Daily Briefing for 05.07.25

At a glance.

• NSO Group ordered to pay $167 million after losing WhatsApp lawsuit.
• CISA warns of unsophisticated threat actors targeting ICS environments.
• iHeartRadio stations breached.

NSO Group ordered to pay $167 million after losing WhatsApp lawsuit.

A California jury has ordered Israeli spyware company NSO Group to pay more than $167 million for its role in the hacking of 1,400 WhatsApp users' phones, concluding six years of litigation. According to the Washington Post, NSO must pay WhatsApp owner Meta $167,256,000 in punitive damages and $440,000 in compensatory damages.

NSO Group maintains that its Pegasus spyware is meant for use by law enforcement and government agencies to pursue criminals and terrorists, but the company has been widely criticized for selling the tool to authoritarian governments known for targeting members of civil society. The judge refused to allow NSO to introduce evidence related to governments using Pegasus to target bad actors, stating, "Defendants cannot claim, on the one hand, that its intent is to help its clients fight terrorism and child exploitation, and on the other hand say that it has nothing to do with what its client does with the technology, other than advice and support."

Meta said in a statement, "The jury’s decision to force NSO, a notorious foreign spyware merchant, to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and the privacy and security of the people we serve."

NSO said it will probably appeal the decision.

CISA warns of unsophisticated threat actors targeting ICS environments.

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a joint advisory with the FBI, the EPA, and the Department of Energy, warning of an increase in "unsophisticated cyber actors" targeting ICS/SCADA systems within US critical infrastructure. Specifically, the attacks are targeting energy and transportation systems in the oil and natural gas sector. The advisory notes, "Although these activities often include basic and elementary intrusion techniques, the presence of poor cyber hygiene and exposed assets can escalate these threats, leading to significant consequences such as defacement, configuration changes, operational disruptions and, in severe cases, physical damage."

The agencies have published guidance to help critical infrastructure entities secure their systems.

iHeartRadio stations breached.

US mass media corporation iHeartMedia has disclosed that several of its radio stations were breached in December, the Record reports. According to a breach notification letter, the incident exposed "Social Security numbers, tax identification numbers, driver’s license numbers, state identification card numbers, passport numbers, financial account numbers, and/or payment card numbers." The company hasn't disclosed how many people were affected or which stations were hacked.

A spokesperson told the Record, "iHeartMedia + Entertainment, Inc. discovered and addressed an incident involving unusual activity on some systems at a small number of our local stations. Upon detecting the activity, we took immediate steps to block it; triggered our incident response protocols; and launched an investigation with the assistance of a third-party cybersecurity firm. We also notified law enforcement."