The guest nobody invited.

Key takeaways

Cyber vulnerabilities are rapidly evolving, with high-impact flaws in widely used platforms like TrueConf, Node.js, and Apple devices requiring urgent patches.
Nation-state actors are increasingly targeting supply chains, as seen in the attack on the Rust ecosystem by North Korean hackers.
Ransomware groups continue to diversify their tactics, with signs of internal conflicts and side operations like 'ransom busters' that undermine traditional extortion schemes.
AI-driven scams are a growing threat across demographics, with scammers deploying sophisticated techniques for automation and personalization that increase financial and personal risk.
Innovative, user-focused cybersecurity tools like those from Savi Security are vital to defend against today's complex scam landscape, especially for vulnerable populations such as the sandwich generation.

Summary

Emerging Cyber Threats and Vulnerabilities

This section covers a range of recent security issues including critical vulnerabilities in TrueConf Server that are actively exploited via remote code execution, and a type-confusion flaw in Node.js's isolated VM library that could allow attackers to escape sandbox environments. Additionally, a new Agent Tesla version (v4) employs sophisticated evasion techniques, and malware delivery methods have evolved to exploit FTP server banners for Command and Control activities. Apple has also released patches for significant cross-platform vulnerabilities, notably in its image processing frameworks, which could be exploited for spyware delivery. These issues highlight the continual emergence of high-severity vulnerabilities that require prompt attention and patching.

High-Profile Attacks and Data Breaches

The podcast discusses a suspected breach involving US Bank, where LockBit ransomware claims to have stolen data, although investigations continue with no conclusive evidence. Latvia’s cyberattack exposed personal and business data affecting over 1.2 million people, prompting political resignations and ongoing inquiries. The supply chain attack targeting the Rust ecosystem by North Korean state actors involved maliciously modified libraries to steal credentials and cryptocurrency data, which underscores the increasing sophistication of nation-state cyberactivities.

Cybercrime Economy and Evasion Techniques

New insights reveal the unsettling trend of ransomware affiliates, such as those linked to Dragon Force, Setra, and Anubis, possibly orchestrating side operations like 'ransom busters' who offer to recover files and delete data for less than the ransom. This suggests a fracturing economy among cybercriminal groups. Technologies like AI are enabling scammers to craft highly personalized and automated scams, leading to significant financial losses across all demographics, especially affecting the vulnerable sandwich generation. These developments point to a need for more innovative protective measures.

Consumer-Focused Security Solutions and Insights from Savvy Security

Patrick Coughlin, CEO of Savi Security, shares his motivation for developing tools to combat AI-driven scams, inspired by a personal experience with a fake kidnapping call targeting his mother. The company offers free and subscription-based tools like Scamwise, which quickly assesses suspicious texts, calls, or emails, and the SAVI app that proactively filters and manages scam content on mobile devices. Technical challenges such as maintaining user privacy while analyzing communication are addressed, emphasizing the importance of innovative, consumer-centric cybersecurity solutions.

Show notes

CISA orders patching of TrueConf Server vulnerabilities. LockBit threatens release of stolen banking data. Researchers disclose a critical type confusion vulnerability in a Node.js library. A new Agent Tesla v4 campaign introduces enhanced evasion techniques. A novel malware delivery technique abuses FTP server banners to hide commands. Apple patches a critical image-processing flaw. A North Korean software supply chain attack targets the Rust ecosystem. Latvian officials resign following a major data breach. Defense contractors are confident in compliance, less so in their ability to prove it. Our guest is Patrick Coughlin, Co-Founder and CEO of Savi Security. discussing the free utility he’s developed to protect the sandwich generation from AI-driven scams. When it comes to cyber extortion, who you gonna call?

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Joining us today is Patrick Coughlin, Co-Founder and CEO of Savi Security. Patrick discusses protecting the sandwich generation from AI-driven scams and Scamwise, their free utility built with this purpose in mind. Learn more about Scamwise, a free public utility tool to help consumers quickly determine whether a suspicious message, call, or email is likely a scam, and download Savi’s app.

Selected Reading

CISA orders feds to patch actively exploited TrueConf Server flaws (Bleeping Computer)

US Bank investigates LockBit's claims as ransomware crims set pay-or-leak deadline (The Register)

Critical Isolated-vm Vulnerability Leads to RCE on Host (SecurityWeek)

New Agent Tesla Malware Variant Boosts Evasion Capabilities (Infosecurity Magazine)

Hackers abuse FTP server banners to deliver new Windows malware (Bleeping Computer)

Apple plugs image-processing hole ripe for spyware abuse (The Register)

North Korean Hackers Tied to Rust Supply Chain Attack (Infosecurity Magazine)

Latvian officials resign after cyberattack exposes data on 1.2 million people (The Record)

Contractors' CMMC Confidence Rises as Ability to Prove It Falls Behind (SecurityWeek)

Ransomware crook poses as recovery firm to steal payments from fellow extortionists (The Register)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices