The Attack Path You Don't Own

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

Introduction

SPEAKER_00 0:01

Each week, we break down the biggest cybersecurity stories: emerging threats, new technologies, and the changes that matter to you. What happened, why it matters, and what to do next. This is What Matters in Cyber with your host Steve.

SPEAKER_01 0:21

Hello

The Attack Path You Don’t Own

SPEAKER_01 0:22

and welcome to What Matters in Cyber. I'm Steve. This week I want to talk about something that tends to make security leaders slightly uncomfortable. Some of the most important attack paths into your organization may not actually belong to you. They sit inside a cloud backup provider, a software application with privileged access, a hardware distributor, a recruitment process, or even the advertising system on somebody else's website. That is the thread connecting several of this week's biggest stories. We have a compromise involving ConnectWise Cloud Backup and Microsoft 365 tenants. We have genuine ledger hardware wallets reportedly altered before they reached customers. We have another major operation against North Korean remote IT workers using laptop farms and stolen identities. And we have the first public confirmation of commercial spyware being delivered through targeted online advertising without the victim clicking anything. I'll also cover the disruption affecting the United States federal bankruptcy courts, a significant security acquisition involving ProofPoint and Veronis, and a Monday patch list that is, frankly, rather impolite in its length. So, this week is less about one clever piece of malware and more about the systems behind the systems. The connections, suppliers, identities, and processes that quietly make modern IT work. And when one of those is compromised, the attacker may arrive through a door you did not realize you had. Let's get into it. The

ConnectWise and Cloud Application Identities

SPEAKER_01 1:58

biggest story for many enterprise teams this week is the incident involving ConnectWise Cloud Backup, which was previously known as SkyKick. ConnectWise says it identified unauthorized access to application identities used by the service and shut off application access while it investigated. That interrupted backup services, although the company says it has not found evidence that backup data itself was compromised. But the more worrying detail came from Huntress. Huntress said a compromised Microsoft 365 application secret was used to gain unauthorized access to customer environments. By Thursday, it had confirmed activity in at least 162 tenants. The permissions associated with the application could expose mailboxes, OneDrive, SharePoint, Teams, and Directory data. In one investigated tenant, the application reportedly assigned itself global administrator rights and added new credentials to two other applications. That last part matters enormously. If an attacker adds another secret or certificate to an application, simply disabling the original supplier application may not remove the attacker's access. The front door can be closed while a newly created side door remains open. The activity also appeared highly automated. Huntress observed movement through tenant identifiers in a predictable order, sometimes only seconds apart. This was not somebody patiently clicking around an admin portal with a cup of coffee. It looked scripted and designed to operate at scale. The immediate advice is to follow the vendor guidance and review the affected application identities, but I would go further. Check the credentials attached to every related enterprise application. Review recent role assignments, consent changes, new secrets, certificates, and unusual sign-ins. Then decide whether the permissions granted to backup and management platforms are still appropriate. Cloud applications are often treated like software. Security teams need to treat them like privileged identities, because that is what they are. A service principal does not get tired, it does not go on holiday, and it can quietly retain access for years without anybody asking whether it still needs it. That is convenient right up until the day it isn't.

Ledger and the Hardware Supply Chain

SPEAKER_01 4:31

According to Ledger, the inserted hardware was designed to capture a user's recovery phrase during setup. The company describes this as a localized distribution attack rather than a compromise of its chips, operating system, or servers. It has asked authorized sellers and distributors in Southeast Asia and Hong Kong to suspend sales while the investigation continues. Whatever label we use, the lesson is the same. A genuine product can still become dangerous after it leaves the manufacturer. That is particularly serious with a hardware wallet, because the entire point of the device is to create a trusted boundary around digital assets. If the device has been modified before the customer receives it, that boundary may never exist. For individual buyers, purchase directly from the manufacturer or a clearly authorized seller. Inspect the packaging and the device. Run the manufacturer's authenticity checks, and never enter a recovery phrase into a website, mobile application, or unexpected prompt. For companies, the wider question is whether you can verify sensitive equipment from the manufacturer to the employee. That includes network devices, security appliances, laptops, and removable media, not just cryptocurrency wallets. Procurement efficiency is useful. Chain of custody is useful too. Sometimes the cheapest reseller is cheap for a reason, and occasionally that reason comes with extra circuitry. The

