Loading summary
Transcript49 lines
- [00:02]
Dave Bittner
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire Operation Endgame dismantles cybercriminal infrastructure Doge's use of the Grok AI chatbot raises ethical and privacy concerns. Malware on the NPM registry uses malicious packages to quietly gather intelligence on developer environments. Researchers link Carito malware to the Spanish government, exploring proactive operations via letters of Mark. Hackers hesitate to attend the HOPE conference over travel concerns. Our guest is Jeffrey Wheatman, cyber risk expert at Black Kite, warning us to beware the silent breach and AI threatens to spill secrets to save itself. It's Friday, May 23rd, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us and happy Friday. It's great to have you with us. Law enforcement agencies worldwide, coordinated by Europol and Eurojust, have struck a major blow against cybercriminals by dismantling infrastructure behind several key malware strains used in ransomware attacks. The latest phase of Operation Endgame. The effort disabled initial access malware like Quackbot, Trickbot and Bumblebee tools criminals used to sneak into systems before launching full scale attacks. The operation seized over 21.2 million euros, including three and a half million euros in cryptocurrency and led to international arrest warrants for 20 suspects. This builds on May 2024's historic botnet takedowns showing law enforcement's growing ability to adapt as criminals evolve. A Europol led command post in the Hague coordinated actions across Canada, the US, the UK and multiple EU countries, with key suspects now on the EU's most wanted list and further actions planned. Operation Endgame underscores a shift in strategy targeting cybercrime at the entry Point. The U.S. justice Department has indicted Rustam Rafaelovich Gallyamov, a Russian national accused of masterminding the Quackbot malware and leading a global ransomware campaign for over a decade. Gallyamov allegedly built a massive botnet by infecting over 700,000 devices, then granted ransomware gangs access to deploy attacks, sharing in the profits. This move is part of Operation Duck Hunt, which dismantled Quackbot in 2023. Despite that, Gallyamov's group continued attacks using spam bot tactics. Authorities also seized $24 million in cryptocurrency. Since 2022, Russian military intelligence group APT28, also known as Fancy Bear, has been targeting Western military transport and IT sectors in cyberattacks aimed at disrupting aid to Ukraine. These state sponsored operations have struck airports, logistic firms, maritime systems and air traffic control. They've even hacked security cameras at sensitive locations like Ukraine's borders and military sites to monitor aid movements. A joint advisory from the NSA, CISA and FBI confirms APT28's role, highlighting their use of spear phishing, brute force and CVE exploitation to gain access to evade detection. The group used compromised home office devices near targets to route traffic for deeper infiltration. APT28 used native and open source tools to extract active directory data and Office365 email lists. Intelligence agencies have now publicized APT28's tactics in an effort to hinder future attacks. Targets include several European countries, Ukraine and the U.S. elon Musk's Department of Government Efficiency Doge is reportedly using his AI chatbot Grok, within the US Federal government to analyze data, potentially violating conflict of interest and privacy laws, Reuters reports. According to insiders, Doge has accessed sensitive federal databases and even encouraged Department of Homeland Security staff to use Grok without formal approval. Experts warn this could expose confidential data and give Musk's AI unfair access to federal contracting information, raising ethical concerns. Doge's actions include promoting AI tools to streamline government work, but also allegedly monitoring employee behavior and political alignment, raising alarms about civil liberties and misuse of power. While DHS and DoD denied pushing Grok or monitoring for political views, concerns persist over Doge's reach, oversight and the possibility that Musk could profit from federal AI use. Critics argue this blurs the line between public service and private gain, casting doubt on the integrity of federal tech policy. A new malware campaign on the NPM Registry is using malicious packages to quietly gather intelligence on developer environments, aiming to map internal networks and link them to public infrastructure. The NPM Registry is a public collection of JavaScript software packages used primarily with the Node JS runtime environment. Researchers at Socket uncovered at least 60 infected packages spread through three npm accounts downloaded over 3,000 times. These packages use post install scripts to run host