Loading summary
Transcript1 lines
- [00:04]
A
Authorities take down a residential proxy service Iranian hackers wipe the network of a US medical device maker Apple patches unsupported iOS against Karuna and CISA asked for Cisco SD WAN device logs. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aired today is the 13th of March and this podcast episode is brought to you by Thinkst, the makers of the much loved Thinxt Canary. In today's top story, the FBI and Europol have dismantled the residential proxy provider SOX Escort. The service used malware to hack systems and sell their network access online. Lumens Black Lotus Lab says the service ran on top of the Avrecon botnet, which has infected almost 370,000 devices. In other news, a hacker breached the FBI in 2023 and stole documents related to the Epstein investigation. The breach impacted a server at the Bureau's child exploitation forensic lab in New York. The hacker did not realise he'd breached the FBI. He contacted the Bureau to report the child abuse images he found. According to Reuters, FBI agents showed their badges to the hacker on a video call to convince him they were actually feds. Iranian hackers have wiped the IT systems of a US medical device maker. The company Stryker has shut down all production systems globally. Hacktivist group Handalla has taken credit. The group claimed the attack was in retaliation for the bombing of a girls school in Iran. Reports claim the group hacked the company's Microsoft Intune server and used the remote wipe feature. Handala says it's wiped more than 200,000 phones, server servers and workstations. The Albanian government is investigating a breach of an internal email server. The hack occurred on Tuesday. Staff members were unable to access their PCs or email accounts for hours while the breach was investigated. Iranian group Homeland justice has taken credit for the attack. The group has a history of hacking Albanian government agencies due to exiled Iranian opposition leaders being hosted in the country. CISA has ordered federal agencies to submit logs from their Cisco SD WAN devices. The devices have been under attack using a zero day since 2023. Aggregating the logs will let CISA assess the extent of the compromises. Agencies have until March 23rd to submit logs. They'll also have to configure their devices to send Future logs to CISA. Apple has released security updates for old versions of iOS to patch vulnerabilities used by the Karuna exploit kit. UN updates are available for iOS 15 and 16. Patches for 17 were released in December. Karuna has an exploit kit for iOS devices developed by American defence contractor L3Harris Trenchant. It's thought to have leaked after a former employee sold it to a private Russian exploit broker. China's warned against using the OpenClaw AI agent. The country's cert says the agent is easy to misconfigure during installation and you and can expose companies to security risks. China's National Vulnerability Database has also warned against using OpenClaw. Canadian retailer Loblaw has suffered a security breach. The company notified affected customers this week. It also logged out all users and asked them to sign back into their accounts. Loblaw said the incident did not impact its financial services subsidiary. Dutch ISP Odito has removed a feature that sent router telemetry data to American AI company LifeMote. The behaviour was discovered by Dutch security researcher Sipke Mellema last week. The feature was removed after Dutch lawmakers questioned its legality. Odeda had not disclosed the telemetry collection to its customers. The Dutch telco disclosed a major security breach last month. Iran has threatened to launch missile and drone strikes against Middle Eastern officers of US Tech firms. A telegram message affiliated with the IRGC listed Google, Microsoft, Palantir, IBM, Nvidia and Oracle as potential targets. Iranian officials threatened to attack American companies following recent U s Israeli strikes. 21 individuals have been arrested in Bangkok accused of running cyberscam compounds. Meta participated in the investigation and has taken down more than 150,000 accounts operated by the group. Last year, Meta removed almost 11 million accounts linked to scam compounds. Indian authorities have arrested two Nigerian nationals believed to be members of the Solar Spider hacking group. Police said they were planning to exploit vulnerabilities in Indian cooperative banks. The two had already stolen more than $750,000 from a bank in Gujarat before they were caught last week. A former employee of a US security firm has been charged with conducting at least 10 ransomware attacks. Angelo Martino allegedly demanded more than $75 million in ransoms. the time of the attacks, he was working as a ransomware negotiator for security firm Digital Mint. Officials say he was one of three cybersecurity professionals who hacked their customers, deployed malware and demanded ransoms. The other two were charged in November and later pleaded guilty. Russian Cyber espionage group APT28 has leaked its exploit for hacking Roundcube email servers. The exploit was part of a kit found in an open directory by security firm Hunt intelligence contained payloads, C2 components and operator artefacts. The payloads enabled persistent mail forwarding, bulk email exfiltration, address book theft and two FA secret extraction. Researchers also found a previously undocumented module that enabled browser credential theft. They found links tying the exploit Kit to previous APT28 campaigns that were discovered by security firm ESET. Google paid security researchers more than $17 million last year for vulnerability reports. This represents a 40% increase from 2024, an all time high. More than half of the payouts went to Google's Android, Chrome and cloud bug bounty programs since the program began in 2010, Google's paid more than $81.6 million for vulnerability reports. WhatsApp will warn users when they receive suspicious requests to link their account to a new device as part of its Scam Meta's, also adding alerts for unusual friend requests on Facebook. Additionally, the advanced scam detection feature in messenger will be made available in more countries. And finally, Meta is adding parent managed accounts to WhatsApp. The accounts are designed for preteen children. Access to settings will be controlled by a PIN set up by the parent. Messages will remain private, but parents can approve who their child communicates with, what groups they can join, and can review message requests from unknown contacts. And that is all for this podcast edition. Today's show is brought to you by our sponsor, thinxt. Find them at Canary Tools. Thanks for your company.