Podcasts

Security researchers exposed Phantom Circuit — the hidden administrative layer Lazarus Group uses to centrally manage its C2 servers from Pyongyang, routed through a freight company’s proxy network in Russia to obscure attribution. The same infrastructure connects to Operation 99, a campaign targeting Web3 and crypto developers with malicious GitHub repositories that backdoor corporate environments. HN54 also covers Android 16’s Advanced Protection Mode: blocking sideloading, dropping 2G, and adding memory safety extensions.

Stories Covered

Lazarus Group Phantom Circuit: The Admin Layer Behind Their C2 Empire

SecurityScorecard researchers, while following up on Operation 99, discovered a previously unknown administrative layer Lazarus Group uses to manage its command-and-control infrastructure — dubbed Phantom Circuit. The setup routes all operator connections through AstroVPNs to an intermediate proxy network registered under a freight company in Hassan, Russia, before reaching the actual C2 servers (hosted on infrastructure registered to a likely fictional “Stark Industries LLC”). The layering is designed to make attribution point to Russian threat actors rather than Pyongyang.

Operation 99, the campaign Phantom Circuit supports, targets software developers looking for freelance Web3 and cryptocurrency work. Victims are directed — via fake job lures — to clone GitHub repositories that appear legitimate but contain backdoors and obfuscated Python scripts that phone home to Lazarus C2 servers. The malware then exfiltrates development secrets, cryptocurrency wallet data, and environment configuration. More than 230 victims downloaded the malicious payloads across the campaign, with Italy accounting for the highest victim count in disclosed data.

The concern here goes beyond cryptocurrency theft. Lazarus has been inserting backdoors into legitimate authentication apps and crypto software to get developers to run them in corporate environments. Developers with broad access — to source code, infrastructure configs, internal APIs — represent high-value pivot points for supply chain attacks. An infection at the developer level can compromise everything downstream. The same Phantom Circuit proxy network was also used in Lazarus’s IT worker impersonation campaign, confirming shared infrastructure across multiple concurrent operations.

Android 16 Advanced Protection Mode: Sideloading Blocked, 2G Cut Off

Android 16 extends Google’s Advanced Protection Program with device-level enforcement. When enabled, the mode greys out “allow from this source” install options system-wide — no app, not even a privileged system process, can sideload an APK. This closes the same vector SpyLoan and similar campaigns have exploited: users tricked into installing malicious APKs from outside the Play Store.

Advanced Protection Mode also disables 2G connectivity. Most major markets have sunset 2G, but most Android devices still support it as a fallback — and fake cell towers (IMSI catchers / “stingrays”) can force devices down to 2G, where traffic is unencrypted and interceptable. Blocking it at the OS level closes that downgrade attack. Android 16 also adds Memory Tagging Extension (MTE) support, a hardware-assisted mechanism for detecting memory safety bugs — addressing one of the most common vulnerability classes in Android’s native code.

A new API lets apps check enrollment status and apply additional hardening when a user is in Advanced Protection — useful for security-conscious enterprise apps and IT MDM setups. The feature was found in Android 16 beta and has not been formally announced by Google, so final availability is not guaranteed, but the components are present and functional.

Listen to the Episode

Harmonic Security researchers analyzed thousands of prompts submitted to ChatGPT, Copilot, Gemini, and Claude and found that 8.5% contained sensitive data — including penetration test results, network configurations, customer insurance claims, and proprietary source code. HN53 also covers threat actors hiding info stealers (LumaStealer, Vidar, MARS Stealer) in YouTube comments and Google Ads disguised as legitimate software download guides.

Stories Covered

Employees Are Leaking Sensitive Data Through GenAI Prompts

Harmonic Security analyzed thousands of prompts submitted by enterprise users to public GenAI platforms — ChatGPT, Microsoft Copilot, Google Gemini, Anthropic Claude, and Perplexity — and found that 8.5% contained sensitive data. At scale, that ratio compounds fast: 85 sensitive submissions per thousand prompts, across an entire organization’s daily usage.

