Cisco SD-WAN Zero Day, Google Disrupts Chinese Campaign, and More Cyber on The Pitt

I'm aware. I've watched 6 out of the 15 seasons of that for the past six weeks. Holy shit. But that's not nearly as gross as the Pit. Like not even It's like I don't, I watched it at the time. I don't totally remember like the level of gore, but it would be like, oh, this person has a broken leg or like this guy's got, you know, some gross like rash or something. But it's not like somebody all the skin on someone's entire body falling off or whatever.

Yeah, they're not showing like the the tongue being sewed back together. That was like, nothing really grosses me out, but I was. That kind of freaked me out last night. I'm, I'm not going to lie to you. Yeah, we're going to spoil the pit for everybody. Sorry. But let's talk a little bit about some security news first. Couple interesting stories this week. The first one I wanted to hit on was this Cisco Zero Day in their the Catalyst SD Wan controller. IT Talos put out a blog post about it which was really good and Cisco released an advisory as well. They have software updates out for this. It's a really serious bug that it looks like attack. It's it's being actively exploited and it looks like the attackers are using that bug plus another one to get some root level privileges and then go on their merry way. And it's serious enough that it

was one of those where the NSA in a bunch of other foreign intelligence agencies put out a joint advisory as they sometimes do. And, you know, kind of like raise their hands like, hey, everybody, please pay attention to this. I think this is really serious. We're here some hunting guidance here, some IO CS. Here's what we're seeing. It's those are always the ones that kind of catch my eye. You know, there there's there's bugs that get exploited all the time. But when you see national intelligence agencies telling you to go patch it, that's when you kind of like, pop your head up and take notice. Yeah, Anytime you see the NSA being involved with any sort of advisory, you're going to want to listen up. And then also I saw that it they were saying it had been exploited since like, was it 2023 or something? I.

Mean. That's what Taylor said. Yeah, yeah, that's, I feel like we've seen a lot of those types of vulnerabilities with those like long tails of exploitation like the was it the Dell recover point for VM flaw that was recently written about that I think it said like 2024. So you know, those are always go to show how you know how persistent and stealthy a lot of these threat actors campaigns are really because it's not just like a couple months like those are years. And it's weird that with the level of telemetry and threat intelligence that everybody has on their networks these days, it's weird that nobody would have picked it up before now. You know, like no threat Intel team, No customer would have been like, hey, we we got popped with something really weird that we and, you know, an IR firm didn't identify it before now, because a lot of times that's

how those get discovered. But this, yeah, for three years or two plus years for this to be exploited in the wild, especially against something that is as widely deployed as this product is, is, you know, kind of interesting. But there isn't any. There's nothing in like Talos's post or the NSA guidance that tells you how many people or customers have been targeted or where they're, you know, what kind of organizations or any geographic breakdown.

So it could have just been like a few organizations here or there, but the guidance from NSA and the other agencies leads me to believe that probably either some critical infrastructure or government agencies were targeted, right? Like that's that's kind of the one follows the other usually. Yeah. And it sounded like the threat actor like based on the Talos research that it at this point it's uncategorized is that's did I read?

Yeah, one of those unattributed. There we go. There's the baby noises. I love it. One of those unattributed actors, so and Talosols did not say Chinese, Russian, North Korea, they didn't give it any attribution other than unattributed, which is, you know, just their catch all for this is probably somebody we haven't seen before. But based on the way that they're going about this, they look like, you know, calling them sophisticated is just a code word for probably a state backed, state backed entity. But you know, everybody targets edge devices these days, so who knows?

You know, true. Yeah, that's, I mean that was the case it seemed like with the other thing in the news that was on the Decipher site this week, which was Google find it or saying they disrupted the infrastructure of a Chinese threat actor. And it sounded like the basically that threat actor targeted global telecom providers and government organizations. But they were saying that for that one too, the initial access was likely for edge devices as you as you mentioned.

