New year, same story. Despite Ivanti's commitment to secure-by-design principles, threat actors — possibly the same ones as before — are exploiting its edge devices for the nth time.

Source: Lobro via Alamy Stock Photo

A Chinese threat actor is once again exploiting Ivanti remote access devices at large.

If you had a nickel for every high-profile vulnerability affecting Ivanti appliances last year, you'd have a lot of nickels. There was the critical authentication bypass in its Virtual Traffic Manager (vTM), the SQL injection bug in its Endpoint Manager, a trio affecting its Cloud Services Appliance (CSA), critical issues with its Standalone Sentry and Neurons for IT Service Management (ITSM), plus dozens more.

It all started last January, when two serious vulnerabilities were discovered in Ivanti's Connect Secure (ICS) and Policy Secure gateways. By the time of disclosure, the vulnerabilities were already being exploited by a suspected Chinese-nexus threat actor, UNC5337, believed to be an entity of UNC5221.

Now, one year and one secure-by-design pledge later, threat actors have returned to haunt Ivanti all over again, via a new critical vulnerability in ICS which also affects Policy Secure and Neurons for Zero Trust Access (ZTA) gateways. Ivanti has further warned of a second, slightly less severe bug that hasn't been observed in exploits yet.

"Just because we're seeing these often doesn't necessarily mean that they're easy to pull off — it's a highly sophisticated group that is doing this," Arctic Wolf CISO Adam Marrè points out, in defense of the downtrodden IT vendor. "Engineering is not easy, and secure engineering is even more difficult. So even though you may be following the principles of secure-by-design, that doesn't mean that someone isn't going to be able to come along and either with new technologies, or new techniques, and enough time and resources, hack in."

Related:New AI Challenges Will Test CISOs & Their Teams in 2025

**2 More Security Bugs in Ivanti Devices**

As yet unexploited (as far as researchers can tell) is CVE-2025-0283, a buffer overflow opportunity in ICS versions prior to 22.7R2.5, Policy Secure before 22.7R1.2, and Neurons for ZTA gateways before 22.7R2.3. The "high" severity 7.0 out of 10-rated issue in the Common Vulnerability Scoring System (CVSS) could enable an attacker to escalate their privileges on a targeted device, but requires them to be authenticated first.

CVE-2025-0282 — rated a "critical" 9.0 in CVSS — does not come with that same caveat, allowing for code execution as root with no authentication required. Ivanti disclosed few details regarding the exact cause of the issue, but researchers from watchTowr were able to successfully reverse engineer an exploit after comparing ICS's patched and unpatched versions.

Related:Best Practices & Risks Considerations in LCNC and RPA Automation

According to Mandiant, a threat actor began exploiting CVE-2025-0282 in mid-December, deploying the same "Spawn" family of malware tied to UNC5337 exploits of previous Ivanti bugs. Those tools include:

*   The SpawnAnt installer, which drops its malware colleagues and persists through system upgrades
    
*   SpawnMole, which facilitates back-and-forth communications with attacker infrastructure
    
*   SpawnSnail, a passive secure shell (SSH) backdoor
    
*   SpawnSloth, which tampers with logs to conceal evidence of malicious activity
    

"The threat actor's malware families demonstrate significant knowledge of the Ivanti Connect Secure appliance," says Mandiant senior consultant Matt Lin. In fact, besides UNC5337 and its spawn, researchers also observed two more unrelated but equally bespoke malware deployed to infected devices. One — DryHook, a Python script — is designed to steal user credentials off targeted devices.

The other, PhaseJam, is a bash shell script that enables remote and arbitrary command execution. Most creative, though, is its ability to maintain persistence through sleight of hand. If an administrator attempts to upgrade their device — a process that would unseat PhaseJam — the malware will instead show them a fake progress bar that simulates each of the 13 steps one might expect in a legitimate update. Meanwhile, in the background, it prevents the legitimate update from running, thereby ensuring that it lives another day.

Related:Cybercriminals Don't Care About National Cyber Policy

DryHook and PhaseJam might have been the work of UNC5337, Mandiant noted, or another threat actor altogether.

**Time to Update**

Data from The ShadowServer Foundation suggests that north of 2,000 ICS instances could be vulnerable at the time of writing, with the greatest concentration in the US, France, and Spain.

Source: The Shadowserver Foundation

Ivanti and the Cybersecurity and Infrastructure Security Agency (CISA) have published instructions for mitigating CVE-2025-0282, emphasizing that network defenders should run Ivanti's built-in Integrity Checker Tool (ICT) to seek out infections, and implement patches immediately.

"We have released a patch addressing vulnerabilities related to Ivanti Connect Secure," an Ivanti spokesperson tells Dark Reading. "There has been limited exploitation of one of the vulnerabilities and we are actively working with affected customers. Ivanti’s ICT has been effective in identifying compromise related to this vulnerability. Threat actor exploitation was identified by the ICT on the same day it occurred, enabling Ivanti to respond promptly and rapidly develop a fix. We strongly advise customers to closely monitor their internal and external ICT as part of a robust and layered approach to cybersecurity to ensure the integrity and security of the entire network infrastructure."

