Risky Business #810 -- Data extortion attacks have a silver lining

In this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news, including:

• FBI intervenes in Scattered Spider Salesforce leaksite

• Clop loots Oracle E-Biz deployments

• Plus so much more data extortion.. At least it’s not ransomware … we guess?

• The US still can’t decide who’s gonna be in charge of NSA & Cybercom

• Cambodian scam compounds get sanctioned and $15b in crypto is seized

• NSO gets sold for pocket-lint-grade money

• Bugs! Redis CVSS 10, Ivanti, Crowdstrike and… Internet Explorer?! zeroday?! In the wild?!!!?

This week’s episode is sponsored by Stairwell. Founder Mike Wiacek talks about how Stairwell brings VirusTotal-like visibility to private files, and about integrating the insights that brings into your SOC workflow.

This episode is also available on Youtube (youtu.be/zc_t8Q3by-I).

Show notes

• FBI takedown banner appears on BreachForums site as Scattered Spider promotes leak | The Record from Recorded Future News (therecord.media/breachforums-fbi-france-takedo…)

• Dozens of Oracle customers impacted by Clop data theft for extortion campaign | CyberScoop (cyberscoop.com/oracle-customers-attacks-clop-g…)

• Well, Well, Well. It’s Another Day. (Oracle E-Business Suite Pre-Auth RCE Chain - CVE-2025-61882) (labs.watchtowr.com/well-well-well-its-another-…)

• Clop is a Big Fish, But Not Worth Hunting - Risky Business Media (risky.biz/clop-is-a-big-fish-but-not-worth-hun…)

• ShinyHunters Wage Broad Corporate Extortion Spree – Krebs on Security (krebsonsecurity.com/2025/10/shinyhunters-wage-…)

• The company Discord blamed for its recent breach says it wasn't hacked (engadget.com/cybersecurity/the-company-discord…)

• Qantas confirms cybercriminals released stolen customer data | The Record from Recorded Future News (therecord.media/qantas-cybercriminals-stolen-d…)

• Red Hat confirms breach of GitLab instance, which stored company’s consulting data | CyberScoop (cyberscoop.com/red-hat-gitlab-attack-consultin…)

• Risky Bulletin: Microsoft revamps Edge's "IE Mode" after zero-day attacks - Risky Business Media (risky.biz/microsoft-revamps-edges-ie-mode-afte…)

• Teenagers arrested in England over cyberattack on nursery chain Kido | The Record from Recorded Future News (therecord.media/kido-nursery-school-chain-hack…)

• Acting US Cyber Command, NSA chief won’t be nominated for the job, sources say | The Record from Recorded Future News (therecord.media/william-hartman-not-nominee-ns…)

• Layoffs, reassignments further deplete CISA | Cybersecurity Dive (cybersecuritydive.com/news/cisa-layoffs-reassi…)

• Trump’s scandalous directive to AG Pam Bondi reached the public by accident (msnbc.com/rachel-maddow-show/maddowblog/trumps…)

• Feds sanction Cambodian conglomerate over cyber scams, seize $15 billion from chairman | The Record from Recorded Future News (therecord.media/feds-sanction-cambodian-conglo…)

• US Congress committee investigating Musk-owned Starlink over Myanmar scam centres | Myanmar | The Guardian (theguardian.com/world/2025/oct/14/us-congress-…)

• Satellites Are Leaking the World’s Secrets: Calls, Texts, Military and Corporate Data | WIRED (wired.com/story/satellites-are-leaking-the-wor…)

• Netherlands invokes special powers against Chinese-owned semiconductor company Nexperia | The Record from Recorded Future News (therecord.media/netherlands-special-powers-chi…)

• Spyware maker NSO Group confirms acquisition by US investors | TechCrunch (techcrunch.com/2025/10/10/spyware-maker-nso-gr…)

• Apple Announces $2 Million Bug Bounty Reward for the Most Dangerous Exploits | WIRED (wired.com/story/apple-announces-2-million-bug-…)

• Wiz Finds Critical Redis RCE Vulnerability: CVE‑2025‑49844 | Wiz Blog (wiz.io/blog/wiz-research-redis-rce-cve-2025-49…)

• SonicWall admits attacker accessed all customer firewall configurations stored on cloud portal | CyberScoop (cyberscoop.com/sonicwall-customer-firewall-con…)

• SonicWall SSLVPN devices compromised using valid credentials | Cybersecurity Dive (cybersecuritydive.com/news/sonicwall-sslvpn-de…)

• Issues Affecting CrowdStrike Falcon Sensor for Windows (crowdstrike.com/en-us/security-advisories/issu…)

• ZDI Drops 13 Unpatched Ivanti Endpoint Manager Vulnerabilities - SecurityWeek (securityweek.com/zdi-drops-13-unpatched-ivanti…)

• Jaguar Land Rover launches phased restart at factories after cyber-attack | Jaguar Land Rover | The Guardian (theguardian.com/business/2025/oct/07/jaguar-la…)

• Windows 10 support ends today — here's who's affected and what you need to do (tomshardware.com/software/windows/windows-10-i…)