Transcript
Dave Buettner (0:02)
You're listening to the CyberWire network, powered by N2K. Cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant. Some US Banks pause electronic communications with the OCC following a major breach of the agency's email system Uncertainty spreads at CISA China accuses three alleged US Operatives of conducting cyber attacks during February's Asian Games. Microsoft Teams suffers file sharing issues Fraudsters use ChatGPT to create fake passports Car rental giant Hertz confirms data stolen in last year's Clio breach. Researchers describe a novel process injection method called Waiting thread hijacking A new macOS malware as a service threat is being sold on underground forums. A UK man is sentenced to over eight years for masterminding the lab host phishing platform. Kim Jones joins us with a preview of the newly relaunched CISO Perspectives podcast. David Moulton from Unit 42 sits down with Rob Wright, security news director at Informa Tech Target for the latest threat vector and Fighting the flood of AI generated experts it's Tuesday, April 15, 2025. I'm Dave Buettner and this is your CyberWire Intel Brief. Foreign thanks for joining us here today. It's great to have you with us. Several major US Banks, including JP Morgan Chase and BNY Mellon, have paused electronic communications with the Office of the Comptroller of the Currency, the occ, following a major breach of the agency's email system, Bloomberg reports hackers accessed over 100 accounts for more than a year, prompting fears that sensitive data such as banks, cybersecurity reports and even national security letters may have been exposed. The OCC is working with Microsoft, CrowdStrike and Mandiant to investigate. Though on site examiners still have access, banks worry the compromised data could aid future cyber attacks. The incident, now deemed a major breach, has triggered congressional scrutiny and raised concerns about the OCC's cybersecurity safeguards, with experts warning that trust between banks and regulators has been fundamentally shaken. Uncertainty is spreading at the US Cybersecurity and Infrastructure Security Agency as staff face a deadline to accept resignation or payout offers from the Department of Homeland Security. But reports suggest CISA could lose up to 1300 employees, about a third of its workforce, amid broader federal cyber staffing cuts. The move has alarmed officials and experts who warn it could weaken the nation's defenses against cyber threats to critical infrastructure like water, energy and transportation. Staff describe the atmosphere as chaotic, with many eyeing exits to the private sector. CISA says it's committed to supporting employees while continuing its mission. However, the scope of the reductions far exceeds previous cuts and threatens to cripple key divisions within the federal Cyber Defense Agency. China has accused three alleged US operatives of conducting cyberattacks during February's Asian Games in Harbin. According to Chinese authorities, the individuals reportedly linked to the NSA targeted event management systems holding sensitive personal data. The cyber attacks allegedly disrupted games operations and extended to critical infrastructure in Heilongjiang Province, including energy, telecom and defense institutions, as well as tech giant Huawei. China claims the attacks caused serious national harm and and has urged the US to stop its alleged cyber operations. While offering no concrete evidence, China says it will take further steps to protect its cybersecurity. The US has not responded to the accusations. Both countries routinely blame each other for cyber espionage, fueling ongoing tensions in cyberspace. Earlier today, Microsoft Teams users experienced a major issue affecting file sharing, prompting an ongoing investigation by Microsoft. The company acknowledged the disruption via its Microsoft 365 Status account and is tracking the issue. Although the Microsoft 365 Service Health page initially showed no problems, users reported widespread difficulties accessing files, particularly via SharePoint. Microsoft has not provided a fix timeline, but recommends using alternatives like OneDrive for sharing. OpenAI's ChatGPT image generator has been exploited to create realistic fake passports in minutes, According to the 2025 Cato Control Threat Report. This marks a major shift in cybercrime where generative AI allows non experts termed zero knowledge threat actors to forge documents without coding skills or access to illicit tools. By tweaking prompts, users can bypass ChatGPT's safeguards, producing convincing passports for fraud. This ease enables scams like new account fraud, insurance fraud and identity theft. Traditional ID verification methods such as photo uploads are now vulnerable. Experts urge stronger defenses like NFC based document checks, liveness detection and and device anchored identity verification. Car rental giant Hertz has confirmed that customer data was stolen in last year's CLOP ransomware attacks exploiting CLIO file transfer software. The breach affected Hertz Dollar and thrifty customers, exposing personal details like names, contact info, birth dates, credit card and driver's license data and and in some cases Social Security numbers and medical claim information. The stolen files came from a Clio product used by Hertz. While there's no evidence of misuse, Hertz is offering two years of identity and dark Web monitoring. Checkpoint Research describes a novel process injection method called weighting thread hijacking, offering a stealthier alternative to traditional thread hijacking techniques. Unlike conventional methods that rely on suspending and modifying active threads, actions often detected by endpoint detection and response systems, WTH targets dormant threads within Windows thread pools by identifying threads in a waiting state. WTH manipulates their return addresses to redirect execution to malicious code without triggering common security alerts. This approach avoids the use of high risk APIs, instead utilizing standard operations to further evade detection. The technique can distribute its steps across multiple processes, obfuscating behavioral signatures typically monitored by security tools. WTH exemplifies the evolving tactics in cyber threats, emphasizing the need for advanced behavioral analysis in cybersecurity defenses. A new macOS malware as a service threat Inari Loader is being sold on underground forums, marking a serious escalation in Apple targeted cyberattacks. Unlike previous macOS stealers, Inari offers a premium toolkit with remote desktop access, advanced data exfiltration and password bypass capabilities, allowing attackers to harvest credentials without fake prompts. The malware is modular and can be deployed through multiple vectors like DMG files or malicious apps. It also reportedly evades detection without adding obfuscation. Offered at between $5,000 and $10,000 per month, it's priced well above competitors like Atomic and Banshee. Likely reflecting its powerful features, the loader adds to a growing wave of macOS threats seen in 2023 and 24, such as Macstealer and Metastealer. Researchers warn this development could lead to broader exploitation of macOS systems. Users should stay alert, avoid unverified downloads, enable 2fa and keep their devices updated with the latest security patches. Zach Coyne, age 23, from Huddersfield in the UK, has been sentenced to eight and a half years in prison for creating Lab Host, one of the world's largest phishing as a service platforms operating from 2021 to 2024, Labhost was used by over 2,000 fraudsters to build fake websites, imitating banks, healthcare providers and postal services to steal personal and financial data. The platform enabled global fraud, causing losses exceeding 100 million pounds, far more than initially estimated. Coyne profited by charging membership fees for access to pre made fishing templates or custom built sites. Labhost was dismantled in April 2024 following a major international takedown involving the Met Police, NCA, Microsoft and Europol authorities also arrested 24 suspects and searched over 70 locations. This case highlights law enforcement's growing focus on dismantling cybercrime infrastructure and prosecuting those who enable mass Frau Coming up after the break, Kim Jones joins us with a preview of the newly relaunched CISO Perspectives podcast. David Moulton sits down with Rob Wright from Inform A Tech Target for the latest threat vector and fighting the flood of AI generated experts. Foreign what's the common denominator in security incidents? Escalations and lateral movement? When a privileged account is compromised, attackers can seize control of critical assets with bad directory hygiene and years of technical debt. Identity attack paths are easy targets for threat actors to exploit, but hard for defenders to detect. This poses risk in active directory, entra ID and hybrid configurations. Identity leaders are reducing such risks with attack path management. You can learn how attack path management is connecting identity and security teams while reducing risk with Bloodhound Enterprise powered by Spectrops. Head to Spectrops IO today to learn more. Spectre Ops See your attack paths the way adversaries do it is my pleasure to welcome back to the show Kim Jones. He is the host of CISO Perspectives, our newly rebooted program that is part of Cyberwire Pro. Kim, welcome back.