Redacted realities: Inside the MoJ hack. - CyberWire Daily

Summary

CyberWire Daily: Redacted Realities – Inside the MoJ Hack (Released May 19, 2025)

Host: N2K Networks

In this episode of CyberWire Daily, hosted by N2K Networks, listeners are presented with an in-depth analysis of the recent cybersecurity incidents, followed by an insightful interview with Ian Tien, CEO of Mattermost. The episode delves into significant breaches affecting major organizations, highlights emerging threats, and explores the crucial role of collaboration in enhancing cybersecurity defenses.

1. UK Ministry of Justice Suffers Major Data Breach

The episode opens with a critical report on a substantial breach at the United Kingdom’s Ministry of Justice (MoJ). In April 2025, hackers infiltrated the Ministry’s systems, specifically targeting the Legal Aid Agency (LAA). The attackers successfully exfiltrated a wealth of sensitive personal data, including names, addresses, birth dates, national insurance numbers, criminal records, and financial details of Legal Aid applicants dating back to 2010.

Scale of the Breach: While the attackers claim to have accessed 2.1 million records, this figure remains unconfirmed. The breach was initially discovered on April 23 but its enormity only became apparent on May 16, leading to the LAA’s digital services being taken offline.
Attribution & Motive: Officials attribute the breach to longstanding vulnerabilities and mismanagement within the Ministry’s cybersecurity infrastructure. This incident follows a spate of cyberattacks on high-profile UK firms such as Ms. Coop and Dior, signaling potential systemic digital security weaknesses across the nation.
Hacker Group Involvement: BBC cybersecurity journalist Joe Tidey received a tip on Telegram from hackers claiming responsibility. These individuals, likely associated with the ransomware group Dragonforce, expressed frustration over Co-op’s refusal to pay the ransom, which they believe led to the public acknowledgment of the breach by Co-op.
Group Dynamics: Dragonforce, operating on a ransomware-as-a-service model, has recently rebranded as a cartel and has been active since 2023. Although linked to numerous attacks, its exact role in the recent MoJ breach remains unclear, with some experts suggesting involvement from other groups like the Spider Collective.

2. Mozilla Patches Critical JavaScript Engine Flaws in Firefox

In response to urgent security threats, Mozilla has rolled out an emergency update for Firefox to address two critical vulnerabilities within its JavaScript engine. Discovered by researchers from Palo Alto Networks and Trend Micro's Zero Day initiative, these flaws pertain to out-of-bounds read and write issues in JavaScript objects, which could allow remote code execution.

Exploitation Method: Attackers can exploit these vulnerabilities by directing users to malicious websites that require minimal interaction, thereby gaining potential control over affected systems.
Mozilla’s Response: The company has strongly urged all Firefox users to apply the updates immediately to safeguard against possible system compromises.

3. Georgia-Based Harbin Clinic Experiences Data Breach Affecting Over 200,000 Patients

A significant breach at Harbin Clinic, a healthcare provider in Georgia, has compromised the sensitive data of over 210,000 patients. The breach, linked to third-party vendors and managed by National Recovery Services (NRS), occurred in July 2024 but was only disclosed in May 2025.

Exposed Information: The compromised data includes names, addresses, Social Security numbers, birth dates, and financial account details, raising substantial concerns over identity theft and financial fraud.
Organizational Impact: Harbin Clinic, which operates multiple locations and employs over 1,400 staff, faces criticism for the delayed notification of affected individuals and the absence of credit monitoring services.

4. ServiceAid Data Leak Impacts Over 400 Catholic Health Patients

ServiceAid, a California-based enterprise solutions provider, reported an accidental exposure of an Elasticsearch database containing data of over 400 Catholic health patients. The exposure occurred between September 19 and November 5, 2024.

Data at Risk: The exposed information encompasses names, Social Security numbers, medical and insurance details, and login credentials. Although there is no evidence of data theft, ServiceAid cannot entirely dismiss the possibility.
Response Measures: Affected individuals are being offered 12 months of free identity protection services as a precautionary measure.

5. Researchers Highlight Increased Malicious Targeting of iOS Devices

A new report from Ximperium reveals a troubling rise in attacks targeting iOS devices, traditionally considered secure. Cybercriminals are leveraging tools like Trollstore and C Shell, alongside vulnerabilities such as Mac, Dirty Cow, and KFD, to bypass Apple’s security protocols.

Malicious Activities: Sideloaded and unvetted apps, appearing benign, can clandestinely exfiltrate data or compromise devices without detection.
Ximperium’s Findings: The research identified over 40,000 apps utilizing private entitlements and more than 800 apps accessing private APIs, posing significant threats to users and organizations, especially those in regulated sectors.
Defense Recommendations: Organizations are urged to implement stricter app vetting processes, monitor permissions diligently, and actively detect and mitigate sideloaded app threats.

