Transcript
Dave Buettner (0:02)
You're listening to the Cyberwire network powered by N2K. Now a word about our sponsor, the Johns Hopkins University Information Security Institute. The JHU ISI is home to world class interdisciplinary experts dedicated to developing technologies to protect the world's vast online systems and infrastructure and working closely with US Government research agencies and industry partners. The Institute offers dual degree and joint programs in computer science and health informatics and has been designated as a Center of Academic Excellence in Cyber Research. Learn more at isijhu.edu a major cybercrime crackdown by Interpol nabs hundreds of suspects and millions in stolen funds Zabbix has disclosed a critical SQL injection vulnerability. A novel phishing campaign exploits Microsoft Word's file recovery feature. Researchers track the Rockstar 2 FA phishing toolkit. Critical vulnerabilities are found in Advantech's industrial wireless access points. North Korea's Kim Suki hacking group shifts their tactics. The UN forms an advisory body to address growing threats to critical undersea cable infrastructure. The UK is laser focused on AI security research. Russian authorities arrest the Wazawaka ransomware affiliate. Our guest is Marshall Heilman, CEO of dtech Systems, sharing his experience with a nation state actor's attempt to gain employment at his company and OpenAI opens the door for incredification. It's Monday, December 2, 2024. I'm Dave Buettner and this is your Cyberwire Intel Briefing. Good day and Happy Monday to you all. If you are here in the US I hope you had a relaxing Thanksgiving break. It's good to be back. An international cybercrime crackdown led by Interpol targeted cyber enabled fraud across 40 countries between July and November of this year. Operation Hikey 5 resulted in over 5,500 arrests and the seizure of $400 million in stolen funds encompassing virtual assets and government backed currencies. It focused on crimes such as voice phishing, romance scams, online sextortion, investment fraud, illegal gambling, business email compromise and e commerce fraud. A notable achievement occurred in East Asia where South Korean and Chinese authorities dismantled a voice phishing network linked to $1.1 billion in losses. The scammers impersonating police victimized over 1900 individuals, leading to 27 arrests. In another high profile case, Singaporean police intercepted $39.3 million of a $42.3 million sum stolen through business email compromise. Seven suspects were apprehended and $2.6 million in additional funds recovered. Key to these successes was Interpol's Global Rapid Intervention of Payments initiative, enabling swift action to halt stolen funds in transit. This operation, supported by the South Korean government, is the fifth in the Hikey series, achieving record results compared to the previous operation, including nearly double the number of solved cases and tripling the blocked virtual asset accounts. Interpol's Secretary General emphasized the importance of international cooperation in combating the borderless threat of cybercrime, highlighting the devastating impacts on individuals and businesses alike. Open Source Enterprise Network monitoring solution Zabbix has disclosed a critical SQL injection vulnerability exploitable by non admin users with API access. It allows attackers to escalate privileges and Compromise systems. Over 83,000 Internet exposed servers are at risk. Patches were released in July and users should update immediately. No active exploitation has been reported. A novel phishing campaign exploits Microsoft Word's file recovery feature by using intentionally corrupted Word documents to bypass email security software. These attachments, disguised as HR or payroll related files, evade detection due to their damaged state but remain recoverable by Word. Once opened, the document prompts users to recover the file displaying a phishing message instructing them to scan a QR code which redirects to a fake Microsoft login page to steal credentials. The campaign, identified by any run, embeds base64 encoded strings and file names to obfuscate intent. The attachments lack malicious code, helping them avoid antivirus detection. On platforms like VirusTotal, recipients are urged to remain vigilant, delete suspicious emails, and confirm unexpected messages with administrators. To avoid falling victim to this tactic, researchers from Trustwave have linked the advanced phishing toolkit Rockstar2FA to a rise in adversary in the middle phishing attacks targeting Microsoft 365 users. This toolkit creates fake login pages to harvest credentials and bypass multifactor authentication using adversary in the middle techniques to intercept session cookies. Campaigns have escalated since August of this year, leveraging car themed web pages and domains with over 5,000 hits since May. Rockstar2FA, a phishing kit offered as a service for $200, features two FA Bypass Anti Bot protections, randomized codes, and telegram bot integration, making it attractive to cybercriminals. Phishing emails use themes like HR alerts, document sharing, and MFA lures, often evading detection by exploiting trusted platforms and obfuscation methods. Experts warn these cost effective kits enable credential theft, account takeovers and business email compromise. Researchers at Nozomi Networks Labs identified 20 critical vulnerabilities in Advantech's industrial wireless access points, widely used in critical infrastructure. The flaws allow remote code execution with root privileges and denial of service attacks. Even without authentication, vulnerabilities also enable lateral movement across networks and exploit wireless data packet management scripts. Firmware updates have been released to address the issues. South Korean researchers have uncovered a shift in the tactics of the North Korean hacking group Kim Suki, which now employs malware less phishing attacks to evade endpoint detection and response systems. These attacks focus on researchers and organizations studying North Korea using phishing emails that impersonate entities such as financial institutions and public agencies. A notable change is Kim Suki's switch from Japanese to Russian email services, making their campaigns harder to detect. They also leverage domains from free Korean registration services and fabricate phishing sites using themes tied to financial matters. These phishing Attempts often include URLs without malware, making them harder to flag as threats. The United nations, alongside the International Telecommunication Union and the International Cable Protection Committee, has formed the International Advisory Body for Submarine Cable Resilience to address growing threats to critical undersea cable infrastructure. Submarine cables handle over 99% of global data exchanges, making their security vital. The advisory body will focus on enhancing cable protection, promoting best practices and ensuring timely repairs. The initiative follows recent incidents, including damage to cables connecting Finland, Germany, Sweden and Lithuania under investigation for possible sabotage. The ICPC reports 150 to 200 annual cable damage incidents, mainly from ship anchors, fishing or natural disasters necessitating weekly repairs. The 40 member body, co chaired by Nigeria and Portugal, will meet twice annually, working with industry experts. The US has also launched projects to bolster cable security, including partnerships with Pacific island nations. The UK has launched the Laboratory for AI Security Research Laser, or maybe I should say Laboratory to combat nation state cyber threats, particularly from adversaries like Russia. Initially funded with $10.3 million from the government, the lab expects additional support from private sector partners. LASER aims to harness artificial intelligence to bolster cybersecurity and intelligence capabilities, collaborating with organizations like gchq, the Alan Turing Institute and top universities such as Oxford and Queen's University Belfast. The lab also seeks international partnerships, including with NATO and Five Eyes allies. Chancellor Pat McFadden highlighted AI's dual role in amplifying cyber threats and enabling advanced defense tools. Laser's creation reflects the UK's commitment to addressing emerging AI driven cyber challenges as part of a broader global strategy. Russian authorities have reportedly arrested Mikhail Matveev, also known as Wazawaka, a high profile ransomware affiliate linked to groups like Babuk, Conti, Darkside, Hive and Lockbit. Matveev faces charges under Russia's Article 273 for creating malware to extort commercial organizations by encrypting data and demanding ransomware. If convicted, he could face up to four years in prison or fines. MeTV, indicted by the US in 2023 and offered a $10 million bounty by the State Department, allegedly participated in major attacks, including the 2021 ransomware attack on Washington, D.C. s Metropolitan Police Department. Despite his crimes, he previously claimed to live freely in Russia. Russia rarely prosecutes domestic hackers, especially those targeting foreign entities, but recent arrests, including members of Revil and Sugar Locker, suggest a possible shift in strategy. I can't resist putting this out there. Waza Waka, a Russian threat actor. I mean, we've gotta go with Fozzie Bear, right?