Cybersecurity today would like to thank Meter for their support in bringing you
This podcast Meter delivers a complete networking stack, wired, wireless and
cellular in one integrated solution that's built for performance and scale.
You can find them at meter.com/cst.
Elite iOS exploit Kit Coruna goes mass market FBI wiretapping tools, again
hacked by Chinese linked threat actors.
Microsoft says attackers have a new click fix trick with Windows terminal.
AWS data centers in the Middle East, targeted in ongoing war
and Iranian hackers becoming increasingly active and skilled.
This is cybersecurity today, and I'm your host, David Shipley.
Let's get started.
A new and highly sophisticated iOS exploit kit dubbed Coruna has been uncovered
in a series of targeted cyber attacks.
Originally reported by Bleeping Computer.
This spyware grade toolkit has been used in both espionage and
financially motivated attacks, marking a troubling shift in how
these tools are being deployed.
The Coruna exploit kit contains 23 separate iOS exploits, including five
complete exploit chains that leverage advanced non-public techniques to
bypass security protections in iOS versions, ranging from 13 to 17.2 0.1.
Essentially covering devices running software released from 2019 to late 2023.
Google's threat Intelligence Group or GTIG first detected the Coruna kit
in February, 2025, initially spotting its use by a surveillance vendor's
client in a highly targeted operation.
However, the toolkit has since spread and by late 2025, it appeared on malicious
websites linked to cryptocurrency scams.
GTIG attributed this activity to a financially motivated Chinese
threat group known as UNC 66 91.
The Coruna kit is capable of selecting specific exploit chains
based on the target devices, iOS version, allowing attackers to
take advantage of vulnerabilities in WebKit bypass security measures
like pointer, authentication code,
and escalate privileges to gain deeper control of affected devices.
Notably, the kit was also found to stop its activity.
If Apple's lockdown mode or private browsing features were enabled.
An important reminder of how valuable these protections can be.
One particularly alarming aspect of the Corona kit is its final payload,
a stager loader called plasma loader tracked as plasma grid, which targets
popular cryptocurrency wallet apps like Meta Mask, Phantom and Uni swap.
The malware attempts to steal critical data such as wallet recovery phrases
and sensitive account information by luring victims to fake finance
and cryptocurrency websites.
According to GTIG researchers, stolen data is encrypted and sent to
command and control servers, which use a domain generation algorithm for
resilience against take down attempts.
While the exact circumstances of Coruna's proliferation remain unclear,
experts believe it represents a broader trend of advanced spyware tools once
used nearly exclusively by nation states and surveillance vendors.
Falling into the hands of cyber criminals, mobile security
firm, I verify, called Coruna.
A quote, clear example, end quote of how sophisticated capabilities once
reserved for high value targets, like government officials are now being
weaponized against everyday people.
This evolution in the mobile threat landscape highlights why staying
vigilant about software updates and enabling features like lockdown
mode is more critical than ever.
The FBI is currently investigating a potential cybersecurity breach involving
one of its most important internal platforms, raising concerns about threats
to sensitive law enforcement data.
The incident, which occurred in February, centered around the
FBI's digital Collection System Network reports the record.
The system supports wiretaps, pen register, surveillance tools,
and other intelligence gathering mechanisms used for criminal and
national security investigations.
The breach was reportedly discovered on February 17th when irregular
network activity was detected.
In a statement to the record, an FBI spokesperson confirmed that
they had identified and addressed suspicious activities on FBI
networks and had leveraged all technical capabilities to respond.
Uh.
The investigation has now expanded to include the White House, the
Department of Homeland Security, and the National Security Agency.
While the affected system is described as unclassified, it
does store sensitive information related to ongoing investigations
and surveillance operations.
According to a letter sent to Congress, the attackers may have
gained access via an internet service provider used as a vendor by the FBI.
This raises significant concerns about the security of third party vendors
and the potential vulnerabilities they introduce into these critical national
security and law enforcement systems.
This breach is the latest in a series of cyber attacks
targeting US federal agencies.
In 2024, Chinese state sponsored hackers connected to the Salt
Typhoon operation were discovered to have breach systems used by US law
enforcement agencies for wiretaps.
More recently, the US Marshal Service and federal court systems have also
fallen victim to cyber attacks, including ransomware and other data breaches.
While few details of the February incident have been disclosed, it underscores the
importance of securing critical systems and vendor relationships against both
nation state hackers and cyber criminals.
The FBI's efforts to contain and investigate this breach, highlight
the ongoing challenges agencies face in protecting sensitive information
and systems against increasingly persistent and sophisticated adversaries.
This story also highlights why so many cybersecurity and privacy advocate.
Push back regularly against any notion of a government back doors into encryption
services used by the regular public.
As such, capabilities can be abused and even more worrisome, hijacked by
these very same hostile nation states or potentially by criminal groups.
