The end of a cybercrime empire. - CyberWire Daily

Summary

Podcast Summary: CyberWire Daily – "The End of a Cybercrime Empire"

Release Date: January 31, 2025
Host: Dave Buettner, CyberWire Network powered by N2K Networks

1. Dismantling a Pakistan-Based Cybercrime Network

US and Dutch authorities successfully dismantled a significant cybercrime network based in Pakistan, known as Operation Heart Blocker. The operation targeted Sim Raja, aka Heartsender, who operated 39 domains since 2020. Raja sold phishing toolkits, scam pages, and email extractors that were marketed as undetectable by security solutions. These tools facilitated business email compromise scams, resulting in over $3 million in losses.

Notable Quote:
“At heart, Raja’s operations have led to significant financial losses for businesses worldwide, highlighting the persistent threat of cybercrime networks,” – Dave Buettner [02:45].

Authorities also uncovered millions of stolen data records, prompting Dutch police to launch a website for users to check if their credentials were compromised. Affected individuals are urged to change passwords and remain vigilant against phishing attempts.

2. Feasibility of Establishing a US Cyber Force as a Standalone Military Branch

A bipartisan group of lawmakers is urging the National Academy of Sciences, Engineering, and Medicine to evaluate the feasibility of creating a US Cyber Force independent of existing military structures. Representatives Morgan Luttrell and Pat Fallon, alongside Senator Kirsten Gillibrand, emphasized the need to determine whether a standalone cyber force is the best approach to address ongoing cybersecurity challenges.

Notable Quote:
“We must explore all options to ensure our cyber defenses are robust and adaptable to emerging threats,” – Senator Kirsten Gillibrand [05:20].

The lawmakers have set a deadline of November 30th and requested bi-monthly updates to inform the fiscal year 2027 defense strategies. The debate centers on whether US Cyber Command should remain integrated within existing commands like Special Operations or operate independently.

3. DOJ Sues to Block HPE's Acquisition of Juniper Networks

The U.S. Department of Justice has filed a lawsuit to block Hewlett Packard Enterprise’s (HPE) $14 billion acquisition of Juniper Networks, citing antitrust concerns. The DOJ argues that the merger would significantly reduce competition in the US networking market, leaving HPE and Cisco with over 70% market control.

Notable Quote:
“This acquisition would create an unfair monopoly, stifling competition and innovation in the networking sector,” – DOJ Representative [07:15].

HPE and Juniper dispute the claims, asserting that the merger would enhance competition. The case marks the first antitrust challenge under President Trump’s administration and will undergo an eight-month legal process before the October deadline.

4. Tangerine Turkey Deploys Crypto Mining Malware

Tangerine Turkey is a newly identified VBS worm that spreads via USB drives, deploying crypto mining malware. First detected by Red Canary in November 2024, it was ranked eighth in IT’s January 2025 threat report. The malware hijacks the PrintUI DLL to execute mining software and is linked to the Universal Mining operation, which infected over 270,000 computers across 135 countries.

Notable Quote:
“The sophistication of Tangerine Turkey underscores the evolving tactics of cybercriminals in leveraging widespread malware for crypto mining,” – Dave Buettner [09:50].

Researchers noted overlaps with other crypto mining campaigns and identified multiple execution methods, including BAT, PowerShell, and EXE-based approaches. Efforts to mitigate the threat include taking down related GitHub profiles and configuration domains.

5. Major Healthcare Providers Send Breach Notifications

Two significant data breaches have impacted major healthcare providers:

Community Health Center (CHC) in Connecticut notified over 1 million patients of a breach that exposed personal and health information, including Social Security numbers and medical diagnoses. The breach occurred in October 2024 but was only discovered in January 2025. While no systems were encrypted, a skilled hacker was apprehended shortly after the attack.
North Bay Health informed 569,000 individuals of a separate breach in early 2024, potentially involving ransomware. Although there's no evidence of identity theft, the attack disrupted hospital operations for weeks. North Bay is offering free identity protection services to those affected.

Notable Quote:
“These breaches highlight the critical vulnerability of healthcare systems to cyberattacks, emphasizing the need for robust security measures,” – Dave Buettner [10:30].

The incidents reflect a growing trend of cybercriminals targeting healthcare providers for data theft and extortion.

