Risky Bulletin: Chinese researchers claim to find new North American APT - Risky Bulletin

Summary7 min read

Risky Bulletin: Chinese Researchers Claim to Find New North American APT Hosted by Claire Aird | Released on July 7, 2025

Introduction

In this episode of Risky Bulletin, host Claire Aird delves into the latest developments in the cybersecurity landscape. From emerging threats and significant breaches to regulatory settlements and global cyber initiatives, this edition provides a comprehensive overview of the critical issues shaping the field today.

Top Story: Emergence of a New North American APT

Chinese Security Researchers Uncover 'Night Eagle' Group

Chinese cybersecurity firm Xianxin has identified a new Advanced Persistent Threat (APT) group targeting North America's high-tech sectors. Dubbed "Night Eagle," this group employs sophisticated malware and utilizes unique server infrastructures tailored for each victim. Notably, Night Eagle is suspected of exploiting a zero-day vulnerability in Microsoft Exchange, enhancing its capabilities to infiltrate and persist within targeted networks.

Claire Aird explains at [00:04]:
"The Night Eagle group uses novel malware, unique server infrastructure for each victim, and may be exploiting a Microsoft Exchange zero-day vulnerability."

Xianxin attributes the group's operational patterns to a base on the North American West Coast, indicating a strategic positioning that aligns with the region's technological hubs.

Insider Threat Leads to Major Bank Hacks in Brazil

Programmer Arrested for Facilitating Theft of $185 Million

Duo Nazareno Hockey, a 48-year-old programmer, has been apprehended for his role in a significant cyber heist involving Brazilian software company CNM and six local banks. Authorities allege that Hockey sold his CNM credentials to hackers for $900 and received an additional $1,800 to execute malicious commands within the company's network.

At [00:04], Aird details:
"Hockey claimed he was recruited in a bar and communicated with the hackers by phone, facilitating the theft of 185 million dollars from local banks."

This case underscores the critical threat posed by insider vulnerabilities, where trusted individuals can inadvertently or maliciously enable large-scale financial crimes.

SEC and SolarWinds Settle Longstanding Legal Battle

Resolution Over Securities Fraud and Security Breaches

After two years of litigation, the U.S. Securities and Exchange Commission (SEC) and SolarWinds have reached a settlement. The dispute originated in 2023 when the SEC sued SolarWinds over a security breach that occurred three years prior. Russian hackers exploited this breach to deploy malware across SolarWinds' customer networks.

Claire Aird notes at [00:04]:
"Some charges against SolarWinds and its CISO were dismissed last year, focusing remaining charges on securities fraud related to the company's public statements."

This settlement marks a significant moment in cybersecurity accountability, highlighting the importance of transparent and robust security practices in maintaining investor and consumer trust.

Luxury Brands Under Siege: Louis Vuitton and Others Breached

Data Theft in South Korea Affects High-End Fashion Industry

Louis Vuitton South Korea has confirmed a data breach that occurred in early June, shortly after similar incidents involving Christian Dior and Tiffany & Co. The breach is part of a growing trend targeting luxury and fashion brands globally, including Cartier, Victoria's Secret, and Adidas.

At [00:04], Aird states:
"The attackers exploited vulnerabilities to steal customer data, joining a list of high-profile brands recently compromised by cyber threats."

These breaches highlight the increasing targeting of high-value brands by cybercriminals, who seek to exploit both financial and reputational assets.

Ransomware Disrupts American IT Distribution

Ingram Micro Suffers from Safeplay Botnet Attack

American IT distributor Ingram Micro has been significantly impacted by a ransomware attack attributed to the Safeplay botnet. The incident has left the company's network down as IT teams work diligently to restore operations.

Claire Aird reports at [00:04]:
"A ransomware attack has disrupted Ingram Micro's operations, with the Safeplay botnet taking credit for the incident."

This event underscores the persistent threat ransomware poses to critical infrastructure and the importance of resilient cybersecurity measures in the IT distribution sector.

Cyber Incident Halts Indiana University's Online Services

Three Weeks of Downtime with No Compromised Data

Indiana University has experienced an extended cyber incident, causing the majority of its public-facing websites to remain offline for three weeks. Officials attribute the disruption to security vulnerabilities but have withheld specific details.

