Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. Hey everybody, Dave here. Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers, so I decided to try Deleteme. I have to say, DeleteMe is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data Privacy is protected. DeleteMe's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Deleteme now at a special discount for our listeners today. Get 20% off your delete me plan when you go to JoinDeleteMe.com N2K and use promo code N2K at checkout. The only way to get 20% off is to go to JoinDeleteMe.comN2K and enter code N2K at checkout. That's JoinDeleteMe.com N2k code N2K the latest cyber moves from the Trump White House Pompompurin faces resentencing an attack on a government IT contractor impacts Medicaid, child support and food assistance programs. Hell down ransomware targets unpatched Zyzyl firewalls Murdoch is a new mirai botnet variant. Cloudflare maps the DDoS landscape North Korea's Lazarus Group uses fake job interviews to deploy malware. Hackers are abusing Google Ads to spread Amos Stealer malware Pwn to own Automotive awards over $382,000 on its first day in our Certbite segment, Chris Hare and Steve Burnley take on a question from N2K's Agile Certified Practitioner Practice Test and NYC Restaurant Week tries to keep bots off the men.
Steve Burnley (2:25)
Foreign.
Dave Bittner (2:31)
It's Wednesday, January 22, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It is great to have you with us. On its first full day, the Trump administration terminated all advisory committee members within dhs, including those on the Cybersafety Review Board. This board was investigating Chinese state sponsored hacking group Salt Typhoon linked to breaches in several telecommunications Networks. In a Jan. 20 letter, acting DHS Secretary Benjamin Huffman cited resource misuse as the reason for the terminations. The Cybersafety Review Board, created under President Biden's 2021 cybersecurity executive order, included cybersecurity leaders from firms like Sentinel One as well as former Biden officials. While the board's future remains uncertain, the letter encouraged former members to reapply and emphasized a focus on advancing DHS priorities. TSA Administrator David Pokoski was ousted by the Trump administration on Monday. Appointed by Trump in 2017 and reappointed by Biden in 2022, Pokoski played a key role in strengthening US transportation cybersecurity after the 2021 Colonial Pipeline ransomware attack. His directives mandated incident reporting, response plans and cybersecurity standards, significantly improving compliance across pipelines, railways and aviation. Bukoski emphasized collaboration and urgency in countering cyber threats, citing growing concerns about adversarial nations like China and Russia. Meanwhile, President Donald Trump has issued a full pardon to Ross Ulbricht, the founder of Silk Road, a dark web marketplace for illegal drugs, hacking tools and stolen Goods. Convicted in 2015 on charges of drug trafficking, money laundering and computer hacking, Ulbricht had received two life sentences plus 40 years, prosecutors alleged. He also solicited murders for hire, though no evidence of killings emerged. Silk Road, which operated anonymously via Tor and Bitcoin, was shut down in 2013 after Ulbricht's arrest in a San Francisco library. Trump framed the pardon as a stand against government overreach, aligning with libertarians who championed Ulbricht's case. The controversial decision drew praise from Republican allies like Representative Thomas Massie, but reignited debate over the balance between privacy rights and crime enforcement online. Conor Bryan Fitzpatrick, founder of Breach Forums, a major dark web marketplace for stolen data, is set to be re sentenced after a federal appeals court vacated his initial 17 day sentence. Operating as Pompompurin, Fitzpatrick oversaw the sale of over 14 billion sensitive records, including Social Security numbers and banking details, earning approximately $698,000. Initially sentenced to time served due to his young age and autism diagnosis, the court deemed the punishment too lenient. Prosecutors argue for a harsher sentence aligned with federal guidelines emphasizing deterrence and public safety. The fourth Circuit Court of Appeals criticized the district court for prioritizing mitigating factors over the severity of Fitzpatrick's crimes. Legal experts expect a significantly longer prison time upon resentencing, potentially setting a precedent for handling severe cybercrime cases. Government IT contractor Conduent experienced a cyber attack that caused outages across several state government programs impacting services like Medicaid, child support and food assistance. A spokesperson confirmed a third