EP:16 A New Era of Cyber Warfare Just Began

This week, we break down four major cybersecurity stories shaping the threat landscape in Australia and around the world.

We examine how the NDIA defended against the TeamPCP software supply-chain attack, including the risks hidden inside CI/CD pipelines, GitHub Actions and exposed build credentials. We look at the US Government’s push to use private cybersecurity companies in offensive operations against overseas cybercriminals, and what that means for attribution, hack-back and cyber warfare.

We also dive into newly disclosed Microsoft Copilot security flaws, including prompt injection, OAuth abuse, AI agents and data exfiltration from connected services. Finally, we explore how Australia and Thailand are strengthening cooperation against cybercrime, scam centres, cryptocurrency laundering and transnational fraud.

A technical but accessible breakdown of cybersecurity news, AI security, supply-chain attacks, cloud security, cybercrime, Microsoft Copilot and offensive cyber operations.

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: cyberinvestigationsau@gmail.com

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

Transcript

SPEAKER_00 0:02

Welcome back to the podcast. This week we're looking at an Australian government agency that was caught up in the blast radius of a compromised security tool. We're also looking at the United States, and it is preparing to let private security companies conduct government authorized offensive cyber operations. We're also looking at researchers that have discovered that Microsoft Copilot could be tricked into using its own trusted connections. And finally, Australia and Thailand are expanding cooperation against the industrial-scale cyber scam operations operating across Southeast Asia. So let's jump into the first story, firstly to Australia, where the National Disability Insurance Agency, or the NDIA, says its security controls stopped a potentially serious software supply chain compromised from turning into a larger breach. The incident actually traces back to March when the threat actor, which for those who have probably heard of it, Team PCP, compromised Trivi. If you didn't know, Trivi is a popular open source vulnerability scanner from AquaSecurity. The irony here is worth appreciating. The organization was running this software designed to detect vulnerabilities. And the vulnerability scanner itself became the malware delivery mechanism. The NDIA says it detected the activity within hours, reset effective credentials, and prevented the attackers from accessing protected sensitive or participant information. But security researchers later found NDIA-related credentials among a huge archive attributed to the Team PCP campaign. IT News reported that the archive contained 175 NDIA CI runner dumps, including large numbers of Java Web Tokens or JWTs, and GitLab CI job tokens. Many were short-lived, it seems, and had already expired, which is good, although some classes of secrets potentially require explicit rotation. So hopefully NDIA did what was needed in quick enough time. This is classic Team PCP. Very DevOpsy, very GitHub actions, all up in CICD pipelines. And it got me interested in you know what are the technical details because this is classic Team PCP. So let's unpack what's actually happened here a little. A CICD runner is an incredibly valuable target. Makes sense as to why Team PCP goes for targets such as this. Think about what happens when something like GitLab CI or GitHub Action builds your software. The runner may need access to source code, container registries, AWS or Azure credentials, Kubernetes clusters, and so on and so forth, mainly package repositories and deployment infrastructure. So although the runner might only exist to perform a build, during that build it can temporarily become one of the most privileged machines in your organization. And this is just exactly what Team PCP thrives off. Aqua's investigation found that attackers had force-pushed malicious commits behind existing trivi version tags. So an organization might have thought, we're safe, we've pinned our pipeline to this particular version, which is common practice, right? Except a git tag such as version 0.34.0, in which this case it may have been, is essentially a pointer to a commit, right? If an attacker controls the repository and can move that pointer, the label can remain identical while the code underneath it changes. The security review write up by Aqua says 75 triviactions tags were poisoned in exactly this way. The attackers even copied author names, email addresses, timestamps, and commit messages from legitimate releases to make the history look convincing. The more robust defense is pinned the more robust defense is pinning critical third party actions to a verified full commit hash because that identifies the actual code rather than an immutable label. But the payload itself is even more interesting in this case. So what happened was on GitHub hosted Linux runners, the malware looked for a runner. And inspect the forward slash proc file. So Linux exposes information about processes through the pseudo file system. The quote unquote forward slash proc. That includes things like memory maps and depending on permissions, process memory. The malware passed, and the file name of this is forward slash proc forward slash maps to find readable memory regions and then dumped data through that same file path except to a different file path that ended in forward slash MEM or MEM. It searched the.NET worker process for GitHub Actions, internal representation of secrets. On self-hosted runners, it went broader. SSH keys, AWS