Transcript
Dave Buettner (0:02)
You're listening to the Cyberwire Network powered by N2K. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com credential theft puts sensitive corporate and military networks at risk A federal judge refuses to block DOGE from accessing sensitive federal data New York based Insight Partners confirms a cyber attack Blacklock Ransomware group is on the rise Open SSH patches A pair of vulnerabilities Russian threat actors are exploiting signals Link devices feature over 12,000 GFI Karyo control firewalls remain exposed to a critical remote code execution vulnerability. CISA issues two ICS security advisories federal contractors pay $11 million in cybersecurity non compliance fines in our certfite segment, Chris Hare is joined by Stephen Burnley to break down a question targeting the ISC2 SSCP system security certified Practitioner Exam and sweeping cybercrime reforms are unveiled by Russ It's Wednesday, February 19, 2025. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Our Cyberwire team is on location in Orlando this week at ThreatLocker's Zero Trust World 25 conference. Sensitive corporate and military networks in the US could be at risk due to widespread credential theft from infosteeler malware. Research from Hudson Rock reveals cybercrime marketplaces are selling credentials from major defense contractors like Lockheed Martin and Boeing, as well as US military and government agencies, sometimes for as little as $10 per log. These logs often include active session cookies allowing attackers to bypass multi factor authentication. Even organizations not directly infected could be compromised through their partners or vendors. Stolen credentials may expose classified systems, procurement details and mission critical intelligence experts warn this poses a major national security threat, urging immediate password resets and forensic investigations. Infostealer infections stem from phishing, malware laden downloads and fake apps. With over 30 million compromised computers identified in recent years. A federal judge refused to block Elon Musk and his Department of Government Efficiency from accessing sensitive federal data despite concerns over privacy and oversight. The Lawsuit filed by 14 state attorneys general failed to prove imminent irreparable harm. The White House shifted its legal stance, arguing that Musk is merely a senior adviser to President Trump and not Doge's leader. Doge retains access to key agencies including Commerce, Energy and Health and Human Services, and has reportedly fed financial data into AI software via Microsoft Azure. The task force has also been granted unchecked system access to young, unvetted employees. The controversy centers on Musk's influence over federal workforce reductions and AI driven efficiency efforts. Despite lacking Senate confirmation, the White House calls Musk a special government employee, while Judge Chutkan acknowledged Doge's unpredictability but found no immediate legal basis for intervention. The White House declined further commentary. Meanwhile, a General Services Administration worker resigned in protest after Thomas Shedd, a Musk ally and head of Technology Transformation Services, requested admin Access to the notify.gov system. This platform sends mass government texts and contains personally identifiable information like phone numbers and Medicaid participation status. Shed's request would grant him unilateral access to this sensitive data without oversight. The resigning worker warned that bypassing the authorization to Operate process violates federal security policies. Other employees fear unchecked power over public data and the risk of government systems being misused for AI driven workforce reductions. Shed previously suggested using login.gov for fraud tracking and replacing federal workers with AI coding agents. Employees say his actions are scary and concerns grow that no one will stop him. GSA has not responded to requests for comment. New York based Insight Partners confirmed a cyber attack in January 2025 caused by what they say is a sophisticated social engineering attack. The breach was detected on January 16 and the firm swiftly contained and remediated it. The attack did not impact operations or pose risks to portfolio companies, including major IT and cybersecurity firms like Sentinel One Wiz and Recorded Future. Insight has informed law enforcement and partners and is investigating the breach with cybersecurity experts. The firm manages $90 billion in assets and has backed over 800 companies. Security researchers warn of Blacklock, a rapidly growing ransomware as a service group, which saw a 1400% increase in data leak posts in late 2025, expected to be 2025's most active ransomware. As a service group, Blacklock distinguishes itself with custom built malware, making analysis difficult and data leak site defenses that prevent victims from accessing stolen data, increasing ransom pressure. Blacklock operates heavily on the Ramp forum, collaborating with affiliates, developers and initial access brokers to accelerate attacks. Unlike typical ransomware as a service groups, it retains control over early attack stages by recruiting traffers, individuals who steer victims to malicious content while higher level developers are discreetly hired. ReliaQuest warns that Blacklock may exploit Microsoft Entra connect to target on premises environments. Organizations are urged to harden synchronization rules, enforce MFA, restrict RDP and secure ESXi hosts to mitigate risks. Qualys reported two OpenSSH vulnerabilities, both now patched in the latest version. The first is a denial of service flaw allowing attackers to overload memory and CPU with small ping messages, potentially crashing systems. The second is a man in the middle attack affecting clients with Verify Host key DNS enabled. FreeBSD had this setting on by default from 2013 through 2023. Admins should update immediately, disable Verify Host key DNS and monitor SSH traffic for anomalies. Russian threat actors are exploiting Signals linked devices feature in phishing campaigns to steal access to secure conversations. Google Threat Intelligence Group reports that state aligned hackers including Sandworm have tricked victims into scanning malicious QR codes linking their signal accounts to attacker controlled devices. Attackers disguised phishing pages as legitimate signal group invites or device pairing instructions. In some cases, modified JavaScript on fake invite pages redirected victims to link their accounts instead of joining a group. Ukrainian military personnel were targeted via a phishing kit impersonating artillery software, while Wave Sign and infamous chisel malware helped extract signal data from compromised devices. Google's Threat Intelligence Group warns this device linking attack is hard to detect and can persist unnoticed. Users should update signal, check link devices, use strong passwords, be cautious with qr codes and enable two factor authentication for better security. Over 12,000 GFI Karyo control firewalls remain exposed to a critical remote code execution vulnerability. First discovered in December 2024, the flaw allows one click RCE attacks due to improper input sanitization leading to HTTP response splitting and cross site scripting exploits. Despite a December security update, over 23,800 instances were still vulnerable weeks later and active exploitation attempts were detected early this year targeting admin CSRF tokens. As of now, 12,229 firewalls remain exposed, mostly in Iran, the US, Italy and Germany. With a public proof of concept available, even low skilled hackers can exploit the flaw. Organizations should immediately update to the latest version released on January 31st. Enhanced Security CISA has issued two ICS security advisories addressing critical vulnerabilities in Delta Electronics, CNCsoft G2 and Rockwell Automation Guardlogix controllers which are widely used in manufacturing energy and critical infrastructure. The one affecting Delta Electronics is a memory corruption flaw that could allow remote code execution via malicious DPAX files. Users should update and isolate networks. The one affecting Rockwell Automation has a denial of service vulnerability in CIP message processing, requiring firmware updates and network restrictions. CISA urges patching segmentation, VPN use and intrusion detection to secure OT environments. HealthNet Federal Services and Centene Corporation will pay $11 million to settle allegations of cybersecurity non complian compliance while supporting the US military's TRICARE healthcare program. Prosecutors claim that between 2015 and 2018, HNFs falsely certified compliance with federal cybersecurity standards, failing to patch vulnerabilities, enforce password policies, and secure outdated hardware and software. The settlement is part of the DOJ's Civil Cyber Fraud Initiative, launched in 2021 under the False Claims act, which holds federal contractors accountable for cybersecurity failures. Similar penalties include Guidehouse paying $11.3 million, Penn State paying $1.25 million and a currently pending lawsuit with Georgia Tech. DOJ officials stress that contractors handling sensitive government data must meet security obligations. Acting Assistant AG Brett Shumate warned that the DOJ will continue pursuing violations that protect national security and Americans privacy. Coming up after the break, Chris Hare and Steven Burnley have our weekly certbite segment and cybercrime reforms are unveiled by Russia Stay with us. Cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with ThreatLocker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant.