Transcript
Cliff Crossland (0:02)
You're listening to the Cyberwire network, powered by N2K.
Dave Bittner (0:12)
Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try DeleteMe. I have to say, DeleteMe is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K chaos and security concerns continue in Washington. Spanish authorities arrest a man suspected of hacking NATO, the UN and the US Army. A major US Hiring platform exposes millions of resumes. Another British engineering firm suffers a cyber attack. Cisco patches multiple Vulnerabilities Criminals exploit SVG files in phishing attacks. Sparkcat SDK targets cryptocurrency via Android and iOS apps. CISA directs federal agencies to patch a high severity Linux kernel flaw. Highland leaves scamming syndicates in the dark. Positive trends in the fight against ransomware. Our guest is Cliff Crossland, CEO and co founder@scanner.dev discussing the evolution of security data lakes and the Bring your own model for security tools and don't Fix with the FCC. It's Thursday, February 6th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief. Thanks for joining us here once again. Always great to have you with us. Elon Musk's Department of Government Efficiency DOGE has gained access to restricted US Government records on millions of federal employees, including treasury and State Department officials in sensitive security roles. The Washington Post reports. According to anonymous sources, doge's involvement raises concerns about potential misuse of personnel data amid threats of retaliation against federal government federal workers by Trump administration officials. The Office of Personnel Management holds sensitive employee data, including addresses, salaries and disciplinary records. Doge agents, some in their early 20s with ties to Musk's private companies, were granted administrative access to OPM systems shortly after Trump's inauguration. This access allows them to install software, alter records and potentially transfer data externally. There is no evidence they have done so, but officials are alarmed at the risk. Doge's arrival has disrupted opm, with mass staff reductions planned, including the removal of key IT and financial executives. Tensions have risen between Doge agents and career officials, contributing to low morale. The halt of IT upgrades and Doge's access to government networks increase security vulnerabilities reminiscent of past cyber breaches, such as China's 2014 theft of US security clearance records. Security experts warn that foreign adversaries could exploit the chaos as Doge's access extends to Treasury's payment systems, which contain classified expenditure details. The Senate Intelligence Committee has demanded transparency on Doge's vetting process and system access. Meanwhile, a lawsuit challenges OPM's privacy policies, arguing that unencrypted government wide email deployments create security risks. Experts fear that foreign intelligence services could infiltrate Doge due to its rapid and opaque hiring process. Spanish authorities have arrested an 18 year old suspected hacker for cyber attacks on over 40 organizations, including NATO, the UN and the US Army. The suspect allegedly leaked stolen data and managed over 50 cryptocurrency accounts. Investigators believe he used multiple online aliases, including NATOHub, who claimed breaches on breach forums. Between June 2024 and January of this year, NATO Hub posted 18 times about data breaches, sometimes selling or freely sharing stolen information. Authorities seized electronic devices during the arrest. Fo&Bo, a US hiring platform used by major brands like KFC, Taco Bell and Nordstrom, exposed millions of job applicants resumes due to an unsecured AWS bucket. The leaked data included full names, contact details, birth information, employment history, education and social media links. Cybersecurity researchers warn that the breach increases the risk of identity theft, allowing criminals to create fraudulent accounts or launch targeted phishing scams. Attackers could impersonate past employers to trick victims into revealing financial details or installing malware. Scammers might also exploit financially vulnerable individuals with deceptive job offers. The exposed Data set contained 5.4 million files, but after multiple warnings, the company secured the database. British engineering firm IMI has disclosed a cybersecurity incident shortly after rival Smith's group reported a similar attack. Imi, which designs industrial automation and transport products, confirmed unauthorized access to its systems in a London Stock Exchange filing. The company has engaged cybersecurity experts to investigate and contain the breach. IMI declined to comment on potential data exfiltration. Meanwhile, Smith's group is also working to recover from an attack, with neither company providing a recovery timeline. Cisco has released patches for multiple vulnerabilities, including two critical flaws in its Identity Services engine. These bugs could allow authenticated attackers to execute arbitrary commands and tamper with device configurations. Patches are available, and Cisco says there are no workarounds. Additionally, Cisco warned of high severity SNMP vulnerabilities in iOS, iOS XE and iOS XR, which could cause denial of service attacks. Patches are expected by March. Medium severity flaws affecting various Cisco products were also addressed. No active exploits have been reported. Researchers at Sophos say cybercriminals are exploiting scalable vector graphics files in phishing attacks to bypass email security filters. SVG files, unlike typical image formats, can contain embedded links and scripts that direct victims to phishing sites. Attackers disguise these files