Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K and now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire the White House's shift of cybersecurity responsibilities to the states is met with skepticism. Baltimore city public schools suffer a ransomware attack. Russian state backed hackers target Dutch critical infrastructure. Microsoft resolves multiple remote desktop issues. A new malware campaign is targeting Docker environments for cryptojacking. A new phishing campaign uses weaponized Word documents to steal Windows login credentials. Zyzon Networks issues critical patches for two high severity vulnerabilities. CISA issues five advisories highlighting critical vulnerabilities in ICS systems. Our guest is Deputy Assistant Director Cynthia Kaiser from the FBI's Cyber Division, sharing the findings of their latest IC3 report and so long privacy sandbox.
Cynthia Kaiser (2:02)
Foreign.
Dave Bittner (2:08)
It's Wednesday, April 23, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thank you for joining us here today. It is great to have you with us. President Trump's recent executive order shifts cybersecurity responsibility from the federal government to states and localities. However, many states are unprepared for this transition. A 2023 National Cybersecurity Review revealed that only 22 of 48 participating states met recommended security standards. Compounding the issue, federal funding cuts have reduced resources for state and local officials, including a cybersecurity grant program and a key cybersecurity agency. This has left states grappling with increased cyber threats such as ransomware attacks and foreign interference, while facing shortages of IT experts and limited budgets. Recent cyber attacks in Rhode Island, Virginia and Massachusetts highlight the vulnerabilities in state systems. Experts warn that expecting states to manage cybersecurity independently without adequate support is unrealistic and could compromise national security. Just a quick program note. We discussed this issue on a recent episode of the Caveat podcast. Do check that out wherever you get your favorite podcasts. Baltimore City Public Schools suffered a ransomware attack on February 13th linked to the cloak gang. The breach exposed sensitive personal data of about 25,000 people, including Social Security numbers, student records and employment documents. Those affected include current and former staff, volunteers and over 1100 students. The school system confirmed no ransom was paid. Law enforcement and cybersecurity experts are investigating. Notification letters were sent April 22, with two years of free credit monitoring and a call center provided for support. Russian state backed hackers have targeted Dutch critical infrastructure in cyber sabotage attempts during 2023 and 2024, according to the Dutch Military Intelligence and Security Service. Though the attacks had minimal immediate impact, they mark the first known sabotage of Dutch control systems. The MIVID warns such operations are rising across Europe, aiming to gain digital access to critical systems for potential future disruption. The Netherlands, home to Europe's largest port in Rotterdam and key NATO logistics hubs, remains strategically vital. Russian cyber activity, including prior infiltration attempts of global institutions like the Hague, is escalating. The Dutch government is boosting its military and cybersecurity investments, sharing intelligence with Ukraine and warning that Europe must act swiftly to counter increasingly sophisticated Russian cyber threats. Amid global geopolitical instability, Microsoft has resolved multiple issues affecting remote desktop on Windows Server 2025 and Windows 11. A bug causing RDP sessions to freeze was fixed in February's Update for Windows 11 and in April's update for Windows Server. Microsoft also used known issue rollback to reverse bugs causing RDP disconnections. Additionally, a long standing bug triggering blue screen errors on servers with over 256 logical processors was fixed. Other recent issues include login problems with Windows hello and domain controller failures. A new malware campaign is targeting Docker environments to hijack compute resources for cryptojacking using highly layered obfuscation to evade detection. Researchers from darktrace and Kato Security Labs found the attackers deploying a Docker image, which runs a deeply obfuscated python script requiring 63 decode loops to reach the final payload. Instead of mining cryptocurrency directly, the malware connects to a Web3 platform to simulate node activity and earn private tokens. This low resource tactic avoids triggering alarms tied to traditional mining. Docker's popularity and frequent misconfigurations make it an attractive target. Experts warn organizations to secure Docker setups with strong authentication, avoid unnecessary Internet exposure, and