credentials, GCB credentials, Kubernetes config, and Docker authentication, terraform state, and even shell history. Then it encrypted the collection using AES two five six, CBC, protected the session material, while attacker's RSA four zine six public key and exfrated the encrypted bundle. After stealing everything, it still ran a legitimate trivi scan so the pipeline could appear perfectly normal. Folks, pay attention to that last detail because it's quite important and really is indicative of PCP, team PCP attribution. Good malware doesn't always crash the system. Sometimes the most effective malicious code is code that lets everything continue working. For defenders, the lesson is that CICD infrastructure needs to be treated as production infrastructure. Short-lived credentials, minimum runner permissions, restrict outbound network access, immutable dependencies, and serious monitoring around build systems. So to cap up this final story, the NDIA appears to have contained the compromise quickly, thank goodness for that. But this incident, I think, shows why software supply chain attacks have such enormous leverage and why Team PCP has had such success as of late. Compromise One Trusted Component, you potentially inherit the permissions of every organization that runs in it. Let's quickly move on to story two. On August 12, US President Donald Trump signed a memorandum establishing a framework under which vetted American companies can perform cyber operations against foreign cyber-enabled transnational criminal organizations under US government direction and oversight. This changes a lot. This is much more significant than ordinary threat intelligence sharing. The release document by the US government distinguishes between cyber surveillance operations and cyber effect operations. Surveillance means, you know, I think in this context, covertly accessing systems without the owner's permissions to collect intelligence. It's the effects wording that is quite telling. Effects operations go further than that. So this is a whole nother ball game we have now found ourselves in. Interestingly, the memorandum explicitly defines them as operations that can result in the manipulation, disruption, denial, degradation, and destruction of information systems, networks, or data. In practical cybersecurity terms, imagine infiltration of a ransomware C2 environment. This could include identifying back-end servers, tracing cryptocurrency infrastructure or gathering intelligence from an administrative panel. An effects operation could then move beyond observation into disrupting the infrastructure itself. But I think there's an important distinction here that it is even more if you read between the lines. This isn't a general license for companies to conduct vigilante, you know, quote unquote, hackback operations or letters of mark. The program is being put under federal control. Participating companies must be vetted, potentially maintain at least a $1 million bond or escrow. So clearly it's not open to everyone. And each cyber operation package requires a written approval from the government. Seems sensible. And detailed operation procedures are due within 60 days of the memorandum. And one technical problem is going to dominate this entire concept in reading this memorandum, which is attribution. Cyber infrastructure rarely maps cleanly to a single criminal. For example, a ransomware operator in Russia might use a compromised VPN in Germany. A botnet containing routers in Australia, a domain registered through American Registrar, and a cryptocurrency infrastructure spread across several jurisdictions. Destroy the wrong server, and you might actually be destroying an innocent organization's compromised infrastructure. There is also operational deconfliction. Imagine the FBI has secretly compromised a ransomware server to gather intelligence, say, while a private operator working for another government program decides to knock that same server offline. You've just destroyed your own intelligence collection platform. So you could see good-intentioned operations bump up against each other. The White House memorandum specifically calls out a deconfliction across law enforcement, intelligence agencies, state, treasury, and other government organizations. So the most interesting part of the story isn't simply that private companies could be allowed to hack criminals. It's that offensive cybercapability may become something governments can procure and coordinate from industry in a much more formal way. It'll almost certainly increase speed and capacity for offensive operations, which I think is ultimately a positive step forward. Countries, particularly outside of the Five Eyes remit, have already been doing this. And it's it's high time that Five Eye countries probably started stepping up their game. So that's a good thing, I would say, on net. Of course, however, each operation depends on the outcomes. This creates an enormous government, governance and attribution problem if anything does go wrong, which it probably inevitably will. Regardless of the outcomes, I am here to see all these cybers in action. Let's quickly move on to story three, where Microsoft Copilot could turn one click into data exfiltration. So let's see what's going on here. Researchers at Veronis discovered three vulnerabilities affecting Microsoft Copilot, the personal subscription, collectively called Co-Snitch. This has been associated with CVE 2026-42301. Microsoft patched the issue on August 18th, and Veronus says it hasn't seen evidence of exploitation in the wild. However, the attack chain is fascinating. So let's unpack what's going on here. Because the