← Risky Bulletin
Risky Bulletin
Risky Bulletin: eScan antivirus distributes backdoor in latest supply chain attack
00:07:01
Loading summary
Transcript1 lines
- [00:04]
A
Hackers breach E Scan antivirus and distributor backdoor Google takes down the IP Idea proxy botnet Most GDPR fines remain uncollected and the Poland wiper attack hit 30 locations this is the risky bulletin prepared by Catalyn Campanu and read by me, Amberly Jack. Today is January 30th and this podcast episode is brought to you by Push Security. In today's top story, the update mechanism of E Scan Antivirus has been used to deliver malware. E Scan says the incident affected just one regional update server. It occurred on January 20th and lasted about an hour. The payload was a backdoor that disabled future E Scan updates and contacted a remote command and control server. U.S. cyber Command hacked foreign disinformation farms ahead of the country's 2024 elections. According to CN, the campaign targeted Russian and Iranian troll farms. Since President Donald Trump took office, his administration has shut down many government programs meant to fight foreign disinformation. The Russian data wiper attack against Poland's energy sector impacted 30 locations. The attack targeted remote terminal units, which are used to monitor energy infrastructure. According to industrial security firm Dragos, the attack rendered the units beyond repair but did not crash the energy grid. The impacted sites include heat and power plants, as well as facilities that manage renewable wind and solar generation. Ireland's Data Protection Agency has collected just 0.5% of all GDPR fines issued. Many foreign tech companies operating in the EU are based in Ireland. 20 million euros has been collected since the GDPR entered into effect in 2016. The total fines issued amount to more than 4 billion euros. The agency says most of the fines are stuck in the appeals process. Apple is rolling out a new privacy setting for iPhones and iPads. The feature will allow users to hide their precise locations from their mobile and cell providers. Once enabled, telcos will only be able to determine a user's general area. The feature will be available for devices running iOS 26.3 or later. Google has agreed to pay $135 million to settle a class action lawsuit. The company was accused of collecting location data without users consent. This is the second class action lawsuit Google has settled this week. It also agreed to pay $68 million for recording users via its voice assistant. The South Korean government will notify citizens when their data is exposed in a security breach. The new system will cover confirmed breaches as well as those under investigation. The changes are part of a new government cybersecurity framework created in response to multiple high profile breaches. Last year, the head of EU's cybersecurity agency says Europe is not investing enough in the sector. ANEESA head Johan Lepassar says recent investments in the bloc's security have failed to adequately address cyber. Lepassar says most EU startups currently rely on cybersecurity data from American organisations like CISA and Mitre. The Chinese government has carried out the death sentences of 11 individuals who ran cyberscam compounds in Myanmar. The suspects were executed following failed appeals. All were members of the Ming crime family and were originally sentenced in October. Five further scam compound operators linked to the Bai family are currently awaiting execution. The FBI has seized the Ramp cybercrime forum. One of RAMP's admins confirmed the takedown in a post on arrival forum. The the site was routinely used to advertise and recruit for ransomware operations. Google has disrupted domains linked to the IP Idea residential proxy botnet. The company says the botnet had been used to hide the activities of multiple threat actors. The IP Idea group operated multiple software development kits, which allowed users to share their Internet bandwidth, but those services were often abused to relay malicious traffic. Google will also start blocking Android apps that use the SDKs. A co founder and administrator of the Empire Underground market has pleaded guilty to federal drug charges. Raheem Hamilton ran the dark web market together with another co founder from 2018 until 2020. The market was used to sell more than $375 million worth of drugs. The other founder, Thomas Pavey, pleaded guilty earlier this month to similar charges. A Chinese national has been sentenced to 46 months in a US prison for laundering Cambodian crypto scam proceeds. Xing Liang Su was part of a network that controlled bank accounts in the bahamas that converted $37 million of stolen funds into cryptocurrency. Su and seven others pleaded guilty last year. Chinese services now account for 20% of all on chain crypto laundering operations, according to a Chainalysis report. Chinese operators laundered more than $82 billion last year, up from just $10 billion in 2020. The growth was driven by law enforcement actions targeting rival services across Southeast Asia. Hackers are scanning the Internet for misconfigured LLM servers and selling access to their computing power on specialised marketplaces. The campaign targets multiple large language model solutions such as such as Ollama and Vllm. Pillars Security has linked the attacks to a threat actor going by the name Hekka. And finally, a major North Korean hacking group known as Labyrinth. Kolyma has separated into three distinct groups. According to CrowdStrike, all three operate independently but share the same tools. The Corps of Labyrinth Kolima continues to carry out cyber espionage operations. The spin offs golden and Pressure Kalima Target the cryptocurrency ecosystem. That's all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them@PushSecurity.com thanks to your company.