Risky Biz News: Four PR firms are behind a Chinese propaganda network

Summary

Risky Business News: Four PR Firms Behind a Chinese Propaganda Network Podcast Episode Released on November 24, 2024

Host: Claire Aird
Prepared by: Catalyn Kimpanu
Podcast: Risky Business News
Host/Author: risky.biz

---

1. Chinese PR Firms Manipulating International Narratives

Summary:
Google has identified four Chinese public relations (PR) firms orchestrating a widespread propaganda network. These firms manage hundreds of news websites that disseminate pro-Beijing content intertwined with benign information to reach international audiences. The content primarily focuses on promoting China's territorial claims in the South China Sea and Taiwan, spreading conspiracy theories, and launching personal attacks against government critics.

Key Points:

• Content Strategy: The websites publish repetitive, low-quality articles that mix propaganda with regular news to manipulate public perception.
• Social Media Manipulation: One of the PR firms employed Fiverr users to amplify their articles on social media platforms.
• Coordination Efforts: Although each PR company operates as a separate legal entity, their similar operational methods suggest coordinated efforts to disseminate propaganda.

Notable Quote:

"Google says the network is large but publishes repetitive, low quality articles." – Claire Aird [04:35]

Actions Taken:

• Google has removed the implicated domains from its search and news indexes to curb the spread of propaganda.

---

2. Salt Typhoon Espionage Targeting U.S. Telecommunications

Summary:
The FBI has alerted nearly 150 victims about breaches perpetrated by the Chinese espionage group Salt Typhoon. This group targeted U.S. telecommunications providers by infiltrating their lawful intercept systems.

Key Points:

• Geographical Focus: Most victims are based in the Washington D.C. area.
• Discovery of Breaches: The breaches were uncovered after Microsoft identified anomalies within the networks, specifically on servers linked to Salt Typhoon.
• Criticism of Telcos: Government officials have criticized U.S. telcos for failing to upgrade outdated networking equipment, some of which are decades old, making them vulnerable to such attacks.

Notable Quote:

"The U.S. government and the telcos learned of the breach after Microsoft notified them of anomalies on their networks." – Claire Aird [09:15]

Actions Taken:

• The FBI has notified the victims and is likely coordinating with telcos to address the vulnerabilities exploited by Salt Typhoon.

---

3. Russian APT 28's WiFi-Based Cyber Espionage

Summary:
A Russian cyber espionage group, identified as APT 28 within the GRU (Russia's military intelligence agency), executed a sophisticated WiFi attack against a U.S. company. This breach occurred just before Russia's invasion of Ukraine, aiming to gather intelligence related to Ukrainian projects and individuals.

Key Points:

• Attack Method: The group leveraged a "nearest neighbour attack," connecting to the victim's WiFi network using a compromised laptop placed across the street.
• Objective: Data collection focused on Ukrainian-related information to support Russian military efforts.

Notable Quote:

"Security firm Velexity called this technique the nearest neighbour attack." – Claire Aird [12:45]

Actions Taken:

• Velexity attributed the intrusion to APT 28 and is likely working with affected companies to mitigate the breach and enhance security measures against similar tactics.

---

4. Thailand's SMS Scam Crackdown

Summary:
Thai authorities have apprehended a 35-year-old Chinese national responsible for dispatching over a million scam SMS messages. The suspect utilized a mobile radio base station installed in his vehicle to conduct the operation.

Key Points:

• Modus Operandi: The SMS messages falsely represented themselves as communications from AI systems, misleading recipients.
• Larger Network: The individual was part of an expansive group that registered local companies to secure phone numbers for mass spamming.
• Impact: The scam primarily targeted Thai citizens, exploiting the country's largest Internet service provider.

Notable Quote:

"Officials say the suspect was driving around Bangkok using a mobile radio base station installed in his car that sent out the SMS messages." – Claire Aird [16:30]

Actions Taken:

• The arrest underscores Thailand's efforts to combat large-scale SMS scams and protect citizens from fraudulent activities.

---

5. Breach of Andrew Tate's Real World Website

Summary:
Hackers successfully infiltrated the website of "The Real World," an online course platform founded by Andrew Tate, formerly known as Hustlers University. The breach resulted in the leakage of 325,000 user email addresses and the inundation of the site's main chat room with emojis related to LGBTQ and feminism.

Key Points:

• Data Compromised: Email addresses of 325,000 users were exposed.
• Disruption: The chat room experienced a flood of specific themed emojis, disrupting normal operations.
• Revenue Impact: As a significant revenue stream for Andrew Tate, the breach could have financial repercussions.

Notable Quote:

"The hackers leaked the email addresses of 325,000 users and flooded the site's main chat room with LGBTQ and feminist themed emojis." – Claire Aird [19:10]

Actions Taken:

• The platform's security measures are likely being reviewed and enhanced to prevent future breaches.

