Pay the ransom or risk data carnage. - CyberWire Daily

Summary

CyberWire Daily: "Pay the Ransom or Risk Data Carnage" Summary

Release Date: February 28, 2025
Host: N2K Networks
Guest: Keith Milarsky, Chief Global Ambassador at Q Intel and former FBI Special Agent

1. Qilin Ransomware Attack on Lee Enterprises

The episode opens with a discussion on the Qilin ransomware group claiming responsibility for a significant attack against Lee Enterprises, a major newspaper publisher based in Iowa. The group disclosed that they had exfiltrated approximately 350 gigabytes of sensitive data, encompassing investor records, financial arrangements, and communications with journalists.

Impact: Over 75 publications across 25 U.S. states were disrupted following the attack on February 3.
Threat: Qilin demands a ransom, threatening to release the stolen data on March 5 if their demands are not met.
Statement: Maria Varmazes highlights the severity, stating, "The attackers encrypted critical applications and exfiltrated certain files, causing widespread disruption." ([01:32])

Despite the gravity of the situation, Lee Enterprises refrains from labeling the incident explicitly as ransomware in their SEC filing, though the nature of the attack clearly aligns with ransomware tactics.

2. Arrest of a Singaporean Cybercriminal in Thailand

The podcast reports on the Thai police's arrest of a 39-year-old Singaporean man suspected of orchestrating over 90 data leaks across the Asia Pacific region. Assisted by Group IB, the joint operation targeted companies in Thailand, Singapore, Malaysia, Indonesia, and India, among others.

Modus Operandi: The suspect primarily focused on exfiltrating personal data and coerced victims into paying to prevent public disclosure.
Aggression: If unpaid, rather than leveraging dark web forums, the hacker directly notified media outlets or data protection regulators to amplify reputational and financial damage.
Quote: "He used direct notifications to pressure victims into submission, inflicting greater reputational and financial harm." – Group IB Press Release ([02:50])

This arrest underscores the growing international collaboration in combating cybercrime and the increasing sophistication of cybercriminals in manipulating data for extortion.

3. JavaGhost Exploits AWS for Phishing Campaigns

Palo Alto Networks' Unit 42 has identified a new threat actor, JavaGhost, exploiting misconfigured AWS environments to propagate phishing campaigns.

Tactics: JavaGhost gains unauthorized access through exposed long-term access keys and leverages legitimate AWS services like Amazon SES and WorkMail to dispatch phishing emails.
Defense Recommendations:
- Limit administrative access.
- Regularly rotate IAM credentials.
- Utilize short-term access tokens.
- Implement multi-factor authentication ([05:15])

By using legitimate services, JavaGhost’s phishing attempts are more likely to bypass traditional security filters, emphasizing the need for stringent configuration and monitoring of cloud environments.

4. Lotus Blossom Cyber Espionage Targeting Southeast Asia

Cisco Talos has been tracking Lotus Blossom, a threat actor engaged in extensive cyber espionage campaigns targeting governmental, manufacturing, telecommunications, and media sectors in Vietnam, Taiwan, Hong Kong, and the Philippines.

Tools Used: The campaigns utilize the Sage Run X remote access tool, uniquely employed by Lotus Blossom, which abuses cloud services like Dropbox, Twitter (now X), and Zimbra for command and control (C2) communication.
Attribution: While Cisco Talos does not directly link Lotus Blossom to a specific nation-state, Microsoft has previously associated the group with China.

This espionage highlights the persistent threats faced by Southeast Asian nations and the sophisticated methods employed by adversaries to infiltrate and control critical infrastructure.

5. Exploitation of Microsoft Dev Tunnel Service by Malware

A novel abuse of Microsoft’s Dev Tunnel service has been uncovered, where cybercriminals utilize it to facilitate data transfer between malware-infected devices and command and control servers.

Malware Utilized: Variants of NJRAT are found exploiting Dev Tunnels to communicate via hidden URLs, making detection by traditional security systems challenging.
Spread Mechanism: The malware can spread through USB devices, further compromising systems.
Recommendation: Organizations not using Dev Tunnels should monitor DNS logs for suspicious tunnel URLs to identify potential breaches early ([06:45])

This exploitation underscores the adaptability of malware in leveraging legitimate services to obfuscate malicious activities.

6. Pass the Cookie Attacks Bypassing Multi-Factor Authentication (MFA)

Longwall Security alerts to the rise of pass the cookie attacks, a technique where attackers hijack session cookies to gain unauthorized access without triggering MFA.

Mechanism: Attackers use info stealer malware like Luma C2 to extract authentication cookies directly from browsers.
Black Market: Stolen cookies are traded on dark web marketplaces, facilitating undetected account access.
Defense Strategies:
- Shorten session expiration times.
- Monitor login behaviors.
- Educate users on phishing threats ([07:30])

As MFA remains a cornerstone of cybersecurity, attackers’ ability to bypass it using session hijacking necessitates enhanced protective measures.

