Subscribe to The Audit Brief, where we break down the latest episode of The Audit Podcast.
Tune into the full episode to hear IT Audit Labs’ Director of Business Operations Kelly Venzke join the show for the first time, plus the crew’s takes on state fair food, Blackstone grills, and whether black coffee is actually a longevity hack.
The Real Talk:
- Why the “air-gapped” water systems across 27+ states weren’t actually air-gapped—and how nation-state actors got the administrative passwords anyway
- The new help desk scam making the rounds: fake IT support calling in over Teams from outside your organization
- How attackers are using blockchain itself as a command-and-control infrastructure, hidden inside a paid search ad
A Closer Look:
The Air Gap That Wasn’t Minnesota was among at least 27 states where nation-state threat actors gained access to programmable logic controllers at water facilities, reportedly using legitimate administrative passwords. Eric Brown, CISSP draws the comparison to Stuxnet back in 2009, except this time nobody needed to smuggle in a USB drive. The systems labeled “air-gapped” had a proxy connection to the internet the whole time. The goal wasn’t contaminating the water. It was disruption, and the fear that comes with a boil water alert.
The Help Desk Call You Didn’t Ask For A security researcher published a public library mapping out how North Korean, Iranian, Russian, and Chinese threat actors typically break in, tradecraft and all. One pattern Eric’s team has seen firsthand: attackers impersonating help desk staff over Teams-to-Teams calls placed from outside the organization, talking their way into remote control, then quietly installing tools for persistence. The fix is more straightforward than the attack: block external Teams calls.
Blockchain as the Getaway Car Dubbed EtherHiding, this technique uses Ethereum’s decentralized structure to keep command-and-control infrastructure alive even after the staging servers get taken down. The delivery mechanism is a paid search ad on Google or Bing, aimed at IT administrators searching for legitimate tools. Click the wrong link at the top of the results, and the payload rides in behind it. Eric’s take: protection has to move into the browser itself, not just antivirus.
Daily Drivers and Browser Hygiene Old habits are still doing damage: admins logging into servers with everyday accounts instead of dedicated admin credentials, browsers saving passwords, and now LLM extensions adding a new layer of exposure. The team’s advice is simple. Run your LLM browser extension in its own isolated profile, separate from email and other logins.
Bottom Line: Nation-state actors don’t need to break down the front door when a mistyped search for the wrong software update, a spoofed help desk call, or a password saved in Chrome will do the job. Every story on this episode shares the same throughline: patience, persistence, and a willingness to exploit ordinary workflows. Segmenting networks, isolating browser extensions, and training people to question the “helpful” call are still the fundamentals worth getting right.
🔗 Ep 95 – The Air Gap Was Never Real: Inside the Minnesota Water Supply Hack
Listen wherever you get your podcasts – Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news.
Learn more at www.itauditlabs.com
