Loading summary
Dave Bittner
You're listening to the Cyberwire network, powered by N2K. And now a brief message from our sponsor, DropZone AI. Is your SoC drowning in alerts with legitimate threats sitting in queues for hours or even days? The latest SANS SOC survey report reveals alert fatigue and limited automation are SOC Team's greatest barriers. Drop Zone AI, recognized by Gartner as a cool vendor, directly addresses these challenges through autonomous recursive reasoning investigations, quickly eliminating false positives, enriching context, and enabling analysts to prioritize real incidents faster. Take control of your alerts and investigations with Dropzone AI. Critical remote code execution vulnerabilities affect Kubernetes controllers Senior Trump administration officials allegedly used unsecured platforms for national security discussions. Even experts like Troy Hunt get phished. Google acknowledges user data loss, but doesn't explain it. Chinese hackers spent four years inside an Asian telecom firm. Snake Keylogger is a stealthy multi stage credential stealing malware. A cybercrime crackdown results in over 300 arrests across seven African countries, and the Pew Research center figures out how its online polling got slightly borked. Foreign March 25, 2025 I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. Great to have you with us. Wiz Research discovered four critical remote code execution vulnerabilities dubbed Ingress Nightmare in the Ingress nginx controller for kubernetes. These flaws allow unauthenticated attackers to inject malicious nginx configurations, leading to full cluster takeover and unauthorized access to all secrets across namespaces. The attack targets the Admission controller, which lacks authentication and is often exposed to the public Internet. With a CVSS score of 9.8, this issue affects at least 6,500 clusters, including Fortune 500 environments. Exploits use NGINX features like SSL engine to load malicious libraries. Mitigation includes patching to the latest versions, disabling or securing the Admission controller, and applying strict network policies. The research also highlights systemic security weaknesses in Kubernetes Admission controllers and calls for better hardening practices. A major national and cybersecurity concern surfaced after the Atlantic's editor in chief Jeffrey Goldberg, was accidentally added to a Signal Group chat involving senior Trump administration figures discussing potential airstrikes in Yemen. The encrypted messaging thread, believed authentic, included sensitive military details like weapons, targets and timing. Though Defense Secretary Pete Hegseth denied it was a war plan, Goldberg noted the chat mirrored Centcom's operational timeline and included high level coordination. The use of Signal a commercial unclassified app for such discussions raises alarms about secure communication practices. Goldberg exited the group after realizing it was likely real and no one noticed his presence. The White House confirmed it's reviewing the incident, underscoring risks of misrouted sensitive information and the vulnerabilities introduced when officials use unsecured platforms for national security discussions. Stay tuned for my discussion of this story with our policy expert Ben Yellen. Speaking of Signal, Mandiant warns that Russian hacking groups are exploiting Signal's Linked devices feature to secretly spy on encrypted chats. By tricking users into scanning malicious QR codes, attackers can add their own device to the victim's Signal account, receiving messages in real time without breaking encryption. Targets include military personnel, journalists and politicians. The technique has low detection risk and has been used in both remote fishing and battlefield operations. Mandiant urges users to audit linked devices and follow strong security practices. Security expert Troy Hunt fell for a convincing mailchimp phishing attack while jet lagged, resulting in the compromise of his account and the export of his 16,000 subscriber mailing list. The Phish, hosted on a spoofed Mailchimp site, tricked him into entering login credentials and a one time password. Moments later, attackers accessed his account from a New York IP and exported the list, which included both active and unsubscribed users, raising concerns about mailchimp's data retention practices. Hunt quickly changed his credentials and notified subscribers, but reflected on how fatigue and subtle social engineering contributed to the breach. He emphasized the limitations of 1 time password based 2fa and called for phishing resistant authentication like passkeys. The phishing site was disabled within hours. Hunt plans a deeper technical analysis and urges users to remain vigilant against sophisticated scams. Google says a technical issue caused the loss of Timeline data for some Google Maps users, possibly permanently. The Timeline feature tracks users location history and can include photos, creating a visual travel log. Users noticed missing data over the weekend, and Google confirmed the issue in emails. Those with encrypted backups can restore their data manually, but users without backups have lost it for good. Google hasn't detailed the cause or scope of the incident, but raising broader concerns about data resilience. Chinese state linked hackers, dubbed Weaver Ant, infiltrated an unnamed Asian telecom firm and remained undetected for over four years. According to incident response firm Signia. The hackers initially breached the network using compromised Zyzyl home routers and maintained persistence through a network of web shells, including the China Chopper tool. Weaver Ant used an orb network of hijacked routers and IoT devices to mask their activity and move laterally across systems. Their objective was long term espionage and data theft. Signia discovered the intrusion during a separate investigation and linked it to Chinese actors based on tools, working hours and targeted infrastructure. The attackers demonstrated high level sophistication using multiple custom tools and evasion techniques to stay hidden. Snake Keylogger is a stealthy multi stage credential stealing malware that uses malicious spam emails with deceptive disk image files to