All Episodes

August 19, 2025 13 mins

This cybersecurity threat brief provides an overview of various threats observed between August 1st and August 15th, 2025. It highlights that small businesses are disproportionately affected by cyber breaches, facing significant risk to their survival. The report details top ransomware variants, with Qilin and Akira leading, and identifies key victim sectors like manufacturing and financial services, primarily in the USA. Additionally, it brings attention to trending adversaries such as the Russian-linked Curly COMrades, lists actively exploited vulnerabilities including a critical Microsoft Exchange flaw, and notes emerging malware strains. The brief concludes with a summary of top cybersecurity news, featuring major zero-day exploits and significant law enforcement actions.

Mark as Played
Transcript

Episode Transcript

Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
Welcome back to Digital Rage. I'm Jeff the producer here at Byer Company. This is the third

(00:06):
Byer-Nichols Cybersecurity Brief episode. In the first half of August we are seeing an uptick in threats
and an overwhelming number of small businesses in the USA are being attacked. This report data is
collected and sent to us by Jeremy Nichols, the former director of the Global Threat Intelligence
Center. Executive summaries and threat actor bios are provided by Cybersecurity expert Geoff

(00:28):
Remitt, lots of data in this one so let's get going. Welcome to the Deep Dive. In the digital world,
this battle between defenders and attackers, it's not just constant is it. It feels like it's always
evolving, always accelerating. It really is a never ending race basically. Patching, predicting,
trying to stay one step ahead of whatever's next. Exactly. So today we're doing a crucial deep dive.

(00:52):
We're looking at the latest cybersecurity landscape specifically for the first half of August 2025.
Our mission really is to cut through the noise of the buyer Nichols Cybersecurity Threat Brief.
We want to pull out the most important insights, maybe some surprising facts, and definitely some
actionable knowledge for youth listener. Okay, let's unpack this. Yeah, it's been a, well, a pretty

(01:14):
active couple of weeks and this brief it gives a remarkably clear picture of where threats aren't
just lurking but are actively getting worse. That's a good way to put it, actively getting worse.
And the thing that really jumps out right from the executive summary, it almost stops you in your
tracks. This number roughly 84% 84% of all breach victims are small businesses. I mean, you think

(01:36):
about small businesses. They're the backbone, right? Like half of global employment, maybe 44% of USGDP,
that number feels well pretty bleak. It absolutely does. And what's particularly worrying about that
figure is why it's so high. You know, small and medium-sized businesses, SMBs, they often lag. They're
just not where larger enterprises are with security posture, with capabilities. You don't have the

(02:01):
huge IT teams or the massive budget. Exactly. They simply don't have the cash for the really advanced
stuff. And here's the kicker. Unlike a big corporation, a major cyber attack, it's far more likely
to just shut an SMB down for good. Wow. The report is very clear on this. They're survival. I mean,
it really hinges on taking cyber risks seriously. Okay. So if small businesses are getting hit the most,

(02:23):
where is this happening geographically? Which sectors? Look at the victim sectors.
Manufacturing financial services seem to be leading both saw increases. Manufacturing is just over 16.5%.
Financial services are really close, like 16.1%. Construction is still up there, run 13.4%
and retail about 11%. Though interestingly, they're sure actually dropped a bit.

(02:45):
Yeah. Slight decrease for those two and for tech as well. Right. Technology sucked up two down to
just over 8.2%. And then geographically, still the US leading by a mile.
Oh, yeah. The USA continues to dominate almost 57.5% of victim locations. And that's an increase
from before. Then you've got the UK just over 6.2%. Germany around 5.1%. They saw increases too.

(03:09):
Right. Italy's around 4.3% Canada about 3.1% rounding out the top five.
But what does this pattern tell us? I mean, where cyber criminals really focusing their efforts and
maybe why there? Well, this pattern, it really does show a kind of strategic calculation, doesn't it?
The increases in manufacturing and financial services. It suggests attackers are prioritizing sectors

(03:29):
with really valuable IP sensitive financial data, maybe critical infrastructure links.
Going for maximum impact. Exactly. Maximum leverage. Retail dipping slightly.
Maybe it's a shift to targets perceived as higher value or maybe just maybe some retailers are getting
a bit better at defense. Hard to say for sure. But the overwhelming dominance of the US plus the

(03:53):
increases in the UK and Germany. It clearly points to a focus on well, economically powerful nation.
It's not random. It's about targeting where the biggest financial leverage is, where the most
valuable data resides. Bigger payouts, more disruption. Okay. So we know where they're hitting.
Now, how are they doing it? What's in their toolkit? Especially ransomware. That's always evolving.

