Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a brief message from our sponsor, DropZone AI. Is your SoC drowning in alerts with legitimate threats sitting in queues for hours or even days? The latest SANS SOC survey report reveals alert fatigue and limited automation are SOC Team's greatest barriers. Drop Zone AI, recognized by Gartner as a cool vendor, directly addresses these challenges through autonomous recursive reasoning investigations, quickly eliminating false positives, enriching context and enabling analysts to prioritize real incidents faster. Take control of your alerts and investigations with Dropzone AI Money laundering runs rampant in Cambodia Privacy advocates question a new data sharing EO from the White House. An NYU website hack exposes the data of millions. A game demo gets pulled from Steam after users report info stealing malware. The Cloak ransomware group claims a cyber attack on the Virginia Attorney General's office. 23andMe files for chapter 11 Medusa ransomware is using a malicious driver to disable security tools. Clearview AI settles a class action lawsuit over privacy violations A look back at the CVE program On today's Industry Voices segment, we're joined by Joe Ryan, head of Customer enablement at Maltego Technologies, who's highlighting how to help analysts in resource constrained environments overcome training gaps and use investigative tools more effectively and luring AI bots into the digital labyrinth. It's Monday, March 24th, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Happy Monday and thank you for joining us here. It is great as always to have you with us. Scammers in Cambodia celebrate their biggest online frauds with fireworks. Often after stealing victims life savings through romance scams or fake crypto platforms. According to the New York Times, these scams fuel a massive, fast moving money laundering network involving billions of dollars. Authorities like the FBI and Interpol have tried to intervene, but the system is resilient and global. At the center is Huon Group, a Cambodian financial conglomerate with legitimate businesses and illicit arms. One Huon affiliate runs a telegram based marketplace linking scammers with money launderers, a hub responsible for at least $26.8 billion in crypto transactions. Another affiliate who own international pay operates like a professional bank, managing funds and coordinating with scammers. The operation uses matchmakers, money mules and sophisticated infrastructure. Some workers are trafficked victims forced into scams. The proceeds fund luxury lifestyles and further criminal services from fake investment sites to stolen personal data. And yes, part of the take pays for fireworks. To celebrate another payday, a new executive order from President Trump expands data sharing between federal and state agencies, sparking concerns from privacy advocates. The order requires federal agencies to eliminate rules that limit the sharing of unclassified data and mandates access to data from all state programs receiving federal funds, even when stored with third parties. Experts warn the move is designed to normalize the controversial practices of the Department of Government Efficiency Doge, which has been accused of overreach and violating privacy laws. Critics fear the order enables a centralized federal surveillance system and bypasses legal safeguards like the system of records notices. Doge has faced lawsuits for unauthorized data sharing, including a recent court order halting its access to Social Security data. Experts warn the move is designed to normalize the controversial practices of the Department of Government Efficiency Doge, which has been accused of overreach and violating privacy laws. Critics fear the order enables a centralized federal surveillance system and bypasses legal safeguards like system of records notices. Doge has faced lawsuits for unauthorized data sharing, including a recent court order halting its access to Social Security data. Experts argue the EO could weaponize personal data and erode civil liberties under the guise of efficiency and fraud prevention. The White House has not commented. A hacker breached NYU's website Saturday morning, exposing personal data from over 3 million applicants dating back to 1989. The leak included names, test scores, intended majors, zip codes, financial aid information and details on family members. The site, hijacked for at least two hours, displayed charts claiming racial disparities in NYU admissions, alleging lower average scores for black and Hispanic students compared to white and Asian applicants despite The Supreme Court's 2023 ban on affirmative action. Four downloadable files revealed common application data, including rejected applicants and sibling information. NYU restored the site by noon and reported the breach to law enforcement. The group behind the hack is tied to a 2023 University of Minnesota breach involving 7 million Social Security numbers. NYU, which opposed the affirmative action ruling, had seen a decline in minority admissions following the decision. Valve has removed the game Sniper Phantom's resolution from Steam after users reported it contained info stealing malware. Though billed as a demo, the installer directed players to download from an external GitHub repository. Reddit users found the file included tools for privilege escalation, cookie theft and persistence via startup scripts. The developers GitHub and website were taken down and Valve acted following reports. Users who installed the game are urged to scan their systems. This follows a similar Steam malware case last month. The ransomware group Cloak has claimed responsibility for a cyber attack that disrupted nearly all systems at the Virginia attorney general's office in February employees were forced to revert to paper filings as internal services VPN and the website went offline. On March 20, Cloak posted alleged stolen AGO data on its leak site, indicating a failed extortion. Active since 2022. Cloak uses Ark cryptor ransomware and often targets small to mid sized businesses, with this being its first confirmed US attack this year. Genetic testing company 23andMe filed for Chapter 11 bankruptcy amid growing concerns over its handling of sensitive customer data. The company, which holds genetic profiles of over 15 million users, suffered a major breach in 2023 that exposed personal information from nearly 7 million accounts, mainly targeting Jewish and Chinese customers. A class action lawsuit followed, accusing 23andMe of failing to notify affected users. As trust eroded, sales declined, contributing to mounting losses. The company says it will maintain current data protections during its sale process. Medusa Ransomware is using a malicious driver to disable security tools on infected systems, according to Elastic Security Labs. Masquerading as a legitimate crowdstrike driver, it's signed with a revoked certificate from a Chinese company and protected by VMprotect Elastic, which calls it Abyss. Worker found samples dating from August 2024 through February of this year, mainly using stolen certificates. The driver, previously used in other malware campaigns, can manipulate processes, files and system operations to disable defenses, often by spoofing system time to bypass signature checks. Clearview AI has settled a class action lawsuit over privacy violations for an estimated $50 million. Approved by a federal judge, the deal gives plaintiffs and their lawyers a stake in the company's future value rather than a direct payout. The lawsuit accused Clearview of scraping billions of facial images from the Web without consent, violating Illinois's Biometric Privacy Act. Clearview denies wrongdoing critics, including 22 state attorneys general, argue the settlement doesn't do enough to prevent future misuse of biometric data. There's no small irony here attaching the plaintiff's benefits to the success of Clearview. A thoughtful piece by Cynthia Brumfield for CyberScoop looks at the CVE, the Common Vulnerabilities and Exposures program. Launched in 1999 by MITRE researchers, it's become a cornerstone in global cybersecurity, enabling consistent tracking and sharing of vulnerability data. Now in its fifth iteration, it includes over 413 reporting organizations across more than 40 countries and had over 270,000 records by 2024. Despite challenges like disputes over data quality, concerns about vendors potentially hiding vulnerabilities and funding issues at nist, the system remains resilient. Experts argue its Federated structure, dispute resolution mechanisms and community oversight help maintain transparency. The rise in CVEs, while sometimes criticized, reflects better visibility and reporting, not necessarily increased risk. Recent funding shortfalls under the Trump administration's DOGE initiative tested the system's durability, but Mitre and others stepped up. Despite imperfections, cybersecurity leaders agree the CVE system remains essential. It's a long standing public private partnership that continues to evolve, and a future without it would leave defenders far less equipped to handle digital threats. Coming up after the break, my conversation with Joe Ryan, head of Customer Enablement at Multi Tigo Technologies. We're talking about how to help analysts in resource constrained environments overcome training gaps and luring AI bots into the digital labyrinth. Stay with us. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off.