← Cybersecurity Today
Cybersecurity Today
Is Russia Cracking Down on Cyber Criminals? Fake Death Scams & Exposed AI Servers | Cybersecurity Today
00:13:24
Loading summary
Transcript1 lines
- [00:00]
A
Is Russia turning on its cyber crooks? Hackers fake your death to get your password. A model context protocol server exposes thousands of API keys. YouTube's ghost network spreads malware through 3,000 fake videos. And a tale of two headlines. Is AI saving cybersecurity or breaking it? This is Cybersecurity Today. I'm your host, Jim Love. In Russia, hackers have long lived by a simple rule. Don't hit Russian targets, and you'll never see the inside of a courtroom. But that unspoken pact may be cracking. In October 2024, Russian authorities arrested nearly 100 people tied to the Cryptex and the Universal Automated Payment Service, two major money laundering networks. They seized cars, property, and about US$16 million in rubles. And then, in April 2025, police detained executives from the AZA Group, a bulletproof hosting provider long favored by ransomware gangs. These arrests are shocking in a country where cybercriminals have operated with impunity, often working hand in glove with state intelligence while thumbing their noses at Western law enforcement. But future analyst Alex Leslie told security writer Nate Nelson that the long standing don't attack Russians rule is fading. He says that Moscow is acquiescing a little bit to the West. The shift follows Operation Endgame, a massive joint operation by US And European agencies that has dismantled ransomware servers and arrested key facilitators around the world. For Russia, that campaign raised the diplomatic cost of offering hackers safe harbor. And analysts say that the Kremlin's new enforcement is as much about saving face as fighting crime, signaling to Western governments that it can police its own while reminding domestic hackers who really holds the power. It's diplomacy on the surface, discipline underneath. Or, as Nate Nelson put it, sacrificing some pawns to save its queens. And there's another theory. Some of Russia's own hackers may have started hitting domestic targets, breaking the covenant. That, says researchers, may have forced the Kremlin's hand. For now, Russia's cybersecurity underground is nervous but still alive. As one analyst put it, this isn't the end of Russian hacking. It's just a reminder of who's really in charge now. For anybody who ever said, these hackers are going to be the death of me, you might be half right. There's a new phishing scam targeting LastPass users with an email claiming they've died. The Message spoofing the LastPass domain comes with a subject line. Legacy request opened, urgent. If you are not deceased. It claims a family member uploaded a death certificate to gain access to your password vault and urges you to click a link or reply stop. That link leads to an attacker controlled website that asks for your master password, and in some cases the scammers even follow up with a phone call pretending to be from LastPass support. Google's threat intelligence team has linked the campaign to Crypto Chameleon, also known as Uncle 5356, a cybercriminal group that's previously targeted cryptocurrency exchanges. The goal this time? Steal credentials and drain crypto wallets. LastPass warns users it never asks for a master password and urges anyone who's received one of these emails to forward it to abuseatlastpass.com Security experts call this one of the most creative phishing lures of the year. Our own David Shipley said it might even have been dreamed up with AI. But as David would also say, make sure your password manager uses a phishing Resistant Multi Factor Authentication or another second factor. That way, even if someone does steal your password, they still can't log in. And if you ever get an email telling you you're dead, don't panic. If you're reading it, you're still alive. But just don't click and you can paraphrase Mark Twain and say to yourself, rumors that I'd fall for rumors of my death are greatly exaggerated. A critical vulnerability in smithery AI, a registry that hosts Model Context Protocol, or MCP, servers, has exposed more than 3,000 AI servers and potentially thousands of API keys. It's just the latest in a series of security issues surrounding the Model Context Protocol, or mcp, invented by AI firm Anthropic to provide a way to integrate AI and legacy software. This exploit occurred at Smithery, a service that helps developers connect AI models to external tools and data sources, everything from local file systems to remote databases. Hence the mcp. It's a popular and convenient service, but a new report from GitGuardian found that it had a key flaw buried in the build configuration file. Developers upload a Smithery YAML that tells Smithery where to find the Docker build path. By changing that setting to dot dot, attackers could escape the project directory, a classic path traversal, and grab sensitive files from the builder machine itself. When researchers tested the exploit, they found something alarming. A Fly IO authentication token was sitting in a configuration file. The single token unlocked more than 3,200 apps