It may be worth noting that unlike ICS, Policy Secure and ZTA gateways won't be receiving their patches until Jan. 21. In its security advisory, Ivanti stated that ZTA gateways "cannot be exploited when in production," and that Policy Secure is designed to not be Internet-facing, reducing the risk of exploitation via CVE-2025-0282 or similar vulnerabilities.

"It's important that administrators here are doing the right things," Marrè says, noting, "That may result in some downtime, which can be disruptive for organizations, which can lead to them putting it off, or not fixing it as thoroughly and as well as they should."

Lin adds, "We’ve observed organizations that have historically acted promptly in response to these threats did not experience the same negative impacts when compared to organizations that failed to do the same." He also acknowledges, "All the swirl that takes place in the background once one of these patches is announced.

"Security teams across orgs have to scramble to not just patch, but also understand whether they’re vulnerable, and if so, do they only need to patch, or have they already been breached? And if they have been breached, that starts another incident response, which creates massive workflows across companies around the world. It’s important to not lose sight of the toil and exhaustion that defenders go through when assessing these scenarios and not be hyper critical of their initial reaction times."

**About the Author**

Nate Nelson is a writer based in New York City. He formerly worked as a reporter at Threatpost, and wrote "Malicious Life," an award-winning Top 20 tech podcast on Apple and Spotify. Outside of Dark Reading, he also co-hosts "The Industrial Security Podcast."

Threat Actors Exploit a Critical Ivanti RCE Bug, Again

Cybercriminals are luring victims into downloading the XMRig cryptomining malware via convincing emails, inviting them to schedule fake interviews using a malicious link.

Source: ImageBroker.com GmbH & Co. KG via Alamy Stock Photo

NEWS BRIEF

Cybercriminals have picked up a new tactic, impersonating CrowdStrike recruiters in order to distribute a cryptominer on their victims' devices.

This malicious campaign starts with an email, inviting the victim to schedule an interview with a recruiter for a position as a junior developer.

The illegitimate email contains a link, alleging that it will take the recipient to a site so they can schedule their interview, but in reality, takes the victim to a malicious website containing links to download a purported "CRM application."

"While interview and job-related phishing emails are not uncommon, this is a very targeted campaign that goes beyond the vast majority of malicious campaigns we see with this theme," said Chance Caldwell, senior director of the Phishing Defense Center at Cofense, in an emailed statement. "The campaign uses URLs that were created to look like they might actually belong to CrowdStrike, and the downloaded malware provides a pop-up that directs users to the real CrowdStrike support portal. Most of the use cases we see are lucky to have proper branding, much less the extended work done here to really portray themselves as CrowdStrike."

**Malicious Recruiter Lures Target Both Windows & Mac**

The site offers options for both Windows and macOS, and regardless of which option the victim chooses, once selected, it will download a Windows executable written in Rust. The executable will then download the cryptominer XMRig.

The executable runs several environmental checks to analyze the device and evade detection, such as scanning the running processes, verifying the CPU, and more.

If the checks are passed, the executable will display a false error message pop-up for the user, while downloading additional payloads needed to run the XMRig miner.

CrowdStrike, which identified the campaign just days ago, is warning job seekers to be vigilant, as this is not the only scam involving fake employment offers that's circulating out there.

It recommended avoiding any interviews carried out through instant message or email, and refusing to download any software for an interview, and it stressed the importance of verifying the authenticity of any CrowdStrike hiring communications by contacting \[email protected\].

"It is very unlikely that a recruiter will direct someone to download an executable as part of the interview process," Caldwell noted. "Any suspicious requests, such as this one, should be sufficiently verified before downloading anything, and contact information should be verified through the legitimate company website."

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Fake CrowdStrike 'Job Interviews' Become Latest Hacker Tactic

Growing sales of the System for Operative Investigative Activities (SORM), a Russian wiretapping platform, in Central Asia and Latin American suggests increasing risks for Western businesses.

Source: Golden Dayz via Shutterstock

A half-dozen governments in Central Asia and Latin American have purchased the System for Operative Investigative Activities (SORM) wiretapping technology from Russian providers, expanding their — and potentially Russian intelligence's — ability to intercept communications.

The technology includes monitoring equipment placed inside a telecommunications provider's facility, which delivers information to the client government's intelligence agency, including mobile numbers, phones identifiers, geolocation, names, email addresses, and IP addresses. That's according to threat intelligence firm Recorded Future, which found in an analysis that the former Soviet territories of Belarus, Kazakhstan, Kyrgyzstan, and Uzbekistan, and the Latin American nations of Cuba and Nicaragua, have very likely acquired the technology to wiretap citizens.

Western companies and citizens should take measures to protect their communications and to understand the risks of surveillance when traveling to countries that have lax civil protections against wiretapping, says a threat analyst with Recorded Future's Insikt threat intelligence group, who asked to remain anonymous due to the sensitivity of the topic.