(04:15):
We've definitely seen some shifts at the top. The ransomware charts,
queeline seems to have really locked down that number one spot. Yeah, they have. Now over 20% of
attacks. That's up from what? About 13% before. Right. And Akira's moved up too. Stronger in the number
two spot, almost 14.2% up from just under 10%. Hmm. Significant jumps for both. And the rest of the top five.

(04:35):
These are newer names, right? Play I had about 7.5%. Sonobi around 6.7% and Black Nevis at roughly 4.7%.
That's right. New players making a mark. And Black Nevis. That was interesting. Also known as trial
recovery. The breeze mentions it just reappeared after being quiet for months. It was first seen back in
September 2024. What's the deal with its return? Yeah, what's fascinating here is just how dynamic this

(04:59):
ransomware world is. Quellen and Akira surging. It shows how effective they are. The resources they
must have. And then these new players play wise. Sonobi popping into the top five so quickly. It just
underscores how fast new variants can take hold. Maybe new techniques, different targeting. Always
something new. Always. And Black Nevis coming back. That's classic. Thread actors often go dark. You

(05:20):
know they retool. Find their methods. Maybe find new vulnerabilities. Then they reemerge. Often
stronger. Posing a renewed threat. Exactly. It's this constant arms race. New tools deployed fast.
And beyond ransomware, the brief flags. Other malware trends too. Things like a 4-0, 4-MD4-R,
EDR kill shifter, muquer agent, plague, spark kitty. And the exit backdoor is still around of course.

(05:44):
Kill a factor. Yes. Okay. So we've mapped the battlefield. Look to the weapons. What about the
minds behind these attacks? The adversaries. The brief highlights a group called Curly Comrades.
An APT advanced persistent threat group. Apparently linked to the Russian Federation. That's the
assessment. Yes. An APT group. And their name. It comes from using curl.exe right for command and

(06:08):
control. C2. Correct. That's how they talk to compromised machines and instructions. And also
for data exfiltration, sneaking data out. And their target seems specific. Eastern Europe. Moldova,
Georgia. Places looking towards the EU. Primarily yes. That seems to be their focus. Once they're inside
a network, they set up these reversed proxy tunnels back to servers they control. Think of them like

(06:30):
secret highways for stolen data. All for espionage basically. That appears to be the main goal. Yes.
Espionage. The good news though is that Bitdefenders report details their IOCs, indicators of
compromise and their TTPs, tactics, techniques and procedures. So defenders can use that to build
detection rules. Precisely. Now the brief does note and we should mention this impartially that

(06:51):
these types of groups are often characterized by targeting countries that support Ukraine. That's
the reported characteristics. Understood. Just reporting what's in the brief. And besides Curly Comrades,
other trending adversaries mentioned are linen typhoon, shiny hunters, storm 2603 and violet typhoon.
Quite a list. A busy landscape for threat hunters. Definitely. Now, vulnerabilities. This is always

(07:13):
crucial. And some old ones just won't go away. Well, they certainly want three D-link vulnerabilities
from 2020 and 2022. CVE 2020 25078, 2507 9 and CVE 2022 40799. Still needing attention.
It's incredible, isn't it? It highlights a huge problem. The attack surface isn't just about
new threats. It's these old known weaknesses that people just don't patch leaving the door wide

(07:37):
open. Easy pickings. But there's also a really urgent new one. High severity.
Effecting on-premises Microsoft Extreme Server 2019. Yes. CVE 2025 53786. This one is serious.
Microsoft strongly recommending applying hot fixes from April 2025. Like now. And maybe even isolating
vulnerable servers from the internet until they are patched. Absolutely critical advice.

(07:59):
Extreme servers are, well, they're central. Compromise that and you potentially have the keys to
the kingdom communications wise high value target. Definitely. And there are also new vulnerabilities
mentioned for Fortinet Fortissim and Trend Micro Apex 1. CVE 2025 25256 for Fortissim and CVE 2025 54948

(08:19):
for Apex 1. More things to add to the patching list. So putting all this together, the vulnerabilities,
the adversaries. What does this all mean? What's the bottom line for organizations and even individuals
just trying to stay secure? Well, the big takeaway, especially with that exchange vulnerability,
is aggressive patching. Organizations have to prioritize patching critical systems. When things

