Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
(00:00):
Welcome back to Digital Rage. I am Jeff the producer here at Byer Company. Today we have
(00:06):
the Byer-Nichols Cybersecurity Brief for the second half of August and the top story is
Promptlock, a malware that uses generative AI to analyze files on a victim's system to
attack vulnerabilities. Also, more attacks are targeting Linux and Mac OS systems that traditionally
were rarely targeted. So let's get into the details. Welcome to the deep dive.
(00:32):
You know, in today's world there's just so much information flying around, especially
in cybersecurity right. It changes so fast. Keeping up feels well, honestly it feels like
trying to drink from a fire hose sometimes. So our mission today, we want to give you
a bit of a shortcut. We've dug into the Byer Nickel's Threat Brief 0-0-0-0-25-0-2. It's
(00:53):
pretty dense stuff and we've pulled out what we think are the most crucial bits the insights
you actually need. The goal here is to get you up to speed, maybe show you a few surprising
things without burying you in technical jargon. Exactly. And this brief, it's specific.
It covers cybersecurity data just from August 15 to the 31st, 2025. So the really fresh
snapshot of what's happening now. We're talking emerging malware, who's getting targeted
(01:16):
industries, countries, you name it. We'll connect the dots for you, look for patterns and
really talk about what it all means for your defenses. Okay, let's unpack this then. Straight
into one of the biggest things in the executive summary, this emergence of malware that actually
uses generative AI. Specifically, the brief calls out prompt lock. He said found this one
recently. And it's not just another piece of malware, it feels like a real shift. Yeah,
(01:39):
prompt lock uses Gen AI like on the victim system. Right. It analyzes files. Then it makes
these intelligent decisions, should I encrypt this for ransomware or maybe steal it? I mean,
think about that. It's way beyond the static stuff we're used to. It can figure out what you
value. What's truly striking here is that adaptive nature. It's dynamic. This isn't just,
you know, throwing a fixed script at a wall and seeing what sticks, prompt lock, analyzing
(02:03):
and then deciding that completely shifts the defensive game. We have to move from just
reacting to known bad files, those signatures, right to actually anticipating attacks that
are context aware that adapt on the fly. It really demands a more proactive, almost
intelligent defense from our side to that's a huge shift. This mean our traditional defenses
like signature based detection. They just done. Absolutely. Well, not entirely obsolete.
(02:28):
I wouldn't say that. They still catch the the easier stuff, the known threats, but for
things like prompt lock, yeah, our focus has got a shift more toward behavioral analysis,
using AI ourselves for anomaly detection, getting real time threat intel. It's becoming
more about understanding the intent and the context, not just recognizing a known piece
of code. Okay. So AI threats are one big thing,
(02:50):
but it's not the only shift, right? The brief also highlights this broader attack surface,
specifically more malware hitting macos and Linux reports is half, fully half of the trending
malware variants in this period. Yeah. Targeted those platforms. That's me. Well, that's
a big number. Talented some old assumptions, doesn't it? It really does. And it raises an
important question, you know, especially for anyone, maybe feeling a bit safer on a Mac
(03:12):
or Linux machine for a long time, the perception was oh, they're less vulnerable or at least
less targeted by the big campaigns, but this data, it's a firm reminder, you need solid
endpoint protection, good detection capabilities, no matter what OS you're running, Windows, Mac,
Linux, doesn't matter. That idea of security through obscurity, it's definitely gone. If
(03:35):
you're on Apple or Linux, you are absolutely a target now. Okay. So we understand the threats
are evolving, becoming smarter, hitting more platforms, but let's, let's follow the money.
Where's the impact really fell? Let's look at the top ransomware groups active in late August.
So Quillen is still up there. 20% share pretty dominant, but a cure is climbing fast over 14%
and Sonobi 2 or on 7%. The brief mentions of Cure's getting traction with these more sophisticated
(03:59):
supply chain attacks makes a harder to trace. And then you've got Warlock. They only showed
it publicly in June 2025, but they quickly made a mark by going after just one thing unpatched
Microsoft SharePoint servers. Very specific. Yeah. And that's crucial, isn't it? The rise of newer
groups like Warlock, focusing laser-like on specific vulnerabilities. It just highlights this
constant cat and mouse game. They are actively scanning for known weaknesses. If you haven't
(04:24):
patched that SharePoint server, you're basically putting out a welcome mat for these agile new
groups. It's not just about what ransomware exists, but how they're finding their way in.
