Risky Bulletin: Major CISA leadership exodus underway

Summary

Risky Bulletin: Major CISA Leadership Exodus Underway

Episode Release Date: May 26, 2025
Host: Caitlin Sorey
Prepared by: Catalyn Campano

---

1. Significant Leadership Departures at CISA

In a major shakeup, several high-ranking officials are set to depart from the Cybersecurity and Infrastructure Security Agency (CISA) by the end of May. Caitlin Sorey reports, “Several high ranking officials will leave the US Cybersecurity and Infrastructure Security Agency at the end of May” [00:00].

An internal memo, obtained by the Washington Post, reveals that the heads of three of CISA’s six divisions—Cybersecurity, Infrastructure Security, and Integrated Operations—will be exiting. Additionally, the deputy of a fourth division is also leaving. Beyond the top levels, regional leaders and key officers responsible for finance, strategy, human resources, and contracting are among those departing. This exodus marks a significant transition within the agency, potentially impacting its strategic direction and operational effectiveness.

2. Government Audit Targets NIST's Vulnerability Management

The National Institute of Standards and Technology (NIST) is under scrutiny as the US Government announces an audit over its management of the National Vulnerability Database (NVD). “The US Government will audit the National Institute of Standards and Technologies over its management of the National Vulnerability Database” [00:00], explains Sorey.

The audit, conducted by the US Department of Commerce's Office of Inspector General, aims to evaluate NIST's processes for handling NVD submissions, especially after the agency grappled with a substantial backlog last year. This evaluation seeks to ensure that vulnerability reporting and management practices meet the necessary standards and timelines to safeguard national cybersecurity interests.

3. Vietnam Enforces Telegram Ban Amid Security Concerns

The Vietnamese government has taken decisive action by mandating local telecom companies to block access to the Telegram instant messenger. “The Vietnamese government has ordered local telecom companies to block access to the Telegram instant messenger” [00:00], notes Sorey.

Officials cited Telegram’s failure to comply with law enforcement requests in cases involving fraud, drug trafficking, and terrorism as the primary reason for the ban, which is set to take effect in June. Telegram responded to Reuters, stating, “We were surprised by the decision,” highlighting the company's unexpected position regarding the enforcement action.

4. Spanish Government Linked to Cyber Espionage Group Careto

Caitlin Sorey highlights the involvement of the Spanish government in cyber espionage activities through the group Careto. “The Spanish government is behind a cyber espionage group known as Careto” [00:00].

Active since at least 2007, Careto has operated sporadically, primarily targeting Spain's neighbors and other Spanish-speaking nations. According to Kaspersky, as discussed in an interview with TechCrunch, Careto is “very small compared to Lazarus and APT41, but far more sophisticated.” This distinction underscores Careto’s advanced capabilities despite its limited size, posing a significant threat in the realm of state-sponsored cyber activities.

5. Chinese Cyber Espionage Group Silk Typhoon Targets Commvault and US Treasury

The Chinese cyber espionage group Silk Typhoon has been active in infiltrating critical infrastructures. Recently, the group hacked Commvault, a backup software company, by compromising its Azure servers in February. According to CISA, this intrusion is part of a broader campaign targeting SAS providers.

Additionally, Silk Typhoon previously breached the US Treasury Department late last year, indicating the group's sustained efforts to penetrate high-value government targets. These actions demonstrate Silk Typhoon’s ongoing strategy to access sensitive information within pivotal institutions.

6. Belgian Authorities Pursue Ransomware Developers from Russia

Belgian prosecutors are seeking severe penalties for individuals involved in the development and distribution of the Krylock ransomware. “Belgian authorities are seeking 13 years imprisonment for the Russian man accused of developing the Krylock ransomware” [00:00], reports Sorey.

The accused man, along with a woman who advertised the ransomware online and negotiated with victims, are believed to have infected over 400 users and amassed more than 3 million euros through their malicious activities. Detained in Spain in 2023, the pair has been extradited to Belgium, where the court is expected to render a verdict in late June.

