Podcast Summary: CyberWire Daily - "SUSE Flaw Found Hiding in Plain Port"

Podcast Information:

• Title: CyberWire Daily
• Host/Author: N2K Networks
• Description: The daily cybersecurity news and analysis industry leaders depend on. Published each weekday, the program also includes interviews with a wide spectrum of experts from industry, academia, and research organizations all over the world.
• Episode: SUSE flaw found hiding in plain port
• Release Date: August 1, 2025

1. Critical SUSE Manager Vulnerability

A significant security flaw has been identified in SUSE Manager, a popular system management tool. This vulnerability allows attackers to execute commands with root privileges without authentication by exploiting an exposed WebSocket endpoint on port 443.

• Impact:

  • Affects multiple SUSE Manager versions, including recent container and cloud deployments.
  • Requires only network access to exploit.

• Recommendations:

  • Immediate Action: Block port 443 or isolate vulnerable systems from untrusted networks.
  • Patch Deployment: Apply the updates released by SUSE until systems are fully patched.
  • Network Controls: Enforce strict network segmentation to limit exposure.

Dave Bittner emphasized the urgency, stating, “Immediate action is needed. Block Port 443 or isolate vulnerable systems from untrusted networks, then patch using the updates SUSE has released until fully patched” [05:15].

2. CISA and US Coast Guard Threat Hunt Findings

A joint cybersecurity threat hunt conducted by the Cybersecurity and Infrastructure Security Agency (CISA) and the US Coast Guard at a critical infrastructure site uncovered several severe cybersecurity issues, though no active threat actors were detected.

• Key Risks Identified:

  • Shared Admin Accounts: Use of shared administrative accounts with plain text passwords.
  • Weak IT/OT Segmentation: Insufficient separation between IT and Operational Technology (OT) environments.
  • Inadequate Logging: Lack of comprehensive logging mechanisms.
  • Misconfigured Systems: Allowed IT users direct access to SCADA networks, posing potential safety risks.
  • Credential Management: Admin credentials stored in scripts and reused across multiple devices.
  • Network Controls: Absence of bastion hosts and insufficient network segmentation.

• CISA’s Urgent Recommendations:

  • Fix misconfigurations promptly.
  • Enforce unique credentials and implement Multi-Factor Authentication (MFA).
  • Segment IT and OT environments effectively.
  • Adopt bastion hosts and Virtual Private Networks (VPNs) to enhance security.

Dave highlighted the advisory, noting, “CISA urges critical infrastructure operators to fix misconfigurations, enforce unique credentials, use MFA, segment IT and OT environments, and adopt bastion hosts and VPNs” [07:45].

Additionally, CISA released two high-severity Industrial Control Systems (ICS) advisories addressing major vulnerabilities in GuroP seismic devices and Rockwell Automation systems utilizing VMware. These vulnerabilities allow unauthenticated remote access and code execution, respectively.

3. Healthcare Sector Data Breaches

Several healthcare providers across the United States have reported data breaches compromising sensitive patient information:

• Mid Florida Primary Care: Breach occurred between November and December 2024.
• Northwest Denture Center, Washington: Exposed protected health information of over 12,000 individuals.
• Equilibria Mental Health Services, Massachusetts: Phishing attack compromised data of up to 2,000 individuals.
• National Data Bank for Rheumatic Diseases: Unauthorized access in March affected personal and medical data.
• West Virginia Primary Care Association: Alleged breach by Inc. Ransom, claiming theft of 296 gigabytes of data (unconfirmed by WVPCA).

Response Measures:

• Impacted organizations are offering credit monitoring, enhancing security protocols, and conducting thorough investigations to prevent future incidents.

4. Indonesian Bank Breach via Raspberry Pi Planting

Cybercriminal group UNC 2891 successfully infiltrated an Indonesian bank in early 2024 by physically installing a Raspberry Pi on a network switch connected to the Atmosphere system.