fingerprinting code and exfiltrate data via a shared discord webhook. This intelligence can aid future more targeted supply chain attacks. Despite the current payload being limited to reconnaissance, the threat remains active with the potential for expanded attacks. Experts urge developers to enhance security by scanning dependencies, detecting post install hooks and scrutinizing small or unfamiliar packages. Without stricter registry controls, similar campaigns are likely to persist, posing ongoing risks to the software supply chain. More than a decade ago, Kaspersky uncovered a highly advanced Spanish speaking hacking group dubbed Carito, which is ugly face or mask in Spanish, after investigating suspicious malware targeting the Cuban government. Although Kaspersky never officially named a sponsor, multiple former employees confirmed, the researchers internally concluded that Carreto was a Spanish government operation. Carreto's malware was stealthy and sophisticated, capable of spying on sensitive data like conversations, keystrokes and encrypted information. The group targeted victims in at least 31 countries, with Cuba being a key focus due to Spanish geopolitical interests, including the presence of ETA members. Despite going dark after Kaspersky's 2014 expose, Carito resurfaced in 2024 with new attacks in Latin America and Africa using similar tactics. Analysts now rank Kireto among elite government backed cyber actors. Likening its precision to master craftsmanship, the group's continued operations reflect its resilience and the growing complexity of state level cyber espionage. U.S. officials and tech leaders are revisiting the centuries old concept of letters of marque once used to authorize private pirate ships to explore whether similar legal tools could let private firms conduct cyber attacks on behalf of of the government. While the original maritime authority doesn't directly translate to cyberspace, some see a modern version as a way to counter China's substantial cyber capabilities. The Trump administration and industry players have discussed granting select companies legal cover to hack back against adversaries, but concerns persist about regulation, liability and potential misuse. Critics argue that offensive operations should remain with U.S. cyber Command and the NSA, not private actors. Still, proponents believe a well regulated framework could bolster national defense against non state hackers or hostile nations. The idea underscores growing frustration over reactive cyber policies and a push for proactive public private cyber defense strategies. But any such plan would require cautious legal and ethical scrutiny. The long running Hope Conference Hope Stands for Hackers on Planet Earth is facing a steep drop in ticket sales, down 50% from last year, which organizers attribute to fears over U.S. immigration policies under the Trump administration. International attendees have expressed concerns about harassment, detainment and and electronic device seizures at the border One speaker, hacker Thomas Kranz, withdrew after friends were detained and had their electronics confiscated en route to another U.S. conference. Hope, which typically attracts around a thousand participants, may need to reduce its venue space to stay within budget. Despite the challenges, organizers confirmed the event will proceed with support from the ACLU and eff, offering travel guidance for international guests. A virtual ticket option remains available. Hope will take place Aug. 15 through the 17th at St. John's University in New York, continuing its tradition of tech activism and hacker culture. Coming up after the break, my conversation with Jeffrey Wheatman, cyber risk expert at Black Kite. We're discussing the silent breach and AI threatens to spill Secrets to save itself. Stay with us.
- [12:25]
Vanta
Compliance regulations, third party risk and customer security demands are all growing and changing fast. Is your manual GRC program actually slowing you down? If you've ever found yourself drowning in spreadsheets, chasing down screenshots or wrangling manual processes just to keep your GRC program on track, you're not alone. But let's be clear. There is a better way. Vanta's Trust management platform takes the headache out of governance, risk and compliance. It automates the essentials from internal and third party risk to consumer trust, making your security posture stronger. Yes, even helping to drive revenue. And this isn't just nice to have. According to a recent analysis from IDC, teams using Vanta saw a 129% boost in productivity. That's not a typo, that's real impact.
- [13:20]
Dave Bittner
So if you're ready to trade in.
- [13:22]
Vanta
Chaos for clarity, check out Vanta and bring some serious efficiency to your GRC game. Vanta GRC how much easier trust can be? Get started@vanta.com Cyber.
