A (0:02)

You're listening to the Cyberwire Network, powered by N2K.

B (0:12)

Risk and compliance shouldn't slow your business down. Hyperproof helps you automate controls, integrate real time risk workflows, and build a centralized system of trust so your teams can focus on growth, not spreadsheets. From faster audits to stronger stakeholder confidence, hyperproof gives you the business advantage of Smarter compliance. Visit www.hyperproof.IO to see how leading teams are transforming their GRC programs. At Talas, they know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most applications, data and identity. That's Talas T H A L E S learn more@talasgroup.com cyber WSUS attacks Escalade as an emergency patch fails to fully contain exploited flaws Schneider Electric and Emerson are listed among victims in the Oracle EBS cyber attack. Google debunks reports of a massive Gmail breach. A new banking Trojan mimics human behavior for stealth. Sweden's power grid operator confirms a cyber attack. Italian spyware targets Russian and Belarusian organizations. The US Declines to sign the new UN Cyber Treaty. Ransomware payments fall to record lows. The US Cyber chief calls for a clean American tech stack to counter China's global surveillance push. On today's Threat Vector segment, David Moulton speaks with two cybersecurity leaders from Palo Alto Networks, Sarit Tagar and kritivasan macheri and AI mistakes doritos for a deadly weapon it's Tuesday, October 28, 2020. Dave I'm Dave Buettner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great as always to have you with us. Researchers warn that a critical Windows Server Update Services, or wsus vulnerability is being actively exploited despite Microsoft's recent emergency patch. The flaw enables unauthenticated remote code execution on Windows Server 2012 through 2025 stemming from insecure deserialization of untrusted data. Google's Threat Intelligence Group confirmed multiple intrusions by a threat actor it calls UNC6512 observing reconnaissance and data exfiltration from compromised hosts. Trend Micro reports roughly 100,000 exploitation attempts in a week, with nearly half a million Internet exposed WSUS servers potentially vulnerable. Experts warn that exposed servers could allow attackers to distribute malicious updates downstream. Amplifying the threat Cybercriminals tied to the CLOP ransomware operation have named Schneider Electric and Emerson as victims of an ongoing campaign exploiting Oracle E business suite vulnerabilities. The attackers, believed to be associated with the financially motivated Fin11 group, claim to have stolen large volumes of corporate data later posted on Klopp's leak site. The site lists 2.7 terabytes of data allegedly from Emerson and 116 GB from Schneider Electric, with file structures suggesting origin in Oracle environments. Other organizations, including Harvard University and Envoy Air, have confirmed impact from the same campaign. Researchers say the operation mirrors prior large scale attacks on MoveIt and Fortra systems, underscoring persistent risks in enterprise software supply chains. Widespread reports of a massive Gmail data breach grabbed headlines this week, but Google says the claims are false. The confusion began after researcher Troy Hunt added 183 million credentials to his have I been Pwned Service sourced from old infostealer malware logs, not a new Gmail hack. Google confirmed there's no evidence of compromise, calling the reports a misunderstanding of recycled data. The company emphasized that Gmail's defenses remain strong and advised users to enable two factor authentication. Researchers at ThreatFabric have identified a new Android banking trojan called Herodotus that uses randomized pauses to evade basic behavioral detection systems. The malware inserts delays of up to three seconds when entering stolen credentials, mimicking human typing speed to appear legitimate. Distributed through smishing links and sideloaded apps, Herodotus abuses Android accessibility services to steal banking credentials, intercept SMS1 time passcodes and display fake login overlays. It shares limited code overlap with the Brokewell Trojan discovered earlier this year. Though currently active in Italy and Brazil, Herodotus includes templates for banks and crypto wallets in multiple countries, suggesting broader campaigns ahead. More advanced biometric systems may still detect its automated behavior. Sweden's state owned power grid operator Svenska Krafnot confirmed a cyber attack that led to a data breach but did not affect the country's electricity supply. The incident, discovered Saturday, targeted an isolated external file transfer system, according to the organization's chief information security officer. Ransomware Group Everest has claimed responsibility, adding Svensa Krafnot to its leak site and alleging theft of roughly 280GB of data. The company reported the attack to authorities and is investigating the breach's scope. While no critical systems were compromised, the attack underscores