Transcript
Maria Varmazes (0:02)
You're listening to the Cyberwire Network powered by N2K.
Dave Bittner (0:14)
We've all been there. You realize your business needs to hire someone yesterday. How can you find amazing candidates fast? Well, it's easy. Just use Indeed when it comes to hiring, Indeed is all you need. Stop struggling to get your job post noticed Indeed. Sponsored Jobs helps you stand out and hire fast. Your post jumps to the top of search results so the right candidates see it first and it works. Sponsored jobs on indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring here at N2K CyberWire. Many of my colleagues here came to us through Indeed. Plus with Sponsored Jobs. There are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data Worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility at indeed.com cyberwire just go to indee indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need.
Maria Varmazes (2:01)
U.S. justice Department charges employees of charge Chinese IT contractor Isun Silk Typhoon targets the IT supply chain for initial access Chrome extensions that change shape Attackers Target Airflow misconfigurations LibreOffice vulnerability opens the door to script based attacks NSO group leaders face charges in spyware case today. Our own Dave Bittner is our guest as he appeared on the Adopting Zero Trust podcast at ThreatLocker. Zero Trust World 2025 event with hosts Elliot Volkman and Neil Dennis and guest Dr. Chase Cunningham and turning $1 billion into thin air. Today is March 6, 2025. I'm Maria Varmazes subbing in for Dave Buettner, still out on vacation and this is your Cyberwire intel br thanks for joining us on this lovely Thursday. Let's get into it. The US Justice Department has charged 12 Chinese nationals for their alleged involvement in hacking US entities on behalf of the Chinese government. Two of the individuals are officers with the PRC's Ministry of Public Security and eight are employees of Chinese IT security contractor Isun. Two additional defendants are freelancers tied to the APT27 threat actor who assisted Isoon in some operations. The Justice Department says the Ministry of Public Security and the Ministry of State Security hired Isoon to carry out espionage campaigns against organizations around the globe, including the US Defense Intelligence Agency, the US Commerce Department, a major US Religious organization, and news organizations based in the United States and Hong Kong. ISOON also allegedly hacked the foreign ministries of India, Indonesia, South Korea and Taiwan, the FBI says. Isun's activities have been publicly tracked as Aquatic Panda Red, Alpha Red Hotel, Charcoal Typhoon Red, Skilla, Hassium, Chromium, and TAG22, justice said in a press release. From approximately 2016 through 2023, ISOON and its personnel engaged in the numerous and widespread hacking of email accounts, cell phones, servers, and websites as at the direction of and in close coordination with the PRCs MSS or Ministry of State Security and MPS, or Ministry of Public Security. ISOON generated tens of millions of dollars in revenue and at Times had over 100 employees. Isoon's primary customers were PRC government agencies. It worked with at least 43 different MSS or MPS bureaus and charged the MSS and mps between approximately $10,000 and $75,000 for for each email inbox that it successfully hacked. Isoon sustained a major breach in early 2024 that exposed its inner workings and ties to the Chinese government, as well as its hacking tools and services. Microsoft has published a report on the Chinese espionage actor Silk Typhoon, finding that the group is now targeting common IT solutions like remote management tools and cloud applications to gain initial access, Microsoft states. While they haven't been observed directly targeting Microsoft cloud services, they do exploit unpatched applications that allow them to elevate their access in targeted organizations and then conduct further malicious activities. After successfully compromising a victim, Silk Typhoon uses the stolen keys and credentials to infiltrate customer networks, where they can then abuse a variety of deployed applications, including Microsoft Services and others to achieve their espionage objectives. Bleeping Computer notes that Silk Typhoon recently made headlines for hacking the U.S. treasury's Office of Foreign Assets Control in December 2024. A newly identified polymorphic attack enables malicious Chrome extensions to impersonate legitimate ones such as password managers, cryptocurrency wallets, and banking applications, thereby facilitating the theft of sensitive user information. Researchers at squarex Labs demonstrated that these extensions can detect other installed extensions using the Chrome Management API or by injecting resources into visited web pages. Upon identifying a target, the malicious extension downloads code to replicate the legitimate extension's interface, deceiving users into entering confidential data. Misconfigurations In Apache Airflow, instances have been found to expose sensitive credentials, including login details, API