Customer data makes up the largest slice at 45.77% — with specific examples like employees pasting insurance claims containing personal customer information to speed up processing. Employee data (performance reviews, HR records) accounts for 27%. Legal and financial data comes in at 14.88%. Security-related data — penetration test results, network configurations, backup plans — sits at 6.88%, and proprietary source code at 5.64%. The last two categories are the smallest in volume but are growing the fastest and carry the highest blast radius: a network config or pen test report submitted to a public LLM essentially hands an attacker a blueprint of your environment before they even scan the network.

The mechanism of harm is twofold. First, public LLM providers’ terms of service typically allow user-submitted data to be used for training — meaning sensitive submissions may be learned from and potentially surfaced later via savvy prompts, vulnerabilities, or breaches. Second, threat actors are already using ChatGPT as a recon tool to surface publicly available knowledge about targets; if proprietary configuration data ends up in the training set, that pool of reconnaissance just got significantly deeper.

The fix is organizational, not technical: train employees not to submit customer data, configs, or code into public AI tools; configure API access with data-retention opt-outs where available; and evaluate on-premises or private-API LLM deployments for any workflow that touches sensitive data.

Info Stealers Hidden in YouTube Comments and Google Search Results

Trend Micro researchers uncovered a campaign distributing info stealers — LumaStealer, Vidar, MARS Stealer, and others — through fake software installation tutorials on YouTube and through poisoned Google search results for pirated or cracked software. Threat actors post videos posing as setup guides, then bury malicious download links in video descriptions or comments, pointing to files hosted on MediaFire and Mega.nz to obscure the origin and complicate takedown.

The campaign exploits two trust signals simultaneously: YouTube’s perceived legitimacy as a platform, and the appearance of a high-ranking search result or a channel with credible-looking tutorial content. LumaStealer is sold as malware-as-a-service — the same model as legitimate SaaS — and is specifically built to harvest passwords, session cookies, and cryptocurrency wallet data. Once an info stealer runs, every credential and session stored on that machine is compromised, regardless of any other protections in place.

The defense is simple but requires discipline: download software only from official sources or verified storefronts. Piracy-adjacent download sites are one of the highest-density environments for info stealer delivery, and distinguishing a legitimate installer from a trojaned one without executing it requires security tooling most users do not have. If you are an IT or security professional managing endpoints, blocking known file-hosting domains used for malware delivery (MediaFire, Mega.nz in untrusted contexts) at the network level is a practical mitigation.

Listen to the Episode

An Amazon Cloud storage misconfiguration at Volkswagen’s software subsidiary Cariad exposed 800,000 EV customer records for months — including precise vehicle location data, home addresses, email addresses, and phone numbers. HN52 also covers a new Mirai botnet variant exploiting a zero-day in 4-Faith industrial routers, maintaining 15,000 daily active bots and generating DDoS traffic peaks of 100 Gbps against hundreds of targets per day.

Stories Covered

Volkswagen Breach: 800,000 EV Customers’ Location Data Exposed

The Chaos Computer Club reported that Volkswagen’s software subsidiary Cariad left an Amazon S3 bucket misconfigured and publicly accessible for months. The exposed data covered 800,000 electric vehicle owners across VW, Audi, Seat, and Skoda brands and included vehicle on/off timestamps, precise GPS location data, email addresses, phone numbers, and home addresses. Among those affected were at least two German politicians and members of the Hamburg police. Most vehicles were located in Germany, with additional data for Norway, Sweden, the UK, Netherlands, France, Belgium, and Denmark.

This is the accelerating pattern with connected vehicles: the car itself is rarely the attack surface. The cloud infrastructure collecting telemetry from the car is. Electric vehicles are effectively computers with motors, continuously reporting location, usage patterns, and system state back to manufacturer servers. When those servers are misconfigured — often due to turnover, unfamiliarity with cloud access controls, or simply never changing default permission settings — all that data becomes public. Location data paired with home addresses is particularly sensitive: it can reveal when a person is home, their daily movement patterns, and where they regularly park overnight.

The root cause here is a cloud misconfiguration, not a sophisticated breach. Proper S3 bucket ACL auditing and access logging would have caught this. For organizations running cloud-connected automotive or IoT infrastructure, automated misconfiguration scanning (tools like Prowler, Scout Suite, or AWS Config) should be table stakes, not an afterthought.

