Risky Biz News: Russia arrests WazaWaka

Summary

Risky Business News: Russia Arrests WazaWaka – Detailed Summary

Podcast Information:

• Title: Risky Business News
• Host: Claire (read by Claire, prepared by Catalyn Kimpanu)
• Episode: Risky Biz News: Russia arrests WazaWaka
• Release Date: December 2, 2024
• Description: Regular cybersecurity news updates from the Risky Business team.

---

Top Stories Overview

In this episode of Risky Business News, host Claire delves into several significant cybersecurity events, including the arrest of a notorious ransomware affiliate in Russia, a major heist targeting Uganda's central bank, privacy concerns surrounding Zoom, and vulnerabilities affecting Windows Server 2012. Additional topics include a ransomware attack on an Italian soccer club, misuse of DDoS features in South Korea, and emerging threats in software licensing bypasses.

---

Arrest of Waza Walker (00:04)

The episode opens with the high-profile arrest of Mikhail Matveev, known as WazaWaka, a significant figure in the ransomware community.

• Details of Arrest:

  • Affiliations: Matveev operated as an affiliate for several major ransomware groups, including Babuk, Conti, Darkside, Hive, and Lockbit.
  • Charges: He faces charges in the US for orchestrating ransomware attacks targeting hospitals and police departments.
  • Notable Attack: In 2022, Matveev led an attack on the Washington, D.C. Metro Police, threatening to release sensitive data on cases and informants. This incident resulted in the disbanding of the Babuk ransomware gang.

• Key Quote:

  "His most infamous attack targeted the Washington, D.C. metro Police in 2022 when he threatened to release data on cases and informants." — Claire [00:04]

• Recent Developments:

  • Court Case: Matveev's arrest was highlighted in a recent Kaliningrad court case, which noted his involvement in developing new ransomware in January of the current year, directly leading to his apprehension.

---

Uganda Central Bank Heist (08:30)

A cybercriminal group named WASTE successfully stole nearly $17 million from Uganda's central bank earlier this month.

• Attack Details:

  • Confirmation: Ugandan officials have officially confirmed the breach.
  • Recovery Efforts: Authorities have tracked a portion of the stolen funds to bank accounts in Japan, recovering over half of the total amount.

• Impact: The audacious nature of the heist underscores vulnerabilities in national banking systems, highlighting the sophisticated methods employed by modern cybercriminals.

---

Zoom Faces SEC Probe (15:45)

Videoconferencing giant Zoom is navigating significant legal challenges as it seeks to settle a probe from the U.S. Securities and Exchange Commission (SEC) concerning its privacy practices.

• Settlement Offer:

  • Zoom has proposed an $18 million settlement in response to the SEC's investigation.

• Investigation Focus:

  • Privacy Policies: The SEC is scrutinizing Zoom's privacy policies and alleged misleading statements regarding call encryption.
  • Timeline: The investigation commenced in 2020 amid the surge in video conferencing usage due to the COVID-19 pandemic.

• Current Status:

  • Zoom awaits the SEC's final decision, as indicated in documents filed last week.

• Key Quote:

  "The SEC started investigating Zoom in 2020 during the height of the COVID-19 pandemic, when video conferencing platforms boomed." — Claire [15:45]

---

South Korean Tech Company CEO Arrested (22:10)

South Korean authorities have apprehended the CEO of an unnamed tech company, along with four employees, over the illicit addition of a DDoS (Distributed Denial of Service) feature to their satellite TV receiver firmware.

• Circumstances:

  • Customer Request: The feature was allegedly incorporated at the behest of a customer facing DDoS attacks from a competitor.
  • Scale of Distribution: Since January 2019, over 240,000 units with the unauthorized DDoS capability were shipped.

• Legal Repercussions: The arrests highlight the severe legal consequences for companies engaging in cyber offensive measures, even when requested by clients.

---

European Court Rules Against Hungarian Government (28:50)

The European Court of Human Rights has ruled in favor of a reporter against the Hungarian government in a landmark case involving illegal wiretapping.

• Case Details:

  • Reporter Involved: Claudia Chikos, a BLIC reporter.
  • Incident: In 2016, Hungarian police wiretapped Chikos to unmask a source providing information on a high-profile murder case.
  • Outcome: The wiretapped conversations were later used to terminate her source, leading to legal action by Chikos.

• Court Ruling:

  • The court found that the Hungarian government violated Chikos's rights to privacy and freedom of expression.
  • It also noted the government's failure to properly investigate the illegal surveillance.

• Key Quote:

  "The court says the government broke the reporter's right to privacy and freedom of expression and failed to investigate her complaint of illegal spying." — Claire [28:50]

---

Ransomware Attack on Bologna FC (35:20)

Italian soccer club Bologna FC has been hit by a ransomware attack, resulting in the unauthorized publication of sensitive internal data.

• Attack Details:

  • Perpetrators: The Ransom Hub Ransomware Group is responsible for the breach.
  • Data Compromised: Personal and medical records of players and staff, along with financial records, were leaked after the club refused to comply with ransom demands.

• Impact on the Club:

  • Bologna FC is currently ranked 8th in Italy's soccer league, and the attack may have implications for its operations and reputation.

• Key Quote:

  "The leaked data allegedly includes the personal and medical records of the club's players, staff and financial records." — Claire [35:20]

---

Vulnerability in Windows Server 2012 Remains Unpatched (42:15)

Researchers have uncovered a critical vulnerability in the Windows Server 2012 operating system that allows threat actors to bypass security measures.

• Vulnerability Details:

  • Bug Nature: The flaw permits attackers to circumvent the mark of the web, a security feature in Windows Server 2012.
  • Affected Versions: All versions released in the past two years are susceptible.