So, you know, importantly that it was interesting. I was reading that and when I saw telecom providers, I was like, oh, is this, you know, Salt Typhoon? But they made a very like a a big footnote where basically they said this isn't Salt Typhoon. Don't worry. Like we wish. But yeah. We wish because we know who those guys are. Yeah, exactly. Yeah. So yeah, it was basically what they did is they they shut down, you know, a bunch of different domains. And there were some Google cloud projects that linked the attack, linked to the attackers that allowed them to have persistent access based on a back door that they had found called grid tide. So and then one other interesting thing was that sounds like the attackers were using Google Sheets API calls for command and control purposes, so. Yeah, spreadsheets as AC2

infrastructure. Just I knew that spreadsheets were evil. I didn't know that they were used for C2. I know that's next level, yeah. It's really putting them to work for evil purposes, yeah. I know definitely did a double take at that one. And then, yeah, I mean, they also talked a little bit about kind of the group itself. And it sounds like, you know, they, I think they said like 53 victims across like 42 different countries, so. That's a lot.

Yeah. I mean, yeah, that's like, you know, one in 1/3 victims per country, which is that's a really like weird and broad distribution of victimology. You know that must be organizations that have one specific type of device or or software that these guys know how to attack or something like that. You know that they had an exploit for or some some other kind of inside access to something along those lines.

Yeah, that's a good point. And the other thing that I was curious about was that, you know, they said they Google researchers had seen this threat actor since 2017, I think. So, yeah, that's that's a long time for, you know, having setting up this infrastructure and having this campaign running. I mean, that's that's a really long time. That's a yeah. I mean, nine years, that's like a lot of the modern threatened tell that we take for granted now, like kind of wasn't really around back then. There were, you know, teams like tag and a few others doing this kind of work.

But a lot of the threatened tell teams that exist now weren't really working in 2017, you know, or those guys, those people are doing other things. So it's I think it is important. I think that or interesting, I guess that Google specifically said this is not Salt Typhoon because you know, I feel like salt Typhoon is almost become a generic phrase for threat actor that targets telecom. You know, it's like the Kleenex or the Xerox of, you know, telecom threat actors, like everything kind of gets lumped in there.

So if they're saying this is not them, I think that's interesting. Yeah, I know. That was that. That was an interesting piece of it as well for sure. Yeah, it's, but it always is like it's nice to see these these disruptions that Google and Microsoft and these other, you know, organizations that have all of this information and all of this power that they actually do some of this stuff. You know, we, we talk about these disruptions all the time and they can take different forms, you know, whether it's like legal means or simply like taking their infrastructure offline or disabling a bunch of accounts or things like that. But it's always good to see them like kind of shutting some of this crap down.

Yeah, I know. I remember, I think it was a while ago, but I wrote an article about, you know, trying to kind of crack down on abuse of accounts and things like that. And I think that ties a little bit into this because a lot of the times threat actors are trying to abuse legitimate things like, you know, in this in this side type of incident, like the Google Sheets or Google cloud projects or Google Drive or all these things to try to use them as part of their campaigns.

And it's always, I think it's, it's a powerful thing when companies are able to kind of suss out what's being used in threat operations and then crack down on that. Because like Google mentioned at the end of their, their research, they, you know, this was essentially almost a decade in the making this, this campaign. And so now, like, I mean, obviously threat actors can rebuild, but it's still like 10 years almost of things that they're going to have to build back up.

So definitely makes a dent. Yeah, for sure. They can always rebuild. That's a good point because a lot of times, you know, you see this a lot with things like bot Nets where somebody will take down a bunch of their C2 infrastructure or take over a bunch of their domains or something like that and there will be a big drop off in that bot Nets activity. But then within, you know, 10 days or two weeks or something, it spikes right back up because they can just spin up new infrastructure and kind of rebuild their their networks really quickly.

But the more you can piss off the threat actors and, you know, annoy them and disrupt their business models, the better. You know, even if it's temporary, I think it it's still good. Yeah, definitely. It's still a win. Yeah, and we need all the ones we can get these days. All right, let's talk about the pit. I talked about this last week on the podcast just because it. I remember seeing the previews for the season and noticing that they there was like a really quick thing where they're like, oh, there's a network outage.

We have to shut down the computer system. I was like, well, we're getting ransomware because this is a hospital. There's no question about it. And it took a few episodes. I think it was last week was episode 7, I think. So they, the way that this was handled in the episode just like cracked me up because there was some TV like stuff in there. But at the same time, essentially they knew that this other hospital across town had some issues so they couldn't treat patients.