Mirai Variant Exploits 4-Faith Router Zero-Day for 100 Gbps DDoS Bursts

QiAnXin’s XLab researchers identified a Mirai botnet variant actively exploiting a zero-day vulnerability in 4-Faith industrial routers since November 2024. The botnet maintains approximately 15,000 daily active infected IP addresses — distributed across China, Iran, Russia, Turkey, and the United States — and launches DDoS attacks against hundreds of targets daily. Attack bursts last 10–30 seconds but generate traffic peaks around 100 Gbps (roughly 12.5 GB/s), enough to saturate most enterprise perimeters.

Beyond the 4-Faith zero-day, the botnet’s arsenal includes over 20 known CVEs — including vulnerabilities from 2013 that have had patches available for over a decade. The presence of decade-old CVEs in an active botnet’s exploit list reflects the core problem with IoT and industrial routers: they get deployed, they work, and nobody touches them again. Unlike a phone that nags you about updates, a router or DVR in a factory corner typically requires manual firmware download and physical USB installation to patch — a barrier most operators never clear. Devices facing the internet with unpatched CVEs from 2013 are not edge cases; they are the normal state of a large fraction of deployed industrial networking equipment.

The botnet also uses weak Telnet credentials for initial access, compounding the exposure. Default credentials on internet-facing devices remain one of the easiest and most reliable initial access techniques available — and one of the easiest things to fix. Changing default credentials and disabling Telnet in favor of SSH should be the first two steps when deploying any industrial router, before it ever hits the network.

Listen to the Episode

Chinese state-backed threat actors breached the US Treasury Department by compromising a BeyondTrust API key — gaining remote access to Treasury workstations and unclassified documents through the vendor’s privileged remote access infrastructure. HN51 also covers 3.1 million fake GitHub stars identified across 278,000 bot accounts, used to artificially inflate the apparent popularity of malware distribution repositories.

Stories Covered

Chinese Hackers Breach US Treasury via BeyondTrust Vendor Compromise

The US Treasury Department notified Congress that Chinese state-backed threat actors accessed its systems in December 2024 through a compromised API key belonging to BeyondTrust — a third-party vendor whose privileged remote access tools are used by over 20,000 customers across 100 countries, including 75% of Fortune 100 organizations. The attackers stole the key and used it to override BeyondTrust’s cloud security layer, gaining remote access to Treasury departmental workstations and the unclassified documents stored on them. BeyondTrust was alerted on December 5th, revoked the key immediately, and notified the Treasury on December 8th. The FBI and CISA are investigating.

This is a textbook supply chain attack on privileged access infrastructure: rather than breaching the Treasury directly, attackers targeted a vendor that had elevated, trusted access into Treasury systems. Vendors supporting privileged remote access tools typically hold keys that override normal user-level security controls — precisely the kind of access you need to move laterally and reach sensitive workstations without triggering per-user authentication. The incident follows the Salt Typhoon campaign, in which Chinese threat actors were found embedded in major US telecoms — with access to SMS messages in plaintext, since SMS is never end-to-end encrypted and sits in carrier databases during routing.

The pattern is clear: Chinese APTs are running parallel, simultaneous campaigns against US government and critical infrastructure — telecom backbone, Treasury, likely others not yet disclosed. The risk from third-party access is that auditing vendor privilege levels is less systematic than auditing internal accounts, and stolen vendor keys often carry more access than the vendor actually needs for their stated support function. Least-privilege enforcement on vendor accounts and API keys is the mitigation that would have limited the blast radius here.

3.1 Million Fake GitHub Stars Used to Boost Malware Repositories

Researchers analyzed 20 terabytes of GitHub Archive data — covering 60.5 million user actions and 610 million stars across 310 million repositories — and identified 3.1 million inauthentic stars generated by approximately 278,000 bot or coordinated accounts. The detection method, called StarScout, applies the CopyCatch fraud-detection algorithm to find patterns that don’t match organic human behavior: accounts starring a single repository, groups of accounts starring the same repositories within short time windows, and accounts with minimal activity outside of starring behavior.

The practical harm is supply chain in nature. GitHub stars signal trust and popularity to developers choosing between packages. A repository with thousands of stars reads as battle-tested and community-vetted. When those stars are purchased, a malicious package can climb the same rankings as a legitimate one — making it more likely that a developer under deadline will install it without scrutinizing the source. Check Point previously documented the Stargazers Ghost Network, an organized service that sold fake stars specifically to push information-stealing malware repositories up the rankings.