trick victims. The attached file mimics a business document, increasing the chance of user interaction. Once opened, it deploys an executable that initiates an infection chain, downloading and decrypting a hidden payload disguised as an MP3. The malware executes in memory via process hollowing, targeting installutil exe to evade detection. It harvests credentials from web browsers, email clients, FTP apps and WI fi settings, exfiltrating data to attacker controlled servers. Interpol coordinated a major international crackdown on cybercrime resulting in over 300 arrests across seven African countries between November and February. Authorities in Nigeria, South Africa, Zambia and others dismantled cross border cybercrime networks behind mobile banking, investment and messaging app scams which defrauded over 5,000 victims. Nigeria arrested 130 suspects, including 113 foreign nationals, some allegedly coerced into scams via human trafficking. South Africa disrupted a simbox fraud operation used in SMS phishing attacks, while Zambia arrested hackers targeting banking data through malicious links. Seized assets include vehicles and properties. Private cybersecurity firms like Kaspersky and Group IB supported the effort by analyzing malware and sharing data. Interpol cited Africa's growing cybercrime risks, with the region leading in average weekly cyber attacks per organization back in 2023. Coming up after the break, my conversation with Ben Yellen over the senior Trump administration officials using unsecured platforms for national security discussions and Q Research center figures out how its online polling got slightly forked. Stay with us. Do you know the status of your compliance controls right now? Like right now, we know that real time visibility is critical for security, but when it comes to our GRC programs we rely on point in time checks. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off.
Ben Yellen
Foreign.
Dave Bittner
Looking for a career where innovation meets impact? Vanguard's technology team is shaping the future of financial services by solving complex challenges with cutting edge solutions. Whether you're passionate about AI, cybersecurity or cloud computing, Vanguard offers a dynamic and collaborative environment where your ideas drive change. With career growth opportunities and a focus on work life balance, you'll have the flexibility to thrive both professionally and personally. Explore open cybersecurity and technology roles today@vanguard jobs.com and it is always my pleasure to welcome back to the show Ben Yellen. He is from the University of Maryland center for Health and Homeland Security and also my co host over on the Caveat podcast. Ben, welcome back.
Ben Yellen
Good to be with you again, Dave.
Dave Bittner
So earlier on today's Cyberwire, we were talking about this amazing story from the Atlantic about the Trump administration accidentally texting one of the Atlantic reporters war plans. Your initial hot take on this when you saw this story come across the wire?
Ben Yellen
Well, first my jaw dropped, right? And then my jaw dropped even further when I saw people who have security clearance or are involved in national security seeing their reaction and basically all of them saying, if I did this, I would have been fired, for starters. There could have been more severe consequences. So my first reaction is to look at the potential legal liability of the principals here. The person who accidentally included Jeffrey Goldberg, the journalist at the Atlantic, in this group chat about the attack on the Houthis in Yemen was Michael Waltz. And that potentially could be a violation of the Espionage act if he was reckless in discussing classified military information that could have caused harm to our troops and could have aided and abetted our enemies. That's the essence of the Espionage Act, Right. I don't think President Trump or his Justice Department would prosecute. Just this morning, as we're recording, the president reiterated that he has confidence in Michael Waltz, the national security advisor. And I take him at his word that there aren't gonna be consequences. That's just not the nature of this president or this Justice Department.
Dave Bittner
Right.
Ben Yellen
In terms of the merits of the case, I do think it's complicated. We saw this with the Hillary Clinton email case where the former FBI Director James Comey said that she had been extremely careless with her classified communications when she used a private email server. But he declined to prosecute, saying that when they've prosecuted these types of cases, there Usually has to be some type of clear intent that's evident. And it seems to me that this was just a very unfortunate accident. I don't know why Michael Waltz would have intended to have Jeffrey Goldberg involved in this conversation. I do think it was extreme recklessness, which, if you look at the letter of the law, you could be charged for extreme recklessness. But just the history of it, there generally has to be some intention. Like there was in the case of David Petraeus, former war general, when he discussed classified information with his mistress, who was writing a book and was prosecuted, although I think he agreed to a plea deal to avoid prison time. So that's one element of it. And then there's the Presidential Records Act. These communications are of the type that need to be preserved under the Presidential Records act to be housed in the National Archives. And Waltz himself put this group chat on the setting where the communications automatically would have been deleted after seven days. So technically that's illegal under the Presidential Records Act. Again, I do not think he's going to be subject to prosecution, just based on the nature of this President and this Justice Department and their lack of willingness to press charges against whom they consider their people. And I think they have the support of the Republican Party in this. Just looking at interviews I've seen with Republican senators and Republican Congressmen, many of them are saying this was a huge screw up, but we have to move on from it. Hopefully they've learned their lesson. And that seems to be the attitude that the party is taking right now.