6. ProColor Printer Malware Incident Uncovered

YouTuber Cameron Coward surfaced alarming news while reviewing a high-end ProColor inkjet printer priced at $6,000. During his review, his antivirus software detected malware on the included USB device, specifically a worm and a file infector named Floxif.

Manufacturer’s Response: ProColor initially dismissed these detections as false positives. However, further investigation by cybersecurity firm GData revealed the presence of malware, including a backdoor and a crypto-stealing Trojan dubbed Snipvex, in official ProColor software downloads.
Financial Impact: GData traced approximately $100,000 in stolen Bitcoin linked to the Snipvex Trojan.
Remediation Steps: ProColor has since acknowledged the possibility of malware introduction via USB devices and has cleaned up its software downloads. Experts recommend users to perform thorough system scans and consider full reinstallation if infection is detected.

7. Pupkin Stealer Targets Windows Systems

The newly identified malware, Pupkin Stealer, is an information-stealing tool written in C, first observed in April 2025. Despite its lightweight nature and lack of advanced evasion techniques, Pupkin Stealer effectively targets Windows systems to harvest:

Stolen Data: Browser credentials, messaging app sessions (e.g., Telegram), Discord desktop files, and screenshots.
Exfiltration Method: Utilizes Telegram’s bot API to blend stolen data within legitimate traffic, enabling stealthy transfers.
Operational Strategy: The malware compresses stolen data into a zip archive enriched with system metadata, operating without persistence mechanisms, indicative of a “quick hit and run” approach.
Distribution & Origin: Likely distributed via malware-as-a-service platforms, with potential ties to a developer known as Ardent, possibly of Russian origin. The malware underscores a trend of cybercriminals exploiting legitimate services like Telegram for clandestine operations, posing significant risks to e-commerce and individual users.

8. Alabama Man Sentenced for SIM Swap Attack on SEC’s Twitter Account

Eric Council Jr., a 25-year-old from Alabama, received a 14-month prison sentence for orchestrating a SIM swap attack that compromised the SEC’s X Twitter account.

Modus Operandi: In January 2024, Council utilized a fake ID to obtain a replacement SIM card linked to a government phone associated with the SEC account. He activated the card, retrieved a password reset code, and passed it to a co-conspirator.
Impact of the Attack: The hacker posted a fraudulent statement claiming SEC approval of Bitcoin ETFs, which temporarily spiked Bitcoin prices by over $1,000 before causing a $2,000 drop when the misinformation was debunked.
Legal Consequences: Council was compensated $50,000 for his involvement, to be forfeited. Additionally, he pleaded guilty to charges of identity theft and fraud and will undergo supervised release for three years post-incarceration, with imposed Internet restrictions.

9. Interview with Ian Tien, CEO of Mattermost: Enhancing Cybersecurity through Effective Collaboration

A significant portion of the episode features an interview with Ian Tien, CEO of Mattermost, conducted at the RSAC 2025 conference. The discussion centers around the pivotal role of collaboration in strengthening cybersecurity, especially within critical infrastructure sectors.

Key Insights from Ian Tien:

Importance of Collaboration: Tien emphasizes that effective communication is essential during mission-critical situations such as power outages, cyber breaches, or system outages. “If something has to work, it's got to be built in a certain way where you can communicate even in sort of unforeseen circumstances,” he states ([15:17]).
Real-World Application: Using the example of interconnected systems, Tien highlights the risks of relying solely on SaaS providers. He references the CrowdStrike outage, which disrupted airlines and communication systems, underscoring the necessity for mission-critical systems to have separate, resilient architectures ([15:48]).
Recent Events Reflection: Discussing the major power outage in Spain and Portugal, Tien notes the cascading effects on telecommunications and transportation. He states, “If your primary system is running on the electric grid that has the outage, you can’t communicate effectively,” underscoring the need for emergency contingency systems ([17:09]).
Common Misconceptions: Tien identifies a prevalent blind spot where organizations reactively use insecure communication channels during emergencies, leading to data leaks and compliance issues. “You’ve gone outside the main system for security, but now you’ve got all this information floating around on people's devices,” he explains ([18:04]).
Role of Open Source Software: Highlighting the flexibility and resilience of open-source solutions, Tien advocates for their use in critical infrastructure. “Mattermost being open source and being in control, having our customers in control,” he remarks, emphasizing the importance of transparency and adaptability in security protocols ([20:23]).
Recommendations for Organizations: Tien advises organizations to engage in tabletop exercises and leverage Mattermost’s open-source platform to build and maintain secure, resilient communication systems. He encourages adopting reference architectures and maintaining full visibility and control over their communication tools ([21:48]).
Final Thoughts: Tien concludes by reflecting on the shift towards digital sovereignty, asserting that while interdependence on SaaS services persists, organizations must retain elements of control over their critical systems to ensure security and operational integrity ([22:38]).