The defense is the same as it has always been: stars are a signal, not a guarantee. Check repository age, commit history, maintainer identity, download counts from package managers (npm, PyPI, etc.), and whether the library is actually referenced in downstream legitimate projects. A high star count on a two-month-old repo with one contributor and no forks warrants more scrutiny, not less.

Listen to the Episode

The FBI warned that HiatusRAT malware is actively scanning and infecting internet-exposed webcams and DVRs — targeting Chinese-branded devices with CVEs as old as 2017 that remain unpatched or end-of-life. HN50 also covers a telehealth breach at ConnectOnCall that exposed the protected health information of over 914,000 patients, including names, phone numbers, medical record numbers, health conditions, prescriptions, and Social Security numbers — for nearly three months before discovery.

Stories Covered

FBI Warns: HiatusRAT Malware Actively Targeting Exposed Webcams and DVRs

The FBI issued a private industry notification warning that HiatusRAT threat actors — linked to Chinese strategic interests — are running active scanning campaigns against internet-exposed webcams and DVRs in the US, Australia, Canada, New Zealand, and the UK. Attackers are focusing on Hikvision and Zhongmai devices, using open-source tools — Ingram for webcam vulnerability scanning and Medusa for brute-force authentication — against TCP ports 23, 26, 554, 2323, 567, 5523, 80, 8080, 9530, and 56575. CVEs being actively exploited include vulnerabilities from 2017, 2018, 2020, and 2021, alongside weak or default vendor-supplied credentials.

The threat model here is lateral movement, not just surveillance. A compromised webcam is a foothold on whatever network segment it sits on. HiatusRAT converts infected devices into SOCKS5 proxies for C2 communication and can pivot to other networked devices — escalating from a forgotten corner-of-the-office camera to a machine with meaningful data or privileges. The malware was previously documented targeting DrayTek Vigor VPN routers across North America, Europe, and South America, and a defense department server in a reconnaissance campaign. The webcam targeting is an expansion of the same playbook.

The core problem is the IoT “set it and forget it” pattern. Unlike a laptop that slows down when infected, a compromised webcam gives no user-visible signal. Devices running 2017-era CVEs have had seven years of available patches — but if firmware updates require manual download and installation, most consumers never perform them. The FBI’s guidance is straightforward: isolate devices from the rest of the network where possible, decommission end-of-life hardware, and report indicators of compromise to IC3 or the local field office. If the device can be patched, patch it now.

ConnectOnCall Breach: 914,000 Patient Health Records Exposed for Three Months

Healthcare SaaS company Phreesia notified the US Department of Health and Human Services that a breach of its telehealth subsidiary ConnectOnCall — acquired in October 2023 — exposed the protected health information of 914,138 patients. The breach ran from February 16 to May 12, 2024, nearly three months before discovery. ConnectOnCall is an after-hours physician answering and patient call-tracking platform. The exposed data included names, phone numbers, medical record numbers, dates of birth, health conditions, treatments, prescriptions, and in a subset of cases, Social Security numbers.

The combination of data types is what makes this breach particularly damaging. Health conditions, prescriptions, and treatment history paired with SSNs, phone numbers, and dates of birth gives an attacker the raw material to build high-fidelity identity profiles. That kind of profile enables targeted phishing, insurance fraud, and prescription fraud — all of which are harder to detect and remediate than a straightforward credit card compromise. The fact that no breach method was disclosed publicly makes it harder to assess, but three months of undetected access suggests either sophisticated evasion or inadequate internal monitoring of who was accessing patient communication data.

The acquisition context matters here. ConnectOnCall was a recently acquired entity — systems that haven’t been fully migrated, audited, or hardened by the parent company are exactly the kind of environment where security coverage lags. Phreesia took ConnectOnCall offline after discovery, notified federal law enforcement, and brought in external cybersecurity investigators. For patients who used the service, the practical mitigation is credit monitoring and freezing credit — and watching for targeted calls or messages leveraging health details that shouldn’t be in the hands of the caller.