"Obviously, in countries that don't employ SORM — even Western countries — surveillance frameworks are not immune to abuse, but it's important to look holistically at this when there's evidence of these systems being built with Russian-company inputs in a country with a history of state surveillance operations," the analyst says. "Particularly, human rights defenders, activists, journalists, members of civil society, but also foreign travelers, \[could all be targets\]."

Related:Fake CrowdStrike 'Job Interviews' Become Latest Hacker Tactic

The expansion of Russia's SORM kit highlights the gains of digital surveillance technology worldwide. The companies behind the spyware tools used by authoritarian governments — such as NSO Group's Pegasus and Intellexa Consortium's Predator — have made inroads globally, as the companies refine their ability to evade roadblocks on sales to sanctioned nations, according to an in-depth report published by the Atlantic Council in September. Overall, 41% of the 195 countries worldwide have licensed commercial spyware, including 14 of the 27 countries in the European Union, according to the Atlantic Council.

Wiretapping technology and spyware are often used for legitimate reasons, whether that be law enforcement investigations of suspected criminals or intelligence gathering against nation-state rivals. However, in countries with few protections for civil liberties, or poor regulation of digital surveillance technologies, abuses inevitably follow for governments that deploy it without adequate oversight, according to the Atlantic Council analysts.

Related:Banshee 2.0 Malware Steals Apple's Encryption to Hide on Macs

"Spyware makes it easier for states to penetrate even the most robust commercial technologies, cell phones, computers, and communications services; makes it far easier to act against citizens beyond state borders; and even provides governments with the ability to target senior officials, both domestically and abroad, where they might otherwise have no means to do so," the Atlantic Council analysts stated in the report. "Where that information is used to facilitate repression and abuse, its harms are untenable."

**The Spyware Nexus: An R Joins the Three I's**

The Atlantic Council identified 435 "entities" — companies and people associated with commercial spyware — and found that two-thirds lead back to three nations: Israel, Italy, and India. Now, Russia has become a major provider of surveillance technology as well.

Existing law in Russia requires that telecommunications providers install and maintain monitoring devices that meet SORM regulations, but the firms are not authorized to access the capabilities of the devices nor audit communications collection, according to Recorded Future's report. Countries in Russia's sphere of influence have passed similar laws mandating SORM-compliant technology, which is typically installed and serviced by Russian providers, likely giving Russia the ability to access intercepted communications.

Related:Unconventional Cyberattacks Aim to Take Over PayPal Accounts

Record Future used a variety of indicators for the adoption of SORM, including marketing materials and the websites of the providers of SORM technologies. The largest providers of SORM technology are companies called Citadel, Norsi-Trans, and Protei, who — along with five other identified technology firms — are likely exporting SORM products and services to at least 15 telecommunications companies, the firm found.

The risks of illicit digital surveillance are growing, argues Vitor Ventura, manager for EMEA and Asia at Cisco's Talos threat intelligence group.

"In certain countries, it might just be legal to do certain kind of interceptions for reasons that are not allowed in other countries, or because you have a law that says that if national security is at risk, you can do whatever you want," he says, adding that there has been a global boom in surveillance technology over the past few years.

"I don't think that the law is changing that much — I just think that there is a bigger appetite, and there's a lot more being offered," he says. "The prices eventually came down, and everyone that has the money for \[surveillance technology\] will actually go for it."

**Know Your Telecom Tech, Wiretapping Laws**

Companies that have employees based in nations with weaker civil liberty protections should note that adopting privacy and encryption tools can help mitigate the risk, but providers of virtual private network (VPN) services often are subject to the same laws as telecommunications providers, according to the Recorded Future report, and might also be turning over intelligence to government agencies.

In many ways, the cyber-risks mirror those argued by the US government in regards to Russian cybersecurity firm Kaspersky, whose antivirus products were banned in mid-2024, the Recorded Future analyst says.

"These \[telecom\] companies might be able to go into systems and have access to such a vast range of data — there's definitely a high intelligence value there," the analyst says. "The same risks that apply to Kaspersky are equally as applicable to Russian SORM providers."

Companies should keep apprised of the spread of the technology in the future. For example, one Russian provider, Protei, markets SORM in trade shows in Africa, the Middle East, and Latin America, raising the likelihood that countries in those regions will adopt the wiretapping platform at some time in the future.

**About the Author**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Russia Carves Out Commercial Surveillance Success Globally

To build a truly inclusive and diverse cybersecurity workforce, we need a comprehensive approach beyond recruitment and retention.

Source: Aleksei Gorodenkov via Alamy Stock Photo

COMMENTARY

As we enter 2025 and face an new presidential administration, the United States faces a critical challenge — maintaining a steadfast commitment and investment in our nation's youngest learners. 

Today's cybersecurity workforce faces a glaring shortfall of skilled workers and a significant diversity gap.

Embracing different perspectives is not just beneficial, it's essential for driving innovation, enhancing resilience, and fostering stronger partnerships across industry, government, and academia. Together, we can create a more inclusive cybersecurity workforce that not only benefits future generations, but advances innovation and US competitiveness.

