Welcome back to Digital Rage. I'm Jeff, the producer here at Byer Company.
Today we have the Byer Nickel Cybersecurity brief for the first half of September,
highlighting an increase in compromised consumer devices from vendors like
TP Link and Sonic Wall. A significant WhatsApp zero click vulnerability and
Quillen is still the top-rance of where. Let's listen.
Welcome curious minds to another deep dive.
Great to be diving in. Today we're tearing into the latest
cybersecurity intelligence. We've got the Byer Nickel's threat brief,
the one covering September 1st, 15th, 2025. Yep, fresh off the digital press.
And our mission, well it's the same as always, sift through this, pull out the really
important stuff, connect those dots and give you that shortcut to being
genuinely informed about the digital threats that are
well shaping things right now. And it's a fascinating snapshot this time.
It is isn't it? And maybe a little alarming in places,
looking at what attackers are actually getting up to. What really jumps out I
think from this brief is just how dynamic and frankly agile cyber threats are
becoming. We're not just tracking say new tools or new attacker names.
We're seeing these fundamental shifts in who's being targeted and maybe even more
importantly how they're being targeted. Right. This period, this first half of
September, it gives a really revealing look into that constant evolution.
It just underscores why vigilance isn't, you know, just a good idea.
Absolutely necessary. Okay, so let's pull back that curtain then.
The executive summary kicks things off with some pretty stark
observations. What's really grabbing your attention as a new or maybe escalating concern,
especially for, you know, the everyday person listening?
Well, the brief really puts a spotlight on a quite a disturbing rise in
attackers managing to compromise devices from vendors like Sonic Wall.
And maybe more surprisingly for some TP link TP link like home routers.
Exactly. And that's the crucial insight here. Many of these aren't big corporate
firewalls. They're consumer grade devices. Your home router, maybe a Wi-Fi
extender. And the big implication, these compromises can just sit there
totally undetected for months. Maybe forever. Your personal network essentially
becomes an unwitting launch pad for attackers. Wow. It makes you ask, doesn't it?
When was the last time you even thought about the security of your home router after
that initial setup? That's yeah, that's a huge shift from what I think most people picture.
We tend to think, you know, asset corporations, government agencies, getting it.
Sophisticated targets. But you're saying our home networks, the actual backbone of our daily digital
lives, they're becoming a really significant and maybe a softer target. What makes them so
vulnerable right now specifically? Precisely. The report is very explicit about significant
activity around three specific CVEs, common vulnerabilities and exposures impacting
certain TP link devices. And here's the kicker. They've reached end of life.
Ah, okay, end of life. Yeah, we're talking CVE 2020, 24, 3, 63 for the TLWA885RE
extender, CVE 2023, 50224 for the popular TLWA841N router and CVE 20259377,
which hits multiple TP link router models. Got it. And the critical point isn't just that
these flaws exist. It's that because they're end of life, the manufacturer isn't releasing
security updates anymore. So no patches coming? Exactly. A patch might exist for one specific old
flaw, but the core firmware isn't maintained. So you get this ever growing list of potential
backdoors. It's like, like having a house with broken windows, but the landlord's just stop
doing any repairs at all. Right. So the advice isn't even patch it. It's replace it. These obsolete
devices are kind of ticking time bombs in potentially millions of homes. So for us, just trying to stay safe
online, it means we've got to look beyond our laptops and phones. We need to literally
audit the hardware connecting us to the internet. Is there anything else broadening this threat landscape?
Yeah, this trend of wider targeting goes beyond just the hardware. We're also seeing a noticeable
uptick and activity from two specific Android malware variants. Okay. And if you step back and
look at the global pattern, there's a definite shift in victim geography too. India and South Korea,
for instance, are now showing up in the top five victim locations for ransomware attacks. Really,
that's new. It is. And it's not just a slight expansion. It suggests attackers are actively diversifying
where they focus, maybe looking for new targets, potentially less hardened ones. Outside those,
traditionally dominant regions like the US or Western Europe. Okay. Now here's where things get
really interesting, I thought the ransomware scene. It's really getting a shake up, isn't it?