So they were sending them to the pit. Nobody knew what the issue was. They were there was a betting pool on what it was. And like somebody said sinkhole, somebody said flooding. I forget what it was, but I think somebody did say computer problem. But whatever. At the end of this episode, and this is all happening on 4th of July. This is a 1 crazy day show. This CEO of this hospital rolls into the ER wearing like salmon colored shorts and like a polo shirt with like pickleball paddles on it or tennis rackets or something. And it's like, hey everybody, bad news. These two hospitals across town got hit with ransomware. We're going to shut down our network proactively so that we don't get hit with that.

And everybody like all the doctors and nurses are standing around. They're like, what are you even talking about? How, A, we don't know how to operate with like, function without a network like electronic health records and how do we ship labs away and all that kind of stuff. And B, you're just going to do this right now? Like you're like, you're telling us, and then it's going to happen. And that was kind of where that episode ended, right? And Noah Wiley's character was like, somebody take a picture of the monitor real quick. Quick.

Right. And so somebody did, but it turns out this week the picture was blurry and it was useless. So this week we get kind of a 5 minute thing at the beginning of the episode where they're like, OK, oh, the other part was the new character this season, Doctor Al Hashimi, the the who's going to take over for Noah Wiley's character when he leaves on sabbatical was like, well, they called me up to the executive office because I was trained in cyber attack prevention and recovery. And I was like, I'm sorry, what?

What are you even talking about? You're like an ER doctor. And you also like, obviously that's TV bullshit, but. And where's the IT team? Like where's the, where's the C cell? Like why are we getting the CEO? Yes. And why is he delivering this news in person? Like he just came from a BBQ? Like what? And so they essentially just have to go analogue and they're literally like writing things on charts. And all of these like student doctors who are, you know, 24 or whatever, don't know how to function without phones or computers.

Like, you know, most people don't these days. And it just kind of like leads to a bunch of chaos. But I assume there's going to be like more obviously there's going to be some more fallout from this and hopefully we'll get some sort of like actual ransom demand or something like this. But it it is just delightful to see the crossover between our one of our favorite shows and like our jobs. So good. Yeah. I love how every screen just had like a big like network disconnect logo.

The triangle warning thing with that exclamation point, yeah. So funny. Yeah. And then like the the whole like, you know, in 30 seconds, like we're gonna just shut down and like, you know, what about incident response? Like there is. Nothing. Really no incident response plan at this hospital. No, and they right, they, I guess they're their backup and recovery plan was like literally paper in a fax machine which they bring in, which was like a hilarious thing because like this older doctor like plops this fax machine down in one of the 24 year olds.

It's like, what is that thing? He's like, oh, you hook it up to a phone line and it spits out paper. I'm sure you love the line. When the what was it the student joy was like? Was this what it was like in the 1900s? My heart and I was only born in the 90s. I was laughing so hard at that, 'cause he was like, yeah, it was like, literally, yes, this is what it was like when I was an intern.

Yeah, that was a riot. I loved it and I I had so many questions about like their planning and their IT stuff. Like you said, why isn't somebody from the security department like every hospital is part of some larger healthcare chain at this point in human history. This one doesn't seem to be, it seems to like stand on its own, but still, it's a big trauma center in a major American city. They must have a security team, whether it's on site or somewhere else. Why would you have your dumb CEO, who's wearing, you know, a Vineyard Vine shirt come in and be like, hey, everybody, I've had four margaritas.

We're shutting down the network. I know that that was ridiculous. Yeah. The, and it's funny, like I'd be curious to talk to like one of our friends who is like in the security and medical like space, like like Beau Woods or someone, like someone who knows, like how this actually plays out. Because there's so much with HIPAA and everything else that you have to take into account when you make that change over from, you know, like if you're dealing with a ransomware, like even just shutting down your network, like how do you, how do you take that into account? Right.

