CyberWire Daily Summary: "Hello, Hacker Speaking"
Released on August 5, 2025
Host: N2K Networks

1. Major Security News Highlights

The episode opens with a comprehensive overview of recent cybersecurity incidents and developments:

• Cisco Data Breach: A phishing scam targeting a Cisco employee resulted in unauthorized access to a third-party cloud CRM system, compromising user profile data without affecting passwords or proprietary information.

• SonicWall SSL VPN Vulnerability: SonicWall warns users to disable SSL VPN services following exploitation by ransomware gangs, potentially leveraging a zero-day flaw in Gen 7 firewalls.

• Linux Backdoor 'Plague': Researchers identify a sophisticated Linux backdoor embedded as a malicious pluggable authentication module, enabling persistent SSH access while evading detection.

• Nvidia Triton Inference Server Vulnerabilities: New vulnerabilities in Nvidia's AI infrastructure pose risks of remote server control, leading to immediate patching by Nvidia.

• Microsoft 365 Malware Campaign: A new malware campaign employs fake OneDrive emails to deceive users into downloading malicious installers, granting attackers remote access through seemingly legitimate tools.

• US Treasury on Crypto ATMs: FinCEN highlights rising criminal activities associated with cryptocurrency ATMs, emphasizing the need for stricter compliance and oversight.

• Cloudflare vs. Perplexity AI Startup: Cloudflare accuses AI startup Perplexity of bypassing web scraping restrictions, leading to the blockage of Perplexity’s bots.

• Global Infostealer Campaign: Over 4,000 victims across 62 countries fall prey to an infostealer campaign using the Python-based Pxa Stealer, compromising sensitive data sold on underground markets.

2. Detailed Analysis of Key Incidents

a. Cisco Data Breach

• Incident Overview ([07:00]): Cisco disclosed a breach where user profile data was stolen via a voice phishing scam. The attack targeted a third-party CRM system, exposing names, contact information, and account metadata.

• Cisco's Response ([08:30]): The compromised CRM was swiftly shut down. Cisco assured that no passwords or sensitive data were affected and committed to enhancing security measures and staff retraining on phishing threats. The company is actively notifying regulators and affected users as necessary.

b. SonicWall SSL VPN Vulnerability and Ransomware Exploits

• Vulnerability Details ([09:15]): SonicWall identified that ransomware gangs might be exploiting a zero-day vulnerability in Gen 7 firewalls, potentially bypassing MFA and targeting domain controllers rapidly.

• Recommended Actions ([10:00]): SonicWall advises disabling SSL VPN, restricting IP access, enabling botnet and GeoIP filters, enforcing MFA, and removing unused accounts. Additionally, users are urged to patch SMA 100 appliances against a critical RCE flaw.

c. Linux Backdoor 'Plague'

• Malware Characteristics ([11:00]): The 'plague' backdoor integrates deeply into Linux systems, surviving updates and erasing SSH logs and shell histories. It uses obfuscation and masquerades under legitimate library names, incorporating hardcoded passwords for easy reentry.

• Detection Challenges ([12:10]): Despite its stealthy design, antivirus engines failed to detect the malware when samples were uploaded to VirusTotal, highlighting the sophisticated evasion techniques used.

d. Nvidia Triton Inference Server Vulnerabilities

• Vulnerability Impact ([13:00]): Three new flaws in Nvidia's Triton inference server could allow remote attackers to execute code and expose data, threatening AI models and sensitive information.

• Mitigation ([13:45]): Nvidia has released patches addressing these vulnerabilities, and Wiz has provided technical details to aid in securing affected systems.

e. Microsoft 365 Malware Campaign

• Attack Vector ([14:00]): The campaign leverages compromised accounts to send fake OneDrive file share notifications containing deceptive links that download malicious installers from Discord’s CDN.

• Persistence Mechanism ([14:45]): The malware installs remote monitoring tools like Atera and SplashTopStreamer, ensuring persistent control even if one tool is detected.

f. US Treasury on Crypto ATMs

• Criminal Exploitation ([15:00]): FinCEN warns about the misuse of cryptocurrency ATMs for scams and money laundering, with a significant increase in complaints and financial losses reported.

• Regulatory Actions ([15:45]): Legislative efforts are underway to enforce kiosk registration, transaction tracing, and enhanced consumer protections to combat these activities.

g. Cloudflare vs. Perplexity AI Startup

• Web Scraping Dispute ([16:00]): Cloudflare has blocked Perplexity’s bots for ignoring robots.txt directives, amid ongoing controversies over unauthorized content use and potential legal actions.

h. Global Infostealer Campaign

• Campaign Scope ([17:00]): Sentinel Labs and Beasley Security report a widespread infostealer campaign affecting over 4,000 victims across 62 countries, compromising more than 200,000 passwords and other sensitive data.

• Tactics Employed ([17:45]): The Pxa Stealer malware uses signed software like HiHi Soft PDF Reader to sideload malicious DNS DLLs, evading detection through decoy documents and multi-stage infections.