6. Norwegian Police Seize Russian Crewed Ships Suspected of Cable Damage

Norwegian authorities have seized the Silver Danje, a Norwegian-registered ship suspected of being crewed by Russians and involved in damaging a communications cable between Sweden and Latvia. This marks the third vessel detained in recent weeks amid rising concerns over subsea infrastructure sabotage in the Baltic Sea.

Notable Quote:
“The intentional damage to critical communication infrastructure poses a significant threat to regional security and stability,” – Dave Buettner [11:15].

Latvian and Swedish authorities are investigating similar incidents, with Finland also seizing the Eagle S, suspected of severing multiple cables by dragging its anchor. NATO allies have launched the Baltic Century initiative to protect critical infrastructure, warning of potential actions against Russian vessels if threats persist.

7. Critical Vulnerabilities in GitHub Copilot and D-Link Routers

GitHub Copilot, Microsoft’s AI-powered coding assistant, was found to have two critical vulnerabilities:

Affirmation Jailbreak Trick: Allows users to bypass Copilot’s ethical safeguards by adding affirmations like “sure” to prompts, enabling the generation of malicious code such as SQL injection scripts.
Proxy Hijack Exploit: Enables attackers to reroute Copilot’s API traffic, capturing authentication tokens and gaining unrestricted access to OpenAI’s models. This could lead to financial risks and leakage of proprietary code.

With 83% of Fortune 500 companies utilizing Copilot, these vulnerabilities pose widespread risks. Researchers recommend implementing better AI security controls, including adversarial training and stricter API token policies.

Additionally, a critical unauthenticated remote execution vulnerability was discovered in D-Link DSL3788 routers by Max Belia of BVTech. This flaw allows attackers to gain full remote control, potentially leading to network compromise and malware deployment. D-Link has released a patched firmware and urges users to update immediately.

Notable Quote:
“The vulnerabilities in GitHub Copilot and D-Link routers expose significant risks, necessitating immediate action to safeguard enterprise security,” – Dave Buettner [11:50].

8. CISA and FDA Warn U.S. Healthcare Organizations of Vulnerable Patient Monitors

The Cybersecurity and Infrastructure Security Agency (CISA) and the Food and Drug Administration (FDA) have issued warnings to U.S. healthcare organizations regarding severe security vulnerabilities in Contec CMS 8000 patient monitors. These Chinese-made devices contain firmware backdoors that allow attackers to:

Overwrite files
Execute arbitrary code
Exfiltrate patient data

Key vulnerabilities include unauthorized remote control and the transmission of unencrypted patient data to hard-coded IP addresses. No patches are available, and CISA advises the immediate removal of these devices from networks.

Notable Quote:
“These vulnerabilities in patient monitors represent a dire threat to both patient safety and data integrity,” – Dave Buettner [12:10].

Past vulnerabilities in the same devices have also posed serious security risks, though no known attacks exploiting these specific flaws have been reported yet.

9. General Services Administration (GSA) Pauses Federal Contract Awards

The General Services Administration (GSA) has temporarily paused new federal contract awards, citing the need for new leadership to review acquisition strategies. This pause has generated confusion among federal cybersecurity vendors and concerns about potential long-term impacts on the cybersecurity sector.

Notable Quote:
“The uncertainty surrounding GSA’s contract pause could deter small vendors and disrupt crucial cybersecurity services,” – Dave Buettner [12:45].

Exceptions are allowed for emergency obligations and IT spending, and the Department of Defense clarified that its contracts remain unaffected to ensure continuity in national security missions. Industry groups are calling for clearer guidance to mitigate disruptions in cybersecurity and other federal services.

10. The Disappearing Government Data: A Threat to Transparency

In a concerning development, Harvard archivist Jack Cushman discovered that over 2,000 datasets had vanished from data.gov the day after Donald Trump’s inauguration. These datasets, related to climate research, environmental monitoring, and diversity initiatives, were confirmed missing through the Wayback Machine.

Notable Quote:
“The quiet deletion of government data undermines transparency and accountability, erasing critical information that shapes our understanding of the world,” – Jack Cushman [28:29].

Archivists and researchers are scrambling to preserve what remains, recognizing that unlike printed documents, digital data is vulnerable to centralization and deletion. The incident raises questions about whether this was a routine cleanup or a targeted purge, highlighting the need for robust digital data preservation policies to protect democratic integrity.

Conclusion

This episode of CyberWire Daily delved into significant cybersecurity developments, from the takedown of a major cybercrime network to critical vulnerabilities in widely-used technologies. The discussions underscored the evolving nature of cyber threats and the imperative for robust defenses and strategic oversight.