Dave Bittner
The fact that, or I suppose more fairly stated, the assumption that if they're using signal, they're doing so on their personal devices, which are not secure devices, to be having these kinds of conversations. Is this a slap on the wrist kind of thing? Hey, don't do that anymore.
Ben Yellen
One would think so. There are ways to hold these types of communications. If you're in person, you do so in a scif, in a secure facility. If you're not, there are communications channels available for these types of conversations. There are going to be imminent foreign policy matters that come up when the National Security Advisor, the Director of National Intelligence, the Secretary of State, the Secretary of Defense are in different physical locations, and they do need a method to communicate candidly, but it should not be on their personal devices and it should not be on the signal application. So I think the lesson going forward for them is obviously, next time use a secure communications method, because this was extremely dangerous. Luckily, the person included in the conversation is a responsible journalist. He chose not to publish the Content that seemed to be the specific war plans for attacking the Houthis, like the time of the attack and the potential targets. He was responsible in withholding that information. But they might not be so lucky in the future. It could be another journalist who's more willing to share that information publicly, or it could be with an adversary of the United States and somebody who wishes to do us harm. So, yeah, that seems to me to be the obvious lesson going forward, to put it mildly.
Dave Bittner
Yeah, this seems to me to be so representative of where we are in this particular moment where you have something like this happen, that under any other circumstances, under any other administration, the folks involved would likely be fired or have to resign. And you have the folks from the opposing party, the Democrats, up in arms about this. And I think anyone concerned about, or anyone who studies national security, anyone who's ever had a security clearance, their jaws hit the floor and they're shouting from the rooftops about how serious this is. And yet on the other side, it's as if there's nothing to see here. Oh, we made a mistake. Let's move on. We promise we won't do it again. And the gulf between those two things, to me is really, again, representative of where we find ourselves. And it makes it so hard to navigate. I think. Do you think I'm on the money with that?
Ben Yellen
I think you're right about it. I mean, naturally, it should be the Democrats who are making a big stink about this publicly. They do not have agenda setting power. They can't schedule hearings in the House or the Senate because they're in the minority. Now, by coincidence, there happens to be a hearing about emerging national security threats, and many of the principals involved in the story are testifying. And it seems that they are using that hearing as an opportunity to ask some of these representatives what, what happened here. They do get, they do have the right to ask questions if these people happen to be at a hearing. But beyond that, I mean, they can demand an investigation, but they don't have any actual power to compel it. So I think they're in a weak political position. As long as members of the Republican Party in Congress stick together and stand by the president and say that this was an unfortunate accident, it doesn't merit further investigation. They've learned their lesson, which, at least at this early stage, seems to be the line. I think regardless of your political views, at the very least there should be some type of investigation here. I think if this were a different administration, you might see the Attorney General appoint a special counsel to investigate this, Somebody who isn't directly involved in the administration, who could draft a nonpartisan report, just giving the straight facts about what happened in the scenario and outlining some recommendations, but I don't anticipate that happening here.
Dave Bittner
Yeah. All right, well, if you would like to hear a more detailed discussion of this, do check out this week's Caveat podcast where Ben and I spend some more time on this topic. You can find that wherever you get your podcasts. In the meantime, Ben Yellen, thank you so much for dropping in with us here today. Always time well spent.
Ben Yellen
Always good to be with you, Dave. Thanks.
Dave Bittner
Is your AppSec program actually reducing risk? Developers and AppSec teams drown in critical alerts, yet 95% of fixes don't reduce real risk. Why? Traditional tools use generic prioritization and lack the ability to filter real threats from noise. High impact threats slip through and surface in production, costing 10 times more to fix. OX Security helps you focus on the 5% of issues that truly matter before they reach the cloud. Find out what risks deserve your attention in 2025. Download the application Security Benchmark from Aux Security. And finally, imagine taking a serious online survey, only to be asked forks or no. That's exactly what happened in a Pew Research center online poll, thanks to a wonderfully weird bug. Turns out a glitch triggered Google Chrome's Auto Translate, mistaking the English language survey for Spanish. Chrome then helpfully translated the word yes to Forks. This culinary chaos stemmed from a bizarre Google Translate quirk where yes in Spanish oddly becomes forks in English. Pew traced the issue, squashed some bugs with some HTML wizardry, and double checked that their data remained deliciously intact. Only 0.2% of users reported seeing the error, and no measurable impact was found on the results. Bonus weirdness. Chrome also thought Lean meant Red. Pew's now got safeguards in place so future surveys don't serve up accidental utensils. So yes, it was a strange ride, but no data or forks were harmed in the making of this research. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Hey, everybody. Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Deleteme. I have to say, delete me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Deleteme's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your DeleteMe plan when you go to JoinDeleteMe.com n2k and use promo code n2k at checkout. The only way to get 20% off is to go to JoinDeleteMe.com N2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.
