Summary5 min read

Risky Bulletin: Germany Seeks More Hacking and Surveillance Powers for Its Intel Service

Podcast: Risky Bulletin (Risky.biz)
Episode date: January 19, 2026
Host: Amberly Jack
Prepared by: Katalin Campanu

Episode Overview

This episode provides a rapid-fire rundown of significant cybersecurity and geopolitics news, with a primary focus on Germany's proposed law to extend digital surveillance and hacking capabilities for its intelligence service (BND). Other featured topics include legislative moves in Finland and the European Union, global internet and disinformation disruptions, high-profile hacks, legal actions against threat actors, notable vulnerabilities, and ongoing cyber exploits in major software platforms.

Key Discussion Points & Insights

1. Germany’s BND Surveillance Law

[00:10] The German government is considering a law to grant its Federal Intelligence Service (BND) expanded hacking and surveillance powers.
- The law would allow BND to:
  - Store full internet communications, not just metadata.
  - Hack foreign service providers.
  - Surveil foreigners and some journalists.
"If approved, a new law would allow the storage of full internet communications rather than just selected metadata."
— Amberly Jack [00:12]

2. Finnish Legislation Against Disinformation

[00:24] Finland's Ministry of Justice proposes criminalizing the spread of false information on behalf of foreign entities.
- The law targets local operatives involved in foreign disinformation.
- Uncertainty remains whether penalties include prison time.

3. US Government and RSA Conference Tensions

[00:32] US cyber officials may skip this year’s RSA Cybersecurity Conference.
- Triggered by Jen Easterly’s appointment as RSA CEO, previously CISA Director under Biden.
- Seen as a political signal from Trump administration officials.

4. EU to Ban Chinese Tech in Critical Infrastructure

[00:39] The EU is preparing a ban on Chinese telecom and solar equipment in its cybersecurity act.
- Affects companies like Huawei and ZTE.

5. Permanent Internet Cuts in Iran

[00:46] Iran could make longstanding internet disconnects permanent; ongoing internet blackout amid protests.
- Only ‘vetted’ individuals may be allowed broader access going forward.
- Digital rights groups confirm government plans for severe restriction.

6. Disinformation Actors Go Silent During Outages

[00:57] Patriotic “French” accounts stirring anti-government sentiment disappeared from X (Twitter) after Iran’s internet outage. Similar activity reported in Scottish independence circles.

"A cluster of so called French patriotic accounts went silent on X after Iran removed itself from the Internet."
— Amberly Jack [01:00]

7. Legal and Regulatory Actions

CrowdStrike Lawsuit Dismissed ([01:10]):
- Shareholder lawsuit over the massive 2024 outage dismissed for lack of evidence of fraud.
Hackers Extort Grubhub ([01:19]):
- Shiny Hunters threaten to leak data hacked from Grubhub’s Salesforce and Zendesk.
European Rail Data Breach ([01:25]):
- Personal information (including passports) of EU rail customers stolen.
$282M Crypto Theft ([01:29]):
- Funds drained from a hardware wallet using social engineering, laundered into Monero—price spikes 70% as a result.

8. Prosecutions and Criminal Cases

Access Broker Arrested ([01:37]):
- Jordanian man, Firas Khali Ahmad Abashiti (aka Riz), pled guilty to selling US network access.
Tennessee Hacker Sentenced ([01:43]):
- Nicholas Moore hacked Supreme Court/Veterans Affairs, posted data to Instagram. Pleads guilty.
Venezuelans Sentenced for ATM Malware ([01:52]):
- Five nationals used malware in Georgia (US) ATMs, caught via fingerprints/surveillance.

