Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. Spy Cloud Identity is the new battleground and attackers are exploiting stolen identities to infiltrate your organization. Traditional defenses can't keep up. Spy Cloud's holistic identity threat protection helps security teams uncover and automatically remediate hidden exposures across your users from breaches, malware and phishing to neutralize identity based threats like account takeover, fraud and ransomware. Don't let invisible threats compromise your business. Get your free corporate Darknet exposure report@spycloud.com cyberwire and see what attackers already know. That's spycloud.com cyberwire Operation Endgame dismantles cybercriminal infrastructure Doge's use of the Grok AI chatbot raises ethical and privacy concerns. Malware on the NPM registry uses malicious packages to quietly gather intelligence on developer environments. Researchers link Carito malware to the Spanish government, exploring proactive operations via letters of Mark. Hackers hesitate to attend the HOPE conference over travel concerns. Our guest is Jeffrey Wheatman, cyber risk expert at Black Kite, warning us to beware the silent breach and AI threatens to spill secrets to save itself. It's Friday, May 23rd, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us and happy Friday. It's great to have you with us. Law enforcement agencies worldwide, coordinated by Europol and Eurojust, have struck a major blow against cybercriminals by dismantling infrastructure behind several key malware strains used in ransomware attacks. The latest phase of Operation Endgame. The effort disabled initial access malware like Quackbot, Trickbot and Bumblebee tools criminals used to sneak into systems before launching full scale attacks. The operation seized over 21.2 million euros, including three and a half million euros in cryptocurrency and led to international arrest warrants for 20 suspects. This builds on May 2024's historic botnet takedowns showing law enforcement's growing ability to adapt as criminals evolve. A Europol led command post in the Hague coordinated actions across Canada, the US, the UK and multiple EU countries, with key suspects now on the EU's most wanted list and further actions planned. Operation Endgame underscores a shift in strategy targeting cybercrime at the entry Point. The U.S. justice Department has indicted Rustam Rafaelovich Gallyamov, a Russian national accused of masterminding the Quackbot malware and leading a global ransomware campaign for over a decade. Gallyamov allegedly built a massive botnet by infecting over 700,000 devices, then granted ransomware gangs access to deploy attacks, sharing in the profits. This move is part of Operation Duck Hunt, which dismantled Quackbot in 2023. Despite that, Gallyamov's group continued attacks using spam bot tactics. Authorities also seized $24 million in cryptocurrency. Since 2022, Russian military intelligence group APT28, also known as Fancy Bear, has been targeting Western military transport and IT sectors in cyberattacks aimed at disrupting aid to Ukraine. These state sponsored operations have struck airports, logistic firms, maritime systems and air traffic control. They've even hacked security cameras at sensitive locations like Ukraine's borders and military sites to monitor aid movements. A joint advisory from the NSA, CISA and FBI confirms APT28's role, highlighting their use of spear phishing, brute force and CVE exploitation to gain access to evade detection. The group used compromised home office devices near targets to route traffic for deeper infiltration. APT28 used native and open source tools to extract active directory data and Office365 email lists. Intelligence agencies have now publicized APT28's tactics in an effort to hinder future attacks. Targets include several European countries, Ukraine and the U.S. elon Musk's Department of Government Efficiency Doge is reportedly using his AI chatbot Grok, within the US Federal government to analyze data, potentially violating conflict of interest and privacy laws, Reuters reports. According to insiders, Doge has accessed sensitive federal databases and even encouraged Department of Homeland Security staff to use Grok without formal approval. Experts warn this could expose confidential data and give Musk's AI unfair access to federal contracting information, raising ethical concerns. Doge's actions include promoting AI tools to streamline government work, but also allegedly monitoring employee behavior and political alignment, raising alarms about civil liberties and misuse of power. While DHS and DoD denied pushing Grok or monitoring for political views, concerns persist over Doge's reach, oversight and the possibility that Musk could profit from federal AI use. Critics argue this blurs the line between public service and private gain, casting doubt on the integrity of federal tech policy. A new malware campaign on the NPM Registry is using malicious packages to quietly gather intelligence on developer environments, aiming to map internal networks and link them to public infrastructure. The NPM Registry is a public collection of JavaScript software packages used primarily with the Node JS runtime environment. Researchers at Socket uncovered at least 60 infected packages spread through three npm accounts downloaded over 3,000 times. These packages use post install scripts to run host fingerprinting code and exfiltrate data via a shared discord webhook. This intelligence can aid future more targeted supply chain attacks. Despite the current payload being limited to reconnaissance, the threat remains active with the potential for expanded attacks. Experts urge developers to enhance security by scanning dependencies, detecting post install hooks and scrutinizing small or unfamiliar packages. Without stricter registry controls, similar campaigns are likely to persist, posing ongoing risks to the software supply chain. More than a decade ago, Kaspersky uncovered a highly advanced Spanish speaking hacking group dubbed Carito, which is ugly face or mask in Spanish, after investigating suspicious malware targeting the Cuban government. Although Kaspersky never officially named a sponsor, multiple former employees confirmed, the researchers internally concluded that Carreto was a Spanish government operation. Carreto's malware was stealthy and sophisticated, capable of spying on sensitive data like conversations, keystrokes and encrypted information. The group targeted victims in at least 31 countries, with Cuba being a key focus due to Spanish geopolitical interests, including the presence of ETA members. Despite going dark after Kaspersky's 2014 expose, Carito resurfaced in 2024 with new attacks in Latin America and Africa using similar tactics. Analysts now rank Kireto among elite government backed cyber actors. Likening its precision to master craftsmanship, the group's continued operations reflect its resilience and the growing complexity of state level cyber espionage. U.S. officials and tech leaders are revisiting the centuries old concept of letters of marque once used to authorize private pirate ships to explore whether similar legal tools could let private firms conduct cyber attacks on behalf of of the government. While the original maritime authority doesn't directly translate to cyberspace, some see a modern version as a way to counter China's substantial cyber capabilities. The Trump administration and industry players have discussed granting select companies legal cover to hack back against adversaries, but concerns persist about regulation, liability and potential misuse. Critics argue that offensive operations should remain with U.S. cyber Command and the NSA, not private actors. Still, proponents believe a well regulated framework could bolster national defense against non state hackers or hostile nations. The idea underscores growing frustration over reactive cyber policies and a push for proactive public private cyber defense strategies. But any such plan would require cautious legal and ethical scrutiny. The long running Hope Conference Hope Stands for Hackers on Planet Earth is facing a steep drop in ticket sales, down 50% from last year, which organizers attribute to fears over U.S. immigration policies under the Trump administration. International attendees have expressed concerns about harassment, detainment and and electronic device seizures at the border One speaker, hacker Thomas Kranz, withdrew after friends were detained and had their electronics confiscated en route to another U.S. conference. Hope, which typically attracts around a thousand participants, may need to reduce its venue space to stay within budget. Despite the challenges, organizers confirmed the event will proceed with support from the ACLU and eff, offering travel guidance for international guests. A virtual ticket option remains available. Hope will take place Aug. 15 through the 17th at St. John's University in New York, continuing its tradition of tech activism and hacker culture. Coming up after the break, my conversation with Jeffrey Wheatman, cyber risk expert at Black Kite. We're discussing the silent breach and AI threatens to spill Secrets to save itself. Stay with us.