**Improve Diversity in Cybersecurity by Inspiring Young Minds**

The current technology landscape has both challenges and opportunities. Increasingly complex cybersecurity threats demand action, yet we face a shortfall of nearly 265,000 cybersecurity professionals, according to CyberSeek. At the same time, the cybersecurity workforce lacks underrepresented groups — as of January 2024, it was comprised of only 11% Black, 8% Asian, and 12.6% Hispanic employees, according to the US Bureau of Labor Statistics.

This workforce gap presents an opportunity to reshape the industry through early intervention. By introducing cybersecurity education in kindergarten, we can spark interest from students across diverse backgrounds, especially in marginalized communities where access is uneven. This can help build a workforce ready to meet evolving cybersecurity demands.

Fortunately, organizations like Black Girls Hack, Girl Scouts of the USA, Cyversity, and Raices Cyber are focused on advancing STEM equity and creating pathways into cybersecurity careers for underrepresented groups. By disseminating no-cost resources and curriculum, training educators, and empowering state departments of education to integrate emerging technology and cybersecurity into curriculum, we can collectively address the existing workforce gap and build the workforce of tomorrow. 

While unconscious bias in hiring and promotion practices remains a barrier, companies with diverse leadership teams are 25% more likely to have higher profits. Diversity also bolsters national resilience against cyber threats and drives innovation. Purposeful collaboration across the public and private sectors shows the power of collective action to shape the future of cybersecurity.

**Integrating Culturally Relevant Cyber Curriculum into the Classroom**

Introducing culturally relevant cybersecurity education as early as kindergarten helps diverse students see themselves in the industry.

Ensuring Hispanic, African American, and tribal communities, among others, have a seat at the table ensures that their perspectives shape educational resources and curriculum. Making cybersecurity education culturally relevant requires deep, meaningful collaboration with community leaders to create content that is culturally appropriate and relevant. Effective implementation in schools means diverse educators from these communities can easily deploy these materials.

Engaging students from diverse backgrounds begins with relatable examples — such as teaching ciphers using lyrics by popular Black artists or adapting common cybersecurity problem by using words and phrases used by the Diné people.

Making cybersecurity relevant to diverse communities gives students visibility into various career paths and emphasizes that cybersecurity is for everyone.

**Empowering Future Cybersecurity Experts**

By championing diverse perspectives, we can create a more equitable digital landscape and inspire the next generation of cybersecurity leaders. Unlike traditional careers such as nurses or police officers, cybersecurity professionals don't benefit from the same level of visibility. Popular culture portrayals of cyber professionals — usually a lone hacker at a dimly lit keyboard — reinforce this anonymous, invisible stereotype. This couldn't be further from the truth.

Representation is key to showing students they too can pursue careers in the field. Diverse cybersecurity leaders making waves include former Cybersecurity Infrastructure and Security Agency (CISA) director Jen Easterly, National Cyber Director Harry Coker, Black Girls Hack's Tenisha Martin, Palo Alto Networks' Mary Ann Barnes, Check Point Global CISO Cindi Carter, and Raices cyber executive director and founder Eric Belardo, among others. These powerful role models are helping students envision similar careers. 

To build a truly inclusive and diverse cybersecurity workforce, we need a comprehensive approach beyond recruitment and retention. This means expanding access to cybersecurity and STEM opportunities at every educational level, creating and disseminating culturally relevant curriculum, and fostering strong partnerships between educational systems and the public and private sectors.

Through early educational intervention, we can create opportunities for all students, regardless of ZIP code or socioeconomic status, help strengthen our cybersecurity posture, and drive progress.

**About the Author**

Executive Director, CYBER.ORG

Laurie Salvail is the executive director of CYBER.ORG, a cybersecurity workforce development organization that targets K-12 students with cyber-career awareness, curricular resources, and teacher development funded through the Cybersecurity and Infrastructure Security Agency’s (CISA) Cybersecurity Education and Training Assistance Program (CETAP) grant. With more than 12 years of classroom experience, Laurie works to bring cyber education to K-12 institutions nationwide through innovative, impactful research-based education strategies, while fueling both public and private sector partnerships aimed at improving access and diversity in cybersecurity.

Laurie received a bachelor of science in business administration and management from McNeese State University, a teaching certification from Louisiana State University in Shreveport, a master of education in education leadership and administration from Louisiana State University and her Ph.D. in curriculum and instruction at Louisiana State University.

The Path Toward Championing Diversity in Cybersecurity Education

Since 2019, MirrorFace has been stealing information from myriad Japanese organizations to gain leverage over Japan in the event of hostilities between the two countries, experts said.

Source: Birgit Korber via Alamy Stock Photo

The National Police Agency and the National Center of Incident Readiness and Strategy for Cybersecurity warned Japanese organizations of a sophisticated Chinese state-backed cyber-espionage effort called "MirrorFace" to steal technology and national security secrets.

Japanese authorities said the advanced persistent threat group (APT) MirrorFace has been operating since 2019.

"By publicizing the modus operandi of 'MirrorFace' cyberattacks, the purpose of this alert is to make targeted organizations, business operators, and individuals aware of the threats they face in cyberspace and to encourage them to take appropriate security measures to prevent the damage caused by cyberattacks from spreading and to prevent damage from occurring in the first place," read a statement from Japanese police.

