Loading summary
Transcript15 lines
- [00:02]
Dave Buettner
You're listening to the Cyberwire Network, powered by N2K.
- [00:12]
Maria Vermazes
Looking for a career where innovation meets impact? Vanguard's technology team is shaping the future of financial services by solving complex challenges with cutting edge solutions. Whether you're passionate about AI, cybersecurity or cloud computing, Vanguard offers a dynamic and collaborative environment where your ideas drive change. With career growth opportunities and a focus on work life balance, you'll have the flexibility to thrive both professionally and personally. Explore open cybersecurity and technology roles today@vanguard.jobs.com A cyber attack targeting Oracle Health conference compromises patient data the DOJ nabs over $8 million tied to romance scams. Trend Micro examines a China linked APT group conducting cyber espionage. A new Android banking trojan called Crocodilis has emerged. North Korea's Lazarus Group targets job seekers in the crypto industry. CISA IDs a new malware variant targeting Ivanti Connect Secure appliances. Maria vermazes, host of N2K's T minus Space Daily show, chats with Jake Braun, former White House Princip Deputy National Cyber Director and Chairman of Defcon Franklin. They discuss designating space as critical infrastructure and nulling out your pizza payment. It's Monday, March 31, 2025. I'm Dave Buettner and this is your CyberWire Intel Brief. Thanks for joining us here today. Happy Monday. It is great to have you with us. A cyber attack targeting Oracle Health, formerly Cerner, compromised patient data from legacy servers not yet migrated to Oracle Cloud. The breach, discovered on February 20, affected multiple US hospitals and healthcare providers. A threat actor reportedly used stolen credentials to access and exfiltrate patient records from these outdated systems. Oracle Health privately informed affected customers but has not publicly acknowledged the breach. The attacker, using the alias Andrew, is demanding millions in cryptocurrency and has launched public websites to pressure victims. Oracle's response has drawn criticism for its lack of transparency and formal documentation. Although Oracle is offering support tools, it's leaving HIPAA notifications to hospitals. Healthcare remains a top target for ransomware due to its large undersecured attack surface and critical need for operational continuity. Hatching medical devices is slow, often delayed over a year due to FDA regulations and outdated systems. Clarity's Team 82 analyzed over two and a quarter million IOMT and 647,000 OT devices across 351 healthcare organizations. They found that 99% are vulnerable to known exploits and 20% of hospital systems with these vulnerabilities are also insecurely connected to the Internet using a triage method based on exploit presence, ransomware links and insecure connectivity. Researcher identified the most at risk devices for OT. Only 0.3% of devices met all three risk criteria for IOMT, about 1%. Clarity has published a five step process to identify and remediate these threats. The US Department of Justice has seized over $8.2 million in USDT. That's Tether cryptocurrency tied to romance baiting scams, also known as pig butchering. In these scams, victims are manipulated into investing on fake platforms that appear to offer high returns. Once large sums are invested, victims are blocked from withdrawing funds and ultimately discover the platforms are fraudulent. The FBI traced laundering patterns linked to these scams, enabling a legal forfeiture under wire fraud and money laundering laws. Tether froze and reissued the stolen funds to law enforcement controlled wallets. The seizure could help compensate victims including 38 individuals with losses over $5.2 million. The scam operation is believed connected to human trafficking rings in Southeast Asia. Authorities stress vigilance when approached with guaranteed return investments. Researchers at Trend Micro take a closer look at Earth Alux, a China linked APT group which has been conducting cyber espionage operations since mid 2023. Initially targeting the Asia Pacific region before expanding into Latin America, the group focuses on government, tech, telecom and retail sectors, exploiting exposed servers to implant web shells like Godzilla. Their primary backdoor, Vargheat allows persistent access, data theft and stealthy operations using multiple communication channels including Microsoft outlook via Graph API. A unique technique involves injecting malicious code into MSPaint EXE processes enabling fileless attacks. This method uses Windows APIs to avoid detection while performing reconnaissance and exfiltrating data to attacker controlled cloud storage. Earth Alyx's use of sophisticated stealthy malware and long term infiltration tactics highlights the growing cyber threat to critical industries in targeted regions. A new Android banking trojan called Crocodilus has emerged with advanced capabilities for remote device takeover, key logging and stealing credentials, according to ThreatFabric targeting users in Spain and Turkey. It bypasses Android 13 security using a custom drone proper and gains full control through accessibility services. Once permissions are granted, Crocodylus connects to its command and control server, runs silently in the background and uses overlays to steal login data. It also logs accessibility events to capture text inputs and even reads one time passwords from Google Authenticator. The malware can mute sound, display black screens to hide activity, and deploy social engineering tricks like fake wallet backup prompts to steal crypto keys. Though