This week’s Cyber Security Headlines – Week in Review is hosted by Rich Stroffolino with guest Jonathan Waldrop, CISO, The Weather Company
Missed the live show? Check it out on YouTube
Jonathan will be speaking at The CrowdStrike Crowd Tour, on Tuesday, April 15, 2025 in Atlanta – details here.
He will also be speaking at the C Vision International Think Tank on April 24, 2025, also in Atlanta – details here.
Cyber Security Headlines – Week in Review is live every Friday at 12:30pm PT/3:30pm ET. Join us each week by registering for the open discussion at CISOSeries.com
Microsoft Trust Signing service abused to code-sign malware
Researchers at BleepingComputer and elsewhere are observing more incidences of threat actors using the Microsoft Trusted Signing service to “sign their malware with short-lived, three-day code-signing certificates.” Code-signing certificates make malware appear legitimate, potentially bypassing security filters that block unsigned executables. Extended Validation (EV) certificates are particularly sought after by threat actors due to the increased trust they confer from cybersecurity programs and their ability to help bypass alerts in SmartScreen. A cybersecurity researcher and developer with the wonderful name of Squiblydoo, told BleepingComputer that they believe threat actors are switching to Microsoft’s service out of convenience, especially given that recent changes to EV certificates are causing confusion for users – something threat actors are taking advantage of.
Vulnerabilities found in numerous solar power systems
Researchers at cybersecurity firm Forescout are warning of “dozens of vulnerabilities” in solar power system products from Sungrow, Growatt and SMA. They say some of these flaws can pose a serious threat to electrical grids. The flaws exist within components such as one that “connects a solar power system to the internet, another in a cloud service where data is sent for monitoring and control, and a mobile application that enables the user to interact with the cloud service,” some of which will allow an attacker to upload files to enable arbitrary code execution on the cloud platform server, steal information, or vandalize the power grid itself.
NHS software supplier gets discount on fine for good behavior
This story follows up on an event from August 2022, in which the LockBit ransomware gang attacked Advanced Health and Care Limited, an IT company that provided services to the UK’s National Health Service (NHS), along with other healthcare organizations. The fine of £3.07 million being levied on the company by the UK’s data protection branch called Information Commissioner’s Office (ICO) is just half of what was originally proposed. The ICO said Advanced Health and Care Limited “settled for the reduced fine after acknowledging the watchdog’s decision; agreeing to pay up without appealing; playing nicely with the NHS and related regulatory bodies following the attack; as well as taking “other steps” taken to mitigate related risk.
The AI mitigation limitation
A new report from the US National Institute of Standards and Technology (NIST) urged the cybersecurity community to develop improved mitigation strategies for adversarial machine learning systems. These include manipulating training data, adversarial inputs to impact system performance, and training data exfiltration from models. NIST noted a so-called “open research problem” that’s found systems optimized for accuracy tend to underperform against adversarial attacks. The report recommends organizations accept trade-offs between these priorities as part of a mitigation strategy. NIST also pointed to the continued struggle to detect adversarial attacks on AI systems due to the high cost of applying formal verification methods to models and an overall lack of reliable benchmarks.
Security Copilot gets AI agents
Microsoft will release previews of new Security Copilot agents next month, the first significant capabilities added to the service since it launched. Microsoft claims these agents can automate specific workflows across threat protection, identity management, data security, and IT operations that previously required a human analyst, reducing the volume of repetitive tasks. One example is a Phishing Triage Agent. These agents will integrate across Defender XDR, Purview, Intune, and Entra. Microsoft said it will demonstrate new security offerings at its Microsoft Secure Conference on April 9th.
Huge thanks to our sponsor, ThreatLocker
23andMe bankruptcy puts millions of DNA records at risk
23andMe filed for bankruptcy on Monday and many are asking the question, what’s going to happen to all of that personal information? Some have raised major concerns that its vast database of genetic data could be sold off to the highest bidder. While the company insists privacy protections will remain intact, court documents make it clear that all assets—including customer DNA records—are on the table. California’s Attorney General issued a release ahead of the announcement urging users to delete their data immediately, warning that unlike passwords, genetic information is permanent, instructions on how to delete that data can be found in today’s show notes.
(The Record), (CyberScoop),(California Attorney General Release)
Even Troy Hunt gets phished
Security researchers they’re just like us. HaveIBeenPwned founder Troy Hunt published a blog post detailing how a “sneaky phish” managed to export his Mailchimp account. Hunt received a legitimate-looking email purportedly from Mailchimp, advising that his sending privileges were restricted and offering a button to review his account. Hunt entered credentials and a one-time password, almost immediately receiving a genuine email from Mailchimp that his subscriber list was exported. The list included about 16,000 emails to Hunt’s blog, including those unsubscribed, which Hunt didn’t realize Mailchimp still kept. Hunt said the only red flag he should have caught was 1Password not auto-filling his credentials because he was on a different domain. He also attributed the attack’s success to fatigue from jet lag. If anyone needs a good example of how to disclose a security incident fully, please check out Troy’s blog in our show notes. (The Register, Troy Hunt)
NIST struggles to keep up
The National Institute of Standards and Technology (NIST) is struggling to clear a growing backlog of CVEs in the National Vulnerability Database (NVD), with a 32% increase in submissions last year exacerbating the issue. Despite maintaining processing rates, the backlog continues to grow, and NIST anticipates even higher submission volumes in 2025. The delays are impacting organizations’ ability to access timely vulnerability data, creating a gap between reported issues and actionable intelligence despite efforts in increasing staff.
150,000 sites compromised by JavaScript injection
At researchers at website security company c/side, this campaign infiltrates legitimate websites with malicious JavaScript, using an iframe injection to display a full-screen overlay in a visitor’s browser using CSS. This takes them to sites promoting Chinese gambling platforms. This current campaign largely targets infected WordPress sites, but the researchers state the technique demonstrates how threat actors continually adapt, increasing their sophistication.