self destruct features. The platform's takedown previously resulted in 52 global arrests, including its alleged administrator. Europol continues to support ongoing investigations and further arrests are expected as digital evidence from the platform is analyzed. Coming up after the break, my conversation with Tal Skverer, research team lead from Asterix. We're discussing the OWASP NHI Top Table Framework and remembering our friend Matt Stephenson. Stay with us. Do you know the status of your compliance controls right now? Like right now we know that real time visibility is critical for security, but when it comes to our GRC programs we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off.