Transcript
Maria Varmazas (0:02)
You're listening to the Cyberwire network, powered by N2K.
Dave Bittner (0:12)
Hey everybody, Dave here. I've talked about Deleteme before and I'm still using it because it still works. It's been a few months now and I'm just as impressed today as I was when I signed up. Deleteme keeps finding and removing my personal information from data broker sites, and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved. Knowing my privacy isn't something I have to worry about every day. The Deleteme team handles everything. It's the set it and forget it peace of mind. And it's not just for individuals. Deleteme also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special 20% off your delete me plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K.
Maria Varmazas (1:34)
Children'S DNA in Criminal Databases ASUS routers get an unwanted House Guest New APT41 malware uses Google Calendar for command and control Interlock Ransomware Gang deploys new Trojan Estonia Issues arrest Warrant for Suspect in Massive Pharmacy breach the Enemy within the Endpoint New England Hospitals Disrupted by Cyber Attack Tim Starks from cyberscoop is discussing Whatever we Did was Not Enough how salt typhoons slipped through the government's blind spots and Victoria's secrets are leaked today is May 29, 2025. Maria I'm T minus Space Daily host Maria Varmazas in for Dave Bittner and this is your Cyber Wire Intel Briefing. Happy Thursday everybody. Thanks for joining us. Let's get into today's intel briefing. Between 2020 and 2024, US Customs and Border Protection collected DNA samples from over 133,000 migran, including at least one as young as four years old, and uploaded their genetic profiles to the FBI's Combined DNA Index System, or CODIS, which is a database traditionally reserved for criminal offenders. This expansion of biometric surveillance, justified by the Department of Justice as a crime prevention measure, has raised significant privacy and ethical concerns. While official policy limits routine DNA collection to individuals aged 14 and older, exceptions were widely made, often without any criminal charges. Notably, 122 minors identified as US citizens had their DNA collected, 53 of whom were not detained for any criminal arrest. Critics argue that this practice blurs the line between civil immigration enforcement and criminal investigation, effectively treating undocumented migrants, especially children, as potential criminals. Privacy experts warn that storing raw DNA samples indefinitely poses risks of misuse, including unauthorized profiling and surveillance. The inclusion of minors in codis, a system designed for tracking criminal offenders, underscores the need for stringent oversight and clear guidelines to protect vulnerable populations from unwarranted surveillance. Gray Noise has uncovered a sophisticated campaign compromising over 9,000 ASUS routers, primarily targeting small office and home office environments. The attackers gain initial access through brute force attacks and authentication bypasses, including techniques not yet assigned CVEs. Subsequently, they exploit CVE2023 39780A command injection vulnerability to execute arbitrary commands. The adversaries establish persistence by enabling SSH access on a non standard port and and inserting their public SSH keys using legitimate ASUS configuration methods. These changes are stored in non volatile memory or nvram, allowing the backdoor to survive reboots and firmware updates. Notably, no malware is deployed. Instead, the attackers disable logging and security features like Trend Micro's AI protection to evade detection. Google's Threat Intelligence Group says the Chinese threat actor APT41 used a compromised government website to host a new strain of malware dubbed Tough Progress. Notably, the malware uses Google Calendar events for command and control communications. Google explains. Once executed, Tough Progress creates a zero minute calendar event at a hard coded date, specifically May 30, 2023, with data collected from the compromised host being encrypted and written in the calendar event description. The operator places encrypted commands and calendar events on July 30th and 31st, 2023, which are predetermined dates also hard coded into the malware. TufProgress then begins polling calendar for these events. When an event is retrieved, the event description is decrypted and the command it contains is executed on the compromised host. Results from the command execution are encrypted and written back to another calendar event. The Interlock ransomware gang is using a new Trojan dubbed Node Snake to target universities. According to a report from Bleeping Computer, the malware is distributed via phishing emails with malicious links or attachments. Quorum Cyber has published a report on the RAT, noting that the malware is encoded in JavaScript and executed with Node JS. The researchers state that Node Snake demonstrates typical capabilities expected from a modern day rat. It is designed for persistent access system reconnaissance and remote command execution. It employs multiple evasion techniques, communicates with command and control servers via HTTP HTTPs, and deploys secondary payloads to maintain control and facilitate further compromise, quorum observed. Node Snake deployed against two universities in the UK within the last two months. Estonian authorities have issued an international arrest warrant for a Moroccan national accused of hacking a customer card database belonging to Allium upi, which is a major provider of pharmacy and healthcare products across the Baltic countries. According to a report from the Record, the breach occurred in February 2024 and exposed nearly 700,000 personal identification codes used by pharmacy customers, revealing pharmacy purchases linked to customer accounts. The incident affected data belonging to almost half of the Estonian population. Estonia's Central Criminal Police alleges that 25 year old Adrar Khalid gained access to the database using a stolen password for an administrator account. In mid-2024, Israeli cybersecurity company Signia uncovered a sophisticated North Korean cyber attack involving a threat actor posing as a legitimate IT employee at a Western company. The attacker, operating from within the organization, used standard tools like zoom and basic network protocols to avoid detection. By leveraging access through a corporate VPN and a company issued laptop, the attacker established a multi layered covert control channel enabling lateral movement, execution of malicious code and data exfiltration, all under the guise of routine remote work activities. Signia's investigation began after the FBI recovered a client issued laptop during a raid on a suspected laptop farm, which is a service that facilitates foreign workers impersonating US Citizens to secure remote roles in Western companies. Shoham Simon, Signia's senior VP of cyberservices, emphasized that the breach exploited a trust vulnerability rather than a code flaw, highlighting the need for detection models that account for anomalies in protocol usage and the misuse of legitimate tools. A cyber incident affecting Massachusetts based health system Covenant Health is disrupting several affiliated hospitals in New England, according to WMUR News Center Maine reports that St. Joseph Healthcare in Bangor and St. Mary's Hospital in Lewiston were both impacted and St. Joseph's has attributed the disruption to a cyber attack. WMUR says St. Joseph's Hospital in Nashua, New Hampshire is diverting ambulances to different hospitals. Coming up after the break, Dave Buettner sits down with Tim Starks, senior reporter at Cyber Scoop. They'll unpack his recent piece called Whatever We Did Was Not Enough, How Salt Typhoon slipped through the government's blind Spots. Plus, what's the story behind Victoria's secrets getting leaked? Stick around.