Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K.
Zscaler Sponsor (0:11)
And now a message from our sponsor. Zscaler, the leader in cloud security Enterprises have spent billions of dollars on firewalls and VPNs, yet breaches continue to rise by an 18% year over year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security Zscaler Zero Trust plus AI stops attackers by hiding your attack surface making apps and IPs invisible eliminating lateral movement Connecting users only to specific apps, not the entire network Continuously verifying every request based on identity and context Simplifying security management with AI powered automation and detecting threats using AI to analyze over 500 billion daily transactions hackers can't attack what they can't see. Protect your organization with Zscaler Zero Trust and AI. Learn more@zscaler.com Security.
Dave Bittner (1:36)
An MFA outage affects Microsoft 365 Office apps the Biden administration introduces new export controls to block adversaries from accessing advanced AI chips. A Dutch university cancels lectures after a cyber attack. Three Russian nationals have been indicted for operating a cryptocurrency mixer. Juniper Networks releases security updates for Junos os. Spain's largest telecommunications company confirms a data breach. The Banshee infostealer leverages a stolen Apple encryption algorithm. Researchers uncover a novel ransomware campaign targeting Amazon S3 buckets. A major data broker suffers a major data breach. Our guest is Philippe Humeaud, CEO and founder of CrowdSec. Sharing the biggest issues currently facing cybersecurity and how open source cybersecurity platforms can help combat them and the weirdness of AI. It's Monday, January 13th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief.
Philippe Humeaud (2:52)
Foreign.
Dave Bittner (2:58)
And thank you for joining us here today. It is always great to have you with us. Microsoft resolved a Multi Factor authentication outage affecting Microsoft 365 Office apps. The issue prevented users relying on MFA from accessing the apps, and some experienced problems with MFA registration and resets. Microsoft rerouted traffic to alternative infrastructure during its investigation, which revealed the outage was limited to users in Western Europe served by a specific section of unresponsive infrastructure. Additionally, some Windows Server 2016 devices experienced crashes in Microsoft 365 apps, prompting further investigation. The company continues monitoring service telemetry to address these issues. This outage follows several recent disruptions. In December, users faced product deactivated errors, while earlier incidents impacted Office Web apps and the Admin Center. In November, a global outage affected multiple services, including Teams Exchange, SharePoint and Outlook. Microsoft has since confirmed that services are stable. The Biden administration is introducing new export controls to block adversaries like Russia and China from accessing US Advanced AI chips and machine learning blueprints. The rules, taking effect in 12 months, implement a three tiered system with the harshest restrictions on adversaries, while exempting key allies such as Australia, Japan and the EU. Commerce Secretary Gina Raimondo emphasized protecting US leadership in AI while allowing secure technology diffusion. Exceptions permit up to 1700 advanced GPUs per order without a license and up to 320,000 over two years for buyers meeting security standards. Restrictions also apply to advanced AI models trained on massive computational operations. Critics, including Nvidia and the Semiconductor Industry association argue the rushed rollout risks stifling innovation. The rules extend 2022 through 2023 chip controls and include measures to secure AI models and data centers while enabling allies to maintain frontier AI infrastructure. A new ransomware group that surfaced in late 2024 called Funk Sec, claimed 85 victims in December alone, according to Checkpoint Research. The group, presenting itself as a ransomware as a service operation, uses AI assisted tools, enabling low skilled actors to develop advanced malware. Funsec employs double extortion tactics, combining data theft with encryption and targets organizations globally, particularly in countries aligned with Israel. Check point notes Many of the group's victim claims may be recycled from previous hacktivist campaigns questioning their authenticity. Eindhoven University of Technology cancelled lectures and activities after a cyber attack detected Saturday night. The Dutch university shut down its network as a precaution but noted it staff retain access to systems and are investigating. No data theft has been confirmed. Network dependent Services like email, Wi Fi and CanTeen registers are offline, although the campus remains open. Three Russian nationals have been indicted for operating cryptocurrency mixers Blender IO and Sinbad IO, which laundered money from cybercrimes, including funds stolen by the North Korean Lazarus Group. Roman Ostapenko and Alexander Olenyk were arrested in December 2024, while Anton