North Korean Remote IT Workers

SPEAKER_01 5:59

United States Justice Department has announced another major operation against North Korean remote IT worker schemes. Under Operation Lone Star Roundup, authorities searched more than 40 residences in Texas and seized 187 laptops and remote access devices. The Justice Department says the operation affected more than 70 American companies and generated roughly $3 million, believed to have supported sanctioned North Korean entities. The basic model is now familiar. Workers use stolen or fabricated American identities to obtain remote technology jobs. A facilitator in the United States receives the employer's laptop and keeps it online at a so-called laptop farm. The actual worker connects remotely from somewhere else, often using virtual private networks, proxies, and remote access tools to disguise the real location. There are at least three risks here. The first is sanctions and fraud. The company may be paying somebody it is legally prohibited from supporting. The second is insider access. The worker may receive legitimate credentials, source code access, and visibility into internal systems. The third is simple operational complacency. Many hiring and onboarding processes were redesigned for remote work, but not necessarily for remote deception. The answer is not to distrust every remote employee. It is to make identity and location verification part of the process. Use live video checks during hiring and onboarding. Confirm identity documents through independent services. Validate where company equipment is shipped and where it later connects from. Look for unexpected remote control software, unusual keyboard, video, mouse devices, and network activity that does not match the employee's claimed location or working pattern. And perhaps most importantly, connect the signals. Human resources may see an identity discrepancy. Finance may see a strange bank account. Security may see an unusual login location. Individually, each can look explainable. Together, they may tell a very different story. One

Spyware Delivered Through Online Advertising

SPEAKER_01 8:09

of the most technically interesting stories this week comes from Citizen Lab. Its researchers say they have confirmed the first publicly documented case of zero-click mercenary spyware being delivered through targeted online advertisements. The operation, which Citizen Lab calls adfection, targeted people at Al Jazeera. The victims did not need to click a malicious link. Instead, the attackers reportedly used the machinery of online advertising to identify devices and deliver an exploit through an advertisement. Think about that for a moment. The advertising ecosystem already knows how to find extremely specific audiences. It makes decisions in fractions of a second about which advertisement to place on a device. If that machinery can be abused for surveillance, the same infrastructure built to sell shoes can help choose and reach a particular target. This does not mean ordinary advertising has suddenly become an automatic compromise for everyone. These appear to be targeted, expensive operations using commercial spyware and previously unknown vulnerabilities, but it changes the defensive assumption. We often tell people not to click suspicious links. That remains good advice. It is simply not enough against a true zero-click exploit. High-risk organizations should keep mobile devices fully updated, use hardened device modes where appropriate, separate sensitive communications, and monitor for indicators published by reputable research groups. Journalists, government officials, executives, and people working in geopolitically sensitive areas need a stronger mobile security model than the average consumer. The uncomfortable point is that the victim can do everything normally considered sensible and still be targeted. Sometimes security is not about perfect prevention. It is about reducing exposure, detecting compromise, and having a plan for what happens next.

