In today’s cybersecurity news…

LegalPwn technique hides LLMs prompts inside contract legalese

Researchers at security firm Pangea are warning of another creative way to jailbreak LLMs, empowering them with instructions that can be used to exploit vulnerabilities and circumvent cybersecurity practices. This one focuses on the inability of many LLMs to distinguish between instructions in their users’ prompt and those hidden inside ingested data. We have already seen this with threat actors hiding prompts inside online calendars and inline comments inside documents, but now they are also being inserted inside the large paragraphs of legalese in contracts, carefully written to not raise suspicions among human readers. Not all LLMs are fooled, but the most popular and heavily used ones do succumb to the prompts more readily.

(The Register)

Maryland Transit investigating cyberattack

The Maryland Transit Administration (MTA) says a cyberattack “impacted some of its operation and information systems, and call centers.” Representatives said hackers accessed its systems but they did not share information on the scope of the incident. “The attack was disclosed on August 25, just prior to a similar announcement made by the state of Nevada announced that hackers breached its state systems.”

(Security Week)

Hacker attempts to forge his way into Spanish university

This story shows ways in which stolen PII gets used. Spanish police have arrested a 21-year-old individual for allegedly accessing a government website to alter his high school and university entrance exam grades, as well as those of some of his friends. “According to investigating officers, the work accounts of at least 13 professors from various Andalusian universities…had been hacked.” Some of these teachers has apparently been responsible for preparing university entrance exams in the country.

(Graham Cluley writing in BitDefender)

Brokewell Android malware delivered through fake TradingView ads

Researchers at cybersecurity company Bitdefender are warning of cybercriminals who are “abusing Meta’s advertising platforms with fake offers of a free TradingView Premium app that spreads the Brokewell malware for Android.” This campaign, which was specifically designed for mobile users, has been active since mid-July. Brokewell is an Android malware capable of info stealing, remote monitoring and taking control of a compromised device. The ads replicate the branding and style of TradingView, a legitimate charting and financial analysis platform and social network. These bogus ads offer a free premium app for Android.

(BleepingComputer)

Huge thanks to our sponsor, ThreatLocker

UK social services department uses Palantir amid concerns

The city council of the English town of Coventry has signed a £500,000-a-year artificial intelligence contract with the U.S. data technology company Palantir, which is also known to be involved with the Israel Defense Forces as well as U.S. government deportation activities. According to The Guardian, “the contract follows a pilot scheme in the council’s children’s services department, including using AI for case-note transcription and to summarize social workers’ records. The council is planning to extend the Palantir system to processes for providing support to children with special educational needs…Palantir already has a number of public sector contracts in the UK, including providing AI to help tackle organized crime in Leicestershire and building the new NHS federated data platform. A number of councilors and other officials have raised concerns about the technology itself as well as this particular supplier.

(The Guardian)

Cephalus ransomware spoofs SentinelOne as attack vector

A new ransomware named Cephalus is casting its spear at law firms, financial services, healthcare organizations, architectural practices, municipalities, IT firms, and marketing agencies in the U.S. and Japan. Cephalus breaks in by leveraging Remote Desktop Protocol (RDP) accounts that have not been secured with multi-factor authentication (MFA). According to a report from security firm Huntress, the malware “drops a real program executable from security firm SentinelOne into a computer’s Downloads folder. This is then tricked into sideloading a malicious DLL that runs the ransomware code. Cephalus will also delete Windows Shadow Copy files, which companies often turn to for recovery of their data, and also disables Windows Defender.

(Fortra)

Hackers disrupt the communications of dozens of Iranian ships

As posted in Security Week, a hacking group known as Lab Dookhtegan “allegedly disrupted the communication systems of 60 Iranian ships, including 39 tankers and 25 cargo ships operated by Iranian maritime companies NITC and IRISL, which are sanctioned by the U.S.” The group hacked satellite communications company Fannava, allegedly disabled a central communications system named Falcon, and “ran destructive commands to erase core data, leaving the ships without communication or data. The group’s name is a translation from Farsi meaning sewn lips or closed lips. Little is known about the group including where it is based, but it focuses on targeting Iranian state infrastructure and is perhaps most famous for its doxxing of Iran’s APT34 hacking unit in 2019.

(Security Week)