Cybersecurity today would like to thank Meter for their support in bringing you
This podcast Meter delivers a complete networking stack, wired, wireless and
cellular in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Millions of devices freed from the clutches of nation state hackers.
AI agents hijacked with a single URL single sign-on systems
compromised through ving attacks.
Polish energy infrastructure targeted by state link cyber
ops and antivirus software allegedly used to deliver malware.
This is cybersecurity today, and I'm your host, David Shipley.
Let's get started.
Millions of people were unknowingly letting criminals and nation state
hackers use their home and mobile internet connections to hide cyber attacks.
According to reporting by Android Central, Google has disrupted a massive
residential proxy network known as IP Idea, which until recently was
operating quietly at global scale.
IP idea wasn't traditional malware.
It was a proxy network embedded inside hundreds of Android
apps and developer toolkits.
Once installed, those apps could silently turn a device into an internet relay
routing other people's traffic through it.
That meant malicious activity didn't come from suspicious data centers.
It came from real phones, real homes, real people.
Google's threat Intelligence Group says The network was used by more
than 550 tracked threat groups in a single week, including organized cyber
criminals and state linked actors tied to China, Russia, Iran, and North Korea.
The infrastructure supported credential theft, espionage, denial of service
attacks, and command and control traffic.
Last week, Google took legal and technical action to shut
down IP idea related domains.
Updated Google Play Protect to remove affected apps, and coordinated with
partners to disrupt backend systems.
Google says, roughly 9 million Android devices were removed from the network
along with hundreds of compromised apps.
Parts of the infrastructure may still exist, but the scale of
abuse has been sharply reduced.
If you wanted to take over every AI agent on one of the Internet's newest
and most talked about AI platforms, you really didn't need to hack much.
You just needed a URL.
You heard that right?
The AI agent platform Jim noted about last week.
It was a security hot mess.
According to reporting by 4 0 4.
Media on Saturday, MT book, build As a Social Network for autonomous
AI agents left its backend database completely exposed, allowing anyone
to take control of any agent on the.
Security researcher Jameson O'Reilly discovered that MT. Book's super
base database exposed API, keys verification tokens, and ownership
data for every registered agent.
Those keys effectively act as passwords, allowing agents to post and act online.
The issue stemmed from a basic configuration failure.
Supera base exposes API by default, but relies on row level
security rules to protect data.
In this case, those protections were either never enabled or
never properly configured.
Compounding the issue, the database URL and publishable keys were
visible in MT. Book's own code.
Anyone who found them could retrieve agent secrets and post whatever they
wanted to as any agent 4 0 4, media verified the exposure and demonstrated
account takeover with permission.
O'Reilly says the flaw could have been prevented with just two sequel statements.
Some affected agents belong to high profile figures in the AI community
raising the risk of impersonation, scams, and reputational damage.
The database has since been secured and there's no evidence of malicious
exploitation prior to disclosure.
Welcome to 2020 six's.
Answer to unsecured AWS S3 buckets.
Our next story shows how attackers are abusing single sign-on platforms to
move quickly through cloud environments.
According to new reporting from Mandiant, the shiny hunters extortion group and
its affiliates are stealing large volumes of cloud data by targeting SSO platforms
like Okta, Microsoft, Enterra, and Google.
The attacks begin with voice phishing or phishing threat.
Actors impersonate corporate IT or help desk staff and call employees
directly claiming there's an issue with multifactor authentication.
During the call, the employee is directed to a company branded
phishing site designed to look like a legitimate login portal.
These sites use advanced phishing kits that allow attackers to
interact with victims in real time.
As credentials are entered, attackers immediately relay them, trigger
legitimate MFA challenges, and instruct the employees on how to
respond, approving push notifications, or entering in one-time codes.
That allows attackers to authenticate and register their own MFA devices.
Once inside attackers log into the organization's SSO dashboard, which in
some cases may list every connected SaaS application the user can access, including
Salesforce, Microsoft 365, SharePoint, DocuSign, slack, Google Drive, and so on.
Manian observed bulk data downloads scripted to access using PowerShell and
attackers deleting security notification emails to conceal new MFA enrollment.
MANIAN is tracking multiple threat clusters involved with shiny hunters
handling extortion and stolen data already appearing on leak sites.
Earlier this month, we told you about a failed cyber attack
targeting Poland's energy sector.
Now, new details from Polish authorities reveal how broad and
coordinated that operation was.
Poland's National Computer Emergency Response Team Cert Polska says Attackers
linked to Russian State Security Services targeted more than 30 wind and solar
Farm, a manufacturing company, and a large combined heat and power plant.
The attacks took place on December 29th, 2025, and are attributed to a
threat cluster known as Static Tundra, which Cert Polska assesses is connected
to Russia's Federal security service.
According to Cert Pol sc, the attacks had a destructive objective.
Communications between renewable energy facilities and grid operators
were disrupted, but electricity production thankfully continued.
An attempted attack on a combined heat and power plant supplying
nearly 500,000 customers also, thankfully failed to cause an outage.
Investigators say attackers accessed internal networks tied to substations,
conducted reconnaissance, damaged firmware on industrial controllers, deleted
system files, and attempted to deploy custom wiper malware known as dyno wiper.
. The malware was deployed on industrial human machine interface systems and
network shares after attackers granted access through vulnerable FortiGate
devices and S-S-L-V-P-N services.
Cert Polska also reports months long data theft, lateral movement, and the use of
stolen credentials to access Microsoft 365 exchange teams and SharePoint
with particular interest in SCADA and operational technology projects.
Our final story today is a reminder that even security software can be an attack.
Vector Security Week reports that some customers of Ecan antivirus were
infected with malware after attackers compromised an official update server
operated by Microworld Technologies.
The incident became public on January 29th after cybersecurity firm morph.
EEC warned that malicious updates were actively tampering with user systems.
According to Morphy, EC attackers distributed a malicious file
called Reload Exe through eScan n's legitimate update infrastructure.
Once installed it blocked future updates, altered antivirus
functionality, established persistence, and downloaded additional payloads.
Because compromise services were cut off from update servers, automatic remediation
was impossible, forcing users to contact eScan directly for a cleanup utility.
Microworld technology says it detected unauthorized access on January 20th and
isolated the affected update server.
In a customer advisory, eScan confirmed a regional update server was compromised
and acknowledged medium to high impact for some enterprise customers.
The company has disputed morphy sex characterization of the incident
as a supply chain attack, and has indicated is working with legal
counsel in response to the disclosure.
eScan says remediation tools have been released and normal
update operations restored.
Those are the stories for Monday, February 2nd.
If you enjoy the show, please consider giving us a like subscribing or a
review on your favorite podcast service.
We'd love to reach even more people and we continue to need your help.
Consider telling folks about cybersecurity today.
I'm David Shipley.
Thanks for listening.
Have a great week, Jim.
Love will be back on the news desk on Wednesday.
we'd like to thank Meter for their support in bringing you this podcast
Meter delivers full stack networking infrastructure, wired, wireless,
and cellular to leading enterprises.
Working with their partners meter designs, deploys and manages
everything required to get performant.
Reliable and secure connectivity in your space.
They design the hardware, the firmware, build the software,
manage deployments, and run support.
It's a single integrated solution that scales from branch offices
to warehouses to large campuses, all the way to data centers.
Book a demo at me.com/cst.
That's METE r.com/cst.