CyberWire Daily
Gone with the command.
· Summarized
Key takeaways
- International law enforcement and industry collaborations are actively disrupting cybercriminal and malware infrastructures.
- Nation-state hackers continue to target critical infrastructure, with warnings issued about future sabotage potential.
- Emerging vulnerabilities like Mystic backdoor and Cordyceps supply chain flaw highlight ongoing risks in cybersecurity due to sophisticated malware and insecure development practices.
- Cyber espionage is often masked as ransomware attacks, complicating attribution efforts, with examples from Iranian and Russian threat actors.
- Advances in AI-powered cybersecurity tools show promise, but also introduce new risks and competition in the cyber defense landscape.
- Law enforcement is increasingly effective in prosecuting cybercriminals, exemplified by the DraftKings case.
- Public education initiatives like KnowBe4’s CAPY program aim to empower families with essential cybersecurity knowledge, fostering safer online environments for all ages.
Summary
International Cyber Operations and Disruptions
This section covers recent global efforts to disrupt cybercriminal infrastructure, notably law enforcement and industry collaborations that took down command and control servers associated with malware strains MAD and STLC. Microsoft used AI-assisted analysis along with legal actions to shut down over 200 servers, with significant support from international agencies and security firms like ESET, IBM X-Force, and Proofpoint. The focus remains on dismantling cybercrime supply chains and preventing further attacks.
Nation-States and Critical Infrastructure Security
Australian intelligence officials issued warnings about nation-state hackers targeting critical infrastructure, including energy, communications, and defense sectors. While they did not specify the threat actor, concerns center on advanced persistent threats aiming to establish access for future sabotage. Meanwhile, other countries such as Russia and Iran are highlighted for their persistent cyber espionage activities, with Russian use of Cellebrite tools post-ban and Iran-linked MuddyWater disguising espionage under ransomware operations.
Emerging Threats and Vulnerabilities in Cybersecurity
Researchers uncovered a new backdoor called Mystic, potentially linked to ransomware access brokers Woodnet, indicating sophisticated stealth and development capabilities. Additionally, the NOV Security team identified a supply chain flaw termed Cordyceps affecting open-source CI/CD workflows, which could allow malicious hijacking of build processes and injection of malicious code. These vulnerabilities raise alarms about the security of software supply chains and the need for rigorous controls.
Cyber Espionage and Disguised Attacks
Operators like MuddyWater are increasingly embedding espionage activities within ransomware campaigns to complicate attribution and distract defenders. An example involved espionage targeting Iran's Ministry of Intelligence, masked as a ransomware attack. On a related note, Cal Water’s investigation found that claims of sabotage by Iranian hackers were overstated, demonstrating that threat actors often exaggerate their capabilities or intentions.
Technology and Security Tools Developments
Chinese cybersecurity firm 360 Security unveiled AI-powered tools for vulnerability discovery and automated cyber defense, challenging existing solutions like Anthropic’s Mythos. Meanwhile, vendors like Cellebrite continue to face scrutiny for their digital forensic tools, which were found to be used beyond approved scopes in Russia. Additionally, researchers flagged millions of smart TV apps, many functioning as covert proxy servers, thus exposing new attack surfaces in IoT devices.
Notable Cyber Criminals and Legal Cases
Nathan Ostad from Minnesota received an 18-month prison sentence for hacking DraftKings and selling user account access. The case exemplifies law enforcement efforts to curb cybercrime activities, especially when financial motives intertwine with broader criminal enterprises.
Community Engagement and Cybersecurity Education
Eric Kron from KnowBe4 discussed the CAPY (Cyber Awareness Program for You), a free online resource geared toward educating families about cybersecurity. The program offers tailored content for children, teens, and adults, emphasizing simple, digestible lessons on scams, credential security, and online safety, reflecting a shift toward proactive community-level cybersecurity awareness.
Sponsors
- Oli · Start your mornings off right with multis-made to support nutrition and immune health. Choose from our lineup of gut supporting probiotics, and we've got occasional sleep support to help the whole fan chase their big dreams. Head back to class with the number one gummy supplement brand. Stuck up on Oli.com today. These statements have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, prevent any disease.
- Black Hat USA · If you follow the research, you know a lot of it breaks on Black Hat stages. Hundreds of peer-reviewed briefings, more than 100 hands-on trainings, and the largest business hall in Blackhats history. Six days to learn the skills you'll need tomorrow. Use code CyberWire for $200 off your briefings pass at BlackHat.com. We'll see you in Vegas.
- Google Chrome · It's new, it can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration blog, or finally breaking down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense? There's no place like Chrome.
- Vanta · When you need to build up your team to handle the growing chaos at work, use Indeed Sponsored Jobs. It gives your job post the boost it needs to be seen, and helps reach people with the right skills, certifications, and more. Spend less time searching and more time actually interviewing candidates who check all your boxes. Listeners of this show will get a $75 sponsor job credit at nd.com/podcast. That's indeed.com/podcast.
- Home Depot · Right now get up to 15% off select storage solutions! Put heavy-duty HDX Totes to good use protecting what's important to you. The solid impact resistant design prevents cracking and the clear base and sides make items easy to find even when the totes are stacked. Find select shelving and tote storage up to 15% off at the Home Depot to organize every room in your home from your garage to your attic. Visit HomeDepot.com. How doers get more done.
Show notes
International operation disrupts Amadey and StealC malware infrastructure. Australian spy chief warns nation-state hackers are prepositioning for future sabotage. Stealthy new backdoor may be tied to initial access broker. Researchers uncover "Cordyceps" supply chain flaw. Iran-linked MuddyWater disguises espionage as ransomware attack. Cal Water says Handala's hacking claims were overstated. Report says Russia continued using Cellebrite phone-cracking tools after the ban. Chinese cybersecurity firm unveils AI tools to rival Anthropic's Mythos. DraftKings hacker is sentenced to eighteen months. Our guest is Erich Kron, CISO Advisor at KnowBe4, sharing the details of the CAPY program. And more Than Meets the Eye-P.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
CyberWire Guest
Today we are joined by Erich Kron, CISO Advisor at KnowBe4, sharing the details of the CAPY (Cyber Awareness Program for You) program that offers free cybersecurity training for families.
Selected Reading
Three ‘cybercrime as a service’ operations undercut by Microsoft, law enforcement (The Record)
Scaling cybercrime disruption through innovation and AI (Microsoft)
Nation-state actors cracked critical Australian infrastructure to ‘cripple it at a time of their choosing’ (The Register)
Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker (Security.com)
Cordyceps: The Silent Parasite Consuming Your Supply Chain (Novee)
Iran-Linked MuddyWater Poses as Ransomware Gang to Mask Cyber Espionage (Infosecurity Magazine)
Cal Water Finds No Evidence of OT Activity After Hackers Claimed They Could Disrupt Water Supply (SecurityWeek)
Russia used Cellebrite phone-hacking tool to crack down on dissident after firm cut off country (The Record)
China’s 360 says it has developed tools to match Anthropic’s Mythos (Reuters)
DraftKings hacker 'Snoopy' sentenced to 18 months in prison (BleepingComputer)
Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs (Spur Intelligence)
Share your feedback.
What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.
Want to hear your company in the show?
N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Follow this show on AudioBrevity and new episodes get summarized for you. Create a free account