Transcript
Dave Buettner (0:02)
You're listening to the CyberWire network powered by N2K. Now a word about our sponsor, the Johns Hopkins University Information Security Institute. The JHU ISI is home to world class interdisciplinary experts dedicated to developing technologies to protect the world's vast online systems and infrastructure and working closely with US Government research agencies and industry partners. The Institute offers dual degree and joint programs in computer science and health informatics and has been designated as a Center of Academic Excellence in Cyber Research. Learn more at isi.jhu.edu More than 760,000 see their personal data exposed on the Breach Forum's Cybercrime Forum the new head of the UK's NCSE warns against underestimating growing cyber threats. The Consumer Financial Protection Bureau looks to prevent data brokers from selling Americans personal and financial information. A US Government and energy sector contractor discloses a ransomware attack. The smoked ham Windows back door is being actively deployed. A new report warns of over reliance on Chinese made LiDAR technology. Smoke loader malware targets companies in Taiwan. NIST proposes new password guidelines. South Korean police make arrests over 240,000 satellite receivers with built in DDoS attack capabilities on our Threat Vector segment, we preview this week's episode where host David Moulton goes behind the scenes with Palo Alto Network CIO And CISO and ChatGPT has a Voldemort moment. It's Tuesday, December 3rd, 2024. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today. It is great to have you with us. More than 760,000 employees across major organizations had their personal data exposed after a threat actor, Nameless posted it on the Breach Forum's Cybercrime Forum. The data tied to the 2023 Move it hack orchestrated by the Klopp Ransomware Group includes names, emails, phone numbers, job titles and manager details. Affected organizations include bank of America, Coke, Nokia, jll, Xerox, Morgan Stanley and Bridgewater. The Move it breach exploited a zero day vulnerability in Progress Software's file transfer tool impacting nearly 2,800 organizations and 100 million individuals. Atlas Privacy, who analyzed the data, linked the breach to CLOP and noted the information's value for social engineering. Bank of America tops the list with over 288,000 affected employees. Nameless, who recently leaked Amazon employee data, appears to have filtered and repackaged terabytes of stolen data for easier dissemination. The breach underscores growing risks tied to large scale cyber extortion campaigns. The UK is underestimating growing cyber threats, warns Richard Horn, the new head of the National Cybersecurity center, part of GCHQ. Speaking at the launch of NCSC's annual review, Horn highlights a widening gap between the increasing sophistication of cyber threats and the UK's defences, particularly around critical national infrastructure. Over the past year NCSC has handled 430 incidents, 89 of which were nationally significant. Ransomware remains the most immediate threat, with state linked actors now targeting industrial control systems. Two major vulnerabilities exploited by state backed hackers were identified linking Iran and ransomware groups to UK infrastructure risks. Horn criticized the lack of adoption of the government backed Cyber Essentials scheme, with only 31,000 organizations certified out of 5 million eligible. He called for urgent improvements in resilience, emphasizing rising risks from state and non state actors, especially Russia and China. The Consumer Financial Protection Bureau has proposed a rule to prevent data brokers from selling Americans personal and financial information such as Social Security numbers and phone numbers under the Fair Credit Reporting Act. This proposal, following President Biden's executive order to limit private data sales, aims to close loopholes that allow data brokers to evade FCRA regulations. CFPB Director Rohit Chopra stated the rule would address the widespread evasion of federal privacy laws and hold data brokers to the same standards as credit bureaus and background check companies. It would restrict brokers from selling sensitive identifying information, reinforcing FCRA protections. The move highlights growing scrutiny of data brokers for profiting from personal data sales and poses significant regulatory changes. The proposal will be open for public comment until March 2025amidst uncertainty over its future under potential regulatory rollbacks. N Global Corporation, a contractor for the U.S. government and energy sector, has restricted its operations following a ransomware attack that encrypted some of its data files. The Texas based company disclosed the breach in an SEC filing, noting it became aware of the incident on November 25. N Global, whose clients include the Departments of Defense and Energy, is investigating the attack but has not determined its financial impact. Full restoration