CyberWire Daily – Episode Summary: "The Nightmare You Can’t Ignore"
Release Date: March 25, 2025
Host: Dave Bittner, N2K Networks
Wiz Research identified four severe remote code execution (RCE) vulnerabilities, collectively named Ingress Nightmare, affecting the Ingress NGINX controller for Kubernetes. These flaws permit unauthenticated attackers to inject malicious NGINX configurations, potentially leading to complete cluster takeover and unauthorized access to secrets across namespaces.
Impact:
Exploitation Techniques:
Mitigation Strategies:
Key Insight:
"These vulnerabilities highlight systemic security weaknesses in Kubernetes Admission controllers and call for better hardening practices."
(Timestamp: 02:15)
A significant national security breach occurred when Jeffrey Goldberg, editor-in-chief of The Atlantic, was mistakenly added to a Signal group chat containing senior Trump administration officials discussing potential airstrikes in Yemen.
Details:
Security Concerns:
Government Response:
Mandiant has issued a warning about Russian hacking groups leveraging Signal’s Linked Devices feature to clandestinely monitor encrypted chats.
Attack Methodology:
Targets:
Detection and Prevention:
Renowned security expert Troy Hunt experienced a successful phishing attack that compromised his Mailchimp account and exposed his 16,000 subscriber mailing list.
Attack Details:
Hunt’s Reflections:
Mitigation Steps:
Notable Quote:
"The phishing site was disabled within hours. Hunt plans a deeper technical analysis and urges users to remain vigilant against sophisticated scams."
(Timestamp: 08:45)
Google announced a technical issue that led to the loss of Timeline data for some Google Maps users, potentially permanently.
Affected Features:
User Impact:
Company Response:
State-linked Chinese hackers, operating under the moniker Weaver Ant, successfully infiltrated an unnamed Asian telecom firm for four years without detection.
Attack Vector:
Stealth Techniques:
Objective:
Detection and Attribution:
Key Insight:
"The attackers demonstrated high-level sophistication using multiple custom tools and evasion techniques to stay hidden."
(Timestamp: 10:20)
The Snake Keylogger is identified as a multi-stage credential-stealing malware employing advanced evasion tactics.
Infection Process:
Execution Techniques:
Data Harvested:
Interpol orchestrated a significant international operation leading to over 300 arrests across seven African countries between November and February.
Targeted Activities:
Country-Specific Actions:
Seized Assets:
Collaborative Efforts:
Significance:
"Interpol cited Africa's growing cybercrime risks, with the region leading in average weekly cyber attacks per organization back in 2023."
(Timestamp: 09:55)
Dave Bittner engages in a comprehensive conversation with Ben Yellen, from the University of Maryland Center for Health and Homeland Security, regarding the alarming incident where senior Trump administration officials inadvertently shared sensitive military plans in a Signal group chat.
Severity of the Incident:
Administrative Response:
Comparison to Past Cases:
Presidential Records Act Violation:
Political Implications:
Recommendations:
Notable Quotes:
"If I did this, I would have been fired, for starters."
(Ben Yellen, Timestamp: 13:20)
"This was extremely dangerous... they might not be so lucky in the future."
(Ben Yellen, Timestamp: 16:10)
"Regardless of your political views, at the very least there should be some type of investigation here."
(Ben Yellen, Timestamp: 19:15)
Conclusion:
In this episode of CyberWire Daily, Dave Bittner presents a comprehensive overview of pressing cybersecurity issues, ranging from critical vulnerabilities in widely-used platforms like Kubernetes to high-stakes breaches involving national security officials. The in-depth interview with Ben Yellen sheds light on the implications of unsecured communication channels within government bodies, highlighting systemic vulnerabilities and the pressing need for robust security protocols. Additionally, the episode covers significant malware threats, international cybercrime crackdowns, and data resilience challenges faced by major tech companies.
Notable Takeaways:
For a deeper dive into the discussion about the Signal group chat incident, listeners are encouraged to explore the accompanying Caveat podcast.
Stay Informed:
For more insights and updates on the latest in cybersecurity, visit CyberWire Daily, or subscribe to the podcast on your preferred platform.