Cyber Brief Covers Airline Breaches, Exploited Device Flaws, Phishing and Wiper Attacks
· 2:04:09 · Watch on YouTube ↗
Summary
Auger reviews Norad and airline data breaches, exploited Zyxel and Apple flaws, evasive bank phishing, Queens Public Library ransomware disruption, and a destructive attack on Russian host Beget. He stresses patching, root-cause analysis and recovery planning.
Key points
- Norad confirmed cybercriminals stole grant-portal users’ names and email addresses, affecting more than 20,000 people across 12,000 organizations. The breach was detected October 30; how long attackers had access was not disclosed.
- An attack on Spanish IT provider Amadeus exposed customer details at multiple airlines. Reported counts included 92,000 Japan Airlines customers, 46,000 Singapore Airlines records and 53,000 Cathay Pacific records; total impact was not disclosed.
- Attackers exploited an unauthenticated out-of-bounds write in the Zyxel GS1900 web interface to execute operating-system commands with crafted HTTP requests. Nearly 1,000 devices were reportedly compromised and configuration files and credentials stolen; updates were released October 22.
- The Android Ghost Map flaw can let a specially crafted app trigger a persistent boot loop without requiring permissions. Separately, Apple patched an operating-system flaw in May 2024; Sekoia reported that APT29 likely used previously patched Safari and Chrome flaws to deliver malware that harvests browser and device data.
- A bank-phishing campaign used more than 300 domains impersonating financial institutions. First-time visitors saw credential-stealing login pages, while returning visitors and investigators were shown fake suspension notices based on their IP address.
- An attack on Russian hosting provider Beget erased data across its cloud infrastructure and disrupted hundreds of websites. The company said more than 1,000 servers required manual inspection and restoration would take considerable time.
- Ransomware disrupted Queens Public Library’s website, computers, checkout and return systems, Wi-Fi, app and digital media services. No ransomware group had claimed responsibility in the transcript.
Article Details
- Topics
- [18:20] Norad grant-portal breach, exposed user information and incident-response lessons
- [31:34] Airline customer data breaches linked to Amadeus and third-party vendor risk
- [37:31] Exploited Zyxel GS1900 flaw, device compromise and firmware updates
- [47:17] Beget cloud data destruction and hosting-service recovery
- [52:54] Apple vulnerability reporting and likely APT29 exploitation of browser flaws
- [59:04] Bank phishing pages using visitor IP addresses to evade detection and takedowns
- [01:02:48] Queens Public Library ransomware disruption and unknown responsibility
- Android Ghost Map flaw and persistent boot-loop denial of service
MITRE ATT&CK
Threat Actors
Cozy BearSekoia reportedly identified Cozy Bear as another name for APT29 and said the group likely exploited patched browser flaws to deliver data-stealing malware.ICE RELICSekoia reportedly said APT29, also known as Cozy Bear, likely exploited patched Safari and Chrome flaws to deliver malware that harvests browser and device data.
Vendors
Amadeus IT GroupAmadeus IT Group, an airline technology provider, was the source of an attack that exposed customer details at multiple airlines.GoogleSekoia reportedly said likely APT29 activity involved exploiting previously patched Google Chrome vulnerabilities to deliver data-stealing malware.ZyxelZyxel released updates for an exploited unauthenticated flaw in its GS1900 switches that could enable operating-system command execution.
Products
Google ChromeSekoia reportedly said likely APT29 activity involved exploiting previously patched Chrome vulnerabilities to deliver malware that harvests browser and device data.SafariSekoia reportedly said likely APT29 activity involved exploiting previously patched Safari vulnerabilities to deliver malware that harvests browser and device data.