---

6. Massive Data Leak from Irish NHS Employees

Summary:
A misconfiguration within the Microsoft Power Pages platform led to the exposure of personal records of over a million employees from the Irish National Health Service (NHS). The leaked data included email addresses, phone numbers, and home addresses.

Key Points:

• Cause of Leak: Misunderstanding of access controls by website administrators resulted in improper exposure of private data via APIs.
• Affected Organizations: The Irish NHS was one of several entities impacted by similar vulnerabilities within the Microsoft Power Pages platform.
• Discovery: Security firm Appomny identified the leakage, highlighting systemic issues with data protection protocols.

Notable Quote:

"Microsoft says the leak took place because website admins misunderstood how access controls work on the Power Pages platform." – Claire Aird [21:50]

Actions Taken:

• Organizations using Microsoft Power Pages are urged to review and correct their access control configurations to safeguard sensitive information.

---

7. International Game Technology (IGT) Cyberattack

Summary:
International Game Technology, a prominent gambling machine company, experienced a cyberattack on November 17th. The breach compromised internal systems and applications, though its impact on the company's financial performance remains uncertain.

Key Points:

• Nature of Attack: The hack targeted internal infrastructures, potentially disrupting operations.
• Current Status: IGT is assessing the extent of the damage and its implications for the company's overall performance.

Notable Quote:

"IGT says the hack affected internal systems and applications and that it was unclear if this would affect the company's bottom line." – Claire Aird [24:05]

Actions Taken:

• IGT is likely collaborating with cybersecurity experts to remediate the breach and strengthen defenses against future attacks.

---

8. Italy Fines Fudinho for Privacy Violations

Summary:
Italy's Data Protection Agency has imposed a €5 million fine on Fudinho for unlawfully tracking drivers' geolocation data outside of working hours. Additionally, the company has been prohibited from processing drivers' biometric data used for authentication.

Key Points:

• Privacy Breaches: Unauthorized tracking of driver locations and misuse of biometric data.
• Company Background: Fudinho operates under the Glovo group, a major player in the food delivery sector.
• Previous Infractions: This is Fudinho's second fine in Italy, having been fined €2.6 million in 2021 for using algorithms to measure employee performance.

Notable Quote:

"The agency has also banned the company from processing drivers biometric data, which the company uses for driver authentication." – Claire Aird [26:30]

Actions Taken:

• Fudinho must comply with the Data Protection Agency's directives to cease infringing practices and enhance data privacy measures.

---

9. U.S. Senators Request Investigation into VeriSign's Pricing Practices

Summary:
U.S. Senators Elizabeth Warren and Jerry Nadler have formally requested an investigation into VeriSign by the Department of Justice and the National Telecommunications and Information Administration. The inquiry centers on VeriSign's alleged monopolistic behavior through predatory pricing of .com domain registrations.

Key Points:

• Pricing Controversy: VeriSign recently increased .com domain prices by 30% without any corresponding enhancements in service quality.
• Allegations: The Senators describe the price hike as evidence of monopolistic practices within the domain registration market.

Notable Quote:

"US Senator Elizabeth Warren of Massachusetts and Congressman Jerry Nadler of New York have asked...to formally investigate VeriSign's sudden 30% price increase." – Claire Aird [28:20]

Actions Taken:

• The Department of Justice and National Telecommunications and Information Administration are expected to review VeriSign's pricing strategies to determine if antitrust laws have been violated.

---

10. Senate Introduces Healthcare Cybersecurity Bill

Summary:
Four U.S. Senators have proposed the Healthcare Cybersecurity and Resiliency Act of 2024. This legislation aims to bolster cybersecurity measures within the healthcare sector by establishing basic standards, providing grants, and enhancing data breach reporting protocols.

Key Points:

• Cybersecurity Standards: Mandatory use of Multi-Factor Authentication (MFA), encryption of health data, and regular security audits and penetration tests.
• Support for Rural Entities: Allocation of grants and provision of training materials to enhance cybersecurity resilience in rural healthcare facilities.
• Enhanced Reporting: Updated requirements for data breach notifications to ensure timely and transparent communication of security incidents.

Notable Quote:

"Basic cybersecurity requirements will include the use of MFA, health data encryption, and conducting security audits and penetration tests." – Claire Aird [30:10]

Actions Taken:

• The bill awaits legislative review and potential passage to implement these critical cybersecurity enhancements within the healthcare industry.

---

11. Vietnamese Arrests Linked to Viet Cred Care Infostealer

Summary:
Group IB has reported that 20 suspects detained by Vietnamese authorities in May are likely connected to the Viet Cred Care infostealer operation. This group's activities have diminished, though another Vietnam-based operation, Ducktale, continues to evolve its malware.

