Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K.
David Holmes (0:12)
And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire a joint operation takes down Luma infrastructure the FTC finalizes a security settlement with GoDaddy. The telemessage breach compromised far more US officials than initially known Twin hackers allegedly breach a major federal software provider from the inside. US telecom providers fail to notify the Senate when law enforcement agencies request data from Senate issued devices. Dragon Force makes its mark on the ransomware front. A data leak threatens survivors of domestic abuse in the UK Lexmark discloses a critical vulnerability affecting over 120 printer models. Our guest is David Holmes, CTO for application security at Imperva, with insights on the role of AI in bot attacks and scammers. Ships stolen cash in squishmallows Foreign It's Thursday, May 22, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Great to have you with us as always. A joint operation by us, EU and Japanese authorities, with help from Microsoft and other cybersecurity firms, has dismantled the infrastructure behind Luma, a major infostealer malware also known as Luma C2. The malware has infected millions of devices since 2023, stealing sensitive data like passwords, credit card info and cryptocurrency wallets. Luma was sold via subscription, making it easy for even low skilled criminals to exploit. The FBI tracked over 10 million infections and estimated $36.5 million in credit card thefts in 2023 alone. Microsoft identified nearly 400,000 infections between March and May of this year. The operation took down about 2,300 domains and disrupted communications between infected devices and Luma servers. Developed by a Russian actor known as Shamel, Luma has been marketed on Telegram and used in phishing and malvertising campaigns. The FBI warned that while this takedown is a blow, Luma's operations may attempt to rebuild. The Federal Trade Commission has finalized an order requiring GoDaddy to bolster its security after years of data breaches due to weak practices, the agency found GoDaddy lacked key protections like multi factor authentication, proper software updates and threat monitoring leading to breaches between 2019 and 2022. In one case, attackers installed malware and stole source code after years of undetected access. Under the new order, GoDaddy must not mislead customers about security, implement HTTPs for APIs, ensure software and firmware are updated, and set up a robust security program. The company must also add MFA for all users, including non phone options, and undergo independent security assessments every two years. GoDaddy must report any data exposure incidents within 10 days. While GoDaddy says it's already making changes, the settlement includes no admission of fault or fines. A hacker breach of Telemessage, a government used messaging service based on Signal compromised messages from over 60 US officials, far more than previously known. Reuters reviewed a cache of leaked data provided by Distributed Denial of Secrets. The material revealed intercepted chats from fema, Customs, the Secret Service, US Diplomats, and even one White House staffer. Though much of the data was fragmentary and not overtly sensitive, it included travel related discussions for senior officials. Telemessage, little known outside federal circles, became public after a Reuters photo showed former Trump national security adviser Mike Waltz using the app. The service, which archives encrypted messages for compliance, went offline May 5. The breach raises metadata related counterintelligence risks, experts say. While some users confirmed message authenticity, federal agencies have offered little comment. The White House acknowledged the cybersecurity incident but didn't elaborate on its use of the platform. Elsewhere, Signal Desktop has added a new screen security feature for Windows 11 to block screenshots and protected chats from Microsoft Recall, which captures app screenshots every few seconds. This setting, now enabled by default, uses a DRM flag to prevent content from appearing in Recall or similar tools. Signal made the move after Microsoft relaunched Recall despite prior backlash. While the setting may impact usability and accessibility, users can disable it with a warning. Signal urges OS vendors to better support privacy focused apps. Bloomberg reports that opexis, a software provider for nearly all US Federal agencies, suffered a major cyber breach in February caused by insider threats. Twin brothers Muneeb and Sahaib Akhtar, both convicted hackers hired as engineers despite their past, they allegedly accessed and deleted sensitive data across multiple agencies, including the IRS and gsa. The attack disrupted key systems and permanently erased records, including FOIA requests. The FBI is investigating, and federal agencies are reassessing contracts with opexus A Mandiant report revealed serious security lapses, including improper access during termination and file exfiltration, contradicting opex's public claims the breach exposed the vulnerabilities in contractor vetting and data security within government IT systems. Under contracts established in 2020, major US telecom providers at and T, Verizon and T Mobile are required to notify the Senate when law enforcement agencies request data from Senate issued devices. However, an investigation by Senator Ron Wyden revealed that these carriers failed to implement such notification systems, leaving senators unaware of potential surveillance activities. One carrier even admitted to providing Senate data to law enforcement without the mandated notification. Following the investigation, all three companies have begun complying with the notification requirement for Senate funded lines. Nevertheless, significant gaps remain, particularly concerning personal and campaign devices, which are commonly used by Senators but fall outside the scope of current protections. While AT and T and Verizon limit notifications to Senate issued lines, T Mobile has agreed to notify about surveillance requests on personal and campaign devices flagged by the Senate sergeant at arms. Senator Wyden urges his colleagues to consider switching to carriers like T Mobile, Google, fi, US Mobile and cape, which have policies to inform customers of government surveillance demands whenever legally permissible. Dragon Force is a rising ransomware group reshaping the threat landscape through aggressive tactics and strategic repositioning, Sophos reports. First appearing in 2023 with a standard ransomware as a service model, the group rebranded in March of this year as a cartel, offering affiliates flexibility to use its infrastructure while branding their own campaigns. Dragon Force has targeted both IT and virtualized environments and reportedly teamed up, if contentiously, with the prolific Ransom Hub group. This included defacing rival leak sites and a potential hostile takeover of Ransom Hub's infrastructure. In recent attacks, Dragon Force linked malware was used by Gold Harvest, also known as Scattered Spider, a decentralized cybercriminal collective known for social engineering, MFA bypasses and use of infostealers. Attacks on UK retailers including Marks and Spencer, highlight their threat as internal feuds destabilize ransomware networks, organizations must reinforce social engineering defenses, monitor credentials and strengthen incident response to withstand unpredictable attacks from increasingly flexible and chaotic cybercrime groups. A CyberAttack on the UK's Legal Aid Agency has exposed sensitive data of over 2 million people, including survivors of domestic abuse, raising fears of imminent leaks. The Ministry of Justice confirmed that anyone who applied for legal aid since 2010 could be affected. Compromised data includes addresses, national IDs and contact details, potentially revealing the locations of confidential women's refuges. The MOJ has refused to pay ransom and is preparing to contact vulnerable individuals, prioritizing abuse survivors, asylum seekers and trafficking victims. Refuge, a charity supporting abuse survivors, warns the breach could escalate abuse campaigns, including harassment, impersonation or tracking survivors. While a court injunction has been issued against the data's distribution, it's unlikely to deter cybercriminals. Refuge is working to identify at risk individuals and urges anyone affected to contact legal advisors immediately. Lexmark has disclosed a critical vulnerability affecting the embedded web server in over 120 printer models. The flaw combines a path traversal and concurrent execution issue, allowing remote attackers to access unauthorized files and execute arbitrary code. If exploited, this vulnerability could let attackers fully compromise affected Lexmark printers. Users are urged to update firmware to mitigate the threat. Coming up after the break, my conversation with David Holmes from Imperva. We're discussing the role of AI in bot attacks and scammers ship stolen cash in squishmallows. Stay with us.