10. Pwn to Own Berlin 2025: Ethical Hackers Take Center Stage

Concluding the episode, the host reports on the Pwn to Own Berlin 2025 competition, a premier event celebrating the prowess of ethical hackers. Hosted by Trend Micro's Zero Day initiative, the event awarded over $1 million to researchers who uncovered 28 zero-day vulnerabilities across various technologies.

Notable Achievements:
- STAR Labs SG secured the largest single payout with a $320,000 reward for the first-ever VMware ESXi hack.
- AI Platforms: A novel inclusion in the competition, AI systems earned $140,000 for exposing vulnerabilities in tools like Nvidia's Triton inference server.
- Mozilla's Prompt Response: Mozilla swiftly addressed $50,000 worth of Firefox vulnerabilities by issuing patches on the same day.
Significance: The event underscored the indispensable role of ethical hacking in identifying and mitigating security flaws, fostering a proactive security culture in the digital realm.

Conclusion

This episode of CyberWire Daily provides a comprehensive overview of recent cybersecurity incidents affecting major institutions, highlights emerging threats and vulnerabilities, and underscores the importance of collaboration and ethical hacking in safeguarding digital infrastructures. Through detailed reporting and expert insights from Ian Tien, listeners gain a nuanced understanding of the evolving cybersecurity landscape and the strategies essential for resilience and protection.

Notable Quotes from the Episode:

Ian Tien on Collaboration: “If something has to work, it's got to be built in a certain way where you can communicate even in sort of unforeseen circumstances.” ([15:17])
On Open Source Importance: “Mattermost being open source and being in control, having our customers in control, they can see all our source code.” ([20:23])
On Strategic Foresight: “Until you're in an emergency, like very often you can't foresee it.” ([18:04])
On Digital Sovereignty: “The world is realizing that the cloud is a social construct created to trust operations and data to someone else's infrastructure.” ([22:38])

For more detailed insights and daily cybersecurity news, visit thecyberwire.com or subscribe to the CyberWire Daily podcast.

Transcript

Dave Bittner (0:02)

You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire the UK's Ministry of Justice suffers a major breach. Mozilla patches two critical JavaScript engine flaws in Firefox. Over 200,000 patients of a Georgia based health clinic see their sensitive data exposed. Researchers track increased malicious targeting of iOS devices. A popular printer brand serves up malware. Pupkin stealer targets Windows systems.

Sponsor (1:31)

An Alabama man gets 14 months in.

Dave Bittner (1:34)