Unpatched systems are key. So who's getting hit by these groups? Let's look at the victim
sector. Big changes here. Manufacturing actually jumped to number one over 16% and financial services
(04:44):
right behind it. Also over 16%. They moved up to these are often critical sectors right now.
Top targets. Absolutely. And construction, retail, they slipped down a bit. Technology stayed
at number five and location wise, the USA is still the main target way out in front at nearly
60%. Yeah. Followed by the UK and Germany much smaller percentages, though. But here's the
(05:04):
stat that really jumped out of me. Victim organization size. Get this. A massive 84.25% of victims are
small businesses. Defined as 500 employees or fewer. 84% that's overwhelming. It really is
overwhelming and incredibly insightful. Why target SMB so heavily? Well, several possibilities,
(05:26):
right? Maybe they're seen as having weaker defenses, perhaps less budget for dedicated
security teams, you know, or and this is key. They could just be an easier way into the supply
chain of larger companies they work with. Whatever the reason that stat just hammers home,
cybersecurity is not just a big company problem anymore. If you're a small business, you are
(05:46):
absolutely a high value target period. Okay. So beyond ransomware, the brief also digs
into specific adversary groups. The more sophisticated actors, let's zoom in on one example
of suspected nation state activity, APT 36 believed to be a Pakistani cyber espionage group
and their target. Indie defense personnel. The brief describes this really clever fishing
(06:07):
campaign they ran. They send emails with malicious PDFs. Okay, it's standard enough. But
the PDF has this blurred background and a button made to look exactly like the log in
for India's national Intermatic Center, the NIC, which is like the main government IT body
there handling critical stuff. Exactly. So if the target clicks that button, boom, redirected
to a URL downloads a ZIP file pretending to be a legit app, but the real goal, steal credentials,
(06:34):
get persistence in defense networks. It just shows the level of craft, doesn't it? And
the social engineering involved, it's not just about code, it's about deception. Making
something look incredibly real to trick someone really underscores how vital critical
thinking is when you get any email, especially official looking ones. And you know, just
to be clear, like the brief, we're focusing on the methods here. The TTP is tactics, techniques,
(06:56):
procedures. We're reporting impartially on how these attacks work, not getting into
the geopolitics behind them. Right. And the brief also quickly mentions salt typhoon
and silk typhoon. Both suspected nation state espionage groups potentially linked to China's
Ministry of State security, the MSS. Yeah. And it connects back to what the brief notes,
how these cyber activities often mirror real world tensions and rivalries. These examples
(07:20):
just highlight how persistent and targeted espionage campaigns are. And the need for incredibly
high security awareness, especially in government defense, that kind of sensitive sector, these
groups don't give up. Okay, let's switch gears a bit to the technical side. The weaknesses
attackers are actually using because the brief flags a particularly high number of trending
(07:43):
and actively exploited vulnerabilities, a CVEs during this period. It's a good reminder
that old flaws, they don't just disappear. Attackers love them. Still finding gold in those
old hills, huh? Totally. Like we're still seeing old dealing vulnerabilities exploited,
remote code execution, stuff like that, things from years ago, but still hitting devices
that never got patched. More recently, though, vulnerabilities in Fortinet, Fortissine,
(08:05):
Microsoft Exchange, big enterprise systems. Yeah, compromising those can give attackers
wide access across the network. Sirius stuff. But the brief highlights three citric flaws
as being of particular concern, two were from 2024, one from 2025, and then there's this
one CVE 2025, 4300, 300. It's an out of bounds right issue, basically letting an attacker
(08:27):
write data where they shouldn't potentially running code. And it impacts iOS, iPad OS,
and macos, broad Apple impact. Apple themselves apparently think it may have been exploited
in a sophisticated attack against specifically targeted individuals. Wow. Okay, so that's
a pretty serious warning for Apple users, even those lockdown systems aren't impenetrable.
