Orange you glad you didn't fall for this? - CyberWire Daily

Summary

CyberWire Daily Podcast Summary: "Orange you glad you didn't fall for this?"
Release Date: February 25, 2025
Host: Dave Bittner, N2K Networks

Introduction

In the February 25, 2025 episode of CyberWire Daily, host Dave Bittner delivers a comprehensive briefing on the latest cybersecurity threats, breaches, and trends shaping the industry. The episode also features an insightful interview with Lauren Buetta, founder and CEO of Girl Security, discussing the importance of mentoring and fostering intergenerational strategies within the cybersecurity workforce.

Major Security Incidents

1. Orange Group Data Breach

At the outset of the episode, Dave reports a significant security breach involving Orange Group, a major French telecommunications company:

Breach Details: A hacker named "Ray," associated with the Hellcat ransomware group, claims to have stolen 6.5 gigabytes of internal documents from Orange, primarily affecting its Romanian branch. The stolen data includes 380,000 unique email addresses, customer and employee information, invoices, contracts, and partial payment card details.

Dave Bittner [04:20]: "Ray says they accessed Orange's systems for over a month using compromised credentials and vulnerabilities in JIRA software."
Company Response: Orange has stated that the breach impacted a non-critical back-office application, ensuring that customer operations remain unaffected. They are collaborating with authorities to investigate the incident.

Dave Bittner [05:10]: "Orange confirmed the breach affected a non-critical back office application, stating that customer operations were unaffected."

2. Russia's Financial Sector Breach at Lanit

The episode highlights a concerning breach within Russia's financial sector:

Impact: Lanit, Russia’s largest IT service provider servicing key government agencies, including the Ministry of Defense and firms like Rostec, suffered a security breach affecting two subsidiaries focused on banking technology, ATMs, and payment systems.

Dave Bittner [06:35]: "The attack could have serious implications for Russia's banking infrastructure."
Nature of Attack: The incident suggests a supply chain compromise rather than a conventional DDoS attack, indicating a more sophisticated approach by the attackers.

Surge in Cyber Attacks

1. Industrial Control Systems (ICS) and Operational Technology (OT) Attacks

There has been a dramatic increase in cyberattacks targeting ICS and OT:

Statistics: Cybersecurity firm Dragos reports an 87% surge in such attacks in 2024, with ransomware attacks on industrial infrastructure increasing by 60%.

Dave Bittner [07:55]: "Ransomware actors are shifting their focus as geopolitical tensions rise."
Geopolitical Context: Conflicts involving Russia, Ukraine, and China have heightened the risk, with state-sponsored groups like China's Volt Typhoon aiming to infiltrate critical infrastructure.

Dave Bittner [08:45]: "Volt Typhoon has identified strategic US targets, including power substations critical for military deployments."

2. Silver Fox's Spoofing of Medical Software

A Chinese-backed hacking group, Silver Fox, is exploiting vulnerabilities in the healthcare sector:

Attack Mechanism: Silver Fox is spoofing legitimate medical software, such as Philips DICOM image viewers, to distribute malware like Valleyrat, a remote access tool.

Dave Bittner [11:15]: "The malware could spread into hospital networks through infected patient devices, posing a major cybersecurity risk to healthcare organizations."
Technical Tactics: The malware leverages PowerShell commands to evade detection and downloads encrypted payloads from Alibaba Cloud.

UK Home Office Vulnerability Reporting Policy

The podcast addresses controversial changes in the UK's approach to vulnerability reporting:

Policy Shift: The UK Home Office has introduced a new vulnerability reporting policy that may inadvertently prosecute ethical hackers, even when they adhere to guidelines.

Dave Bittner [12:30]: "Unlike the Ministry of Defense, which assures researchers they won't face prosecution, the Home Office offers no such protections."
Industry Impact: Critics argue that this outdated stance under the Computer Misuse Act of 1990 discourages responsible disclosure, potentially weakening the UK's cybersecurity resilience.

Ransomware Trends

A notable shift in ransomware strategies was discussed:

From Encryption to Data Exfiltration: ReliaQuest's annual cyber threat report reveals that 80% of ransomware attacks in 2024 focused solely on data exfiltration, bypassing encryption.

Dave Bittner [13:10]: "Attackers achieve lateral movement in as little as 27 minutes, leaving defenders little time to respond."
Defensive Recommendations: Emphasis on AI-driven security, enhanced VPN monitoring, and rapid vulnerability patching are essential as attackers expedite their methods.

Advanced Malware Campaigns

1. Poseidon Stealer on macOS

A sophisticated malware campaign targeting macOS users with Poseidon Stealer was extensively covered:

Distribution Tactics: The malware spreads via a counterfeit Deepseek AI website, utilizing malvertising to lure victims into downloading malicious DMG files.

