Transcript
A (0:02)
You're listening to the Cyberwire network. Powered by N2K.
B (0:14)
The DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot. Think your certificate security is covered by March 2026 TLS certificate lifespans will be cut in half, meaning double today' renewals. And in 2029, certificates will expire every 47 days, demanding between 8 and 12 times the renewal volume. That's exponential complexity, operational workload and risk. Unless you modernize your strategy, Cyberark Proven in Identity Security is your partner in certificate security. Cyberark simplifies lifecycle management with visibility, automation and control at scale. Master the 47 day shift with CyberArk Scan for vulnerabilities, streamline operations, scale Security visit cyberark.com 47day that's cyberark.com the numbers 47 day Land Rover suffers a major cyber attack ICE gains access to a powerful spyware tool Researchers find fancy bears snuffling around a new Outlook back door Cloudflare and Palo Alto networks confirm compromised Salesforce data A researcher discovers an unsecured Navy Federal Credit Union server A new click fix scam spreads Metastealer malware Specialty healthcare providers struggle to protect sensitive patient data CISA appoints a new Executive Assistant Director for cybersecurity on afternoon cybertea Ann Johnson and Harvard's Amy Edmondson discuss how psychological safety helps cybersecurity teams speak up, spot risks and learn from failure Our guest today is Tim Starks from cyberscoop discussing China's reliance on domestic firms for hacking and hackers threaten to feed stolen art to The Machines Foreign September 3, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Jaguar land Rover, the UK's leading luxury automaker, has confirmed a major cyber attack that forced the shutdown of its global IT systems. The incident has halted production lines in the UK and abroad, disrupted supply chains and temporarily closed some retail outlets and online services. While JLR says there's no evidence of customer data theft or operations have been severely impacted, the attack comes amid financial strain. Jaguar Land Rover recently reported a 49% drop in pre tax profits, delayed its new electric models to 2026, and announced 500 UK job cuts. This is the second breach in a year following a March 2025 ransomware attack linked to the Hellcat group. Jaguar Land Rover joins other UK companies like Marks and Spencer and Harrods, recently hit by cybercriminals. U.S. immigration and Customs Enforcement will gain access to Paragon Solutions spyware tool Graphite after the Trump administration lifted a hold on a $2 million contract first signed under President Biden. Graphite allegedly can hack any phone, including encrypted apps like WhatsApp and Signal, and even turn devices into listening tools. Civil rights advocates warn the move hands invasive surveillance powers to an agency already accused of due process violations. While Paragon claims it only works with democracies and cuts ties with abusive clients, its spyware has previously been misused in Italy against journalists and activists. Experts argue such tools pose security risks as multiple governments share access to the same tech. Critics say this raises threats to privacy, free speech and democratic accountability. Researchers at Spanish cybersecurity firm Estou Grupo have discovered a new Outlook backdoor dubbed Notdoor, linked to Russia backed APT28, also known as Fancy Bear. The malware uses Visual Basic for applications macros in Microsoft Outlook to monitor incoming emails for trigger words, then exfiltrate data, upload files or execute commands. NotDoor hides in Outlook's event driven processes, abuses DLL sideloading with OneDrive and disables security warnings to maintain persistence. It communicates via attacker controlled email accounts and covert callbacks, deleting traces after exfiltration. Its modular design allows dynamic updates, making detection difficult. APT28, tied to Russia's GRU, has a long record of high profile Cyberattacks, including the 2016 US election breaches. Researchers at Lab52 warn. Nottor reflects the group's evolving tactics and recommends disabling macros and monitoring Outlook activity. Cloudflare and Palo Alto Networks have confirmed that threat actors access their Salesforce data via a compromised Salesloft drift app. Cloudflare said attackers exfiltrated Salesforce case data, including customer contact details and support ticket text, between August 12th and 17th of this year. While no attachments were stolen. Sensitive information like scanning Sensitive information like keys or logs pasted into tickets may be compromised. Palo Alto reported exposure of sales and case data. Hundreds of organizations are affected, with experts warning attackers may leverage stolen data for targeted campaigns. Researcher Jeremiah Fowler discovered an unsecured Navy federal credit Union server exposing 378 gigabytes of internal files while no member data was found. The trove included