← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
An APT stole source code and Vulnerability reports from F5A European MP files a criminal hijacking complaint against Hungary's Prime Minister. Airport PA systems are hijacked in Canada and the US and the Power School hacker gets prison time. This is the Risky Bulletin prepared by Catalan Kimpanu and read by me Claire aired today is the 17th of October and this podcast episode is brought to you by Nebuloc. In today's top story, American tech company F5 was hacked by a Chinese state sponsored group. The hackers were in the company's network for almost a year and stole source code and vulnerability reports. Sources told Bloomberg that the Chinese hacking group UNC5221 was behind the intrusion. F5 has patched the stolen vulnerabilities and has rotated signing keys and certificates. In other news, the UK government has refuted a media report that Chinese hackers breached its classified information system. This week the Times reported that Chinese hackers maintained access for over a decade. The hackers allegedly accessed diplomatic cables, government policy documents and private communications. Former NCSC boss Kieran Martin described the report as categorically untrue. A member of the European Parliament has filed a criminal hacking complaint against Hungary's Prime Minister Viktor Orban. German Green Party member Daniel Freund claims the Hungarian Secret Service tried to deploy spyware on his device. Last May, the EU cyber security team detected an attempted deployment of spyware made by Israeli vendor Candiru. Freund has been a vocal critic of Orban. A Massachusetts man has been sentenced to four years in prison for hacking the PowerSchool education cloud platform. 20 year old Matthew D. Lane stole the personal details of 70 million students and teachers. Last year, PowerSchool paid a ransom of $2.85 million. Lane also attempted to extort individual school districts. He was arrested earlier this year and pleaded guilty. He's been ordered to pay $14 million in restitution. Microsoft has revoked 200 certificates used by the Vanilla Tempest group to sign malware. The certificates were being used to sign apps that posed as legitimate software. The apps were distributed via poisoned search results. The Vanilla Tempest group is also known as Vice Society. Its most recent attacks deployed the Resider ransomware. Eight auto insurers have agreed to pay the State of New York $14.2 million over data handling practices. More than 800,000 New Yorkers had their data stolen from online quote forms that were pre filled with personal information. Some of the stolen data was later used to fraudulently file for COVID 19 unemployment payments. The UK's privacy watchdog has fined outsourcing company Capita 14 million pounds. The company was found at fault for a 2023 ransomware attack that exposed the personal details of 6.6 million customers. The regulator initially planned to fine the company 45 million pounds before capita accepted Liab. A ransomware attack has been disrupting the Muni OS debt marketplace. The platform allows US local and state governments to share bond offering documents to raise capital. According to Bloomberg. The site's been down for several days and has already disrupted municipal government financing. Hackers hijacked PA systems and defaced display screens at four North American airports this week. The attackers broadcasted messages praising Hamas while criticising US President Donald Trump and Israeli Prime Minister Benjamin Netanyahu. Incidents were reported on Tuesday at Pennsylvania's Harrisburg International Airport plus three Canadian airports. More than 500 VS code extensions have leaked access tokens and credentials. In more than 130 cases, the tokens would have allowed threat actors to publish malicious updates. Most of the credentials were found in JSON configuration files that ship with the extensions. According to Wiz, the extensions had been installed 150,000 times. A Russian bulletproof web hosting provider has shut down citing political reasons. Bear Host customers have been left without refunds or access to their servers. The service was also known as Voodoo servers and began operating in 2016. According to Reis Security, one of its most well known customers was the Killin Ransomware Group. A suspected Chinese APT group has hacked a Russian IT service provider. The attackers maintained access for at least five months and sought to steal the company's source code. Broadcom's security team believes the Juulbug Group was trying to launch a supply chain attack. The group also hacked a Latin American government, a Taiwanese company and another South Asian IT provider. North Korean state sponsored hackers are storing malicious code in smart contracts on the Binance public blockchain. The technique, known as etherhiding, has been used by cybercriminals and botnets since 2023. Google tracks the North Korean group as UNC5342. It's also known as Contagious Interview. The group is known for its cryptocurrency heists. Hackers are exploiting a recent zero day to deploy rootkits on Cisco switches. Cisco patched the vulnerability in late September while it was under attack, but did not provide further details. Trend Micro says the hacking campaign targeted CIS 9400 and 9300 switches. Some attacks also targeted legacy 3750G devices. Threat actors are exploiting a recently patched vulnerability in the Adobe Experience Manager form. Building extensions Attackers are bypassing authentication and running malicious code via a component that was left enabled in developer mode. Security researchers published a detailed write up and proof of concept code in July. Adobe patched the bug a week later. The vulnerability has a severity rating of 10 out of 10. Red lion has patched two vulnerabilities that could be used to take over six net industrial controllers. The flaws allowed attackers to bypass authentication and run code on the devices with root privileges. Vulnerable models include Red Lion 6 track and VersaTrack remote terminal units. Both vulnerabilities have a severity score of 10. And finally, Google users can now recover their accounts using the help of a friend or family member. The Recovery Contacts feature is intended for situations when users lose their phone or passkey devices. Google will send a code to a friend or family member that can be used to recover the account, and that is all for this podcast edition. Today's show was brought to you by our sponsor nebuloc. Find them at Nebuloc IO. Thanks to your company.