Archive for May 21, 2025

2,300 Domains Seized in Lumma Infostealer Disruption

Posted in Commentary with tags on May 21, 2025 by itnerd

Microsoft’s Digital Crimes Unit facilitated the takedown, suspension, and blocking of about 2,300 malicious domains that formed the infrastructure backbone of Lumma Stealer, an info-stealing malware used by hundreds of cyber threat actors to steal passwords, credit cards, bank accounts, and cryptocurrency wallets. Lumma Stealer has also enabled criminals to hold schools for ransom, empty bank accounts, and disrupt critical services.

Microsoft has a blog post on this here: https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/

Ensar Seker, CISO at SOCRadar, commented:

“The coordinated takedown of Lumma Stealer’s infrastructure marks a pivotal moment in combating the proliferation of Malware-as-a-Service (MaaS) platforms. Lumma Stealer, also known as LummaC2, has been a formidable tool in the cybercriminal arsenal, facilitating the theft of sensitive data including credentials, financial information, and cryptocurrency wallets from nearly 400,000 Windows systems globally between March and May 2025.

“This operation, led by Microsoft’s Digital Crimes Unit in collaboration with international law enforcement agencies, successfully seized over 2,300 domains integral to Lumma’s operations and dismantled its command-and-control infrastructure . Such actions not only disrupt the immediate threat but also send a clear message to cybercriminals about the increasing capabilities and resolve of global cybersecurity alliances. However, the resilience of such malware underscores the necessity for continuous vigilance. Lumma’s ability to adapt employing phishing, malvertising, and exploiting trusted platforms highlights the evolving tactics of threat actors.

“While this takedown is a commendable achievement, it also serves as a reminder of the persistent and evolving nature of cyber threats. Ongoing collaboration between private sector entities and international law enforcement is essential to stay ahead.”

Takedowns are nice. But sometimes they’re a game of “whack a mole” where the threat actors pop up someplace else. Which is why these sorts of efforts need to be ongoing and not a one time thing.

Ivanti vulnerabilities being actively chained in the wild

Posted in Commentary with tags on May 21, 2025 by itnerd

Wiz researchers report that two recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities—CVE-2025-4427 and CVE-2025-4428—are being actively chained in the wild to achieve unauthenticated remote code execution (RCE). The first flaw is an authentication bypass stemming from misconfigured Spring framework routing, while the second involves unsafe handling of Java Expression Language in error messages, allowing arbitrary code execution. Although each vulnerability is individually rated medium severity, their combination creates a critical exploitation path. Attackers are deploying Sliver beacons to known malicious infrastructure also used against Palo Alto PAN-OS products, suggesting targeted, opportunistic exploitation across vulnerable platforms. Ivanti issued patches on May 13, but organizations not filtering access to the affected APIs remain at elevated risk.

Wade Ellery, Field CTO, Radiant Logic had this to say:

“This is a textbook example of how low-to-moderate vulnerabilities can escalate into high-impact breaches when chained together. It’s also a reminder that the complexity and interdependencies throughout today’s IT infrastructure creates almost continuous opportunities for attack.  Given these vulnerabilities it is even more critical that the last line of defense to a breach, the identity first security layer, be as fortified as possible. Identity observability provides a 360 degree view and active management of identity data attack vectors when proactively deployed and maintained.  As attackers continue to innovate, but without the ability to compromise account access their impact is severely blunted.”

This underscores the need to “patch all the things” the moment that patches for something become available as threat actors will simply do what’s illustrated here. Which isn’t good if you haven’t patched all your gear.

Today’s Outage Was Caused By A Bell Software Update

Posted in Commentary with tags on May 21, 2025 by itnerd

Well, today was an eventful day. After people in Ontario and Quebec lost Internet access just after 9AM EST, but got it back just after 10AM EST or later, there were questions as to what happened. To my surprise, Bell who seemed to bear the brunt of this outage actually admitted what happened on Twitter:

To be completely frank, I am shocked that Bell is being this transparent about what happened as I have never seen this level of detail from Bell before. Maybe they’re doing this to head off what happened to Rogers when they had that outage that pretty much took the entire country down a few years ago. Which is that there were a lot of inquiries, investigations and government interventions that must have made Rogers feel that they were having a proctology exam. Now to be clear, today’s outage wasn’t nearly as bad as the Rogers outage, but it was far from good. Hopefully Bell learns the lessons from this and doesn’t repeat history anytime soon if ever.

Hyper Launches Unique Tool-Free Cable Lock Designed to Secure MacBook Pro Laptops

Posted in Commentary with tags on May 21, 2025 by itnerd

HYPER today announced the launch of its HyperShield® MacBook Pro Cable Lock, a tool-less cable lock designed exclusively for 14” and 16” MacBook Pro models.  

