← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Hackers leaked data from a major Russian bulletproof hosting provider Australia deregisters 95 companies linked to cyber scams, the US treasury gets hacked again and Meta expands teen accounts to Facebook and Facebook Messenger. This is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 9th of April. A hacker has leaked files from major bulletproof hosting provider media. The files contain information on customers, the services they use and the data they hosted on the platform. The leak includes recent data and could help de anonymize cybercrime operators threat. Intel firm Prodaft believes the same actor also leaked internal chats from the BlackBasta ransomware group in February. Medialand is a Russia registered company that has been active for more than a decade. In other news, hackers have breached US Treasury Office email systems and intercepted around 100 employees emails. The breach occurred in June 2023 and was discovered by CISA in January this year. The Treasury's Office of Foreign Assets Control and the Committee on Foreign Investment in the US were also breached earlier this year. The US government blamed Chinese hacking group Silk Typhoon for those hacks. 21 countries have joined the Pall More process, an international agreement to combat the proliferation of commercial spyware. The U.S. israel and Macedonia did not participate. Coincidentally, those countries are well known for their spyware industries. A similar U S led commitment was signed by 23 countries in 2023 under the Biden administration. Elon Musk's DOGE team has allegedly deployed an AI tool to surveil internal communications at the Environmental Protection Agen Agency, according to a report from Reuters. The tool is designed to monitor chats for disloyalty and negative comments about Donald Trump and Musk. The EPA did not confirm or deny the story when it was approached by Reuters. A Chinese info op is attempting to influence the Chinese diaspora in Canada ahead of the country's upcoming federal election. The campaign is taking place on WeChat, an app commonly used by Chinese speakers everywhere. The info op is attacking Canada's Liberal Party leader and current Prime Minister Mark Carney. Canada's election task force has linked the campaign to the Chinese Communist Party's Central Political and Legal Affairs Commission. The Russian Government may block 12 Foreign web hosting providers for failing to register in the country. The country's Internet watchdog says companies must comply with local laws and integrate with its anti DDoS system. The Roscom Nadzor has been threatening to block foreign web and cloud providers since Russia invaded Ukraine. The agency ran a test last month to see if it could block access to Cloudflare, which caused significant disruption to Russian Internet users. Australia's financial regulator is deregistering 95 companies with suspected links to online investment and romance scams. Most of the companies had been registered with false information and many were associated with apps and websites used in the scams. ASIC says the companies were set up to give the scams a veneer of credibility. Spain's national police have broken up a criminal group that allegedly stole more than 19 million euros via cryptocurrency investment scams. Six suspects were detained in Spain, including the gang's leader, who was preparing to travel to Dubai. The group allegedly used AI to create deepfake ads of Spanish celebrities luring victims to fake investment portals. Two Singaporean banks have confirmed a ransomware gang stole its customers data from a printing service provider. The incident impacted DBS bank and the bank of China's Singapore branch. The banks used the service to print and send letters to its customers. 10 VS code extensions that contain crypto miners have been spotted in the official plugin store. The extensions were published by three accounts and appear to have accumulated over 1 million installs. But security firm Extension Total says the installation numbers were artificially inflated to make the extensions appear popular. The Hellcat hacking group is using JIRA credentials collected by InfoStealer malware to breach systems. The group acquires the credentials from underground markets, accesses corporate networks, steals sensitive data and then extorts the companies. Hellcat's hacking spree has been going on for over a month and has hit dozens of companies. The most well known victims include Telefonica Orange, Schneider Electric and Jaguar Land Rover. A threat actor named Kill Security has claimed credit for a hacking spree that used a zero day vulnerability in Crush FTP. The group claims it stole significant volumes of data and is now extorting victims. In the meantime, Crush FTP is dealing with drama of its own after it asked Mitre to invalidate the original CVE for the vulnerability and not issue a replacement one for 90 days. Critics have claimed this was to help them keep the vulnerability quiet. The toddycat cyber espionage group is abusing an ESET security tool to escalate privileges on compromised systems. ESET released a security update last week to fix the issue, which is in its command line scanner. The attack is another example of APT groups using the bring your own vulnerable driver technique. Google has patched two Zero days in Android. One of the fixes is a patch for cellebrite exploit used by Serbian authorities to unlock the phones of journalists and anti government protesters. The exploit and the HAC were first detailed in an Amnesty International report in February. There are no details on the second zero day, which impacts the Android kernel USB audio driver code. This is the third month in a row that Google has fixed zero days in the Android os. Meta is expanding its teen account's security protections from Instagram to Facebook and Facebook messenger accounts. The feature prevents children under the age of 16 from modifying a series of privacy settings on their accounts without a parent parents approval. This includes settings related to who can contact the account and what content they can see on the site. Meta is also expanding these restrictions and teens won't be able to live stream on their sites without a parent's approval. And finally, akamai says that four of the 10 largest DDoS attacks it ever mitigated took place last year. Overall, DDoS attacks are getting longer and larger with each quarter. Much of the recent rise was driven by the recent Russo Ukrainian and Israeli Palestine conflicts. And that is all for podcast edition thanksg company.