Johnson & Johnson Data Breach, Blackcat & Bumblebee Are Back, VMware struggles to Patch

CyberHub Podcast

1×

0:00

Current time: 0:00 / Total time: -18:16

-18:16

Johnson & Johnson Data Breach, Blackcat & Bumblebee Are Back, VMware struggles to Patch

Ransomware Strikes Back, Cryptocurrency Breaches, and Major Industry Acquisitions: Uncovering the Latest Cybersecurity Threats, Emerging Malware, and How Global Incidents are Reshaping the Cyber Land

James Azar

Oct 22, 2024

Transcript

CyberHub Podcast host James Azar delivered another packed episode on October 22, 2024, diving deep into some of the most pressing cybersecurity stories from across the globe. In his characteristically energetic style, Azar provided listeners with insights on the latest data breaches, ransomware developments, and a critical infrastructure attack against a small but strategically important nation.

He also dissected a notable acquisition in the cybersecurity industry and highlighted the resurfacing of a dangerous malware strain that had previously been thought neutralized. With each story, Azar emphasized the complexities of today’s cybersecurity landscape and the importance of staying vigilant.

The episode opened with Azar’s signature coffee cup cheers and a call to action for listeners to subscribe to Substack.

Here’s a closer look at the key stories from the episode.

Johnson & Johnson Data Breach

James Azar kicked off the episode by discussing a developing data breach at Johnson & Johnson, one of the largest pharmaceutical companies in the world. The breach, which the company reported to the Maine Attorney General’s Office, was detected in August 2024 but was only recently disclosed. While the company has not revealed many details about the nature of the breach, it has indicated that the compromised data was sensitive enough to warrant offering free credit monitoring and identity restoration services to the affected individuals.

Azar pointed out the lack of clarity surrounding the breach, particularly regarding what kind of data was compromised and how the breach occurred. With Johnson & Johnson employing hundreds of thousands of people globally, the fact that only 3,200 individuals were affected suggests this was a smaller, targeted breach. However, the lack of transparency raises concerns about the true impact and scope of the incident.

The pharmaceutical sector, Azar noted, is an especially attractive target for cybercriminals due to the sensitive nature of the data they handle, including intellectual property and personal health information. This breach serves as a reminder of the ongoing risks that even the most well-protected organizations face.

Transak Crypto Payment Services Breach

Next, Azar shifted focus to a breach at Transak, a Miami-based cryptocurrency payment services firm. The company confirmed that a sophisticated phishing attack allowed attackers to access an employee’s laptop, compromising personal data for over 92,000 users. Among the leaked data were passports, driver's licenses, and user selfies—critical information that could easily be exploited for identity theft.

Transak downplayed the severity of the breach, stating that no financially sensitive or critical information had been compromised. However, as Azar pointed out, this statement rings hollow given that such highly personal documentation was exposed. The attackers gained access to Transak’s know-your-customer (KYC) vendor, a critical component for document scanning and verification. The phishing attack was sophisticated, and the breach was attributed to a ransomware group named "Stormous," which claimed responsibility and threatened to leak 300 GB of data if a ransom was not paid.

Transak operates in a non-custodial manner, meaning that users’ funds were not directly impacted. However, the breach highlights the ongoing vulnerabilities faced by cryptocurrency companies. As Azar discussed, crypto firms are frequently targeted due to the significant value of both financial and personal data they handle, combined with a relatively immature security posture compared to traditional financial institutions.

AlphV/BlackCat Ransomware Group Resurfaces

In a major ransomware development, Azar detailed the re-emergence of the notorious ransomware group BlackCat, now rebranded as “Cicada 3301.” After several arrests and what seemed like a fragmentation of the original group, they have returned with new attacks on small and medium-sized businesses in sectors such as healthcare, hospitality, manufacturing, and retail. Since June 2024, Cicada 3301 has been responsible for over 30 ransomware incidents across North America and the UK.

The new strain of ransomware retains many of the hallmarks of BlackCat, with similar techniques like shadow copy deletion and vector exception handler manipulation. IBM X-Force and Morphosec were quick to note the technical similarities between BlackCat and Cicada 3301, concluding that the groups are likely sharing or selling code. Azar explained that this decentralization of cybercrime allows for the continued use and modification of effective ransomware techniques, even as law enforcement efforts disrupt individual groups.

This resurgence of BlackCat under a new name illustrates the resilience of ransomware operations and the difficulty law enforcement faces in permanently taking them down. With ransomware continuing to evolve, it remains a major threat to businesses of all sizes.

