Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network, powered by N2K.
Podcast Announcer (0:12)
Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance.
Dave Bittner (0:34)
Visit www.hyperproof.IO to see how leading teams are transforming their GRC program. Explosions rock A shuttered Myanmar cybercrime hub. The Isuru botnet shifts from DDoS to residential proxies. Dentsu confirms data theft at Merkel Boston bans biometrics Proton restores journalists email accounts after backlash. Memento Labs admits Dante spyware is theirs Australia accuses Microsoft of improperly forcing users into AI upgrades. CISA warns of active exploitation targeting manufacturing management software A covert cyber attack during Trump's first term Disabled vendors Venezuela's intelligence network Our guest is Ben Serry, co founder and CTO of Zafran, discussing the trend of AI Native attacks and new glasses deliver fashionable paranoia. It's Wednesday, October 29th, 2025. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today. Great to have you with us as always. Thailand's military says the flow of people fleeing Myanmar after a major cybercrime hub was shut down has nearly stopped following a week in which more than 1500 crossed the border. Myanmar's army raided the KK park complex near Mywadi in mid October, part of an ongoing campaign against online scams and illegal gambling networks. Explosions reportedly leveled parts of the site, damaging homes on the Thai side. Most who fled are believed to have been foreign workers forced into scam operations, with Thai authorities sheltering and screening people from 28 countries to determine if they were trafficking victims. KK park had been a key node in Myanmar's expanding cyberscam industry, where criminal groups lure workers with fake job offers before coercing them into online fraud. Despite the raid, independent reports suggest similar operations remain active in My Wadi, underscoring Myanmar's ongoing struggle to dismantle cross border cybercrime networks. The Isuru botnet, once known for record breaking DDoS attacks, has shifted toward a more profitable model, renting infected IoT devices as residential proxies. Krebson Security estimates ISURU controls about 700,000 compromised routers and cameras. These devices now help anonymize cybercriminal traffic and power large scale data scraping for AI training. Experts say the flood of cheap proxy access is driving explosive growth across proxy services, some tied to Chinese conglomerates like IPDA's HK network. Many of these networks rely on SDKs secretly installed on user devices, selling their bandwidth to proxy resellers. While legitimate firms such as OxyLabs and Bright Data deny exaggerated growth claims, analysts warn that botnet driven proxy ecosystems blur the lines between lawful data collection and cybercrime infrastructure. Japanese advertising giant Dentsu has confirmed a cybersecurity incident affecting its US Subsidiary Merkel, exposing employee and client data. The company detected abnormal network activity, shut down certain systems and notified authorities in affected countries. Internal reports suggest the breach involves staff, financial and personal data, including payroll and bank details. Dentsu later confirmed that attackers stole files containing information on clients, suppliers and current and former employees while its Japan based systems were unaffected. The company anticipates some financial impact. Merkel, which employs 16,000 people and serves major global brands, continues to investigate with third party forensics experts. No ransomware group has claimed responsibility and the full scope of the breach remains under review. The Boston City Council has unanimously voted to ban the use of facial recognition technology by all city departments, including the police, making Boston the largest east coast city to do so. The ordinance prohibits officials from acquiring or using facial recognition systems or or contracting third parties to do so, though police may still follow up on leads generated by other agencies, citing racial bias and accuracy issues. The law aims to protect residents privacy and prevent discrimination against communities of color. Supported by the ACLU of Massachusetts and local advocacy groups, the measure aligns Boston with cities like San Francisco and Oakland that have enacted similar bans. The ordinance was sponsored by counselors Michelle Wu and Ricardo Arroyo. The company behind ProtonMail suspended the accounts of two journalists investigating South Korean government hacks, prompting backlash over its commitment to privacy and press freedom. The reporters, publishing under pseudonyms in Frack magazine, had responsibly disclosed their findings linked to North Korea's Kimsuki Threat Group to South Korean authorities using ProtonMail accounts. After the print issue appeared, Proton disabled their accounts, citing policy violations following a complaint from an unspecified cybersecurity agency. Despite appeals, Proton offered little explanation until public criticism forced reinstatement weeks later. Press advocates warned the move undermines trust among journalists who rely on Proton for secure communications. Proton later said it was acting on a cert alert but admitted its automated anti abuse process may have mistakenly affected legitimate users. Yesterday, we reported cybersecurity firm Kaspersky has identified a new Windows spyware strain called Dante, which it links to Memento Labs, the rebranded successor to the notorious spyware maker Hacking Team In a key confirmation, Memento CEO Paolo Lezzi told TechCrunch that the spyware detected by Kaspersky does indeed belong to his company, blaming a government client for using an outdated version. This discovery follows earlier reporting on Memento's continued development of surveillance tools despite hacking team's collapse after major scandals and leaks. Kaspersky says the forum troll group used Dante in targeted attacks on Russian and Belarus and organizations including media and government entities. Memento has since urged customers to discontinue use of its Windows spyware as it shifts focus to mobile surveillance tools. Australia's competition regulator, the Australian Competition and Consumer Commission, or ACCC, has filed suit against Microsoft, alleging the company misled Office 365 customers by forcing an upgrade to its Copilot AI service and charging higher subscription fees without proper consent. The ACCC claims Microsoft falsely represented that users had to accept the AI integration and pay more to retain access, violating multiple provisions of Australian consumer law. The regulator seeks penalties, refunds and injunctions. Microsoft, which told customers they risked losing access if they didn't upgrade, says it's reviewing the claim and will cooperate with regulators. The accc, known for strong consumer enforcement, says affected users can revert to their original plans and should contact Microsoft for refunds if charged improperly. CISA has warned that attackers are actively exploiting two critical flaws in Dassault Systems Delmia Apreso manufacturing management software. The bugs, which allow remote privilege escalation, enabling arbitrary code execution with existing elevated access, affect multiple versions. Dassault patched both vulnerabilities in August of this year, and CISA urges organizations to apply updates immediately and isolate affected systems from untrusted networks to prevent compromise. In the final year of Donald Trump's first term, the CIA launched a covert cyberattack that disabled Venezuela as intelligence network. The operation, described by sources as perfectly successful, was intended to appease Trump's push for aggressive action against Nicolas Madura without escalating into open conflict. Officials characterized the move as part of broader covert maneuvers to pressure Caracas, though Maduro remained in power. The revelation emerges as Trump's current administration ramps up military activity near Venezuela, including the deployment of 10,000 US troops and an aircraft carrier, raising fears of a potential regime change effort. Former officials say Trump's renewed maximum pressure campaign reflects lessons from his first term when military and intelligence leaders resisted riskier operations. Analysts warn that today's military buildup, framed as a counter narcotics mission, may mask preparation for direct strikes. Coming up after the break, my conversation with Ben Serry from Zafran discussing the Trend of AI native attacks and new glasses deliver fashionable paranoia. Stay with us Foreign they know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales. T H A L E S Learn more@talasgroup.com Cyber.