At [00:04], Aird conveys:
"The university stated that no sensitive data was compromised despite the prolonged network outage."

This incident emphasizes the challenges educational institutions face in safeguarding their digital assets and maintaining operational continuity amidst cyber threats.

EU Cyber Security Initiative in Moldova

Private Sector Experts to Safeguard Parliamentary Elections

The European Union is set to deploy a team of private sector cybersecurity experts to Moldova in September. Their mission is to assist local authorities in defending the upcoming parliamentary elections against potential Russian interference. This operation will serve as a precursor to the official launch of the EU Cyber Reserve Group in December.

Claire Aird explains at [00:04]:
"The EU's mission in Moldova will act as a test run for the Cyber Reserve Group, enhancing the region's resilience against external cyber threats."

This initiative highlights the EU's commitment to strengthening cybersecurity collaboration and safeguarding democratic processes in vulnerable regions.

Mass Arrests in Nepal for Cyber Scams

52 Suspects Linked to Crypto, Investment, and Dating Fraud

Nepalese authorities have detained 52 individuals suspected of orchestrating various cyber scams, including crypto investment fraud and online dating cons. The group operated a fake dating site, MeToo, to lure victims. Among the arrested, six are Chinese nationals believed to have overseen the operations.

At [00:04], Aird reports:
"The crackdown reveals the transnational nature of cybercrime and the urgent need for international cooperation in combating such frauds."

This case exemplifies the global reach of cybercriminal networks and the importance of cross-border law enforcement efforts to dismantle them.

Australia Implements Age Verification for Search Engines

New Rules to Protect Minors from Explicit Content

The Australian government is set to enforce age verification measures for search engines, including giants like Google and Bing. Users logged into their accounts will undergo age verification, while explicit material will be automatically blurred or excluded for those not logged in. This regulation aims to prevent minors from inadvertently accessing violent or pornographic content and is scheduled to take effect later this year.

Claire Aird notes at [00:04]:
"These measures are designed to create a safer online environment for young Australians by controlling access to inappropriate material."

This policy reflects growing global trends towards enhancing online safety for minors through regulatory interventions.

Google Removes Fraudulent Android Apps from Play Store

Icon Ads Botnet Exposed for Ad Fraud

Google has taken action against 352 Android applications from the Play Store linked to Icon Ads, a botnet responsible for generating up to 1.2 billion fraudulent ads daily since 2020. These apps were identified as part of a widespread ad fraud scheme that undermines the integrity of digital advertising ecosystems.

At [00:04], Aird states:
"By removing these malicious apps, Google aims to curb the extensive ad fraud orchestrated by the Icon Ads botnet."

This crackdown underscores the ongoing battle against ad fraud and the critical role platforms play in maintaining secure and trustworthy digital marketplaces.

New HPing Botnet Targets Diverse Devices

NS Focus Identifies DDoS Tool Leveraging HPing3 Utility

A newly discovered botnet, named HPing, is actively infecting Internet of Things (IoT), Linux, and Windows devices to launch Distributed Denial of Service (DDoS) attacks. Revealed by Chinese security firm NS Focus, the HPing botnet exploits the HPing3 open-source utility to orchestrate large-scale disruptions.

Claire Aird explains at [00:04]:
"The HPing botnet's ability to target multiple device types makes it a versatile tool for executing DDoS attacks."

This development highlights the evolving tactics of cybercriminals in leveraging open-source tools to amplify their attack capabilities across diverse platforms.

Deja Vu Libra Project Patches Linux Vulnerability

Critical Fix Prevents Malicious Code Execution via Crafted Files

The Deja Vu Libra project has addressed a significant vulnerability affecting Linux desktop users. The flaw allowed attackers to execute malicious code when users opened specially crafted files in the Deja Vu document format, akin to PDFs. Given its widespread use in Linux environments, the patch is crucial for preventing potential exploits.

At [00:04], Aird notes:
"Fixing this vulnerability is essential to protect Linux users from potential attacks that exploit the Deja Vu document format."