the growing threat to critical infrastructure operators from data extortion groups, researchers from Kaspersky say. Italian spyware from Memento Labs, formerly known as Hacking Team, was used in cyber attacks targeting organizations in Russia and Belarus. The commercial surveillance tool called Dante appeared in incidents linked to a threat group dubbed Forum Troll, which has previously targeted Russian institutions with phishing and Chrome Zero day exploits. Kaspersky could not confirm who commissioned the attacks or whether Memento Labs knew of Dante's deployment. The discovery marks the spyware's first confirmed use since its 2023 debut for law enforcement clients. Forum Trolls campaigns leveraged a custom loader leet agent to deploy DANTE in select cases showing advanced espionage capabilities. Memento Labs declined to comment on the findings. More than 70 countries, including the UK, China, Russia and the European Union signed the new UN Convention against Cybercrime in Hanoi, while the United States notably withheld its signature. The treaty establishes the first global framework for sharing electronic evidence and coordinating cross border cybercrime investigations. UN Secretary General Antonio Guterres called the convention a powerful, legally binding instrument against crimes like ransomware, money laundering and online trafficking. But critics warn it could enable mass surveillance and suppress digital freedoms under authoritarian regimes. The State Department said the US is still reviewing the treaty, which will take effect after 40 ratifications. Ransomware payments have fallen to their lowest level on record, with just 23% of victimized organizations paying attackers in the third quarter of this year, according to Coveware. The firm says the steady six year decline reflects stronger defenses, improved incident response and growing pressure from authorities not to pay. Average ransom payments dropped to $377,000, with median payments at 140 grand. Data theft now dominates ransomware activity featured in 76% of incidents and payment rates fall to 19% when only exfiltration is involved. Groups like Akira and Keelin increasingly target medium sized firms, while remote access, compromise and software vulnerabilities remain top entry points. Coveware says every avoided payment constricts attackers of oxygen, validating collective defensive progress. National Cyber Director Shawn Cairncross warned that China is attempting to export a surveillance state across planet Earth and urged the US to promote a clean American tech stack as a democratic alternative. Speaking at the 2025 Meridian Summit, Cairncross said Washington must engage both current and emerging partners to push back against Beijing's growing digital influence, which he described as destabilizing and aimed at undermining US decision making. He said the upcoming US cybersecurity strategy under President Trump will emphasize posture and action over length or rhetoric. Strengthening the office of the National Cyber Director remains his top priority, following recommendations from the Cyberspace Solarium Commission. Cairn Cross also urged Congress to renew the expired Cybersecurity Information Sharing act, calling its protections essential for industry collaboration on cyber threats. Coming up after the break in our Threat Vector segment, David Moulton speaks with his Palo Alto Network colleagues about urgent challenges of securing modern development in the age of AI and shifting security left and AI mistakes Doritos for a deadly weapon. Stick around. And now a word from our sponsor, Threat Locker, the powerful zero Trust enterprise solution that stops ransomware in its tracks. Allowlisting is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy, ensuring apps can only access the files, registry keys, network resources and other applications they truly need to function. Shut out cybercriminals with world class endpoint protection from Threat locker. What's your 2am Security worry? Is it do I have the right controls in place? Maybe? Are my vendors secure? Or the one that really keeps you up at night? How do I get out from under these old tools and manual processes? That's where Vanta comes in. Vanta automates the manual work so you can stop sweating over spreadsheets, chasing audit evidence and filling out endless questionnaires. Their trust management platform continuously monitors your systems, centralizes your data and simplifies your security at scale. And it fits right into your workflows, using AI to streamline evidence collection, flag risks, and keep your program audit ready all the time. With Vanta, you get everything you need to move faster, scale confidently and finally get back to sleep. Get started@vanta.com cyber that's V A N T A dot com cyber on today's threat Vector segment, David Moulton speaks with a pair of his Palo Alto Networks colleagues, Sarit Tagar and Krithi Macheri. They're diving into some of the urgent challenges of securing modern development in the age of AI. Here's their conversation.