Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K and now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire adversary nations are using click fix in cyber espionage campaigns. Japan's Financial Services Agency issues an urgent warning after hundreds of millions in unauthorized trades, the critical Erlang OTP SSH vulnerability now has public exploits A flawed rollout of a new Microsoft Entre app triggers widespread account lockdown. The alleged operator of smoke loader malware faces federal hacking charges. A new scam blends social engineering, malware and NFC tech to drain bank accounts. GSA employees may have been oversharing sensitive documents. Our guest is Yoni Shohed, co founder and CEO of Valence Security, who cautions financial organizations of coming Chinese open source AI and crosswalks in the crosshairs of satirical hacking.
Yoni Shohed (2:02)
Foreign.
Dave Bittner (2:08)
It's Monday, April 21, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us. Happy Monday. It's great to have you with us. Government backed hackers from North Korea, Iran and Russia are now using a technique called click fix in cyber espionage campaigns. According to proofpoint, this method tricks users into running malicious commands by displaying fake error messages or security alerts. Victims believe they're fixing a problem, but instead activate malware. North Korea's TA427 used ClickFix in early 2025 to target think tanks via fake meeting invites. Iran's TA450 deployed it in late 2024 against Middle Eastern financial and government sectors through bogus Microsoft email Updates. Russian group TA4.22 and UNK remote rogue also used it in phishing campaigns. While not replacing all attack methods, QlikFix is being used to streamline infection steps. Proofpoint notes that Chinese hackers haven't used ClickFix yet, but its growing use signals a rising trend among state backed groups. In spring of 2024, Russian linked hackers breached water plants in rural Texas, including in mule shoe triggering system malfunctions. While no ransom was demanded. The attack highlighted critical infrastructure vulnerabilities, an urgent concern for cybersecurity professionals. These incidents weren't isolated, experts say. They represent a growing state backed actors probing US Systems to test digital defenses. Similar threats include China's Volt Typhoon and Salt typhoon campaigns, which targeted telecom networks and government communications for long term espionage. Despite this rising threat landscape, the US has weakened cyber defenses under the Trump administration, firing NSA leadership, cutting election security budgets and slashing cybersecurity staff. Some say the cybersecurity workforce gap remains a pressing issue, with over half a million professionals needed, while others are skeptical that the so called gap even exists. Either way, as global tensions escalate and adversaries cooperate digitally, cyber professionals must prepare for more complex, persistent and politically motivated attacks. Japan's Financial Services Agency has issued an urgent warning after hackers conducted over $665 million in unauthorized trades via compromised brokerage accounts. Using phishing sites posing as legitimate firms, attackers stole customer credentials to access and manipulate accounts, often selling Japanese stocks to purchase Chinese ones, which remain in the victims accounts. At least 12 security firms, including Nomura and Rakuten, reported over 1,400 fraudulent trades and over 3,300 illegal access attempts. Brokerages will cover customer losses. Japan links rising threats to China backed cyber attacks. The critical vulnerability in Erlang OTP's SSH daemon now has public exploits, putting thousands of systems at risk. The flaw allows unauthenticated remote code execution and affects all devices using the daemon. Although patched in recent versions, many systems, especially in telecom and database infrastructure, remain unpatched. Proof of concept Exploits were recently shared on GitHub and Pastebin, raising the risk of mass exploitation. Security experts urge immediate updates as attackers are expected to begin scanning and exploiting vulnerable systems. A flawed rollout of Microsoft's Entra ID's new Mace credential revocation app has triggered widespread false positive alerts and account lockouts across organizations. Admins reported that up to one third of accounts were locked due to supposed leaked credentials, though the passwords were unique and protected by mfa, no signs of compromise were found and breach checks showed no matches. The issue appears tied to Mace's sudden deployment. Microsoft has yet to officially confirm the cause. Nicholas Moses, also known as Scrublord, is facing federal hacking charges in Vermont for allegedly operating the Smoke Loader malware stealing personal data from over 65,000 victims worldwide. Prosecutors say Moses used the malware to harvest passwords and sensitive information from infected devices between January 2022 and May 2023. Maintaining a command server in the Netherlands he allegedly sold stolen credentials for a dollar to $5 each and claimed to have over half a million logs. Smokeloader, a malware strain active since 2011, is popular among Russian cybercriminals for its modular design and ability to perform various attacks. Moses case follows Europol's Operation Endgame, which recently targeted major malware droppers, including Smokeloader. Authorities continue to investigate and arrest individuals linked to the botnet's distribution and resale operations. A new scam blending social engineering, malware and NFC tech is targeting Android users and their payment cards. Researchers at kleefi report dubbed SuperCardX the malware tricks victims via fake bank fraud alerts, urging them to call a number where scammers then collect pins and convince users to remove card limits. Victims are later prompted to place their card near their infected device. The malware then uses NFC to silently capture card data, enabling instant theft outside traditional bank fraud channels. SuperCard X is linked to a malware as a service model operated by Chinese speaking developers but used by different groups globally. Unlike past scams targeting specific banks, this campaign targets any debit or credit card. Authorities warn such NFC based fraud is growing and may appear in more regions soon. Internal records reviewed by the Washington Post reveal that General Services Administration employees under both the Biden and Trump administrations improperly shared sensitive files, including White House blueprints and vendor banking details, with over 11,000 federal workers. The documents, stored in a Google Drive folder, included at least nine files marked controlled unclassified information, which, while not classified, still require protection. Some files allowed editing access. The oversharing, ongoing since 2021, triggered a cybersecurity investigation last week. The breach included sensitive plans for the White House's east and west wings and details for a proposed blast door. Though not necessarily classified, experts say such data should be tightly secured. The GSA has annual security training and scanning tools, but the incident highlights systemic weaknesses in document handling across administrations. Coming up after the break, my conversation with Yoni Shohed, co founder and CEO of Valence Security, who cautions financial organizations of coming Chinese open source AI and crosswalks in the crosshairs of satirical hacking. Stay with us. What's the common denominator in security incidents? Escalations and lateral movement. When a privileged account is compromised, attackers can seize control of critical assets with bad directory hygiene and years of technical debt. Identity attack paths are easy targets for threat actors to exploit, but hard for defenders to detect. This poses risk in active directory, entra ID and hybrid configurations. Identity leaders are reducing such risks. With attack path management, you can learn how attack path management is connecting identity and security teams while reducing risk with Bloodhound Enterprise powered by Spectrops. Head to SpectorOps IO today to learn more. Spectrops see your attack paths the way adversaries do. Do you know the status of your compliance controls right now? Right now we know that real time visibility is critical for security, but when it comes to our GRC programs we rely on point in time checks. But get this, more than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks like SoC2 and ISO 27001. They also centralize key workflows like policies, access reviews and reporting, and helps you get security questionnaires done five times faster with AI. Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com cyber that's vanta.com cyber for $1,000 off Yoni Shohet is co founder and CEO of Valence Security. I recently got together with him to discuss financial organizations being wary of coming Chinese open source AI.