Listen to the Episode

The FTC distributed $72 million in Fortnite refunds from a record $245 million settlement with Epic Games, after the agency found the company used dark patterns to trick players into unwanted purchases. HN49 also covers the Lazarus Group’s latest cryptocurrency campaign: a professionally built fake NFT tank game, two Chrome zero-days including an unpatched V8 sandbox escape, AI-generated marketing content, and coordinated social engineering across X and LinkedIn targeting crypto investors worldwide.

Stories Covered

FTC Distributes $72 Million in Fortnite Refunds Over Dark Pattern Allegations

The Federal Trade Commission began distributing $72 million to 629,344 Fortnite players as the first tranche of a $245 million settlement reached with Epic Games in December 2022. The FTC alleged that Epic used dark patterns — deliberate interface designs that exploit user behavior to produce outcomes favorable to the business — to generate unwanted charges. Specifically, players were charged while attempting to wake the game from sleep mode or during loading screens, and adjacent button presses intended only to preview items triggered purchases. The agency also alleged that Epic allowed unauthorized charges by minors and locked accounts of users who disputed those charges.

Dark patterns are social engineering at the UI layer. Instead of exploiting a technical vulnerability, the designer exploits how humans process visual information and make quick decisions under ambiguity. Fortnite is a free-to-play game that monetizes through cosmetic skins and season passes — meaning the revenue model depends entirely on getting users to spend money they didn’t necessarily intend to spend. The FTC’s complaint documents a pattern of making it harder to say no: confusing button placement, inconsistent interface behavior, and charging flows that activate on incidental inputs. Players receiving refunds averaged $114 each — real money spent on cosmetic upgrades in a free game.

One practical note: the FTC explicitly warned that scammers will use this refund program as a pretext to phish for personal information or payment of fake “clearance fees.” This is a standard pattern — whenever a government program distributes money on a deadline, threat actors impersonate that authority to create urgency. There are no fees to claim a Fortnite refund. If you may be eligible (charges between January 2017 and September 2022, unauthorized minor charges through November 2018, or a locked account over disputed charges), go directly to the FTC source — not a link from an unsolicited email.

Lazarus Group Exploits Chrome Zero-Day with AI-Crafted Fake Crypto Game

Kaspersky researchers found North Korea’s Lazarus Group running an elaborate campaign since February 2024 against cryptocurrency investors, centered on a fake NFT-based multiplayer tank game hosted at tankzone.com. Lazarus built the site using stolen source code from a legitimate game, giving it a functional and professional appearance. Embedded in the site was an exploit chain targeting two Chrome vulnerabilities: CVE-2024-4947, a zero-day in Chrome’s V8 JavaScript engine that allowed arbitrary code execution, and a second vulnerability with no public identifier that escaped the Chrome V8 sandbox entirely — giving the attackers full system access. The chain deployed shellcode to profile the compromised system before deciding whether to install a backdoor called Manuscript.

The exploit chain is the technical core, but the social engineering infrastructure around it is what makes this campaign notable. Lazarus created multiple fake accounts on X and LinkedIn, used AI-generated images and content to make the game appear legitimate, and directly approached cryptocurrency influencers to promote the site — both to expand distribution and to target the influencers’ own accounts and crypto holdings. AI generation lowers the quality bar needed to fool most users: an AI-rendered tank game screenshot doesn’t need to be indistinguishable from human art, it just needs to be good enough that someone glancing at a Twitter post doesn’t pause. Kaspersky noted Lazarus is actively iterating on generative AI capabilities and predicted more sophisticated use going forward.

The cryptocurrency angle is strategic. Blockchain transactions are irreversible — once funds move, there is no chargeback, no dispute mechanism, no central authority to appeal to. For a state actor like North Korea that is funding weapons programs through cybercrime, crypto theft offers a high-ROI channel: spend relatively modest resources building a convincing campaign, harvest from thousands of targets, and extract funds with no recovery path. Lazarus has been one of the most prolific actors in this space, responsible for the 2016 Bangladesh Bank $81 million SWIFT heist and the WannaCry ransomware outbreak. The ChromeV8 zero-day campaign is a continuation of that track record — technically sophisticated, lavishly socially engineered, and aimed squarely at a target pool with liquid assets and high risk tolerance.

Listen to the Episode