Cybersecurity Threats and Trends - 02/18/2025

Chinese APTs are swarming Western infrastructure and several firewalls are open for exploit.

Author

J.W. Croley
February 18, 2025

In partnership with

Here’s Why Over 4 Million Professionals Read Morning Brew

  • Business news explained in plain English

  • Straight facts, zero fluff, & plenty of puns

  • 100% free

1. Chinese Hackers Breach Telecoms via Cisco Routers

Primary Threat: Chinese state-sponsored hackers, known as Salt Typhoon, have infiltrated multiple U.S. telecommunications companies by exploiting unpatched vulnerabilities in Cisco routers. These breaches have granted unauthorized access to sensitive data and critical infrastructure.

Risk: Unauthorized access to sensitive communications, potential data exfiltration, and disruption of critical services.

Detection Tips:

  • Regularly update and patch network devices, especially Cisco routers, to address known vulnerabilities.

  • Monitor network traffic for unusual activities indicative of unauthorized access.

  • Implement robust access controls and network segmentation to limit potential breach impact.

2. PostgreSQL Flaw Exploited as Zero-Day in BeyondTrust Breach

Primary Threat: Attackers have exploited a zero-day vulnerability in PostgreSQL to breach the network of BeyondTrust, a provider of privileged access management solutions. This flaw allowed unauthorized access to sensitive systems, potentially compromising privileged accounts.

Risk: Compromise of privileged accounts, unauthorized data access, and potential lateral movement within networks.

Detection Tips:

  • Apply the latest security patches for PostgreSQL and related systems promptly.

  • Monitor for unusual database activities, such as unexpected queries or access patterns.

  • Implement strict access controls and regular audits of privileged accounts.

3. PirateFi Game on Steam Installs Password-Stealing Malware

Primary Threat: The free-to-play game "PirateFi" on the Steam platform has been distributing the Vidar infostealing malware to unsuspecting users. This malware is capable of stealing credentials, financial information, and other sensitive data from infected systems.

Risk: Credential theft, financial fraud, and unauthorized access to personal and corporate accounts.

Detection Tips:

  • Avoid downloading and installing software or games from unverified sources.

  • Utilize reputable antivirus and anti-malware solutions to detect and prevent such infections.

  • Regularly monitor accounts for unauthorized access and update passwords periodically.

Did you know...?

The use of email drafts as a covert communication channel isn’t new—Russian hackers reportedly used this tactic in 2016, leveraging compromised Gmail accounts to evade detection. Instead of sending messages, they stored commands in draft folders, which malware on infected devices could access without triggering email security filters.

This stealthy technique, seen again in the FinalDraft malware, highlights how attackers constantly adapt, exploiting trusted applications to hide in plain sight.

Stay vigilant—because sometimes, the biggest threats don’t even hit "Send." 🚀

4. Russian-Linked Hackers Employ 'Device Code Phishing'

Primary Threat: An emerging threat cluster, identified as Storm-2372 and assessed with medium confidence to be aligned with Russian interests, has been targeting various sectors since August 2024. The attackers employ a technique called 'device code phishing,' tricking users into logging into productivity apps while capturing their login tokens. This method grants unauthorized access to accounts across sectors including government, IT services, defense, and energy.

Risk: Unauthorized account access, data breaches, and potential espionage.

Detection Tips:

  • Implement multi-factor authentication (MFA) to add an extra layer of security.

  • Educate users about phishing techniques and encourage verification of unexpected login prompts.

  • Monitor for unusual login activities, especially from unfamiliar devices or locations.

5. OS AI Models used for Malicious Code and Vulnerabilities

Primary Threat: The increasing adoption of open-source AI models has introduced a new vector for cyber threats. These models, while fostering innovation, can be manipulated to include malicious code or exploited due to inherent vulnerabilities, posing significant risks to organizations integrating them into their systems.

Risk: Introduction of malicious code into production environments, data breaches, and compromise of AI-driven applications.

Detection Tips:

  • Thoroughly vet and test open-source AI models before integration.

  • Implement code reviews and security assessments for all third-party components.

  • Stay informed about updates and patches related to the AI models in use.

6. FinalDraft Malware Abuses Outlook

Primary Threat: A newly discovered malware, dubbed "FinalDraft," has been observed using Outlook email drafts for command-and-control communications. This technique allows the malware to evade detection by traditional security measures, as it doesn't rely on external servers for communication.

Risk: Stealthy data exfiltration, prolonged undetected presence within networks, and potential compromise of sensitive information.

Detection Tips:

  • Monitor for unusual activities within email accounts, such as the presence of unexpected drafts.

  • Implement multi-factor authentication to secure email accounts against unauthorized access.

  • Utilize advanced threat detection solutions capable of identifying anomalous behaviors within trusted applications.

IN SUMMARY:

Recent cybersecurity incidents underscore the importance of timely patch management, vigilant monitoring, and robust access controls. Organizations must remain proactive in identifying and mitigating vulnerabilities to protect their systems and data from evolving threats.

Key Takeaways:

  • Regularly update and patch systems to address known vulnerabilities.

  • Monitor network and application logs for unusual activities.

  • Educate users on the risks associated with downloading software from unverified sources.

  • Implement strong access controls and multi-factor authentication to secure sensitive accounts.

Staying informed and adopting a proactive security posture are essential steps in safeguarding against the ever-evolving cyber threat landscape.

J.W.

(P.S. Check out our partners! It goes a long way to support this newsletter!)