Transcript
Dave Bittner (0:02)
You're listening to the Cyberwire Network powered by N2K. We got your patch Tuesday. Notes the Matrix foundation patches high severity vulnerabilities in its open source communications protocol. The Curly Comrades Russian aligned APT targets critical infrastructure Microsoft tells users to ignore new certificate services client errors Researchers uncover a malware campaign hiding the NJ RAT remote access Trojan in a fake Minecraft clone. Motorcycle manufacturer Royal Enfield suffers a ransomware attack. The DOJ details a major operation against the Black Suit ransomware gang. Our guest is Jack Jones, father of Factor Analysis of Information Risk and the Fair Controls Analytics Model model sharing insights on cyber risk quantification and data brokers digital hide and seek It's Wednesday, August 13, 2025. I'm Dave Bittner and this is your Cyberwire Intel Brief Foreign thanks for joining us here today. It's great as always to have you with us. August 2025's Patch Tuesday brought a major wave of security updates across the tech stack. Microsoft patched over 100 vulnerabilities spanning Windows Office Hyper V and flagged a publicly disclosed privilege escalation bug. 12 are rated critical, with the most severe being a GDI remote code execution issue with a CVSS of 9.8, though none appear actively exploited and overall exploitation is judged unlikely. Intel, AMD and Nvidia release dozens of advisories. Intel patched high severity flaws affecting Xeon drivers, firmware and networking, many enabling privilege escalation, denial of service or information disclosure. AMD fixed issues tied to research on stacking engine attacks and an EDK2 SMM code execution bug. Nvidia resolved several high severity flaws in its Nemo, Isaac, Groot, Apex and Deep learning tools that could lead to remote code execution or data tampering in the industrial and control system. Space vendors including Schneider Electric, Honeywell, abb, Phoenix, Contact and Aviva fixed code execution, privilege escalation and denial of service vulnerabilities across SCADA controllers, analytics and management tools. Several were high severity. Adobe issued Updates for over 60 vulnerabilities across 13 products, including Commerce, Photoshop, InDesign, FrameMaker, and Substance 3D tools. Many were critical code execution flaws, though none are known to be exploited in the wild. Finally, Fortinet released 14 advisories, including a critical Fortasim bug allowing unauthenticated remote code execution with a proof of concept Public, a high severity authentication bypass in fortaweb and other important fixes in fortamanager, fortamail and more were also addressed. Avanti patched two high severity authenticated RCE issues in Avalanche. The Matrix foundation has patched two high severity vulnerabilities in its open source federated communications protocol, used by governments and enterprises for sensitive discussions. The flaws could have allowed attackers to seize control of classified channels or predict room IDs, enabling them to infiltrate or redirect communications. One bug let malicious admins override a channel creator's permissions, potentially disrupting crisis coordination. The other allowed prediction of room IDs, risking authentication. Access fixes elevate room creators privileges and switch to cryptographic hashing for IDs. The off cycle embargoed update required complex coordination and delayed full disclosure to allow test. Room upgrades may cause user disruption and testing before deployment is advised. Bitdefender Labs has detailed Curly Comrades, a Russian aligned APT active since mid-2024, targeting critical infrastructure in Georgia and Moldova. The group infiltrates judicial, government, and energy entities to steal credentials, maintain persistence, and exfiltrate sensitive data. Key tools include the custom Mukur agent Backdoor, which bypasses AMSI to run encrypted PowerShell scripts, and techniques like comm hijacking of disabled engine tasks for system level reentry operations. Blend legitimate utilities with custom malware using proxy relays, Socks5 servers, and compromised websites for covert C2 credential theft exploits, NTDs, database copies, LSAs, dumps, and adapted open source tools. Data is staged, encrypted, disguised as PNGs, and updated via curl exe. The stealthy redundant infrastructure underscores resilience and geopolitical intent. Bitdefender urges XDR deployment, LOL bin monitoring, and managed detection. To counter this persistent espionage threat, Microsoft is asking Windows 11 users to ignore new certificate Services client errors appearing after the July 2025 preview and later updates. The Event Viewer logs error id 57, citing a failed Microsoft Pluton cryptographic provider load, but Microsoft says it's harmless, linked to an unfinished feature. Similar false warnings have surfaced in recent months, including Windows Firewall, BitLocker, and WinRE update errors, all without functional impact. The company confirms no action is needed, as these events don't affect system performance OR security. Point Wild's LAT61 threat intelligence team has uncovered a malware campaign hiding the Njrat remote access Trojan in a fake Minecraft clone. Eaglecraft 1.12 offline popular in schools and restricted environments, the game distracts players while NJRAT silently steals passwords, keystrokes, and personal data, and spies via webcam and microphone. The malware installs WindowsServices EXE for persistence, spawning hidden processes for command execution and payload handling. It can crash systems if security tools like wireshark are detected. The RAT connects to a remote server in India hosted on Amazon's cloud for attacker control. Given Minecraft's long history as a malware target, experts warn players to download only from official sources and avoid unofficial mods or installers to prevent spyware infections and data theft. Motorcycle manufacturer Royal Enfield has reportedly suffered a ransomware attack with hackers claiming to have encrypted all servers and wiped backups, crippling operations. Posted on an underground forum as a complete breach notice, the attack prompted temporary suspension of online ordering and some workshop services. The Chennai based company confirmed a cybersecurity incident and and launched an internal investigation, but disclosed no details on affected data. The breach risks regulatory fines, reputational damage and loss of trust among dealers, suppliers and customers in the motorcycle community. The U.S. department of justice has detailed a major operation against the Black Suit Ransomware group formerly known as Royal authorities seized four servers, nine domains and $1.1 million in cryptocurrency stolen from a vict who paid a $1.4 million ransom in April of 2023. The funds, repeatedly moved through a crypto exchange, were frozen in January 2024. This covert seizure preceded Operation Checkmate, a multinational effort involving US agencies, the UK's NCA and partners from Europe and Canada disrupting the gang's infrastructure and seizing digital assets. Active since 2022 and linked to Conti, Black Suit has demanded over $500 million from victims targeting manufacturing, government, healthcare and commercial sectors. Officials say the action reflects a disruption first strategy to protect critical infrastructure and US businesses from ransomware threats. Coming up Break my conversation with Jack Jones, father of Factor Analysis of Information Risk Fair and Data Brokers Digital Hide and Seek Stay with us.