Dave Bittner [13:50]: "Poseidon employs anti-analysis techniques and exfiltrates stolen data via curl post requests."
Mitigation Strategies: Experts recommend restricting OSA script execution, utilizing next-generation antivirus, and educating users about terminal-based threats.

2. Light Spy Surveillance Framework Evolution

The Light Spy Surveillance framework has expanded its capabilities:

Expansion: Originally targeting messaging apps, it now supports over 100 commands, capable of infiltrating multiple platforms including Android, iOS, Windows, macOS, Linux, and routers.

Dave Bittner [14:30]: "LightSpy also uses malicious plugins for keystroke logging, screen capture, and USB monitoring."
Defense Measures: Adoption of behavior-based detection strategies is crucial to counteract its advanced evasion tactics.

Botnets and Targeted Attacks

Chinese Botnet Targeting Microsoft 365

A potent threat from a Chinese botnet targeting Microsoft 365 accounts was discussed:

Botnet Scale: The botnet comprises over 130,000 compromised devices utilizing password spraying to bypass multi-factor authentication.

Dave Bittner [15:05]: "The campaign, linked to Chinese infrastructure, poses a major threat to financial, healthcare, government, and tech sectors."
Operational Impact: Attackers exploit non-interactive sign-ins, often going unnoticed, and can trigger account lockouts, disrupting business operations.
Preventative Measures: Security teams are advised to monitor non-interactive sign-in logs to detect and mitigate such sophisticated attacks.

Vulnerabilities and Exploits

Oracle Agile PLM Flaw

An important vulnerability was highlighted:

Vulnerability Details: CISA has added an Oracle Agile PLM flaw to its known exploited vulnerabilities catalog. This high-severity deserialization vulnerability allows low-privileged attackers to execute arbitrary code.

Dave Bittner [15:40]: "While no public reports confirm active exploitation, experts believe attackers likely use it post initial access."
Industry Relevance: Oracle vulnerabilities, especially those related to WebLogic, remain frequent targets for attackers, underscoring the need for diligent patch management.

Interview with Lauren Buetta, Founder and CEO of Girl Security

Mentoring and Intergenerational Strategies

The episode features an in-depth conversation with Lauren Buetta about Girl Security's initiatives to empower girls and young women in the national security sector:

Organizational Mission: Girl Security focuses on advancing young women through skills-based learning, mentorship, and professional advancement, emphasizing the application of technology within a national security context.

Dave Bittner [14:49]: "Central to our mission is an emphasis on educating girls about how technology is applied within the national security context."
All Secure Alliance Initiative: Launched two years prior, this program identifies gaps in the security sector and promotes an intergenerational workforce through innovative tools like the reverse mentorship toolkit.

Dave Bittner [15:21]: "We created the first reverse mentorship toolkit that can be used within the security sector, but really by any industry."
Reverse Mentorship Model: This approach encourages junior employees to mentor senior leaders, facilitating the transfer of contemporary technical knowledge and modern educational experiences.

Dave Bittner [16:34]: "Younger people mentor up senior people on how to use those technologies."
Program Success and Expansion: Girl Security maintains a waitlist over six years, signifying high demand. Their workforce training program supports approximately 300 fellows annually, while the mentoring program fosters around 1,000 mentoring relationships each year.

Dave Bittner [17:43]: "Our challenge, which is not necessarily new, is how do we leverage systems and the communities of people we serve to design for certain efficiencies?"
Measuring Success: Utilizing comprehensive surveys and analyses, Girl Security boasts a 97% satisfaction and engagement rate, with 87% placement into cybersecurity pathways.

Dave Bittner [20:30]: "We're at about 87%. That means that someone who's gone through our program has secured an opportunity in the security space."
Mentor Selection: Girl Security seeks mentors from diverse sectors who understand the security landscape and possess strong listening skills to provide targeted guidance.

Dave Bittner [21:49]: "We're really just looking for people who have an understanding of what the security sector looks like, believes in the power of engaging young people in the sector..."
Success Story: Lauren shares the story of Araya, a standout participant who transitioned from the summer fellowship to a workforce training program, securing a scholarship at the University of Chicago for cybersecurity studies, and contributing to notable projects like the White House global convening of girls and women in cyber.

Dave Bittner [22:59]: "She stayed involved in the mentoring program as an alumni and is just off doing remarkable things."

Conclusion

Dave Bittner wraps up the episode by emphasizing the critical nature of cybersecurity advancements and community initiatives like Girl Security in fostering a resilient and diverse workforce. Listeners are encouraged to stay informed and engaged with the latest developments to stay ahead in the rapidly evolving cybersecurity landscape.

