December 10 2024 – Cyber Briefing

👉 What’s the latest in the cyber world today?

WPForms Plugin Flaw, WordPress Sites, Financial Risk, Chinese Hackers, Visual Studio Code, Espionage, Nemesis Group, AWS Vulnerabilities, Russia, Phishing Attacks, Ukraine Defense, OpenWrt, Sysupgrade Flaw, Malicious Firmware, Artivion,Romania, Electrica Group, Sabre Breached, Employee Data, Hackers, DDoS Attacks, Denmark, Municipal Websites, Japan, Sankei, Personal Information, Customers, TikTok, US, Ban, National Security, Rhode Island, Schools, DNS Service, Ransomware Attack, Google, Willow, Quantum Chip, Computing Performance, Russia, Sovereign Internet, Test, OpenAI Startup Fund, $44M, AI Investments

Listen to the full podcast

🚨 Cyber Alerts

1. WPForms Flaw Exposes 6 Million Websites

A critical vulnerability, CVE-2024–11205, has been discovered in the WPForms plugin, which is used by over 6 million WordPress websites. This flaw, with a CVSS score of 8.5, affects businesses using WPForms for payment processing and subscription management, particularly those integrated with Stripe. The vulnerability allows authenticated attackers with low-level access to perform unauthorized refunds and cancellations of Stripe payments, posing significant financial risks to businesses. The issue lies in the improper capability checks in the plugin’s core functionality, which allows attackers to bypass nonce protections.

2. Hackers Exploit VS Code for Cyber Espionage

A suspected China-linked cyber espionage group has been attributed to a campaign targeting business-to-business IT service providers in Southern Europe, known as Operation Digital Eye. The attackers exploited Visual Studio Code Remote Tunnels, a legitimate feature of Microsoft’s IDE, for command-and-control purposes, allowing them to manipulate files and execute arbitrary commands on compromised systems. The campaign began in late June 2024 and was discovered before data exfiltration occurred.

3. Nemesis Group Unveils Campaign Targeting AWS

The Shiny Nemesis Cyber Operation, uncovered by researchers Noam Rotem and Ran Locar, highlights a large-scale cyberattack exploiting misconfigured public sites on AWS cloud infrastructure. The operation, linked to the “Nemesis” and “ShinyHunters” hacking groups, employed advanced tools and scripts to scan and exploit vulnerabilities, harvesting sensitive data, including customer credentials, proprietary source code, and database keys. Attackers used tools like Shodan and SSL certificate analysis to extend their attack surface and leveraged known exploits to install remote shells for deeper access.

4. Phishing Campaign Targets Ukraine’s Defense

Ukraine’s Computer Emergency Response Team (CERT-UA) has identified a phishing campaign targeting the country’s defense companies and security forces, attributed to the Russia-linked group UAC-0185 (UNC4221). Disguised as official emails from the Ukrainian League of Industrialists and Entrepreneurs, the phishing messages promote a fake conference on NATO defense standards. Recipients are lured into clicking malicious URLs, leading to the execution of a Windows shortcut file that downloads a series of payloads.

5. OpenWrt Vulnerability Allows Malware Attacks

A critical vulnerability in OpenWrt’s Attended Sysupgrade (ASU) service, tracked as CVE-2024–54143, exposed devices to potential malicious firmware updates. OpenWrt, a widely used open-source operating system for routers and IoT devices, allows users to create custom firmware images with previously installed packages and settings. The flaw, discovered by security researcher RyotaK, stemmed from insecure command handling and hash truncation issues. This allowed attackers to inject arbitrary commands and create malicious firmware images.

💥 Cyber Incidents

6. Artivion Operations Disrupted by Cyberattack

Artivion, a leading medical device manufacturer specializing in heart surgery products, recently disclosed a cyberattack that disrupted its operations. The incident, which occurred on November 21, 2024, involved attackers encrypting files and exfiltrating data from compromised systems. While the company refrained from explicitly labeling it as a ransomware attack, the characteristics of file encryption and data theft align with ransomware operations. Artivion responded swiftly by taking certain systems offline, launching an investigation, and engaging external experts for legal and cybersecurity assistance.