7. Russian Programmer Sentenced for Data Breach to Ukrainian Intelligence

In a notable case of cyber-related treason, Russian authorities have sentenced a 37-year-old programmer to 14 years in prison. “Russian authorities have sentenced a man to 14 years in prison for uploading Russian's personal data to a Telegram channel managed by Ukrainian intelligence” [00:00], states Sorey.

The convicted individual worked at a hospital in Russia's Arkhinsk region and unlawfully disseminated personal information, including details of Russian military personnel, to a channel controlled by Ukrainian intelligence, resulting in charges of high treason.

8. Romanian Nationals Arrested in Australia for ATM Skimming

Two Romanian nationals have been apprehended in Australia on charges of installing skimming devices on ATMs. “Two Romanian nationals have been arrested in Australia for installing skimming devices and ATMs” [00:00], explains Sorey.

Operating in Sydney and the Illawarra region, the duo allegedly cloned bank cards using the stolen data, extracting over 800,000 Australian dollars from unsuspecting victims. Law enforcement agencies conducted the investigation over a month, responding to numerous reports of tampered ATMs. Due to challenges in physically seizing the group's infrastructure, authorities resorted to hacking Loomasteela's servers to gather evidence.

9. FBI’s Tactics Against Loomasteela Operation

The FBI has employed innovative methods to combat the Loomasteela cybercriminal group. Sorey reports, “Officials have been investigating the pair for a month after banks reported ATMs being tampered with. Law enforcement agencies reportedly hacked Loomasteela's servers because they couldn't physically seize the group's infrastructure” [00:00].

In a Telegram post, Loomasteela administrators claimed that the FBI exploited a vulnerability in Dell's IDRAC Lights Out management system to collect data and wipe their backup servers. Additionally, the post alleged that law enforcement deployed a phishing page on Loomasteela's portal to harvest customer data. These actions purportedly occurred a week before authorities successfully dismantled the Lumasteela operation.

10. Silent Data Extortion Group’s Phone Phishing Campaign

The Silent Data Extortion group has been actively targeting US companies through sophisticated phone phishing attacks for the past two years. “The silent Data Extortion group has been targeting US Companies with phone phishing attacks for two years” [00:00], states Sorey.

Their modus operandi involves callers posing as representatives from the company’s IT department, tricking employees into inadvertently downloading malware. This approach has primarily affected US law firms, potentially compromising sensitive legal information and client data.

11. Surge in SVG-Based Phishing Attacks

A noticeable increase in the abuse of the SVG (Scalable Vector Graphics) image format for phishing has been observed by over a dozen security firms. “A recent surge in abusing the SVG image format has been noted by more than a dozen security firms” [00:00], reports Sorey.

Sublime Security highlighted that SVG-based attacks constituted about 1% of all phishing attempts they monitored in the last six months. The SVG format's proximity to full-featured web pages makes it an attractive vector for malicious actors to craft convincing phishing lures.

12. Russia Deploys Mobile Signal Jammers in Educational Institutions

In an effort to curb cheating during examinations, Russian authorities have installed over 11,000 mobile signal jammers in schools. “Russian authorities deployed more than 11,000 mobile signal jammers in schools to prevent students from cheating during exams” [00:00], elaborates Sorey.

These jammers are strategically placed in exam rooms and some bathrooms, effectively blocking phone signals and preventing students from using hidden wireless earpieces. This measure reflects Russia's stringent approach to maintaining examination integrity through technological enforcement.

---

This summary encapsulates the key discussions and insights from the May 26, 2025 episode of Risky Bulletin, providing a comprehensive overview of the latest developments in cybersecurity and related fields.

