← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
Almost 2000 Arch Linux packages have been infected with malware in a supply chain attack Pfizer surveillance powers expire for the first time since 2008 the FBI takes down a Chinese phishing service and a major supply chain attack hits the WordPress ecosystem. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire Airdrop. Today is the 15th of June and this podcast episode is brought to you by Ent AI. In today's top story, more than 1,900 arch Linux ecosystem packages have been hijacked to distribute Rootkit and Infostealer. The attacker targeted AUR packages that had been abandoned and were open for new maintainers. The attacks occurred in several waves over the last few days and are ongoing. Researchers have yet to attribute the attacks. In other news, Pfizer section 702 Foreign surveillance powers expired on Friday for the first time since they were granted in 2008. The US House of Representatives rejected a last minute short term extension. Members of both parties are unhappy with President Trump's decision to name his friend Bill Pulte acting Director of National Intelligence. Lawmakers say Pulte is unqualified for the role and voiced concerns about him having access to Pfizer powers. Last week, a vote to extend Pfizer for three years failed to pass the US Senate. Meantime, the US government has ordered AI company Anthropic to block foreign nationals from accessing its new models. The export control restrictions apply to Claude Fable 5 and Claude Mythos 5, which were released last week. The White House imposed the restrictions after Amazon reportedly found a jailbreak that bypassed guardrails on Anthropic's new newest releases. The United States is pressuring its NATO allies to use their defence budgets to replace Huawei gear in telecommunications and critical networks. The US designated Huawei a national security risk in 2020. American telcos are banned from using its equipment. Spain and Germany are among NATO countries that allow their telcos to use Huawei equipment. Hackers have gained access to the internal network of Danish pharmaceutical giant Novo Nordisk. The company has taken its systems offline to conduct incident response and evict the attackers. Novo says some sensitive data was copied during the intrusion, including patient pii. The company is known for developing the weight loss drugs Ozempic and Wegovy. Hackers have stolen terabytes of Data from major K12 school operator Global Schools Group. Extortion group Fulcrums claims to have obtained passport details for children and parents, attendance records, teacher passwords and photos of campus visitors. The Information was stolen in April from an unsecured and exposed database. The hackers leaked the data last week after a failed ransom negotiation. Singapore based Global Schools group manages 12 different schools that have 65 campuses between them in nine countries. Maine's Attorney General has taken down the state's data breach reporting portal. Last week, unknown individuals filed fake data breach notices claiming there were incidents at Online game company VRChat and messaging platform Discord. The fake reported breaches were subsequently listed on the attorney general's website with no verification. Maine officials said they're reworking submission procedures to prevent future abuse. The Shiny Hunters hacking group has published a new list of victims on its Dark Web leak site. The group says it's currently extorting the Council of Europe fashion house Ralph Lauren retailer J.C. penney, as well as America's largest TV broadcaster, Nextstar. Most companies that get listed on Shiny Hunter's leak page ultimately confirm the hacks. In recent weeks, the group has exploited a zero day vulnerability in Oracle. PeopleSoft hackers are demanding a $2 million ransom from Japanese gaming company Nintendo. The Shadow Bytes group claimed to have stolen almost 1 gigabyte of employee and business data from one of the company's suppliers, TinyPulse. Shadow Bytes first surfaced in April and describes itself as a data extortion group. Hackers have stolen $36 million worth of crypto assets from the Humanity Protocol platform. The attacker allegedly stole private multisig keys from a Compro developer laptop. The Humanity token lost almost 90% of its value following the hack. The FBI, Google and Lumen Technologies have taken down the Chinese phishing as a service platform outsider enterprise. The platform's been linked to the theft of more than 3.8 million credit card numbers and $1.9 billion from toll phishing scams. Officials have seized domains, server infrastructure and cryptocurrency wallets used to receive payments. Google's also suing the group for using Gemini AI to build the service. A Ukrainian national has pleaded guilty to hacking US companies and deploying Conti ransomware on their networks. Oleksiy Oleksiyevich Litvinenko was arrested in Ireland in 2023. He was extradited to the US last year. He