The HyperShield Cable Lock offers a simple, hassle-free installation process—attaching directly to the MacBook Pro’s air vent without any tools, adhesives, or screws needed, making it extremely functional and easy-to-use. Its sleek design combined with robust security features enable MacBook Pro users to protect their devices in shared workspaces or on the go. 

Smart Security for Professionals on the Go 

The HyperShield MacBook Pro Cable Lock introduces a new standard in device security by offering the following key features: 

  • Tool-less Design for MacBook Pro – Install in seconds by attaching the lock directly to the MacBook Pro air vent, preserving its minimalist aesthetic.
  • Full Port Accessibility – Unlike traditional locks, this innovative solution keeps all USB-C ports unobstructed, allowing users to charge their devices and connect peripherals effortlessly.
  • Durable Galvanized Steel Cable – The 6.5ft cut-resistant cable ensures reliable protection and secures the MacBook Pro to a variety of anchor points.
  • Lightweight, Portable Design – Compact enough to fit in a bag, the HyperShield lock is perfect for remote workers, professionals, and students on the move.
  • Peace of Mind with Secure Key Locking – Each lock comes with two keys, delivering an added layer of reassurance for users in busy, shared environments. The HyperShield Cable Lock is a versatile security solution, ideal for protecting your MacBook Pro in coffee shops, libraries, co-working spaces, offices, and even classrooms. It’s compatible with all M1, M2, M3, and M4 14” and 16” MacBook Pro models.
  • Tested Tough – A rigorous test of 2,500 lid open/close cycles—representing over two years of daily use—showed no visible impact on the MacBook Pro’s display or hinge, with the silicone sleeve preventing scratches and pressure marks.
    * Test results are based on internal testing under controlled conditions. Actual performance may vary.  

Security Solution for Remote Workers, Professionals, and Students 

The HyperShield Cable Lock caters to the needs of modern users who demand portability, security, and reliability, such as remote workers securing their workspace in a bustling coffee shop, professionals who need to protect data and devices in open offices, or students safeguarding their laptop on campus. 

Pricing and Availability 

The HyperShield MacBook Pro Cable Lock is now available for sale starting today at $59.99 on Hypershop.com and through select retailers. 

US Network Administrator Salary & Employment Study – How Much Does a Network Admin Make by State?

Posted in Commentary with tags on May 21, 2025 by itnerd

Today, Comparitech researchers released a study looking into the salary and employment statistics of network administrators across the US. 

Since a network administrator plays a crucial role in ensuring the smooth and efficient operation of an organization’s IT infrastructure, it is interesting to see that the number of people is set to decline by -3 percent in the next 10 years. 

Average US-wide changes include:

  • Average annual salary for network administrators increased by 0.6 percent from $100,580 (2023) to $101,190 (2024)
  • # of people in network administrators roles decreased by 0.3 percent from 322,500 (2023) to 321,580 (2024)
  • Employment per 1,000 people (the number of jobs in the given occupation per 1,000 jobs in the given area) decreased by over 8 percent from 2.22 (2022) to 2.04 (2024)
  • # of vacancies available decreased by 24.5 percent from 7,354 (2022) to 5,552 (2025)
  • 10-year growth projection for roles decreased from 3 percent for 2021-2031 to -3 percent for 2023-2033 (according to the latest BLS data)

For full details, including a breakdown of the differences of the network administration role across the United States, please see the study here: https://www.comparitech.com/net-admin/us-network-administrator-salary-employment-study/

BREAKING: Massive Outage Takes Out Numerous ISPs And Apps In Canada [UPDATE: Resolved]

Posted in Commentary with tags on May 21, 2025 by itnerd

About 45 minutes ago I started getting calls from numerous clients about not being able to get email or surf the Internet. On top of that my wife texted me to say that our Internet was out. I knew that wasn’t a good sign and a quick look at Down Detector confirmed what I was thinking:

Clearly numerous ISP’s including Rogers, Cogeco, Bell, Ebox, and Distributel have issues at the moment. On top of that, I note that Scotiabank is down as well. From what I can tell this outage covers the Greater Toronto Area and beyond. And clearly Bell and related companies are affect more than others. I’ll be keeping an eye on this as clearly this is very serious and wide spread.

UPDATE: This outage apparently covers Ontario and Quebec. So this is big.

UPDATE #2: This outage seems to be resolved as of roughly 10AM EST.

Pay-i lands $4.9M to answer the question every enterprise is asking: Does this GenAI investment have actual ROI?