Bumblebee Malware Returns

Bumblebee malware, which had seemingly been taken down earlier this year during Operation Endgame, is back in the cybercrime arena. Operation Endgame had disrupted a range of malware loaders, including Bumblebee, Trickbot, IcedID, and others, by seizing over 100 servers. However, as Azar noted, Bumblebee has resurfaced, with recent activity observed by Netskope indicating the malware is once again active.

The malware’s return highlights a common issue in cybersecurity: taking down infrastructure does not necessarily eliminate a threat. Cybercriminals are adept at rebuilding their operations, often reusing successful techniques and code. Bumblebee, like many other forms of malware, operates within memory, making it harder to detect and eradicate.

This story serves as a reminder that the cybercriminal ecosystem is highly adaptable. Even when major operations are dismantled, the individuals behind them can often reassemble and return to business as usual, posing a renewed threat to organizations.

DOJ Indicts IT CEO for Fraud

Azar also covered the indictment of Deepak Jain, the CEO of an unnamed IT services company based in Maryland, for allegedly creating a fake data center audit to win contracts with the US Securities and Exchange Commission (SEC). Jain is accused of fabricating a certification through a self-created entity, Uptime Counsel, to falsely claim that his data center had a Tier 4 certification, the highest available for redundancy, reliability, and security.

The indictment revealed that the SEC had contracted with Jain’s company between 2012 and 2018, paying millions of dollars in federal contracts. Despite Jain’s falsified certification, there is no evidence that any data was lost or compromised during the period the company was under contract.

This case underscores the importance of verifying third-party certifications and the potential for fraud in the cybersecurity and IT services sectors. Azar suggested that companies need to be more diligent in questioning the authenticity of certifications and should not rely solely on documentation provided by vendors.

Sophos to Acquire SecureWorks

In a significant consolidation within the cybersecurity industry, Sophos announced its acquisition of SecureWorks for $859 million in an all-cash deal. This merger is set to turbocharge Sophos’ capabilities in threat intelligence, detection, and response by combining its Managed Detection and Response (MDR) with SecureWorks’ Extended Detection and Response (XDR) platform.

Azar highlighted the importance of this deal, noting that it could position the combined entity as a major competitor to industry giants like CrowdStrike and SentinelOne. SecureWorks, known for its strong presence in XDR, will add significant value to Sophos’ already robust security offerings, potentially reshaping the competitive landscape of the cybersecurity market.

This acquisition illustrates the ongoing trend of consolidation in the cybersecurity sector as companies seek to expand their capabilities and market share through strategic partnerships and acquisitions.

VMware Struggles with Remote Code Execution Vulnerability

VMware continues to face challenges in patching a critical remote code execution (RCE) vulnerability in its vCenter Server platform. The company had previously released a patch to address the flaw, but it was found to be incomplete, requiring additional updates. The vulnerability, originally disclosed and exploited during a Chinese hacking contest earlier this year, has a CVSS score of 9.8, highlighting its severity.

This incident demonstrates the difficulties companies face in fully addressing vulnerabilities, particularly when initial patches are insufficient. The need for rapid, effective patching is critical, especially in widely used platforms like VMware, which are integral to many organizations' IT infrastructure.

Cyprus Defends Against Critical Infrastructure Attack

The small island nation of Cyprus recently defended itself against a massive cyberattack targeting its critical infrastructure. The attack, believed to be carried out by pro-Palestinian hacking groups, aimed to disrupt banks, airports, and government websites. The attackers justified the assault as retaliation for Cyprus’ perceived support of Israel during the ongoing Middle Eastern conflict.

Azar noted that Cyprus, despite being geographically and politically neutral, became a target due to its role in providing logistical support for Israeli airlines. As a major hub for flights into Israel, Cyprus’ Larnaca airport became a focal point for attacks. This incident reflects the increasingly complex motivations behind cyberattacks, particularly in the context of geopolitical tensions.

FBI and CISA Release Product Security Guide

The final story covered by Azar was the FBI and CISA’s release of a product security guide aimed at making software more resilient to cyberattacks. The agencies are seeking public comments on the guide, with a deadline of December 2, 2024. This effort is part of an ongoing push to improve the security of software products and make them more resistant to hacking.

Azar emphasized the importance of participating in this public feedback process, as it directly influences how the cybersecurity community can address software vulnerabilities and improve product security.

Discussion about this podcast

CyberHub Podcast

Today’s top cybersecurity news and the latest from Practicing CISO James Azar, tune in to hear how practitioners read, view and work after hearing the latest headlines and how these stories help keep practitioners sharp and ready.

Listen on