Transcript
Dave Bittner (0:02)
You're listening to the CyberWire network. Powered by N2K, traditional pen testing is resource intensive, slow and expensive, providing only a point in time snapshot of your application's security, leaving it vulnerable between development cycles. Automated scanners alone are unreliable in detecting faults within application logic and critical vulnerabilities. Outpost 24's continuous pen testing as a service solution offers year round protection with recurring manual penetration testing conducted by Crest certified pen testers, allowing you to stay ahead of threats and ensure your web applications are always secure.
Tim Starks (1:05)
A massive power outage strikes the Iberian Peninsula. Iran says it repelled a widespread and complex cyber attack targeting national infrastructure. Researchers find hundreds of SAP netweaver systems vulnerable to a critical zero day. A British retailer tells warehouse workers to stay home following a cyber attack. Verisource Services discloses a breach exposing personal data of 4 million individuals. Global automated scanning surged 16% in 2024. CISA discloses several critical vulnerabilities affecting Planet Technologies, industrial switches and network management products. A Greek court upholds a VPN provider's no logs policy. Law enforcement dismantles the Joker OTP phishing tool. Our guest is Tim Starks from cyberscoop with developments in the NSO Group trial and how bad scans and AI spread a scientific urban legend.
Unknown Guest (2:06)
Foreign.
Tim Starks (2:12)
28Th, 2025 I'm Dave Bittner and this is your CyberWire Intel Briefing. Thanks for joining us here today. We are coming to you live and on location from RSAC20 right here in beautiful San Francisco. The Moscone center is buzzing with the latest in cybersecurity innovation, critical discussions and of course a few caffeine fueled debates about AI quantum threats and how to finally get rid of passwords for good. We've got a packed week ahead with interviews from industry leaders, quick takes on major announcements and a look at the trends shaping the future of cyber defense. So whether you're joining us from the show floor or tuning in from afar, stick around. You don't want to miss what's coming up this week. Let's dive in. A massive power outage struck the Iberian Peninsula today, cutting electricity across Spain, Portugal and parts of southern France and Andorra. The blackout, which began around 12:30pm local time, caused Spain's power demand to collapse by half within moments. A total grid failure. Sources suggest a cyberattack is the likely cause of though authorities have not confirmed this critical infrastructure was severely impacted, including airports, metros, telecommunications and traffic systems. Spain's Prime Minister Pedro Sanchez visited Red Electrica's control center as emergency restoration efforts began focusing on hydroelectric power, while gas and nuclear power remained offline. Internet traffic dropped by nearly 37% across the region. The Spanish Cybersecurity Coordination Office is investigating, but officials warn it's too early to draw conclusions. This outage highlights growing concerns as cyberattacks on utilities have more than doubled globally in recent years. Recovery is expected to take time. Meanwhile, Iran says it repelled a widespread and complex cyber attack targeting national infrastructure, according to Bezad Akbari of the government's telecommunication infrastructure company. Few details were shared, and there's no confirmed link to a deadly explosion at Rashid Rajeh port the previous day, which killed 28 and injured 800. Maritime experts attribute the explosion to mishandled ballistic missile fuel, though Iran denies this. The incident comes amid tense nuclear negotiations between Iran and the us. Iran has faced several major cyber attacks in recent years, including ones on its fuel system and steel mills often blamed on US And Israeli forces. Without evidence, groups like Predatory Sparrow have claimed past attacks, raising suspicions of state backing due to the precision involved. Iran's officials continue to cite cyber threats as key national security concerns. Shadow servers found 454 SAP Netweaver systems vulnerable to a critical zero day flaw allowing unauthenticated file uploads and full system Compromise. Discovered by ReliaQuest in April. The bug targets the metadata uploader component and has already been weaponized in the wild. Attackers upload Web shells via a missing authorization check. SAP issued an emergency patch on April 24th. Organizations are urged to patch immediately or apply temporary passwords as the flaw poses a severe risk to exposed SAP environments. British retailer Marks and Spencer has told around 200 agency workers not to report to its main warehouses as it manages a growing cyber attack crisis. Online shopping remains paused, with Ms. Apologizing for the disruption but assuring customers that stores are still open. The incident, first disclosed last week, has already led to an 8% drop in Ms. Shares. The company says its internal team and external cyber experts are working urgently to restore online and app services. VeraSource Services disclosed that a 2024 breach exposed personal data of 4 million individuals tied to companies using its employee benefits platform. Stolen data includes names, birth dates, addresses and Social Security numbers. Although discovered quickly, full impact analysis took over a year, with final notifications issued this month. No misuse has been reported yet, but verisource is offering free credit monitoring. Security experts stress the prolonged exposure window raises heightened risks of identity fraud and theft. Global Automated scanning surged 16.7% in 2024, exposing major digital vulnerabilities, according to FortiGuard Labs 2025 Global Threat Landscape Report. The threat actors now execute 36,000 scans per second targeting services like SIP, RDP and IoT protocols. Cybercrime marketplaces added 40,000 new vulnerabilities and drove a 500% rise in infostealer malware logs contributing to 1.7 billion stolen credentials. Critical sectors like manufacturing and business services are increasingly targeted with the US absorbing 61% of attacks. AI driven threats such as fraud GPT are intensifying phishing and credential stuffing campaigns. Fortinet urges organizations to shift to intelligence led defense strategies emphasizing attack surface management, real world adversary simulation and dark web monitoring. Experts stress that real time AI powered security solutions are crucial to countering today's evolving cyber threats and preventing operational disruptions. Several critical vulnerabilities affecting Planet Technologies, industrial switches and network management products have been disclosed by cisa. The flaws allow remote unauthenticated attackers to gain admin access, create accounts and execute OS commands. Researcher Kevin Breen, who reported the issues, noted hundreds to thousands of exposed devices globally, including in critical manufacturing. Planet Technology patched the vulnerabilities this month and no active exploitation has been reported so far. Windscribe, a privacy focused VPN and cybersecurity provider, has scored a major legal victory as founder Igor Sack was acquitted by a Greek court. The case, triggered by the cyber incident involving a Windscribe server, could have set a dangerous global precedent by criminalizing infrastructure ownership. Thanks to Windscribe's strict no logs policy. The court found no evidence linking Mr. Sack or the company to any wrong. The ruling reaffirms that privacy providers cannot be held responsible for user actions when no data is collected. Windscribe, founded in 2016, remains a fierce defender of online freedom, vowing to resist any pressure to compromise user trust. Mr. Sack called the case a critical stand against government overreach, warning, today it's hacking, tomorrow it could be criticizing a dictator. Two men have been arrested in the UK and the Netherlands as part of a major international operation dismantling Joker otp, a phishing tool used to steal over seven and a half million pounds. The tool tricked victims into revealing two factor authentication codes by impersonating trusted institutions like banks and cryptocurrency platforms. Joker OTP was deployed in over 28,000 phishing attacks across 13 countries. The investigation, led by Cleveland police's Cybercrime unit and supported by Europol and the Dutch National Police, marks one of the UK's largest cyber fraud cases. The suspects, operating online as Spit and DePhone123 face charges including fraud, unauthorized access, money laundering and blackmail. Authorities have begun shutting down the infrastructure supporting Joker otp, warning users of the platform that further law enforcement actions are underway. Coming up after the break, Tim Starks from cyberscoop shares developments in the NSO Group trial and how bad scans and AI spread a scientific urban legend. Stay with us.