Microsoft has revealed details of a new twist on the sophisticated Click
Fix social engineering campaign.
This time, criminals are exploiting the Windows Terminal app as part
of an elaborate attack chain to deploy the Luma Steeler malware.
The campaign first observed in February, 2026 underscores how
attackers are leveraging legitimate tools to bypass security defenses
and compromise unsuspecting users.
Instead of relying on the traditional method of tricking users into pasting
malicious commands into the Windows Run dialogue box, the attackers
employed an interesting evolution.
They instructed targets to instead use the Windows plus x plus I shortcut
to launch the Windows Terminal app.
WT exe a program often used by IT professionals for administrative tasks.
This strategy made the attack me appear more legitimate and bypassed
some existing detections designed to flag suspicious run dialogue abuse.
Once users opened Windows terminal and pasted a specially crafted hex
encoded X or compressed command from a click fix lure page, the attack began.
The command spawned additional terminal and PowerShell instances,
ultimately invoking a PowerShell process to decode the malicious script.
From there, the attack unfolded in the usual stages.
Number one, a zip payload and a renamed seven zip binary were
downloaded with the binary, extracting the zip files, contents.
Additional payloads were then retrieved, and persistence was
established using scheduled tasks.
Microsoft Defender exclusions were configured to evade detection.
Machine and network data were then exfiltrated and the Luma Steeler
malware was deployed by injecting malicious code into Chrome XE and
Ms. Edge XE processes, allowing the attackers to harvest sensitive browser
data, such as save credentials.
A second attack pathway was also detected involving the use of a
batch script to write and execute a visual basic script via MS. Build xe.
This method abused living off the land binaries.
To further evade detection.
The campaign also incorporated techniques like connecting to crypto
blockchain RPC endpoints and leveraging ether hiding for further obfuscation.
The Luma Steeler malware targeted high value browser artifacts,
including stored login credentials and exfiltrated the stolen informations
to attacker controlled infrastructure.
This campaign demonstrates the increased use of legitimate tools by threat actors
to execute complex attacks while evading traditional detection mechanisms.
These kinds of attacks also don't look like the kinds of
phishing that many people have been trained on for many years.
By asking people to validate that they're human or fix a problem,
they can get users to execute these commands with surprising effectiveness.
And now we turn to cyber related coverage for the ongoing Iran war.
Iranian State-sponsored hacking group.
Muddy Water, also known as seed Worm, has been linked to a series
of sophisticated cyber attacks targeting US and Israeli networks.
According to new research from Broadcom Semantic and Carbon Black threat
hunting teams, the group affiliated with Iran's Ministry of Intelligence
and security has been observed infiltrating networks of US banks,
airports, nonprofit organizations, and the Israeli branch of a software company.
The campaign, which reportedly began in early February has escalated
in the wake of the recent US and Israeli military strikes on Iran.
Muddy Water is using new tools in these attacks, including a previously
unknown backdoor dubbed din door, which relies on the Dino JavaScript runtime.
Additionally, a Python based backdoor called fake set has been identified on the
networks of a US airport and a nonprofit downloaded from servers belonging to
the American Cloud Storage Company.
Backblaze.
Notably, these attacks highlight advanced tactics such as leveraging
cloud storage services like Wasabi and Backblaze for data exfiltration.
Symantec and Carbon Black researchers noted that digital certificates
used in these attacks have also been linked to other Muddy Water malware
families, reinforcing the attribution to the Iranian state sponsored group.
This latest revelation is part of a broader wave of cyber attacks
tied to the ongoing Middle East.
In recent months, Iranian link groups and their proxies have ramped up offensive
cyber operations targeting critical infrastructure in Gulf States like the
UAE, Qatar and Bahrain, as well as Israel.
Here's a quick recap of known recent activity first wiper campaigns in Israel.
Multiple wiper malware campaigns have been launched against Israeli energy,
financial government, and utility sectors.
Iran's wiper arsenal includes over 15 malware families, such as
Zero, Clear Meteor and Dust Man.
Second surveillance system exploits Iranian aligned threat actors
have increased their targeting of vulnerable surveillance cameras
in Israel and in Gulf nations.
These attacks are suspected to assist military operations and
even in missile and drone targeting according to checkpoint researchers.
And that makes sense.
This is the exact same playbook that Israel and the United States used
in the targeted killing of Iran's supreme leader by hacking into
Tehran's traffic camera network.
It's not just Iranian activists and other nation state folks getting involved.
pro-Russian linked activists are also ramping up in support of Iran.
Groups like ELA Hack and 3 1 3 Team have targeted industrial control systems and
government portals in the Middle East.
Meanwhile, Z Pen test, a pro-Russian hacktivist group have claimed
responsibility for compromising US-based.
ICS SCADA systems and CCTV networks during Operation Epic Fury.
