CyberWire Daily: Law Enforcement Takedowns, Vendor Exploits, and AI in AppSec

Law Enforcement Takedowns and Exploitation Campaigns

• FBI and French police successfully seized the domains of BreachForums, a platform used for leaking corporate data, signaling increased global cooperation.
• Researchers have linked exploitation campaigns targeting Cisco, Palo Alto Networks, and Fortinet devices, observing significant spikes in scanning activity preceding vulnerability disclosures.
• Juniper Networks has released patches for over 200 vulnerabilities in its Junos Space and Security Director platforms, including nine critical flaws.

Bug Bounty Programs and AI in Security

• Apple has doubled its top bug bounty payout to $2 million for exploit chains enabling spyware attacks, emphasizing its commitment to incentivizing vulnerability research.
• Google has launched a new AI vulnerability reward program, offering up to $30,000 for bugs in its AI products like Gemini and Workspace.
• A survey indicates that 90% of security leaders are using or evaluating AI in their application security programs, despite concerns about accuracy and human review.

Ransomware Containment and New Botnets

• Organizations adopting microsegmentation can contain ransomware much faster and potentially receive better cyber insurance terms, though deployment challenges persist.
• A new botnet named RondoDox has been identified, exploiting over 50 vulnerabilities across devices from more than 30 vendors, with compromised devices used for cryptocurrency mining and DDoS attacks.
• Researchers have disclosed 13 unpatched Ivanti Endpoint Manager flaws, including local privilege escalation and remote code execution vulnerabilities.

Public-Private Partnerships for National Security

• Jason Manar, CISO of Kaseya, discusses the challenges in cybersecurity legislation due to the pace of technological change and political shifts.
• He emphasizes the need for dialogue and collaboration between public and private sectors to protect national interests and businesses.
• Manar highlights initiatives like CISA's past work on RMM security standards as examples of effective public-private partnerships.

Activist Hackers and Decoy Networks

• Pro-Russian hackers were tricked into attacking a decoy network set up by researchers, mistaking it for a real Dutch water facility.
• This incident highlights the trend of novice activists targeting industrial systems they poorly understand, often falling into researcher-created honeypots.
• While these activist groups may have short lifespans, their actions signal a worrying shift towards targeting real-world infrastructure.