Risky Business #791 -- Woof! Copilot for Sharepoint coughs up creds and keys

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

• Struggling to find that pesky passwords.xlsx in Sharepoint? Copilot has your back!

• The ransomware ecosystem is finding life a bit tough lately

• SAP Netweaver bug being used by Chinese APT crew

• Academics keep just keep finding CPU side-channel attacks

• And of course… bugs! Asus, Ivanti, Fortinet… and a Nissan LEAF?

This week’s episode is sponsored by Resourcely, who will soothe your Terraform pains. Founder and CEO Tracis McPeak joins to talk about how to get from a very red dashboard full of cloud problems to a workable future.

This episode is also available on Youtube (youtu.be/eShq_dvwWiA).

Show notes

• Exploiting Copilot AI for SharePoint | Pen Test Partners (pentestpartners.com/security-blog/exploiting-c…)

• MrBruh's Epic Blog (mrbruh.com/asusdriverhub)

• Ransomware group Lockbit appears to have been hacked, analysts say | Reuters (reuters.com/technology/ransomware-group-lockbi…)

• "CONTI LEAK: Video they tried to bury! 6+ Conti members on a private jet. TARGET’s birthday — $10M bounty on his head. Filmed by TARGET himself. Original erased — we kept a copy." (x.com/GangExposed/status/1919741718338936980)

• Mysterious hackers who targeted Marks and Spencer's computer systems hint at political allegiance as they warn other tech criminals not to attack former Soviet states (dailymail.co.uk/news/article-14699457/hackers-…)

• The organizational structure of ransomware groups is evolving rapidly. (coveware.com/blog/2025/4/29/the-organizational…)

• SAP NetWeaver exploitation enters second wave of threat activity (cybersecuritydive.com/news/sap-netweaver-explo…)

• China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures (blog.eclecticiq.com/china-nexus-nation-state-a…)

• DOGE software engineer’s computer infected by info-stealing malware (arstechnica.com/security/2025/05/doge-software…)

• Hackers hijack Japanese financial accounts to conduct nearly $2 billion in trades (therecord.media/hackers-hijack-japan-finance-a…)

• FBI and Dutch police seize and shut down botnet of hacked routers (techcrunch.com/2025/05/09/fbi-and-dutch-police…)

• Poland arrests four in global DDoS-for-hire takedown (therecord.media/poland-arrests-four-ddos-hire)

• School districts hit with extortion attempts after PowerSchool breach (nbcnews.com/tech/security/school-districts-hit…)

• EU launches vulnerability database to tackle cybersecurity threats (therecord.media/eu-launches-vulnerability-data…)

• Training Solo - vusec (vusec.net/projects/training-solo)

• Branch Privilege Injection: Exploiting Branch Predictor Race Conditions – Computer Security Group (comsec.ethz.ch/research/microarch/branch-privi…)

• Remote Exploitation of Nissan Leaf: Controlling Critical Body Elements from the Internet (i.blackhat.com/Asia-25/Asia-25-Evdokimov-Remot…)

• PSIRT | FortiGuard Labs (fortiguard.fortinet.com/psirt/FG-IR-25-254)

• EPMM Security Update | Ivanti (ivanti.com/blog/epmm-security-update)