Transcript
A (0:04)
New Microsoft accounts will be passwordless by default. A Chinese APT is hijacking software updates the US dominates the EU cybersecurity market and Commvault discloses a breach this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 2nd of May and this podcast episode is brought to you by DropZone AI. Microsoft is making passwordless logins the default setting for new user accounts. Login alternatives will include passkeys or facial recognition. Microsoft has also updated its login experience to make using passwordless authentication more appealing. Since adding passkey support a year ago, Microsoft has seen more than a million passkeys created per day, according to the Dutch government. The EU is dependent on foreign companies for its cybersecurity services. US companies dominate the European cybersecurity market, with EU providers making up just 25%. Officials have called for some of the EU's current defence investment to be directed towards cybersecurity. Two UK retail chains have disclosed security breaches where hackers tried to gain access to internal systems. Retailer Co Op has disabled part of its IT system and has told staff to turn cameras on during virtual meetings. They hope this will help them spot wily hackers lurking in their midst. Harrods is also investigating a breach and has disconnected Internet access at its stores. Earlier this week, another UK retailer, Marks & Spencer, said it lost 500 million pounds in market value following a cyber attack. Hackers have breached the Azure environment of backup software company Commvault. The company says the breach in February was the work of a state sponsored group, but the attackers did not gain access to customer backup data. The hack is unrelated to recent exploitation of a flaw in on premise Commvault backup servers. The Grafana project says someone gained access to its GitHub repository and auth tokens. The company, which manages open source and commercial IT monitoring solutions, has traced the breach to a newly deployed GitHub action. Grafana says it rotated all exposed tokens and found no evidence of abuse or unauthorised access in other parts of its systems. US officials have accused China of hacking Guatemala's Ministry of Foreign Affairs. The hack allegedly took place in September 2022. It was discovered during a joint investigation by the Guatemalan government and the US military. US authorities have extradited a Ukrainian national over his role in the Nephilim ransomware gang. Artem Stryshak was arrested in Spain last June and extradited to the US on Wednesday. Nephilim has been active since 2020 and has been known to target large companies in the us, Canada and Australia. Apple has sent a fresh round of notifications to users who may have been targeted with government spyware. The notifications were sent this week to users in more than 100 countries. The recipients included an Italian journalist and a Dutch right wing activist. Threat actors are snail mailing paper letters to Ledger crypto wallet owners. The letters claim to be from Ledger's security team and instruct recipients to validate their wallets by scanning a QR code. The QR code takes the targets to a phishing page that collects their recovery phrases. These are used by the scammers to empty the victims wallets. Cryptocurrency mixer Ecks has shut down operations after being linked to money laundering. The Service launched in 2014. It grew in popularity in 2022 after announcing it wouldn't help authorities track hacked funds. The site laundered the proceeds of the Parity Wallet, Bitbrowser and Bybit hacks. According to blockchain investigation firm Elliptic, 98% of funds that passed through the service were linked to criminal activity. Ransom Hub has been offline for more than a month since being hacked by rival group Dragonforce. No new Ransom Hub activity has been reported on hacking forums and its dark web portals have remained offline. Reports indicate the group's affiliates have now switched to using the Qilin ransomware. A Chinese APT group is hijacking software updates in organisations across Southeast Asia using a novel technique. The Wizards group has been active since 2022. It deploys a tool named Spell that uses IPv6 Slack spoofing to redirect DNS queries. The group intercepts queries associated with updates for Chinese software and redirects them to malicious versions. Security firm ESET has linked the APT to a Chinese company named Dianker Network Security Technology, also known as UPSEC. And finally, defence contractor Raytheon has agreed to pay $8.4 million for failing to comply with Pentagon cybersecurity requirements. The fine relates to 2019 Pentagon contracts that the company held between 2015 and 2021. The company's non compliance was exposed by a former director of Engineering who received $1.5 million from the settlement. And that is all for this podcast edition. Today's show is brought to you by our sponsor DropZone AI. Find them at DropZone AI.