Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network. Powered by n2k.
Dutch Bros Ad Voice (0:09)
This episode is brought to you by Dutch Bros. Big smiles, rocking tunes and epic drinks. Dutch Bros. Is all about you. Choose from a variety of customizable handcrafted beverages like our Rebel Energy drinks, coffees, teas and more. Download the Dutch Bros app for a free medium drink plus find your nearest shop, order ahead and start earning rewards Offer valid for new app users only. Free medium drink Reward upon registration. 14 day expiration terms apply. See Dutchbros.com.
Dave Bittner (0:42)
Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs, we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off the Biden Administration takes step to retaliate against China for the SALT typhoon cyber attack the Feds release a draft National Cyber Incident Response Plan Telecom Namibia suffers a cyber attack the Australian Information Commissioner has reached a $50 million settlement with Meta over the Cambridge Analytica scandal. CISA releases its 2024 Year in Review LastPass hackers nab an additional $5 million Texas Tech University notifies over 1.4 million individuals of a ransomware attack Researchers discover a new Dark Gate RAT attack vector using Vishing a fraudster gets 69 months in prison on our Threat Vector segment. David Moulton speaks with Nir Zook, Founder and CTO of Palo Alto Networks. With predictions for 2025 and surveillance tweaks our brains in unexpected ways. It's Tuesday, December 17th, 2024. I'm Dave Buettner and this Cyberwire Intel Briefing. Thanks for joining us here today. It is great to have you with us. The Biden Administration has taken its first step to retaliate against China for the SALT Typhoon cyber attack by banning China Telecom's remaining U.S. operations, citing national security risks. This follows a broader Chinese hack that infiltrated US Telecommunications networks, compromising sensitive data and exposing US Surveillance targets. While largely symbolic, the Commerce Department's move addresses China Telecom's ability to peer in on traffic, an issue left unresolved since the FCC revoked its phone licenses in 2021. However, officials admit the action may not deter China's advanced cyber operations, such as Volt Typhoon, which planted malicious code in critical infrastructure. Incoming Trump officials, including Mike Waltz, advocate for offensive cyber responses to impose higher costs on China and prevent further escalation. Meanwhile, China's penetration remains unresolved, with hackers gaining access to wiretap targets and potentially voice calls. The Biden administration created a task force to tackle the breach, meeting daily with telecom executives, but its delayed public response reflects concerns over embarrassment and exposing ongoing investigations. Biden reportedly addressed the issue with President Xi Jinping in November, though specifics remain unclear. The US Government has released a draft National Cyber Incident Response plan, updating the 2016 version to address evolving cyber threats, policies and capabilities. CISA is soliciting public feedback until January 15th of 2025. The NCIRP outlines a flexible framework for federal, state and local government coordination with private sector organizations during significant cyber incidents categorized as level 2 or higher in severity. It focuses on four key areas of asset response led by cisa, providing technical assistance to mitigate vulnerabilities and reduce cascading effects Threat response managed by the DOJ and FBI, focusing on investigations, evidence collection and threat disruption Intelligence response led by the Office of the Director of National Intelligence to build awareness and share threat intelligence and affected entity response, ensuring operational continuity with the federal government playing a limited role for private entities. CISA emphasizes the plan is not a step by step guide, but a flexible structure for collaboration. Additional planning documents and regular updates will be developed to address emerging needs. Telecom Namibia suffered a cyber attack on December 11th of this year, resulting in the leak of over 400,000 customer files. The Ransom Group Hunters International exfiltrated 626 gigabytes of data, including personal identification addresses and banking details, later leaking the information when ransom demands went unmet. Telecom Namibia's CEO Stanley Shanapinda assured the public of efforts to contain the breach and strengthen cybersecurity. The Communications Regulatory Authority of Namibia and NAM CCERT are assisting in mitigating the attack's impact. The Australian Information Commissioner has reached a $50 million settlement with Meta Platforms over privacy breaches related to the Cambridge Analytica scandal. The settlement follows court ordered mediation stemming from civil penalty proceedings that began