Security Weekly #626: Stop & Shop Breach, OVH Cloud Malware, and Plex Exploits
· 32:24 · Watch on YouTube ↗
Summary
Security Weekly #626 covers a confirmed Stop & Shop breach, an OVH Cloud CLI compromise distributing information-stealing malware, ConnectWise credential abuse across Microsoft 365, Plex flaws exploited after PoC release, and ransomware-response risks.
Key points
- Stop & Shop confirmed a cybersecurity breach but did not disclose what happened.
- Attackers reportedly hijacked a developer’s GitHub account and modified OVH Cloud’s open-source CLI to distribute information-stealing malware. The release was blocked after a customer reported it.
- A compromised ConnectWise cloud-backup credential was used for unauthorized access to multiple Microsoft 365 environments. Applications reportedly elevated their privileges and added secrets; ConnectWise shut down access to its backup service.
- The US Department of Homeland Security directed federal civilian agencies to remove DeepSeek-related products. The presenter noted that the order’s broad scope could be difficult to apply.
- Plex vulnerabilities reportedly allowed unauthenticated code execution on exposed servers. Attackers began exploiting them within a day of PoC publication; Plex had shipped fixes and urged server owners to upgrade.
- A Saudi national was reportedly charged over a concealed recording device in an OpenAI meeting room; alleged Saudi government support was not presented as established fact. The discussion recommends policies and checks for covert recording and surveillance devices.
- The ransomware discussion distinguishes guilty pleas from allegations involving Shiny Hunters and negotiators. Practical advice included separating negotiation from payment approval and setting decision processes before an incident.
Article Details
- Topics
- [01:36] Cybersecurity job-posting declines and uncertainty about AI’s role
- [05:28] Stop & Shop confirms a breach but provides no details
- [07:20] OVH Cloud CLI compromise and information-stealing malware
- [10:03] ConnectWise credential compromise and Microsoft 365 application trust
- [13:04] DHS order restricting DeepSeek products in federal civilian agencies
- [16:01] Plex vulnerabilities, unauthenticated code execution, and exploitation after PoC publication
- [17:52] Alleged corporate espionage involving a concealed recording device and surveillance controls
- [22:00] Shiny Hunters reporting, ransomware negotiator misconduct allegations, and governance safeguards
MITRE ATT&CK
T1078.004 · Cloud AccountsA compromised Microsoft 365 application credential was reportedly used to gain unauthorized access to multiple cloud environments.T1098.001 · Additional Cloud CredentialsOne observed application reportedly added secrets to other applications, with expirations in 2028.T1098.003 · Additional Cloud RolesThe compromised applications reportedly made themselves Exchange administrators and, in one observed case, a Teams application became a global administrator.T1190 · Exploit Public-Facing ApplicationAttackers reportedly exploited Plex vulnerabilities on exposed servers to execute code without valid credentials.T1195.002 · Compromise Software Supply ChainAttackers reportedly hijacked a developer’s GitHub account and modified the OVH Cloud CLI release to distribute information-stealing malware, consistent with software supply-chain compromise.
People
Aaron LeylandSecurity Weekly contributor who analyzed ransomware negotiation risks and recommended separating negotiation from payment authority and preparing decision processes in advance.Angelo MartinoRansomware negotiator who, according to the transcript, pleaded guilty to giving Black Cat clients’ negotiating positions and policy limits.Doug WhiteSecurity Weekly host who presented the security stories and discussed operational risks, including software supply-chain controls and application credentials.Monster Clyde Suhar PinachiThe transcript reports that he pleaded not guilty to wire fraud; prosecutors allegedly said he billed clients for recovery while secretly paying ransoms.Tore BurkhardtFormer colleagues reportedly said ransomware crews knew him by the nickname Ghost Byte. A Dharma representative reportedly directed a victim to a Ghost Byte email in 2018, but the transcript says it is unclear whether Burkhardt used that address; he was not charged, and no one linked him to Shiny Hunters.
Threat Actors
Black CatRansomware group that Angelo Martino pleaded guilty to providing with clients’ negotiation positions and policy limits.DharmaA Dharma ransomware representative reportedly directed a victim to a Ghost Byte email address in 2018.Edward DubrovskyThe transcript reports that he was arrested and charged with extortion offenses. Sources cited by Brian Krebs allegedly said he knew Shiny Hunters had stolen sensitive FBI data; the claim was described as untested in court, and he was not reported convicted.Shiny HuntersDescribed as an extortion gang whose site reportedly listed around 100 organizations, offered data samples, and threatened to publish data after seven days.