CyberWire Daily: Patch Tuesday, North Korean APT, Apple Security, and Project Franklin

Patch Tuesday Updates

• 💻 Microsoft released fixes for 86 vulnerabilities, including two publicly disclosed zero-day flaws, one enabling SMB relay attacks.
• 📄 Adobe addressed nearly two dozen vulnerabilities, with critical flaws in Cold Fusion and Commerce.
• 🏭 Industrial sector updates included eight high security advisories from Rockwell Automation, alongside advisories from Siemens, Schneider Electric, and Phoenix Contact.
• ⚙️ Fortinet, Ivanti, and Nvidia also issued updates for high-severity issues.

North Korean APT Kimsuky and Mac Malware

• 🇰🇵 A 9 GB data leak revealed North Korean APT Kimsuky's development of interactive malware, a Linux rootkit, and phishing infrastructure.
• 🎯 The group, also known as APT43, targeted South Korea and Taiwan with GPKI and credential theft campaigns, with suspected Chinese support.
• 🍎 Apple introduced Memory Integrity Enforcement (MIE) for iPhones to combat advanced spyware attacks exploiting memory safety flaws.
• 💻 ChillyHell, a sophisticated modular backdoor targeting macOS, has been active since 2021 and evades antivirus detection.

Ransomware Trends and Critical Infrastructure Security

• 📉 Ransomware demands and payments in the education sector have dropped sharply in 2025, with average demands falling 74% and payments by 80-90%.
• ⚡ US critical infrastructure security lags behind modern smartphones, with the energy sector and water systems being particularly vulnerable.
• ⚠️ Senator Angus King described US cybersecurity as a “hellscape” exacerbated by government cuts, especially at CISA.
• 🇺🇦 A Ukrainian national faces federal charges and an $11 million bounty for allegedly running ransomware operations causing an estimated $18 billion in global damages.

Project Franklin and Wi-Fi Spying

• 🤝 Project Franklin, co-founded by Jake Braun and Jeff Moss, aims to recruit DEF CON community volunteers to provide free cybersecurity support to water utilities.
• 💧 The initiative has successfully assigned volunteers to several water utilities, assisting with basic security measures like password changes and MFA, to more advanced tasks like asset inventory and incident response planning.
• 🌐 Researchers developed WhoFi, a system that can identify and re-identify people based on how their bodies distort Wi-Fi signals, achieving 95.5% accuracy.
• 🔒 WhoFi's ability to see through walls and operate without a phone raises new privacy concerns.