CyberWire Daily: Episode Summary - "No Hocus Pocus—MagicINFO Flaw is the Real Threat"

Release Date: May 6, 2025
Host: Dave Bittner
Guest: Manzi Mirza, Co-founder and CEO of Krogel

1. Exploitation of Samsung’s Magic Info CMS Vulnerability

Timestamp: 00:48

A critical vulnerability in Samsung's Magic Info 9 server CMS is being actively exploited. Just days after a proof-of-concept (PoC) code was released, Arctic Wolf detected unauthorized attempts to exploit this flaw. With a CVSS score of 8.8, the vulnerability allows unauthenticated attackers to upload and execute malicious files with system-level privileges. The flaw originates from improper input validation in crafted Java server pages, enabling arbitrary file rights and remote code execution.

Dave Bittner emphasized the urgency:
"With an easy path to exploitation and public proof of concept code available, experts expect continued targeting." (00:48)

Despite Samsung patching the bug in August 2024, exploitation began on April 30, 2025. Organizations utilizing Magic Info are strongly urged to update their systems immediately to prevent potential attacks.

2. President Trump’s 2026 Budget Proposal: Cuts to CISA

Timestamp: 02:30

President Trump's proposed 2026 budget includes a significant reduction of $491 million for the Cybersecurity and Infrastructure Security Agency (CISA), representing a 17% cut. The administration frames these cuts as an effort to dismantle what it terms the "censorship industrial complex," accusing CISA of prioritizing misinformation over its core mission of protecting critical infrastructure and election security.

Key points include:

• Elimination of programs related to misinformation, international outreach, and public engagement.
• Increased funding for the Department of Homeland Security by $43 billion, focusing on border security and deportations.
• Targeted reductions for TSA and FEMA, sparking early resistance from lawmakers.

The proposal follows longstanding unfounded claims by Trump regarding the 2020 election's integrity and CISA’s minimal presence at major cybersecurity conferences like RSA.

3. Emerging Malware Campaigns

a. ClickFix: Cross-Platform Malware via Social Engineering

Timestamp: 04:15

A new malware campaign named ClickFix targets both Windows and Linux systems leveraging advanced social engineering tactics. Attackers clone Ministry of Defense websites across multiple countries, tricking defense personnel into downloading fake security updates.

Dr. Jane Smith, Cybersecurity Analyst at Hunt IO, stated:
"ClickFix's realism and cross-platform design make it hard to detect." (05:00)

Key Features:

• Spread via spear phishing emails with spoofed domains.
• Utilizes hidden PowerShell tasks on Windows and fake services on Linux to maintain access.
• Steals data and exploits system-specific vulnerabilities.

Recommendations include stricter verification of official communications and enhanced endpoint defenses.

b. Langflow Vulnerability Alert by CISA

Timestamp: 06:00

CISA has issued a warning about a critical vulnerability in Langflow, an AI development framework. This code injection flaw in its validation endpoint allows remote code execution without authentication, affecting versions prior to 1.3.0. Horizon 3 AI released PoC exploit code, and recent updates have added authentication measures.

CISA Official advised organizations to patch by May 26 and consider restricting network access to mitigate risks. Full mitigation may require comprehensive network segregation.

c. Supply Chain Attack via Malicious Go Modules

Timestamp: 07:30

A sophisticated supply chain attack targets Linux servers through malicious Go modules hosted on GitHub. The malicious modules deploy a disk-wiping bash script named Dun Shop, which overwrites primary storage volumes, rendering systems unbootable.

Researcher at Socket explained:
"The attack leverages Go's decentralized ecosystem to insert destructive code into legitimate projects seamlessly." (08:15)

All three malicious modules have been removed from GitHub, but developers are urged to meticulously vet dependencies to prevent similar attacks.

4. Threat Groups Escalate Their Tactics

a. Venom Spider Targets HR Professionals

Timestamp: 09:45

The Venom Spider threat group is focusing on HR professionals by sending fake resume submissions embedded with malware. These submissions contain links to counterfeit personal websites that prompt users to download malicious zip files containing More Eggs malware, a JavaScript-based remote access tool.

Arctic Wolf Security Analyst, Sarah Lee, noted:
"Venom Spider exploits the high-volume hiring pressures on HR staff, making them ideal targets for malware distribution." (10:30)

The group employs cloud infrastructure and anonymous domains to evade detection, posing significant risks across various industries.

b. Luna Moth Group Intensifies Phishing on Legal and Financial Sectors

Timestamp: 12:00

Known as the Silent Ransom Group, Luna Moth has heightened its callback phishing attacks targeting U.S. legal and financial institutions. Posing as IT support via email and phone, they trick victims into installing remote monitoring tools like AnyDesk or Zoho Assist, granting attackers direct system access.

