Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Cellebrite bans Serbia from using its products Chinese hackers breached the Belgian security service, the Republican National Committee hid a Chinese hack and Microsoft removes malicious extensions from the VS Code Marketplace. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 28th of February and this podcast episode is brought to you by vulnerability management and analysis platform Nucleus Security. Israeli tech company Celebrite has banned the Serbian government from using its products over its alleged misuse of the technology. MSD International says the Serbian security service unlocked dissidents phones and installed spyware on them with cellebrite's tools. The company says it's committed to human rights and democracy. Amnesty International has praised Cellebrite, saying the withdrawal of life licenses from Serbia is a critical first step. Chinese state sponsored hackers have allegedly breached an email server belonging to a Belgian intelligence service. The 2023 hack was part of a campaign exploiting a zero day in email security product Barracuda. According to local media, the hackers stole two years of unclassified email from the intelligence service. Chinese state sponsored hackers also breached the email system of the Republican national committee in July 2024. The the mostly unreported incident came a month after Iranian hackers gained access to the Trump campaign's email. An upcoming book from journalist Alex Eisenstart claims the RNC chose not to notify the FBI about the intrusion. A hacking group calling itself the Philippine Exodus Security has leaked data from the country's armed forces on a cybercrime forum. The leaked data allegedly includes sensitive details about 10,000 military personnel, including medical records, financial information and contact details. The Philippine army has confirmed the breach. New evidence has shown that North Korea's $1.5 billion Bybit heist was pulled off by hacking a developer at multisignature wallet provider Safewallet. The hackers compromised the developer and injected malicious code targeting Bybit into SafeWallet's web interface. SafeWallet says it's removed the code and will publish further details following an investigation. Initial reports claim that the intrusion involved malware being deployed to BYB Network. The FBI has confirmed North Korea's involvement in the hack and linked it to a group it tracks as Traitor Traitor, which is better known by us mere mortals as the Lazarus Group. A threat actor has stolen $50 million worth of assets from Defi protocol Infini. The attacker compromised private keys and drained the funds on Monday. It may not quite have the same pizazz as the $1.5 billion theft but $50 million was close to all that Infini had. According to reports, the private keys belonged to a former develop still had access. Thai police have detained a hacker who allegedly sold data stolen from more than 70 companies. The 39 year old Singaporean is believed to have targeted companies throughout Southeast Asia. Local news reports say he's confessed to the crimes. Microsoft is suing four individuals for allegedly abusing its AI services to generate deep fakes of celebrities and sexually explicit content. The four allegedly used leaked Microsoft customer credentials to access the services. They then resold access to the generative AI capabilities to their own customers on underground forums. The four are based in Iran, the uk, China and Vietnam and are part of a group that Microsoft tracks as Storm 2139. The US has extradited a Russian national from Portugal for allegedly manipulating cryptocurrency markets. Gotbit founder Alexei Andrunyan and two of the company's executives were charged with market manipulation last year. Gotbit allegedly inflated trading volumes for cryptocurrencies currency companies to boost the value of their assets. The FBI created its own crypto token last year to catch Gotbit and several other fraud as a service companies. The operators of cyber scam centres in Myanmar are now using Starlink for Internet access. Starlink equipment has been spotted on top of at least eight scam compounds since June. The move to Starlink came after Thai authorities seized shipments of network equipment and cut fibre optic cables in the area. Microsoft has removed two malicious theme extensions from the VS Code marketplace. The themes were from the same developer and were downloaded a combined 9 million times. Microsoft says the malicious code was found by a member of the VSCode community, but did not give further details. The company has said it's reviewing the developer's other extensions. The developer claims the malicious code came from a compromise dependency. The number of voice phishing attacks grew more than 400% last year, according to CrowdStrike's annual threat report. The technique is used to trick recipients into calling a fake tech support line that talks them through deploying remote access tools and ransomware to enterprise networks. It's become a common vector amongst cybercrime groups in China and Russia. A new variant of the void IoT botnet has infected over 1.6 million devices, most of which are smart TVs. Chinese security firm Xianxin has said that the sheer volume of traffic to the botnet's infrastructure has earned some of its command control service a spot in Tranko's million most popular websites. A vulnerability in the Nakevo backup software allows unauthenticated attackers to help themselves to backed up files. The vulnerability discovered by Watchtower Labs can be used to retrieve the backup server's password or the backup files themselves. Watchtower says the vendor patched the bug but did not reply to its disclosure. And finally, a new type of radio jamming transmitter has been developed by a team of academics. Known as Reconfigurable Intelligent Surfaces, it allows fine grained spatial control over signal jamming. An RIS jamming attack can be tuned to target specific devices while avoiding impact to others as little as millimetres away. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Nucleus Security. Find them@nucleussec.com Thanks E Company.