Transcript
Dave Buettner (0:02)
You're listening to the CyberWire network, powered by N2K.
Ben Yellen (0:12)
Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows, and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, Hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproof.IO to see how leading teams are transforming their GRC programs. Patch your Linux systems no SER pseudo Patch your Linux systems Cisco has removed a critical backdoor account that gave remote attackers rude privileges. The Hunters International Ransomware Group rebrands and closes up shop. The Centers for Medicare and Medicaid services notifies over 100,000 people that their personal data was compromised. Nimdor is a sophisticated North Korean cyber campaign targeting macOS. Researchers uncover a massive phishing campaign using thousands of fake retail websites. The FBI's top cyber official says Salt Thai food is largely contained. Microsoft tells customers to ignore Windows firewall error warnings. A California jury orders Google to pay $314 million for collecting Android user data without consent. Ben Yellen shares insights from this year's Supreme Court session and ransomware negotiations with a side of side hust. It's Thursday, July 3rd, 2025. I'm Dave Buettner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Security researchers have found two serious elevation of privileges vulnerabilities in pseudo the critical Linux utility installed on nearly all servers and workstations. The first flaw affects multiple versions. It lets local users gain full root access by abusing the chroot function, even without specific sudo rules. The bug was introduced in June 2023 and impacts multiple systems like Ubuntu and Fedora. Users are urged to upgrade immediately. The second flaw is an elevation of privilege bug that remained hidden for 12 years. It affects multiple stable versions and legacy versions, allowing privilege escalation in configurations using host or host alias directives common in enterprises. Though low in severity, it still poses a risk, Strata Scale warns these vulnerabilities highlight operational gaps or, urging businesses to audit environments, strengthen detection and patch systems to avoid hidden threats, undermining trust and compliance. Cisco has removed a critical backdoor account from its Unified Communications Manager that allowed unauthenticated remote attackers to log in with root privileges. The flaw results from static root credentials left over from development and testing. There are no workarounds. Admins must upgrade or apply patches. Successful exploitation lets attackers execute commands as Root. While Cisco has seen no active attacks yet, it released indicators of compromise to help detect breaches. This was the latest in a series of backdoor removals from Cisco products, including previous issues in iOS, XE DNA Center WAS and smart licensing Utility, highlighting ongoing risks from hard coded credentials in enterprise infrastructure. The Hunters International Ransomware Group has shut down its operations and is offering free decryptors to help victims recover data without paying ransoms. In a dark Web statement, the gang cited recent developments for its closure, likely referencing increased law enforcement scrutiny and declining profits. Hunters International emerged in late 2023 and was suspected to be a rebrand of Hive due to code similarities. It targeted nearly 300 organizations worldwide, including the US Marshals Service, Hoya, Tata Technologies, AutoCanada, Austral USA, Integris Health and Fred Hutch Cancer Center. While it previously combined encryption with extortion, the group recently launched WorldLeaks, an extortion only operation. Victims can request decryption tools and recovery guidance via the gang's website. Threat analysts warn this shutdown does not end its threat actors activities, as affiliates may migrate to other ransomware or data extortion groups. The Centers for Medicare and Medicaid Services cms is notifying 103,000 people that their personal data was compromised and after Fraudsters created fake Medicare.gov accounts using valid beneficiary information Between 2023 and 2025, the scheme came to light in May when beneficiaries reported account creation letters they didn't initiate. Attackers used stolen data, including Medicare beneficiary identifiers, dates of birth and zip codes from unknown external sources to create accounts and potentially access additional information like provider details, diagnoses and premium data. CMS deactivated affected accounts, replaced Medicare cards for victims, and blocked new account creation from foreign IP addresses. While no misuse has been reported yet, CMS continues to investigate. The incident follows broader warnings about rising healthcare scams exploiting people's fear of losing access to care as cybercriminals increasingly target government healthcare programs for profit. Sentinel Labs has uncovered a sophisticated North Korean Cyber campaign targeting Web3 and cryptocurrency firms using new macOS malware called Nimdor, revealed on July 2. The report details multi stage attacks leveraging social engineering, fake Zoom updates and the rare NIM programming language to evade detection. Hackers pose as trusted contacts on Telegram, sending malicious Zoom SDK scripts heavily disguised to install additional tools. Once inside, they deploy a C injector to steal keychain passwords, browser data and Telegram chats, and install Nimdor for long term access. The malware uses encrypted web socket communications and techniques to stay active even after a shutdown. Sentinel Labs warns that North Korea's adoption of cross platform languages like NIM plus clever AppleScript use makes detection harder. The report urges companies to strengthen defenses against these evolving persistent threats. Targeting the crypto and Web three sector researchers uncovered a massive phishing campaign using thousands of fake retail websites impersonating brands like Apple, PayPal, Nordstrom and Hermes to steal credit card data. First flagged in Mexico, security firm Silent Push found it targets English and Spanish users globally. Some sites convincingly mimic retail stores with scraped listings and Google pay widgets, while others are poorly built. Technical indicators suggest Chinese cybercriminals are behind it. Many sites remain active despite takedowns highlighting the persistent threat of retail themed phishing scams. In an interview with Tim Starks from Cyberscoop, Brett Leatherman, the FBI's new top cyber official, said Chinese hackers behind the telecommunications breach known as Salt Typhoon are currently largely contained and dormant within network networks but still pose a threat. Although Salt Typhoon is known for espionage, Leatherman warned their access could pivot to destructive actions similar to Volt Typhoon, which is pre positioned in US Critical infrastructure. Nine US Telecom companies were impacted, with more victims identified abroad due to information sharing. Leatherman emphasized continued focus on victim support, resilience and deterrence. Though offensive operations require further attribution, evicting Salt Typhoon remains challenging due to their entrenched foothold. He also flagged North Korean IT scams as a growing insider risk that could evolve into intellectual property theft or brokering access for broader cyber operations. Microsoft has told customers to ignore Windows firewall error warnings labeled Event 2042, appearing after the June 2025 preview update on some Windows 11 systems. These config read failed errors result from a new unfinished feature and do not affect firewall functionality or system processes. Microsoft said no action is required and they're working on a fix. The errors appear in event viewer logs but can be safely disregarded, according to the company's Windows release Health Dashboard. This week, a California jury has ordered Google to pay $314 million for collecting Android user data over cellular networks without consent. In a class action lawsuit dating back to 2019, plaintiffs argued Google's passive data transfers used users paid cellular data for its own benefit, including targeted ads, and continued even after apps were closed. The lawsuit said these transfers occurred silently, even while devices sat idle overnight and couldn't be fully disabled. Google argued the data transfers are minimal and essential for security and device performance, stating users consented through Settings and Terms of Use. A spokesperson said Google will appeal, calling the ruling a setback for users. Coming up after the break, Ben Yellen shares insights from this year's Supreme Court session and ransomware negotiations with a side of side hustle. Stick around. Did you know Active Directory is targeted in 9 out of 10 cyber attacks? Once attackers get in, they can take control of your entire network. That's why Sempras created Purple Knight, the free security assessment tool that scans your active directory for hundreds of vulnerabilities and shows you how to fix them. Join thousands of IT pros using Purple Knight to stay ahead of threats. Download it now at sempris.com purple-knight that's sempris.com purple knight foreign and now a word from our sponsor. Spy Cloud identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire and joining me once again is Ben Yellen. He is from the University of Maryland center for Cyber Health and Hazard Strategies. Ben, it's always great to have you back.