linked to actor Cybra, evidence suggests a new likely Turkish speaking developer is behind it North Korea's Lazarus Group is back with a new cyber campaign, Click Fake Interview, targeting job seekers in the crypto industry. Using fake interview websites built with React js, attackers trick victims into downloading malware during staged recruitment processes. These sites deploy Golang Ghost, a cross platform backdoor that enables remote control, data theft and credential exfiltration on Windows and macOS. The campaign expands on the earlier contagious interview tactic and now focuses on centralized finance platforms like Coinbase and Bybit. It also targets non technical roles, exploiting their lower cybersecurity awareness. Malware like Frosty Ferret and Scripts in VBS or Bash help establish persistence and avoid detection. This campaign highlights Lazarus's continued evolution and its strategic pivot to support North Korea's financial and military goals through crypto heists. CISA has identified a new malware variant named Resurge, targeting Ivanti Connect secure appliances via an already patched vulnerability. This flaw, exploited since December and flagged in January, allowed threat actors to gain access to critical infrastructure upon analyzing compromised systems. CISA discovered Resurge alongside another variant, Spons Cloth, an open source shell script bundled with Busybox Tools. Resurge shares traits with spawn chimera such as reboot persistence, but adds new functions like web shell deployment, file manipulation and integrity check tempering. It can also embed itself into Ivanti's boot disk and manipulate the core boot image. CISA advises full factory resets along with widespread credential and password resets to mitigate the threat. Coming up after the break, Maria Vermasis sits down with Jake Braun, former White House Principal Deputy National Cyber Director. They discuss designating space as critical infrastructure and nulling out your pizza payment. Stay with us. Foreign Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try Delete Me. I have to say, Delete Me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data Privacy is protected. DeleteMe's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K. Are you frustrated with cyber risk scores backed by mysterious data, zero context and cloudy reasoning? Typical cyber ratings are ineffective and the true risk story is begging to be told. It's time to cut the bs. Black Kite believes in seeing the full picture with more than a score. One where companies have complete clarity in their third party cyber risk using reliable quantitative data. Make better decisions, reduce your uncertainty. Trust Black Kite. Jake Braun is former White House Principal, Deputy National Cyber Director and Chairman of DEFCON Franklin. He recently sat down with my N2K colleague Maria Vermazes, host of N2K's T Minus Space daily podcast, to discuss designating space as critical infrastructure.
- [12:42]
Jake Braun
My name is Jake Braun. I am currently the Executive Director of the Cyber Policy Initiative at the University of Chicago, but may be more relevant for this conversation. I was most recently, as of about six months ago, eight months ago, the acting Principal Deputy National Cyber Director in the White House, which essentially means I was the COO of this new cyber office they set up in the White House that was actually created in the Trump administration, but it was so new they hadn't hired any people into the office until Biden. And the first employee I think was hired in 21. And by the time I left we were up to about 100 people. So running a startup is interesting. Running a startup in government is, is particularly unique and then running a startup in the White House is something that I have a lot of scars from, but I would have never given up for the world.
- [13:42]
Dave Buettner
Wow. Yeah. So I want to hear more about that. Not the scars up to you obviously, but the work that you were doing in the White House. Please tell me a bit more about the efforts that you are working on.
- [13:54]
Jake Braun
Sure. So Congress created this office essentially because while there's a bunch of offices around the federal government that do cyber, there wasn't one that was at a level, meaning White House level, that could kind of compel other agencies to implement government wide policies and programs in cyber. And so this group in Congress, the Cyberspace Solarium Commission, created this. And our first task that was assigned to us by the President was to write or really update the National Cyber Strategy, which the first one was written in Bush, the second term of W. Bush. And then it's been updated, we did the fourth iteration of it. So our office rewrote or updated the National Cyber Strategy and then I was brought in to oversee implementation across the federal government of that strategy. And space was a key component of it, as well as a whole host of other things, including AI and mundane things like workforce and sexy things like cybercrime and cartels and stuff like that. But it ran the gamut.
- [15:14]
Dave Buettner
Yeah, Given what I often focus on. Clearly biased. I really want to hear more about the space side of things because as I mentioned before we started recording, I have a number of conversations with people in various parts of the space industry where we talk about space as critical infrastructure, what that means and what that would affect. And I don't think this is a very well understood thing. So I'd love to hear a bit more about your thoughts on that and sort of why the effort to get space designated as critical infrastructure is so important.