party compromise but did not disclose whether ransomware or data theft was involved. The disruption lasted several days, delaying payment processing for beneficiaries in four states, including Wisconsin, where families struggled to make or receive payments. Conduent restored systems by Sunday and added staff to expedite backlogs. The company emphasized its commitment to system integrity, supporting around 100 million US residents and disbursing $100 billion in government payments annually. This incident follows Conduent's history with ransomware, notably a 2020 attack. A new ransomware threat called Helldown is exploiting a critical vulnerability in Zyzyl firewall devices, particularly those using IPsec VPNs. This flaw, with a CVSS score of 7.5, enables attackers to gain unauthorized access via crafted URLs. Helldown targets both Windows and Linux systems, with Windows attacks derived from Lockbit 3.0 and Linux variants focused on VMware ESXi servers. Employing a double extortion strategy, the group has claimed at least 31 victims since August 2024, primarily small and medium sized businesses in the US and Europe. Despite Zyzyl's release of firmware patches in September of last year, some organizations remain vulnerable due to poor security hygiene, such as unchanged passwords and unchecked malicious accounts. The Murdoch botnet, a new Mirai variant, targets vulnerabilities in AvTech IP cameras and Huawei HG532 routers, exploiting a pair of CVEs to compromise IoT devices. Active since July 2024, it has infected over 1300 systems, primarily in Malaysia, Thailand, Mexico and Indonesia, with over 100 servers distributing malware, researchers found. The botnet uses command line injections to deploy payloads, leveraging compromised devices to propagate through C2 servers. Cloudflare's 20th DDoS Threat Report highlights the evolving landscape of distributed denial of service attacks in 2024. The company blocked 21.3 million attacks last year, a 53% increase from 2023, with an average of 4870 attacks per hour. Hypervolumetric network layer attacks grew 1885% quarter over quarter, with a record breaking 5.6 terabits per second attack in the fourth quarter. HTTP DDoS attacks comprised 51% of incidents, with 73% launched by botnets, often spoofing legitimate browsers or using suspicious attributes. Key attack vectors include SYN floods and DNS floods. Indonesia was the largest attack source, while China, the Philippines and Taiwan were the most targeted countries. Industries like telecommunications and Internet services face the most attacks. The North Korean APT Lazarus Group has launched a sophisticated campaign, Contagious Interview or Dev Popper, targeting technology, financial and cryptocurrency sectors using fake job interviews. They deploy malware like Beavertail and Invisible Ferret to compromise systems and exfiltrate sensitive data. Invisible Ferret, a python based malware, steals cryptocurrency wallets, source code, credentials and more using FTP, encrypted connections and Telegram for data exfiltration. The campaign exploits social engineering and malicious coding challenges to lure software developers demonstrating advanced tactics in cyber espionage. Hackers are abusing Google Ads to spread amostealer malware targeting macOS and Linux users through a fake homebrew website. Homebrew, a popular open source package manager, allows users to install and manage software via the command line. A malicious ad displayed the correct URL brew sh, but redirected users to a fake site where they were tricked into running commands that installed malware. Amostealer sold for $1,000 a month, steals credentials, browser data and cryptocurrency wallets. Homebrews leader Mike McQuaid criticized Google's inadequate ad scrutiny, noting this is a recurring issue. Though the ad was removed, similar campaigns may resurface to minimize risks, users should verify URLs, avoid clicking on ads and bookmark trusted websites. This incident highlights the dangers of malicious ads and the importance of caution when downloading software. Trend Micro's Zero Day initiative launched PWN to own Automotive 2025 in Tokyo, awarding $382,750 on the first day for 16 Zero Day exploits targeting infotainment systems, EV chargers and automotive operating systems. Top rewards included $50,000 each for exploits on Autel and Ubiquiti chargers, while a ChargePoint charger exploit earned $47,500. Participants also received $20,000 for hacking Alpine, Kenwood and Sony infotainment systems. Nearly two dozen more attempts are planned. Coming up after the break on our CERT byte segment, Chris Hare and Steven Burnley take on a question from N2K's Agile certified practitioner Practice Test and NYC Restaurant Week tries to keep the bots off the menu. Stay with us.