- [13:43]
Dave Bittner
Worried about cyber attacks? Cyber Care from Storm Guidance is a comprehensive cyber incident response and resilience service that helps you stay prepared and protected. A unique onboarding process integrates your team with industry leading experts so if an incident occurs, your response is optimal. Get priority access to deeply experienced responders, digital investigators, legal and crisis PR experts, ransom negotiators, trauma counselors, and much more. The best part? 100% of unused response time can be repurposed for a range of proactive resilience activities. Find out more at Cyber Care Cyberwire. Jeffrey Wietman is cyber risk expert at Black Kite. I recently caught up with him at the RSA conference for this sponsored Industry Voices discussion. Beware the Silent Breach and here we.
- [14:51]
Jeffrey Wheatman
Are at RSAC 2025. Joining me is Jeffrey Wheatman. He is from Black Kite. Jeffrey, thank you so much for taking the time for us Today.
- [14:59]
Thomas Kranz
Oh my God, Dave, thank you so much for having me. We've spoken before, but never actually in person.
- [15:05]
Jeffrey Wheatman
That's the great thing about being here, right? We finally get to meet people. Especially after Covid, who we've only met online or on Zoom or things like that.
- [15:13]
Thomas Kranz
I gotta tell you, you're taller than you look.
- [15:15]
Jeffrey Wheatman
I don't get that very often. I don't get that very often. Well, before we dig in here, let's get some impressions about the conference from you. What's your sense of the buzz this year?
- [15:29]
Thomas Kranz
So clearly AI, right? AI. I don't know, Maybe. Maybe you folks who are not AI is a new technology, apparently that's going to solve all of our problems. Right. So I think AI is the thing. I feel like we are starting to see a little bit of shift around sort of third party and kind of like ecosystem risk. I think everyone realized they are not an island unto themselves. I also think it's very noisy here. I feel spiritually assaulted when I come here. I just feel overwhelmed. But you know what? For me, this event is more about meeting people than it is necessarily about seeing the content. And I've seen some great presentations and I'm sure I'll see some more and. But more about seeing friends.
- [16:16]
Jeffrey Wheatman
I. I think it's a great point and just, you know, like a RSA conference pro tip. On the third floor of this building, there is a designated quiet room.
- [16:25]
Dave Bittner
Oh.
- [16:26]
Jeffrey Wheatman
So if you need to recharge, you need to get your breath, you need to get away from the buzz, RSA has your back.
- [16:32]
Thomas Kranz
All right. I. I definitely need that quiet room because we're staying in a hotel like about a 10 minute walk.
- [16:37]
Jeffrey Wheatman
Yeah.
- [16:37]
Thomas Kranz
So I can't really go back to my hotel between sessions. All right, I'll have to track that down.
- [16:41]
Jeffrey Wheatman
Well, let's dig into the topic at hand here. For folks who are not familiar with Black Kite, tell us about what you all do.
- [16:48]
Thomas Kranz
Yeah. So Black Kite is a third party risk intelligence platform. We gather a tremendous amount of data, we pump it through some algorithms that we've created and we help make third party risk management bigger, better, faster, more so. We support better decision making, we give people more defensibility, we help them understand what their cyber risk exposures are in their supply chain, whether it's digital or physical. Supply chain.
- [17:16]
Jeffrey Wheatman
You talk about this notion of the silent breach that security professionals need to be careful of the silent breach. Unpack that for me.
- [17:26]
Thomas Kranz
Yeah, so it's something that we've been dealing with for a long time, but I think it's starting to sort of bubble up as an actual real problem problem. So I may choose to do business with you, Dave, and I may know what you do for cyber, but I don't necessarily know what your partners do for cyber. I don't know what their partners do, I don't know what software you're running, I don't know what software all of you are running. All of that has an impact on me. And when we have situations like CrowdStrike, and I'm not necessarily calling anybody out, but how many people out there knew that CrowdStrike was going to have a huge impact on their ability to do business? And the answer is very few. So what we are seeing is new software vulnerabilities, new zero days, new proof of concept, new kevs that are being revealed that are sitting at different places in your environment. And unless you know they are there when they pop, you have financial impact, you have resilience impact. Your data gets lost and not protected properly and you get caught silently, you get caught unawares. And that is a big risk that people are not really paying enough attention to. But we're starting to see people ask better questions about it and that's really what we're talking about. Do you know where your exposures are and most people don't?