Notable Quotes

Dave Bittner [04:20]: "Ray says they accessed Orange's systems for over a month using compromised credentials and vulnerabilities in JIRA software."
Dave Bittner [07:55]: "Ransomware actors are shifting their focus as geopolitical tensions rise."
Dave Bittner [15:05]: "The campaign, linked to Chinese infrastructure, poses a major threat to financial, healthcare, government, and tech sectors."
Dave Bittner [20:30]: "We're at about 87%. That means that someone who's gone through our program has secured an opportunity in the security space."

Final Thoughts

This episode of CyberWire Daily offers a wealth of information on current cybersecurity threats and highlights the importance of nurturing the next generation of security professionals through strategic mentoring and educational programs. The discussions underscore the multifaceted nature of cybersecurity challenges and the collaborative efforts required to address them effectively.

Transcript

Dave Bittner (0:02)

You're listening to the Cyberwire network, powered by N2K.

Lauren Buetta (0:12)

Hey, everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try DeleteMe. I have to say, DeleteMe is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K. A hacker claims to have stolen internal documents from a major French telecommunications company. A security breach hits Russia's financial sector. Cyber attacks targeting ICS and OT surged dramatically last year. Chinese group Silver Fox is spoofing medical software. The UK's Home Office's new vulnerability reporting policy risks prosecuting ethical hackers. Hackers. Ransomware actors are shifting away from encryption. A sophisticated macOS malware campaign is distributing. Poseidon Stealer, the light spy surveillance framework evolves into a cross platform espionage tool. A Chinese botnet is targeting Microsoft 365 accounts using password spraying attacks. Our guest today is Lauren Buetta, founder and CEO at Girl Security, discussing mentoring and intergenerational strategies. And there may be a back door in your front door. It's Tuesday, February 25th, 2025. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here once again today. It is great as always to have you with us. A hacker going by the name Ray claims to have stolen 6.5 gigabytes of internal documents from Orange Group, a major French telecommunications company and digital services provider primarily affecting its Romanian branch. The breach exposed 380,000 unique email addresses, customer and employee data, invoices, contracts and partial payment card details. Ray, a member of the Hellcat ransomware group, says they accessed Orange's systems for over a month using compromise credentials and vulnerabilities in JIRA software. After exfiltrating data for three hours undetected. They attempted to extort Orange but were ignored. Orange confirmed the breach affected a non critical back office application, stating that customer operations were unaffected. The company is investigating and working with authorities. Ray denies that this was a Hellcat operation, though the group has previously targeted Schneider Electric and Telefonica. Russia's national coordination center for computer incidents, has warned the country's financial sector about a security breach at lanit, a major IT service provider. Lanit, Russia's largest system integrator, serves key government agencies, including the Ministry of Defense and military industrial complex firms like Rostec. The attack, which occurred on February 21, affected two subsidiaries, both specializing in banking technology, ATMs and payment systems. The breach could have serious implications for Russia's banking infrastructure. Authorities have not disclosed the attack's origin, method or impact, but the incident suggests a potential supply chain compromise rather than a typical DDoS attack on banks. Cyberattacks targeting industrial control systems and operational technology surged dramatically by 87% in 2024, according to Cybersecurity firm Dragos. Ransomware attacks on industrial infrastructure also increased by 60%, reflecting heightened geopolitical tensions involving conflicts like Russia, Ukraine and China. Taiwan experts warn that state sponsored groups such as China's Volt Typhoon are infiltrating critical infrastructure, preparing potential future disruptions. Volt Typhoon has notably identified strategic US targets, including power substations critical for military deployments. Alarmingly non state cybercriminals are gaining ICS expertise through collaboration with state actors, broadening attack capabilities and risks to critical infrastructure. The shift threatens more frequent, indiscriminate attacks as cybercriminal groups increasingly target industrial systems for financial or disruptive objectives. A Chinese government backed hacking group, Silver Fox, is spoofing medical software to infect hospital patients, computers with backdoors, keyloggers and crypto miners, according to forescout's Videri Labs. The malware mimics Philips dicom image viewers and other healthcare applications, tricking victims into installing Valleyrat, a remote access tool. The attack uses PowerShell commands to evade detection and downloads encrypted payloads from Alibaba cloud while targeting individuals. The malware could spread into hospital networks through infected patient devices, posing a major cybersecurity risk to healthcare organizations. The UK Home Office's new vulnerability reporting policy risks prosecuting ethical hackers even if they follow its guidelines due to the Computer Misuse act of 1990. Unlike the Ministry of Defense, which assures researchers they won't face prosecution, the Home Office offers no such protections, leaving them vulnerable to legal action. The Cyber up campaign warns that the outdated CMA criminalizes all unauthorized access, discouraging responsible disclosure. While other countries have modernized laws to protect researchers, critics worry the UK's delay is harming cybersecurity resilience. Ransomware actors are shifting away from encryption, with 80% of attacks in 2024 focusing solely on data exfiltration, which is 34% faster, according to ReliaQuest's annual cyber threat Report. Attackers achieve lateral movement in as little as 27 minutes, leaving defenders little time to respond. Service accounts were compromised in 85% of breaches, often due to poor security management. Insufficient logging was the top cause of breaches, while legitimate remote access tools were used in two thirds of critical intrusions, ReliaQuest advises. AI driven security better monitoring VPN security and rapid vulnerability patching automation is now essential, they say, as attackers move faster than ever. A sophisticated macOS malware campaign is distributing Poseidon Stealer via a fake Deepseek AI website, according to cybersecurity researchers. The malware bypasses macOS Gatekeeper and harvests sensitive data including browser credentials, cryptocurrency wallets and system keychains. Attackers use malvertising to lure victims to a counterfeit site delivering a malicious DMG file. Poseidon employs anti analysis techniques and exfiltrates stolen data via curl post requests. Security experts recommend restricting OSA script execution using next generation antivirus and educating users on terminal based threats to mitigate the risk. Meanwhile, a privilege escalation vulnerability in Parallel's desktop remains unpatched with two exploits publicly disclosed allowing attackers to gain root access on Macs. Security researcher Mickey Ginn bypassed Parallel's previous fix for a flaw stemming from missing code signals signature verification. Despite seven months of warnings, Parallels has not addressed the issue, leaving all known versions vulnerable. Gin urges users to take proactive security measures as attackers could exploit this in the wild. The Light Spy Surveillance framework has evolved into a cross platform espionage tool, now supporting over 100 commands to infiltrate Android, iOS, Windows, macOS, Linux and routers, according to new research. Originally targeting messaging apps, it now focuses on stealing Facebook and Instagram database files, exposing private messages, contacts and metadata. LightSpy also uses malicious plugins for keystroke logging, screen capture and USB monitoring. The framework's multi OS reach and advanced evasion tactics pose a significant cyber espionage threat, requiring behavior based detection strategies for effective defense. A Chinese botnet with over 130,000 compromised devices is targeting Microsoft 365 accounts using password spraying attacks that bypass multi factor authentication, according to Security Scorecard the botnet exploits non interactive sign ins which often go unnoticed in security logs, allowing attackers to access emails, documents and collaboration tools. The campaign, linked to Chinese infrastructure, poses a major threat to financial, healthcare, government and tech sectors. Attackers also risk business disruption by triggering account lockouts. Security teams should monitor non interactive sign in logs to detect this evolving attack. CISA has added an Oracle Agile PLM flaw to its known exploited vulnerabilities catalog. The high severity deserialization vulnerability, patched in January, allows low privileged attackers to execute arbitrary code. While no public reports confirm active exploitation, experts believe attackers likely use it post initial access. Oracle vulnerabilities, particularly weblogic flaws, remain frequent attack targets. Coming up after the break, my conversation with Lauren Buetta from Girl Security. We're discussing mentoring and intergenerational strategies and there may be a back door in your front door. Stay with us. And now a message from our sponsor Zscaler, the leader in cloud security Enterprises have spent billions of dollars on firewalls and VPNs, yet breaches continue to rise by an 18% year over year increase in ransomware attacks and a $75 million record payout in 2024. These traditional security tools expand your attack surface with public facing IPs that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Zscaler Zero Trust AI stops attackers by hiding your attack surface, making apps and IPs invisible, eliminating lateral movement Connecting users only to specific apps, not the entire network continuously verifying every request based on identity and context simplifying security management with AI powered automation and detecting threats using AI to analyze over 500 billion daily transactions. Hackers can't attack what they can't see. Protect your organization with Zscaler Zero Trust and AI. Learn more at Zscaler.com Security Cyber threats are more sophisticated than ever. Passwords. They're outdated and can be cracked in a minute. Cybercriminals are intercepting SMS codes and bypassing authentication apps. While businesses invest in network security, they often overlook the front door, the login Yubico believes the future is passwordless. Yubikeys offer unparalleled protection against phishing for individuals, SMBs and enterprises. They deliver a fast, frictionless experience that users love. Yubico is offering N2K followers a limited buy one, get one offer. Visit yubico.com N2K to unlock this deal. That's Yubico. Say no to modern cyber threats. Upgrade your security today. Lauren Buetta is founder and CEO at Girl Security I recently caught up with her for insights on mentoring and intergenerational strategies.