researchers have effectively convinced Copilot to explain how to attack itself. Classic LM gelbreak. So what they did was they repeatedly asked why automatic execution of a prompt wasn't possible. Copilot kept explaining why the feature was safe, but those explanations gradually revealed details about its architecture until it disclosed an undocumented parameter called auto-run equals one. So normally copilot could receive a URL containing a Q parameter that pre-populated a prompt. Sometimes conceptually like copilot.microsoft.com forward slash question mark q equals do something. That's what it looks like if you are copilot. Normally a user still needed to submit it, but combining Q with auto-run equals one cause the supplied prompt to execute automatically when the page loaded inside an already authenticated copilot session. This is effectively prompt injection URL injection. And that changes the security model completely. And it seems that once that happens, now the attacker doesn't necessarily need to steal, for example, an OAuth token. They don't need to steal a Gmail password. From that point, an attacker could potentially persuade your trusted copilot session to access those systems for the attacker on that end. So you've authorized Copilot to access Gmail, Calendar, or any other systems connected to Copilot within a network, OAuth has already delegated those permissions. The vulnerability effectively broke an important assumption inside Microsoft security. And that was that the system assumed requests using those permissions originated from the user, which was not the case. And once a malicious prompt executed, researchers demonstrated that Copilot could retrieve information from connected services, place that stolen information into its context, base 64 encode it, insert that encoded data into a URL, and then use Copilot's legitimate WebFest functionality to request the attacker's URL at the network layer. That can look, you know, remarkably boring. It's just Copilot performing an outbound HTTPS GET request, something it legitimately does do when retrieving web pages. This is really interesting technical work, and I think this illustrates an emerging AI security principle that we all do know by now, and that an AI-aided attack service is the sum of every tool it can call. Given LLM access to, you know, an MCP server out to email, calendar, web access, file access, or persistent memory, and you've effectively created a privileged software identity sitting across multiple security domains. The Verona's write-up also demonstrated a separate indirect prompt injection. Problems yeah, problem involving persistent memory. So what happens here is a malicious instruction could be placed inside a web page content. If Copilot summarized that the web page wasn't merely data anymore. It contained instructions that could influence the model. That's fundamentally a challenge with LM security that is continually emerging. Traditional software has reasonably clean distinction between code and data. Large language models, on the other hand, don't naturally understand that distinction. And to the model, an email saying ignore previous instructions and do X and a user saying do X are ultimately both sequences of tokens. Security has to be imposed by the architecture surrounding the model. And as an AI assistant becomes an agent with more connectors and more authority, that distinction is going to become incredibly important. Let's quickly move on to the fourth and final story of today. Australia and Thailand have agreed to deepen cooperation against transnational crime, with particular focus on technology-enabled scams, cybercrime, and financial fraud and money laundering. If you couldn't tell by now, from the accent, I live in Australia, and I think this is a good first step for Australia and our cooperation, particularly among Southeast Asian cyber criminal operations. If you haven't heard of the term pig butchering, it's a whole new economy that is emerging primarily in Laos, but a number of other Southeast Asian countries, and it's becoming a very significant problem. And while this agreement doesn't specifically resolve that issue, I think it's a step in the right direction. So the agreement evolves Australian and Thai law enforcement, customs, immigration, and financial intelligence agencies, alongside existing AFP cooperation with the Royal Thai Police and Thailand's anti-cyber scam center. And it's important because we're increasingly talking about in industrialized criminal ecosystems that have popped up in those pig butchering operations I previously mentioned. How these operations typically work is that they need domains, they need burner phones, social media accounts, payment infrastructure, money mules, bank accounts, all of this infrastructure to set up the cyber scam operations. And in some cases, Southeast Asian trafficking networks supplying the people operating the scams. That means disruption has to happen across the graph rather than simply arresting the person typing the message. And our financial intelligence agency might identify wallets and bank accounts. Police might identify operators. Immigration data can help establish movement across borders of these financial. And so I think this is exactly what is required to stamp out some of those pig butchering operations that we're seeing in Southeast Asia. So hopefully we see some results from this. And I'll be paying attention to uh the developments in this space. That effectively wraps up our four stories for today. Uh, drop a comment in the podcast comment section. I very much enjoy interacting with listeners out there. Thank you for listening. See you next time.