Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K.
Marty Momjian (0:12)
And now a word from our sponsor, ThreatLocker, the powerful Zero Trust Enterprise Solution that stops ransomware in its tracks. Allow Listing is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy ensuring apps can only act access the files, registry keys, network resources and other applications they truly need to function Shut out cybercriminals with world class endpoint protection from Threat Locker Cisco reveals a phishing related data breach Sonicwall warns users to disable SSL VPN services After reports of ransomware gangs exploiting a likely zero day. Researchers uncover a stealthy Linux backdoor and new vulnerabilities in Nvidia's Triton inference server. A new malware campaign targets Microsoft 365 users with fake OneDrive emails. The US treasury warns of rising criminal activity involving cryptocurrency ATMs. Cloudflare accuses an AI startup of using stealthy methods to bypass restrictions on web scraping. A global infosteeler campaign compromises over 4,000 victims across 62 countries. Marty Momjian, general manager of Ready One by Semperis, joins us to talk about Operation Blindspot, a tabletop exercise taking place this week at Black Hat. On this week's Threat Vector segment, David Moulton speaks with Nigel Hedges from Sigma healthcare about how CISOs can shift cybersecurity from a technical problem to a business priority and one hospital's data ends up in the smack aisle. It's Tuesday, August 5th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. Cisco has revealed that attackers stole user profile data from Cisco.com via a voice phishing scam targeting an employee. The breach, discovered on July 24, involved unauthorized access to a third party cloud CRM system. Exposed data includes names, organization details, contact info, Cisco user IDs and account metadata. Cisco emphasized that no passwords, sensitive data or proprietary information were taken and its products and services remain unaffected. The compromised CRM instance was promptly shut down and an investigation began. Cisco has notified regulators and affected users where required to prevent future incidents. The company says they're enhancing security and retraining staff on phishing threats. Cisco has not disclosed the number of affected users or whether a ransom demand was made. Sonicwall is warning users to disable SSL VPN services after reports of ransomware gangs exploiting a likely zero day flaw in Gen 7 firewalls since mid July Arctic Wolf Labs and Huntress have observed Akira ransomware attacks that may bypass MFA and and target domain controllers within hours. While a zero day is suspected, other methods like brute force or credential stuffing haven't been ruled out. Sonicwall confirmed its investigating and urged users to disable SSL VPN, restrict access by IP, enable botnet and GeoIP filters, enforce MFA and remove unused accounts. The company also recently advised patching SMA 100 appliances against a critical RCE flaw, which, while not yet exploited, is being targeted in attacks using stolen credentials to deploy overstep malware Researchers at nextron Threat have uncovered a stealthy Linux backdoor dubbed plague. It's embedded as a malicious pluggable authentication module, giving attackers persistent SSH access while bypassing system authentication. The malware deeply integrates into Linux systems, survives updates, erases traces like SSH logs and shell histories, and uses obfuscation techniques to avoid detection. It even masquerades under a legitimate library name and includes hard coded passwords for easy re entry. Worryingly, no antivirus engines flagged the malware when samples were uploaded to VirusTotal in 2024. Nextron isn't sure how it's being deployed, but the potential risk is high due to its ability to hijack authentication. So far there's no evidence it's been found in the wild, but experts warn it poses a serious threat to Linux systems. Elsewhere, researchers at Wiz have uncovered new vulnerabilities in Nvidia's Triton inference server, saying they could pose a serious risk to AI systems. Three flaws affect the Python backend and could allow remote attackers to gain full server control. Two are high severity, enabling code execution and data exposure. The third is medium severity. The attack chain starts with a minor info leak and escalates to full compromise, risking theft of AI models and sensitive data. Nvidia has patched the flaws and and Wiz has published technical details. Sublime Security has uncovered a new malware campaign targeting Microsoft 365 users with fake OneDrive emails. The attack begins with a message from a compromised account posing as a OneDrive file share. It includes a deceptive link that appears to lead to a Word document, but instead downloads a malicious installer hosted on Discord cdn. When clicked, it installs two remote monitoring Tools, Atera and SplashTopStreamer, alongside Net Runtime 8, giving attackers full remote access. These tools, often used by IT admins, appear legitimate and bypass typical security checks. The dual installation ensures persistent control even if one tool is detected. This sophisticated multi stage threat highlights the need for caution with unexpected emails and file types. Always verify file extensions and be wary of unusual Download sources. The US Treasury's financial crimes enforcement network FinCEN is warning financial institutions about rising criminal activity involving cryptocurrency ATMs. Also known as convertible virtual currency kiosks, these machines, often found in places like gas stations, allow users to buy crypto with cash and and are increasingly exploited for scams and money laundering. Many operators fail to comply with anti money laundering rules or register as required. In 2023, the FBI received nearly 11,000 complaints involving these kiosks totaling $246 million in victim losses. Criminals often target vulnerable groups, especially seniors using fake tech support scams. FinCEN urges operators and banks to watch for suspicious behavior like repeated sub threshold transactions or first time users making large deposits. Legislative efforts are underway to tighten oversight, including a bill requiring kiosk registration, transaction tracing and consumer protections. Cloudflare has accused AI startup Perplexity of using stealthy methods to bypass website restrictions on web scraping. In a blog post, Cloudflare said Perplexity ignored directives in robots Txt files, which tell bots what content they can access. After receiving complaints, Cloudflare blocked Perplexity's bots and removed them from its list of verified crawlers. The move follows Cloudflare's recent policy giving customers the option to block or charge AI scrapers. Perplexity denies the claims, calling Cloudflare's post a sales pitch and disputing the bot identification. The incident adds to Perplexity's growing controversy, including threats of legal action from the BBC over alleged unauthorized content use. A global infosteeler campaign has compromised over 4,000 victims across 62 countries, stealing more than 200,000 passwords, hundreds of credit card numbers and 4 million browser cookies, according to Sentinel Labs and Beasley Security. The attacks are tied to Vietnamese speaking actors using the Python based Pxa Stealer with data sold on Telegram based markets like Sherlock. The malware uses signed software like HiHI Soft PDF Reader and Microsoft Word 2013 to sideload malicious DNS DLLs and evade detection. Campaigns in April and July of this year revealed increasingly sophisticated tactics including decoy documents and multi stage infections. Pxa stealer targets over 40 browsers and crypto wallet extensions exfiltrating data via Telegram. The stolen information grants access to victims bank accounts, crypto apps, VPNs and more, fueling a thriving underground market for digital identity. The Coming up after the break, my conversation with Marty Momjian, general manager of Ready One by Semperis Telling us about Operation Blind Spot tabletop exercise taking place this week at Black Hat. And on this week's Threat Vector, David Moulton speaks with Nigel Hedges from Sigma healthcare about how CISOs can shift cybersecurity from a technical problem to a business priority. And one hospital's data ends up in the snack aisle. Stick around.