Cybersecurity Quick Hits

SPEAKER_01 10:09

Now for three shorter stories worth watching. First, a cyber incident at BAE Systems disrupted the Bankruptcy Noticing Center, which handles notices for every federal bankruptcy court in the United States. The federal courts said the center's systems and websites were unavailable, stopping the production and distribution of bankruptcy notices. This is a useful reminder that an incident at one service provider can interrupt a national business process. Business continuity plans need to account for important external services disappearing, not just internal systems going down. Second, ProofPoint has agreed to acquire Veronis in an all-cash transaction valued at roughly $6.3 billion. The proposed combination brings ProofPoint's focus on people, email, and agents, together with Veronis' focus on data security and access. Strategically, that makes sense. Identity, data, and human behavior are increasingly part of the same security problem. For customers, though, the sensible response is patience. Watch the product roadmap, licensing, and integration plans. An acquisition announcement is not the same thing as a fully integrated platform, no matter how attractive the diagram looks. Third, Google announced new Android protections aimed at scam activity. These include stronger warnings when someone tries to persuade a user to enable call forwarding, protections that hide sensitive login and payment information during screen sharing, and expanded scam detection in messages. I like this direction because it recognizes that scams are often a sequence, not one malicious message. The attacker starts a call, persuades the victim to share a screen, changes a setting, and then moves money. Security controls become more effective when they understand that sequence instead of judging every action in isolation. Now

The Monday Patch List

SPEAKER_01 12:03

the Monday patch list. And this week it is not a small one. Start with internet-facing remote access and security products. Beyond Trust has disclosed a critical vulnerability in remote support, identified as CVE 2026 102764. The company says it was exploited as a zero-day from late August by a suspected China-linked actor. Beyond Trust's hosted service has been patched, but self-hosted customers may need to apply the update manually, particularly if automatic updates are disabled. Ivanti has also disclosed an actively exploited vulnerability in Connect Secure. The floor allows an unauthenticated attacker to execute commands, and federal guidance is to patch immediately. If you operate one of these appliances, do not just schedule the update for the next convenient maintenance window. Check the current vendor guidance, update it, and investigate for evidence of compromise. Cisco has a critical vulnerability in the malware scanning feature of Secure Email Gateway. It can allow an unauthenticated remote attacker to write files and potentially execute commands with root privileges. Cisco says it is being actively exploited and there is no workaround. That makes the priority fairly clear. Palo Alto Networks is addressing an authenticated remote code execution flaw affecting the management interface of PANOS. Exploitation has been observed. The obvious control, alongside patching, is to ensure the management interface is not exposed broadly and is reachable only from trusted administrative networks. Then we have Microsoft's October security updates. Reporting on this month's release counted more than 1400 vulnerabilities, including three zero days and one known to be actively exploited. The total is unusually large, partly because of the way issues are being counted across products, but the operational point remains the same. This is a substantial update cycle. Do not let the headline number drive the whole process. Prioritize known exploitation, externally reachable systems, identity infrastructure, email, remote access, and assets with high business impact. Then validate that the patch is actually deployed. A patch dashboard showing 98% compliance looks reassuring. The missing 2% somehow always contains a domain controller, an appliance nobody owns, and a server last rebooted during the Obama administration. Patch priority should be based on exposure and consequence, not just the score printed next to the vulnerability.

My Take

SPEAKER_01 14:32

And now, my take. The central lesson from this week is that dependency risk is operational, not contractual. A supplier agreement may say who is responsible after an incident. It does not stop the incident reaching you. The ConnectWise story is about privileged application identities. The Ledger story is about distribution. The North Korean worker story is about hiring and device handling. The spyware story is about an advertising ecosystem almost nobody would consider part of their attack surface. Different stories, same problem. We rely on connections we do not always see clearly. So this week, ask four simple questions. Which third-party applications have privileged access to our environment? Which external services could stop an important business process? Can we verify the people and equipment entering our organization? And if one of those trusted connections were compromised, would we recognize it quickly? You do not need to eliminate every dependency. Modern organizations cannot operate that way. But you do need to know where the dependencies are, limit what they can do, and prepare for one of them to fail. Because increasingly, the attack path that matters most may be the one you do not own. That's it for this week's What Matters in Cyber. If this helped, subscribe and share the episode with somebody who needs a practical view of what is happening in IT and cybersecurity. I'm Steve. Thanks for listening, and I'll be back next Monday.