as legal documents, voicemails or invoices using familiar brands like DocuSign and Microsoft SharePoint. Once opened, the file redirects users to fraudulent login pages that steal credentials. Some attacks also deliver malware or leverage captcha gates to evade detection. Researchers identified evolving tactics, including localized phishing pages and embedded keystroke loggers. Security experts recommend setting SVG files to open in Notepad instead of a browser and carefully checking URLs for legitimacy. Sophos suggests organizations should update email security solutions to detect malicious SVG attachments and prevent credential theft. A malicious software development kit called Sparkcat has been discovered in Android and iOS apps, stealing cryptocurrency wallet recovery phrases using optical character recognition. The malware hidden in SDKs named Spark, GZIP, Google App SDK and stat extracts sensitive text from images on devices, enabling attackers to access crypto wallets on Google Play alone. The infected apps were downloaded over 242,000 times, with some still available on both Google Play and the App store. Kaspersky identified 18 Android and 10 iOS infected apps with attackers using a Rust based module for communication with the command and control servers. Users are advised to uninstall affected apps immediately scan devices with antivirus software and avoid storing recovery phrases in screenshots. Instead, use offline encrypted storage for security. Google and Apple have yet to respond. CISA has ordered U.S. federal agencies to patch a high severity Linux kernel flaw within three weeks due to active exploitation. The vulnerability, found in the USB video class driver, enables privilege escalation on unpatched devices. Google patched it for Android users, warning of limited targeted attacks. Security experts believe forensic tools may be exploiting this flaw. CISA also flagged critical vulnerabilities in Microsoft.net and Apache of Biz, urging manufacturers to enhance network forensic visibility to aid cyber defense. On Wednesday, Thailand took a decisive step against online scamming syndicates by cutting off electricity, fuel and Internet to key scam hubs in Myanmar. These enclaves, run by organized crime groups, have become centers for cyber fraud targeting victims worldwide. The move follows pressure from China's assistant Minister of public Security, Lui Zhang Ji, who urged Thailand to intensify its crackdown. Lui revealed that 36 Chinese run scam operations in Myanmar employ over 100,000 workers, many trafficked and forced into fraud. The high profile rescue of Chinese actor Wang Xing from one of these compounds heightened scrutiny. Thailand's Prime Minister Petong Tarn Shinawatra defended the action, citing the scam's $2 million daily impact on Thailand's economy. The crackdown aligns with her visit to China, where both nations pledged stronger law enforcement cooperation to combat cross border cybercrime. At the start of 2024, ransomware groups seemed as powerful as ever, pulling in hundreds of millions of dollars in extortion payments. But as the year progressed, something shifted. Law enforcement agencies, cybersecurity firms and victims themselves began pushing back harder than ever before. By year's end, ransomware payments had dropped 35% from the previous year, marking the first significant decline in years, according to research from Chainalysis. It wasn't just government action that slowed ransomware operators. Victims became more resilient, with more organizations refusing to pay and instead relying on backups to recover their data. Ransomware gangs adapted, working faster than ever, sometimes beginning negotiations within hours of an attack. But even with these tactics, the market fractured. The collapse of Lockbit and Black Cat, two of the biggest ransomware groups, left a void that no single group was able to fill. New players emerged. Groups like Akira and Fog stepped into the spotlight, specializing in exploiting VPN vulnerabilities to infiltrate corporate networks. Meanwhile, Iranian linked ransomware strains, rebranded and resurfaced, proving that attackers were not giving up. They're just adapting. Financially, ransomware groups faced another hurdle moving their money. In the past, they relied on cryptocurrency mixers to launder their earnings. But after sanctions and takedowns of services like Tornado Cash, they turned to cross chain bridges and centralized exchanges instead. However, even this became riskier as governments cracked down on crypto platforms with loose know your customer policies. Perhaps the most telling sign of ransomware's changing landscape was Lockbit's desperate attempt to stay relevant after being hit by Operation Chronos. The once dominant group resorted to reposting old victims, inflating their numbers in a bid to maintain their reputation. Despite the decline in payments, ransomware is far from defeated. The criminals behind these attacks are still out there, learning, adapting and and searching for new ways to evade security measures. But for the first time in years, defenders seem to have the upper hand, and that's worth celebrating. Coming up after the break, our Guest Cliff Crossland, CEO and co founder@scanner.dev discusses the evolution of security data lakes and Don't f with the fcc, stick around. Cyber threats are evolving every second, and staying ahead is more than just a challenge, It's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant. Foreign do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off. Cliff Crossland is CEO and co founder at scanner.dev. in today's sponsored industry Voices segment, we discuss the evolution of security data lakes and the bring your own model for security tools.