CyberWire Daily Summary

Title: CyberWire Daily
Host: N2K Networks (Dave Bittner)
Episode: Scrutinizing the Security of Messaging Apps Continues
Release Date: May 9, 2025

1. Cybersecurity News Brief

1.1. CBP’s Messaging App Under Scrutiny
The U.S. Customs and Border Protection (CBP) confirmed its use of a messaging app from Telemessage, a service that clones popular platforms like Signal and WhatsApp with added archiving features for compliance. However, following a detected cyber incident, CBP disabled the app.

• Incident Details: Telemessage, now owned by US-based Smarsh, paused all services amid investigations into multiple security breaches and flaws in its Android app's source code.
• Notable Quote:
  • Dave Bittner (00:02): "The CyberWire messages app used by CBP and the White House faces continued security scrutiny."

1.2. Hacktivist Breach of Global X Airlines
Hacktivists claiming ties to Anonymous breached Global X Airlines, a US Government contractor involved in deportation flights. They stole flight records, passenger lists, and itinerary data, and defaced the airline's website with a political message.

• Methodology: Exploited a developer token to access AWS cloud, retrieved access keys, and infiltrated flight operations tools and GitHub repositories.
• Impact: Highlighted significant security lapses; no official comments from GlobalX or US immigration officials yet.

1.3. FBI Warns on Outdated Routers
The FBI issued warnings about threat actors exploiting outdated, unsupported routers from brands like Cisco's Linksys and Ericsson's Cradlepoint.

• Exploit Mechanism: Hackers use unpatched vulnerabilities and remote management software to gain shell access, install malware, and incorporate devices into botnets.
• Security Advice: Replace old routers or disable remote access to prevent such exploits.

1.4. Pearson’s Cyber Attack
UK-based education giant Pearson confirmed a cyber attack where threat actors stole corporate and consumer data by exploiting an exposed GitLab personal access token in a public git config file.

• Data Compromised: Terabytes from AWS, Google Cloud, Salesforce, and Snowflake; no employee data was affected.
• Response: Pearson is continuing its investigation and emphasizes the importance of securing access tokens.

1.5. Exploitation of Windows Remote Management (WinRM)
Researchers at Practical Security Analytics reported increased exploitation of WinRM for stealthy lateral movements within Active Directory environments.

• Attack Techniques: Utilize WinRM commands to scan systems, authenticate remotely, and execute malicious payloads disguised as legitimate processes.
• Recommendations: Restrict WinRM access, monitor for anomalies, and enhance endpoint detection to prevent misuse.

1.6. Sophisticated Email Attack Campaign (RATI Trojan)
Fortinet researchers uncovered an email campaign using malicious PDF invoices to deliver the cross-platform Remote Access Trojan (RATI).

• Infection Process: Deceptive emails pass SPF validation, leading victims to click buttons in PDFs that initiate multi-stage infections via Dropbox, Mediafire, and ngrok tunneling.
• Capabilities of RATI: Execute commands, log keystrokes, and access webcams and files across Windows, Linux, and macOS systems.

1.7. Zero-Day Vulnerability in SAP NetWeaver
A critical zero-day in SAP NetWeaver allowed remote code execution, compromising hundreds of systems globally.

• Affected Industries: Energy, government, and others.
• Response: Immediate patching, thorough assessment of affected systems, and updated detection measures are urged by Anapsis and Mandiant.

1.8. Indiana Health System Data Breach
Union Health System reported a breach affecting nearly 263,000 individuals due to a January cyber attack on legacy Cerner systems during migration to Oracle's cloud.

• Data Compromised: Social Security numbers, medical records, and insurance details.
• Legal Ramifications: Lawsuits allege negligence; Oracle denies breaching its cloud infrastructure but acknowledges unauthorized access to outdated servers.

2. Interview with Alex Cox, Director of Information Security at LastPass

2.1. Tax-Related Cyber Lures Targeting Refunds
Alex Cox discusses the surge in cyber attacks during tax season, where attackers exploit the period's increased financial activities to target both individuals and larger entities like CPA firms and tax preparation agencies.

• Key Points:
  • Attackers increasingly target larger firms to access extensive data pools instead of focusing solely on individual taxpayers.
  • Notable Quote:
    • Alex Cox (15:37): "Instead of a bad guy attacking an individual taxpayer, which they still do, they may also go after a CPA firm or a tax preparation agency."

2.2. AI Empowering Phishing Attacks
AI technologies, such as ChatGPT, are being leveraged by threat actors to craft more convincing phishing messages, enhancing the believability and sophistication of their attacks.

• Impact: Improved language usage makes phishing attempts harder to detect using traditional technical means.
• Notable Quote:
  • Alex Cox (17:31): "What we see is these messages that... have gotten much, much better due to AI."

2.3. Best Practices for Security Professionals
Cox emphasizes the importance of vigilance and skepticism in verifying unexpected communications, especially those requesting sensitive information.

• Recommendations:
  • Cross-verify information from multiple sources before responding.
  • Use password managers to create and store unique, complex passwords for different sites.
• Notable Quote:
  • Alex Cox (19:08): "Being very suspicious of any single point of information that you just sort of suddenly get out of nowhere."

2.4. Role of Password Managers in Enhancing Security
Password managers like LastPass play a crucial role in mitigating risks by enabling users to generate unique passwords for each site, thereby limiting the impact of potential credential leaks.

• Benefits:
  • Reduces the risk of credential stuffing attacks.
  • Provides alerts for suspicious login attempts on unfamiliar sites.
• Notable Quote:
  • Alex Cox (20:26): "When you use a password manager and you're creating those individual complex passwords, if the bad guys get a hold of one of those, they just have access to one site."

3. Special Segment: Speaking from Beyond the Grave

A groundbreaking case in an Arizona courtroom featured an AI-generated avatar of a murder victim, Christopher Pelke, who was killed in a 2021 road rage incident.

• Details:

  • The avatar, created by Pelke's sister using AI and voice cloning, delivered a heartfelt message forgiving the shooter and suggesting they could have been friends.
  • Notable Quote:
    • Narrator (22:16): "The family said their goal was to bring Chris back, to humanize him. And it worked."

• Implications:

  • Raises ethical and legal questions about the use of AI in judicial proceedings.
  • Highlights the powerful emotional impact of AI-generated representations in real-world scenarios.

4. Upcoming Events and Closing Notes

• Webinar Announcement:

  • Topic: The State of Modern Web Application Security
  • Date & Time: Tuesday, May 13th at 12 PM Eastern Time
  • Panelists: Laura Enriquez and Michaelo Steppa from Outpost 24
  • Registration: events.thecyberwire.com

• Research Saturday Preview:

  • Topic: Atomic and Exodus Crypto Wallets Targeted in Malicious NPM Campaign
  • Guest: Lucia Valente from Reversing Labs
  • Note: Encourages listeners to check out additional research for deeper insights.

• Credits:

  • Senior Producer: Alice Carruth
  • CyberWire Producer: Liz Stokes
  • Mixer: Trey Hester
  • Music and Sound Design: Elliot Peltzman
  • Executive Producer: Jennifer Ibin
  • Publisher: Peter Kilpe
  • Host: Dave Bittner

Conclusion

This episode of CyberWire Daily provided a comprehensive overview of recent cybersecurity incidents, highlighted the evolving tactics of threat actors, and offered expert insights into best practices for enhancing organizational security. The discussion with Alex Cox underscored the critical role of password managers and the growing sophistication of AI-driven attacks, while the special segment raised important ethical considerations regarding AI in legal contexts.

For detailed information on each story and to stay updated with the latest cybersecurity trends, listeners are encouraged to visit thecyberwire.com and engage with upcoming webinars and research reports.