Quillen, which has been such a dominant player. Yeah, consistently. It's actually seeing its
percentage decrease steadily. Yeah. So if Quillen's maybe losing a bit of ground, who's actually
stepping into that spotlight? Who's changing the game? The report paints a really clear picture here.
You're right. Quillen still holds the top spot overall for this period, but it's share of
attacks has definitely dropped. Akira is the only other group from the previous top five that's still,
you know, really relevant. They actually moved up a rank, but the big story, the sudden emergence
of three entirely new actors making their debut in the top five. Three new ones, wow. Yeah. The gentleman,
play, and I and see ransom. These groups aren't just like bubbling under. They're rapidly asserting
themselves. The gentleman. That sounds less like hackers and more like, I don't know, something out
of a spy movie. What makes this particular group stand out? What are their methods? Well, the gentleman,
a group we genuinely hadn't documented before they stand out because the report notes their use of
highly tailored tools to bypass enterprise endpoint protection. Highly tailored. So this isn't just
about finding an existing vulnerability and exploiting it with an off the shelf tool. It suggests a
level of bespoke development, maybe deep reconnaissance before the attack. Right, custom work.
Exactly. It's like they're crafting custom keys for specific locks, not just trying a bunch of master
keys. That level of sophistication, the resources involved, the patience, it kind of blurs the lines
between purely criminal groups and maybe something more strategic. It makes them a really significant
and frankly, alarming new threat for organizations to watch. Okay. So we've covered who's attacking
how new players like the gentleman are emerging. But who are they actually going after? Let's dig into
the victim's sector, geography, company size. What's the data telling us there? The victim's sector data
shows a fairly consistent pattern. But with some interesting nuances, manufacturing technology,
still leading the pack. Surprise there. Not really given their IP and supply chain value. But interestingly,
construction has climbed up to third place this period. Instruction. It could be several reasons,
maybe less mature security postures, valuable project data, disruption potential. It's definitely
a sector to watch. Retail and financial services, they round out the top five, still consistently high
value targets. And geographically, you mentioned the US is still taking the broad. Oh yeah, heavily.
Over 53% of attacks still hit US-based organizations. Wow. But as we touched on, the really notable change
is seeing South Korea and India pop up in the top five victim locations for the first time. South
Korea is over 4%, India nearly 3%. This isn't just a minor blip. It really signifies a deliberate
expansion of targeting. Attackers are actively seeking out new territories or perhaps finding new
ways into these rapidly digitalizing economies. This raises a really important question, probably for
a lot of our listeners. Does the data show whether it's the big Fortune 500 companies or smaller
businesses suffering more? Who's actually feeling the most pain here? And the data on this is, well,
it's stark. There's no ambiguity. Small businesses. And they define that as 500 employees or less.
They account for a staggering 84.07% of all victims. 84%. 84%. Mid-market organizations, they're next
at nearly 14%. Large enterprises, a tiny fraction, just over 2%. That's incredible. It really underscores
that it's often the smaller organizations. The ones typically with fewer dedicated cybersecurity
resources, maybe less expertise. They're the ones bearing the overwhelming brunt of these attacks.
It's not about being too small to be noticed. It's often about being seen as, well, easier prey.
Okay, shifting gear slightly. Beyond the purely criminal gangs, the brief also gets into some
trending adversaries that sound a bit more cloak and dagger or now sophisticated, often state
sponsored actors. Can you shed some light on these threats? Absolutely. What's quite illuminating here
is the sort of resurgence or continued high activity of known APT groups, advanced persistent threats.
Right. Specifically, APT 29 and APT 28 may be better known as Kozy Bear and Fancy Bear.
Both Russian state-sponsored groups heavily involved in espionage. They're definitely active.
Still busy. Very. And APT 28, Fancy Bear has specifically been observed using a new Microsoft
Outlook Backdoor. They're calling it Not Door. A new Backdoor for Outlook, given how central email
is. That sounds particularly nasty. It's incredibly insidious. Yeah. Because Outlook is the
communication hub for countless organizations, government included. It's a potent tool for
intelligence gathering if you can get inside it undetected. Are other state-backed players making noise?