Posted in Commentary with tags on May 21, 2025 by itnerd

Enterprise spending on GenAI is surging, but clear proof of ROI remains elusive. Most companies can’t answer the simplest question boards are now asking: is this actually working? Pay-i, a new value-intelligence platform for GenAI, is coming out of stealth today with $4.9 million in seed funding to solve that. The round was co-led by Fuse Partners and Tola Capital, with participation from Firestreak, Pear VC, Gaia Capital, and angel investors from Fortune 100 companies.

Today, most teams still measure success of their AI initiatives in token counts or latency – metrics that don’t capture business value or justify costs. Pay-i gives product, finance, and engineering leaders a real-time dashboard that links every model call, prompt, and token to measurable business outcomes for specific use cases, like revenue growth, task completion time, or CSAT uplift. Users can assign explicit dollar or time values to KPIs, compare multiple versions of a use case, and instantly see which model, agent, or prompt delivers the strongest return. A built-in forecasting engine then projects those returns forward – so companies can prioritize what works, sunset what doesn’t, and scale GenAI with confidence before it even goes into production. 

The product is already being used by enterprise teams to assign hard dollar values to GenAI-enhanced features – like customer support copilots or AI-generated reports – then A/B test different agents or prompts in production. Pay-i tracks how each change impacts task completion time, revenue conversion, or KPIs like CSAT – and forecasts the business impact before full rollout.

The product reflects what they learned working with the largest cloud buyers in the world: traditional cost tooling stops at usage, while real decision-making happens where cost meets value. That’s especially true in GenAI, where token-based billing, multimodal inputs, reasoning models, and agentic workflows have made unit economics opaque and ROI harder to track than ever.

The need for clarity is only growing. IDC projects enterprise GenAI investment will top $632 billion by 2028, but 72% of CIOs cite ROI measurement and forecasting as their #1 blocker. 

With the new funding, Pay-i will accelerate product development, and bring its platform to more enterprise teams looking to scale GenAI with precision. Already live with early customers, Pay-i is now generally available across all major cloud providers and models – offering decision-makers a long-overdue solution to the GenAI value gap. Pay-i and AWS ProServe are providing a customer solution that combines AWS ProServe’s expertise consulting customers on value tracking with Pay-i’s software to instrument GenAI value metrics. Pay-i is deployed to customers on AWS and can instrument Bedrock workloads. 

Kettering Health Pwned In Ransomware Attack

Posted in Commentary with tags on May 21, 2025 by itnerd

A ransomware attack on Kettering Health, a network of 14 medical centers in Ohio, has caused a system-wide technology outage, forcing the cancellation of elective inpatient and outpatient procedures. While emergency rooms remain operational, the incident has disrupted operations across the network and prompted a scramble to contain the damage. The ransomware note, attributed to the Interlock gang, threatens to leak sensitive data unless a ransom is paid. This is part of a wider trend: in 2023, the healthcare sector led all critical infrastructure sectors in reported ransomware incidents, reflecting persistent cybersecurity vulnerabilities. Similar attacks on Ascension and UnitedHealth Group have recently demonstrated the direct patient impact of such breaches.

Debbie Gordon, CEO and Founder, Cloud Range:

“We keep seeing healthcare systems pushed to the brink—not by medical emergencies, but by cyberattacks that disable basic operations. The Kettering Health attack is yet another example of why tabletop exercises and simulation-based training  programs are essential. Responding to ransomware is not only about technology; it’s about people knowing what to do when systems go down. Clinical staff, IT teams, and executives all need to rehearse how to operate effectively under pressure. The faster we normalize this kind of preparedness, the more resilient our healthcare infrastructure will become.”

Gunter Ollmann, CTO, Cobalt follows with this:

“The healthcare sector continues to be disproportionately targeted by ransomware groups because it presents a high-pressure environment where disruption can immediately impact patient lives. This urgency increases the likelihood of ransom payment, making hospitals prime targets for attackers looking for quick returns. But these incidents are more than just criminal opportunism—they’re warning shots for what cyber warfare could look like. The same vulnerabilities being exploited now would be leveraged in future geopolitical conflicts to destabilize critical infrastructure. Offensive security gives us the ability to simulate these high-stakes scenarios and uncover weak points before the stakes become national.”

This incident underlines how vulnerable the health care sector is to cybercrime. I’ve said it before and I will say it again. Urgent action needs to be taken to make this sector less of a target.

UPDATE: I have additional commentary starting with Rebecca Moody, Head of Data Research at Comparitech

“This attack has been linked to the ransomware gang Interlock. Since it first emerged back in October 2024, we’ve tracked 16 confirmed attacks via this group, while a further 17 remain unconfirmed by the victims involved. Today, Interlock also came forward to claim a large-scale attack on West Lothian Council, UK, which has been disrupting its school network for over a week.”