running on Smithery's hosting infrastructure, including user submitted MCP servers. With that access, an attacker could execute code, intercept network traffic, or harvest client API keys, even one tied to the Brave browser git. Guardian said the impact could have rippled across the AI ecosystem because many MCP servers still use static API keys instead of more secure OAuth tokens. Smithery patched the flaw within two days of disclosure, rotated keys and tightened its build controls. Still, the episode shows how AI's new infrastructure layer these model to data connectors is quickly becoming the next big attack vector. It doesn't take much in the way of a misconfiguration to create an access disaster. Foreign researchers at Checkpoint have uncovered a massive, long running campaign they're calling the YouTube Ghost Network, a sophisticated web of fake or hijacked YouTube channels distributing malicious links disguised as cracked apps and game hacks. The operation has published more than 3,000 videos, often titled things like Free Photoshop Download or Roblox Cheat Tool. The video descriptions included links to Dropbox, Google Drive or mediafire, usually to password protected archives. Some even told viewers they had to disable Windows Defender before installing. But instead of freebies, the downloads delivered infostealers like lumastealer and Ratamanthus, designed to steal passwords, browser data and crypto wallet keys. Check Point says that the network was organized like a professional marketing campaign, with video accounts to upload content, post accounts to publish the same links, and interact accounts to flood comment sections with fake positive reviews. And even when some of these accounts were banned, others quickly replaced them, making the network resilient. Researchers say that the criminals regularly updated links, malware payloads and command and control servers to avoid detection. Google has since removed the flagged videos, but the network has been active since at least 2021, and the number of malicious uploads tripled in 2025. As Check Point put it, cybercriminals are moving beyond email phishing to exploit the trust built into social platforms. Here's a tale of two headlines that say everything about where AI stands in cybersecurity right now. Like many people in the industry, I'm of two minds about AI. On one hand, it's a transformative technology, but on the other hand, it's the biggest threat to cybersecurity we've ever seen. And that duality was emphasized for me in these two headlines. TechRadar had a headline that said 1 in 5 security breaches now thought to be caused by AI written code. And then another headline in the Register where Jen Easterly wrote AI could revolutionize cybersecurity. Now the second one really got my attention, because if you read the Register, it's not what I'd describe as an AI cheerleader. They have a reputation for at least straight talk, sometimes just plain cranky talk, and I love them for it. That headline comes from US CISA director Jen Easterly, who told a Stanford audience that AI could become the single most transformative technology for cybersecurity. She said it could help defenders move faster than attackers, automate routine patching, and even predict threats before they happen. But on the other hand, a new keto security study reported by TechRadar said that 69% of organizations have discovered vulnerabilities in AI generated code, and one in five breaches now involves AI written software. Now that's a big deal because some people are saying as much as a quarter of of all production code worldwide is already created by AI tools. Aikido's CISO Mike Wilkes put it bluntly, developers didn't write the code, Infosec didn't review it, and legal can't determine liability. It's a real nightmare of risk. And it turns out rules and resultant controls actually do matter. According to one report, AI related incidents hit 43% of US firms, but only 20% in Europe, where compliance rules are stricter. But for those who struggle with the move fast and break things culture of North America, I can see why they'd hold out hope and why 96% of companies believe AI will be writing secure, reliable code within five years. But almost all still agree it'll need some human oversight. I think about Charles Dickens when he wrote it was the best of times, it was the worst of times, and he didn't even have a word processor. So who wins? I don't know. I'd love to hear your vote on this. A quick note. Starting next week, we've agreed to take on some sponsors. Although a number of readers have been generous, the reality is we aren't covering our expenses, let alone being able to invest in some things we'd like to do now. I promise you our sponsorship will always be tasteful. It will always be at the beginning and ending of shows, never interrupting. And of course, I will not let a sponsor keep us from telling it like it is. I've built my reputation over years and years and I don't intend on losing it now. Love to hear from you. You can reach me@tech newsday.ca or.com on the contact Us page, or if you're watching this on YouTube, leave a comment under the video. I'm your host, Jim Love. Thanks for listening.