• Attack Details:

  • The Raspberry Pi was equipped with a 4G modem, enabling remote access to the bank’s internal systems.
  • Utilized a backdoor named TinyShell, disguised as a Linux display manager, to evade detection.
  • Maintained persistent access via the bank's mail server, facilitating cash theft.

• Challenges in Mitigation:

  • Advanced obfuscation tactics, including the use of Linux bind mounts (MITRE ATT&CK Technique T1564.013), complicated forensic investigations.

• Outcome:

  • Attackers aimed to deploy the CAKE tap rootkit for further withdrawals but were ultimately blocked by defenders.

Group IB reported, “The incident highlights the need for advanced memory and network forensics beyond standard response measures” [09:30].

5. Russian State-Backed Hackers Target Moscow Diplomats

The APT group Secret Blizzard (also known as Turla and Krypton), backed by the Russian state, is actively targeting Moscow diplomats to deploy custom malware named Apollo Shadow.

• Modus Operandi:

  • Utilizes adversary-in-the-middle (AitM) attacks via domestic surveillance systems like Sorm to intercept traffic.
  • Redirects victims through a fake captive portal where Apollo Shadow installs a counterfeit Kaspersky certificate to gain system control.
  • The malware modifies system settings, installs root certificates through Certutil, and creates a persistent admin account.

• Impact:

  • Provides system control and persistent access to targeted diplomats.

• Microsoft’s Advisory:

  • Targeted Individuals: Diplomats using Russian ISPs.
  • Recommendations: Use VPNs, enforce least privilege policies, and implement script blocking to mitigate risks.

Dave noted, “This is the first confirmed case of ISP-level adversary in the middle malware deployment inside Russia” [11:20].

6. Luxembourg Telecom Outage Investigation

On July 23rd, Luxembourg experienced a major telecom outage lasting over three hours, disrupting 4G and 5G services, emergency calls, internet access, and banking services.

• Suspected Cause:

  • A sophisticated denial-of-service attack targeting Huawei equipment, exploiting a software flaw in Post Luxembourg's infrastructure.

• Consequences:

  • Disruption of critical services, prompting concerns over national resilience.

• Current Status:

  • A comprehensive forensic investigation is underway.
  • Potential regulatory changes may emerge to enhance network redundancy and prevent future outages.

7. Nvidia Summoned by China’s Cyberspace Regulator

China's Cyberspace Administration has summoned Nvidia over alleged security risks associated with its H2O AI chips sold in China.

• Concerns Raised:

  • The chips may contain tracking and remote shutdown features, posing national security risks.

• Regulatory Actions:

  • China is demanding explanations and supporting evidence from Nvidia, citing national data and network security laws.

• Context:

  • US lawmakers, including Senator Tom Cotton, have proposed legislation mandating such features in exported chips.
  • Nvidia's H2O AI chips are under scrutiny for potentially embedding this technology.

8. Graynoise Report on Pre-Disclosure Exploit Activity

Graynoise released a report revealing that attackers often exploit vulnerabilities in edge devices up to six weeks before public disclosure or assignment of a Common Vulnerabilities and Exposures (CVE) identifier.

• Findings:

  • In 80% of cases, there is a spike in pre-disclosure activities such as scanning, brute forcing, and zero-day exploit attempts.
  • This trend is particularly prevalent among eight major vendors: Cisco, Citrix, Fortinet, Avanti, Juniper, Mikrotik, Palo Alto Networks, and SonicWall.
  • Graynoise identified 216 pre-disclosure exploit spikes, urging defenders to treat these as early warning signals.

• Recommendations:

  • Enhance monitoring during identified spikes.
  • Harden systems against potential exploits.
  • Block malicious IP addresses proactively.

Dave summarized, “These early indicators provide a window for proactive defense, especially against nation-state actors like Typhoons targeting enterprise edge devices for surveillance and long-term access” [13:10].