There's two different things there. Like the HIPAA part of it. They literally rolled out a whiteboard, a dry erase board, and we're like, put all of the patients names here, their diagnosis, what their problems are, what medicines. On I was like, that is just a rolling HIPAA disaster right there. You're like, it's in full public view, you know, like what what are we doing? And yeah, there's it's crazy. And also like the the decision to just shut down the network as a way to prevent a ransomware infection is not the best approach, I don't think. Yeah, because I think I said this last week, if this, you know, ransomware group has already hit two hospitals in this town on 4th of July, the odds are very high that they're already inside of your network at the pit and they just haven't decided to push the button yet.

So whenever you turn the network back on, guess what? Ransomware. Yeah, you know. You're saying like obvious clues too, or like bread crumbs that you're going to want to have to, you know, keep your finger on as well. Just yeah. Oh. Crazy. I also like. I don't know if this is true, but I would have to believe that some medical facilities have like, offline access to records, right? Like electronic, like not air gaps, but like databases that are offline that don't require network access.

You know, like a terminal that's connected to a database or something like that so that you could do some. Yeah, I don't know, maybe it's like wishful thinking on my part, but yeah, you're too young to remember, like going into a doctor's office that just had like 10,000 medical records in it, like with the movable file shelves and all that kind of stuff. That's a real thing. Yeah, that was. But it's crazy to think about a trauma center trying to operate, especially one that's already overworked and like, you know, they have patients in the hallways and like, you know, patients wandering off into the streets and things like that. Doing this without any electronics is crazy. Yeah, I know.

I'm still cracking up when no, Wiley was like, quick, get a like picture of the board. Like it's just like so disorganized. I but I will say there were like, you know, I, I think the pit is, it's really interesting because it's like a very accurate medical show. And I wish that they had brought in someone from, you know, the IT side because they could have played it so much better. But there's still some things that they didn't get right, Like the diversion of patients from other hospitals that have been hit by ransomware is something that we definitely have seen play out in real life incidents. I don't know if they meant to do this, but like the 4th of July, the fact that it's like a holiday, like sometimes you'll see, you know, big things happen around around the holidays. I don't know, like if that's coincidental or like, or what, But that was another thing I thought about. But for the most part, you know, I think if they had someone come in and like consult on kind of

how to play this better, I think it would have been a really interesting angle. Yeah, I think they probably blew their consult budget on like all of these doctors that are, you know, actually, you know, background actors and things like that that are, you know, if you watch any of the behind the scenes stuff that HBO has on this show, it's crazy the level of like detail and training that all of the actors are going through to do like these medical procedures, you know, on camera or whatever, like resetting somebody's dislocated shoulder by like shoving your hand in there, you know, all that kind of shit. But it would have been great to have, you know, yeah, like you said, Beau or just anybody just be like, that's kind of not how that would work.

Like just, you know, make this little tweak here and might make it a little more realistic, but it is like a hyper realistic medical show. It's the one that like if you have any, I know you have doctors in your family. They're probably like, I mean, that's kind of how it works. And I've unfortunately been in enough ERS in my life as a patient that I'm like, yeah, that's how yours work. Like they're you wait a long time. And then when they see you, they're just like, let's get this person out of here as quickly as possible. Yeah, it's so true. And it's funny watching these medical shows like they're even without the cyber attack angle, like as a tech Raider. And you probably feel the same way. Like I love the fact that just like the, the playing out of like the medical jargon and like the fact that like, there's all these like very technical terms, but the way that the shows use them, you're like, Oh yeah.

Like CBC. They're like, like Asus to Leon, not like just all these terms. I have no idea what they are, but because of like the way they're presented, it just makes it so fascinating. And I think there's a lot of that within cybersecurity too, like. Oh yeah. We're writing about even though, you know, APT is a little like to someone who doesn't know what it is like, you know, might be seen as technical jargon like it's a it's a fascinating topic, so. It's very true because there's tons of yeah jargon and they, they do explain some things because they have the conceit of it being a teaching hospital. So they are explaining things to the younger doctors or whatever, even though they, you know, they're Med students, they know what they're doing.

They are explaining like, here's why we're doing this instead of this other thing. But there's lots of phrases where you're like, I've heard those words and I sort of know what they mean, but I'm not totally sure. Like this person either has like, bone cancer or a cold. I'm not positive. But yeah, that is the thing of like if you're watching a movie or a TV show that's focused on a cyber security thing, like go and watch Black Hat or CSI Cyber or something like that and you're like, Oh my God, what is happening? Yeah, I know.

