cyber.hendryadrian.com
YouTube · Simply Cyber - Gerald Auger, PhD

Cyber News Roundup: ConnectWise Backup Suspension, Beyond Trust Zero-Day and Discord RAT

· 1:34:09 · Watch on YouTube ↗

Summary

The briefing covers a ConnectWise backup suspension, a patched Beyond Trust zero-day linked to suspected Chinese espionage, Drupal fixes and a Windows RAT that uses Discord for command and control.

Key points

  • ConnectWise suspended cloud backups and disabled seven application identities after attackers gained unauthorized access to them and compromised Microsoft 365 tenants. Backup and restoration services remained unavailable.
  • The briefing reports that a suspected Chinese state-backed group exploited a Beyond Trust Remote Support zero-day for espionage. A patch has been released.
  • Drupal patched two critical flaws that could allow remote code execution on websites running supported versions; administrators were urged to update promptly.
  • Burger King Japan disclosed a breach involving more than 11 million customer records. Representatives said card numbers were not stored and they found no evidence of credential access.
  • A cyberattack on BAE Systems disrupted federal bankruptcy notice production and distribution. The company was investigating and working to restore operations.
  • The Sika Bea bot RAT uses document-themed lures and a hidden PowerShell process to deploy a Windows payload that collects system information and communicates through Discord.
  • CyberSN reported a four-year low in cybersecurity job postings alongside growth in AI security engineer and cyber data scientist roles.

Article Details

Topics
  • [13:56] CyberSN cybersecurity jobs report and AI security roles
  • [23:20] ConnectWise application identity compromise and backup disruption
  • [29:55] Drupal remote code execution patches
  • [35:33] Beyond Trust zero-day and suspected Chinese espionage
  • [46:58] Proof Point's proposed acquisition of Veronus Data Security
  • [53:44] Burger King Japan customer data breach
  • [56:24] BAE Systems cyberattack and federal court disruption
  • [01:00:34] Sika Bea bot infection chain and Discord command and control
  • [01:12:50] Security governance documentation and leadership approval

Threat Actors

ARMORY CASTLE[36:06] The briefing identifies UNC5221 as an alias of Armory Castle and reports suspected Chinese state-backed exploitation of a Beyond Trust zero-day for espionage.

Vendors

BeyondTrustBeyond Trust confirmed a zero-day affecting its remote support appliances; the briefing reports that a patch was released.

Products

DiscordThe Sika Bea bot RAT registers infected machines with Discord and uses the service for command and control.DrupalTwo critical flaws affecting supported Drupal versions were patched; they could allow remote code execution on websites.

Related Articles