← Risky Bulletin
Loading summary
Transcript1 lines
- [00:05]
A
Iranian password spraying targets Israel ahead of missile strikes A major NPM package gets hacked Iran says it will bomb US tech firms in the Middle east and Flint 24 hackers are sentenced to prison in Russia. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire airdrop. Today is the 1st of April and this podcast episode is brought to you by Knock Knock. A password spraying campaign is targeting the Microsoft 365 accounts of middle Eastern organisations. Evidence suggests the campaign is being carried out by an Iranian threat actor. The attacks began shortly after the US and Israel launched military action against Iran. The password spraying campaign targets agencies such as local governments that would collect information about effects of Iranian missile strikes. Check Point says that some regions targeted by the campaign were later hit by Iranian strikes. In other news, the popular NPM package has been hacked to deploy a remote access trojan. Attackers broke into the Axios GitHub and npm accounts on Monday and locked out its admin. Malicious versions were live on NPM for just over three hours. Axios has over 100 million weekly downloads. Google's linked the attack to a North Korean group tracked as UNC 1069. The source code of Anthropic's Claude AI coding agent has leaked online. It leaked via a map file in the company's NPM account. This is the second time Claud Code source has leaked after a similar incident last February. A 36 year old Maryland man has been charged with hacking the Uranium Finance cryptocurrency platform. Jonathan Spoletta is accused of stealing $53 million from the platform in 2021. Authorities seized two $31 million of the stolen funds in February last year. Spoleta allegedly used the remaining funds to acquire antique Roman coins as well as rare Pokemon and Magic the gathering cards. The US has charged 10 individuals over a scheme to artificially inflate cryptocurrency prices. Among those charged are executives and employees from the companies Gotbit, Vortex, Anteir and Contrarian. The companies used wash trading to inflate trading volumes and prices to facilitate facilitate pump and dump schemes. A Nigerian national has been sentenced to 15 years in a U.S. prison for scamming victims out of more than $1.5 million. Inmate Awolabi operated a group that ran classic Nigerian print scams. The prosecution requested a harsh sentence highlighting Awolabi's social media posts flaunting his stolen wealth. Russian Authorities have sentenced 26 members of the Flint 24 hacking group, each received between five and years in a penal colony. The Flint 24 group operated dozens of underground carding shops. Authorities dismantled the group in 2020 after they were caught selling the data of Russian citizens. South Africa's statistics agency is being extorted by a ransomware group. The hackers are demanding $100,000 to not leak the agency's data. The group XP95, which began its operations in March, has claimed credit for the attack. A new platform automates device code phishing campaigns targeting Microsoft accounts. The Evil Tokens platform launched in February and has been used in attacks throughout March. Device code phishing tricks users into granting attackers access to an account without compromising their credentials. The technique abuses the mechanism used to connect Microsoft accounts to devices like smart TVs or embedded systems. A suspected APT group is exploiting a zero day in the TrueConf videoconferencing platform. Attacks have targeted the on premise servers of several Southeast Asian governments. The zero day allows attackers that have gained access to a server to push malicious updates to its clients. Check Point says the APT has a Chinese Nexus Magento. Online stores are being targeted via a recently patched vulnerability known as PolyShell. According to SanSec. Hundreds of stores are being hacked every hour. The vulnerability was disclosed in mid March. It allows unauthenticated remote attackers to upload a Web shell. Hackers are exploiting an SQL injection vulnerability in Fortinet EMS servers. The vulnerability allows unauthenticated attackers to take over the EMS server's Web interface. It was patched in February. Attacks began last week. CISA has dropped its investigation into Starfus, who arranged a polygraph test of former director Madhu Gotamu. The agency launched the investigation into seven staff members last year after he failed the test. Kota Mukale said the test was unsanctioned and he was tricked into taking it. Politico later reported he pushed for the test in order to access sensitive documents. South Korea has launched a task force to help companies recover from ransomware attacks. It'll be part of the country's cybersecurity agency. The agency said ransomware attacks were up 40% last year compared to 2024. Iran says it would target the infrastructure of American tech companies in the Middle East. The Islamic Revolutionary Guard Corps has published a list of companies it accuses of aiding Israeli and American military operations. All but one of the 18 are US companies. The list includes Google, Apple, Microsoft and Nvidia. Iranian strikes have already hit an Amazon Data Centre and Microsoft Research Office in the region. Russia has ordered local platforms to block VPN users. This week, the government sent letters to Russian banks. Online Marketplaces and IT companies. Businesses that comply may be permitted to remain active during the country's mobile Internet blackouts. Italy's largest bank has been fined 31.8 million euros by the country's data protection agency. According to the agency, an Intesa San Paolo employee accessed data about more than 3,500 customers. Celebrities and politicians were among the affected individuals. This is the country's second largest GDPR fine. The largest was against energy provider Enel, which was fined 79.1 million euros in 2024. Australia is investigating five tech platforms for failing to comply with social media minimum age requirements. The investigation targets Facebook, Instagram, Snapchat, TikTok and YouTube. The country is looking into weaknesses in the implementation of age verification rules. Google has started verifying Android developer accounts. Apps on the Play Store must come from developers who've provided government ID or business registration data. Students and hobbyist developers can skip the verification process, but their apps will require extra steps to install. A new access control standard will allow mobile devices to be used as building access cards. The Alero standard was released by the Connectivity Standards alliance earlier this year. It was backed by major vendors including Apple, Google and Samsung. The standard is expected to be integrated in home alarm systems, building management software and other access control systems. And finally, Russian security firm Kaspersky has reported a record revenue of 836 million doll. Last year, revenue increased in Russia and former Soviet states. Kaspersky was outed from the US market in 2024. It closed most European offices following Russia's invasion of Ukraine. And that is all for this podcast edition. Today's show is brought to you by Knock Knock. Find them at Knock Knock. That's Knoc Knoc IO thanks for your company, Sam.