Oh, yes. Not to be outdone, the Chinese group, known as Mustang Panda, has been noted for its
exploits. Specifically, they targeted a Philippine military company in what looks like a focused
espionage campaign. And this group, Mustang Panda, also ties into some of the newer malware we're
seeing. Like the snake disc USB worm. Snake disc. Yeah. It works with another piece called the
Tone Shell Backdoor. And interestingly, snake disc apparently limits its execution just to
devices with Tylen-based IP addresses. Then it drops another payload, the Yokai Backdoor.
Wow. That's incredibly specific targeting geographically limited. Exactly. It demonstrates
meticulous planning, very clear strategic objectives. These aren't just random smash and grab attacks.
So definitely not opportunistic. These are well-resourced, carefully orchestrated campaigns.
What about white cobra? They were also mentioned. White cobra is another interesting one. They were
responsible for planting 24 malicious extensions across the Viscode and open VSX marketplaces.
Ah, targeting developers. Precisely. For anyone listening who works in development,
this highlights that growing threat to the software supply chain itself.
The tools, the components developers rely on every single day. Right. By compromising those
development environments, attackers can potentially inject malicious code into countless projects downstream.
It creates this huge ripple effect of vulnerabilities. It's like,
contaminating the flower before thousands of loaves of bread are baked. Yeah, that's a scary prospect.
Let's zero in now on some specific vulnerabilities and malware variants making waves right now.
One really caught my eye and involves a super popular messaging app. Pretty much everyone uses it.
Ah, you must be talking about CVE 2025 55177, the WhatsApp one. That's the one.
And it's frankly terrifying. It's a zero-click vulnerability effect in WhatsApp on both iOS and MacOS.
Zero-click. Explain that again. It means the attacker can trigger the vulnerability and potentially
execute code or process content from some arbitrary URL on your device without you doing anything.
No clicking a link, no opening a message, no interaction needed from the user at all.
And there's even evidence it's already being exploited out there in the wild.
Which raises that critical point again. Are you diligently keeping all your apps,
especially communication apps like WhatsApp, updated to the absolute latest version?
Because that's often your first line of defense. Zero-click is definitely nightmare fuel. It just
removes the user entirely from the equation. What other active and dangerous malware should we
be aware of from this report? Well, there's also BroQwell. It's an InfoSealers specifically going
after Android users. How does it spread? Attackers are being pretty clever, actually. They're using
Meta's ad platforms, Facebook, Instagram ads to trick people into installing fake versions of
the trading view app. Oh, the trading app. Okay. Yeah. Once you install the fake app, BroQwell gets
deployed. And it's designed to capture credentials, intercept your multifactor authentication codes,
text messages, and even try to drain cryptocurrency wallets if you have them.
Ouch. Any others. There's another Android banking Trojan called Raton. It's also quite sophisticated.
It combines RAT capabilities remote access Trojan with an NFC relay feature. NFC. Like Tap to
Pay. Sort of. It seems designed for crypto wallet account takeover and automating money transfers.
The report mentions it particularly targeting a specific bank's application in the Czech Republic.
Again, quite targeted. It really sounds like good old-fashioned social engineering, just
tricking users. It's still incredibly effective, even when paired with these advanced malware types.
Oh, absolutely. Social engineering never goes out of style, unfortunately.
Steele C is another textbook example mentioned. It's described as a very sophisticated campaign using
a convincing, multilingual phishing website. How does it usually start? Often with an email,
a very convincing one. Warning the victim that their Facebook account is at risk of suspension because
of some policy violation. It prays perfectly on that fear of losing access to your social media,
your online identity. Classic fear tactic. Exactly. And we're also seeing older threats being sort of
rebooted hybrid petia. Petia. Like the infamous wiper malware. A direct copy of the original petianop
petia wiper. Yeah. But it's been updated. Now it's capable of compromising UEFI-based systems.
UEFI. That's the basic boot up software on modern computers, right? That's right. The foundational
stuff that starts your computer before Windows or Mac OS even loads. And this new hybrid petia can
apparently bypass UEFI secure boot, at least on some older systems, using a specific vulnerability.
CVE 2024 7344. So they're reviving old destructive malware, but weaponizing it with new tricks to
hit deeper system levels. Precisely. Shows that attackers are constantly recycling and refining their
tools. Nothing ever truly goes away. Okay, let's turn to the top news headlines from this period.