• Current Mitigation:

  • Vendor Response: Microsoft has yet to release a patch for this vulnerability, despite it being reported.
  • Workaround: Security firm Across has issued a micro patch to temporarily address the issue until Microsoft can provide an official fix through its Extended Security Updates program.

• Additional Threats:

  • Malware Sneak-Ins: Cybercriminals are exploiting corrupted files to bypass email security measures like sandboxes and spam filters.
  • Recovery Mechanisms: Malicious files leverage built-in recovery features of user applications to gain access.

• Key Quote:

  "The researchers from Across say they reported the issue to Microsoft, but the bug is still unpatched." — Claire [42:15]

---

Emergence of Software Licensing Bypass Techniques (49:40)

A group of software crackers, identified as the MAS group, claims to have developed a novel method to bypass Microsoft’s licensing protections for Windows and Office software.

• Bypass Details:

  • Technique: Their method reportedly does not require any third-party software.
  • Scope: The bypass can activate licenses for Microsoft Office, Windows Desktop and Server, and even licenses for Microsoft's Extended Security Updates program.

• Implications:

  • If verified, this breakthrough could significantly escalate Windows piracy, undermining Microsoft's software protection efforts.

• Key Quote:

  "The MAS group claims their licensing bypass does not require third-party software and can activate licenses for Microsoft Office, Windows Desktop and Server." — Claire [49:40]

---

Conclusion

This episode of Risky Business News presents a comprehensive overview of recent cybersecurity incidents and developments. From the arrest of a major ransomware figure in Russia to vulnerabilities in longstanding software systems, the discussions underscore the evolving challenges in the cybersecurity landscape. The insights provided by Claire offer listeners a deep understanding of the threats and responses shaping the digital world today.

---

Note: This summary excludes advertisements, introductions, and outros to focus solely on the substantive content discussed in the episode.

Transcript

[Claire]

Russia arrests Woza Walker Police arrest the CEO of a tech company that added a DDoS feature to its products hackers steal $17 million from Uganda's central bank and a Windows server 2012 zero day awaits a patch this is Risky Business news, prepared by Catalyn Kimpanu and read by me Claire aired today is the 2nd of December and this podcast episode is brought to you by Push Security. In today's top story, Russian authorities have arrested the high profile ransomware affiliate Waza Walker. Mikhail Matveev worked as an affiliate for groups such as Babuk, Conti, Darkside, Hive and Lockbit. He was charged in the US for ransomware attacks against hospitals and police departments. His most infamous attack targeted the Washington, D.C. metro Police in 2022 when he threatened to release data on cases and informants. His actions led to the Babuk ransomware gang disbanding a few days after the attack. Matve's recent arrest was mentioned in a court case filed in Kaliningrad last week. The case specifically mentions that Waza Walker wrote new ransomware in January this year, which led to his arrest. In other news, hackers stole almost $17 million from Uganda's central bank earlier this month. A group named WASTE is believed to be behind the attack. Ugandan officials have confirmed the incident and said they tracked some of stolen money to bank accounts in Japan. Over half of the stolen funds have already been recovered. Videoconferencing app Zoom has offered $18 million to settle a probe from the U.S. securities and Exchange Commission into the company's privacy practices. In documents filed last week, the company says it's still waiting for the SEC's decision. The SEC started investigating Zoom in 2020 during the height of the COVID 19 pandemic, when video conferencing platforms boomed. The investigation is Zoom's privacy policies and misleading statements about call encryption. South Korean police have arrested a tech company's CEO and four employees for adding a DDoS feature to its satellite TV receiver firmware. The company allegedly added the feature at the request of one of its customers. The customer claimed they were facing DDoS attacks from a competitor and requested the DDoS feature to fight back. The unnamed South Korean company allegedly shipped the feature to more than 240,000 units sold since January 2019. The European Court of Human Rights has ruled that the Hungarian government violated a reporter's rights by wiretapping her. In 2016, BLIC reporter Claudia Chikos sued the government after police wiretapped her to unmask a source who shared details about a high profile murder case. Conversations from the wiretaps were later used to fire her source. The court says the government broke the reporter's right to privacy and freedom of expression and failed to investigate her complaint of illegal spying. Italian soccer club Bologna FC has fallen victim to a ransomware attack. The club put out a statement last week warning that data from its internal network had been published online. The Ransom Hub Ransomware Group published the data after the club refused to pay. The leaked data allegedly includes the personal and medical records of the club's players, staff and financial records. Bologna FC is currently ranked 8th in Italy's soccer league. Researchers have discovered a new vulnerability that can allow threat actors to bypass the mark of the Web on the Windows Server 2012 operating system. The researchers from across security say they reported the issue to Microsoft, but the bug is still unpatched. The bug impacts all Windows Server 2012 versions released over the past two years. Across has released its own micro patch for the bug until Microsoft releases a fix through its Extended Security Updates program. Windows Server 2012 reached end of support in October last year. Threat actors are using corrupted files to sneak malware past email security sandboxes and spam filters. Although broken and corrupted user applications open the malicious files through built in recovery mechanisms. Security firm Anyrun says the technique has been used in the wild since at least August this year. And finally, a team of software crackers claims it's developed a bypass for the Windows and Office software licensing protection scheme. The MAS group claims their licensing bypass does not require third party software. The group says the technique can activate licenses for Microsoft Office, Windows Desktop and Server, as well as licenses for Microsoft's Extended Security Updates program. If confirmed, the technique is a new boon for Windows piracy. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find [e-mail] thanks for your company.