Transcript
A (0:02)
You're listening to the Cyberwire network, powered by N2K. AI agents are now reading sensitive data, executing actions and making decisions across our environments. But are we managing their access safely? Join Dave Bittner and Barak Shalef from Oasis Security on on Wednesday, December 3rd at 1pm Eastern for a live discussion on agentic access management and how to secure non human identities without slowing. Innovation can't make it live. Register now to get on demand access after the event, visit events.thecyberwire.com that's events with an s.thecyberwire.com to save your spot.
B (1:01)
What's your 2am Security worry? Is it do I have the right controls in place?
A (1:06)
Maybe?
B (1:07)
Are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale and it fits right into your workflows, using AI to streamline evidence collection, flag risks and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber.
A (2:10)
Report sheds light on cyber activity targeting space related organizations during the Gaza war Russian Threat actor targets US civil engineering firm FBI says $262 million has been stolen in account takeover scams this year Tricks AI browser assistance London Council's disrupted by cyber attacks Russia's Gamarudan and North Korea's Lazarus Group appear to be sharing infrastructure. Cannon says subsidiary was breached by Oracle EBS Flaw Dave Buettner was joined by Cynthia Kaiser, SVP of the Ransomware Research Institute at Halcyon Sharing Deep dive on Akira Ransomware and Campbell's Soup CISO placed on leave following lawsuit. Today is Wednesday, November 28th and I'm your T minus Space Daily host Maria Varmazes in for Dave Bittner, who is preparing for tomorrow's turkey feast. Thank you for joining us for your Cyber Wire intel briefing. We're starting today with a new report out of ETH Zurich that sheds light on a spike in cyber activity targeting space related organizations during the Gaza war. Researchers at the center for security studies tracked 237 cyber operations aimed at the space sector over the course of the conflict, and here is the striking Only 11 of those incidents happened before October 7, according to the study. Once the war began, hacktivist groups, mostly pro Palestinian groups, either emerged or significantly ramped up activity. And most of what they did was not subtle. The bulk of These operations were DDoS attacks. One of the most frequent targets was the Israel Space Agency, even though it does not operate satellites or maintain deep space infrastructure and has a pretty limited attack surface. But because hacktivist campaigns often recycle huge lists of government related URLs, the agency became a recurring name on those target lists. The authors of the report say that this is part of a broader pattern that we are seeing in modern conflict. Cyber operations against space sector organizations are now a routine element of geopolitical escalation. The Russia aligned threat actor Rom com used Soc Golish to breach a US based civil engineering company that had done work for Ukraine, according to researchers at Arctic Wolf. While Soc Golish is operated by a criminal malware as a service group, Arctic Wolf assesses with a medium to high confidence level that Russia's GRU unit 29155 is utilizing Sokolish to target victims, the researchers note. This sock goal ish activity demonstrates the ongoing exploitation of compromised legitimate websites as a malware delivery framework, turning routine web browsing into a potential vector for ransomware access. The U.S. federal Bureau of Investigation has issued an advisory on account takeover fraud schemes, noting that these attacks have caused $262 million in losses since January 2025. The attackers use well known social engineering techniques to impersonate financial institutions and trick users into granting access to their accounts. The crooks are targeting banks, payrolls and health savings accounts, the FBI notes. In some instances, cybercriminals impersonating financial institutions reported to the account owner that their information was used to make fraudulent purchases, including firearms. The cybercriminal convinces the account owner then to provide information to a second cybercriminal impersonating law enforcement, who then convinces the account owner to provide account information. Cato Networks has published a report on an indirect prompt injection technique affecting several AI browser assistants, including Perplexity's Comet Copilot for Edge and Gemini for Chrome. The technique, which Cato calls Hash Jack, uses the pound symbol or hashtag sign, depending on what generation you're in, to place malicious prompts after legitimate URLs, the researchers explain. When an AI browser loads a page and the user interacts with the AI assistant, these hidden prompts are fed directly into large language models in agentic AI browsers like Comet, the attack can escalate further with the AI assistant automatically sending user data to threat actor controlled endpoints. Perplexity and Microsoft have since implemented mitigations against this technique, while Google acknowledged the issue and gave Cato permission permission to publicly disclose the flaw. The issue is still unresolved in the Chrome browser. The BBC reports that at least three London councils were hit by disruptive cyber attacks over the last few days. The Royal Borough of Kensington and Chelsea or RBKC and the Westminster City Council sustained an attack that affected shared IT systems and took down phone services, while Hammersmith and Fulham Council said it was working to recover from a serious cybersecurity incident. The Hammersmith and Fulham attack appears to be connected to the incident affecting RBKC and Westminster City. A memo from the Hammersmith and Fulham council instructed staff not to click on any Outlook or Teams links from RBKC and Westminster City colleagues until further notice. The BBC says the Met Police is investigating the incidents. Researchers from genthreat Labs have seen evidence that Russia's Gamarudon and North Korea's Lazarus Group are sharing infrastructure, indicating that the two state sponsored actors may be coordinating at an operational level. The researchers Observed a Gamaridon C2 server hosting invisible Ferret, which is a strain of malware attributed to the Lazarus Group. The malware was then delivered through an identical server structure used in Lazarus's contagious interview campaign. Jen notes while the IP could represent a proxy or VPN endpoint, the temporal proximity of both groups activity and the shared hosting pattern is indicate probable infrastructure reuse with moderate confidence of operational collaboration. Canon has confirmed that one of its subsidiaries was breached by an attack campaign targeting Oracle E business suite instances, the company told Security Week, quote, we have confirmed that the incident only affected the web server and we have already taken security measures and resumed service. In addition, we are continuing to investigate further to ensure that there is no other impact. The Klopp extortion gang listed Cannon as one of its victims, but has not leaked any data from the company. Stick around after the break as we have Cynthia Kaiser, SVP of the Ransomware Research center at Halcyon, sharing a deep dive on Akira ransomware and Campbell's Soup CISO placed on leave following lawsuit.