Transcript

[Caitlin Sorey]

Foreign exodus of leadership is underway at cisa the US Government will audit NIST over its vulnerability backlog. An ancient and mysterious APT has been linked to Spain's government and the SVG image format is great for phishing. This is the risky bulletin prepared by Catalyn Campano and read by me, Caitlin sorey. Today is May 26th and this podcast episode is brought to you by Sublime Security, an email security platform that's not a black box. Several high ranking officials will leave the US Cybersecurity and Infrastructure Security Agency at the end of May. An internal memo seen by the Washington Post said the heads of three of the agency's six divisions will leave this month. The affected units are cybersecurity, infrastructure, security and integrated Operations. The deputy of a fourth division is also departing. Regional leaders and top officers for finance, strategy, human resources and contracting are also said to be leaving. The US Government will audit the National Institute of Standards and Technologies over its management of the National Vulnerability Database. The audit will assess NIST's processes for managing NVD submissions after the agency developed a huge backlog last year. The audit will be conducted by the US Department of Commerce, Office of Inspector General. The Vietnamese government has ordered local telecom companies to block access to the Telegram instant messenger officials say the company failed to comply with law enforcement requests in cases related to fraud, drug trafficking and terrorism. Ban takes effect in June Telegram told Reuters it was surprised by the decision. The Spanish government is behind a cyber espionage group known as Careto. The group has been active since at least 2007, but has been seen operating infrequently. Its primary targets have been Spain's neighbors and other Spanish speaking countries. Talking to TechCrunch, Kaspersky described the group as very small compared to Lazarus and APT41, but far more sophisticated. Chinese cyber espionage group Silk Typhoon has hacked backup software company commvault. The group gained access to Commvault's Azure servers in February. According to cisa, the intrusion was part of a larger campaign targeting SAS providers. Silk Typhoon also hacked the US Treasury Department late last year. Belgian authorities are seeking 13 years imprisonment for the Russian man accused of developing the Krylock ransomware. Prosecutors are also seeking a 10 year sentence for a woman who allegedly advertised the ransomware online and negotiated with victims. The pair are believed to have infected more than 400 users and earned more than 3 million euros from the attacks. The two were detained in Spain in 2023 and extradited to Belgium to face trial. The court is expected to rule in late June. Russian authorities have sentenced a man to 14 years in prison for uploading Russian's personal data to a Telegram channel managed by Ukrainian intelligence. The man, 37, worked as a programmer at a hospital in Russia's Akirk region. The data also included details of Russian military members. He was found guilty of high treason. Two Romanian nationals have been arrested in Australia for installing skimming devices and ATMs. The two are accused of installing the devices in Sydney and the Illawarra region. They also allegedly cloned bank cards with the stolen data and took more than 800,000 Australian dollars from victims. Authorities have been investigating the pair for a month after banks reported ATMs being tampered with. Law enforcement agencies reportedly hacked Loomasteela's servers because they couldn't physically seize the group's infrastructure. Earlier this month, posting on Telegram, Loomasteela admins claim the FBI used an exploit in Dell's IDRAC Lights out management system to collect data and wipe their backup servers. The post also said law enforcement deployed a phishing page on Luma's portal to collect customer data. The hacks allegedly happened a week before authorities took down the Lumasteela operation. The FBI says that the silent Data Extortion group has been targeting US Companies with phone phishing attacks for two years. The group calls employees pretending to be from their company's IT department and tricks them into infecting themselves with malware. Many of the companies are US Law firms. A recent surge in abusing the SVG image format has been noted by more than a dozen security firms. The SVG format is well suited for misuse, being much closer to a full featured web page than an image file. Sublime security said SVG based attacks accounted for 1% of all phishing attempts it saw in the last six months. Russian authorities deployed more than 11,000 mobile signal jammers in schools to prevent students from cheating during exams. Mobile jammers were installed in exam rooms and some bathrooms there were designed to block phone signals and restrict students using hidden wireless earpieces. That's all for this podcast edition. Today's show was brought to you by our sponsor, Sublime Security. Find them at Sublime Security.