7. Cyber Threats to Agriculture and the Farm and Food Cybersecurity Act

The episode highlights the Farm and Food Cybersecurity Act, reintroduced in Congress to safeguard the U.S. food supply chain from digital threats.

Provisions:
- Mandates the USDA to perform biennial cybersecurity assessments.
- Requires coordination of crisis response exercises with homeland security and intelligence agencies.
Rationale: Recent incidents, like the 2021 JBS ransomware attack, have exposed vulnerabilities in precision agriculture and food production sectors.
Statistics: A report cited that 90% of cyberattacks leverage readily available tools and 83% involve spear phishing.
Support: The bill enjoys backing from key industry groups, emphasizing that food security equates to national security ([08:15])

This legislative effort aims to bolster cyber resilience in a sector critical to national infrastructure and public health.

8. Interview with Keith Milarsky on Cryptocurrency and Cybersecurity

The core segment features an in-depth conversation between Dave Bittner and Keith Milarsky, exploring the intersection of cryptocurrency and cyber threats.

a. The Rise of Crypto as a Target

Keith Milarsky outlines the transformation of cryptocurrency from a fringe interest to a mainstream investment avenue, attracting significant attention from cybercriminals due to its high liquidity and anonymity.

Quote: "Crypto has evolved from a side activity to a mainstream investment, attracting both legitimate investors and cybercriminals alike." ([12:27])

b. Challenges in Tracking Crypto-related Crimes

Milarsky explains the complexities law enforcement faces in tracing crypto transactions compared to traditional financial systems.

Anonymity: Despite blockchain's transparency, the use of crypto mixers and rapid coin conversions (e.g., Bitcoin to Monero) complicate tracking efforts.
Quote: "The anonymous nature of crypto transactions makes it significantly harder to trace compared to traditional money laundering methods." ([13:47])

c. Cryptocurrency as an Enabler for Ransomware

The discussion highlights how cryptocurrency has amplified ransomware operations by providing a streamlined avenue for ransom payments and laundering.

Impact: Instances where entities like North Korea have exploited crypto to fund their operations are cited.
Quote: "Cryptocurrency has been pivotal in enabling ransomware to flourish, providing an efficient means to launder multi-million dollar ransoms." ([15:07])

d. Lack of Regulation and Consumer Protections

Milarsky emphasizes the urgent need for regulatory frameworks to protect consumers investing in cryptocurrency, pointing out the absence of safeguards like FDIC insurance.

Personal Impact: He shares a personal anecdote about a friend losing substantial crypto holdings to malware, highlighting the dire consequences of inadequate protections.
Quote: "Without regulations, consumers have no recourse when their crypto investments are compromised, leading to significant financial losses." ([18:24])

e. Recommendations for Protecting Crypto Assets

To mitigate threats, Milarsky suggests three primary methods for safeguarding cryptocurrencies:

Using Reputable Exchanges: Although exchanges are targets, selecting reliable ones can offer some level of security.
Physical Storage: Storing crypto on a USB drive or employing cold storage solutions.
Regulatory Advocacy: Pushing for comprehensive regulations to enforce security standards and protect consumers.

Quote: "While no method is foolproof, combining these strategies can significantly reduce the risk of crypto asset theft." ([19:34])

Milarsky concludes by stressing the necessity of public trust and regulatory measures to ensure the sustainable growth of cryptocurrency as a legitimate financial tool ([20:49]).

Conclusion

This episode of CyberWire Daily provides a comprehensive overview of current cybersecurity threats, ranging from ransomware attacks on major publishers to sophisticated cyber espionage and emerging threats targeting the burgeoning cryptocurrency market. Through expert analysis and insightful discussions, particularly with Keith Milarsky, listeners gain a deeper understanding of the evolving cyber threat landscape and the imperative for enhanced security measures and regulatory frameworks.

For those seeking to stay ahead in cybersecurity, this episode underscores the critical need for vigilance, proactive defense strategies, and informed policy-making to safeguard both organizational and personal digital assets.

Transcript

Maria Varmazes (0:02)

You're listening to the Cyberwire network, powered by N2K.

Dave Bittner (0:12)

Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try Deleteme. I have to say, Deleteme is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.