It's pretty clear cyber threats aren't just hiding in the shadows. They are dominating public
discussion. What were some of the biggest stories that really reinforced what we've been talking
about that showcased this evolving landscape? The headlines really do vividly underscore this
acceleration, especially the role of AI and cybercrime now. AI. Yeah, that's popping up everywhere. We
saw reports of AI powered malware like this squangularity attack that apparently hit over 2,000 GitHub
accounts. And perhaps even more concerning, this tool called Hextrike AI is reportedly being used by
hackers to rapidly exploit in-day flaws. In-day, meaning flaws that are known, but maybe not widely
patched yet. Exactly. Vulnerabilities that have been discovered, maybe a patch is available, maybe not,
but systems haven't been updated yet. This tool uses AI to weaponize those known flaws in
incredibly quickly. It's not just AI assisting defense anymore. It's AI becoming a potent,
almost autonomous weapon for attackers. It dramatically increases the speed and scale of potential
compromises. That feels like a genuine game changer, fundamentally altering attack speed and scale.
And we also saw massive supply chain attacks making headlines, which ties back to what you said about
White Cobra earlier. Precisely. There is that story about hackers hijacking NPM packages. These are
widely used software components in web development packages that collectively get 2 billion weekly
downloads. 2 billion. Wow. Yeah. It just shows how compromising one single point in that software
ecosystem can have these incredibly widespread devastating effects downstream. Similarly,
there was the Ghost Action GitHub Supply Chain attack, which stole over 3,300 secrets, things like
API keys, passwords, again targeting the fundamental billing blocks of software development.
These attacks are so insidious because they leveraged the trust we place in the shared code repositories
and tools. And just to highlight the scale of other threats, CloudFlare reported blocking the
largest ever recorded DDoL-US attack during this period, 11.5 terabits per second. Terabits, that's
astronomical. It's hard to even comprehend that scale. It's enough traffic to basically cripple
internet access for a small country all aimed at one target. It just speaks to the sheer destructive
power these denial of service threats now wield. Wow. Okay. That was a truly expansive and maybe
slightly sobering look into a rapidly evolving digital world. We've covered vulnerable home devices,
state-sponsored espionage, the alarming rise of AI and cybercrime. The landscape is incredibly
dynamic. So for you, our listener tuning in, what's the most critical takeaway from this deep dive
into the bar nickels threat brief? You know, if you zoom out what this brief really highlights, I think,
is the relentless broadening of the threat landscape. It's just not enough anymore to focus solely
on securing, say, corporate networks. We have to be thinking critically about securing our
personal devices, understanding the increasing sophistication of social engineering, recognizing
the systemic risk that comes from these supply chain attacks. And the fact that small businesses
are overwhelmingly targeted, combined with the common neglect of consumer grade devices,
like routers, that really pinpoints where many of the most significant yet often overlooked
risks actually reside. It's where individual awareness can genuinely make a difference.
So what does this all mean for you? Just navigating your own digital life day to day. It really
means proactive awareness is your absolute best defense. It really is. Keep those devices updated.
Your phone, your laptop, your router, keep the apps updated too. Seriously, consider replacing
any hardware that you know has reached end of life, especially network gear. Don't just leave it
plugged in. Exactly. And always, always, apply that healthy dose of skepticism to unexpected emails,
messages, pop-ups, especially anything designed to create urgency or fear. Question at first.
And maybe just for a final provocative thought to leave people with. Go for it.
Given this increasing sophistication we see, AI-powered threats, state-sponsored actors,
and this widespread targeting of consumer devices that are often vulnerable because they're
end of life. How much ethical or even practical responsibility should a hardware and software
vendors actually bear for the long-term security of those products, especially when they continue
to operate in our interconnect world and become easy entry points for attackers long after the
official support ends. That's a really good question. Where does that responsibility truly lie?
Something to ponder, I think, as we all continue trying to build and secure our digital future.
Reach out to us at jbuyer.com for comments and questions. Follow us at buyer company on social media,
and if you'd be so kind, please rate and review us in your podcast app.