So what's the big takeaway from all this vulnerability talk? It just reinforces yet again, how
(08:52):
absolutely critical it is to keep everything patched and updated. Your servers, your laptops,
yeah, but also your phones, your tablets, everything. The fact that vulnerabilities from like
2020 are still actively used, it shows the scale of the patching challenge. Attackers
will always take the easiest path in and an unpatched system is practically an open door.
Definitely. And moving from the flaws to the actual malicious code, the brief also lists
(09:14):
several trending malware families, new ones, and some making a comeback, a real mix.
A rogue scallery you might sell. Yeah, like EDR kill shifter, this is nasty. It's an evolution
of some ransom hub malware built specifically to disable endpoint detection and response
tools, basically trying to blind your security systems, cook and operate freely.
Sneaky turning off the cameras before the robbery. Exactly. Then there's plague. This one targets
(09:38):
Linux. It disguises itself as a Pam module, pluggable authentication module. That's deep
in the Linux authentication system. Wow, embedding itself in the login process. That makes
it incredibly hard to spot little on remove.
For sure. And remember the XC backdoor scare. Oh, yeah, the supply chain nightmare.
Well, it's resurfaced. Researchers found dozens of Docker hub container images,
(10:00):
prebuilt software packages that had infected versions of the XC utils compression tool baked
right in. So developers could be pulling down these images and unknowingly compromising
their own systems or applications. What's really striking across all these examples,
though, is the sheer diversity. You've got ransomware, sophisticated evasion tools like
EDR kill shifter, deep back doors, like plague on Linux, espionage tools, mobile malware,
(10:25):
export kitty mentioned in the brief supply chain threats like XZ. It hits everything from
servers to phones to development environments. It just paints a picture of a really complex,
multifaceted threat landscape, not just one type of enemy. Absolutely. Okay. So to round
things out, let's quickly touch on some of the top news headlines, the brief summarized.
These give us that wider context of what's happening in the cyber world. Yeah, the bigger
(10:48):
picture stuff. Right. So things like critical zero day bugs found in cyber arc and hash
record password vaults. That's huge for enterprise security keys to the kingdom stuff.
Yeah, certainly concerning on the flip side. Some good news. Over $300 million in cybercrime
crypto seized by law enforcement, a significant win. Nice to see some claws taking back
illicit gains. And then this potentially game changing discovery. A new shade bios technique.
(11:14):
The report says it beats every kind of security. Whoa. Okay. That sounds fundamental. The
hardware level threat will need to watch that space for sure and other things like new ghost
calls using zoom and teams for command and control. Sonic wall urging users to disable SSL VPN.
Let's go on. If you connect all these dots, these headlines, they really paint this picture
(11:36):
of constant rapid innovation on both sides, right? Offense and defense. The stakes are just
incredibly high for businesses for us as individuals for nations. It's this complex, always shifting
battleground. It's not static. It's always evolving demands constant vigilance. So after all
that, what does this deep dive mean for you? Let's recap quickly. We saw the rise of intelligent
(11:56):
adaptive threats like Jenny, I malware, prompt lock being a prime example. We saw that all
operating systems Mac Linux included our vulnerable and targeted. We saw that small businesses
are bearing the brunt of attacks a massive percentage. Yeah, over 84% still staggering.
And we saw the persistent threat from sophisticated nation state actors alongside the constant
(12:17):
need to patch old flaws and watch out for diverse new malware. Honestly, just doing what you
did today, staying informed, listening to this, it's a really vital first step. This landscape
changes so fast. Proactive knowledge is absolutely key. It really is. And maybe that leaves us with
a final thought for you to chew on. Given this increasing sophistication, we're seeing AI
(12:37):
malware like prompt lock that learns targeted exploits hitting even supposedly secure systems
like Apple devices. How do our security strategies, both personal and for organizations, need to adapt?
What new capabilities should you be looking for in your defenses to counter threats that
learn, adapt and target with this kind of precision? Something to think about as these threats
(12:58):
inevitably keep evolving. Great point. Thank you for joining us on this deep dive today.
Stay curious, stay informed, and keep protecting your digital life. We'll catch you next time.
Reach out to us at jbuyer.com for comments and questions. Follow us at buyer company on social
media. And if you'd be so kind, please rate and review us in your podcast app.
[Music]