Key Points:

• Infostealer Activity Decline: A noticeable reduction in Viet Cred Care's operations correlates with the recent arrests.
• Ongoing Threats: Ducktale remains active, with its malware receiving multiple updates post-arrests, indicating sustained cybercriminal activity in Vietnam.

Notable Quote:

"In a report last week, it said Viet Cred Care activity had dropped off, leading it to include the arrests were related to that group." – Claire Aird [32:45]

Actions Taken:

• Continued monitoring of Vietnam-based cybercriminal activities, particularly Ducktale, is essential to mitigate ongoing threats.

---

12. Fortinet VPN Vulnerability Exploited by Threat Actors

Summary:
Researchers at Penterra have uncovered a design flaw in Fortinet VPNs that allows attackers to execute brute force attacks without detection. This vulnerability stems from inadequate logging during the authentication phase.

Key Points:

• Nature of Flaw: Fortinet VPN servers only log failed login attempts during authorization, not during the initial authentication phase, enabling unlimited credential attempts without alerts.
• Exploitation: Attackers can test numerous credentials, establishing VPN connections only when valid credentials are used, bypassing logging mechanisms.

Notable Quote:

"Attackers can test as many credentials as they want during the initial authentication phase and only establish a working VPN connection with the valid ones." – Claire Aird [34:30]

Actions Taken:

• Fortinet users are advised to implement additional security measures, such as rate limiting and enhanced monitoring, to prevent exploitation of this vulnerability.

---

13. Xyxl Advises Firewall Owners on Ransomware Protection

Summary:
Taiwanese equipment vendor Xyxl has issued a security advisory urging firewall owners to apply recent updates to defend against ransomware attacks, specifically those executed by the Heldown ransomware gang.

Key Points:

• Vulnerabilities Addressed: Patches released in September are being exploited by Heldown to infiltrate corporate networks.
• Recommended Actions:
  • Install the latest security updates provided by Xyxl.
  • Change firewall administrative passwords to enhance security.

Notable Quote:

"Vulnerabilities patched by the vendor in September are currently being used by the Heldown ransomware gang to gain initial footholds on corporate networks." – Claire Aird [36:20]

Actions Taken:

• Organizations are strongly encouraged to adhere to Xyxl's recommendations to mitigate the risk of ransomware attacks exploiting known vulnerabilities.

---

14. Microsoft Reinstates Recall Feature in Windows 11 Insider Builds

Summary:
Following substantial public backlash, Microsoft has reintroduced the Recall computer history feature into its Windows 11 Insider builds. The feature was initially removed in June due to privacy concerns.

Key Points:

• Feature Enhancements: The new version of Recall allows users to disable the feature and ensures that data is encrypted, addressing previous criticisms.
• Initial Flaws: The first iteration of Recall did not permit user disablement and stored data in clear text on disk, raising significant privacy issues.

Notable Quote:

"Microsoft has re-added the Recall computer history feature into Windows 11 Insider builds... Unlike its first iteration where users couldn't disable it." – Claire Aird [38:50]

Actions Taken:

• Users can now opt to remove the Recall feature, and Microsoft has implemented encryption measures to secure the stored data, mitigating earlier privacy concerns.

---

Conclusion:
This episode of Risky Business News, hosted by Claire Aird, provided a comprehensive overview of recent cybersecurity incidents and developments globally. From state-sponsored espionage and propaganda efforts to vulnerabilities in widely-used software platforms, the discussions underscored the evolving landscape of cyber threats and the importance of robust security measures. Additionally, legislative actions and regulatory fines highlighted ongoing efforts to enforce cybersecurity and data privacy standards across various sectors.

Notable Closing Quote:

"And that is all for this podcast edition." – Claire Aird [40:05]

---

This summary captures the key points, discussions, and insights from the November 24, 2024 episode of Risky Business News. For detailed analysis and ongoing updates, listening to the full podcast episode is recommended.

Transcript

[Claire Aird]