of IT systems remains uncertain. Cyber researchers at Track Labs have analyzed a renewed threat from UNC 2465, a cyber criminal group once affiliated with the now defunct Darkside Ransomware. The group is actively deploying the Smoked Ham Windows back door, which facilitates initial access and persistence in targeted networks. UNC 2465 uses trojanized installers disguised as legitimate tools and spreads malware through phishing, emails, malicious ads and cloud services like Google Drive and Dropbox. The back door allows for reconnaissance lateral network movement using tools like Mimikatz and credential harvesting despite the disruption of some ransomware groups, UNC 2465 remains a significant threat, adapting its tactics and ransomware partnerships to continue operations. The nonprofit foundation for Defense of Democracy's think tank warns that U.S. reliance on Chinese made lidar technology poses a significant national economic and cybersecurity risk. LiDAR, critical for creating 3D maps and models, supports autonomous navigation infrastructure monitoring and military applications like enemy detection. However, Chinese LiDAR systems integration into US critical infrastructure such as public safety, transportation, and utilities could expose users to espionage and sabotage by Beijing. The report highlights the risk of Chinese intelligence exploiting LiDAR systems, similar to previous cases involving Huawei's communication technology. Additionally, China could disrupt lidar supply chains, as it has with rare earth elements to exert strategic pressure. The report recommends reducing reliance on untrusted vendors, implementing rigorous cybersecurity standards, and boosting domestic LIDAR production to secure vital systems. Legislative action, like a proposed ban on purchasing Chinese lidar, underscores growing concerns over these vulnerabilities. Researchers at Fortagard Labs uncovered a smoke loader malware campaign targeting companies in Taiwan across manufacturing, healthcare, IT, and other sectors. Known for its modular design and advanced evasion techniques, Smokeloader acted both as a downloader and a direct attacker by fetching plugins from its command and control servers. The malware was delivered via phishing emails, exploiting vulnerabilities in Microsoft Office. The malware's plug ins were used for credential theft, key logging, browser injections, and persistence across systems. IT leveraged sophisticated techniques including steganography and obfuscated scripts to avoid detection. Attackers exploited cloud services like Google Drive to host payloads and used malicious advertising campaigns to spread infections. This campaign highlights smoke loaders adaptability and the persistent threat it poses. Fortaguard advises organizations to remain vigilant and strengthen defenses against such advanced malware operations. The Wall street journal looks at NIST's proposed updated password guidelines aimed at improving security and usability. The draft, settled for finalization in 2025, advises organizations to eliminate outdated practices like frequent password changes and overly complex requirements. Instead, NIST emphasizes longer passwords, recommending a minimum of eight characters, ideally 15 or more, with support for special characters like emojis. The guidelines also promote tools such as password managers and passkeys, which use biometrics to authenticate without passwords. Research shows that strict password rules often backfire, leading users to create predictable patterns. NIST also recommends block lists to prevent the use of compromised or common passwords. While passkeys offer strong security against phishing, vulnerabilities remain if devices aren't properly secured. These new standards aim to balance user friendliness with robust protections, reshaping password practices across government and industry. South Korean police arrested a CEO and five employees for manufacturing over 240,000 satellite receivers with built in or update enabled DDoS attack capabilities. Between 2019 and 2024, 98,000 devices shipped with pre installed DDoS modules, while others were updated later. These devices, sold at the request of a purchasing company starting in 2018, enabled illegal attacks targeting external systems allegedly to counter Arrival's actions. Users of the receivers were unknowingly involved in these attacks, potentially experiencing degraded device performance. The scheme was uncovered after intelligence from Interpol revealed the involvement of a Korean manufacturer and a foreign broadcaster. Authorities seized the company's assets, totaling about $4.35 million and charged the suspects under Korea's Information Protection Act. While the purchasing company's operators remain at large, Korean police are seeking international cooperation to apprehend them. Coming up after the break on our Threat Vector segment, Dave Moulton Go behind the scenes with Palo Alto Network's CIO and CISO and ChatGPT has a Voldemort moment. Stay with us.