GoshDarn it, that’s advanced.

This section discusses the evolving sophistication of ransomware, specifically highlighting the new 'GoshDarn' ransomware. Researchers at Semtiex observe that this malware, an evolution of the Hyadena family, uses advanced tactics including malicious kernel drivers signed by Microsoft to disable security tools and deploy credential theft utilities. The episode also covers the importance of timely patching, as exemplified by Zimbra urging users to fix a critical cross-site scripting vulnerability in its web client—highlighting ongoing threats targeting collaboration platforms. Additionally, a sophisticated vishing campaign is targeting Microsoft 365 accounts, manipulating users into granting attacker-controlled access using social engineering tactics.

Highlighting the emergence of GigaWiper, a new modular malware platform, Microsoft reports it combines espionage capabilities with destructive payloads, allowing for stealthy data gathering and system sabotage. The malware's capabilities include ransomware-like encryption, disk wiping, and crash triggers, representing a significant evolution in destructive cyber tools. The segment emphasizes the importance of understanding these threats and the need for improved defenses against such advanced malware.

The European Commission is examining Meta's design choices on Facebook and Instagram, preliminarily finding that features like infinite scroll and autoplay may encourage addictive use, especially in vulnerable populations. The Commission also criticizes the ineffective safeguards against excessive use. Meanwhile, EU member states face pressure for delayed implementation of cybersecurity laws such as NIS-2 and the Digital Operations Resilience Act. The episode also notes the reorganization of the NSA's elite cyber unit, revival of TAO, aiming to bolster offensive cybersecurity capabilities, with a focus on countering nation-state threats.

A significant data exposure incident is reported in Puerto Rico, where a government agency inadvertently published sensitive social security numbers of nearly a million individuals via an online property system—exposing vulnerabilities in government cybersecurity practices. In the US, a former ransomware negotiator, Angelo Martino, receives a prison sentence for assisting the Black Cat ransomware gang by providing negotiation strategies, highlighting insider threats. Additionally, a physical security breach in Florida involved a red-teamer who posed as a Wi-Fi technician, stealing a valuable trophy, illustrating the effectiveness of social engineering and physical security flaws.

Maxim Zavodchik, Senior Director of AI Security Research at Akamai, discusses upcoming changes to the MCP (Meta Connection Protocol). He explains the protocol’s evolution towards a stateless architecture, which enhances security by reducing certain session hijacking risks but shifts the responsibility of security to applications. Zavodchik highlights potential attack vectors introduced by newer features like metadata injection and task abuse, and he advises organizations on best practices for validation and security measures to adapt to these architectural changes, emphasizing the importance of secure implementation.

The episode wraps with a reminder about the importance of cautious physical security, as demonstrated by the Wi-Fi phony technician incident. It also includes sponsorship promotions from Vanta, emphasizing automated security and compliance solutions, and from Google Chrome Gemini, highlighting advanced browsing tools. The hosts thank listeners, encourage feedback, and promote upcoming episodes, including special coverage at Black Hat USA.