“Four of Interlock’s confirmed attacks are on healthcare organizations in the US. It was also confirmed as the gang involved in the attack on kidney dialysis company, DaVita, in April 2025, and the 2024 attacks on Brockton Neighborhood Health Center (which led to 97,488 people having their data breached) and Drug and Alcohol Treatment Service, Inc. (which impacted 22,215 people). Interlock was also behind the huge data breach on Texas Tech University Health Sciences Center, which involved nearly 1.5 million records.”

“So far this year, we’ve tracked 24 confirmed attacks on US healthcare companies in total, with nearly 1.6 million records breached across these attacks. While this attack on Kettering Health is in its early stages, it’s highly likely Interlock will have stolen data and will release this if its ransom demands aren’t met.”

Erich Kron, Security Awareness Advocate at KnowBe4 had this to say: 

“Sadly, the organizations that are charged with ensuring our health and safety are often the biggest targets of ransomware actors due to the sensitive information they collect and the time sensitive nature of their mission. This sensitivity to time gives the cybercriminals significant leverage when attempting to collect a ransom from organizations that have been left in a severely limited condition, or in some cases unable to provide services at all. While in this case it seems that only elective surgeries are being rescheduled, that doesn’t mean that the patients waiting for these surgeries are not uncomfortable or having issues.”

“Sometimes these procedures must be scheduled months in advance to find an available time on the schedule, especially in cases such as this where the organization is a nonprofit and is likely quite busy. This means that even though rescheduling is an option, it may push back their procedure by weeks or maybe even months.”

“In addition to the issues related to the inability to provide services, health care is a heavily regulated industry, and most ransomware actors will steal a copy of the most sensitive data they can get a hold of and threaten the organization with potentially leaking this information. Not only do the patients have to reschedule their procedures, but information such as their Social Security numbers, medical history, and other sensitive things are at risk of being dumped on the internet, making them more susceptible to future attacks from cybercriminals and possibly revealing embarrassing medical issues. There are also significant fines that may be leveraged by regulatory committees for the exposure of data in health care organizations.”

“Since most ransomware is spread through social engineering, such as email phishing or text message phishing, organizations in the healthcare industry especially need to ensure that they have a robust human risk management (HRM) in place, that data is being kept from leaving the network through data loss prevention (DLP) controls, and that they have backups that are tested on a regular basis, and kept off site or in an immutable state period.”

Additionally, Comparitech researchers today published a blog reporting another healthcare breach — this one a Montana hospital breach now confirmed to have compromised patient names, SSNs, DOBs, ID numbers, financial information, and more. This breach was claimed by ransomware gang Meow. For full details, please see here: https://www.comparitech.com/news/montana-hospital-data-breach-leaks-ssns-medical-and-financial-info/

UPDATE #2: Ensar Seker, CISO at SOCRadar adds this comment:

“The ransomware attack on Kettering Health is yet another stark reminder that cyberattacks in healthcare are no longer just data breaches. They are public health emergencies. When a system-wide outage results in canceled procedures and disrupted emergency operations, the consequences extend far beyond the digital domain and directly impact patient outcomes.”

“Healthcare systems like Kettering operate highly complex, interconnected environments with legacy infrastructure, fragmented security oversight, and tight operational margins. This makes them prime targets for ransomware groups, who know that the urgency of patient care often leads to faster ransom payments and less resistance. Disruption to electronic health records, scheduling, communications, and diagnostics can paralyze clinical operations, leading to delayed care, misdiagnoses, and even loss of life in worst-case scenarios.”

“This incident also reflects a growing trend. Threat actors are targeting not just data, but availability. The aim is to inflict operational chaos, knowing that healthcare providers must act fast. The fact that Kettering was forced to cancel both inpatient and outpatient procedures indicates a deep-level compromise of core infrastructure, not just a containment effort at the perimeter.”

“Hospitals must prioritize segmentation of critical systems, implement ransomware-specific playbooks, and invest in 24/7 threat detection tied to real-time operational impact assessments. Moreover, this reinforces the need for industry-wide collaboration, sharing IOCs, TTPs, and breach intel in real time to help other healthcare organizations stay ahead of similar attacks.”

“Ultimately, we need to treat ransomware in healthcare as a patient safety issue first, cybersecurity issue second. As long as these attacks continue to disable essential care services, they must be met with the same urgency as any other emergency affecting human lives.”

Libyan Consulate exposes hundreds of passport applications 

Posted in Commentary with tags on May 21, 2025 by itnerd

The Cybernews research team discovered that the Libyan Consulate in Stockholm left an unprotected instance accessible to the public with nearly 550 filled-in passport applications.

What data was revealed?

  • Full names
  • Dates of birth
  • Email addresses
  • Parental details

To read the full research, please click here.