Exploring how cyber attackers are undermining trust by targeting isolated systems, hijacking hardware and exploiting the software supply chain

Key takeaways

• Attackers are exploiting assumed trust in isolation models, business workflows and software supply chains.
• Malware distribution increasingly hides inside routine enterprise activity, including hiring and development pipelines.
• Automated and self‑propagating supply‑chain threats reduce defenders’ reaction time and increase blast radius.

This Malware Brief highlights three very different threats that share a common theme: attackers are going where controls are weakest and trust is highest.

APT37 Ruby Jumper: Breaching air‑gapped systems

Key facts

• Threat actor: APT37 (aka ScarCruft), linked to North Korea
• Malware/toolkit: Ruby Jumper
• Target: Air‑gapped and segmented environments
• Initial access: Malicious files plus removable media
• Notable tactic: Cloud services combined with USB propagation

Observers have spotted APT37 using Ruby Jumper, a toolkit designed to move commands and data between internet‑connected and air‑gapped systems. Rather than relying on unusual side‑channel exploits, Ruby Jumper uses vectors that have proven reliable in many forms of attack: people, removable media and legitimate cloud services.

Researchers report that the malware stages data on USB devices and leverages cloud storage platforms for command‑and‑control, allowing instructions to move across environments whenever trusted users do the same. Barracuda threat telemetry consistently shows that removable media and trusted workflows remain recurring weak points in otherwise well‑segmented environments.

This recent blog post discusses vulnerabilities in air-gapped systems more fully.

FAUX#ELEVATE: Fake résumés, real cryptomining

Key facts

• Malware family: FAUX#ELEVATE
• Payload: Illicit Monero cryptominer
• Primary impact: Stolen CPU cycles and degraded system performance
• Distribution method: Multiple, including weaponized résumé files sent to recruiters

FAUX#ELEVATE is a reminder that malware does not need to be sophisticated to be effective. The threat installs a covert Monero cryptominer, quietly consuming CPU resources while leaving victims with sluggish performance, overheating systems and higher power consumption.

Recent reporting shows the malware delivered through fake job applications, where malicious résumé files are sent directly to HR teams. Barracuda Research telemetry regularly shows malware attempting to blend into routine business processes. Hiring workflows remain especially attractive because opening attachments from unknown senders is part of the job.

Cryptomining malware like this often persists and goes undetected longer than more disruptive threats because it avoids obvious damage. The result is a slow, accumulating cost that many organizations don’t immediately connect back to malware activity.

CanisterWorm: Supply‑chain malware that spreads itself

Key facts

• Malware: CanisterWorm
• Attack type: Supply‑chain compromise
• Target: Open‑source packages and build pipelines
• Notable behavior: Self‑propagating infection across ecosystems

CanisterWorm highlights how supply‑chain attacks continue to evolve toward automation and speed. Rather than remaining isolated in a single project, the malware actively propagates through package registries and CI/CD environments as developers unknowingly pull in infected components.

Researchers describe behavior that resembles a worm optimized for modern software development workflows. Barracuda threat data increasingly reflects this shift: Once a compromised dependency enters the ecosystem, downstream exposure can expand rapidly before defenders have visibility.

The challenge is not just detection, but containment. The longer these infections circulate through interconnected build systems, the harder recovery becomes.

Why this matters

Across these three threats, the pattern is consistent:

• Physical isolation is treated as a control instead of a risk reduction.
• Routine workflows are trusted by default.
• Software dependencies are inherited without enough scrutiny.

Barracuda’s global threat data continues to show attackers taking advantage of each of these assumptions.

BarracudaONE, our cybersecurity platform, uses advanced machine learning and a groundbreaking set of integrated capabilities to deliver total visibility, detection and response across your infrastructure, protecting your entire attack surface even as it grows more complex.

The post Malware Brief: Air gaps breached, CPUs hijacked and supply‑chain chaos appeared first on Tubesock, Inc..

What organizations miss about air‑gapped security—and how to build true resilience

Key takeaways

• Air‑gapped networks reduce exposure, but they are not immune to cyberattacks.
• Treating air gaps as perfect security can lead to blind spots and risky shortcuts.
• Research has shown exotic ways to spy on air‑gapped systems, but attackers rarely use them in the wild.
• Real‑world breaches usually rely on removable media, supply‑chain compromise and trusted users.
• Basic controls and awareness go a long way toward protecting isolated systems.