9. Active Threats and Vulnerabilities

Malicious Chrome Extensions ([02:02]):
- Five extensions targeted HR/ERP software (Workday, NetSuite, SuccessFactors), stealing cookies and hijacking sessions. 2,300 users affected.
AMD Stack Warp Attack ([02:10]):
- Vulnerability allows code execution in AMD SEV environments; exposed secrets in VMs. Firmware patch released.
Fortinet FortiSIEM Exploited ([02:17]):
- Attackers use recent PoC for pre-auth remote command execution after public disclosure.
Cisco Zero-Day Active Exploits ([02:23]):
- Zero-day in email security appliances abused by a Chinese espionage group; lets attackers run root commands.
Google Zero-Click Dolby Vulnerability ([02:30]):
- Project Zero discloses zero-click exploit for Dolby decoder in Android; tested on Pixel 9, affects many devices.
"No user interaction is required, as many Android communication apps automatically process audio."
— Amberly Jack [02:42]
Livewire PHP RCE ([02:44]):
- Unpatched Laravel Livewire file manager lets attackers upload and run malicious PHP. No vendor response yet.

Notable Quotes & Memorable Moments

On Germany’s Proposed Law:

"A new law would allow the storage of full internet communications rather than just selected metadata."
— Amberly Jack [00:12]
On the French Disinformation Cluster Vanishing:

"A cluster of so called French patriotic accounts went silent on X after Iran removed itself from the internet."
— Amberly Jack [01:00]
On the Scale of Crypto Theft:

"A hacker has stolen $282 million in crypto from a single hardware wallet… The move caused the price of Monero to spike 70% in the days following."
— Amberly Jack [01:30]
On Google’s Zero-Click Exploit:

"No user interaction is required, as many Android communication apps automatically process audio."
— Amberly Jack [02:42]

Timestamps for Important Segments

Germany’s Surveillance Law – [00:10]
Finland’s Proposed Disinformation Law – [00:24]
US RSA Conference Boycott – [00:32]
EU Ban on Chinese Tech – [00:39]
Iran’s Internet Blackout – [00:46]
Disinformation Accounts Go Silent – [00:57]
CrowdStrike Lawsuit Dismissed – [01:10]
Grubhub Data Extortion – [01:19]
EU Rail Data Breach – [01:25]
$282M Crypto Heist – [01:29]
Access Broker Sentenced – [01:37]
US Supreme Court/VA Hacker – [01:43]
ATM Malware Group Sentenced – [01:52]
Malicious Chrome Extensions – [02:02]
AMD Stack Warp Vulnerability – [02:10]
Fortinet Vulnerability Exploited – [02:17]
Cisco Zero-Day Hack – [02:23]
Android Zero-Click Exploit – [02:30]
Livewire File Manager RCE – [02:44]

Tone and Style

The episode delivers news in a brief, factual, and slightly urgent tone, providing context and highlighting impacts where appropriate. Amberly Jack’s delivery is clear and information-dense, in line with cybersecurity professional audiences.

Summary

This installment of Risky Bulletin succinctly unpacks top global cybersecurity, policy, and infosec news: from sweeping proposals for German state surveillance, European responses to Chinese tech, Iran’s drive for a split internet, to ongoing threats and vulnerabilities affecting software, hardware, and infrastructure. The briefing format ensures maximum relevance for security professionals and anyone interested in current cyber and policy developments.