It's so funny. But yeah, anyways, I'm, I'm curious if they keep going on with the cyber security plot in the future episodes. Like, I don't know why they didn't just have the hospital hit by a ransomware attack. Like that would have been so much more interesting. But maybe they're just trying to keep it, you know, medically focused. I guess so. I mean, there's got to be some resolution to it, you know, one way or the other because they have to bring this network back up online or something. But I'm, I'm really hoping we get some more of the background of Al Hashimi being a trained cyber defense person. Like, I just want to know what that's about and what her actual training was like.

What is she doing? Because she made that pronouncement? And then she just goes back to doing doctor things like what, what would why did that matter? It has no effect on anything in the hospital. I know. And I love that they took the network down like, 'cause they were like, we're going to like implement more protections. Like we're gonna like what? Yes. And I think she said at one point that this could last up to 24 hours of us trying to bolster our defenses. I'm like, wow, you're gonna get it all done in 24 hours. Oh my, what kind of defenses are we implementing here? Yeah.

Sounds great. Oh my gosh, yeah, it's, it's really. I love it. I do too. I think there's I think we have like 7 more episodes, so there should be some more stuff happening. I don't know if we'll get like an actual rant. Well, this hospital hasn't been ransomed, so we may not see that. But hopefully we'll see some sort of like, chaos coming from the computers or something, who knows? But the visuals of all of these people wandering around with clipboards now and like, knocking things over and like, forgetting to circle the diagnosis or like the :) or, you know, whatever it is on every chart is pretty funny too.

Yeah, I will say like the ending scene where you know everyone, they're just looking out and like everyone's just like bumping into each other, like you're saying, just bumbling around like that's it is. And I feel like we write about this a lot, but just the significance of critical infrastructure and how much we depend on technology and what a cyber attack could potentially mean. And I mean, like even just this week, like you dealt with like the impact of a storm in a major way.

So I'm sure like this was hitting hard for you as well. It's very true, yeah. We lost power here for like 4 days thanks to this stupid Blizzard. But it is one of those things where, like, you become so dependent on technology and not just the Internet, but like a toaster or, you know, heat. And when that all goes away, when somebody just turns that off, you're like, oh, man, what do we do now? Like, I read like 400 pages of a book, which is great. But otherwise you're just trying to like, stay warm and like figure out how to make food and like literal caveman stuff. And it, that was kind of what that last scene was like in this episode of like they, they have like kind of this, yeah, like wide shot of, you know, the 40 doctors and nurses and and orderlies and everybody in this

hub area of the ER. Just kind of like like a Three Stooges scene, like kind of bumping into and getting in everybody's way and just like staring wide eyed at like, how do we do this? I was not trained for this. Yeah, that was really interesting. It was great. This show is so great. I mean, it's I love it. It's so well made. Yeah, I love it. So this has been your medical update on the Decipher podcast. I know This is why you all come here, but it was great. So yeah, we'll, we'll keep, I'm updating on this as the show goes on, I'm sure.

I mean, like I said, there has to be a resolution one way or the other. Yeah, definitely. I'll be curious to watch it the next episode, next few episodes, see what happens. I'm really hoping there's some sort of like like hacker's esque like montage of like somebody going in through like going through code, like code like spinning through the screen or something like Al Hashimi, like typing really fast and like changing server configurations or something, but probably not. I know that would just be like the cherry on top of. Everything it would, Yes.

Yeah. All right, I'm gonna let you go because you have a baby to take care of. But thank you for coming on the Decipher podcast, Lindsay. Yeah. No, I'm glad this may be the first cybersecurity podcast with a baby in the background. I don't. I could be wrong, I don't know but. Have your other babies been on our podcast? I don't think so. I don't think so, no. Yeah, so. I What a missed opportunity by us. I know, yeah. Yeah, it worked out great.

She made some cute noises and didn't scream. Yes. All right. Great to see you and good luck with the rest of your leave all. Right. Thanks. See ya. Bye.