Loading summary
Transcript1 lines
- [00:04]
A
Hackers bypass Fido keys with a new phishing technique A mobile surveillance Vendor deploys an SS7 exploit ransomware hits South Korea's largest insurance provider and law enforcement agencies Dismantle a Pro Kremlin DDoS group this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 18th of July and this podcast episode is brought to you by Zero Networks. A cybercrime group is using a new phishing technique to bypass Fido keys. It's been used by a threat actor known as Poisonseed, who's previously targeted cryptocurrency users. According to security firm Expel, the technique abuses the cross device sign in feature to make it appear that a Fido key is not present or needed. In other news, A vulnerability in the SS7 telecommunications protocol is being exploited by a mobile surveillance vendor. The exploit allows attackers to trick mobile operators into to disclosing subscriber locations. Requests for location details are not usually permitted from outside the operator's network. The attack bypasses that restriction by leveraging confusion in the protocol's encoding of subscriber identifiers. Telco security firm Enia saw attacks Starting in late 2024 a ransomware attack has disrupted South Korea's largest insurance company. Seoul Guarantee Insurance has been handwriting its loan guarantee certificates since Monday's incident. The company is working to restore affected systems. Grocery distributor United Natural Foods expects to lose up to $400 million in sales this year following a recent cyber attack. Multiple systems were taken offline for days while the company recovered from the ransomware attack in June. The company's ability to fulfil and distribute customer orders was affected. Australian airline Qantas has obtained a court order to prevent the use of data stolen in a recent ransomware attack. Almost six customers were affected in last month's breach. The interim injunction prevents third parties from publishing, viewing or accessing the data if it's released by the attackers. No ransomware group has taken credit for the incident yet. A minor right wing political party in Australia has suffered a ransomware attack, the United Australia Party. An associated group, the Trumpeter Patriots, confirmed that hackers stole data from their servers in late June. They the data includes personal information, banking records and employee details. Both groups are controlled by Australian mining magnate Clive Palmer. A data breach exposing the names of Afghans who helped the UK military is larger than previously reported, new reporting has revealed. The leak also exposed personal data of UK spies and special forces, as well as some military and government officials, according to the BBC. The breach occurred when a staff member at the headquarters of the UK Special forces inadvertently emailed the data. The incident took place in 2022 but was made public this week. Hackers have stolen customer data from the Seychelles Commercial Bank. The bank notified customers last Friday. It said no money was stolen. A hacker advertising the data for sale on an underground forum has has complained that the bank has not yet engaged in negotiations. Hackers have stolen $27 million worth of assets from the Big One cryptocurrency exchange. The funds were stolen from one of the company's hot wallets on Wednesday. Big One has said it will reimburse any affected users. The Australian government will establish cyber reserves within its defence force. The new unit will be comprised of civilian cybersecurity experts. It'll be tasked with defending Australia's critical networks. It's expected to launch early next year. The Russian Duma has banned online searches for what it considers extremist content. Russians can be fined up to $65 for searching for terrorist groups, fascist ideology or LGBTQ content. Users searching for VPNs and other censorship evasion technology can also be fined. An international law enforcement operation has disrupted the activity of pro Kremlin activist group no Name 057. Authorities seized over 100 servers and detained two people. Arrest warrants have been issued for seven other individuals. The group launched following Russia's invasion of Ukraine and has carried out thousands of DDoS attacks against Western countries. An Armenian national has been extradited from Ukraine to the US over his role in the Ryuk ransomware attacks. Karin Serebovich Bardanyan was a member of a group that extorted more than $15 million from victims. Another Armenian member of the group was arrested in France and is undergoing extradition proceedings. The group also included two Ukrainians who've not yet been arrested. Four members of the Scattered Spider group have been released on bail in the uk. They were arrested last week and have been charged with hacking UK retailers Marks and Spencer, Co Op and Harrods. Cambodian authorities have arrested more than 1,000 suspects linked to online scams and cybercrime operations. Police raids took place across the country. Prime Minister Hun Mane ordered government bodies to crack down on cybercrime following international pressure, according to Cambodia News. Major scam compounds connected to local political elites were not included in the raids. Belgian authorities are printing cybercrime warnings on bread bags to alert the elderly to the risks. Police have distributed more than 10,000 bags to bakers across the Pajotenland region. The bread bags are printed with advice for dealing with scammers who request pins and passwords. Google is suing the operators of the Bad Box Botnet. The group infects Android based smart TV devices with ad fraud malware. It's believed to have infected over 10 million devices. Devices often come pre installed with the malware from the factory or have it installed during initial setup, according to Bleeping Computer. Google is seeking damages and a permanent injunction to dismantle the malware's infrastructure. A hacking group with links to Ransomware is targeting SonicWall SMA VPNs. Google said the group uses previously stolen credentials and one time password seeds to gain access to fully patched devices. The attackers deploy a backdoor and user mode rootkit. The group was previously linked to attacks with the Abyss ransomware. Google has patched an actively exploited Chrome Zero Day. The vulnerability is a sandbox escape via an exploit in Chrome's WebGL and GPU components. It was discovered by Google's security team and appears to be chained with another exploit patched earlier this month. This is the fifth Chrome Zero Day patch this year. A container escape vulnerability has been discovered in the Nvidia container toolkit. The toolkit is a sandboxing technology for Nvidia GPUs on Linux and is used by multiple cloud AI platforms. According to Wiz, the vulnerability allows a malicious container to escape isolation and gain root access to the host machine. And finally, three vulnerabilities have been found in Aton KVM switches. The devices are used for network access to the screens and keyboards of remote servers. The vulnerabilities allow attackers to take control of the connected servers. The flaws were discovered by Russian security firm Positive Technologies and that is all for this podcast edition. Today's show was brought to you by Xero Networks. Find them@zeronetworks.com thanks to your company.