Save the Date for 2025 #NMFTACyber

October 26-28, 2025 | Austin, TX

We are seven months away from the 2025 NMFTA Cybersecurity Conference. Make plans to join us on October 26-28, 2025, at the Westin Downtown Austin. Join our email list and be the first to hear when registration opens.

Table of Contents

Cyberthreat Analysis

• New Side-Channel Vulnerabilities Identified Affecting Apple Infrastructure
• Growing Threat of Cybercriminals Utilizing AI for Fraud
• Russian Threat Actors Launch Phishing Campaign Targeting Signal Messaging App

Industry News

#NMFTACyber On Demand

New Side-Channel Vulnerabilities Identified Affecting Apple Infrastructure

Two new side-channel vulnerabilities have been identified affecting Apple infrastructure wherein sensitive information can be stolen from web browsers. Both flaws stem from flaws in speculative execution implementation, when a computer performs tasks before it is known to be needed in order to avoid delays. The two vulnerabilities are known as False Load Output Predictions (FLOP) and Speculation Load Address Prediction (SLAP) attacks, which aim to speed up processing which causes a system to make mistakes in speculative execution thus leaving gaps of information the attacker can exploit. The attacks are executed remotely through web browsers using malicious code hidden in webpages. 

Both of these forms of attacks utilize operations designed to decrease delays to extract information. Effectively, the attacker can grab bits and pieces of information by forcing a speculative execution implementation to guess wrong and run a process unnecessary to the function that is actually required, allowing the attacker to view that function and steal data. Through repeating these processes an attacker can build a portfolio of information that can be usable in other forms of attacks such as password spraying or phishing attacks. Additionally, these attacks can be executed remotely, granting the attacker anonymity and security. 

This form of attack does not require a malware infection of a targeted system, making it versatile and less technical. Avoiding malicious webpages and monitoring internal traffic can prevent data leakages associated with this technique. Ensuring that all systems are fully updated can also make the vulnerability harder to exploit. Apple has indicated that it is working on a security update to path the issues.

Growing Threat of Cybercriminals Utilizing AI for Fraud

Artificial Intelligence (AI) has grown into the mainstream. Threat actors have attempted to exploit it for criminal activity. AI offers new opportunities for threat actors to more easily manipulate people through social engineering with a multitude of fraud schemes. For example, analysts identified a post on the Russian hacking forum Exploit in which a user asked for recommendations of AI bots with the capability of undressing a person in a photograph. This indicates the user may engage in sextortion scams wherein the threat actor claims to have sensitive media involving a victim to extort money from the victim. Another incident occurred in Italy where scammers utilized an AI voice cloning tool to imitate the Italian defense minister's voice in an effort to extort money in a fake ransom scheme.

The use of AI to fabricate photos and videos is particularly dangerous. Recent reports indicate that a threat actor fabricated videos through AI wherein an Israel Defense Forces (IDF) spokesperson thanked Egypt for its cooperation in the recent Gaza Strip conflict. Protests over the claims of cooperation occurred in Egypt, and Israel has denied the legitimacy of these videos. Israel contests that the videos were developed in an effort to sabotage relations between Egypt and Israel to destabilize the area.

These forms of attacks are growing more frequently as AI grows in popularity. It is sometimes difficult to discern reality from fraud given AI’s rapid progression and improvements. Threat actors can utilize AI to execute social engineering attacks more frequently and with far less skill. AI will only continue to improve and AI fraud campaigns will only become more sophisticated. Confirming the legitimacy of any cyber interaction or media can mitigate the possibility of falling victim to AI fraud.

Russian Threat Actors Launch Phishing Campaign Targeting Signal Messaging App

Multiple Russian state-backed threat actors have utilized the “Linked Devices” feature provided by the Signal messaging app to conduct a device-linking phishing campaign. The campaign exploits this legitimate feature by creating fraudulent quick response (QR) codes and sending link requests or developing phishing pages to deceive potential victims into granting the threat actors access to the system. The Russian threat actor UNC4221 has specifically developed a malware kit designed to target signal groups utilized by military personnel in the ongoing Russo-Ukrainian war. Once access is granted to the threat actor, they can monitor all communications conducted through the signal account.

This form of unauthorized access has vast implications both for military personnel, as it has been observed, and private companies that conduct business through the app or utilize it for sensitive internal private communications. This form of attack does not require a device to be fully compromised as it only requires access to a viewable account. There is no technical solution for monitoring the threat of newly-linked devices to a signal network meaning the access can go unnoticed for a long period of time. Consistently reviewing connected devices on a Signal network can aid in identifying unauthorized access. 

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!