Prison for a SIM swap attack on the sec. Our guest is Ian Tien, CEO at Mattermost, sharing insights on enhancing cybersecurity through effective collaboration and ethical Hackers win the day at PWN to own Berlin Foreign May 19, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us. Happy Monday. It is great to have you with us as always. In the uk, hackers breached the Ministry of Justice's systems in April, stealing a significant amount of personal data from the Legal Aid agency. The stolen data may include names, addresses, birth dates, national insurance numbers, criminal records and financial details of Legal aid applicants since 2010. While the attackers claim to have accessed 2.1 million records, this figure is unconfirmed. The breach was discovered on April 23, but its scale became clear on May 16. The LAA's digital services were taken offline. Officials blame long standing vulnerabilities and mismanagement. The Ministry of Justice, working with national cybersecurity bodies, urges past applicants to stay vigilant for fraud. The breach follows a wave of recent cyberattacks on UK firms like ms.co op and Dior, raising concerns about systemic digital security failures. Meanwhile, BBC cybersecurity journalist Joe Tidey received a tip on telegram from hackers claiming responsibility for the cyber attacks on MNS and Co Op. Over a five hour exchange, they provided data samples confirming their involvement. The hackers, likely linked to the ransomware group Dragonforce, were frustrated that Co Op refused to pay the ransom after Tidy alerted Co Op the company acknowledged the breach publicly. Dragon Force operates a ransomware as a service model, offering tools and support to cybercriminals in exchange for a cut of ransoms. Recently rebranded as a cartel, the group has been active since 2023. Though linked to numerous attacks, it remained silent on the retail hacks, possibly due to ransom payments. Some experts suggest the broader scattered spider collective may be behind the campaign, but their exact role remains unclear. Mozilla has issued an emergency security update for Firefox to patch two critical JavaScript engine flaws that allow remote code execution. Discovered by security researchers from Palo Alto Networks and Trend Micro's Zero Day initiative, the vulnerabilities involve out of bounds read Write issues in JavaScript objects. Attackers can exploit them by luring users to malicious websites requiring minimal interaction. Mozilla urges users to update Firefox immediately to protect against potential system compromise. Over 210,000 patients of Georgia based Harbin Clinic had sensitive data exposed in a breach linked to third party vendors and national recovery services. The breach, which occurred In July of 2024, targeted NRS, a debt collection service provider for Harbin. However, Harbin only began notifying affected individuals in May of this year. Nearly 10 months later, exposed data includes names, addresses, Social Security numbers, birth dates and financial account details. The delay and the severity of the stolen information raise concerns about identity theft and financial fraud risks. Harbin recommends affected individuals monitor their financial accounts but has not confirmed offering credit monitoring services. The clinic, headquartered in Rome, Georgia, runs multiple locations statewide and employs over 1400 staff elsewhere. ServiceAid, a California based enterprise solutions provider, reported a data leak affecting over 400 Catholic health patients to the Department of Health and Human Services. The breach involved an Elasticsearch database that was accidentally exposed online from September 19 through November 5, 2024. While there's no evidence the data was stolen, ServiceAid can't rule it out. Exposed information includes names, Social Security numbers, medical and insurance details and login credentials. Affected individuals are being offered 12 months of free identity protection services. A new report from Ximperium warns that iOS devices, often seen as secure, are increasingly targeted through sideloaded and unvetted apps. Attackers exploit flaws in iOS using tools like Trollstore, C Shell and vulnerabilities such as Mac, Dirty Cow and KFD to bypass Apple's protections. These apps may appear benign but can exfiltrate data or compromise devices without detection. Ximperium found over 40,000 apps using private entitlements and over 800 using private APIs, posing serious risks. Organizations, especially in regulated sectors, should adopt stricter app vetting, monitor permissions and detect sideloaded apps. Zimperium urges proactive defenses to counter these threats. Just because an app runs on iOS doesn't mean it's safe. Its behavior and origin matter more than its appearance. If you've bought a UV inkjet printer from the brand procolored recently, you might want to scan your system for malware. YouTuber Cameron Coward, known for his DIY tech reviews, first raised the alarm while reviewing a $6,000 printer. His antivirus flagged threats on the included USB device, specifically a worm, and Floxif, a file infector. When procolord dismissed this as a false positive, Coward turned to Reddit, catching the attention of cybersecurity firm GData. Their investigation found malware including a backdoor and a crypto stealing Trojan called Snipvex, in official Pro colored software downloads. GData traced around $100,000 in stolen Bitcoin linked to Snipvex. ProColor later admitted malware might have been introduced via USB and has since cleaned up its downloads. Experts now urge users to scan their systems and consider full reinstallation if infected. Pupkin Stealer is a newly discovered information stealing malware written in C and first observed in April of this year. Lightweight and lacking advanced evasion tactics, it targets Windows systems to steal browser credentials, messaging app sessions like Telegram, and Discord desktop files and screenshots. The malware exfiltrates data using Telegram's bot API, allowing it to hide within legitimate traffic. Despite its simplicity, pupkinstealer is effective, compressing stolen data into a zip archive enriched with system metadata. It operates without persistence mechanisms, suggesting a quick hit and run strategy. Researchers believe it may be distributed via malware as a service and linked to a developer using the alias Ardent, possibly of Russian origin, The malware highlights a growing trend of cybercriminals exploiting legitimate services like Telegram or for stealthy attacks posing risks to e commerce and individual users alike. Eric Council Jr. A 25 year old from Alabama, has been sentenced to 14 months in prison for a SIM swap attack that compromised the SEC's X Twitter account. In January of 2024, Mr. Counsel used a fake ID to obtain a replacement SIM card tied to a government phone linked to the SEC account. He then activated the card, retrieved a password reset code and passed it to a co conspirator. The hacker posted a false statement claiming SEC approval of Bitcoin ETFs, briefly spiking Bitcoin prices by over $1,000 before a $2,000 drop when the post was debunked. Counsel, who was paid $50,000 for his role, pleaded guilty to identity theft and fraud. He must also forfeit the payment and will be on supervised release for three years post prison with Internet restrictions. Coming up after the break, my conversation with Ian Tien, CEO at Mattermost, sharing insights on enhancing cybersecurity through effective collaboration and ethical hackers Win the day at PWN to own BERLIN Stay with U.S.