Cyber Brief: APT28 Targets NATO Suppliers as Ransomware Groups Exploit PAN-OS
· 1:34:08 · Watch on YouTube ↗
Summary
The briefing covers reported APT28 attacks on NATO-linked targets, ongoing exploitation of patched PAN-OS flaws, Meta Muse privacy exposure, AI-assisted intrusions and new US restrictions on DeepSeek.
Key points
- Symantec researchers reportedly linked attacks on organizations in two NATO member states to APT28, using the Hookedge backdoor, in-memory loaders, credential theft and a persistent SSH tunnel.
- Researchers reportedly found hundreds of sensitive Meta Muse chats through easily enumerated sharing URLs and passive DNS searches. Meta paused artifact sharing.
- Documents reported by The Intercept describe Echo Tribble as a proposed Army Cyber Command platform for autonomous offensive AI operations; the briefing does not establish a deployed capability.
- DHS ordered federal civilian agencies to remove DeepSeek models and barred future purchases, including third-party integrations. The reported order specified neither particular security concerns nor a removal deadline.
- Sources cited by ProPublica alleged that DHS appointees asked CISA to investigate hacking a voting machine without notifying its vendor of discovered flaws.
- The briefing says the EU Cyber Resilience Act requires reporting attacks exploiting end-of-life products but does not require fixes, following attacks involving Copeland and Danfoss refrigeration equipment.
- Researchers reportedly found exposed Karen dashboards showing automated attacks against hundreds of organizations. Separately, ransomware groups continue exploiting patched PAN-OS and Prisma Access flaws to bypass MFA and establish VPN access.
Article Details
- Topics
- [15:06] Reported APT28 attacks against NATO defense suppliers and law enforcement
- [22:48] Meta Muse sharing URLs expose sensitive chat information
- [27:31] Reported Echo Tribble plans for autonomous offensive cyber agents
- [33:03] DHS orders DeepSeek removal from federal civilian systems
- [40:27] Reported DHS request for CISA voting-machine hacking research
- [46:16] End-of-life refrigeration attacks and EU reporting obligations
- [51:22] Karen agent platform reportedly abused for automated intrusions
- [55:18] Ransomware groups continue exploiting patched PAN-OS vulnerabilities
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationRansomware groups reportedly exploited authentication bypass vulnerabilities in PAN-OS and Prisma Access to gain an initial corporate-network foothold.T1204.002 · Malicious FileThe briefing describes initial infection through execution of a macro-enabled Word document in the reported APT28 attacks.T1486 · Data Encrypted for ImpactThe reported post-exploitation ransomware activity includes encrypting data.T1572 · Protocol TunnelingOperators in the reported naval shipbuilder intrusion established a persistent SSH tunnel into an internal network.
People
Threat Actors
APT28Symantec researchers reportedly linked this Russian-linked group to attacks against law enforcement and defense-related organizations in two NATO member states; the briefing also identifies the tracking name Swallowtail.CertaNamed in the briefing as a ransomware group reportedly continuing to exploit patched PAN-OS and Prisma Access authentication bypass flaws.InkNamed in the briefing as a ransomware group reportedly continuing to exploit patched PAN-OS and Prisma Access flaws for initial access.QuillanNamed in the briefing as a ransomware group that Unit 42 and ReliaQuest reportedly observed continuing to exploit patched PAN-OS and Prisma Access flaws.