SAN MATEO, CA, January 20, 2025 — Cybersecurity news weekly roundup. Stories, news, politics, and events that impacted the network security industry last week. Sponsored by NetworkTigers.
Biden issues last-minute cybersecurity executive order
Outgoing President Joe Biden has issued an “Executive Order on Strengthening and Promoting Innovation in the Nation’s Cybersecurity” in an effort to bolster the country’s digital infrastructure amidst ongoing threats from China and Russia. The Executive Order also seeks to make software and cloud service providers more accountable and strengthen the security of federal communications. Some of the requirements listed in the order include mandating that federal agencies encrypt internal messages, requiring software vendors to demonstrate compliance with requirements introduced in Biden’s 2022 cybersecurity-focused executive order, and establishing the Pentagon’s own AI models to help with cyber defense. The security community is generally satisfied with the new rules, but some feel they could have gone further. Read more.
FTC sues GoDaddy for poor hosting security practices
The Federal Trade Commission is suing GoDaddy for what it says are years of negligent security practices and will be required to implement baseline security protections such as HTTPS APIs and mandatory multi-factor authentication. The FCC says that GoDaddy’s security issues include a failure to use multi-factor authentication (MFA), manage software updates, log security-related events, segment its network, monitor for security threats, and use file integrity monitoring. “Millions of companies, particularly small businesses, rely on web hosting providers like GoDaddy to secure the websites they and their customers rely on,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is acting today to ensure that companies like GoDaddy bolster their security systems to protect consumers around the globe.” Read more.
North Korea exposed in 2016 crowdfunding scam
Secureworks Counter Threat Unit has reported that they have discovered links between North Korean IT worker schemes a fraudulent crowdfunding scam from 2016. Nickel Tapestry, “a threat actor that comprises multiple clusters of activity operated on behalf of North Korean interests,” has been linked to the crowdfunding campaign that generated around $20,000 to be allocated to Pyongyang. Rafe Pilling, Director of Threat Intelligence at SecureWorks CTU, said, “Over the past 12 months, we’ve seen the North Korean IT worker scheme evolve, leveraging deepfakes and AI. To counter state-sponsored groups like Nickle Tapestry, it’s crucial to understand not only how their tradecraft is changing, but also where it began.” Secureworks Counter Threat Unit made the connection between the two schemes by uncovering an overlap in infrastructure between a phony IndieGoGo campaign that advertised a Kratos portable wireless memory device and current IT worker campaigns. Read more.
Change Healthcare hid breach from search engine results
Change Healthcare lost more than 100 million people’s health data in a ransomware attack and has recently reported that it has “substantially” completed notifying those affected by the exposure. However, those looking for official word from the company about the breach itself are not likely to find a relevant, official notice from them, as they have hidden the information from search engines using the “noindex” code on the page that hosts it. The findings come from TechCrunch, who say that the code has been included on the data breach notice since November of 2024. The detail adds to a lengthy list of issues several U.S. states have called out relating to the company’s slow response to the largest breach of healthcare data in U.S. history and the security failings that allowed it to occur. Read more.
FBI deletes PlugX malware from 4,250 hacked computers
According to a disclosure from the U.S. Department of Justice, the FBI has been engaged in a court-authorized, multi-month operation in which they deleted instances of PlugX malware from more than 4,250 infected computers. The PlugX variant has been linked to Mustang Panda, a state-sponsored Chinese hacking group. “Since at least 2014, Mustang Panda hackers then infiltrated thousands of computer systems in campaigns targeting U.S. victims, as well as European and Asian governments and businesses, and Chinese dissident groups,” the DoJ said. The variant is said to spread via attached USB devices and, once installed, communicates with a server maintained by the threat actors to await further data-collecting instructions. Read more.
Allstate Insurance tracks drivers without their permission
Insurance giant Allstate and its data subsidiary Arity are facing a lawsuit filed by Texas Attorney General Ken Paxton that accuses the company of “collecting, using, and selling driving data from over 45 million Americans.” Allegedly, the companies paid millions of dollars to app developers “to embed tracking code in widely used mobile apps to gather the location and movement data of people without their knowledge or consent.” This data was then used to adjust insurance quotes by monitoring driving habits. The companies are also accused of selling the data they collected to other insurance companies for similar purposes. Allstate’s practices violate the Texas Data Privacy and Security Act, which requires companies to inform users that their data is being harvested. Read more.
iPhone users tricked into disabling protections
Apple’s iMessage automatically disables links from messages originating from unknown senders. However, cybercriminals use a scheme that convinces victims to turn it off. Messages purporting to be from shipping companies or utility services that include a malicious link follow it with instructions that tell the user to reply with “Y” and then “reopen the text message activation link, or copy the link to Safari browser to open it.” Following the instructions enables the embedded links and turns off protections for the text in question. Furthermore, an individual replying to the message but not clicking the link informs the scammer on the other end that they have reached a person who is likely to be convinced in the future. Read more.
Threat actors hide infostealers on YouTube and Google
Threat actors are weaponizing YouTube comments and Google Search results to target individuals looking for cracked or pirated software, according to findings from Trend Micro. On YouTube, hackers create legitimate software installation tutorial videos and then direct viewers to comments or video descriptions where malicious links are used to trick victims into downloading malware. Google Search results are being seeded with results along the same theme, with links to seemingly authentic downloaders hiding infostealing malware. The criminals “often use reputable file hosting services like Mediafire and Mega.nz to conceal the origin of their malware and make detection and removal more difficult,” Trend Micro researchers Ryan Maglaque, Jay Nebre, and Allixon Kristoffer Francisco said. Furthermore, the researchers say that malicious downloads can evade early detection by being password-protected and encoded. Read more.
FunkSec ransomware group uses AI to create malware
A new ransomware group, FunkSec, appears to be using AI to assist in their malware development. Check Point researchers note that little information exists about FunkSec. The group does not seem to have connections to other known ransomware operations, and its origin remains a mystery. Strangely, the demands made by the group are small compared to others, with some as little as $10,000, and researchers believe that it is being spearheaded by an individual or group with little experience. Check Point researchers point out that the gang’s “rapid iteration” is likely due to the use of AI in creating their malware, further speaking to “the author’s apparent lack of technical expertise.” Read more.
Banshee Stealer attack campaign sets sights on Mac users
A campaign featuring a newly evolved version of Banshee Stealer’s stealer-as-a-service malware is putting Mac users at risk, according to a report from Check Point. “For $3,000,” Check Point researchers said, “threat actors could purchase this malware to target macOS users” and use a “string encryption algorithm from Apple’s own XProtect antivirus engine, which replaced the plain text strings used in the original version.” Banshee Stealer “operates undetected and blends seamlessly with perfectly normal system processes, yet all the time, it is stealing browser credentials, cryptocurrency wallets, user passwords, and sensitive file data.” Researchers say that this updated version of Banshee Stealer underscores how organizations adopting Apple ecosystems must ensure their security protocols and IT staff keep up. Read more.
More cybersecurity news
- Last week’s news
- More cybersecurity news
- All articles sponsored by NetworkTigers