vet images carefully. This campaign signals a shift toward abusing legitimate, decentralized systems for stealthy profit. A new phishing campaign uncovered by Fortinet's FortiGuard Labs uses weaponized Word documents to steal Windows login credentials disguised as sales orders. The emails carry attachments exploiting a known vulnerability in Microsoft Equation Editor. This flaw enables remote code execution, leading to the deployment of a new formbook malware variant. The attack chain involves a Word document embedding an obfuscated RTF file and DLL, triggering buffer overflows and stealthily launching the malware via process hollowing. The payload downloaded as a disguised PNG file decrypts into a fileless executable. Injected into a legitimate Windows process, the malware collects credentials, keystrokes, and screenshots while maintaining persistence through registry edits. Fortinet has flagged this campaign and urges users to update systems and remain alert to phishing threats. Exploiting old vulnerabilities two significant data breaches have recently impacted US organizations, compromising the personal information of over 600,000 individuals on site. Mammography, a Massachusetts based medical services provider, reported unauthorized access to an employee's email account in October of last year. The breach exposed sensitive data including names, Social Security numbers, dates of birth, driver's license and credit card numbers, and medical information affecting approximately 357,000 patients. The company asserts that the intrusion was limited to the email account and is offering 12 months of free credit monitoring to those affected. Kelly Benefits, a Maryland based benefits and payroll solutions provider, disclosed a breach affecting nearly 264,000 individuals. Hackers accessed the company's systems between December 12th and 17th of last year, exfiltrating files containing personal data such as names, dates of birth, Social Security numbers, tax ID numbers, medical and health insurance information, and financial account details. While no ransomware group has claimed responsibility, the possibility of a ransomware attack has not been ruled out. ZYZL Networks has issued critical patches for two high severity vulnerabilities affecting USG Flex H series firewalls. These flaws could allow unauthenticated users to escalate privileges and gain unauthorized access. The first vulnerability enables low privileged users to reach admin level access via PostgreSQL command issues, especially if an admin remains logged in. The second lets admins upload malicious configs to gain further control. Discovered by security researchers, both bugs are fixed in a recent firmware update. Immediate patching is urged. CISA has issued five advisories highlighting critical vulnerabilities in ICS systems from Siemens, Schneider Electric and Abbas, with potential impacts on industrial automation and infrastructure. Siemens telecontrol Server Basic SQL suffers from multiple high severity SQL injection flaws enabling attackers to manipulate databases and bypass controls. Another Siemens advisory cites a lower risk vulnerability causing partial denial of service in redundant server setups. Schneider Electric's Weiser Home controller contains a flawless allowing remote credential exposure. ABB MV drives are affected by codesys vulnerabilities enabling memory based attacks. A previous advisory for Schneider's Modicon M580 PLCs was updated to address a buffer size flaw that could cause denial of service. CISA urges patching network segmentation and continuous monitoring to safeguard critical infrastructure from these escalating threats. Coming up after the break, my conversation with Deputy Assistant Director Cynthia Kaiser from the FBI Cyber Division and so long privacy sandbox. Stay with us. Foreign what's the common denominator in security incidents? Escalations and lateral movement. When a privileged account is compromised, attackers can seize control of critical assets with bad directory hygiene and years of technical debt. Identity attack paths are easy targets for threat actors to exploit, but hard for defenders to detect. This poses risk in active directory, entra ID and hybrid configurations. Identity leaders are reducing such risks with attack path management. You can learn how attack path management is connecting identity and security teams while reducing risk with Bloodhound Enterprise powered by SpectreOps. Head to Spectrops IO today to learn more. SpectreOps see your attack paths the way adversaries do. Do you know the status of your compliance controls right now? Like right now? We know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. Look at this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off. It is always my pleasure to welcome back to the show Deputy Assistant Director Cynthia Kaiser from the F Cyber Division. Dad Kaiser, welcome back.