Tarasov remains at large. Blender IO, active from 2018 through 2022, promised anonymity through a no logs policy. After its shutdown, Sinbad IO emerged offering similar services. Both mixers were previously sanctioned by the US treasury for laundering millions in cryptocurrency, including funds stolen from the Axie infinity hack in 2022. The suspects faced charges of money laundering, conspiracy and operating an unlicensed money transmitting business with potential sentences of up to 20 years. Authorities emphasized international cooperation in combating cybercrime and disrupting illicit financial networks. Juniper Networks kicked off 2025 by releasing security updates for Junos OS addressing dozens of vulnerabilities, including several high severity flaws. These include an out of bounds read bug in the routing protocol daemon that can cause denial of service via malformed BGP packets and a kernel memory exhaustion flaw triggered by malformed IPv6 packets. Fixes were also issued for high severity open SSH vulnerabilities and critical flaws in third party components like expatriates. No exploits have been reported, but users are urged to apply patches promptly. Telefonica, Spain's largest telecommunications company, confirmed a data breach involving its internal ticketing system after 2.3 gigabytes of data appeared on breach forums. Hackers using compromised employee credentials access the system, scraping documents and tickets, Some linked to telefonica.com emails. Attackers linked to the Hellcat ransomware group did not attempt extortion before leaking the data. Telefonica has blocked access and reset impacted accounts. While the full extent of the breach remains unclear, the company says they are investigating and enhancing security measures. A critical remote code execution vulnerability affects Aviatrix Controller, a popular cloud networking platform actively exploited. With a CVSS score of 10, it enables unauthenticated attackers to execute arbitrary code via unsanitized API inputs. Exploitation has led to cryptojacking malware and backdoors in unpatched systems, with attackers targeting publicly exposed controllers. Multiple versions are affected. Organizations are urged to patch immediately, restrict access, and monitor for lateral movement within cloud environments. The macOS info stealer Banshee has been leveraging a stolen Apple encryption algorithm to evade antivirus detection since September 2024. Initially sold on Russian cybercrime marketplaces as a fifteen hundred dollar stealer. As a service, Banshee targets macOS Systems to steal browser credentials, cryptocurrency, wallet data, system information and to unlock passwords. Earlier versions were easily detected due to plain text packaging, but a potent variant emerged using the same encryption algorithm as Apple's XProtect antivirus, bypassing nearly all antivirus solutions. For months, Banshee spread via GitHub repositories offering cracked software and phishing sites, mimicking legitimate programs like Google Chrome and Telegram. Despite its source code leaking in November and Yara rule updates addressing it, encrypted versions of Banshee largely remain undetected Researchers warn that this incident underscores the need for vigilance as macOS users are increasingly targeted by sophisticated malware campaigns. Researchers with the Halcyon Rise team have uncovered a novel ransomware campaign targeting Amazon S3 buckets using AWS's server side encryption with customer provided keys. The attack, orchestrated by a group dubbed Code Finger, leverages compromised AWS keys to encrypt S3 data, rendering it unrecoverable without the attacker's AES256 key, victims face permanent data loss, and files are set for deletion within seven days. To pressure ransom payments, organizations should restrict SSE C usage, audit AWS keys and enable advanced logging to mitigate this threat. Gravy Analytics, a major location data broker, has suffered a major data breach, exposing millions of people sensitive location data collected from popular smartphone apps. Hackers accessed Gravy's Amazon cloud storage using a misappropriated key, stealing terabytes of data, including over 30 million location data points. The leaked data set tracks individuals movements to sensitive sites such as the White House, military bases and personal residences, raising concerns about privacy and national security. Vulnerable groups like LGBTQ individuals in restrictive countries face heightened risks from deanonymization. Gravy sources much of its data via ad auctions, where apps unknowingly share users information. The breach follows an FTC ban on Gravy for unlawful tracking practices. Experts recommend using ad blockers, disabling app tracking, and restricting location sharing to protect against such risks. Gravy has confirmed the breach and is investigating while its website remains offline. Coming up after the break, my conversation with Philippe Humo, CEO and founder of CrowdSec. We discuss how open source cyber security platforms can help combat some of the biggest issues facing cybersecurity and the weirdness of AI. Stay with us.