- [15:46]
Jake Braun
Sure. So actually our role in that conversation, the role of my office in the White House, the office of National Cyber Director, was actually not kind of a foregone conclusion. Initially the Space Council and the National Security Council were going to work to decide how things should unfold as it relates to space as critical infrastructure and kind of key recommendations on security of space infrastructure and so on. However, we kind of rose our hand as kind of the new kid on the block and said, hey, cyber's kind of a key component of all this. We should really be at the table. And after some hemming and hawing and typical government turf battles and everything else, folks agreed that not having the Cyber Office involved in this conversation was a big missed opportunity. And so over time we made a strong push, as did others, to designate space as critical infrastructure officially. I know that there's been some disagreement on that designation, but I think in practice people have largely come to agree that space is critical infrastructure, regardless of its formal designation by the government as such.
- [17:06]
Dave Buettner
That's a really good point. I think you're right that I think unofficially a lot of people are thinking of it that way. What would that. Would there be a really super big material difference if it was more officially designated? I mean, I know there is, but how, how big a difference would that really make at this point?
- [17:22]
Jake Braun
Well, part of the reason I think the space industry was, was somewhat less excited about it was that it can doesn't always, but can come with increased regulations and scrutiny from government, which of course industry generally doesn't like for obvious reasons. That being said, also, more resources often come with it. So there's. The government will often fund the way it does with other industries, information sharing groups to share threat intelligence they'll often fund, via CISA and other entities, folks that will go out and do free cybersecurity assessments. CISA does this, and a whole host of entities like state and local governments in the energy sector and water and so on, other parts of critical infrastructure. And so those types of resources would be available. Generally, we try not to subsidize major corporations who have the financial wherewithal to do it themselves. Like CIS is not out there doing free cyber assessments for JP Morgan or Bank of America, which are also critical infrastructure designated formally as such. But, you know, you could certainly envision that being applicable to many of the smaller companies in space.
- [18:48]
Dave Buettner
Absolutely, yeah. I think some of the tenor of the conversations I've had also have been, we're fine, we're good, we've got this. But my question is often the follow up, do you actually have it? Are you actually fine? Is the nature of the threat really fully understood? I'm not an expert here, I don't know. I often wonder though, do people quite understand what threats look like in the realm of space? Is it even all that special and all that different from the threats that we see terrestrially? I'm just so curious your thoughts on sort of the nature of what's going on in the space domain.
- [19:22]
Jake Braun
So first off, just to answer your question, absolutely not. They don't got it. And that's not their fault. Like no one does. I mean, you know, if you've got a nation state actor after you just remember stuxnet, right? Stuxnet was US and Israeli attacks on the Iranian nuclear program. The Iranians put their centrifuges in concrete vaults in the desert, buried underground, zero connection to the Internet or anything else. And we were still able to hack into those centrifuges and shut them down and make them break in a whole bunch of creative ways and so on and so forth. And so if somebody can get into your infrastructure that's not connected to the Internet, that's buried underground in the desert in a concrete vault, then they absolutely a nation state of similar capability like China or Russia or Iran or whoever could get into your satellite, which by definition is connected to networks all over the planet. And by the way, in fact, I'll give you an example. So, in my current capacity at the University of Chicago, we've partnered with defcon, the largest and longest running hacker conference in the world, to put out an annual report on the top findings at defcon. One of those findings this year was around space. And since this is a little bit more technical than I am, I'm just going to kind of read it off to you. So a group of hackers figured out that they could reverse engineer efforts to exploit VSAT satellite modems from Earth and they focused on the Newtek MDM 2200 from iDirect. So as far as they could tell, this was the first successful demonstration of a signal injection attack on a VSAT modem using software defined radios from Earth. I mean, they're spending hundreds or single digit thousands of dollars just messing around. Now granted these are brilliant people, so they're messing around is a lot more advanced than most people's messing around. But nonetheless, if they can do it on a shoestring budget, imagine what China, Russia, Iran or some other bad actor could do when they have millions or billions of dollars to throw in it. And considering that China itself has said that we're going to be at war over Taiwan in 2027, which hopefully none of us, hopefully that doesn't happen and hopefully that's all bluster and everything. But as we know from the Ukraine war, the first shot across the bow was against satellites. And we would presume the first shot fired in a war with China would be in space at our satellite infrastructure.
- [22:13]
Dave Buettner
If I'm a space company, large or small, I'm sure if I'm a large company, I have a good, I would hope a good understanding of some of the things that I would need to do. But I mean no company can deal with this alone. I mean nobody can deal with it in a vacuum. Collaboration is key, threat, information sharing is key. What needs to be done. I mean, I know there are some efforts underway. I'm thinking of the space ISAC is one of them in terms of sharing threat intel in the space industry and the space domain. If there's something going on, if there's a threat, that's if something is underway, how do people in the space domain share that information with each other in a meaningful way?
- [22:51]
Jake Braun
Right, so first off, your initial point is the exact right one. Join the Space isac. Even if you're a small company, I forget exactly what their fee structure is like, but usually the little guys and gals get a get a joint for free or very reduced rate and it's worth it. Secondly, particularly if you're a startup and you don't have a ciso, hire a ciso. And look, that's important not just for your security, but it's also important for your valuations and so on. I mean a lot of these folks in China and elsewhere will look at what Companies most recently got major investments from private equity firms or venture capital firms or, or whoever else. And then those will be the ones they target. In fact, we found several years ago at Homeland Security or Homeland Security found several years ago that attacks from China on IP were directly correlated to press releases of $20 million of investment or more. And so, yeah, like we could see that within weeks or whatever after press release saying they got 20 million in investment, they were getting hacked and their IP was getting pulled out the back door. So it's not just that you should do this for the good of the security of our space infrastructure, it's also for the good of the security of your company's ip. So number one, join the space isac. Number two, if you don't have a ciso, hire a ciso. And then number three, you know, if you have a ciso, they're going to know most of the things that you need to the basics that you need to do. A huge challenge in cyber that often precisely prohibits folks from hiring cyber staff is how expensive they are. And if you want somebody with a master's or even a bachelor's in computer science with a focus on cyber, they're incredibly expensive. However, if you've already got a ciso, you probably don't need people at that level. And one of the things we really pushed for in the national cyber strategy was for companies to think about how they could bring on folks that are maybe not super duper cyber Experts with a PhD in cyber or whatever, but somebody who they can do on the job training, there's a lot of certifications, online classes and so on where you could plus up your cyber workforce. Meaning you could do more cyber security if you were to bring on people who maybe have less qualifications from a degree perspective, but could quickly gain the hands on knowledge they would need from, you know, working with your ciso, taking some online classes, getting a certification here or there, or by the way, attending defcon, who we partner with on the Hackers Almanac. I encourage everybody to Google and read because it's fun. Read.
- [25:40]
Dave Buettner
Well, Jake, I've learned a ton from you and I really appreciate you taking the time. So thank you for joining me today.
- [25:47]
Maria Vermazes
And of course be sure to check out the T Minus Space Daily podcast wherever you get your favorite podcasts. Is your AppSec program actually reducing risk? Developers and AppSec teams drown in critical alerts, yet 95% of fixes don't reduce real risk. Why? Traditional tools use generic prioritization and lack the ability to filter real threats from noise. High impact threats slip through and surface in production. Costing 10 times more to fix. AUX Security helps you focus on the 5% of issues that truly matter before they reach the cloud. Find out what risks deserve your attention in 2025. Download the application Security benchmark from AUX Security. And finally, our five Finger Discount desk tells us about Diego Gouvea, a Portuguese software developer and cyber sleuth who uncovered a sneaky flaw in a local food delivery app. The bug? A sneaky little null character in the payment mode parameter. Turns out this unassuming character can tell the system to ignore everything that comes after it, like your actual bank balance. Diogo found that by slipping a null character into a payment request, he could order food without having the system actually check to see if you had any available cash. The system just nodded and said, yeah, that sounds legit. The loophole let users sidestep payment checks, potentially costing businesses big. Diogo's step by step exploit shows just how easy it was to game the system using tools like Burp Suite. His advice? Sanitize inputs, validate parameters, enforce strict data types, and maybe don't trust strings at face value, especially when food is involved because no one should be able to order pizza with Monopoly money. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com don't forget to check out the Grumpy Old Geeks podcast, where I contribute to a regular segment on Jason and Brian's show. Every week you can find Grumpy Old Geeks, where all the fine podcasts are listed. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Foreign cyber threats are evolving every second, and staying ahead is more than just a challenge, it's a necessity. That's why we're thrilled to partner with Threat Locker, the cybersecurity solution trusted by businesses worldwide. ThreatLocker is a full suite of solutions designed to give you total control stopping unauthorized applications, securing sensitive data, and ensuring your organization runs smoothly and securely. Visit threatlocker.com today to see how a default deny approach can keep your company safe and compliant.