faces up to 25 years in prison. Vietnamese police have arrested seven individuals for attempting to establish cyberscam compounds across the country. The group consisted of four Chinese nationals and three locals. They rented multiple resorts, farm stays and villas and were bringing in workers from Cambodia. French, Italian and US Authorities have shut down an online platform that generated and hosted non consensual deepfake pornography of famous women. The platform's administrator was arrested in Nice, former France. The service allegedly hosted thousands of photos and videos of female politicians, first ladies, movie stars and athletes. The US also seized two domains under America's new Take It Down Act. It's the first time the law has been used to shut down a deepfake platform. Certificate authority GlobalSign is mass revoking SSL certificates for Russian customers. The process began on Saturday. GlobalSign told Russian partners it's complying with new CAB forum rules passed in May. The rules require certificate authorities to follow strict customer verification procedures and observe international sanctions. More than 1.2 million websites have been backdoored following a security incident at awesom motive, a WordPress plugin developer. Malicious code was added to the JavaScript files of three of the company's plugins, OptinMonster, TrustPulse and Pushengage. When an admin logs in, the malicious code creates its own admin account and then installs a hidden backdoor plugin to maintain access. No malicious code has been found in awesome Motive's other plugins. The UK's communications watchdog will begin investigating smart TV makers for installing hidden trackers used to collect data about viewing habits. The ICO plans to launch several investigations throughout the year. They will ensure that device makers are obtaining consent and that users have opt out options, and that children's rights and privacy are being protected. The Texas Attorney General office launched a similar crackdown this year and sued several device makers for privacy violations and data tracking. Intellexa CEO Tal Dillian says he has documents that prove the involvement of the Greek intelligence service in the Predator Gate spyware scandal. Dillian was sentenced to eight years in a Greek prison earlier this year. The sentence is currently suspended pending an appeal. Dillian is now threatening to release the documents. He claims his company simply sold spyware, but the EYP intelligence service used it against opposition figures, journalists and prosecutors. In a controversial ruling, the Greek Supreme Court absolved the state of any involvement. In March, Dillian said he was being used as a scapegoat. He's technically been sentenced to 126 years in prison, but if his appeal fails, he'll only serve eight because the charges are misdemeanours. British police and tech giant Apple have entered into a partnership to counter the rising trend of smartphone thefts. The police will share the IMEI codes of stolen devices with the US tech company to prevent the phones from being reactivated. The device data will also be used to track the locations of stolen phones. The market for stolen phones is estimated to be in the millions of US Dollars. Most are resold in China as devices without government restrictions. A cyber espionage group operating out of Belarus is targeting the personal Gmail accounts of Polish citizens. The Ghostwriter group is targeting high profile Polish public figures and their family members. Targets include politicians, journalists and law enforcement personnel. Previously, Ghostwriter only targeted work related accounts. The change in tactics began in March. A new vulnerability allows attackers to escape Linux virtual machines and execute malicious code as root on the underlying host. The vulnerability, codenamed itscape, impacts the kernel based virtual machine component of Linux. It only impacts multi tenant clouds that use KVM on ARM 64 processors. The bug was discovered by security researcher Hyun Woo Kim and was patched in the Linux kernel last week. A technical malfunction has wiped Ziggo Safe Online password vaults. Ziggo Safe Online is a password manager app run by the Dutch ISP Ziggo. The company confirmed the incident but declined to say how many users were affected. Ziggo says customers will have to redownload the app and resync passwords. Zigosafe Online lists more than 500,000 downloads on its Platform Play Store page. And finally, the Microsoft Edge web browser will Switch to a two week release cycle starting with Edge version 152 in late August. Edge will sync with Chrome's new release cycle, which is also set to switch to two weeks in September. The change from four weeks is intended to reduce the patch gap in its open source components and deliver security updates faster. And that is all for this podcast edition. Today's show is brought to you by our sponsor ENT AI. Find them at entry AI thanks to your company.