Maria Varmazes (1:32)

Qilin ransomware gang claims responsibility for attack against Li Enterprises Thai police arrests suspected hacker behind more than 90 data leaks JavaGhost uses compromised AWS environments to launch phishing campaigns Lotus Blossom cyber espionage campaigns target Southeast Asia malware abuses Microsoft DEV tunnels for C2 communication protecting the food supply. Today's guest is Keith Milarsky, Chief Global Ambassador at Q Intel and former FBI special agent, discussing crypto being the target of the cyber underground and an interview with Ironman. Today is Friday, February 28, 2023. I'm Maria Varmazes, host of T Minus Space Daily, in for Dave Bittner and this is your Cyber Wire intel briefing. The Qilin Ransomware group yesterday claimed responsibility for an attack against Iowa based newspaper publisher Lee Enterprises, reports Security Weekly. The group claims to have stolen around 350 gigabytes of data, including investor records, financial arrangements that raise questions, payments to journalists and publishers, funding for tailored news stories and approaches to obtaining insider information. Qilin is threatening to publish the data on March 5 unless the company pays the ransom. LI Enterprises, which publishes more than 350 newspapers across 25 United States states, sustained a cyber attack on February 3 which disrupted at least 75 of its publications. The company has avoided using the term ransomware, but it did mention in an SEC filing that the attackers encrypted critical applications and exfiltrated certain files. Security Week reports that police in Thailand have arrested a 39 year old Singaporean man suspected of involvement in over 90 data leaks. Group IB, which assisted in the joint operation between the Royal Thai Police and the Singapore Police Force, said in a press release that the arrested individual was one of the most active cybercriminals in Asia Pacific since 2021, targeting companies and businesses in Thailand, Singapore, Malaysia, Indonesia, India and many more. The security firm added that the main goal of his attacks was to exfiltrate the compromised databases containing personal data and to demand payment for not disclosing it to the public. If the victim refused to pay, he did not announce the leaks on Dark Web forums. Instead, he notified the media or personal data protection regulators with the aim of inflicting greater reputational and financial damage on his victims. Later, he also asserted pressure on his victims by sending direct customer notifications via email or via instant messengers to force them into submission. Palo Alto Networks Unit 42 warns that the Java Ghost threat actor is compromising misconfigured AWS environments and using them to launch phishing campaigns. The group gains entry to the AWS environments via exposed long term access keys, and once they've gained access, the attackers use the victim's Amazon simple email service or ses, and Workmail services to send out phishing emails. Since the emails are sent from a legitimate source, they're more likely to bypass security filters. And to defend against these attacks, Unit 42 recommends that AWS users limit access to administrative rights, rotate IAM credentials regularly, use short term or just in time access tokens, and enable multi factor authentication. Cisco Talos is tracking multiple cyber espionage campaigns by the Lotus Blossom threat actor targeting government, manufacturing, telecommunications and media entities in Vietnam, Taiwan, Hong Kong and the Philippines. The researchers note that the operation appears to have achieved significant success. The campaigns involve the Sage Run X remote access tool, which is exclusively used by Lotus Blossom. The Sage Run X backdoor abuses legitimate cloud services such as Dropbox, Twitter or now X and Zimbra for its C2 communication. Talos does not attribute Lotus Blossom to any particular nation state, but Microsoft has previously linked the group to China. In a new twist, cybercriminals are exploiting Microsoft's Dev Tunnel service to send data back and forth from malware infected devices. This service, designed for developers to test apps and collaborate securely, is now being abused to help malware avoid detection. Recently, researchers found two versions of NJRAT malware using Microsoft's dev tunnels to connect to command and control servers. The malware communicates through hidden URLs, making it harder for traditional security systems to spot the malware checks in with its remote servers, reporting its status, and then can even spread through USB devices. Experts say that organizations that are not using dev tunnels should keep an eye on DNS logs for any unusual dev tunnel URLs as a way to spot potential attacks early. According to Longwall Security, cybercriminals are using pass the cookie attacks to bypass multi factor authentication. Instead of stealing passwords, attackers target session cookies, which allow them to hijack active sessions without triggering MFA info Stealer malware like Luma C2 is often used to extract authentication cookies from victims browsers. Once stolen, these cookies let attackers impersonate users and access accounts. These stolen cookies are even being traded on dark Web marketplaces, making it easier for cybercriminals to access accounts undetected. Longwall Security recommends shortening session expiration times, monitoring login behavior, and educating users on phishing to defend against this rising threat. As attackers evolve, organizations must strengthen their security to stay ahead. Cyber threats to agriculture are no longer hypothetical. The Farm and Food Cybersecurity act, reintroduced in Congress, aims to secure the US Food supply chain from digital attacks. With bipartisan support, the bill mandates the USDA to conduct biennial cybersecurity assessments and coordinate crisis response exercises with homeland security and intelligence agencies. Recent attacks, like the 2021 JBS ransomware incident, highlight the growing risks to precision agriculture and food production. A new Food and Ag Sector Cyber Threat report found that 90% of cyberattacks exploit readily available tools and 83% of them involve spear phishing. With backing from key industry groups, this legislation pushes for stronger public private collaboration. The message is clear. Food security is national security and cyber resilience must be a priority. Coming up next, we've got Dave Buettner's conversation with Q Intel Chief Global Ambassador and former FBI Special Agent Keith Milarsky discussing crypto being the target of the cyber underground and an interview with a superhero courtesy of N2K producer Liz Stokes. We'll be right back.