Loading summary
Transcript1 lines
- [00:04]
A
Cybercrime losses surpassed $20 billion last year. Authorities disrupt a Russian router botnet that intercepted email logins. Iran hacks PLCs across the US and exploitation hits ComfyUI and Flowwise AI servers. This is the risky bulletin prepared by Catalan Kim Panu and read by me, Claire Airdrop Today is the 8th of April and this podcast episode is brought to you by Airlock Digital. In today's top story, Americans lost a record $21 billion to cybercrime last year. It's the highest amount since the FBI began tracking cybercrime data 25 years ago. Cyber enabled fraud accounted for $17.7 billion, or 85% of last year's losses. $8.6 billion was lost to investment scams, making it the top franchise fraud category for the fourth year in a row. The FBI also received more than 1 million cybercrime reports for the first time and says it's now receiving more than 3,000 a day. In other news CISA will likely have to cut staff as part of next year's proposed White House budget. The proposal released last week would cut $707 million from CISA's 2027 budget. This would translate to cutting 867 jobs, bringing its workforce to almost half the size it was when Donald Trump took office. The budget also cuts a program that supports local governments and eliminates CISA's 14 person election security program. Russia's attempt to block VPNs last week caused a major banking outage. Point of sale and ATM transactions were down for a number of hours on Friday morning, according to local tech experts. The issue was caused by Russian banks using VPN tunnels within their infrastructure once operations were restored. Russia's Internet agency ordered some news sites to take down articles about the incident. A key member of the Revil and Gand Crab ransomware groups has been identified by German authorities. The 31 year old Russian national, Daniil Shukin, used the online handle Unknown. He was an administrator and public representative of both groups. He'd previously been indicted in the US but his role within the groups was unclear. According to a CCC talk from 2023, his last known location was Turkey. He'd fled Russia with his wife after the start of the Ukrainian war. Russian military hackers have compromised thousands of routers globally to redirect select authentication traffic to phishing pages. Most of the compromised devices are Mikrotik and TP link routers. The phishing pages target Microsoft accounts and email server login pages. Victims have been confirmed in Africa, Southeast Asia and Central America. The botnet's been linked to a collection of cyber units from Russia's military intelligence service, the gru. The botnet was disrupted this week by US authorities. Microsoft and Lumen Technologies, Iranian threat actors are hacking Internet exposed programmable logic controllers. CISA and the FBI say Disruptions have been reported across the US the attacks have targeted Rockwell and Allen Bradley PLCs. A threat actor using the moniker Raccoon is extorting high value corporations. The attacker is using social engineering to trick employees into accessing fake Okta login pages. Google's security team has spotted attacks against dozens of major companies. Brazilian authorities have arrested a man accused of running a fake mobile base station from his apartment window. It was used as an SMS blaster to send spam. The device was detected by Brazil's communications watchdog Anatel. The agency held workshops for local telcos last year and about how to spot fake base stations. The founder of spyware company PC Tattletale has avoided further jail time. Brian Fleming was sentenced last week to times served and received a fine of $5,000. He was charged with creating and selling the spyware last year and pleaded guilty in January. Fleming shut down PC Tattletale in 2024 after the company leaked customer data. A major US law firm has confirmed a security breach after hackers posted client information online. The breach on Jones Day was the result of a successful phishing attack. The company is one of the biggest corporate law firms in the U.S. employing more than 2,400 lawyers. The firm represented U.S. president Donald Trump during both of his election campaigns. Two Canadian telecommunications companies have reported recent data breaches. Freedom Mobile and Rogers have notified customers of the incidents. The intrusions appear to be related to a breach at the business outsourcing company Telus Digital. A cybersecurity incident has disrupted the Bat Mini security alarm monitoring system. The system was down for two days across the U.S. last week. Its vendor, Uplink, has not provided details about the root cause. North Korean hackers built a fake trading company to steal $280 million from the Drift platform. The attackers spent months building Truck Trust with their targets. They then used malicious Apple test flight apps and VS code extensions to compromise devices. Hackers used the compromised systems to sign the transactions that emptied Drift's treasury. Last month. Investigators linked the attack to a group known as Citrine Sleet. A threat actor is abusing ComfyUI to deploy cryptocurrency miners on high capacity cloud servers. Compromised systems are also enrolled in a proxy network. Census says the same attacker is also also exploiting Redis databases. Threat actors are launching attacks on Flowwise, a web based tool for building and deploying AI agents. The attackers are leveraging a major vulnerability that was patched in September. The bug allows remote unauthenticated attackers to inject and run commands on the Flowwise server. The vulnerability has a severity rating of 10. VulnCheck first spotted attacks this week. A Chinese cybercrime group has used zero Days to deploy the Meduza ransomware. Microsoft has linked the group, known as Storm 1175-0 Days, in GoAnywhere, MFT and Smarter Mail. The group also used 14 additional vulnerabilities shortly after public disclosure. Microsoft says the group moves rapidly from initial compromise to ransomware deployment and rotates exploits on a regular basis. A security researcher has published proof of concept code for a Windows zero day. The Blue Hammer Zero Day can be used to elevate privileges on Windows. The researcher appears to have released the exploit code after a disagreement with Microsoft's team that handles its bug bounty program. Cloudflare plans to secure its cloud systems against post quantum encryption attacks by 2029. The company has accelerated its roadmap following a similar announcement from Google last week. Cloudflare and Goog both cited recent advances in quantum computers. And finally, Anthropic has given more than 40 tech companies access to a new AI agent for cybersecurity defence work. The Mythos agent has been designed to help companies find vulnerabilities in their code. Anthropic has also donated $4 million to open source security organizations to help fund the patching of identified issues. And that is all for this podcast edition. Today's show was brought to you by Airlock Digital. Find them@airlockdigital.com thanks for your company.