This resolution exemplifies the importance of proactive vulnerability management and timely patch deployment in safeguarding operating systems against emerging threats.

Conclusion

The July 7, 2025 episode of Risky Bulletin sheds light on a myriad of cybersecurity challenges and responses across the globe. From the identification of new threat actors and significant data breaches to legislative measures and international cooperation, the episode underscores the dynamic and multifaceted nature of the cybersecurity landscape. Staying informed and proactive remains paramount in navigating these evolving threats.

For more detailed insights and updates, tune into the latest episodes of Risky Bulletin.

Loading summary

Transcript1 lines

[00:04]
Claire Aird
Chinese security researchers claim to have found a new American apt. The SEC and SolarWinds are seeking a settlement. A company insider was behind Brazil's bank hack and Louis Vuitton discloses a security breach. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 7th of July and this podcast episode is brought brought to you by Knock Knock. In today's top story, Chinese security firm Xianxin claims a new cyber espionage group is targeting the country's high tech sectors. The Night Eagle group uses novel malware unique server infrastructure for each victim and may be using a Microsoft Exchange zero day. It also uses command and control servers that only activate when being used. Xianxian says the group's operating hours suggest it's based on the North American West Coast. In other news, a 48 year old programmer has been arrested in connection with the hack of Brazilian software company CNM and six local banks. Duo Nazareno Hockey allegedly sold his CNM work credentials to hackers for $900. He received a further $1,800 to run malicious commands on the company's network. Hockey said he was recruited in a bar and he communicated with the hackers by phone. The attackers used his CNM Access to steal 185 million DOL. Local banks, software maker SolarWinds and the US securities and Exchange Commission have proposed to settle a two year legal battle. The SEC sued SolarWinds in 2023 over a security breach three years earlier. Russian hackers used the breach to Deploy malware on SolarWinds customers networks. Some charges against the company and its CISO were dismissed last year which covered post breach disclosures and poor security posture. The remaining charges relate to securities fraud for the company's public statements. A hacker has stolen customer data from Louis Vuitton South Korea. The breach occurred in early June, the month prior hackers also breached the South Korean operations of Christian Dior and Tiffany and company. They join a growing list of luxury and fashion brands that have been hacked in recent months, including Cartier, Victoria's Secret and Adidas. A ransomware attack has disrupted American IT distributor Ingram Micro. The company's network remains down as it works to restore systems. A relatively new ransomware operation named Safeplay has claimed credit for the attack. The majority of Indiana University's public facing websites have been down for three weeks following a cyber incident. Officials said security vulnerabilities were at fault but declined to provide further details. The university has said no sensitive data was found to be compromised. The European Union will send a group of private sector cybersecurity experts to Moldova. The group will assist local authorities with defending parliamentary elections against Russian interference. The September mission will work as a test run for the EU Cyber Reserve Group, due to officially launch in December. Nepalese Authorities have arrested 52 suspects accused of running crypto, investment and online dating scams. The group allegedly found victims through its fake online dating site MeToo. Six of the suspects are Chinese and are believed to have managed the operation. The Australian government is introducing age verification checks for search engines. The sites, like Google and Bing, will have to verify the age of all Australians who are logged into their services. If users are not logged in, explicit material will automatically be blurred or excluded. The rule is designed to prevent minors from accidentally viewing violent or pornographic material. It will come into effect later this year. Google has removed 352 Android apps from the Play Store that were showing unwanted ads. The apps were part of Icon Ads, an ad fraud botnet that's been operating since 2020. According to Human Security, Icon Ads was showing up to 1.2 billion fraudulent ads per day. A new botnet has been found infecting IoT, Linux and Windows devices. The new HPing bot botnet is used to launch DDoS attacks. It was discovered by Chinese security firm NS Focus. It uses the HPing3 open source utility to launch the attacks. And finally, the Deja Vu Libra project has fixed a vulnerability allowing attacks on Linux desktop users. The bug lets attackers run malicious code when users open a crafted file. Deja Vu is a document format similar to PDF and is widely used in Linux environments. And that is all for this podcast edition. Today's show was brought to you by Knock Knock. Find them at Knock Knock IO. Thanks for your company.