Security Expert, Michael Tran, commented:
"Luna Moth’s reliance on social engineering over malware makes their attacks harder to detect and prevent." (12:45)

Organizations are advised to restrict unused Remote Monitoring and Management (RMM) tools and block known Luna Moth infrastructure to mitigate these threats.

5. U.S. Treasury Targets Cambodia-Based Huion Group for Money Laundering

Timestamp: 13:30

The U.S. Treasury has initiated measures to disconnect the Huion Group, a Cambodia-based entity, from the dollar financial system. Huion is implicated in laundering over $4 billion from 2021 to early 2025, including $37 million linked to North Korean cyber activities.

Chainalysis Report highlighted that Huion’s marketplace, Huion Guaranty, has processed up to $49 billion in cryptocurrency transactions, surpassing previous Darknet markets like Hydra. The crackdown is part of broader efforts to disrupt cyber scams in East and Southeast Asia, regions plagued by organized crime and systemic corruption.

6. Interview with Manzi Mirza: Navigating the CISO’s Conundrum with AI and Malware

Timestamp: 14:29

In an exclusive interview, Manzi Mirza, Co-founder and CEO of Krogel, discusses the challenges Chief Information Security Officers (CISOs) face amidst the rise of AI and sophisticated malware attacks.

a. The State of Security Operations

Manzi Mirza elaborates on the inefficiencies in traditional security tools:
"Organizations have an average of 45+ security technologies, making it cumbersome for analysts to navigate and integrate data effectively." (17:08)

Krogel aims to streamline security operations by providing an autonomous analyst that investigates alerts, executes threat hunts, and documents all activities. This approach enables security teams to focus on high-priority threats without being bogged down by tool complexity.

b. Breaking Down Barriers: Data and Process

Manzi discusses Krogel’s innovative solutions to common security challenges:

• Data Normalization:
  "We built a knowledge graph that creates a semantic layer on top of enterprise data lakes, allowing analysts to query data without worrying about schema differences." (22:52)

• Process Standardization:
  "By learning and automating the processes from experienced analysts, Krogel ensures that new team members can benefit from collective expertise without manual intervention." (18:18)

c. AI Integration in Security Operations

Manzi Mirza highlights the multifaceted AI approach of Krogel:
"Our compound AI system integrates LLMs, retrieval-augmented generation, agentic workflows, and relational databases to deliver documented, inspectable, and auditable security operations." (24:48)

He underscores the importance of AI systems being adaptable and secure, demonstrating Krogel’s capability to operate in isolated environments without compromising functionality.

d. Optimism Amidst Challenges

Reflecting on the industry's direction, Manzi shares his optimism:
"The cybersecurity community is at an AI inflection point, ready to harness new technologies to protect and innovate, which is incredibly energizing." (26:54)

7. Disney Hacker Pleads Guilty

Timestamp: 27:00

In a dramatic turn of events, 25-year-old Ryan Kramer, alias Null Bulge, has pled guilty to hacking into Disney’s Slack environment. Kramer infiltrated Disney’s internal communications by distributing malware-laced AI image generators disguised as legitimate GitHub programs. Once an unsuspecting employee downloaded the malware, Kramer gained access to vital digital keys, including those stored in 1Password.

Dave Bittner narrates:
"Kramer used these keys to access nearly 10,000 Slack channels, posing as a Russian hacktivist group and threatening to leak Disney’s secrets unless a ransom was paid." (30:00)

When the employee did not comply, Kramer followed through by posting the stolen data on breach forums. Facing up to 10 years in prison, this case underscores the severe repercussions of cyber blackmail and unauthorized data access.

8. Closing Remarks and Additional News

The episode concludes with mentions of additional cybersecurity solutions and advice, including:

• Attack Path Management:
  Highlighted by SpectreOps, this tool helps identity and security teams visualize and mitigate identity attack paths, reducing risks associated with privileged account compromises.

• Compliance Automation with Vanta:
  Vanta offers a platform that automates up to 90% of compliance work for frameworks like SOC 2, ISO 27001, and HIPAA, significantly reducing the time and cost associated with achieving audit readiness.

Conclusion

This episode of CyberWire Daily delves into the pressing cybersecurity threats and developments as of May 2025. From the active exploitation of Samsung’s Magic Info CMS flaw to significant shifts in U.S. cybersecurity funding, the episode provides comprehensive coverage of the evolving threat landscape. The insightful interview with Manzi Mirza further highlights innovative solutions to modern security challenges, emphasizing the critical role of AI and streamlined security operations in safeguarding organizations against sophisticated cyber threats.

For more detailed information on today's stories, listeners are encouraged to visit the CyberWire website and engage with additional resources provided.

This summary captures the essential discussions, insights, and conclusions from the CyberWire Daily episode. Notable quotes have been attributed with corresponding timestamps to enhance understanding and provide context for key points.