Air‑gapped networks have long been held up as the safest way to protect sensitive systems. No internet connection, no remote access, no problem. Or so the thinking goes.

In reality, that confidence often turns out to be misplaced. Air‑gapping does reduce risk, but it does not remove it. And in industrial and operational environments, where systems still need to be maintained, updated and used by real people, that gap is rarely as airtight as it looks on paper.

What air‑gapped networks are and why organizations use them

An air‑gapped network is one that is physically or logically isolated from other networks, especially the public internet. There is no Ethernet cable plugged in, no Wi‑Fi enabled and no obvious path for data to flow in or out.

You’ll typically find air‑gapped systems in places where mistakes are expensive or dangerous, including:

• Manufacturing and industrial control environments
• Critical infrastructure such as power, water and transportation
• Defense, government and research facilities
• Systems protecting valuable intellectual property

The logic is that If attackers cannot reach a system remotely, they cannot attack it. But of course, as we know from countless successful breaches, if attackers can gain physical access to a system, they don’t need remote access to carry out an attack.

Air-gapping’s core vulnerability

Even the most isolated systems still need care and feeding. Software needs updating. Logs need reviewing. Configurations change. Vendors ship new tools. Engineers carry files. Operators move reports.

Over time, isolation can begin to do too much of the security heavy lifting. Controls around physical access loosen. Removable-media policies get bent “just this once.” Trusted users stop being treated as part of the threat model.

Unfortunately, attackers understand this dynamic very well.

A digression: Exotic techniques for accessing air-gapped systems remotely

Security researchers have demonstrated some genuinely creative ways to observe or leak information from air‑gapped systems. These include techniques based on:

These methods make for fascinating demos and eye‑catching headlines. And they are useful reminders that physical isolation is not the same thing as invisibility.

But they do not turn up in real-world incident reports. They are fragile, complex and difficult to use outside tightly controlled conditions. Just as in the general cyberthreat environment, attackers generally prefer simpler, more reliable options.

How air‑gapped networks are actually breached

In the real world, air‑gapped networks are breached the same way many other systems are breached: through people, processes and things we already trust.

Stuxnet was a wake‑up call back in 2010. The malware didn’t use advanced physics to jump an air gap. It was carried in on infected USB drives by authorized users performing routine work. Nothing about the attack required an internet connection.

That lesson stuck. Modern campaigns targeting air‑gapped environments often follow a familiar pattern:

• Compromise a connected system first
• Use it to seed malicious files onto removable media
• Wait for that media to be carried into an isolated system
• Collect data or stage payloads until the path reverses

Recent, well‑documented attacks show how effectively this approach still works, especially in operational technology environments where removable media remains a practical necessity.

Beyond USB‑based attacks, breaches of air‑gapped systems commonly involve:

• Supply‑chain compromise through trusted software or installers
• Insider activity, whether malicious or simply rushed
• Social engineering that convinces someone to bend the rules

None of this is exotic. All of it is predictable. And that is exactly why it works.

How to reduce risk

Air‑gapping still has value. It just needs backup.

Organizations can meaningfully reduce risk by tightening the controls that sit around isolated systems, including:

• Strict removable‑media discipline
  Limit approved devices, scan everything and eliminate personal USB drives altogether.
• Targeted security awareness training
  Make sure staff understand that removable media and installers are not harmless and are often how attacks start.
• Minimal access by design
  Restrict who can interact with air‑gapped systems and make those interactions visible and auditable.
• Controlled transfer workflows
  Treat every file crossing the air gap as untrusted until proven otherwise.
• Monitoring and readiness
  Even offline systems generate signals. Monitor them to detect anomalous activity.

For teams with limited resources, the biggest improvements usually come from fixing everyday behaviors rather than chasing edge‑case threats.

How Barracuda Managed XDR can help close the gap

Air‑gapped environments often fall outside traditional monitoring and detection workflows. Visibility is limited. Telemetry is sparse. When something does go wrong, it can take time to connect the dots.

Barracuda Managed XDR combines expert human insight with AI-enhanced automated detection and response to cyber incidents. It’s designed to help resource-constrained teams protect complex environments, even when parts of the infrastructure are isolated. By combining expert‑led monitoring with unified visibility across endpoints, networks and cloud services, Managed XDR helps surface suspicious activity that might otherwise go unnoticed, including signs that attackers are attempting to bridge isolated systems through removable media or trusted processes.