This news comes amidst other news reports that Russia is
providing Iran with targeting information to help in its efforts.
Experts warn that these developments illustrate the growing maturity
of Iran's cyber capabilities.
Rather than relying on cutting edge zero day exploits, Iranian operators are
employing repeatable, proven tactics like credential theft, social engineering, and
exploitation of known vulnerabilities.
The focus for them right now is maintaining persistence in enterprise
environments and leveraging cloud infrastructure as part of their
operations as the Middle East remains a geopolitical flashpoint.
Folks like the Canadian Center for Cybersecurity and others, including CISA,
have issued advisories and warnings about the Iranian threat on the cyber front, and
warning that it may increasingly target critical infrastructure in retaliation
for the ongoing military action.
Organizations are urged to adopt a proactive stance in
their cybersecurity strategies.
That includes strengthening monitoring capabilities where possible
limiting exposure to the internet, and restricting remote access to
operational technology, OT systems, particularly, um, any of these vulnerable
CCTV, , IP camera connected systems.
Implementing phishing resistant multifactor authentication, segmenting
networks, and maintaining good validated backups, and regularly
updating applications including firewalls and other edge devices.
In the words of Adam Meyers, head of Counter Advisory operations at
CrowdStrike, quote, Western organizations should continue to remain on a high
alert for potential cyber responses.
As the conflict continues, activity may escalate beyond hacktivism
into more destructive operations.
On that note, last week, Iranian drones struck three Amazon Web Services
data centers located in the United Arab Emirates and Bahrain sparking
global online service outages.
As reported by Futurism, the attacks have drawn significant concern as they mark
what experts believe to be the first time American Big tech infrastructure has been
directly targeted in a military operation.
According to Amazon, the strikes caused significant damage to their
infrastructure, disrupting power delivery, and even triggering
fire suppression systems that resulted in further water damage.
Iranian state affiliated media claimed that Microsoft facilities were also
targeted, though no disruptions have been reported by Microsoft to date.
The attacks highlight the growing risks faced by data centers, which are
increasingly being recognized as critical infrastructure on the modern battlefield.
The Middle East has become a hotspot for US.
Hyperscalers companies like Amazon, Microsoft, and Google operate large scale
cloud computing platforms in the region.
This growing presence puts American assets in the region at greater risk.
Patrick Murphy, executive Director of the Geopolitical Unit at Hilco Global
pointed out that the attacks represent a shift in focus for Iran and its proxies.
Historically, oil fields were the primary target in the region, but now
these strikes demonstrate that these data centers are viewed as equally
important to their respective countries and maybe potentially more vulnerable.
Experts warn that fortifying data centers against attacks could prove challenging
as vital components like turbines, air conditioning units, and other
exposed systems can be easily targeted.
The incident also underscores the growing importance of data centers in
the global economy, particularly with the rise of artificial intelligence.
Companies like OpenAI and Nvidia are investing heavily in the Middle
East, driven by the increased demand for computing power required
to support advanced AI systems.
However, as these facilities become more critical, they also
become more valuable to hit.
Amazon has acknowledged the risks posed by the ongoing geopolitical
instability in the region, and has urged clients to migrate workloads outta
the Middle East to other AWS regions.
As a precaution, the company stated that the broader operating
environment in the Middle East remains unpredictable and it is working
to restore the damage facilities.
The incident serves as a stark reminder that as technology evolves, so too,
does the nature of modern warfare data centers once seen as mere enablers
of the digital economy are emerging as strategic national assets that
require the same level of protection as traditional critical infrastructure
like energy and water systems.
We covered the opening cyber impacts tied to the Iran War in Saturday's Month.
In Review panel discussion, it's well worth a listen if you're
following the conflict and the evolution of cyber warfare.
That's cybersecurity today for Monday, March 9th, 2026.
I've been your host, David Shipley.
Thanks for listening and thanks for your continued support.
Please keep leaving reviews, ratings, and sharing the show with others.
We'd love to continue to reach even more people, and we need your help.
To the listener who left the recent review, complimenting
my pronunciation of Venezuela's State owned Oil Company, Pedevesa.
Thank you and thank you for the tip on improving how I pronounce Caracas.
Thanks so much.
Have a wonderful week.
Stay safe.
Saturday morning.
And finally, we'd like to thank our sponsor meter for their support
in bringing you this podcast Meter delivers full stack networking
infrastructure, wired, wireless and cellular to leading enterprises.
Working with their partners, meter designs, deploys and manages everything
required to get performant, reliable and secure connectivity in a space
they design the hardware, the firmware.
Build the software, manage deployments, and run support.
It's a single integrated solution that scales from branch offices
to warehouses to large campuses, all the way to data centers.
Book a demo at meter.com/cst.
That's METE r.com/cst.
I'm your host, Jim Love.
Thanks for listening.