in 2020. The scheme will offer two tiers of compensation, a base payment for general concerns and a higher tier for individuals who prove specific loss or damage. An independent third party administrator will oversee the program, expected to begin in the second quarter of 2025. CISA has issued a warning about an actively exploited Windows kernel mode driver vulnerability that enables privilege escalation to system level. Initially disclosed by Microsoft in June 2024 with a CVSS score of 7.8, the flaw requires low privileges and no user interaction, making it highly exploitable. CISA has mandated remediation for Federal Agencies by January 6, 2025. Organizations are urged to apply Microsoft's June patch or use mitigations like system isolation, firewalls, endpoint detection tools and enforcing least privilege to reduce risk. Additionally, CISA released its 2024 year in review, highlighting key accomplishments in advancing cybersecurity, protecting critical infrastructure and addressing emerging threats. Throughout the year, CISA focused on building resilience through partnerships, innovation and proactive measures. Areas of specific interest include election security, cyber threat mitigation, global partnerships, workforce development and emergency communications. CISA underscored its commitment to collaboration, innovation and accountability, positioning itself as a leader in securing critical systems that underpin the nation's economy and daily life. The 2024 report reflects CISA's ongoing mission to safeguard the United States against evolving cyber and infrastructure threats. Hackers linked to the 2022 LastPass breach have stolen an additional $5.36 million from 40 victims, pushing total crypto losses to $45 million. The attackers accessed users encrypted vault backups exploiting private keys and seed phrases stored before 2023. Blockchain sleuth Zach XBT traced the stolen funds, swapped for ether and sent to exchanges. Security experts urge affected users to transfer assets immediately. The theft comes amid a spike in scams during the holiday season, dubbed hacker season, with warnings to avoid free WI fi, sharing, two FA codes and festive scams. Non crypto funds have also been targeted, with $250 million stolen in May. Cybersecurity advocates stress vigilance as hackers aim to exploit the seasonal uptick in online activity and spending. Texas Tech University is notifying over 1.4 million individuals of a ransomware attack that targeted its Health Sciences center and Health Sciences Center, El Paso. The attackers accessed the network from September 17th to 29th, exfiltrating personal and sensitive data including names, Social Security numbers, driver's license details, health insurance, medical records and financial account information. The Interlock Ransomware group claimed responsibility, alleging theft of 2.5 terabytes of data, including medical research and SQL databases. Texas Tech also reported prior threats. In July, the Meow Ransomware Group offered SQL databases and website vulnerabilities for sale. The university has filed breach reports with the U.S. department of Health and Human Services and is offering free credit monitoring to affected individuals. Researchers at Trend Micro discovered a new Dark Gate RAT attack vector using vishing via Microsoft Teams calls to gain remote access to a victim's device. Initially, the attacker attempted to install Microsoft Remote support, but when that failed, they manipulated the victim into downloading any desk. Once connected, the attacker loaded suspicious files including Dark Gate, which enabled remote control, executed commands and established a connection to a C2 server. The multi stage attack began with phishing emails followed by a fake teams call posing as external tech support. Darkgate, a sophisticated malware active since 2017, allows remote access, key logging, cryptocurrency mining and system data theft. To mitigate such attacks, organizations should train employees on social engineering tactics, verify third party support claims, whitelist approved remote tools, enable MFA and block unvetted applications. The U.S. justice Department sentenced Vitaly Antonenko, age 32 to 69 months in prison for hacking, credit card theft and money laundering. Arrested in 2019 at JFK airport returning from Ukraine, Antonenko was found with hundreds of thousands of stolen payment card numbers. He belonged to a cybercrime group that exploited SQL injection vulnerabilities to steal data from organizations like a hospitality business and a research institution. The stolen data was sold on cybercrime marketplaces and proceeds were laundered through cryptocurrency and cash transactions. Coming up after the break on our Threat Vector segment, David Moulton speaks with Nir Zuk, Founder and CTO of Palo Alto Networks, about predictions for 2025 and surveillance tweaks our brains in unexpected ways. Stay with us.