Risky Bulletin: New Microsoft accounts will be passwordless by default

Summary

Risky Bulletin: New Microsoft Accounts Will Be Passwordless by Default

Podcast Information:

• Title: Risky Bulletin
• Host/Author: risky.biz
• Episode: Risky Bulletin: New Microsoft accounts will be passwordless by default
• Release Date: May 2, 2025
• Description: Regular cybersecurity news updates from the Risky Business team.

---

Introduction

In the May 2, 2025 episode of Risky Bulletin, host Claire Aird presents a comprehensive overview of the latest developments in the cybersecurity landscape. The episode, prepared by Catalyn Kim and Panu, delves into significant updates ranging from Microsoft's shift to passwordless authentication to major breaches affecting prominent companies.

Microsoft Embraces Passwordless Authentication

Microsoft is making a pivotal change by instituting passwordless logins as the default for all new user accounts. This initiative leverages advanced authentication methods such as passkeys and facial recognition to enhance security and user experience.

"New Microsoft accounts will be passwordless by default. Login alternatives will include passkeys or facial recognition."
— Claire Aird [00:04]

Microsoft has also revamped its login interface to make passwordless options more attractive to users. Since integrating passkey support a year prior, the company has witnessed the creation of over a million passkeys daily, as reported by the Dutch government.

US Dominates the European Cybersecurity Market

The European Union’s reliance on foreign entities for cybersecurity services remains a concern. US-based companies command a substantial 75% share of the EU cybersecurity market, leaving only 25% occupied by European providers. This imbalance has prompted EU officials to advocate for reallocating some defense funds towards bolstering internal cybersecurity capabilities.

"US companies dominate the European cybersecurity market, with EU providers making up just 25%."
— Claire Aird [02:15]

Security Breaches in UK Retail Sector

Two major UK retail chains, Co Op and Harrods, have recently disclosed security breaches aimed at infiltrating their internal systems. In response, Co Op has partially disabled its IT infrastructure and mandated that employees keep their cameras on during virtual meetings to detect potential insider threats.

"Retailer Co Op has disabled part of its IT system and has told staff to turn cameras on during virtual meetings."
— Claire Aird [03:05]

Harrods has taken the precautionary step of disconnecting Internet access at its stores while investigating the breach. These incidents underscore the persistent vulnerability of the retail sector to cyberattacks.

Additionally, Marks & Spencer experienced a significant financial setback, losing £500 million in market value following a cyberattack earlier in the week.

Commvault and Grafana Suffer Breaches

Backup software giant Commvault announced a breach in its Azure environment, attributing the intrusion to a state-sponsored group. Fortunately, the attackers did not access customer backup data, and the incident is unrelated to a recent flaw exploited in on-premises Commvault backup servers.

"The company says the breach in February was the work of a state-sponsored group, but the attackers did not gain access to customer backup data."
— Claire Aird [04:20]

Meanwhile, Grafana, known for its IT monitoring solutions, reported unauthorized access to its GitHub repository and authentication tokens. The breach was traced to a newly deployed GitHub action. Grafana has since rotated all exposed tokens and found no evidence of further compromise.

Geopolitical Cyber Threats

US officials have accused China of orchestrating a cyberattack on Guatemala's Ministry of Foreign Affairs in September 2022. The breach was uncovered during a collaborative investigation between the Guatemalan government and the US military, highlighting ongoing tensions in cyber espionage.

In related news, Artem Stryshak, a Ukrainian national linked to the Nephilim ransomware gang, was extradited from Spain to the US. Stryshak's arrest marks a significant development in the fight against ransomware operations targeting North American and Australian enterprises.

Apple Alerts Users to Government Spyware

Apple has issued a new round of notifications to over 100 countries' users, warning them about potential government spyware targeting their devices. Notable recipients of these alerts include an Italian journalist and a Dutch right-wing activist, indicating the breadth of Apple’s protective measures.

"Apple has sent a fresh round of notifications to users who may have been targeted with government spyware."
— Claire Aird [05:00]

Phishing and Cryptocurrency Threats

Cryptocurrency wallet owners, particularly those using Ledger, are being targeted by threat actors sending meticulously crafted paper letters. These letters impersonate Ledger’s security team and prompt recipients to validate their wallets via a QR code, leading to phishing pages designed to steal recovery phrases and drain wallets.

In other crypto-related news, Ecks, a cryptocurrency mixer service, has ceased operations following its ties to money laundering activities. Launched in 2014 and gaining popularity in 2022, Ecks facilitated the laundering of funds from significant hacks involving Parity Wallet, Bitbrowser, and Bybit.

"Cryptocurrency mixer Ecks has shut down operations after being linked to money laundering."
— Claire Aird [06:10]

Ransom Hub Compromised by Dragonforce

Ransom Hub, a prominent ransomware group, has been offline for over a month after being compromised by rival group Dragonforce. There has been no new activity reported on hacking forums, and dark web portals associated with Ransom Hub remain dormant. Dragonforce affiliates appear to have transitioned to utilizing the Qilin ransomware strain.

Chinese APT Group Exploits Software Updates

A sophisticated Chinese Advanced Persistent Threat (APT) group, known as Wizards, has been targeting organizations across Southeast Asia by hijacking software updates. Active since 2022, Wizards employs a tool named Spell that utilizes IPv6 Slack spoofing to redirect DNS queries. This technique allows them to replace legitimate software updates with malicious versions, compromising targeted systems.