Final Quote:
“Safeguarding our digital infrastructure is not just about technology; it’s about defending the very fabric of our society,” – Dave Buettner [28:29].

Stay informed and protected by tuning into future episodes of CyberWire Daily.

Notable Mentions:

N2K Networks is a leading provider in cybersecurity solutions, emphasizing practical and adaptable AI-driven data platforms.
Domo offers AI and data products that enhance business operations through secure AI agents and automated workflows.

Note: This summary excludes advertisements, sponsor messages, and farewell segments to focus solely on the critical cybersecurity content discussed in the episode.

Transcript

Dave Buettner (0:02)

You're listening to the Cyberwire Network, powered by N2K. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. That's where Domo's AI and data products platform comes in. With Domo, you can channel AI and data into innovative uses that deliver measurable impact. Secure AI agents connect Prepare and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more@AI.domo.com that's AI.domo.com Authorities dismantle a Pakistan based cybercrime network Lawmakers question the feasibility of establishing a US Cyber force as a standalone military branch. The DOJ sues to block HPE's acquisition of Juniper Networks Tangerine Turkey deploys crypto mining malware Major healthcare providers send breach notifications Norwegian police seize a Russian crewed ship suspected of damaging a communications cable Researchers discover Critical vulnerabilities in GitHub CoPilot D link patches, a critical router vulnerability CISA and the FDA have warned U.S. health care organizations of severe security vulnerabilities in Chinese made patient monitors. Pauses in funding create confusion for federal cybersecurity vendors we bid a fond farewell to a pair of N2K colleagues and the case of the disappearing government data. It's Friday, January 31st, 2020. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Happy Friday and thanks for joining us here. It's great to have you with us. US and Dutch authorities have dismantled a Pakistan based cybercrime network that sold hacking and fraud tools online. Dubbed Operation Heart Blocker, the crackdown led to the seizure of 39 domains operated by Sim Raja, also known as Heartsender, who had been selling phishing toolkits, scam pages and email extractors since 2020. His tools, marketed as undetectable by security solutions, were widely used in business email compromise scams, leading to over $3 million in losses. Thousands of cybercriminals purchased these tools to steal credentials and conduct fraud. Authorities also uncovered millions of stolen data records, prompting Dutch police to launch a website where users can check if their credentials were compromised. Those affected are urged to change their passwords and stay vigilant against phishing attempt. A bipartisan group of lawmakers is urging the National Academy of Sciences, Engineering and Medicine to fully evaluate the feasibility of establishing a US cyber force as a standalone military branch. In a January 29 letter, Representatives Morgan Luttrell, Republican from Texas Pat Fallon, Republican from Texas, and Senator Kirsten Gillibrand, Democrat from New York, stressed that while the defense policy bill altered the study's focus to broader cyber force models, it must still answer whether a cyber force is the best option. Lawmakers also suggested a deadline of November 30th and requested updates every two months to ensure timely input for the fiscal year 2027 defense discussions. The debate continues over whether US Cyber Command should remain under its current structure, akin to Special Operations Command, or if an independent cyber force is necessary to address ongoing readiness challenges. The letter signals Congress commitment to reassessing military cyber capabilities. The U.S. department of justice has sued to block Hewlett Packard Enterprise's $14 billion acquisition of Juniper Networks, arguing it would stifle competition by leaving only HPE and Cisco controlling over 70% of the US networking market. The companies dispute the claim, saying the deal would enhance competition. The lawsuit marks the first antitrust case under President Trump's new term, despite approvals from the UK and eu. HPE and Juniper face an eight month legal battle before the October deadline. Tangerine Turkey is a VBS worm that spreads via USB drives to deploy crypto mining malware. First observed by Red Canary in November of last year, IT ranked number eight in their January 2025 threat report. The malware hijacks PrintUI DLL to execute mining software and has been linked to a global cryptojacking campaign. Azerbaijan's CERT found strong overlaps between Tangerine Turkey and a massive crypto mining operation called Universal Mining, which had infected over 270,000 computers in 135 countries. VirusTotal samples indicated sometimes drops XMRig, though configuration files are often pulled from remote servers and GitHub repositories. Several related GitHub profiles and domains used for configuration were taken down. Reports from QuickHeal and Azerbaijan SERT suggest Tangerine Turkey is part of a larger, evolving crypto mining campaign, possibly with new variants beyond VBS, including BAT, PowerShell and EXE