November 27 2024 – Cyber Briefing

👉 What’s trending in cybersecurity today?

Matrix Botnet, IoT Flaws, DDoS Attacks, Bootkitty, UEFI Bootkit, Linux, Servers, Chinese Hackers, GHOSTSPIDER, Malware, Espionage, Telecoms, NVIDIA, Unified Fabric Manager, Privilege Escalation, GitLab, Critical Vulnerability, OpenAI, Sora, Leak, Beta Testers, Ransomware Attack, Spain, National Agriculture Research Center, Fukushima Police, Email Server, Exploitation, Telstra, Breach, Employees, Australia, Mortgage Broker, Finsure, Customer Data, Washington State, Breaches, Surge, Australia, Ransom Payment, Reporting, Bluesky Open API, AI Training, INTERPOL, Africa, Cybercrime Networks, Anti-Ransomware Firm Halcyon, Series C

Listen to the full podcast

🚨 Cyber Alerts

1. Matrix Botnet Exploits IoT Devices for DDoS

The Matrix Botnet has emerged as a significant threat, exploiting vulnerabilities and misconfigurations in Internet of Things (IoT) devices to launch widespread distributed denial-of-service (DDoS) attacks. Leveraging weak or default credentials and targeting unpatched devices such as IP cameras, DVRs, routers, and telecom equipment, the botnet has primarily affected IP addresses in China, Japan, and several other countries. The operation integrates scanning, exploiting, and malware deployment, using publicly available tools and scripts, including Mirai-based malware, PYbot, and custom DDoS programs.

2. New Bootkitty UEFI Bootkit Targeting Linux

Researchers have uncovered Bootkitty, the first UEFI bootkit specifically targeting Linux systems, marking a significant expansion in the evolution of UEFI threats. Traditionally, UEFI bootkits have focused on Windows platforms, but Bootkitty demonstrates how attackers are broadening their scope. Though currently a proof of concept, Bootkitty disables kernel signature verification and manipulates the Linux init process to preload malicious ELF binaries.

3. Telecoms Targeted With GHOSTSPIDER Malware

A China-linked advanced persistent threat (APT) group, Earth Estries, has been using a previously undocumented backdoor called GHOSTSPIDER to target telecommunications companies across Southeast Asia. This sophisticated attack campaign has compromised over 20 organizations in industries such as telecommunications, technology, government, and non-profits. The malware, part of a broader toolkit that includes other backdoors like MASOL RAT, Deed RAT, and the Demodex rootkit, exploits known vulnerabilities in systems like Ivanti Connect Secure and Microsoft Exchange Server to gain initial access.

4. NVIDIA UFM Flaw Enables Privilege Escalation

A critical vulnerability (CVE-2024–0130) has been discovered in NVIDIA’s UFM (Unified Fabric Manager) product line, affecting multiple versions of UFM Enterprise, UFM Appliance, UFM SDN Appliance, and UFM CyberAI. The flaw, which carries a CVSS score of 8.8, stems from improper authentication in the Ethernet management interface of the affected systems. Attackers could exploit this vulnerability to escalate privileges, tamper with data, cause denial of service, and potentially gain access to sensitive information.

5. GitLab Flaw Allows Privilege Escalation

GitLab has issued critical security updates to address multiple vulnerabilities in its Community and Enterprise Editions. One of the most severe flaws, CVE-2024–8114, could allow attackers to escalate privileges by exploiting a compromised Personal Access Token (PAT), affecting all versions from 8.12 up to but not including the patched versions 17.4.5, 17.5.3, and 17.6.1. The vulnerability has a high CVSS score of 8.2, highlighting its potential impact on confidentiality and integrity. Additionally, several medium-severity issues, including denial-of-service (DoS) vulnerabilities and unauthorized access to sensitive data, have been patched.

💥 Cyber Incidents

6. OpenAI’s Sora Tool Leaked by Beta Testers

A group of artists and early testers have leaked OpenAI’s unreleased text-to-video tool, Sora, as part of a protest against the company for allegedly exploiting their contributions during the tool’s research and development phase. The group, known as “PR-Puppets,” accused OpenAI of using their unpaid labor for bug testing, feedback, and creative input without offering compensation or recognition. In response, they published a front-end version of Sora on the AI platform Hugging Face on November 26, 2024, allowing anyone to use the tool before OpenAI intervened and took it down.

