Transcript
A (0:02)
You're listening to the Cyberwire Network powered by N2K.
B (0:14)
We've all been there. You realize your business needs to hire someone yesterday. How can you find amazing candidates fast? Well, it's easy. Just use Indeed when it comes to hiring, Indeed is all you need. Stop struggling to get your job post noticed Indeed Sponsored Jobs helps you stand out and hire fast. Your post jumps to the top of search results so the right candidates see it first and it works. Sponsored Jobs on indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring here at N2K CyberWire. Many of my colleagues here came to us through Indeed plus with Sponsored Jobs. There are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data Worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility at indeed.com cyberwire just go to indee indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need.
A (2:01)
Prosper data breach reportedly affected more than 17 million accounts Microsoft revokes certificates used in Rise IDA ransomware operation Threat actors exploit Cisco Flaw to deploy Linux rootkits Europol disrupts cybercrime as a service operation Beavertail and Otter Cookie merge and display new functionality Singapore Cracks down on social Media on our Industry Voices segment today, we are joined by Danny Jenkins who is talking about defending against AI and who let the bots out. Today is Friday, October 17, 2025. I'm Maria Varmazes, host of T Minus Space Daily, taking the mic for Dave Buettner and this is your Cyber Wire Intel Briefing. Thank you for joining me on this Friday. Let's get into it. A data breach disclosed last month by financial services company Prosper affected more than 17 million accounts. According to Bleeping Computer. Prosper disclosed that the attackers stole Social Security numbers belonging to Prosper customers and loan applicants, but didn't share how many users were impacted. Have I been poned? Disclosed the alleged scope of the breach yesterday, saying that the breach affected 17.6 million unique email addresses as well as names, dates of birth, government issued IDs, employment status, credit status, income levels, physical addresses, IP addresses and browser user agent details. Prosper spokesperson told Bleeping Computer that the company quote is not able to validate HaveIBenPWN's report, adding the investigation to determine what data was affected and to whom it belongs remains ongoing. Microsoft disrupted a Rysider ransomware operation by revoking more than 200 certificates that were being used to sign malicious teams installers, according to Security Week. The company attributes the activity to the financially motivated threat actor called Vanilla Tempest. Microsoft stated running the fake Microsoft Teams setup delivered a loader, which in turn delivered a fraudulently signed Oyster backdoor. Vanilla Tempest has incorporated Oyster into their attacks as early as June 2025 and but they started fraudulently signing these backdoors in early September 2025 to fraudulently sign the fake installers and post compromise tools. Vanilla Tempest was observed using Trusted Signing as well as SSL.com, digiCert and GlobalSign code signing services. Trend Micro has published a report on the exploitation of a Cisco SNMP vulnerability to deploy rootkits on older Linux systems. The researchers have dubbed the operation Zero Disco after the universal password used by the malware, the report notes. Trendmico Telemetry has, as of writing, detected that Cisco 9400 series and 9300 series are affected by this operation. The operation also affected Cisco 3750G devices with no Guest Shell available, but this type of device has already been phased out and treadmicro added this Currently, there is no universal automated tool that can reliably determine whether a Cisco switch has been successfully compromised by the Zero Disco operation. So if you suspect a switch is affected, we recommend contacting Cisco TAC immediately and asking the vendor to assist with a low level investigation of firmware, ROM and boot regions. Security researchers have disclosed critical vulnerabilities in Connectwise, a widely used remote monitoring and management platform. Attackers could exploit these flaws to gain unauthorized access, execute arbitrary commands, or escalate privileges across managed networks. Some of the issues stem from inadequate input validation and weak authentication checks in key modules, including Web interfaces and API endpoints. Because remote monitoring and management tools inherently have deep privileged access, exploiting them can grant attackers broad control over client environments, so users are strongly urged to apply vendor patches immediately, audit all privileges and sessions, and monitor logs for suspicious behavior. The situation does underscore how remote monitoring and management and managed service provider software do remain prime targets, as when compromised, they act as force multipliers for attackers. A Europol coordinated operation resulted in the arrest of five Latvians accused of operating a service that sold phone numbers to scammers. According to the record, police seized 1,200 SIMbox devices and 40,000 active SIM cards, Europol stated the online service created by the criminal network offered phone numbers registered to people from over 80 countries for use in criminal activities. It allowed perpetrators to set up fake accounts for social media and communication platforms, which were subsequently used in cybercrimes while obscuring the perpetrator's true identity and location. North Korea linked operators are using stealthy modular malware and social engineering to steal credentials and cryptocurrency. Cisco, Talos and Google's Threat Intelligence Group observed campaigns linked to famous Cholima that involved the use of Beavertail and Otter Cookie, which are separate but complementary malware strains frequently used by the North Korea Aligned Threat Group. Researchers said that their analysis determined the extent to which Beavertail and Otter Cookie have merged and displayed new functionality in recent campaigns. Those recent campaigns trick job seekers into installing loaders that deploy info stealers, backdoors and ransomware, often rotating tool sets and infrastructure to evade detection. Attackers favor low noise tactics like rust based binaries, transacted hollowing and impersonation of legitimate services to blend malicious traffic and reduce forensic footage footprints. Compromised endpoints are leveraged for targeted crypto theft, data exfiltration and follow on ransomware, while operators rapidly switch payloads and C2 servers to frustrate defenders. Singapore's parliament passed a sweeping new law granting authorities broad powers to block harmful online content, target platforms with fines up to 1 million Singaporean dollars or the equivalent of US$740,000 and require removal of content at quote, short notice. The legislation empowers the Infocom Media Development Authority to issue takedown orders without court approval and mandate platforms to use proactive monitoring tools. Platforms that fail to comply may be blocked in Singapore, and foreign services face stricter obligations if they reach large audiences in the country. While dubbed the move to protect society from disinformation and cyber harm, critics warn that it risks censorship and overreach, especially given its vague definition of what harmful speech means. Civil liberties groups say that the law could chill online discourse and give the state sweeping control over public narratives. After the break, we have our industry voices segment, with Danny Jenkins, CEO and co founder of Threat Locker, talking about defending against AI and who let the bots out?