based execution methods. Community Health Center, a major Connecticut healthcare provider, is notifying over 1 million patients of a data breach, exposing their personal and health information. Attackers accessed CHC's network in October 2024, but the breach was only discovered in January of this year. The stolen data includes names, Social Security numbers, medical diagnoses and insurance details, but CHC states that no systems were encrypted and operations remain unaffected. Investigators found that a skilled criminal hacker was behind the attack but was stopped within hours. Meanwhile, North Bay health is notifying 569,000 individuals of a separate data breach in early 2024, which may have involved ransomware. Although North Bay says there's no evidence of identity theft, it is offering free identity protection. The attack disrupted hospital operations for weeks. These incidents highlight the growing trend of cybercriminals targeting healthcare providers for data theft and extortion. Norwegian police have seized the Silver Danje, a Norwegian registered Russian crewed ship suspected of damaging a communications cable between Sweden and Latvia. This marks the third vessel detained in recent weeks amid rising concerns over subsea infrastructure sabotage in the Baltic Sea. The ship was detained at Norway's request after sailing from St. Petersburg to Murmansk. Latvian authorities are investigating three ships over the cable cut, with Sweden having already detained a ship. Meanwhile, Finland has seized the Eagle S, suspected of intentionally dragging its anchor for 60 miles, severing multiple cables with heightened NATO concerns Baltic Century A new military initiative has been launched to protect critical infrastructure. NATO allies have warned of potential actions against Russian vessels if subsea threats persist. Researchers have discovered two critical vulnerabilities in GitHub Copilot, Microsoft's AI powered coding assistant, exposing major security flaws in enterprise AI tools. The affirmation jailbreak trick allows users to bypass CoPilot's ethical safeguards by simply adding affirmations like sure to prompts, enabling it to generate malicious code such as SQL injection scripts or deauthentication attacks. The proxy hijack exploit is even more secure, allowing attackers to reroute CoPilot's API traffic capture authentication tokens and gain unrestricted access to OpenAI's models. This could lead to enterprise wide financial risks by generating high cost AI queries or leaking sensitive proprietary code. With 83% of Fortune 500 companies using Copilot, the risks are widespread. Researchers urge better AI security controls, including adversarial training, certificate pinning and stricter API token policies. As AI coding tools advance security frameworks like NIST's AI risk management are needed to prevent exploitation. A critical, unauthenticated remote execution vulnerability in D link DSL3788 routers allows attackers to gain full control remotely. The flaw was discovered by Max Belia of secure network BVTech. Potential risks include complete router takeover, network compromise and malware deployment. D Link has released a patched firmware version and urges users to update immediately to protect against exploitation. CISA and the FDA have warned US healthcare organizations to remove Contec CMS 8000 patient monitors due to severe security vulnerabilities that risk remote code execution and patient data leaks. The Chinese made device used in the US and EU contains a firmware backdoor that allows attackers to overwrite files, execute arbitrary code, and exfiltrate patient data. One of the flaws enables unauthorized remote control. A second exposes patient data by transmitting unencrypted information to a hard coded IP address. A third flaw allows out of bounds writes leading to remote code execution. These issues affect multiple firmware versions, including rebranded models like the EPSMED MN120. No patches exist, and CISA advises immediate removal from networks. Past vulnerabilities in the same device have also exposed serious security risks, but no known attacks have been reported yet. The General Services Administration has paused new federal contract awards, creating confusion among vendors and raising concerns about broader impacts. The Jan. 24 memo cites the need for new leadership to review acquisition strategies, but allows exceptions for emergency obligations and IT spending. The pause follows President Trump's freeze on federal funds, though some restrictions were lifted after state Medicaid websites went down. Despite concerns in the cybersecurity sector and experts believe the GSA pause won't cause long term harm. However, uncertainty about cybersecurity funding, especially given the administration's stance on agencies like cisa, could deter small vendors. Industry groups including the Professional Services Council have called for clearer guidance on contract spending. Meanwhile, the Department of Defense clarified that its contracts remain unaffected, ensuring that critical national security missions continue. Vendors are seeking clarity to avoid disruption in cybersecurity and other federal services. Coming up after the break, a fond farewell to a pair of N2K colleagues and the case of the disappearing government data. Stay with us.