Transcript
Dave Buettner (0:02)
You're listening to the Cyberwire Network powered by N2K. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect, Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com Palo Alto Networks confirms a recently patched firewall vulnerability is being actively exploited CISA warns of an actively exploited iOS vulnerability Juniper networks has issued a critical security advisory for an API authentication bypass vulnerability. The acting Commissioner of the Social Security Administration resigns after Elon Musk's team sought access to sensitive personal data of millions of Americans. The eager B malware framework is actively targeting government agencies and ISPs across the Middle East. Proofpoint researchers document a new macOS Info Stealer. A new phishing kit uses timesheet notification emails to steal credentials and two factor authentication codes. JPMorgan Chase will begin blocking Zelle payments to social media contacts to combat online scams. Our guest is Tim Starks from cyberscoop discussing his interview with former National Cyber Director Harry Coker and transferring your digital Legacy. It's Tuesday, February 18th, 2025. I'm Dave Buettner and this is your CyberWire Intel Brief. Thanks for joining us here today. It is great to have you with us. Palo Alto Networks has confirmed that a recently patched firewall vulnerability is being actively exploited. The flaw, disclosed on February 12, allows unauthenticated attackers to bypass authentication and execute PHP scripts via the Pan OS management interface. Threat intelligence firm Graynoise detected exploit attempts starting February 13th with attacks originating from nearly 30 unique IPs. The vulnerability can be chained with another vulnerability for remote code execution, posing a serious risk to unpatched systems. A proof of concept exploit is publicly available and researchers warn that roughly 3,500 Pan OS management interfaces remain exposed. Palo Alto urges immediate patching, emphasizing that securing external facing management interfaces is critical. Asset Note, which discovered the flaw Coordinated disclosure with Palo Alto arguing transparency helps defenders track attacks rather than leaving organizations vulnerable and in the dark. CISA has issued an urgent warning about a zero day vulnerability in Apple iOS and iPadOS actively exploited in targeted attacks. The flaw an authorization bypass in Apple's USB restricted mode, allows attackers with physical access to disable security protections on locked devices, potentially exposing sensitive data. Apple confirmed the exploit has been used in highly sophisticated attacks against high value individuals, possibly by state sponsored groups. The vulnerability affects a wide range of Apple devices, including iPhone XS and later models. Emergency patches were released on February 10th and CISA urges users to update before March 5th. While no specific surveillance vendors are named, the attack methods resemble those used by firms like NSO Group. Users should update immediately and enforce physical security measures. Juniper Networks has issued a critical security advisory for an API authentication bypass vulnerability affecting Session Smart Router, Session Smart Conductor and WAN Assurance Managed Router products. The flaw, with a CVSS score of 9.8, allows unauthenticated attackers to gain full administrative control by injecting spoofed JWTs, bypassing authentication checks. Attackers can exploit this flaw to modify routing policies, intercept encrypted traffic, and move laterally across networks. The vulnerability affects multiple software versions and requires network adjacency but no user interaction. Juniper discovered the issue through internal testing with no known exploitation. As of February 18, patches are available and cloud managed WAN assurance routers received automatic fixes. Organizations should apply updates immediately, audit configurations, monitor API requests, and implement network segmentation to mitigate risks. Unpatched systems pose serious threats to SD, WAN and 5G infrastructure. Turning to Washington, Michelle King, the acting commissioner of the Social Security Administration, resigned after Elon Musk's team sought access to sensitive personal data of millions of Americans. Musk's Department of Government Efficiency has been embedding in federal agencies, claiming to root out fraud and waste. The Social Security Administration, which manages $1.5 trillion in benefits, reported $71.8 billion in improper payments from 2015 through 2022, less than 1% of total disbursements. Musk's team sought access to an internal database containing financial, employment and medical records, raising serious privacy concerns. Former Social Security Administration Commissioner Martin O'Malley refuted Musk's claims of mass fraudulent payments, calling them baseless. Amid controversy, Trump's nominee for Social Security Administration leadership, Frank Bisignano, awaits Senate confirmation. The White House backs Musk's broader data access initiatives. The eager B malware framework is actively targeting government agencies and ISPs across the Middle east, including Saudi Arabia, the UAE and Qatar. Linked to the Chinese aligned APT27, the malware employs advanced backdoor capabilities through DLL hijacking and process hollowing. The UAE Cybersecurity Council urges organizations to patch exchange servers, monitor modified DLLs, and review service configurations. Immediate memory analysis is recommended as Eager B leaves minimal disk traces a new macOS malware campaign has emerged. On February 18, Proofpoint reported the discovery of Frigid Stealer, a new macOS info stealer linked to the TA569 threat group, also known as Mustard, Tempest, and purple Vallhund. TA569, previously known for fake updates and sock golish attacks, now collaborates with two new TA2726 and TA2727. TA2727 recently deployed frigid Stealer alongside Windows and Android malware, while TA2726 functions as a traffic distribution service. In early 2025, Proofpoint observed TA2726 redirecting traffic North American users to TA569 and others to TA2727, which distributed malware like Lumasteeler, Deer Stealer, and Marcher. The Frigid Stealer campaign detected in January of this year, tricked Mac users into downloading malware through fake update pages. Security experts warn that evolving collaboration among threat actors makes these campaigns increasingly sophisticated and harder to track. Meanwhile, a new XCSSet malware variant is targeting macOS users, Microsoft reports. Originally discovered in 2020, XCSSet spreads through Apple Xcode infecting systems when compromised projects are executed. It steals data from chat apps, injects JavaScript, takes screenshots, and encrypts files. The latest variant employs new obfuscation techniques, enhanced persistence, and novel infection methods. It randomizes payload generation, drops payloads into shell launch files, and manipulates Launchpad's doc path to execute malware. Microsoft also observed new payload injection techniques using target rule and forced strategy methods in XCODE projects. The malware continues to target digital wallets, notes, app data, and system files. With these upgrades, XCSSET remains a stealthy and evolving macOS threat. Cybersecurity researchers have uncovered a phishing campaign using the Tycoon 2 FA phishing kit disguised as timesheet notification emails to steal credentials and two factor authentication codes. Attackers abuse Pinterest's redirect service to bypass security filters before leading victims to a malicious Russian hosted site. Tycoon 2fa is evolving now, featuring obfuscated JavaScript, geofencing and adaptive phishing forms. Mimicking Microsoft 365, Salesforce and banking portals. This multi platform credential theft suggests collaboration with ransomware groups. Threat actors increasingly exploit trusted platforms like Pinterest to evade detection, rendering traditional perimeter defenses ineffective. Experts recommend organizations implement behavior based detection systems and strict access controls to counter these evolving threats. JPMorgan Chase will begin blocking Zelle payments to social media contacts starting March 23 to combat a rise in online scams. Nearly 50% of reported fraud cases involving Zelle or wire transfers between June and December of last year originated on social media. Zelle, a widely used digital payment service, offers fast bank to bank transfers but lacks purchase protection, making it a prime target for scammers. Chase's updated policy warns that Zelle should only be used to pay trusted individuals, not social media sellers. This change follows a Consumer Financial Protection Bureau lawsuit against Zelle's operator, Early Warning Services and three major banks, including Chase, accusing them of rushing Zelle to market without proper consumer protections. The lawsuit claims hundreds of thousands of users lost over $870 million. Chase may delay, decline or block payments deemed high risk and request additional transaction details to mitigate fraud risks. Coming up after the break, two Tim Starks from cyberscoop discusses his interview with former National Cyber Director Harry Coker and transferring your digital legacy Stay with us. Cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control, stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant.