CyberWire Daily: Ransom Demands and Medical Data for Sale – March 31, 2025

Hosted by N2K Networks

Episode Overview

In this episode of CyberWire Daily, hosted by Maria Vermazes from N2K Networks, the focus is on critical developments in the cybersecurity landscape. The discussion delves into ransomware attacks targeting healthcare data, significant law enforcement actions against romance scams, advanced persistent threats from China, emerging Android banking trojans, North Korea's Lazarus Group activities, and new malware variants identified by CISA. A highlight of the episode is an in-depth interview with Jake Braun, former Principal Deputy National Cyber Director at the White House and Chairman of DEFCON Franklin, who provides insights into the strategic designation of space as critical infrastructure.

Major Cybersecurity Incidents

1. Oracle Health Conference Breach

A significant ransomware attack targeted Oracle Health (formerly Cerner), compromising patient data from legacy servers still operating on-premises. The breach, identified on February 20, affected numerous U.S. hospitals and healthcare providers. Threat actors leveraged stolen credentials to access and exfiltrate sensitive patient records from outdated systems.

• Key Points:

  • Oracle Health notified affected customers privately but has not made a public disclosure.
  • The attacker, known as "Andrew," is demanding millions in cryptocurrency and has set up public websites to apply pressure.
  • Oracle faces criticism for its lack of transparency and formal reporting regarding the breach.
  • Although Oracle provides support tools, the responsibility of HIPAA notifications falls on the individual hospitals.

• Expert Analysis: Healthcare remains a lucrative target for ransomware due to its vast, often undersecured attack surface and the imperative need for uninterrupted operations. Legacy medical devices, hindered by slow FDA approval processes and outdated systems, present significant vulnerabilities. Clarity's Team 82 found that 99% of over two million Internet of Medical Things (IOMT) and operational technology (OT) devices across 351 healthcare organizations are susceptible to known exploits[^1].

2. DOJ Seizes Over $8 Million from Romance Scams

The U.S. Department of Justice successfully seized over $8.2 million in USDT (Tether cryptocurrency) linked to romance baiting scams, also known as pig butchering. These scams manipulate victims into investing in fraudulent platforms promising high returns. Once substantial funds are deposited, victims are blocked from withdrawals and eventually realize the platforms are scams.

• Key Points:
  • The FBI traced laundering activities associated with these scams, facilitating legal forfeiture under wire fraud and money laundering statutes.
  • Tether froze and redirected the stolen funds to law enforcement-controlled wallets.
  • The operation is believed to be connected to human trafficking rings in Southeast Asia.
  • Authorities urge caution against investments promising guaranteed returns.

3. China-Linked APT Group Earth Alux Conducts Cyber Espionage

Trend Micro's research highlighted the activities of Earth Alux, a China-associated Advanced Persistent Threat (APT) group engaged in cyber espionage since mid-2023. Initially focusing on the Asia Pacific region, their operations have expanded to Latin America, targeting sectors like government, technology, telecommunications, and retail.

• Key Points:
  • Earth Alux exploits exposed servers by implanting web shells such as "Godzilla."
  • Their primary backdoor, "Vargheat," facilitates persistent access, data theft, and covert operations using multiple communication channels, including Microsoft Outlook via Graph API.
  • A novel technique involves injecting malicious code into MSPaint EXE processes, enabling fileless attacks that utilize Windows APIs to evade detection while performing reconnaissance and data exfiltration.

4. Emergence of Crocodilus: A New Android Banking Trojan

A new Android banking trojan named Crocodilus has surfaced, exhibiting advanced capabilities for remote device takeover, keylogging, and credential theft. Primarily targeting users in Spain and Turkey, Crocodilus bypasses Android 13 security measures using a custom drone propeller and gains full device control through accessibility services.

• Key Features:
  • Connects to command and control servers silently in the background.
  • Utilizes overlays to steal login information and logs accessibility events to capture text inputs, including one-time passwords from Google Authenticator.
  • Employs social engineering tactics like fake wallet backup prompts to extract crypto keys.
  • Despite its association with actor "Cybra," evidence points to a new Turkish-speaking developer behind its creation.

5. North Korea's Lazarus Group Targets Crypto Job Seekers

North Korea's Lazarus Group has initiated a cyber campaign dubbed "Click Fake Interview," aiming at job seekers within the cryptocurrency industry. Attackers create fake interview websites using React.js to deceive victims into downloading malware during seemingly legitimate recruitment processes.

• Campaign Highlights:
  • Deployment of "Golang Ghost," a cross-platform backdoor enabling remote control, data theft, and credential exfiltration on Windows and macOS systems.
  • The campaign has shifted focus towards centralized finance platforms like Coinbase and Bybit, expanding its reach to non-technical roles with typically lower cybersecurity awareness.
  • Utilizes malware such as Frosty Ferret and scripts in VBS or Bash to establish persistence and evade detection.
  • This evolution underscores Lazarus Group's strategic pivot to support North Korea's financial and military objectives through crypto heists.

6. CISA Identifies New Malware Variant Resurge Targeting Ivanti Connect Secure Appliances

The Cybersecurity and Infrastructure Security Agency (CISA) has identified a new malware variant known as Resurge, targeting Ivanti Connect Secure appliances through an already patched vulnerability. This flaw has been exploited since December and was flagged in January, allowing attackers to infiltrate critical infrastructure by analyzing compromised systems.

• Resurge Capabilities:

  • Shares characteristics with "Spawn Chimera," such as reboot persistence.
  • Introduces new functionalities like web shell deployment, file manipulation, and integrity check tampering.
  • Can embed itself into Ivanti's boot disk and alter the core boot image.

• CISA's Recommendations:

  • Full factory resets of affected systems.
  • Comprehensive credential and password resets to mitigate the threat.

Exclusive Interview: Jake Braun on Space as Critical Infrastructure

Maria Vermazes engages in a profound conversation with Jake Braun, the former Principal Deputy National Cyber Director at the White House and Chairman of DEFCON Franklin. Braun discusses the imperative of designating space as critical infrastructure and the unique cybersecurity challenges associated with the space domain.

Key Discussion Points:

1. Designation of Space as Critical Infrastructure:

   • Braun emphasizes the necessity of involving the Cyber Office in discussions about space security:

     "[...] not having the Cyber Office involved in this conversation was a big missed opportunity." [13:54]

   • Official designation could lead to increased government funding, resources, and information-sharing initiatives, benefiting smaller companies in the space sector.

2. Understanding Cyber Threats in Space:

   • Braun highlights the underestimation of cyber threats in the space domain:

     "Absolutely not. They don't got it. And that's not their fault. Like no one does." [19:22]

   • He cites the Stuxnet attack as an example of how infrastructure not connected to the internet can still be vulnerable, drawing parallels to satellite systems.

3. Real-World Examples of Space Vulnerabilities:

   • Braun references a DEFCON report where hackers successfully executed a signal injection attack on VSAT satellite modems using software-defined radios:

     "[...] reverse engineer efforts to exploit VSAT satellite modems from Earth [...] first successful demonstration." [19:22]

   • This showcases the ease with which malicious actors, even with limited resources, can breach space-related systems.

4. Strategic Implications:

   • Discusses the potential for nation-state actors like China or Russia to target satellite infrastructure, especially in the context of geopolitical tensions such as the anticipated conflict over Taiwan in 2027.

5. Recommendations for Space Companies:

   • Braun advises space companies, regardless of size, to:

     • Join collaborative information-sharing groups like the Space ISAC.
     • Hire Chief Information Security Officers (CISOs) to bolster cybersecurity defenses.
     • Invest in workforce development through training and certifications to enhance internal security capabilities.

   • He underscores the correlation between cybersecurity breaches and significant financial investments, noting that companies receiving substantial funding are prime targets for intellectual property theft.

"If somebody can do it on a shoestring budget, imagine what China, Russia, Iran or some other bad actor could do when they have millions or billions of dollars to throw in it." [19:22]

Conclusion and Recommendations

The episode underscores the escalating complexity and frequency of cyber threats across various sectors, particularly in healthcare and the burgeoning space industry. With nation-state actors and sophisticated criminal organizations continually evolving their tactics, the importance of robust cybersecurity measures, transparency in incident reporting, and collaborative defense mechanisms cannot be overstated.

Key Takeaways:

• Healthcare Sector Vulnerabilities: Legacy systems and medical devices present significant security risks, necessitating urgent remediation efforts.
• Law Enforcement Successes: Effective tracking and seizure of illicit funds demonstrate the potential of coordinated law enforcement actions.
• Emerging Threats: New malware variants and advanced persistent threats require constant vigilance and adaptive cybersecurity strategies.
• Strategic Infrastructure Protection: Recognizing space as critical infrastructure is pivotal for preempting future cyber conflicts in the domain.

For comprehensive insights and continuous updates on cybersecurity developments, tuning into CyberWire Daily remains essential.

[^1]: Clarity's Team 82 Analysis Report, March 2025.