Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network, powered by N2K. Investigating is hard enough. Your tools shouldn't make it harder. Maltego brings all your intelligence into one platform and gives you curated data along with a full suite of tools to handle any digital investigation. Plus with on demand courses and live training, you your team won't just install the platform, they'll actually use it and connect the dots so fast cybercriminals won't realize they're already in cuffs. Maltego is trusted by global law enforcement, financial institutions and security teams worldwide. See it in action now@maltego.com Researchers uncover a new Windows zero day a covert Chinese linked network targets recently laid off US government workers. Malicious NPM packages are found injecting persistent reverse shell backdoors. A macOS malware loader evolves Draytek router disruptions affect users worldwide. A new report warns of growing cyber risks to the commercial space sector. CISA issues four ICS advisories U.S. marshals arrest a key suspect in a multimillion dollar cryptocurren heist our guest is Brian Levine, co founder and CEO of FormerGov.com, speaking about creating a networking directory for former government and military professionals and the UK's NCSC goes full influencer to promote 2fa it's Wednesday, March 26, 2025. I'm Dave Buett and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great to have you with us. A new zero day vulnerability affects all Windows versions from Windows 7 and Server 2008 R2 up through Windows 11 and Server 2025. Researchers at Zero Patch say the flaw allows attackers to steal NTLM authentication credentials just by tricking users into viewing a malicious file in Windows Explorer. No clicks required. It can be triggered through shared folders, USB drives or files downloaded from malicious websites. Though similar in impact to a previously recorded cve, this issue is technically distinct and previously undocumented. Security researchers have reported the flaw to Microsoft and released temporary micro patches via Zero Patch, free until an official fix is issued. This marks the fourth zero day from the same research team. The patches cover a broad range of Windows systems and deploy automatically with no reboot needed. A covert Chinese linked network is allegedly targeting recently laid off U.S. government workers with fake job ads aiming to gather sensitive information. Researcher Max Lesser found the campaign uses bogus consulting firms with overlapping websites and fake contact details. One firm, River Merge Strategies, posted ads for roles requiring government experience with connections traced to a Chinese tech company. Some ads ran on LinkedIn and Craigslist, but were later deleted. Reuters couldn't confirm if any hires occurred or direct ties to the Chinese government. U.S. officials warn these tactics mirror past Chinese espionage operations. The FBI confirmed that foreign intelligence often uses fake recruiters to exploit former federal workers. Financial vulnerability the firm's activity raises concerns about national security, especially amid recent federal workforce layoffs. Two malicious NPM packages were found injecting persistent reverse shell back doors into legitimate, locally installed packages. Even if the malicious packages were removed, the back door remains active, discovered by Reversing Labs. The attack replaces files in the popular ETHERS package with Trojanized versions that fetch further payloads from a remote server. The tactic is stealthy and dangerous, targeting developers through clever installer scripts. Additional linked packages were also identified. Developers are urged to scan environments and verify package legitimacy. The macOS malware loader reader update has evolved, now existing in five variants compiled in Python, Crystal, Nim, Rust, and go, according to SentinelOne. Originally seen in 2020, it still deploys the Genio adware, but now spreads through Trojanized software installers on third party download sites. The Go variant collects system information and can execute remote commands, hinting at broader malware potential. While current payloads are adware, Reader Update's design suggests it could be used for more serious threats under a Malware as a service model A wave of Draytek router disruptions is affecting users worldwide, causing devices to enter constant reboot loops. The issue began around March 22 and appears linked to the exploitation of known vulnerabilities. Security firm Graynoise observed active attacks on three Draytek flaws, including remote code execution and directory traversal bugs. Affected regions include the UK, Vietnam, Germany and others. ISPs confirm that outdated firmware is a key risk factor. Draytek urges users to disconnect from the WAN and update firmware immediately. Additional steps include disabling remote access features, enabling two factor authentication, and applying ACLs. The disruptions impact both consumers and businesses, with instability reported across various sectors. Security researchers continue to track live attacks, urging quick action to prevent further outages. The EU's cybersecurity agency ENISA has released a new Space Threat Landscape Report warning of growing cyber risks to the commercial space sector. With over 10,000 satellites in orbit, most privately owned space infrastructure now supports critical services like Internet access, logistics tracking and remote monitoring. Enisa warns that cyberattacks could trigger cascading effects from service disruptions to geopolitical tensions. The report highlights vulnerabilities from commercial off the shelf components, legacy systems, weak encryption and human error. ANISA recommends security by design, strong encryption, regular patching, and adopting zero trust principles. Despite space being classified as an essential sector under the NIS 2 directive, many operators still struggle with compliance. The report underscores the urgent need for robust cybersecurity as digital threats to space systems grow alongside sector expansion. CISA issued four ICS advisories revealing critical vulnerabilities in abb, Rockwell Automation, and Inaba Denki Sangyo products. Flaws with CVSS scores up to 9.3 could enable denial of service device takeovers or unauthorized access in systems used across oil, gas and manufacturing sectors. While ABB and Rockwell have released patches, Anaba Denki Sangyo's device remains unpatched. CISA urges immediate mitigation, including firmware updates, network segmentation, limiting physical access, and secure remote access to protect critical infrastructure. U.S. marshals have reportedly arrested Veer Sheetal, also known as Whiz, a key suspect in a $243 million cryptocurrency heist. According to blockchain investigator ZacxBT, the September 2024 scam involved phishing tactics where hackers impersonated Google and Gemini's support to trick a victim into resetting their two factor authentication. Sheetal, along with two co conspirators, then looted the victim's crypto holdings. Zach XBT traced the stolen funds and exposed how the group laundered money to fund a lavish lifestyle. Chetal's arrest marks a major breakthrough in the case. The incident highlights the critical need for strong personal cybersecurity practices. No software can replace user vigilance when facing sophisticated phishing threats. Investigations into the broader scam and remaining suspects are ongoing. Coming up after the break, my conversation with Brian Levine from about creating a networking directory for former government and military professionals and the UK's NCSC goes full influencer. Stay with us. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off.