This week’s Cyber Security Headlines – Week in Review is hosted by David Spark with guest Brett Perry, CISO, Dot Foods
Missed the live show? Check it out on YouTube
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Hegseth orders Cyber Command to stand down on Russia planning
According to an exclusive report from The Record, Defense Secretary Pete Hegseth has ordered U.S. Cyber Command to halt “all planning against Russia, including offensive cyber actions.” The directive was given to Cyber Command chief Gen. Timothy Haugh, who relayed it to Marine Corps Maj. Gen. Ryan Heritage. The order does not extend to the National Security Agency or its signals intelligence efforts. The full scope remains unclear, but it aligns with White House efforts to normalize relations with Moscow following the Kremlin’s 2022 invasion of Ukraine. The decision marks a shift in U.S. cyber strategy amid ongoing geopolitical tensions.
Fake Ransomware Attack Claims Sent to US Executives via Snail Mail
Executives at a number of U.S. organizations, mostly in healthcare, are being targeted by someone claiming to be from the BianLian ransomware group. The postal letters, stamped “Time Sensitive Read Immediately”, inform the reader that their organization has become a victim, threatens to publish the data and provides a QR code linked to a Bitcoin wallet to pay the ransome of between $250,000 and $500,000. Not only has no connection to BianLian actually been proven, but security company Arctic Wolf also says there is no evidence that “the targeted organizations were victims of ransomware attacks.”
Mark Cuban offers to fund government tech unit that was cut
SSSThe unexpected offer of support was posted on the social network Bluesky and urged the displaced engineers and designers to turn the upheaval to their advantage. Referring to the 18F technology unit of the government’s General Services Administration, he wrote, “if you worked for 18F and got fired, group together to start a consulting company,” continuing “it’s just a matter of time before DOGE needs you to fix the mess they inevitably created. They will have to hire your company as a contractor to fix it. But on your terms. I’m happy to invest and/or help.” The unit had reportedly built, among other things, Login.gov, a secure and private way for the public to access services at government agencies, including Social Security and the Department of Veterans Affairs.
Huge thanks to our sponsor, ThreatLocker
UR Encoder launch by FaceTec introduces new option for biometric ID issuers
FaceTec has launched UR Encoder, which is software that lets biometric ID issuers create UR Codes—digitally signed face data stored on a user’s device for secure identity verification. The system promises privacy while letting authorities like DMVs, passport offices, and employers issue biometric credentials. UR Codes use cryptographic signatures to prevent tampering and can be scanned on a mobile device or webcam. FaceTec offers a free license for governments and nonprofits, with commercial use available through partnerships. Developer access is now open, with additional software components rolling out soon.
Ransomware gang bypasses EDR via a webcam
The Cybersecurity firm S-RM team discovered the unusual attack method conducted by the Akira ransomware gang during a recent incident response to one of their clients. The gang had initially accessed the victim’s corporate network by way of an exposed remote access solution, then they used AnyDesk and stole data for use as part of the double extortion attack. Attempts to deploy encryptors on Windows were blocked by the victim’s EDR solution. Akira then scanned the network for other devices that could be used to encrypt the files and found a webcam and fingerprint scanner. The attackers chose the webcam because it was vulnerable to remote shell access and unauthorized video feed viewing. It also ran on a Linux-based operating system compatible with Akira’s Linux encryptor and did not have an EDR agent. “Akira was subsequently able to encrypt files across the victim’s network.” S-RM told BleepingComputer that “there were patches available for the webcam flaws, meaning that the attack, or at least this vector, was avoidable.”
1Password introduces location-based passwords
This new feature allows users to add a specific physical location to password items, allowing them to automatically appear in a new “Nearby” section of the app’s home tab. The intention of the feature is to simplify the list of available passwords without searching such as health card data at the doctor’s office or travel documents at the airport. Locations can be added to new or existing items saved in 1Password.