In today’s cybersecurity news…
Beijing-linked hackers penetrated U.S. Treasury systems
According to a letter the agency sent from the U.S. Treasury to congressional lawmakers on Monday, a Chinese state-sponsored APT actor was responsible for what is being called “a major incident” that compromised U.S. Treasury Department workstations and classified documents at the Office of Foreign Assets Control (OFAC). The department had been notified on December 8 by BeyondTrust, that “a foreign actor had obtained a security key” that allowed it “to remotely gain access to employee workstations and the classified documents stored on them.” The letter “”did not specify the number of impacted workstations or the kind of documents accessed,” and the agency adds, the compromised service “has been taken offline and at this time there is no evidence indicating the threat actor has continued access to Treasury information.”
Russian tanker suspected of undersea data cable sabotage
On yesterday’s episode of Cyber Security Headlines, we mentioned briefly that Finnish authorities seized a Russian ship after it allegedly damaged several submarine cables in the Baltic Sea. The story continues to unfold. The ship seized was the Eagle S, an oil tanker that departed from a Russian port on December 25, and which is suspected of “intentionally dragging its anchor for several miles resulting in the complete severing of multiple cables, including the Estlink 2 power cable and four telecommunications cables.” Authorities from Finland boarded the ship by helicopter, having “identified but not arrested seven suspects.” The ship is being treated as a crime scene on suspicions that it is more than just an oil tanker. A report from the shipping journal Lloyd’s List, describes the Eagle S as “was loaded with spying equipment unusual for a merchant ship, and used to monitor NATO naval and aircraft radio communications, and to drop “sensors-type devices” in the English Channel.”
(The Record and Lloyd’s List)
Lumen reports says it has locked the Salt Typhoon group out of its network
More updates in the continuing Salt Typhoon story, following revelations last week that a ninth telecom company had been penetrated by the China-linked APT group Salt Typhoon, Lumen announced this week that the APT group had been ejected from and locked out of the Lumen network. Company spokesperson Mark Molzen told TechCrunch that “an independent forensic analysis confirmed the company ejected the Chinese actors from its network, adding that there is no evidence that customer data was accessed.”
Huge thanks to our sponsor, ThreatLocker
ThreatLocker helps you take a proactive, default-deny approach to cybersecurity and provides a full audit of every action, allowed or blocked, for risk management and compliance. Onboarding and operation are fully supported by their US-based support team.
To learn more about how ThreatLocker can help keep your organization running efficiently and protected from ransomware, visit ThreatLocker.com.
Biden administration finalizes rule to block sale of Americans’ bulk data to adversaries
This rule, first proposed as an executive order last February and finalized last Friday, means that companies will “no longer be able to sell sensitive data about Americans to countries of concern,” being Russia, China, Iran, North Korea, Cuba, and Venezuela,” which, according to the U.S. Department of Justice, can be used for “can be used for espionage, blackmail, influence campaigns, and other malicious activities.”
Malicious NPM package deploys Quasar RAT
A researcher from the security platform Socket is warning of a malicious package on the npm (Node Package Manager) registry which appears as a library for detecting vulnerabilities in Ethereum smart contracts, but which actually drops an open-source remote access trojan called Quasar RAT onto developer systems. The heavily obfuscated package, is named ethereumvulncontracthandler. The Quasar RAT, which first appeared on GitHub in July 2014, has been used for cybercrime and cyber espionage by various threat actors over the past decade.
Looking ahead to the OWASP Top 10 for 2025
The Open Web Application Security Project, better known as OWASP, is hard at work putting together its list of its top ten security risks to web applications. With its data collection phase having been scheduled to end by the end of December, 2024, the organization plans to release its list in early 2025. Security researcher Aditya Sawant, writing in Medium, says the 2025 update includes a refined approach to data collection, “casting a wider net, pulling insights from security vendors, consultancies, and bug bounty programs,” as well as not just counting how many times a vulnerability appears, but also how many applications are affected by at least one instance of each vulnerability type, giving a clearer picture of real-world impact. The top three risks are the same as they were in 2021 – Broken Access Control, Cryptographic Failures, and Injection. Sawant anticipates Security Misconfiguration and Identification and Authentication Failure to move up from lower positions with Exposed Sensitive Data appearing in sixth place. A link to Sawant’s article is available in the show notes to this episode.
(InfoSecWriteups and OWASP)
Large-scale supply chain attack using generative AI now possible, says researcher
Crystal Morin, former intelligence analyst for the US Air Force and cybersecurity strategist at Sysdig, says she anticipates “seeing highly successful supply chain attacks in 2025 that originated with an LLM-generated spear phish.” This is because cybercrime groups know they do not need to train their own LLMs, when they can steal credentials and then jailbreak existing ones. She states that this is not pointing to a fully AI-generated attack leading to business operations shutdown, but instead the focus will be on more sophisticated social engineering campaigns. She calls spear phishing and social engineering her greatest security concern for 2025.”