"A Chinese APT group is hijacking software updates in organizations across Southeast Asia using a novel technique."
— Claire Aird [07:30]

Security firm ESET has connected this APT to Dianker Network Security Technology (UPSEC), further elucidating the group's operational tactics.

Raytheon Penalized for Cybersecurity Non-Compliance

Defence contractor Raytheon has agreed to pay an $8.4 million fine for failing to meet Pentagon cybersecurity requirements. The infraction pertains to contracts held between 2015 and 2021, with non-compliance revealed by a former director of engineering. As part of the settlement, the former director received $1.5 million.

"Raytheon has agreed to pay $8.4 million for failing to comply with Pentagon cybersecurity requirements."
— Claire Aird [08:45]

Conclusion

The episode of Risky Bulletin offers an in-depth examination of the current threats and developments in cybersecurity, emphasizing the critical need for robust security measures across various sectors. From Microsoft's transition to passwordless authentication to geopolitical cyber threats and significant breaches affecting major corporations, the bulletin underscores the evolving challenges in safeguarding digital infrastructure.

---

This summary captures the key discussions, insights, and conclusions presented in the Risky Bulletin episode titled "New Microsoft accounts will be passwordless by default." For more detailed information, listening to the full episode is recommended.

Transcript

[A]

New Microsoft accounts will be passwordless by default. A Chinese APT is hijacking software updates the US dominates the EU cybersecurity market and Commvault discloses a breach this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 2nd of May and this podcast episode is brought to you by DropZone AI. Microsoft is making passwordless logins the default setting for new user accounts. Login alternatives will include passkeys or facial recognition. Microsoft has also updated its login experience to make using passwordless authentication more appealing. Since adding passkey support a year ago, Microsoft has seen more than a million passkeys created per day, according to the Dutch government. The EU is dependent on foreign companies for its cybersecurity services. US companies dominate the European cybersecurity market, with EU providers making up just 25%. Officials have called for some of the EU's current defence investment to be directed towards cybersecurity. Two UK retail chains have disclosed security breaches where hackers tried to gain access to internal systems. Retailer Co Op has disabled part of its IT system and has told staff to turn cameras on during virtual meetings. They hope this will help them spot wily hackers lurking in their midst. Harrods is also investigating a breach and has disconnected Internet access at its stores. Earlier this week, another UK retailer, Marks & Spencer, said it lost 500 million pounds in market value following a cyber attack. Hackers have breached the Azure environment of backup software company Commvault. The company says the breach in February was the work of a state sponsored group, but the attackers did not gain access to customer backup data. The hack is unrelated to recent exploitation of a flaw in on premise Commvault backup servers. The Grafana project says someone gained access to its GitHub repository and auth tokens. The company, which manages open source and commercial IT monitoring solutions, has traced the breach to a newly deployed GitHub action. Grafana says it rotated all exposed tokens and found no evidence of abuse or unauthorised access in other parts of its systems. US officials have accused China of hacking Guatemala's Ministry of Foreign Affairs. The hack allegedly took place in September 2022. It was discovered during a joint investigation by the Guatemalan government and the US military. US authorities have extradited a Ukrainian national over his role in the Nephilim ransomware gang. Artem Stryshak was arrested in Spain last June and extradited to the US on Wednesday. Nephilim has been active since 2020 and has been known to target large companies in the us, Canada and Australia. Apple has sent a fresh round of notifications to users who may have been targeted with government spyware. The notifications were sent this week to users in more than 100 countries. The recipients included an Italian journalist and a Dutch right wing activist. Threat actors are snail mailing paper letters to Ledger crypto wallet owners. The letters claim to be from Ledger's security team and instruct recipients to validate their wallets by scanning a QR code. The QR code takes the targets to a phishing page that collects their recovery phrases. These are used by the scammers to empty the victims wallets. Cryptocurrency mixer Ecks has shut down operations after being linked to money laundering. The Service launched in 2014. It grew in popularity in 2022 after announcing it wouldn't help authorities track hacked funds. The site laundered the proceeds of the Parity Wallet, Bitbrowser and Bybit hacks. According to blockchain investigation firm Elliptic, 98% of funds that passed through the service were linked to criminal activity. Ransom Hub has been offline for more than a month since being hacked by rival group Dragonforce. No new Ransom Hub activity has been reported on hacking forums and its dark web portals have remained offline. Reports indicate the group's affiliates have now switched to using the Qilin ransomware. A Chinese APT group is hijacking software updates in organisations across Southeast Asia using a novel technique. The Wizards group has been active since 2022. It deploys a tool named Spell that uses IPv6 Slack spoofing to redirect DNS queries. The group intercepts queries associated with updates for Chinese software and redirects them to malicious versions. Security firm ESET has linked the APT to a Chinese company named Dianker Network Security Technology, also known as UPSEC. And finally, defence contractor Raytheon has agreed to pay $8.4 million for failing to comply with Pentagon cybersecurity requirements. The fine relates to 2019 Pentagon contracts that the company held between 2015 and 2021. The company's non compliance was exposed by a former director of Engineering who received $1.5 million from the settlement. And that is all for this podcast edition. Today's show is brought to you by our sponsor DropZone AI. Find them at DropZone AI.

[B]

Thanks.