Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Italy arrests a Chinese APT hacker A Russian drone software group gets wiped, the Satan Lock ransomware operation shuts down and browser extensions power a web scraping botnet. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 9th of July and this podcast episode is brought to you by Knock Knock. In today's top story, Italian authorities have arrested a suspected member of a Chinese Apt Group. 33 year old Xu Zhi Wei was arrested at an airport in Milan on Monday. He was detained on a U.S. arrest warrant for allegedly hacking the University of Texas in 2020. He stole information about a COVID vaccine that was being developed there. He's a suspected member of the Hafnium apt. The group is also known as Silk Typhoon, but it's unclear if Xu was invol involved in the group's recent hacks of U.S. critical infrastructure. The U.S. department of justice says Xu worked for the Chinese company Shanghai PowerRock Network when he conducted the vaccine hacks. In other news, the U.S. treasury Department has sanctioned a member of the Andariel APT for his role in North Korean remote IT worker schemes. Sanctions were levied against Songkum Hyeok for managing groups of IT workers and providing them with stolen US identities. Sanctions were also levied against two North Korean companies that hired the workers and a Russian national and two Russian companies that hosted them. An unknown individual is impersonating the US Secretary of State Marco Rubio. They contacted American and foreign officials via text messages and signal chats. In at least two cases, the imposter left audio messages using a deep fake of Rubio's voice. According to the Washington Post, targets have included three foreign ministries, a US Governor and a member of Congress. A volunteer group that provides the Russian army with customised drone firmware has been hacked. The hackers wiped the group's servers and defaced laptops used by soldiers to reflash civilian drones. The group, known as Russian Hackers for the Front confirmed the hack and told installers to cease operations while they investigate. The group said it found no evidence that the attackers tampered with the actual drone firmware. Private documents from China's hacker for hire industry have been offered for sale on an underground forum. Two separate posts on the Dark Forums platform offered samples of the data in May, according to Spy Cloud's analysis of those samples. The first set of documents is from Chinese network security firm venustech. The second set reportedly contains details about several companies behind the Salt Typhoon Apt and its government customers. More than 1 million users have installed extensions that turn their browsers into proxies for a web scraping botnet. The extensions contain a library named Melotel that loads websites inside a hidden iframe. Security firm Secure Annex has found the library in 245 extensions for Chrome, Edge and Firefox. The firm believes the extensions provide the back end for the web scraping service Olistopol. A threat actor has compromised a VS code extension used by nearly 6,000 cryptocurrency developers. The Ethcode extension was modified last month in a malicious GitHub commit. Reversing labs says the attacker added a new dependency that would allow them to run malicious code. The ETH code extension is typically used for Ethereum smart contract development. More than 2.3 million Chrome and Edge users have installed malicious extensions that track their activity and could hijack their browsers. The extensions pose as entertainment and productivity tools and are still available through both official browser stores. The extensions were once legitimate but have been updated over time to include backdoor features. The attackers behind the campaign have not yet activated the hijack capability. A network of more than 17,000 websites is impersonating trusted media organisations to send visitors to scam sites. The bait trap network lures victims through social media posts, YouTube videos and Google and Meta ads. The bogus sites collect personal information and attempt to hijack crypto accounts. Dutch authorities have arrested five members of a phishing gang. Four of the suspects are teenagers and the youngest is 14. The group operated out of the city of Lelystadt. They used QR codes sent via email to collect login credentials for local banks. Iranian hacking group Pay2Key has returned with a revamped ransomware as a service platform. The group relaunched in February this year and is believed to have already collected more than $4 million in ransoms. Pay2Key said it's upgraded its software since 2020, when it launched data wiping attacks against Israeli organisations. According to security firm Morphasec. The group is recruiting members of the Russian and Chinese ransomware ecosystems to attack enemies of Iran. The Satan Lock ransomware group has shut down operations and said it will publish all its stolen data. The group launched in April and listed more than 70 victims on its Dark Web leak site. Satan Lock did not say why it shut down Default installations of the Sailpoint identity platform have a hard coded encryption key that can be used to run malicious code, according to security firm Netspy. The key is in the component that integrates with Windows environments. Sailpoint addressed the issue in its May security updates. Spyware has infected more than 100 users at Russian industrial organisations. The Batavia spyware has been used in campaigns against Windows systems in Russia since last July. Kaspersky says the malware is used to steal sensitive documents from infected organisations. A new attack can hijack user interactions on Android smartphones. The Tap Trap attack was developed by a team of academics. It tricks users into interacting with an invisible application, such as system settings or a crypto wallet. It does this by displaying a game or other interactive feature beneath the invisible app. While the victim believes they're clicking on the game, they're actually doing the attacker's bidding. And finally, a team of academics has published details on a new attack against TTLs connections. The oposum attack requires an attacker in the middle position. It could be leveraged for session fixation, resource confusion and cookie leaks. Researchers say that while the attack is reliable, its prerequisites are rarely met. And that is all for this podcast edition. Today's show was brought to you by Knock Knock. Find them at Knock Knock IO. Thanks for your company.