Salt Typhoon attack potentially exposes wiretap data
The Chinese state-sponsored hacking group known as Salt Typhoon has reportedly compromised U.S. broadband providers, including AT&T, Verizon, and Lumen Technologies, through systems used for court-authorized wiretapping. According to sources, the hackers gained access not only to these wiretapping systems but also to general internet traffic flowing through the networks, raising significant national security concerns. The breach is believed to be part of a larger intelligence-gathering campaign by China, potentially compromising sensitive data. The FBI, along with private security analysts are currently investigating the extent of the intrusion and data theft.
(The Wall Street Journal), (Security Week), (The Register), (Dark Reading)
Cyberattack hits major U.S. water utility
American Water Works, which serves over 14 million people, disclosed a cyberattack that impacted its billing systems, though the company says water and wastewater services remain unaffected. The attack was first detected on October 3, and the company has assured customers that there will be no late fees or service interruptions as they work to restore normal operations. In response to the growing number of threats aimed at the water sector, the EPA announced plans to ramp up security inspections and require the government to provide yearly risk mitigation updates.
(Cyber Scoop), (Bleeping Computer), (American Water Statement)
A not- so- happy birthday present for Russia’s president
Two pro-Ukrainian hacking groups hit Russia’s state media giant VGTRK and its court system with cyberattacks on President Vladimir Putin’s birthday. The attacks, claimed by “sudo rm-RF” and “BO Team,” disrupted media services and took the judicial system’s websites offline. While Russian officials admitted the media attack was “unprecedented,” they did downplay the damage, with VGTRK’s sites quickly restored. However, the court system remained down as of this recording.
Healthcare industry faces new ransomware threat
Federal officials have issued a warning after at least one U.S. healthcare provider was hit by the newly discovered Trinity ransomware. With connections to Venus and 2023Lock, this strain targets healthcare systems, stealing data and encrypting files, giving victims just 24 hours to respond before the data is leaked. The attack methods follow familiar patterns, exploiting vulnerabilities, spreading laterally across networks, and demanding cryptocurrency payments for decryption.
Thanks to today’s episode sponsor, Vanta
Gorilla botnet targets critical sectors
Cybersecurity researchers have uncovered a new botnet malware family called Gorilla, a variant of the infamous Mirai botnet source code. For the majority of September the botnet executed over 300,000 attack commands, focusing on distributed denial-of-service (DDoS) attacks across more than 100 countries, primarily targeting critical sectors like telecoms, universities, and government websites. The malware supports various CPU architectures and connects to multiple command-and-control servers to launch its attacks.
Raccoon stealer operator pleads guilty
A Ukrainian national has pleaded guilty to his role in running the MaaS (malware-as-a-service) operation, Raccoon Stealer. The model which was sold for as little as $75 per week was used by cybercriminals to steal sensitive information like browser credentials, cryptocurrency wallets, and credit card data from millions of victims. After dismantling Raccoon Stealer’s infrastructure in a joint operation, the FBI recovered over 50 million stolen credentials and created a portal to help victims check if their data was compromised.
Ransomware hits Comcast debt collector
Comcast has confirmed that data from about a quarter of a million of its customers was stolen in a February ransomware attack on debt collector FBCS, despite earlier assurances from FBCS that Comcast customer data was not compromised. The stolen information includes Social Security numbers, dates of birth, and Comcast account details. Comcast noted its own systems were not breached and took the opportunity to reveal that FBCS, facing financial difficulties, could not offer identity protection services to affected customers—leaving Comcast to cover the costs.
MITRE launches AI incident sharing platform
MITRE has unveiled its AI Incident Sharing initiative, designed to enhance collective defense and intelligence-sharing on real-world AI incidents. Developed in collaboration with over 15 organizations, the project is called MITRE’s ATLAS (Adversarial Threat Landscape for Artificial-Intelligence Systems) framework and provides a secure platform for contributing and distributing anonymized data related to AI-enabled system threats. Inspired by traditional intelligence-sharing models, the new initiative utilizes the STIX framework for its data structure.