Inside Scattered Spider: Tactics of a Cyber Crime Group

British and Romanian authorities make arrests in a major tax fraud scheme. The Interlock ransomware gang has a new RAT. A new vulnerability in Google Gemini for Workspace allows attackers to hide malicious instructions inside emails. Suspected Chinese hackers breach a major DC law firm.  Multiple firmware vulnerabilities affect products from Taiwanese manufacturer Gigabyte Technology. Nvidia warns against Rowhammer attacks across its product line. Louis Vuitton joins the list of breached UK retailers. Indian authorities dismantle a cyber fraud gang. CISA pumps the brakes on a critical vulnerability in American train systems. Our guest is Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Assistant Director at the FBI’s Cyber Division, with insights on Scattered Spider. Hackers ransack Elmo’s World. 

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

Today we are joined by Cynthia Kaiser, SVP of Halcyon’s Ransomware Research Center and former Deputy Assistant Director at the FBI’s Cyber Division, discussing "Scattered Spider and Other Criminal Compromise of Outsourcing Providers Increases Victim Attacks." You can check out more from Halcyon here.

Selected Reading

Romanian police arrest 13 scammers targeting UK’s tax authority (The Record)

Interlock Ransomware Unleashes New RAT in Widespread Campaign (Infosecurity Magazine)

Google Gemini flaw hijacks email summaries for phishing (Bleeping Computer)

Chinese hackers suspected in breach of powerful DC law firm (CNN Politics)

Flaws in Gigabyte Firmware Allow Security Bypass, Backdoor Deployment (Security Week)

Nvidia warns of Rowhammer attacks on GPUs (The Register)

Louis Vuitton UK Latest Retailer Hit by Data Breach (Infosecurity Magazine)

Indian Police Raid Tech Support Scam Call Center (Infosecurity Magazine)

Security vulnerability on U.S. trains that let anyone activate the brakes on the rear car was known for 13 years — operators refused to fix the issue until now (Tom's Hardware)

End-of-Train and Head-of-Train Remote Linking Protocol (CISA)

Hacker Makes Antisemitic Posts on Elmo’s X Account (The New York Times)

Audience Survey

Complete our annual audience survey before August 31.

Want to hear your company in the show?

You too can reach the most influential leaders and operators in the industry. Here’s our media kit. Contact us at cyberwire@n2k.com to request more info.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.

Learn more about your ad choices. Visit megaphone.fm/adchoices