Maersk breach, CopperDragon malware, United AI booking ban - CISO Series

The shipping giant Maersk has confirmed a security breach affecting LF Logistics, a company it previously acquired. Hackers from the group WhiteArmor claim to have stolen approximately 100 gigabytes of data and are demanding $5 million in ransom. Despite the breach, Maersk states it has found no evidence of operational disruption or impact on connected customers and partners.

The investigation into the incident is ongoing, with Maersk reporting that current evidence doesn't indicate sensitive data has been disclosed. The company continues to monitor the situation closely as cybersecurity threats evolve across multiple sectors.

Global Cyber Threats

Check Point Research has identified three China-linked hacking campaigns potentially connected to a shared malware supplier dubbed CopperDragon. The year-long investigation tracked attacks targeting organizations across Latin America, Asia, and Europe, with methods including hacked websites and fake Chrome certificate warnings to install malware.

United Airlines has implemented a policy blocking personal AI assistants from accessing its booking systems, citing data privacy concerns. This move limits AI agents' ability to make travel purchases on behalf of customers, reflecting growing caution about AI integration in sensitive operations.

Ransomware Developments

A KrebsOnSecurity investigation has linked Qilin administrator Haise to Aleksey Mikhailovich Yakovtsev, a 36-year-old Russian national living in St. Petersburg. The ransomware group has claimed at least 365 victims in just three months, offering affiliates at least 80% of ransom payments.

Vulnerabilities and Patches

Zoom has addressed two critical vulnerabilities in its Workplace for Windows application, with severity scores of 9.6 and 8.1. The flaws could allow unauthenticated attackers to gain elevated network privileges, though the company hasn't reported any active exploitation in the wild.

N-able has restored hosted N-central environments following an emergency hotfix addressing seven vulnerabilities. The update temporarily disables built-in remote control while more security enhancements are developed. On-premises customers remain advised to keep servers offline until updated.

State-Sponsored Attacks

US prosecutors have charged three men with directing attacks across Europe for Iran's Islamic Revolutionary Guard Corps, including arson attacks in London streamed over FaceTime. The prosecution alleges filming attacks for propaganda was central to the operation, with evidence recovered from seized devices rather than breaking encryption.

Arctic Wolf Labs has connected the AI penetration testing platform AntiFox to attacks on web applications and Amazon Web Services environments. In some cases, attackers used compromised Microsoft web applications to install web shells and access cloud credentials, though the majority of requests were denied.