7. Electrica Group Tackles Ongoing Cyberattack

Romania’s Electrica Group, a key energy distributor serving over 3.8 million customers, is currently addressing an ongoing cyberattack. The company, listed on both the Bucharest and London stock exchanges, assured investors that its critical systems remain secure despite the attack. In a statement, CEO Alexandru Chirita confirmed that specialized teams are collaborating with national cybersecurity authorities to manage and resolve the incident, while temporary protective measures were implemented to safeguard internal infrastructure.

8. Travel Giant Sabre Hit With Data Breach

Sabre GLBL Inc., a leading travel technology provider, has announced a data breach affecting employee-related personal information. On September 6, 2023, the company detected unauthorized access to sensitive data, which was later found to have been posted on the dark web. The breach potentially compromised a range of personal details, including Social Security numbers, financial account numbers, and identification documents.

9. Hackers Target Danish Municipal Websites

Several Danish municipal websites, including those of Aabenraa and Haderslev, were taken offline on December 9, 2024, following a denial-of-service (DDoS) attack. The Danish Center for Cyber Security (CFCS) confirmed the incident and identified strong indications that pro-Russian cyber activists were behind the attack. The CFCS proactively alerted the affected municipalities and worked to stay ahead of potential threats.

10. Sankei Suffers Breach Affecting Thousands

Sankei, a prominent company in Japan, recently disclosed a significant data breach involving its former e-commerce website. The breach, which occurred between December 27, 2019, and May 15, 2024, compromised the personal and financial information of nearly 71,943 customers. Exposed data included sensitive details such as credit card information, names, addresses, and encrypted login credentials. The attack exploited a vulnerability that allowed unauthorized access to transaction data. Sankei responded by shutting down the old website and implementing a new system in May 2024.

📢 Cyber News

11. TikTok Seeks Emergency Pause on US Ban

TikTok has filed for an emergency injunction to prevent its impending ban in the U.S., which is scheduled for January 2025. The request comes after a recent appeal failure against a law that mandates TikTok’s sale or ban, citing national security risks due to its links with China, which TikTok denies. In its legal filing, TikTok and its parent company ByteDance argue that the law would cause irreparable harm, affecting its operations and the 170 million American users of the platform. TikTok also emphasizes the public interest of giving the Supreme Court time to review the case, particularly in light of the upcoming presidential transition.

12. Rhode Island Tackles Ransomware with DNS

Rhode Island has become the first state to implement a statewide cybersecurity tool aimed at safeguarding K-12 schools from growing ransomware threats. The state is deploying the Protective Domain Name Service (PDNS) to protect 136,000 students across 64 districts. This service works by blocking access to malicious websites and preventing cyberattacks before they occur. The tool, which requires no complex setup or passwords, is a federally funded, no-cost solution designed to address the increasing cyber risks faced by schools.

13. Google Reveals Quantum Chip Breakthrough

Google has made a significant leap in quantum computing with the unveiling of its new chip, Willow, which is capable of solving a complex computational task in under five minutes — a process that would take a supercomputer 10 septillion years. This breakthrough marks a major advancement from Google’s 2019 achievement, where its quantum processor solved a problem in three minutes instead of 10,000 years. Willow features 105 qubits and represents a significant step forward in overcoming quantum computing’s error correction challenges.

14. Russia Tests Sovereign Internet with Outages

Russia recently conducted tests of its “sovereign internet” infrastructure by disrupting internet access in several regions, including Chechnya, Dagestan, and Ingushetia. These trials, aimed at evaluating the country’s ability to maintain domestic services amid potential external interference, lasted for nearly 24 hours in some areas. During this time, residents were unable to access both foreign and local websites, including YouTube, Google, WhatsApp, Telegram, and even some services of the Russian tech giant Yandex.

15. OpenAI Startup Fund Raises $44 Million

The OpenAI Startup Fund, an early-stage AI investor, has successfully raised $44 million for its fifth Special Purpose Vehicle (SPV), marking its largest raise to date. Established in 2021, the Fund operates with a unique structure where OpenAI’s name is used, but the organization itself does not invest. Although OpenAI co-founder Sam Altman initially had legal control, this was handed over to general partner Ian Hathaway earlier in 2024. The fund, which has been on a strong fundraising streak, aims to support existing portfolio companies and make new investments in high-potential AI startups.