9. Expert Interview: Ryan Whelan on Scattered Spider and PWN2 Own

Guest: Ryan Whelan, Managing Director and Global Head of Accenture Cyber Intelligence

Discussion Highlights:

• Overview of Scattered Spider:

  • Described as a financially motivated threat group comprising many young individuals with evolving motives, making their actions less predictable.
  • Highly active, employing advanced social engineering techniques to compromise high-security organizations globally.

  “Scattered Spider employs some very advanced social engineering techniques in order to conduct pretty advanced compromises of some of the most advanced security organizations and firms in the world.” – Ryan Whelan [14:34]

• Tactics and Techniques:

  • Living Off the Land: Minimal use of novel exploits, relying instead on existing tools and techniques, enhancing stealth and detection evasion.

  “They employ some very advanced social engineering techniques... which makes them even more hard to detect.” – Ryan Whelan [15:20]

  • Social Engineering Red Flags:
    • Imitating IT personnel or help desk staff to extract credentials.
    • Impersonating trusted roles to bypass security controls.
    • Unusual requests for credentials or MFA codes via phone calls.

  “Most organizations are not going to call you up on the phone and ask you to hand over individual credentials... One of the first things you should do... is hang up and contact your own organization’s security operations center.” – Ryan Whelan [19:16]

• Demographics and Adaptability:

  • Notably, many members originate from Western countries (e.g., UK, USA), making them more adept at mimicking local communication styles and cultural nuances.
  • Gender Diversity: A recent arrest involved a female member, challenging the stereotype that cybersecurity threats are predominantly male.

  “These are native English speakers... which makes it harder to detect as they target organizations.” – Ryan Whelan [18:08]

• Organizational Preparedness:

  • Emphasis on building a culture of awareness and resilience beyond the Security Operations Center (SOC).
  • Importance of training frontline staff, such as help desk personnel, to recognize and respond to sophisticated social engineering attempts.

  “Security extends beyond the SoC... build a culture of awareness and resilience to the folks who might be manning their help desks.” – Ryan Whelan [16:53]

• Upcoming Engagements:

  • Ryan is preparing to attend the Black Hat conference to explore emerging adversary tactics and defensive strategies.

  “Black Hat and DEFCON are more of the practitioner conference... emerging tactics and techniques we're seeing adversaries use.” – Ryan Whelan [21:18]

Key Takeaways from the Interview:

• Advanced Social Engineering: Scattered Spider’s use of sophisticated, culturally aware tactics makes them a formidable threat.
• Proactive Defense: Organizations must foster widespread security awareness and implement robust verification protocols.
• Adaptability: Understanding the evolving nature of threat groups is crucial for effective defense strategies.

Conclusion

This episode of CyberWire Daily delves into a spectrum of pressing cybersecurity issues, from critical vulnerabilities in widely-used management tools to sophisticated attacks on essential infrastructure and diplomatic entities. The interview with Ryan Whelan provides valuable insights into the evolving tactics of threat groups like Scattered Spider, underscoring the importance of advanced social engineering defenses and organizational resilience. As cyber threats continue to grow in complexity and sophistication, staying informed and proactive remains paramount for safeguarding digital and physical assets.

Notable Quotes:

• Ryan Whelan: “Scattered Spider employs some very advanced social engineering techniques... which makes them even more hard to detect.” [15:20]
• Ryan Whelan: “Most organizations are not going to call you up on the phone and ask you to hand over individual credentials... One of the first things you should do... is hang up and contact your own organization’s security operations center.” [19:16]
• Ryan Whelan: “These are native English speakers... which makes it harder to detect as they target organizations.” [18:08]

Additional Resources:

• For a deeper dive into Scattered Spider and PWN2 Own's million-dollar WhatsApp hack challenge, tune into the full interview with Ryan Whelan.
• Stay updated with the latest cybersecurity news and expert analyses by subscribing to CyberWire Daily.