← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
Canonical's Snap Store hit by Domain Resurrection attacks Russia will use AI to detect VPN users, Iranian hackers use Starlink during Internet outage, and Greece arrests SMS blasters by dumb luck. This is the risky bulletin prepared by Cataline Campanu and read by me, Amberly Jack Today is January 21st and this podcast episode is brought to you by Spectrops. The experts in attack path management threat actors are using expired email domains to hijack developer accounts on Canonical's Linux app Store. At least two accounts on the Snap Store have been taken over through Domain Resurrection attacks, according to Linux expert Alan Pope. The group responsible is based in Croatia and has been targeting Snap with malicious packages for two years. GitHub, PyPi and npm have all experienced similar attacks. Ireland has adopted new lawful interception powers. The law grants police and intelligence agencies the power to surveil any type of modern communications channel. It also allows them to use covert software for their operations, including spyware. Under the new law, communications service providers must cooperate with government operations. The British government has launched a new service for reporting online scams, cybercrime and fraud. The report fraud service soft launched in December and was made widely available this week. It will replace the previous cybercrime reporting tool, Action Fraud. The new service features a streamlined process and allows victims to submit evidence for criminal investigations. Russia's Internet watchdog will use AI technology to automatically detect VPN users. The Roscovnadzor will spend close to $30 million this year to develop the system. The Russian government has blocked access to dozens of VPN apps. It is a crime in Russia to share information about censorship, circumvention Russian banks have blocked access to almost 3 million bank cards this month. The banks are implementing new fraud detection rules issued by the Russian central bank. The number of specific rules that banks must follow have doubled from 6 to 12. Some Russians have reported that their cards were blocked after everyday activities such as buying goods online. CISA's acting head, Madu Ghotamakawa, tried to forcibly reassign the agency's chief information officer last week. Robert Costello was given the choice to accept a management directed reassignment or resign by Friday. Gotchmakhala backed down after pushback from senior officials. Costello has been the agency's CIO for four years. A major Apple iPhone assembler has fallen victim to a ransomware attack. The Ransom Hub group claims to have stolen circuit board designs and internal documents from Chinese company Luxshare. The stolen files allegedly include data about Apple and Nvidia products going back six years Hackers have disrupted Iran's state TV channel to broadcast anti government propaganda. The broadcast displayed messages from the country's exiled crown prince who urged the military to join the anti regime protests. Thousands of protesters have been killed by the military in Iran during recent unrest. Iranian hacking group Handala is carrying out its attacks via Starlink connections. According to security firm Check Point, activity from the group initially stopped when the Iranian regime cut off the country's Internet access. Fresh activity was spotted a few days later coming from Starlink IP ranges. The Handala group poses as hacktivists but is run by Iran's MOIS intelligence service. Greek authorities have arrested two Chinese nationals for sending SMS spam. The suspects drove around Athens with an SMS blaster in their car. The two were questioned by police after they were reported to be acting suspiciously at a mall. The device was found during a subsequent search of their car. Real estate company Minto holdings is seeking to recover a ransom payment made to the CACBOT malware. The company is seeking $830,000 from Cacbot's developer Rustam Rafalevich Gallyamov. A 49 year old Moscow resident. Gallyamov was indicted by the US last year for running Cacbot. He is still at large. A Telegram based criminal marketplace appears to have shut down most of its operations. TUDO provided services for cyber scams. Prior to its shutdown, it had processed more than $12 billion in user transactions. According to Elliptic. This made Tudo the third largest illicit marketplace of all time. Tudo launched in 2025 after Telegram shut down the Huey One Guarantee Marketplace, which processed $27 billion worth of similar transactions. TP Link has released a security update for its Viji cameras to patch a critical device takeover vulnerability. The bug can allow attackers on the same LAN to bypass authentication during the password reset process. The vulnerabilities impact 32 camera models. And finally, security firm Check Point believes the new Void Link malware framework was almost entirely coded using AI tools. The malware was designed to target Linux servers running in cloud environments. It was discovered this month. Check Point believes the malware is the work of a single developer using the Trey AI based ide. That's all for this podcast edition. Today's show was brought to you by our sponsor Spectrops. Find them@Spectropsio. Thanks for your company.