**MirrorFace Cyberattacks Against Japan**

Japanese law enforcement identified three types of MirrorFace attacks. The earliest and most enduring tactic used by MirrorFace to steal Japanese secrets was an elaborate phishing campaign between 2019 and 2023 aimed at delivering malware to the country's think tanks, governments, and politicians, according to the warning issued by Japan's National Police Agency and translated to English.

In 2023, MirrorFace pivoted to finding vulnerabilities in network devices across healthcare, manufacturing, information and communications, education, and aerospace, the police continued. MirrorFace exploited vulnerabilities in devices that included Fortinet FortiOS and FortiProxy (CVE-2023-28461), Citrix ADC (CVE-2023-27997,) and Citrix Gateway (CVE-2023-3519).

Another phishing campaign began around June 2024 and used basic phishing tactics against the media, think tanks, and Japanese politicians, according to police. And from February 2023 to October 2023, the group was observed exploiting an SQL injection in an external public server to gain access to Japanese organizations.

The revelations about MirrorFace's activities come amid other headline-grabbing Chinese-sponsored cyberattacks against US and global telecom companies, and even the US Department of the Treasury, carried out by a fellow APT group "Salt Typhoon."

MirrorFace appears to operating as a a People's Liberation Army (PLA) cyber-warfare unit, according to Mark Bowling, former FBI special agent and current chief information security and risk officer at ExtraHop.

"Since 2019, the MirrorFace APT has consistently utilized well-crafted spear-phishing campaigns, and used weaponized code/logic such as LODEINFO and MirrorStealer to steal credentials, escalate privileges, and exfiltrate data which could be utilized to better position the PLA in the event of hostilities with Japan," Bowling says.

As geopolitical tensions continue to flare up around the world, Bowling expects to see an increasing uptick in APT activity in kind, particularly by nation-state actors targeting the US.

"The consequences of those strained relations over Ukraine, Taiwan, and the ongoing Iran hostility against Israel though its proxies are now increasingly spilling over into aggressive and relentless digital campaigns," Bowling explains. "There is no doubt threats from nation-state groups will increase in volume and sophistication this year, targeting our critical infrastructure like utilities, telecommunications, and healthcare."

**About the Author**

Dark Reading

Becky Bracken is a veteran multimedia journalist covering cybersecurity for Dark Reading.

Chinese APT Group Is Ransacking Japan's Secrets

The most recent iteration of the open source infostealer skates by antivirus programs on Macs, using an encryption mechanism stolen from Apple's own antivirus product.

Source: Charles Walker Collection via Alamy Stock Photo

The macOS infostealer "Banshee" has been spotted skating by antivirus programs using a string encryption algorithm it stole from Apple.

Banshee has been spreading since July, primarily via Russian cybercrime marketplaces, where it was sold as a $1,500 "stealer-as-a-service" for Macs. It's designed to steal credentials from browsers — Google Chrome, Brave, Microsoft Edge, Vivaldi, Yandex, and Opera — and browser extensions associated with cryptocurrency wallets — Ledger, Atomic, Wasabi, Guarda, Coinomi, Electrum, and Exodus. Plus, it lifts additional information about targeted systems, including software and hardware specifications, and the password needed to unlock the system.

It was far from a perfect tool, widely detected by antivirus programs, thanks in part to its being packaged entirely in plaintext. But on Sept. 26, researchers from Check Point observed a more potent variant. This more successful variant remained otherwise undetected for months, primarily because it was encrypted with the same algorithm used by Apple's Xprotect antivirus tool for macOS.

**Banshee Malware Steals From XProtect**

XProtect is Apple's decade-and-a-half-old anti-malware engine for macOS. To detect and block malware, it uses "Remediator" binaries, which combine various methods and tools for antivirus-ing, including YARA rules, which contain patterns and signatures associated with known threats.

Check Point found that the same encryption algorithm that protects XProtect's YARA rules also concealed the September variant of Banshee.

It's not clear how the malware author — nom de guerre "0xe1" or "kolosain" — gained access to that algorithm.

"It could be that they performed a reverse engineering of the XProtect binaries, or even read relevant publications, but we can't confirm it," Antonis Terefos, reverse engineer at Check Point Research, speculates. "Once the string encryption of macOS XProtect becomes known — meaning the way the antivirus is storing the YARA rules is reverse-engineered — threat actors can easily 'reimplement' the string encryption for malicious purposes," he says.

Either way, the effect was significant. "The majority of the antivirus solutions in VirusTotal detected the initial Banshee samples using plaintext, but once the developer introduced this novel string encryption algorithm, none of the approximately 65 antivirus engines in VirusTotal detected it," he says.

That remained the case for around two months. Then, on Nov. 23, Banshee's source code was leaked on the Russian language cybercrime forum "XSS." 0xe1 shuttered his malware-as-a-service (MaaS) operation, and antivirus vendors incorporated associated YARA rules in due course. But even after that point, Terefos reports, the encrypted Banshee remained undetected by most engines on VirusTotal.

