This Week's Cybersecurity News Summary

Wrapping all with a summary of the cybersecurity news you missed this week.

Mar 07, 2025

Here’s a comprehensive weekend roundup of the latest cybersecurity news and insights from the CyberHub Podcast.

Philippines Army Cyber Attack Disclosure

The Philippine Army disclosed an attempted breach of its systems, allegedly orchestrated by a group called Exodus Security. Although the army maintains that no serious damage or data theft took place, reports suggest that as many as 10,000 records—including personal, medical, and possibly criminal information—could be at risk. This incident adds to the ongoing cyber tension in the Asia-Pacific region, especially amid rising geopolitical pressures from China.

Thai Authorities Arrest Major Data Breach Suspect

In a significant law enforcement success, Thai authorities apprehended a 39-year-old man allegedly linked to over 90 major data leaks worldwide. Operating under multiple aliases, he specialized in extortion: leaking stolen data to media or regulatory bodies to pressure victims. His arrest is considered a major step toward dismantling a highly active cybercriminal network in the APAC region.

Tata Technologies Ransomware Incident

Tata Technologies—a subsidiary of Tata Motors—confirmed a ransomware attack involving “Hunters International.” Though the company was initially tight-lipped, the attackers later added Tata to their leak site, threatening data publication if demands weren’t met. The timeline suggests covert negotiations may have taken place, underscoring the importance of backups that can prevent organizations from feeling forced to pay ransoms.

North Korea’s Lazarus Group Launders $1.5 Billion

North Korean threat actor Lazarus Group reportedly laundered $1.5 billion stolen from the ByBit crypto platform. Investigators say the group used various DeFi platforms to convert and shuffle Ethereum into Bitcoin, dispersing it across multiple blockchain addresses. The incident highlights how nation-state cybercrime intersects with global finance, making asset recovery and international cooperation ever more critical.

Lee Enterprise Ransomware Breach

Media conglomerate Lee Enterprise became the latest victim of “Key-Lean” (Agenda) ransomware. After negotiations broke down, the attackers threatened to release the stolen data unless their demands were met by March 5. Lee Enterprise’s SEC filing pointed out the potential for severe financial, reputational, and operational damage, reminding large organizations that ransomware attacks remain a top-tier threat.

Government and Public Sector Attacks

From the Polish Space Agency (POLSA) going offline in response to an undisclosed cyberattack—likely tied to geopolitical strains—to MS-ISAC’s warning about vulnerabilities in state and local agencies, the public sector is facing heightened threats. Limited budgets, outdated systems, and shortage of cybersecurity expertise make these targets especially appealing to both cybercriminals and nation-state actors.

Key Vulnerabilities & Patch Alerts

VMware ESXi Zero-Days: Broadcom issued an urgent warning about three zero-day vulnerabilities affecting ESXi, Workstation, and Fusion. Attackers could potentially gain unauthorized host-level code execution.
Microsoft-Signed Driver Flaws: Ransomware groups increasingly exploit a “Bring Your Own Vulnerable Driver” (BYOVD) approach using flaws in signed Windows drivers.
Qualcomm & MediaTek Chipset Updates: Both companies released fixes for critical vulnerabilities. Millions of devices could be affected if left unpatched.
One Million Off-Brand Android Devices: Researchers found preinstalled backdoors in cheap IoT and mobile devices, forming a large botnet concentrated in South America.

Privacy & Regulatory Developments

French lawmakers are proposing legislation that would require encryption backdoors and force VPN providers to block government-blacklisted sites, facing pushback from privacy advocates. In the U.S., the FTC shut down a “phantom debt-collection” scam, and Microsoft named individuals tied to Azure OpenAI service abuse in a public lawsuit. Meanwhile, financial institutions are advocating for streamlined incident reporting rules under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCA), arguing that excessive paperwork hinders swift remediation.

$31 Million Crypto Seizure: U.S. authorities recovered stolen funds from a 2021 Uranium Finance hack, underscoring the growing collaboration between law enforcement and cryptocurrency platforms.
Chinese Nationals Charged in Treasury Hack: The DOJ unsealed indictments against multiple defendants accused of hacking the U.S. Treasury. While extradition is unlikely, their international travel and financial activities will be heavily restricted.
Nigerian Cybercriminals Extradited: Two suspects involved in large-scale tax fraud and computer intrusions were handed over to U.S. authorities after phishing and laundering schemes targeted American tax services.

Personal Reflection from James

Throughout these updates, one message resonates: no organization—whether public, private, or multinational—can afford to be complacent about cyber threats. The sheer variety of adversaries, from state-sponsored groups to opportunistic criminals, means that vigilance and preparedness must be top priorities. Even small actions, like regular patching and staff training, make a substantial difference.

Above all, global cooperation continues to emerge as a crucial factor, enabling the interception of stolen crypto funds, successful arrests, and major disruptions of malicious campaigns.

Action Items

Patch and Update Immediately: Prioritize fixes for VMware ESXi, Qualcomm, MediaTek, Microsoft drivers, Chrome, and Firefox.
Automate Backup & Restoration Drills: Verify that you can recover systems quickly without paying ransoms.
Review Access Controls & VPN Security: Harden remote gateways to deter state-sponsored or criminal exploits.
Conduct Supply Chain Audits: Investigate vendors and off-brand IoT devices for preloaded backdoors.
Bolster Incident Response Plans: Account for newer tactics such as BYOVD attacks and even physical-mail ransom threats.
Stay Current on Regulatory Changes: Watch for emerging encryption backdoor legislation and other data-privacy mandates that could impact operations.
Enforce Robust Key Management: Rotate credentials often to minimize damage from leaked keys.
Collaborate with Law Enforcement: Reporting incidents promptly can aid in tracing stolen assets and curbing criminal activity.

Stay Cyber Safe!