(08:40):
like Exchange get popped, attackers can get deep, pervasive access. It's bad. And for individuals,
it just reinforces the need for constant vigilance, right? Spotting fishing, keeping your own devices
updated. Because the threats are sophisticated. And the focus on espionage, like with curly comrades,
it reminds us it's not always just about money. It's data, intelligence, geopolitics, demands a

(09:03):
broader view of defense. Good point. Now, beyond the core stats and threats, the brief also
touches on some big cybersecurity news items making waves recently. Like critical zero-day bugs,
cracking open password vaults from cyber arc and hashie corp. That sounds really bad for password
security. Extremely concerning password managers are supposed to be the secure place. Right? And

(09:25):
Microsoft paying a record $17 million in bounties shows the scale of vulnerability discovery.
And the value placed on finding flaws before the bad guys do. Then there's this new shade
bios technique reportedly beats all AV by hiding in the system's firmware. Yeah, that's deeply
worrying. Malware at the bios level is incredibly stealthy, very hard to read out. And ghost calls

(09:46):
abusing zoom in teams. Making fake calls look real to trick people. Another example of attackers
exploiting the tools we rely on every day. Social engineering basically. We also seem shiny
hunters tactics starting to look like scattered spiders. Suggest threat actors learn from each other,
adapt successful playbooks, the landscape evolves. Sonic wall urging admins to disable SSL VPN

(10:08):
due to a critical bug. Another reminder about securing the network edge.
Perimeter security is still absolutely vital, yes. And on the plus side, maybe, the DOJ seized
over $300 million in cybercrime crypto. A significant win for law enforcement, yeah.
Shows their making progress and tracing illicit funds. And a hacker extra-dited to the US for

(10:29):
stealing $3.3 million in crypto. Accountability. Important to see those real world consequences.
So if we try and connect these news items to the bigger picture, what does this flurry of activity
tell us? I think it really shows the attackers relentless creativity. They're constantly probing
for new ways in from your deepest system levels like the BIOS with shade BIOS to

(10:52):
manipulating the everyday tools we use like Zoom and Teams with Ghost Calls.
They're getting us high and low. Exactly. It tells us that just defending the perimeter isn't
enough anymore. The fight is internal too. Continuous vigilance needed everywhere. The huge
bounties shows the growing industry around finding flaws both ethical hackers and unfortunately,

(11:14):
those selling them on the black market. Right. And the law enforcement wins, the seizures,
the extraditions. There are crucial reminders that even in the perceived anonymity of cyberspace,
there are efforts to bring people to justice. It's not a totally lawless space.
Okay, so wrapping up this deep dive on the buyer Nichols' brief for early August.
Let's recap the core insights. First, small businesses are overwhelmingly the primary victims.

(11:39):
They desperately need to boost their defenses. It's an existential issue for many--
Absolutely key takeaway. Second, the ransomware scene is churning. New groups rising fast. Old ones
like Black Nevis coming back strong. It's incredibly dynamic. Constant change there. Third, we have a
specific well-funded adversaries like Curly Comrades, potentially state-linked, focused on espionage
and critical regions. A reminder that not all threats are financially motivated. And finally,

(12:04):
patching is paramount. Old vulnerabilities like those delink ones persist. And new critical flaws,
especially in core systems like Microsoft Exchange, demand immediate attention.
Can't stress that enough, patch, patch, patch. So understanding these trends. It's not just about
the numbers, is it? It's about giving you the listener the context you need to navigate this digital

(12:26):
world a bit more safely, to be genuinely informed about what's out there. Knowledge is power in this domain.
It really is. So here's a final thought to maybe mullover. In an environment where these old
vulnerabilities can hang around for years, literally years, while brand new sophisticated threats pop up
constantly. What does being truly proactive in cybersecurity even mean anymore? And how do we actually

(12:48):
shift from just reacting, constantly putting out fires, to genuinely getting ahead of these evolving
dangers? That's the million dollar question, isn't it? Moving from reactive to truly proactive.
A tough challenge for everyone. Reach out to us at jbuyer.com for comments and questions.
Follow us at buyer company on social media. And if you'd be so kind, please rate and review us
in your podcast app.
Advertise With Us

Popular Podcasts

Stuff You Should Know
Dateline NBC

Dateline NBC

Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com

The Herd with Colin Cowherd

The Herd with Colin Cowherd

The Herd with Colin Cowherd is a thought-provoking, opinionated, and topic-driven journey through the top sports stories of the day.

Music, radio and podcasts, all free. Listen online or download the iHeart App.

Connect

© 2025 iHeartMedia, Inc.