← Risky Bulletin
Risky Bulletin
Risky Bulletin: IcedID malware developer fakes his own death to escape the FBI
00:07:11
Loading summary
Transcript1 lines
- [00:04]
A
A malware developer faked his own death to evade the FBI Apple patches a zero day used in a targeted attack the Tianfu cup quietly returns and researchers spot the first malicious Outlook Add in. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 13th of February and this podcast episode is brought to you by Trail of Bits. In today's top story, the Ukrainian developer of the Iced ID malware tried to evade the FBI by faking his own death after learning he was being sought by US officials in 2024, the unnamed suspect bribed Ukrainian police to issue a fake death certificate. He did, though, continue to live at his known address. Local authorities seized Iced ID a month later. He was arrested in the Ukraine in December. A local judge has set bail at $9.3 million, deeming him a flight risk. In other news, Apple has patched a zero day that it says was used in a sophisticated attack. The attack targeted specific individuals that were using versions prior to iOS 26. The attacks were discovered by Google's security team. The zero day was in the dynamic linker component, which links executables to their libraries. It's one of 37 vulnerabilities patched by Apple this week. Russia's Internet watchdog has blocked access to YouTube, Facebook, WhatsApp and Instagram. The Roscom Nadzor has removed the platform's records from the country's domain name system. The agency has been throttling traffic to YouTube and WhatsApp since July. The Russian government designated Meta an extremist organisation after the company refused to censor content related to the Ukrainian war. The Roscom Nadzor has also blocked access to the Tor project, the BBC and several media sites. The Dutch government has been urged to keep its national ID service away from US providers. The DigiID service is hosted by cloud provider Solvinity, which was recently acquired by an American company. The lower house of the Dutch parliament wants the infrastructure located in Europe. Meantime, the Swiss government has ended its contract with American analytics company Palantir. Officials said the platform risked national security. A review carried out by the Swiss armed forces found a significant likelihood that the US government would be able to access confidential Swiss data. French authorities have taken down More than 100 websites operated by a Russian disinformation group. The websites posed as French news outlets to manipulate opinions about political candidates ahead of next month's municipal elections. The French National Security Directorate said the sites were taken down before they achieved any significant visibility. Iranian hackers are attempting to breach personal Google accounts of Israeli officials. The number of attacks increased after Israel's 12 day war with Iran last year. Hundreds of attacks have been detected in recent months. They targeted government officials, academics and journalists. Hackers have breached the customer contact system of Dutch telco Odido. According to the local media outlet NOS, more than 6.2 million customers are affected. Odido says sensitive information like invoice, passwords and location data was not stolen. South Korean authorities have accused Coupang of failing to preserve logs from last year's security breach. The incident at the country's largest online retailer exposed the personal details of more than 33 million South Koreans. The company's American owners have sued the government in Seoul, accusing it of unfair treatment. Three fashion and luxury brands have been fined $25 million in South Korea over recent data breaches. The fines were levied against the local brand branches of Christian Dior, Louis Vuitton and Tiffany's and company. All three companies suffered breaches last year, exposing the personal details of a combined 5.5 million customers. Ukraine's cyber police have detained two men accused of stealing funds from a local hospital. They allegedly hacked the hospital accountant's computer and transferred more than $115,000 to their own company's accounts. US prosecutors are seeking a nine year prison sentence for a trenchant executive who sold zero day exploits to foreign adversaries. Australian national Peter Williams sold eight of his employer's exploits to a Russian company for $1.3 million. Prosecutors are also seeking $35 million in restitution, a fine of $250,000 and three years of supervised release. The infrastructure of an abandoned Outlook add in has been hijacked to steal Microsoft credentials. More than 4,000 users of the agree to add in were compromised in the attack, according to Koi Security. The attackers took over an expired Vercel app domain after the developer failed to renew it. The attacker then deployed malicious code that prompted users to re authenticate to a phishing site. Global telnet traffic has fallen by two thirds in the last month, according to security firm Gray Noise. The sudden drop began on January 14th. A week later a major telnet vulnerability was disclosed. Traffic has remained at 35% of previous levels, suggesting a concerted effort by Internet service providers to block the outdated protocol. Google says that LLMs have become essential tools for state backed cyber operations. The company's Threat Intelligence Team has spotted groups from China, Russia, Iran and North Korea using AI in their operations. Google's LLM Gemini was used to analyse inboxes, write code and automate Vulnerability Research and reconnaissance the Chinese government has quietly held another round of its hacking contest, the Tianfu Cup. This year's competition included prominent use of AI to discover zero days. It also included a special competitive track for reproducing exploits for known vulnerabilities. Exploits used at the Tianfu cup have been collected by the Chinese government and and later exploited in the wild by the country's cyber contractors. And finally, two security researchers have bypassed the age verification process used by Discord, Twitch and Snapchat. The bypass abuses a bug in the design ofKid, a third party age verification technology provider. The technique uses the browser's developer console to trick the kid backend into thinking the user has already scanned their face and and is an adult. And that is all for this podcast edition. Today's show is brought to you by our sponsor, Trail of Bits. Find them@trailerbits.com thanks for your company.