keys, and cloud service tokens due to insecure coding practices and outdated deployments. These vulnerabilities affect sectors such as finance, healthcare, and E commerce with exposed credentials for services like AWS, Slack, PayPal, and internal databases. The primary issues include hard coded secrets in DAG scripts, unencrypted variables and connection metadata, legacy logging vulnerabilities, and exposed configuration files. To mitigate these risks, organizations should Upgrade to airflow 2.0 or later, implement network segmentation, use dedicated secrets management tools, and conduct thorough code reviews to eliminate hard coded credentials. A newly discovered vulnerability in LibreOffice allows attackers to execute arbitrary scripts via maliciously crafted macro URLs, posing a significant security risk. The flaw exploits LibreOffice's handling of macro execution, enabling remote attackers to bypass security warnings and execute malicious code without user consent. If successfully exploited, this vulnerability could allow system compromise, data theft, or further malware deployment. Security researchers recommend disabling macros, restricting untrusted document execution and ensuring LibreOffice is updated to the latest patched version. Organizations should monitor for suspicious document activity and enforce strict macro security policies to mitigate the risk of exploitation. In a follow up to a story from earlier this week, tens of thousands of VMware ESXi instances remain vulnerable to a chain of actively exploited vulnerabilities that were disclosed on Tuesday, according to a report from Security Week, the vulnerabilities can allow an attacker to perform a VM escape and gain access to the ESXI hypervisor. Security researcher Kevin Beaumont explains that attackers can use that to Access every other VM and be on the management network of the VMware cluster. Beaumont added that once you have this level of access, traditionally you'll see groups like ransomware actors steal files and wipe things. While the vulnerabilities are being exposed by unnamed threat actors, details of the exploit aren't yet publicly available. Organizations should prioritize patching before an exploit is released. A Catalan court has indicted three NSO group executives for their alleged involvement in espionage against the lawyer representing Catalan independence leaders. This decision overturns a prior ruling that limited accountability to the company and its European subsidiaries. The court's action is part of a broader investigation into the use of NSO's Pegasus spyware against Catalan separatists, a scandal known as Catalan Gate, which reportedly targeted at least 65 individuals, including politicians, activists and their families. The human rights organization Iridia, representing the lawyer in question, hailed the indictments as a pivotal step towards addressing unlawful surveillance. The court has also sought cooperation from Luxembourg authorities to advance the investigation. Rob Joyce, who is the former director of cybersecurity at the National Security Agency and a White House advisor for the first Trump administration, testified before the House Select Committee. Expressing grave concerns over the Trump administration's initiative to mass fire probationary federal employees. Joyce emphasized that such actions could severely undermine U.S. cybersecurity and national security efforts, particularly encountering Chinese cyber threats. He highlighted that probationary employees often constitute a pipeline of top technical talent essential for identifying and mitigating cyber threats. The administration's aggressive stance on reducing the federal workforce, including attempts to dismiss nearly all probationary employees, has faced legal challenges, with the federal judge temporarily blocking the order due to the overreach by the Office of Personnel Management. Several prominent financial organizations have formally requested that the Cybersecurity and Infrastructure Security Agency, or cisa, revise its proposed implementation of the Cyber Incident Reporting for Critical Infrastructure act of 2022, otherwise known as CIRC. Enacted in March 2022, CIRCIA mandates that critical infrastructure entities report significant cybersecurity incidents within 72 hours and ransomware payments within 24 hours. CISA's current proposal, set to take effect in October 2025, is estimated to impact approximately 316,000 entities. The financial groups argue that the proposed rules deviate from Circe's original intent by imposing undue burdens on organizations, potentially diverting resources from effective incident response and recovery efforts. They advocate for a collaborative approach to develop a rule that allows victimized companies to prioritize addressing cyber attacks over fulfilling reporting obligations. Coming up after the break, Dave Bittner himself joins hosts Elliot Volkman and Neil Dennis on the Adopting Zero Trust podcast from Threat Lockers, Zero Trust World 2025 alongside special guest Dr. Chase Cunningham. And don't miss how one hacker group turned $1 billion into thin air.