Loading summary

Transcript1 lines

[00:04]
A
Germany seeks more hacking and surveillance powers for its intelligence service. Finland intends to criminalise the spreading of false information Patriotic French social media goes quiet during Iran's Internet outage and hackers are extorting GrubHub. This is the risky bulletin prepared by Katalin Campanu and read by me, Amberly Jack Today is January 19th and this podcast episode is brought to you by Spectrops, the experts in attack path management. In today's top story, Germany is considering increased hacking and surveillance powers for its intelligence service, the bnd. If approved, a new law would allow the storage of full Internet communications rather than just selected metadata. The BND would also be allowed to hack foreign service providers and as well as surveil foreigners and some journalists. The Finnish Ministry of Justice may criminalise the dissemination of false information on behalf of a foreign government. The proposed law is aimed to counter disinformation operations aided by local operatives. It's unclear whether the punishment would include prison sentences. U.S. government cyber officials may not attend this year's RSA Cybersecurity conference. According to NexGov, Trump administration officials are considering skipping the event after Jen Easterly was appointed CEO of the conference. Easterly served as sister Director during the Biden administration. The EU is preparing to ban Chinese equipment in telecommunications and solar energy. The provision is part of the draft EU Cybersecurity act set to be unveiled this week. The ban would apply to Chinese companies such as Huawei and zte. Reports from Iran suggest the country will permanently disconnect its populace from the global Internet. The Internet has been down for more than a week during protests. Digital rights organisation Filter Watch says a plan is underway for long term restrictions. Access to the global Internet would be limited to vetted individuals. A cluster of so called French patriotic accounts went silent on X after Iran removed itself from the Internet. The accounts posed as French people and stoked anti government protests. A similar cluster promoting the Scottish independence movement also went quiet. A lawsuit by CrowdStrike shareholders over the company's 2024 outage has been dismissed. The incident crashed more than 8 million Windows computers impacting flights and hospitals globally. Shareholders argued the company lied about its software testing practices. The judge said shareholders failed to prove that CrowdStrike's statements were motivated by an intent to defraud. Hackers are extorting food delivery platform grubhub. The Shiny Hunters group is threatening to release files that were stolen from the company's Salesforce and Zendesk accounts last year. The company has not said if it intends to pay. A hacker has stolen personal information about EU rail customers. The European rail company began notifying affected individuals last week. Stolen data includes names, contact information and passport details. A hacker has stolen $282 million in crypto from a single hardware wallet. The funds were stolen through social engineering on January 10 and and immediately laundered into Monero. The move caused the price of monero to spike 70% in the days following. A Jordanian man has pleaded guilty to selling access to more than 50 hacked networks in the US Firas Khali Ahmad Abashiti worked as an individual access broker under the name Riz. He was arrested in the country of Georgia and extradited to the US last year. He he faces up to 10 years in prison. A Tennessee man who hacked the US Supreme Court also breached the Department of Veterans Affairs. Nicholas Moore published data from both networks on his Instagram account. Hackthegovernment. He pleaded guilty last week. Moore faces a maximum sentence of one year in prison and a fine of up to $100,000. Five Venezuelan nationals have pleaded guilty to hacking ATMs in the US state of Georgia. The group accessed the ATM supervisor mode and deployed malware to force the devices to dispense cash. Members of the group were caught on camera and were identified through fingerprints left behind. They face up to 30 years in prison. A cluster of five malicious Chrome extensions is targeting HR and ERP platforms. The extensions contain code to steal cookies, hijack sessions, and block access to security and admin pages. Targeted services include Workday, NetSuite and SuccessFactors. According to Socket Security, roughly 2,300 users were affected. Academics have discovered a vulnerability that allows malicious code to run inside the AMD Secure encrypted virtualization platform. The Stack Warp attack can be used to expose secrets from virtual machines in AMD powered clouds. All Xen family processes are affected when hyperthreading is enabled. The company released firmware updates last week. Threat actors are exploiting a recently patched vulnerability in Fortinet FortiSeam devices. The attacks began after security firm Horizon 3 published a write up and proof of concept code. The vulnerability allows attackers to remotely run OS commands on the device without authentication. Cisco has released a security update for a zero day disclosed by the company in December. The flaw affected Cisco Email Security products such as the Secure Email Gateway and the Cisco Secure Email and Web Manager. It allows the attackers to run commands as root on the devices if the quarantine service was enabled. Cisco linked the attacks to a Chinese espionage group. Google Project Zero has released a zero click exploit for the Dolby Audio decoder on Android phones. No user interaction is required, as many Android communication apps automatically process audio. The exploit was tested on a Pixel 9, but Google researchers say the attack should work against most Android devices. And finally, an unpatched security flaw has been disclosed in Livewire, a file manager for the popular Laravel web framework. The vulnerability can allow threat actors to upload malicious PHP files and execute them. Neither Livewire nor Laravel have responded to researchers. That's all for this podcast edition. Today's show was brought to you by our sponsor, Spectrops. Find them@Spectropsio. Thanks for your company.