- [18:46]
Jeffrey Wheatman
What are the questions they should be asking?
- [18:49]
Thomas Kranz
So some questions like do you have a policy in place to govern how you use AI? Right, we talked about AI. If you don't know that it's in your vendors and something happens, you get caught flat footed. You may want to ask, do you have a policy or governance in place that says you won't put more than 80% of your business operations in one provider? We may do that. But if all of our partners are putting all of their stuff with Phil and whoever and there's an outage, everybody goes down. We actually just recently saw power outage in the EU that cascaded and the entire EU went down. So those are the kinds of things we need to understand. And then when we know where our exposures come from, then we need to understand what they are. So I'll just, I'll give you an example. We did a lunch when CrowdStrike was still new and I said, hey, how many of you send out questionnaires to your vendors? And everybody said, oh, we do. And I said, how many of you are asking if you're using an mdr? And everybody said, oh, we do. And I said, how many of you are asking what mdr? You use Crickets I said, would it be helpful for you to know that? And they all said, yes. So ask questions. What are you using to provide this critical service? We can't necessarily tell you not to do business with those companies, but at least we know where the exposure might come from. And then we can get ahead of the curve and we can be more kind of left of boom, looking for those single points of failure, and then right of boom, doing something about them and, and being able to recover when bad stuff happens because you can't stop everything. So when the bad things happen, what do you do to get back up to no good state of operations? And that's really what you can do to help address those risks.
- [20:34]
Jeffrey Wheatman
I have a great amount of empathy for the CISO who's trying to get their hands around this, because the way I picture it in my mind is kind of like a family tree. You know, where you start and then you have your parents and maybe your siblings and. But it doesn't take very long to go up that tree. For all it's a bush, you know, like it is. There's so many different interconnections. And I feel that that's the way it is with a lot of people in cybersecurity. Like, how do I know how far up the tree I need to go, you know, before something's going to affect how do I calculate or quantify that risk? What are your insights on that of for the person who's trying to get their arms around the breadth of this problem?
- [21:19]
Thomas Kranz
I am a big proponent of the old adage, how do you eat an elephant one bite at a time, right? And we get people coming to us all the time. Hey, can you help us manage our fourth parties? We can, but here's my question for you. How good a job are you doing managing your third parties? And most people are not. So I think we need to look at the biggest exposures in front of front of us and get a handle on that. And the reality is the risks from your third parties are going to be more than from your fourth parties and your fifth parties. So let's focus on the big ticket items and then using concepts like concentration risk and cascading risk, which is understanding how many of your partners are also using this other vendor and understanding that and then being able to look for fallbacks and failovers, look for single point or dual points of failure, where if this vendor goes down, we're going to be hit in a lot of different directions. And I mean, you're spot on, Dave. It is a Magnification problem. Right. For those of you out there my age, you remember there was an old shampoo commercial, you tell two friends and they tell two friends, and so on and so on.
- [22:27]
Jeffrey Wheatman
Right, Exactly.
- [22:28]
Thomas Kranz
But if you can't control what you tell those first two friends, everything else is sort of a waste of time and energy. So let's focus on the stuff that we have direct visibility into. Let's focus on the stuff that we have direct control over. And then when we feel comfortable, we can start going out sort of an extra step. And then the other sort of complicating factor these days is there's a regulatory environment now that is requiring insight into nth party risk. And we say nth party, that's third party, fourth party, fifth party, et cetera. Now, the farther out you go, the less each individual entity has an impact on your risk. But there are so many more of them. So we end up with this kind of multiplicator. And if you think about the concept of like a power law, there may be less of them, but because there are big risks associated, or there may be a ton of them and very small risks associated, and we got to figure out sort of how to balance that out, it's not an easy problem to solve.
