
Loading summary
A
Iran attempts to hack security cameras to support its missile strikes Israel bombs Iran's cyber headquarters, Authorities take down leak base and tycoon 2fa and TikTok says no to encrypted private messaging. This is the Risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 6th of March and this podcast episode is brought to you by Okta. In today's top story, Iranian hackers are targeting security cameras in Israel and the Middle east to support the country's missile strikes. Security firm Check Point has observed an increase in scans for vulnerable hikvision and Dahua cameras in several countries hit by Iranian missiles. The company's linked the activity to a known Iranian hacking group. Similar activity followed the October 7th terrorist attack and and Iran's 12 day war with Israel last year. In other news, Israel says it's bombed the headquarters of Iran's Cyber and Electronic Warfare Unit. The building in Tehran was one of 10 major targets hit by the IDF on Wednesday. Iranian state media has not confirmed the attacks. Meantime, Iranian authorities have threatened to arrest citizens who connect to the Internet. The country imposed an Internet blackout on Saturday as US Israeli strikes began Monday. Many Iranians are connecting via Starlink dishes smuggled into the country. Local police warned citizens via SMS messages this week. Mexicans have until the end of June to register their SIM cards with a government id. The new requirement applies to subscription and prepay plans as well as ESIMs. It also applies to foreigners using Mexican SIMs. US and European law enforcement have taken down the leak based hacking forum the the site launched in 2021 and sold credentials stolen via infostealers. It catered to English speaking users and had more than 142,000 registered members. Authorities raided more than 100 locations globally and arrested 13 suspects. Multiple law enforcement agencies and cybersecurity firms have disrupted the activity of the Tycoon2FA phishing service. The joint operation took control of more than 330 domains powering Tycoon's platform. The service launched in 2023 and allowed threat actors to easily impersonate online services. Tycoon was one of the first phishing platforms that successfully automated the process of intercepting Multi Factor Authentication codes. Proofpoint says Tycoon was the most active MFA capable phishing toolkit in its data. Taiwan has indicted 62 suspects over their involvement in cyberscam operations. They're accused of running 13 companies associated with Cambodian Cyberscam Compound Oper. The Prince Group officials say they laundered close to $340 million in stolen assets. The US and the UK have imposed sanctions on the Prince Group and its founder. Chen Xi. Xi was arrested in Cambodia last month and extradited to China. A Russian national has pleaded guilty in the US for running the Phobos ransomware operation. Evgeny Chichin built and advertised the platform. He's estimated to have made more than $39 million from ransoms. He was arrested and extradited from South Korea in 2024. Jichin faces a maximum penalty of 20 years in prison. More than 100,000 N8N AI automation servers are missing a critical security patch. A vulnerability disclosed last week can allow attackers to escape the server's sandbox in the default configuration. This can allow full compromise of the system. Online ads have surpassed email as the main delivery method for malware. Last year, malicious ads accounted for 60% of all malware campaigns observed by the media trust. The company's 2026 intelligence report said. AI has played a major role in generating deepfake ads and precision targeting of malware campaigns. The Qilin Group was last year's most active ransomware operation, accounting for 13% of all attacks. The number of total ransomware attacks increased by 50% from 2024, an all time high, according to the NCC Group's yearly threat report. North America remained the top target. Threat actors are exploiting a recently patched vulnerability in VMware ARIA operations servers. The flaw allows unauthenticated remote code execution attacks via a command injection vector. CISA flagged it as being exploited in the wild this week. It was patched in February. Security firm quarkslab has published details about three vulnerabilities in Avira antivirus. The bugs can allow attackers to delete local files and elevate privileges. Quarkslab released the details and proof of concept code without an available fix, researchers said. Avira's owner, Gen Digital, demanded they report the bugs via bugcrowd and agree to an NDA. Hackers have leaked data from French torrent portal. The stolen data includes 6.6 million user records, source code, databases, configs and passwords. The hackers said they attacked the site after free user accounts were limited to five torrents a day. A threat actor is extorting a major Hong Kong cable car operator. Hackers are demanding a ransom from Nongping360, threatening to release internal files and customer data. The company said the hack did not impact the safety of its cable car service. Hackers are extorting Texas company Hunger Rush, a point of sale platform for small restaurants. The attackers emailed restaurant patrons directly, threatening to release their personal data if Hunger Rush doesn't pay. The entry point for the hack is believed to be a compromised employee account. The company confirmed the breach and said no card data was exposed. And finally, TikTok says it will not introduce encrypted private messaging. The company told the BBC that encrypted DMs will make its users less secure because it wouldn't be able to scan messages for malicious content. Meta and Telegram have introduced encrypted DMs and are now facing pressure from authorities. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Okta. Find them@okta.com thanks for your company.
This episode delivers a rapid-fire update on notable cybersecurity events from around the world, with a primary focus on how Iranian hackers are exploiting internet-connected security cameras to support missile strikes in the Middle East. The bulletin covers government crackdowns, major law enforcement operations, significant hacks and ransomware actions, as well as policy changes impacting internet security and privacy.
[00:04 – 01:15]
[01:15 – 02:00]
[02:00 – 02:18]
[02:18 – 02:51]
[02:51 – 03:18]
[03:18 – 03:49]
[03:49 – 04:13]
[04:13 – 04:27]
[04:27 – 04:44]
[04:44 – 04:55]
[04:55 – 05:08]
[05:08 – 05:20]
[05:20 – 05:32]
[05:32 – 05:42]
[05:42 – 05:59]
[05:59 – 06:15]
This Risky Bulletin underscores the escalation of cyber threats entangled with military conflict, the frequent targeting of widely used products (cameras, POS systems, antivirus software), and a growing law enforcement response to large-scale cybercrime. The landscape is rapidly evolving, with malvertising overtaking traditional email-based malware delivery and the enduring debate over encryption vs. content monitoring intensifying as exemplified by TikTok’s recent decision.
Listeners gain an up-to-date snapshot of the global cyber risk environment, major vulnerabilities in popular software, and the persistent challenge of defending infrastructure against sophisticated, state-backed threats.