The goal is not to eliminate air gaps. It is to support them with better insight and faster response. For teams responsible for critical or operational systems, that added visibility helps turn isolation into part of a broader, more resilient security strategy rather than a single source of confidence.

Air-gapping is just a security control

Air‑gapped networks definitely reduce risk, but they cannot eliminate it.

Attackers already understand how isolated environments really function. Defenders need to be just as realistic. When isolation is paired with strong operational controls, user awareness and layered detection, air‑gapped systems become harder targets. And hardening your entire attack surface is a key element of true cyber resilience.

The post Why air gapped networks aren’t as secure as you think appeared first on Tubesock, Inc..

How non-human accounts are reshaping cybersecurity risks in manufacturing and industrial Networks

Takeaways

• Machine identities are non-human accounts that systems, applications and devices use to authenticate and communicate.
• They now outnumber human identities by a wide margin and are far harder to track and govern.
• Poorly managed machine identities increase the risk of breaches, downtime and supply‑chain attacks.
• Manufacturing and industrial environments are especially exposed due to connected equipment, legacy systems and vendor integrations.
• Small IT teams can reduce risk with basic visibility, lifecycle management and monitoring.

What are machine identities?

When we talk about identity in cybersecurity, most people think about users logging in. But modern IT environments rely on a far larger and less visible population of non‑human identities.

Machine identities are the credentials that applications, scripts, APIs, cloud workloads, industrial devices, and automation tools use to authenticate. They include service accounts, API keys, certificates, tokens, and embedded credentials that let systems communicate automatically and continuously.

In manufacturing, this might include production systems pulling data from ERP software, industrial controllers updating configurations, remote monitoring tools, or third‑party vendors accessing plant networks. These identities are essential for efficiency and uptime, but they also introduce risk.

Why machine identities are a growing cybersecurity problem

The challenge isn’t that machine identities exist. It’s that most organizations, especially those with limited IT resources, don’t have clear visibility or ownership over them.

Machine identities now vastly outnumber human users, and many are created automatically as cloud and industrial environments scale. Unlike people, machines can’t use MFA, credentials often aren’t rotated, and service accounts may run over-privileged “just in case.”

Common risks include:

• Hard‑coded or long‑lived credentials embedded in scripts or systems
• Over‑permissioned service accounts that violate least‑privilege principles
• Orphaned identities that remain active long after systems change
• Minimal monitoring of machine behavior because activity looks “normal”

Attackers have noticed these risks. Machine identities are increasingly targeted because they provide quiet, persistent access without triggering the alarms designed for human users.

Machine identities and supply‑chain risk

Machine identity risk and supply‑chain attacks are closely linked — especially in manufacturing.

Industrial environments depend heavily on third‑party software, managed service providers, system integrators, and equipment vendors. Each relationship often comes with its own credentials, service accounts or API access. If one supplier is compromised, attackers may inherit access downstream.

Manufacturing‑focused research highlights that machine identities tied to APIs, certificates and automation tools are among the most attractive targets for attackers because breaching them can lead to outages, data exposure or operational disruption.

Practical ways small IT teams can reduce risk

You don’t need an enterprise IAM overhaul to make progress. For small teams, a few basics go a long way:

1. Get visibility first
   Inventory service accounts, APIs and certificates. If you don’t know what exists, you can’t secure it.
2. Reduce privileges
   Limit machine identities to only the access they actually need, especially in production and OT-adjacent systems.
3. Rotate and expire credentials
   Eliminate hard‑coded and long‑lived secrets where possible, and set ownership for each identity.
4. Monitor behavior, not just logins
   Unexpected system‑to‑system activity can be an early indicator of compromise.
5. Treat vendors as identity risk
   Review what machine access third parties have, and disable what’s no longer required.

These steps won’t eliminate risk, but they will dramatically reduce the chance that a quiet machine identity becomes your next entry point.

Barracuda can help

For SMBs and manufacturers with limited resources, security tools that improve visibility and monitoring across identity‑driven activity can help close gaps without adding operational burden. The BarracudaONE cybersecurity and resilience platform is designed to support lean IT teams by improving visibility, detection and response across modern, connected environments to build resilience, even as machine identities continue to grow.

Barracuda SecureEdge reduces exposure with consistent, policy-based access and segmentation across users, sites and cloud resources, while Barracuda Managed XDR continuously detects and responds to suspicious machine-account activity that can signal compromised keys, tokens or certificates. 

The post Machine identities: The invisible cyber risk you probably aren’t managing appeared first on Tubesock, Inc..