usernames, emails, possibly hashed passwords and tableau workbooks with database connections and financial formulas. Fowler warned this information could give attackers a blueprint of Navy Federal's systems, enabling phishing or deeper breaches. The database was quickly secured after disclosure, but it's unclear how long it was exposed. Researchers at Huntress have uncovered a new ClickFix scam that spreads metastealer malware using a fake AnyDesk installer. Traditionally, ClickFix tricks users into copying malicious commands into Windows Run, but this campaign adds a twist called FileFix, which abuses Windows File Explorer searches. Victims searching for anydesk may land on a fake site with a counterfeit Cloudflare verification prompt. Clicking Verify triggers File Explorer to fetch a disguised file named readme anydesk PDF while it installs the real Anydesk. To avoid suspicion, it also secretly loads metastealer, which can steal credentials, files and crypto wallet data. The scam blends legitimate software behavior with social engineering, making it harder to detect. Experts stress user awareness and caution while downloading tools online. Specialty health care providers, while skilled in treating patients, often lack strong cybersecurity defenses, making them prime targets for ransomware and data theft. Three recent breaches illustrate the risks. Excelsior Orthopedics in New York disclosed nearly 395,000 patients and employees were impacted by a 2024 ransomware attack. Florida based Vital Imaging reported 260,000 individuals affected by a February 2025 hack, and the University of Iowa Community Home Care breach exposed data for 211,000 people. Together, nearly 900,000 individuals were impacted. Experts warn that specialty practices with limited budgets and sometimes outdated systems struggle to protect sensitive data like medical histories and insurance details. Cybercriminals exploit these weaknesses for fraud and extortion, often pressuring providers to pay ransoms quickly to avoid care disruptions. Researchers at Cipherma have detailed a new Python based malware called InfoSec, with a 0 for the O and a 3 for the E because, of course, it does. It's an advanced infostealer capable of harvesting a wide range of sensitive data distributed as a compressed 64 bit executable packed with PI installer, it evades detection through obfuscation, runtime code, unpacking, VM checks and self deletion. Its main component collects system info, IP data, credentials, cookies, WI fi passwords, browsing history, crypto wallets, and even webcam images. It also targets popular gaming accounts like Roblox, Steam and Minecraft. Stolen data is archived into a password protected RAR file and exfiltrated via discord persistence is achieved by copying itself to the Windows Startup folder. Cipherma noted similarities to grabbers like Blank Grabber and Umbral Stealer, suggesting shared origins. The findings highlight how easily criminals can access sophisticated automated info stealing tools. CISA has appointed Nicholas Anderson as Executive Assistant Director for Cybersecurity. A decorated Marine veteran and national security leader, Anderson brings extensive experience from both government and private sectors. He previously served as CISO at Lumen Technologies, COO at Invictus, and Senior Official at the Department of Energy, where he directed cyber and energy security efforts. Recognized as Intelligence Executive of the Year, Anderson has overseen initiatives defending against state sponsored threats and major crises. At cisa, he'll lead efforts to protect critical infrastructure amid escalating cyber risks. His arrival marks a leadership transition with Chris Butera becoming acting Deputy Executive Assistant Director. Anderson's appointment underscores CISA's push to strengthen resilience and deepen collaboration with industry partners. Coming up after the break, Ann Johnson and Harvard's Amy Edmondson discuss how psychological safety helps cybersecurity teams speak up, spot risks and learn from failure. Tim Starks from cyberscoop discusses China's reliance on domestic firms for hacking and hackers threaten to feed stolen art to the machines. Stay with us. At talas, they know cybersecurity can be tough and you can't be protect everything. But with Thales you can secure what matters most. With Thales industry leading platforms you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales. T H A L E S learn more@thalesgroup.com cyber and now a word from our sponsor, ThreatLocker, the powerful Zero Trust Enterprise solution that stops ransomware in its tracks. Allowlisting is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy ensuring apps can only access the files, registry keys, network resources and other applications they truly need to function. Shut out cybercriminals with world class endpoint protection from threat locker and it's always my pleasure to welcome Tim Starks back to the show. He is a senior reporter at cyberscoop. Tim, good to talk to you here my friend.