Sandworm

So it rode in on a USB stick, and it made about a thousand uranium centrifuges spin themselves apart while the operators watched a calm screen.

In December twenty-fifteen, a Russian military unit known as Sandworm reached down through the shell and switched off the lights for about two hundred and thirty thousand people in Ukraine.

And a year later, it did it again in Kyiv.

In twenty-seventeen, the same unit released a swarm called NotPetya on Ukraine, dressed up as a ransom note, and the swarm ignored the border.

Cisco's mail gateway is on CISA's exploited list.

Sandworm and a ransomware crew are exploiting two flaws in the console that manages Cisco firewalls, and a Twitch extension with roughly thirty thousand Chrome users forwarded live session tokens to a third-party bot service.

[upbeat music] This is Wordfence security news.

I'm Alex Thomas.

Cisco says there is no workaround.

Cisco Talos says attackers are exploiting two flaws in Cisco Secure Firewall Management Center.

It attributes one intrusion cluster to Sandworm and another ended in Qilin ransomware.

Cisco Secure Firewall Management Center is the console that manages Cisco firewalls.

Yeah, and I, I mean, we saw, we feel like we saw almost everything since Log4j in 2021 when, I mean, it was one of the largest vulnerabilities that we saw.

Now we, we are seeing the supply chain attacks, this wave of Shaihulud and, uh, other similar GitHub worms that, that we're seeing.

But of course in everything with AI and how AI impact security, it kind of feels like we're starting all over again since the challenge is real.

There are new challenges.

We're talking specifically about their elite hacking squads, right? Like units two nine one five five and seven four four five five.

Those are the ones, along with groups utilizing tradecraft associated with Sandworm.

Let's break down what cyber physical actually means for you, the listener.

It's a, it's a shift from stealing spreadsheets to targeting systems that affect physical reality.