Google says four PR firms are behind a major Chinese propaganda network US Telcos learned of Salt Typhoon breaches from Microsoft, Russian hackers pull off a cunning wifi attack and hacktivists leaked data from Andrew Tate's website. This is Risky Business News, prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 25th of November and this podcast episode is brought to you by Stairwell. Stairwell lets you do you know if, when and where malware has ever been on your systems by collecting, storing and continuously reassessing every executable file and indicator of compromise in your environment. Find [e-mail] in today's top story. Four Chinese PR firms are running hundreds of news websites that publish pro Beijing propaganda mixed with benign content to international audiences. The site's published articles that promoted China's territorial claims over the South China Sea and Taiwan, conspiracy theories and personal attacks against government critics. Google has removed the domains linked to the companies from its search and news index and said the network is large but publishes repetitive, low quality articles. One of the companies also paid Fiverr users to promote the articles on social media. Google says all the PR companies are separate legal entities but operated in a similar fashion, suggesting a form of coordination was taking place. The FBI has notified almost 150 victims who were targeted by Chinese espionage group Salt Typhoon. The group spied on victims and breached the lawful intercept systems of four major U.S. telecommunications providers. According to the Washington Post, most of the victims are located in the D.C. area. According to the New York Times, the U.S. government and the telcos learned of the breach after Microsoft notified them of anomalies on their networks. The anomalies included data on servers used by Salt Typhoon that traced back back to US telcos. Government officials have also criticized the companies for being too slow to upgrade their networking equipment, some of which is decades old. A Russian cyber espionage group has breached a US company by connecting to the victim's WI fi network from a compromised laptop across the road. The attack took place ahead of Russia's invasion of Ukraine and sought to collect data related to individuals and projects involving Ukraine. Security firm Velexity called this technique the nearest neighbour attack. It attributed the intrusion to APT 28, a cyber unit inside Russia's military intelligence agency GRU. Thai authorities have arrested a 35 year old Chinese man for sending over a million SMS scam messages. Officials say the suspect was driving around Bangkok using a mobile radio base station installed in his car that sent out the SMS messages. Posing as AIs, Thailand's biggest Internet service provider the suspect was part of a larger group that registered local companies to obtain phone numbers and spam. Thai citizens Hackers have breached the website of the Real World, an online course founded by Andrew Tate. The hackers leaked the email addresses of 325,000 users and flooded the site's main chat room with LGBTQ and feminist themed emojis. The platform was previously known as Hustlers University and is one of Tate's main revenue streams. The personal records of over a million Irish National Health Service employees were leaked online due to a misconfiguration in the Microsoft Power Pages platform. The leak was discovered by security firm Appomny and exposed email addresses, phone numbers and home addresses. Appomny says the Irish NHS was one of several organizations that leaked data via websites built on the Microsoft Power Pages platform. Microsoft says the leak took place because website admins misunderstood how access controls work on the Power Pages platform and exposed private data via their website's APIs. A cyber attack has crippled the systems of International Game Technology, a large gambling machine company. The hack took place on November 17th. IGT says the hack affected internal systems and applications and that it was unclear if this would affect the company's bottom line. Italy's Data Protection agency has fined Fudinho 5 million euros for tracking the geolocation of its drivers outside of working hours. The agency has also banned the company from processing drivers biometric data, which the company uses for driver auth authentication. Fodinho is part of the Glovo group of food delivery companies. This is the company's second fine in Italy. It was also fined 2.6 million euro in 2021 for using algorithms to measure employee performance. Two US senators have asked the US government to investigate VeriSign over its predatory pricing of dot com domains. US Senator Elizabeth Warren of Massachusetts and Congressman Jerry Nadler of New York have asked the Department of Justice and the National Telecommunic Patients and Information Administration for a formal investigation. In a letter sent last week, the to say VeriSign has increased dot com domain prices by 30% without changing the service. The two describe the price as monopolistic behaviour. Four US Senators have introduced a bill in the Senate to improve cybersecurity in the healthcare sector. The Healthcare Cybersecurity and Resiliency act of 2024 will introduce basic cybersecurity standards for the healthcare sector and allocate grants to improve CY security. The bill also updates data breach reporting requirements and will provide training and guides for rural health entities. Basic cybersecurity requirements will include the use of MFA Health data encryption and conducting security audits and penetration tests. Group IB says that 20 suspects detained by Vietnamese officials back in May were likely linked to the Viet Cred Care infostealer. In a report last week, it said Viet Cred Care activity had dropped off, leading it to include the arrests were related to that group. Ducktale, another Vietnam based Infostealer operation, has continued operating and its malware has received several updates since the arrests. So it wasn't them. A design flaw in the Fortinet VPN allows threat actors to hide brute force attacks. The issue was discovered by researchers at Penterra, who found that Fortinet VPN servers only log failed login attempts during the authorisation phase, but not during authentication. Attackers can test as many credentials as they want during the initial authentication phase and only establish a working VPN connection with the valid ones. None of the failed logins would get logged. Taiwanese equipment vendor Xyxl has urged firewall owners to install security updates to protect against ransomware attacks. Vulnerabilities patched by the vendor in September are currently being used by the Heldown ransomware gang to gain initial footholds on corporate networks. Cyxal has also recommended changing firewall admin passwords. And finally, Microsoft has re added the Recall computer history feature into Windows 11 Insider builds. Microsoft pulled Recall in June after massive public backlash and delayed its return twice, according to security boffin Alex Haganah. Recall can now be disabled and its data is encrypted, unlike its first iteration where users couldn't disable it. Remove it and its data was sitting in clear text on disk for anyone to take. And that is all for this podcast edition. Today's show was brought to you by our sponsor Stairwell. Find them [e-mail] thanks for your company.