Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire Verizon and Mandiant call for layered defenses against evolving threats. Cisco Talos describes toymaker and cactus threat actors. Researchers discover a major Linux security flaw which allows rootkits to bypass traditional detection methods. Ransomware groups are experimenting with new business models. Deputy Assistant Director Cynthia Kaiser from the FBI FBI Cyber Division shares the latest on Salt Typhoon and global censorship Takes a Coffee break It's Thursday, April 24, 2024. I'm Dave Bittner and this is your Cyberwire Intel Brief. Thanks for joining us again here today. It's great to have you with us. Two of the cybersecurity industry's most anticipated annual reports the Verizon 2025 Data Breach Investigations Report, the DBIR and Mandiant's M Trends 2025 report offer a revealing look at the evolving threat landscape. Drawing on tens of thousands of real world incidents, both reports provide critical insights into how threat actors operate, what vulnerabilities they exploit, and which sectors are most at risk. Together, they highlight rising trends in credential theft, ransomware, supply chain attacks and the persistent human element in security breaches. The 2025 Verizon data breach Investigations Report reveals critical shifts in the cybersecurity landscape, drawing insights from over 22,000 incidents and over 12,000 confirmed breaches. Credential abuse and vulnerability exploitation remain the top attack vectors, with the latter jumping 34%. Driven by a surge in zero day exploits targeting VPNs and Edge accounts, ransomware continues its relentless rise, now appearing in 44% of breaches despite a dip in ransom payouts. Alarmingly, breaches involving third party vendors have doubled to 30%, underscoring growing supply chain vulnerabilities. Human error and manipulation, especially through social engineering, remain a major factor in successful attacks. Espionage driven breaches are also on the rise, particularly in manufacturing and healthcare, suggesting a shift in threat actor priorities to counter these evolving threats Verizon recommends a layered security strategy enforcing strong password policies, timely vulnerability patching, robust employee training and tighter controls over third party access. The report makes it clear cyber risks are expanding and proactive defense is no longer optional. The Mandiant M Trends 2025 report paints a clear picture of an evolving cyber threat landscape marked by a rise in financially motivated attacks. Now making up 55% of all observed threat activity exploits remain the leading entry point for attackers, but the use of stolen credentials has reached an all time high at 16%, highlighting a growing vulnerability. The financial sector emerged as the most targeted industry involved in over 17% of all cases studied. Meanwhile, attackers are lingering longer within networks with the median dwell time increasing to 11 days, a sign that detection capabilities may be lagging behind the sophistication of modern threats. New and evolving risks include the growing presence of infostealer malware insecure cloud data repositories, insider threats from foreign IT operatives, and a surge in attacks on cryptocurrency and web3 platforms. In response, Mandiant stresses the need for multi layered defense strategies emphasizing better logging, proactive threat hunting, strong identity and access controls, and adoption of FIDO 2 compliant multi factor authentication to help organizations stay a step ahead. In 2023, Cisco Talos uncovered a sophisticated attack on critical infrastructure involving two threat actors, Toymaker and Cactus. Toymaker, a financially motivated initial access broker, breached the organization by exploiting Internet facing vulnerabilities and deployed a custom backdoor lag toy. This tool enabled remote command execution and credential theft. After initial reconnaissance and credential harvesting, Toymaker handed off access to Cactus, a ransomware group known for double extortion. Cactus launched a full scale attack using various remote tools, creating malicious accounts and eventually deploying ransomware. Their tactics included extensive data exfiltration and defense evasion, such as safe mode reboots and credential hiding. The incident highlights the operational handoff between access brokers and ransomware actors and underscores the need for organizations to recognize and model interconnected threats for better defense. Researchers at ARMO discovered a major Linux security flaw involving the IO URing interface, which allows rootkits to bypass traditional detection methods that rely on monitoring system calls. To demonstrate this, they created a stealthy rootkit called curing that uses iouring to execute commands without triggering alerts. Most security tools, including Falco and Tetragon in default settings, failed to detect it. ARMO recommends kernel runtime security instrumentation for monitoring such threats, and Curing is now publicly available for testing on GitHub. Ransomware groups like Dragonforce and Anubis are experimenting with new business models to attract affiliates and boost profits. According to SecureWorks, DragonForce, which began as a traditional ransomware as a service operation, has rebranded as a cartel, offering hackers shared infrastructure and management tools while allowing them to use their own malware. This flexible model may broaden its affiliate base, though shared resources introduce operational risks. Meanwhile, Anubis offers multiple monetization options, ransom, extortion and access sales, sharing 50 to 80% of profits with affiliates. It also increases pressure on victims through public shaming and threats to report breaches to regulators. These evolving strategies reflect a shift towards decentralization in the ransomware ecosystem, especially following disruptions to major players like Lockbit. While ransomware attacks continue, experts note early signs that profit cutting efforts may be impacting the threat landscape. Coming up after the break, Deputy Assistant Cynthia Kaiser from the FBI Cyber Division is back with the latest on Salt Typhoon and Global censorship takes a coffee break. Stay with us. Foreign what's the common denominator in security incidents? Escalations and lateral movement. When a privileged account is compromised, attackers can seize control of critical assets with bad directory hygiene and years of technical debt. Identity attack paths are easy targets for threat actors to exploit who but hard for defenders to detect. This poses risk in active directory, entra ID and hybrid configurations. Identity leaders are reducing such risks with attack path management. You can learn how attack path management is connecting identity and security teams while reducing risk with Bloodhound Enterprise powered by SpectreOps. Head to SpectreOps IO today to learn more. Spectrops see your attack paths the way adversaries do. Do you know the status of your compliance controls right now? Like right now? We know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. Look at this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000. It is my pleasure to welcome back to the show Deputy Assistant Director Cynthia Kaiser from the FBI Cyber Division. Dad Kaiser, welcome back.