Transcript
A (0:02)
You're listening to the Cyberwire network, powered by N2K. And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science in Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's Cyber Service Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. Edu MSSI International Law Enforcement Take down the Breach Forums Domains Researchers link exploitation campaigns targeting Cisco, Palo Alto and Fortinet Juniper Networks patches over 200 vulnerabilities Apple and Google update their bug bounties evaluating AI use in application security programs. Micro segmentation can contain ransomware much faster and yield better cyber insurance terms. The new Rondo Docs botnet exploits over 50 vulnerabilities. Researchers tag 13 unpatched Avanti Endpoint Manager flaws. Our guest is Jason Minar, CISO of Kaseya, sharing his insights into how the private and public sectors can work together for national security and hackers Mistake a decoy for GLORY It's Friday, October 10th, 2024. I'm Dave Buettner and this is your Cyberwire Intel Brief. Thanks for joining us here today. Happy Friday. It's great to have you with us. The FBI and French police seized Breach Forums domains, shutting down Shiny Hunter's platform used to leak corporate data. The seizure occurred October 9, with bleeping computer confirming FBI name servers now control the sites. Shiny Hunters acknowledged the loss in a PGP signed telegram post saying backup since 2023 escrow databases and backup servers are now compromised. They added the forum will not be rebuilt, warning that such platforms have become law enforcement honeypots. Despite the seizure, their Dark Web leak site remains online, with a Salesforce data dump still scheduled. The takedown exposes historic forum data and signals closer global cooperation. Still, organizations face looming risk as Shiny Hunters claims to hold over a billion stolen Salesforce records. Gray Noise has linked three exploitation campaigns targeting Cisco, Palo Alto networks and Fortinet devices to IPs on the same subnets, suggesting shared threat actors. The firm first observed scanning of Cisco ASA firewalls weeks before Cisco disclosed two zero day flaws exploited in China linked arcane door espionage attacks. More recently, granoise detected a 500% spike in scanning of Palo Alto global protect portals with over 1.3 million login attempts from thousands of unique IPs. These same subnets are now tied to brute force attacks against Fortinet VPNs. Granoise warns that 80% of such spikes precede new firewall or VPN vulnerabilities by about six weeks, advising organizations to harden defenses and block brute forcing. IPs. Juniper Networks has patched over 200 vulnerabilities in its Juno, Space and Security Director platforms, including nine rated critical flaws range from cross site scripting and privilege escalation to remote command execution and backdoor creation. One critical bug allows admin level command execution. No active exploitation is reported, but Juniper urges immediate patching. The issues pose serious risks to enterprise and telecom networks, especially in Europe, where large Juniper deployments heighten potential impact. Apple has doubled its top bug bounty payout to $2 million for exploit chains enabling spyware attacks, with total rewards reaching $5 million for findings that also bypass lockdown mode or are discovered in beta software. Announced by Apple security chief Ivan Krstyk at Hexacon, the expansion underscores the company's push to incentivize high impact vulnerability research. Since opening its bounty to the public in 2020, Apple has paid over $35 million to more than 800 researchers. The program now covers one click WebKit and wireless proximity exploits and adds a target flags testing feature. Alongside this, Apple introduced memory integrity enforcement in iPhone 17 devices and pledged 1,000 phones to rights groups supporting at risk users. Google has launched a new AI vulnerability reward program offering up to $30,000 for verified bugs in its AI products, including Search, Gemini and Workspace. The program streamlines reporting by consolidating AI related issues previously handled under the Abuse vrp. Eligible vulnerabilities include data leaks, model theft and phishing enablement involving AI interactions. Since 2018, researchers have earned over $430,000 from AI related reports. Google says the AI VRP aims to reward high impact findings while excluding content based issues like prompt injections. A new survey from Fastly finds that 90% of security leaders are using or evaluating AI in their application security programs, citing faster vulnerability detection and reduced manual effort. Yet nearly a third act on AI findings without human review, raising concerns over false positives and misplaced trust. Half of the respondents report frequent or occasional inaccuracies, while only 22% rate AI's accuracy as excellent. Key challenges include integration, complexity, skills gaps and compliance worries. Despite mixed confidence, 80% plan to expand AI use, emphasizing automation, real time detection and explainability fastly. CISO Marshall Irwin cautions that success will depend on reducing false positives and integrating AI effectively to avoid AI shelfware. A new report from Akamai finds that organizations adopting micro segmentation can contain ransomware much faster and receive better cyber insurance terms. Surveying 1200 security leaders, Akamai notes that while 90% use some form of segmentation, only 35% employ micro segmentation across their networks. Among enterprises already using micro segmentation, ransomware containment times dropped by about 33%, 75% of organizations say insurers now assess segmentation posture during underwriting, and 60% report receiving lower premiums tied to their segmentation maturity. The report also flags deployment challenges including network complexity, visibility gaps and organizational resistance as common barriers to adoption. Trend Micro has identified a new botnet, Rondodocs, that exploits over 50 vulnerabilities across routers, servers, cameras and other devices from more than 30 vendors active since mid-2025. Rondo Docs initially targeted a TP link router flaw, but has since expanded to include DVRs, CCTV systems and web servers. The botnet leverages both known and unlisted command injection vulnerabilities 18 without CVEs, several on CISA's known exploited vulnerabilities list. CloudSec reports a 230% surge in Rondo Docs activity since mid-2025 with compromised devices used for cryptocurrency mining, DDoS attacks and enterprise intrusions. The malware now spreads via a loader as a service model alongside Mirai and Morta payloads, masking activity by mimicking gaming platforms and VPNs. Trend Micro's zero day initiative disclosed 13 unpatched Ivanti endpoint manager flaws, one local privilege escalation reported in November 2024 and 12 remote code execution issues reported in June of this year. Zdi labels them zero day upon disclosure. Though they're not actively exploited zero days. No CVEs exist yet all are high severity with one scoring 8.8. The local privilege escalation affects agent portal via unsafe deserialization to system. The RCEs stem from inadequate input validation across multiple reporting and query classes, mostly leading to authenticated SQL driven code execution. The highest severity, RCE involves unsafe path use and can be triggered with admin credentials or user interaction. Trend Micro says patches slipped from September and November to March of next year. Coming up after the break, my conversation with Jason Minar from Kaseya, sharing his insights on public private cooperation for national security and hackers mistake a decoy for glory. Stay with us Foreign they know cybersecurity can be tough and you can't protect everything, but with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Thales. T H A L E S Learn more@talasgroup.com Cyber what's your 2am Security worry? Is it do I have the right controls in place? Maybe Are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started@vanta.com cyber that's v a n t a dot com cyber Jason Minar is CISO at Kaseya. We recently caught up to discuss his insights on how the private and public sectors can work together for national security.