**How Banshee Stealer Is Spreading in Cyberattacks**

Since late September, Check Point has identified more than 26 campaigns spreading Banshee. Broadly speaking, they can be grouped into two clusters.

In three waves of campaigns lasting from mid-October to early November, threat actors spread the infostealer via GitHub repositories. The repositories promised users cracked versions of popular software, like Adobe programs and various image and video editing tools. The malware was concealed behind generic file names such as "Setup," "Installer," and "Update." This same cluster of activity also targeted Windows users with the popular Lumma Stealer.

The remaining campaigns spread Banshee via phishing sites, of one form or another. In these cases, the attackers disguised the malware as various popular software programs, including Google Chrome, TradingView, Zegent, Parallels, Solara, CryptoNews, MediaKIT, and Telegram. If a visitor was using macOS, they'd get a download link.

More, varying campaigns could be on the way, now that Banshee has been leaked. Thus, Terefos says, "Despite macOS traditionally being regarded as more secure, Banshee’s success demonstrates the importance for macOS users to remain vigilant and aware of the threats."

**About the Author**

Nate Nelson is a writer based in New York City. He formerly worked as a reporter at Threatpost, and wrote "Malicious Life," an award-winning Top 20 tech podcast on Apple and Spotify. Outside of Dark Reading, he also co-hosts "The Industrial Security Podcast."

Banshee 2.0 Malware Steals Apple's Encryption to Hide on Macs

The attack used a stolen remote support SaaS API key to exfiltrate data from workstations in the Treasury Department's Office of Foreign Assets Control.

Source: World History Archive via Alamy Stock Photo

NEWS BRIEF

The Chinese threat actor group known as "Silk Typhoon" has been linked to the December 2024 hack on an agency that's part of the US Department of the Treasury.

In the breach, the threat actors were able to use a stolen Remote Support SaaS API key through third-party cybersecurity vendor BeyondTrust to steal data from workstations in the Office of Foreign Assets Control (OFAC).

Silk Typhoon, also known as Hafnium, is well known for hitting targets in education, healthcare, defense, and non-governmental organizations. 

Using tools such as the China Chopper Web shell, the group's cyber-espionage campaigns focus mainly on data theft.

The group also targeted the Treasury Department's Office of Financial Research; this latest breach is still being investigated and assessed.

The Cybersecurity and Infrastructure Security Agency (CISA) has since confirmed that these exploits are limited to just the agency, and there is no indication that any other federal agencies have been impacted by the incident.

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Hacking Group 'Silk Typhoon' Linked to US Treasury Breach

CISOs need to recognize the new threats AI can present — while also embracing AI-powered solutions to stay ahead of those threats.

Source: marcos alvarado via Alamy Stock Photo

COMMENTARY

Security teams have always had to adapt to change, but new developments that will play out over the next year could make 2025 particularly challenging. The accelerating pace of AI innovation, increasingly sophisticated cyber threats, and new regulatory mandates will require chief information security officers (CISOs) to navigate a more complex landscape.

Vendors are rapidly adding AI-enabled features to existing products, and the foundational large language models (LLMs) they are using present a new attack surface that malicious actors will try to exploit. CISOs will need to understand their level of exposure to these threats and how to mitigate them.

Simultaneously, the dynamic landscape of cybersecurity regulations, particularly in regions like the European Union and California, demands enhanced collaboration between security and legal teams to ensure compliance and mitigate risks. This convergence of new technologies and laws means CISOs must balance board-level compliance needs with novel security challenges to protect their organizations.

Despite the potential security challenges posed by generative AI (GenAI), it also offers opportunities to improve the security of software development processes. By proactively identifying vulnerabilities and enabling greater automation, AI will help close the gap between developers and security teams. 

Below are three trends that will dominate the enterprise security landscape in 2025. 

**Trends to Watch in 2025****1\. Vulnerabilities in Proprietary LLMs Open the Possibility of Broad-Impact Security Incidents**

Software vendors are rushing to add AI-enabled features to their products, often by leveraging proprietary foundational LLMs. As attackers start to find vulnerabilities in these models, they will open a new attack vector with potentially wide-scale consequences. Industry consolidation increases risk.

Proprietary models reveal little information about their provenance or internal guard rails, making them much harder for security professionals to understand and manage. As such, attackers can embed malware or exploit lesser-known attack surfaces in a model's feature space. 

Because the industry relies heavily on a few proprietary LLMs, these attacks could have cascading effects throughout the software ecosystem, potentially leading to wide-scale outages or impacts. 

**2\. AI and Cloud-Native Workloads Will Increase Demand for Highly Adaptive Identity Management **

The growth of cloud-native and AI applications creates new challenges for identity management systems. This year, access control must become more adaptive to deal with the increase in non-human, service-based identities. 

Systems that manage identity and permissions have already been transitioning from their traditional, static state to a more ephemeral and adaptable framework, reflecting the agility required for modern digital interactions. These needs will become even greater in the year ahead. 