3. Operation Blindspot: Tabletop Exercise at Black Hat

Guests:
Marty Momjian, General Manager of Ready One by Semperis
Marcus Hutchins, Renowned Cybersecurity Practitioner

Discussion Highlights:

• Exercise Focus ([15:12]): This year's Operation Blindspot centers on simulating cyberattacks targeting critical infrastructure, specifically a water treatment facility. This choice is influenced by recent state-sponsored adversarial activities against similar targets globally.

• Exercise Structure ([16:35]): Participants engage in a two-hour tabletop exercise, alternating between red team (attackers) and blue team (defenders), replicating real-world incidents to enhance incident response strategies.

• Educational Value ([17:28]): The exercise emphasizes non-theoretical, practical scenarios, allowing attendees to learn from actual tactics employed by threat actors and effective response measures.

• Key Takeaways ([18:56]): Awareness and collaborative learning are paramount, enabling organizations from diverse industries to enhance their incident response plans by sharing insights and strategies.

Notable Quotes:

• (15:12) Marcus Hutchins: "We focus around what is really currently happening out there in the cyber industry. Right. What are the high value targets?"
• (17:26) Marty Momjian: "Marcus Hutchins, one of my favorites. So I would say to me is more than a celebrity."
• (18:56) Marcus Hutchins: "Mainly awareness. And the attendees are a mix of different industries. So we have attendees from all different types of industries from around the world."

4. Threat Vector Segment: Shifting Cybersecurity to a Business Priority

Guests:
David Moulton, Senior Director of Thought Leadership for Unit 42 at Palo Alto Networks
Nigel Hedges, Executive General Manager of Cyber and Risk at Chemist Warehouse

Interview Highlights:

• Elevating Cybersecurity ([21:06] Nigel Hedges): Cybersecurity should be viewed not merely as a technology risk but as a technology-enabled business risk. Engaging with key business stakeholders and aligning cyber strategies with business objectives are crucial steps for CISOs.

• Industry-Specific Approaches ([22:42] Nigel Hedges): While the core concerns remain consistent across sectors, cultural differences dictate tailored approaches. For example, the retail sector's fast-paced environment contrasts with the more regulated landscape of higher education and professional services.

• Board-Level Communication ([24:18] Nigel Hedges): Effective presentations to the board require a materiality perspective, focusing on incidents of significance and aligning cyber priorities with fiduciary duties. Prioritization involves mapping cyber initiatives to business strategies and transparently communicating resource constraints and needs.

• Budget Prioritization ([25:48] Nigel Hedges): Linking cybersecurity spending to business strategy and demonstrating its impact ensures that cyber initiatives receive appropriate budgetary support. Utilizing frameworks like SABSA helps in aligning security measures with overarching business goals.

Notable Quotes:

• (21:05) Nigel Hedges: "The future is now and our expectations are wrong."
• (22:29) Nigel Hedges: "It's a technology enabled business risk, just like any other business risk."
• (24:18) Nigel Hedges: "They've got a fiduciary duty of care at the board level, especially to protect the organisation and the organization's interests."

5. Notable Closing Story: Thai Hospital Data Breach

In an unusual breach of both privacy and packaging standards, a major Thai hospital was fined approximately $37,000 after confidential patient medical records were discovered repurposed as snack bag wrappers. The incident involved a family-run document destruction contractor that mistakenly recycled over 1,000 records by embedding them in snack packaging instead of shredding them. The contractor faced a modest fine of $500 and is likely to undergo education on data privacy protocols. This case underscores the critical importance of proper data handling and disposal procedures to prevent inadvertent exposures.

Closing Remarks:

• Survey and Feedback ([31:30]): Listeners are encouraged to participate in CyberWire’s annual audience survey to provide insights and feedback.

• Production Credits:

  • Senior Producer: Alice Carruth
  • Producer: Liz Stokes
  • Mixer: Trey Hester
  • Original Music: Elliot Peltzman
  • Executive Producer: Jennifer Ivan
  • Publisher: Peter Kilpe
  • Host: Dave Bittner

Conclusion

This episode of CyberWire Daily delivers a thorough examination of current cybersecurity threats, in-depth discussions on practical defense strategies through tabletop exercises, and insights into elevating cybersecurity within organizational priorities. Noteworthy contributions from industry experts like Marcus Hutchins and Nigel Hedges provide listeners with actionable knowledge to bolster their cybersecurity measures and strategic approaches.

For more detailed information on today’s stories, visit [daily briefing@thecyberwire.com](mailto:daily briefing@thecyberwire.com).

Notable Quotes with Timestamps:

• (00:12) Marty Momjian: “Sonicwall warns users to disable SSL VPN services after reports of ransomware gangs exploiting a likely zero day.”

• (11:38) Nigel Hedges: “The future is now and our expectations are wrong.”

• (16:31) Marty Momjian: “We decided instead of doing the traditional tabletop exercise, let's do something that would actually have direct impact to the public from what we know is going on out there.”

• (21:17) Nigel Hedges: “I have more and more described cyber to anyone who will listen that it's not a technology risk, it's a technology enabled business risk, just like any other business risk.”

• (24:18) Nigel Hedges: “They've got a fiduciary duty of care at the board level, especially to protect the organisation and the organization's interests.”