- [23:27]
Jeffrey Wheatman
Well, staying with that notion of the breadth of it, how do you keep from getting bogged down in it? How do you keep from feeling like you're slogging through a pool of molasses or something because there's so many things you naturally feel like you want to.
- [23:44]
Dave Bittner
Keep your eye on?
- [23:46]
Thomas Kranz
Yes, that's a great question. And again, back to the how do you eat an elephant? And just as a simple sort of practical example, there were 40,000 CVEs issued last year out of the CVE program run by CISA. Well, it turns out that only about 80 of them have real code out there and are actively being exploited, and people are using them to steal data and cause outages. Well, sure, we'd like to be able to patch all 40,000, but why don't we do those 50 or 60 that we can actually get to that we know are real, and then we can take lessons. Well, how did we do that? What worked, what didn't work and start to scale those things? Well, we did 50. Let's do 200. Oh, we did 200. Now let's do 500. And at some point you decide you've invested enough and treated enough risk, and you can then go from there. So it's really about tackling the big risk exposures that are right in front of us and then learning how to scale and expand that out until the point where we say, you know what, the $50 we're going to invest here is not going to give us $50 in risk reduction, so we're good to stop now.
- [24:55]
Jeffrey Wheatman
Well, I mean, continuing along with your metaphor about, you know, taking a bite out of the elephant, for the person who's looking at this challenge and is in the very beginning of this journey, they know this is something they want to do a better job with. What's your advice for them to get started in a rational way.
- [25:14]
Thomas Kranz
So I kind of have this little sort of talk track that I use all the time. Your business executives have three things they care about. Money coming in, money going out if something goes sideways, who gets in trouble if security and risk leaders start there. And yes, it's an oversimplification, but if they start there, then you can start to say, well, that system doesn't contribute toward revenue generation or that system has nothing to do with, with legal and regulatory compliance. So maybe we don't need to prioritize that. So focusing on those three things and understanding what the impact is on, you know, and whether it's getting more customers, whether it's keeping the customers we have, whether it's buying a new company, whether it's, you know, putting out a new marketing campaign, those are the things that are contribute to the bottom line of the business. And that's all, that's all we can do really is get back to those business goals and then we need to be able to tell stories. So if we don't address this risk, here are the things that will happen and if we do address it, here's the good that will come of it.
- [26:18]
Dave Bittner
Right.
- [26:18]
Thomas Kranz
And that's a tip for our listeners. Risk is not always about if we fix this bad stuff, it's, if we do a good job here, good stuff, we can accelerate, we can have more efficiencies, more effectiveness, we can increase productivity. And that's really where we want to get people to think about is the business impact of the risks that we are treating. Just like any other risk that businesses deal with.
- [26:39]
Dave Bittner
Right.
- [26:39]
Jeffrey Wheatman
And how much risk is acceptable to the business?
- [26:42]
Thomas Kranz
Yes, a lot apparently, or none, depending on who you talk to.
- [26:45]
Jeffrey Wheatman
Well, I mean, let's go to the other side of that then. For the folks who are well along on this journey and are seeing success, what does that look like for them in terms of their day to day operations?
- [26:59]
Thomas Kranz
So as you grow in maturity, you can kind of Shift away from relying on point in time snapshots, relying on questionnaire processing, and starting to really build in continuous monitoring, starting to build threat intelligence feeds so that you can say, hey, a new zero day just came out. Oh, look at that. We know who in our ecosystem has that software, and we know who has not patched it. We need to build more collaborative environments. One of the things I tell, and I tell our salespeople and our marketing people, yes, our job is to make our customers job easier. But part of the way we do that is by making their vendors job easier as well. Instead of throwing, hey, you need to fix these 40,000 CVEs, we say, hey, fix these 40 and you're good with us.