AI-driven applications, in particular, demand a solid understanding of transitive identities. These applications require systems that provide secure and efficient access, even as roles and needs constantly evolve.

**3\. AI Will Help Scale Security Within DevOps**

In a recent survey, 58% of developers said they feel some degree of responsibility for application security. However, the demand for security-skilled DevOps professionals still outpaces supply. 

AI will continue democratizing security expertise within DevOps teams by automating routine tasks, providing smart coding recommendations, and further bridging the skills gap. Security will be integrated throughout the build pipeline, enabling the early identification of potential vulnerabilities at the design stage by leveraging reusable security templates that can be integrated into developer workflows.

Authentication and authorization will also be improved, with AI automatically assigning roles and permissions as services are deployed across cloud environments. 

The net result will be improved security outcomes, reduced risk, and enhanced collaboration between developers and their security peers. 

**Embracing AI-Powered Solutions to Secure the Threat Landscape **

As the technology landscape continues to evolve and cyber threats become increasingly sophisticated, CISOs must recognize the new threats that AI can present while embracing AI-powered solutions to stay ahead of them. 

By leveraging AI to automate security tasks, identify vulnerabilities, and respond to threats in real-time, organizations can strengthen their security posture and stay ahead of the fast-evolving threat landscape.

**About the Author**

CISO, GitLab

Josh Lemos is the CISO at GitLab Inc., where he brings 20 years of experience leading information security teams to his role. He is responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected, fortifying the GitLab DevSecOps platform and ensuring the highest level of security for customers. A talented security practitioner and technology leader, Josh is widely recognized for his strategic vision, his ability to drive growth and innovation, and his passion for building and empowering teams. He believes in technology's potential to transform the world and the need to secure it against emerging threats. Josh has led security teams at numerous high-growth technology companies including ServiceNow, Cylance, and most recently Block (formerly known as Square).

New AI Challenges Will Test CISOs &amp; Their Teams in 2025

The country awaits implementation guidelines for a framework that gives Indians greater autonomy and security over their personal data — and recognizes a right to personal privacy.

Source: Wavebreakmedia Ltd IFE-240405\_3 via Alamy Stock Photo

The government of India has drafted rules that will define how companies inside and outside of the country must handle its citizens' data privacy.

A year and a half ago, India enacted its first ever comprehensive national data protection law: the Digital Personal Data Protection (DPDP) Act. The act defined key privacy rights for Indian citizens — to access, update, correct, challenge, port, and erase their data, plus additional safeguards for children's data — and various obligations of data stewards to secure user data, maintain its accuracy, limit how it's used, and more.

Organizations have not yet been forced to adjust their data trafficking practices, as the act was waiting on a set of clearly defined rules of implementation. On Jan. 3, India's Ministry of Electronics and Information Technology (MeitY) released those draft rules, designed to operationalize DPDP. In 22 provisions and seven schedules, the DPDP Rules provide businesses with a framework for complying with the act once the government begins to enforce it.

For years leading up to this point, "As the digital infrastructure in India has grown exponentially, the absence of safety mechanisms for individuals has left citizens vulnerable," says Pankit Desai, CEO and co-founder of Sequretek. That makes DPDP "a landmark regulation, long overdue. It's not just a regulatory framework — it is a signal of India's readiness to prioritize citizen welfare in the digital age."

**India's Long Road to Data Privacy**

In 1941, Khrarak Singh, a citizen of India's northern state of Uttar Pradesh, was tried for gang robbery (dacoity). He was let off thanks to an absence of evidence, but police kept an eye on him nonetheless. They visited his home at night, kept tabs on his movements, and monitored various aspects of his personal life: his employment, social life, and habits, for example.

Eventually Singh filed a petition, arguing that the surveillance violated his constitutional rights. On Dec. 18, 1962, six judges of India's Supreme Court ruled that though some of the police tactics amounted to harassment, many of their surveillance measures were legally permissible. Privacy, they argued, was not a fundamental right under the country's constitution.

That remained the case until 2017, after India's government proposed the "Aadhaar" project, giving all citizens identification numbers backed with various demographic and biometric data. Overseeing a challenge to Aadhaar, Chief Justice of India JS Khehar explained, “It is essential for us to determine whether there is a fundamental right to privacy in the Indian Constitution," citing the Kharak Singh case. In August 2017, a nine-judge bench declared that privacy was a right given to India's citizens under its constitution.

Their ruling opened the floodgates to data protection legislation, first and most notably the proposed Personal Data Protection Bill of 2019. However, the bill was proved both expansive and restrictive. The bill covered both personal and non-personal data, but was stringent in mandating that sensitive personal data not leave the borders of the country, yet also lenient in allowing the government to exempt itself for various reasons. Regardless, the bill was withdrawn in August 2022. It was followed in spirit by the more neutral DPDP, which will finally become operational once the latest proposed rules are finalized.

**New Rules of the Road**

The DPDP rules are mostly industry standard: companies must notify customers about the data they collect, and if it's breached, encrypt it at rest and in transit, delete it after three years of inactivity, and so on.