7. Agricultural Center Disrupted by Ransomware

Spain’s largest agricultural research center, the Instituto Nacional de Investigación de Tecnología Agraria y Alimentaria (INIA-CSIC), has been severely impacted by a ransomware attack that began on November 12, 2024. The cyberattack has left over 600 employees unable to access internal systems, scientific data, and the internet. Sensitive data stored on affected devices was encrypted, but prompt response efforts reportedly contained the spread of the malware. The attack has disrupted vital research activities, such as genetic editing and endangered species conservation, while also halting essential operations like procurement and data sharing.

8. Fukushima Police Email Server Compromised

On November 26, 2024, the Fukushima Prefectural Police’s email server was compromised, relaying around 50,000 emails with the subject “Notice” or similar to both domestic and international recipients. The attack occurred between 6:00 a.m. and 2:00 p.m., affecting an external-facing server used for public relations and corporate communications. Importantly, the internal server used for police communications remained unaffected, limiting the broader impact on critical law enforcement operations. The breach highlights ongoing cybersecurity risks to government infrastructure, especially those systems interacting with the public.

9. Telstra Hit With Breach Affecting Employees

Telstra has confirmed a data breach involving one of its internal systems, where threat actors accessed and stole data related to employees and partners. The breach occurred when the attackers used stolen credentials to infiltrate a pre-production test environment. The data, which includes names, email addresses, physical addresses, and some mobile phone numbers, does not involve customer information such as passwords or financial data. Telstra has since restricted access and informed affected individuals while working with authorities to investigate the incident.

10. Aussie Mortgage Broker Finsure Breached

Australian mortgage broking group Finsure has confirmed a recent cyber incident involving the exposure of marketing data linked to nearly 300,000 of its customers and brokers. The breach, which occurred through compromised credentials on a third-party platform, was highlighted when these email addresses appeared on the “Have I Been Pwned” database. While personal information such as financial data, passwords, and credit card details were not affected, the exposed data includes names, email addresses, phone numbers, and physical addresses, much of which is publicly available.

📢 Cyber News

11. Washington Data Breaches Hit All-Time High

In 2024, Washington state has reached a troubling milestone with data breaches hitting an all-time high, as reported by the Attorney General’s Office. Over 11.6 million breach notifications were sent to Washington residents, a significant increase from the previous record of 6.6 million in 2021. The rise in cyberattacks, particularly ransomware, now makes up 78% of all breaches, affecting both large corporations like Starbucks and smaller businesses across the state. Experts attribute the surge to the growing profitability of cybercrime and the sophistication of attacks, urging businesses to prioritize cybersecurity and consider insurance to recover from such incidents.

12. Australia’s New Law Targets Ransom Payments

Australia has officially passed a landmark cybersecurity law that mandates organizations to report ransom payments. The new legislation, part of a broader cybersecurity package, aims to enhance the nation’s resilience against cyber threats. It requires certain organizations to disclose ransomware payments, helping the government better understand the economic and social impact of such incidents. Additionally, the law sets basic cybersecurity standards for connected devices, allowing authorities to test and remove devices with vulnerabilities.

13. Bluesky’s Open API Sparks Privacy Debate

Bluesky, the rapidly growing decentralized social platform, has come under scrutiny for its open Firehose API, which allows third parties to scrape public user data. A recent incident highlighted by 404 Media revealed that a Hugging Face researcher collected 1 million public Bluesky posts for machine learning research, sparking a debate about consent and data privacy. Although the dataset was later removed, the event underscores the vulnerability of public content to external misuse. Bluesky has acknowledged the issue, emphasizing its commitment to developing tools for users to express consent preferences, though it admits enforcement outside its platform is limited.

14. INTERPOL Busts Major African Cybercrime Ring

INTERPOL’s Operation Serengeti has led to the arrest of 1,006 suspects across 19 African countries and the dismantling of over 134,000 malicious networks involved in cybercrime. The operation, which took place from September 2 to October 31, 2024, targeted a wide range of criminal activities including ransomware, business email compromise (BEC), digital extortion, and online scams. The coordinated effort uncovered global financial losses totaling nearly $193 million, affecting over 35,000 victims. Notable arrests included those involved in an online Ponzi scheme, with authorities seizing substantial evidence, including SIM cards, cash, and personal identification data.

15. Anti-Ransomware Firm Halcyon Secures $100M

Halcyon, an anti-ransomware firm, has raised $100 million in Series C funding, bringing its valuation to $1 billion. Founded in 2021 and led by Jon Miller, former chief research officer at Cylance, Halcyon specializes in protecting Mac, Linux, and cloud environments from evolving ransomware threats. The company’s unique attacker-led approach allows it to develop proactive countermeasures based on real-time insights into ransomware tactics. With this funding, Halcyon plans to expand its market presence, particularly in Japan, and strengthen strategic partnerships with companies like Dell and Cisco.