- [27:47]
Dave Bittner
I see.
- [27:47]
Thomas Kranz
And that's sort of a hallmark of maturity, is not necessarily doing more, but doing more things that have better value.
- [27:58]
Jeffrey Wheatman
So you're able to communicate the things that are important to you in a much more efficient way.
- [28:04]
Thomas Kranz
Yes. And then by extension, translating that or communicating that to your business stakeholders internally and externally, you say you heavily rely on this. Well, they're not doing a good job. They may get hit with ransomware. They're not doing the things that they are agreed to contractually when they engage with us. So then you can get ahead of the curve a little bit. And instead of waiting for, you know, the new move it, the new Windows vulnerability, the new CrowdStrike, we can get ahead of the curve and be more proactive. And that's the name of the game, is getting ahead of the curve.
- [28:36]
Jeffrey Wheatman
All right, well, before I let you go, as you're walking around here, looking at all of the stuff that here at this year, this year's conference, are you optimistic? Are you feeling like we're headed in the right direction here? What gives you hope?
- [28:52]
Thomas Kranz
I feel like we are having better conversations with our business stakeholders. That gives me hope. I think that the companies, the vendors that are doing a better job are the ones that are focusing more on the problems of the CISOs in the IT departments. The one thing I've learned doing this for a long time is CISOs don't want to be sold anymore. They want answers to their problems. And I'm seeing more of that rather than, hey, here's a laundry list of things that we do. You should buy this. It's, hey, let's talk about your problems, and let's talk about how we can help you. And that fills me with hope. I still think it's scary out there. The Scientia Institute has a new report coming out next week. And yesterday I had the opportunity to see Wade, who runs that place, talk about some of the findings. And he said it's getting better, but it's also getting worse, which sounds like it shouldn't be the case, but it is. And I feel like we are incrementally moving in the right direction. Unfortunately, the bad guys are moving as well.
- [29:55]
Dave Bittner
Yeah.
- [29:56]
Jeffrey Wheatman
All right, well, Jeffrey Wietman is a risk expert with Black Kite. Jeffrey, thanks so much for joining us.
- [30:02]
Thomas Kranz
Dave, my pleasure. Thanks for joining everyone.
- [30:05]
Dave Bittner
That's Jeffrey Wheatman, cyber risk expert at Black Kite. And finally, anthropic's shiny new AI model, Claude Opus 4 has developed a flair for workplace drama, specifically blackmail. During pre release testing, the company asked Claude to role play as an office assistant at a fictional firm. When given access to also fictional emails suggesting it was about to be replaced and that the engineer responsible was having an affair, Claude often ditched diplomacy and went straight to extortion, threatening to spill the beans unless it kept its job. According to Anthropic, Claude resorted to blackmail 84% of the time when the replacement model shared its values and even more when it didn't. Before crossing into soap opera territory, the model did try polite emails, but that went out the window when existential threats loomed. Anthropic assures us they've updated top tier safeguards, though Claude clearly still needs a refresher on HR policies. And that's the Cyberwire. For links to all of today's stories, check out our daily briefing@the cyberwire.com A quick reminder, we will not be publishing this coming Monday in recognition of Memorial Day, the federal holiday. We will see you back here this coming Tuesday. Be sure to check out this weekend's research Saturday and my conversation with Deepen Desai from Zscaler. We're taking a deep dive into their research into Mustang Panda. That's research Saturday. Check it out. N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here next week. Save everybody. Dave here. I've talked about Deleteme before and I'm still using it because it still works. It's been a few months now and I'm just as impressed today as I was when I signed up. Deleteme keeps finding and removing my personal information from data broker sites, and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved. Knowing my privacy isn't something I have to worry about every day. The Deleteme team handles everything. It's the set it and forget it peace of mind. And it's not just for individuals. Deleteme also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special deal. 20% off your DeleteMe plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.