"Most notably, they grant substantial control to the data principal (individual) over their personal data, including the ability to determine when, how, where, and for what purpose their data is used," notes Rama Krishna Gudipati, head of customer success at CloudSEK. "Additionally, the introduction of penalties for non-compliance adds an important layer of accountability." Failing to notify customers of a breach, for example, or betraying obligations around children's data, could cost companies up to INR 200 crore (around $23 million).

Certain provisions are more debatable, though, like the continued exceptions afforded to government agencies. Sequretek's Desai says that "The exemption granted to the government from these rules raises questions about fairness and accountability, especially given the government's significant role as a service provider," says Sequretek's Desai. "India's digital infrastructure is heavily influenced by government-led initiatives, unlike in the West, where private enterprises dominate," making the rule more impactful than it would be in other countries.

The deadline for submitting feedback on the new draft rules is Feb. 18. After the rules are activated, MeitY stated in a Jan. 5 press release, "An adequate period would be provided so that all stakeholders, from small enterprises to large corporates, may transition smoothly to achieve compliance with the new law."

**About the Author**

Nate Nelson is a writer based in New York City. He formerly worked as a reporter at Threatpost, and wrote "Malicious Life," an award-winning Top 20 tech podcast on Apple and Spotify. Outside of Dark Reading, he also co-hosts "The Industrial Security Podcast."

India Readies Overhauled National Data Privacy Rules

The voluntary program is intended to boost consumer confidence in vulnerable IoT devices, but experts want to see vendors held to a higher standard.

Source: Prisma by Dukas Presseagentur GmbH via Alamy Stock Photo

Yesterday, the White House introduced a cybersecurity labeling program for wireless Internet-connected devices, intended to help Americans make more informed decisions about the products they buy and their security.

As Americans continue to add Internet of Things (IoT) devices to their home networks — everything from baby monitors to security cameras — there are growing concerns about the safety of these devices and their vulnerability to hackers. The goal of this label is to guide consumers to more secure products as well as encourage vendors in their cyber practices.

Known as the "US Cyber Trust Mark," the label has been a long time coming, with the Federal Communications Commission gathering input over the past 18 months. In a bipartisan and unanimous vote, the FCC authorized the program and said 11 vendors will act as label administrators while UL Solutions will serve as the lead administrator.

"The White House launched this bipartisan effort to educate American consumers and give them an easy way to assess the cybersecurity of such products, as well as incentivize companies to produce more cybersecure devices, much as EnergyStar labels did for energy efficiency," the White House brief read.

**Just Good Intentions?**

Though this new system has good intentions for both consumers and vendors, there are concerns and speculation as to how effective this cybersecurity label will be.

The FCC intends to use QR codes linking to a national registry of certified devices and information about these products, such as how to change the default password, configure the device securely, determine whether updates and patches are automatic and how to access them, and how long the vendor will support device security.

"Allowing consumers to scan a QR code and get information from a decentralized IoT registry is a terrific idea," Roger Grimes, data-driven defense evangelist at KnowBe4, wrote in an emailed statement. "There are a lot of things to like about this program, especially the focus on IoT cybersecurity basics, such as changing default passwords, patching, data protection, and a software/hardware bill of materials."

For these reasons alone, he believes that this program is worth supporting. However, he has some reservations.

"The devil is in the details and many of the security requirements are really just recommendations, such as the entire program itself (i.e., vendors do not need to participate), are voluntary, and only suggestions," Grimes wrote. "I wish many basic cybersecurity defenses such as the customer being forced to change the default password and automatic patching were required to be in the program. It would make the program much more valuable."

Part of the reason the program is voluntary is because the FCC believes that "the success of a cybersecurity labeling program will be dependent upon a willing, close partnership and collaboration between the federal government, industry, and other stakeholders" and the record shows "substantial support for a voluntary approach."

**Making Assumptions**

In order to use the US Cyber Trust Mark, manufacturers that meet eligibility criteria must have their products tested by an FCC-recognized and accredited third-party lab to ensure that the program's requirements have been met. After this, they must submit an application to a Cybersecurity Label Administrator with the necessary supporting documents. 

But the way the requirements are written, patching on behalf of the organizations isn't necessarily automatic, indicating that though an organization may have a cyber sticker of approval, it's still the consumer's responsibility to stay up to date with cybersecurity standards.

"So, you could have some IoT vendors really going out of their way to make very secure products that require very little attention from the consumer and other IoT vendors not applying the same high cybersecurity practices and getting to use the same mark," Grimes wrote.

And while the FCC safety mark may indicate a device is designed safely, the US Cyber Trust Mark doesn't necessarily mean the same thing. This leads to consumers seeing the mark and believing they are secure.

"We also must consider whether this trust mark will give consumers a false sense of being 'unhackable' and a false sense of complacency," Sean Tufts, managing partner for critical infrastructure and operational technology at Optiv, wrote in an emailed statement. "Even if a smart device has built-in security features, users still have a personal responsibility to do their part by taking extra safety precautions — for example, changing default passwords and updating drivers/software/firmware."

**About the Author**

Skilled writer and editor covering cybersecurity for Dark Reading.

Source

DARKReading