← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
An NPM supply chain attack uses AI to steal credentials and crypto wallet keys. Google establishes a cyber Disruption unit A ransomware attack disrupts more than 200 Swedish municipalities and sold Typhoon hacks have now hit more than 80 countries. This is the risky bulletin prepared by Catalyn Campanu and read by me, Amberly Jackson. Today is August 29th and this podcast episode is brought to you by Okta. A threat actor has hacked the Node package manager account of the NX build automation system. The attacker published malicious versions of several NX libraries. The code contained hidden prompts that instructed AI coding tools to exfiltrate credentials and crypto wallet keys. The data was uploaded to public GitHub repositories for the attacker to collect. A GitHub search suggests that data was stolen from more than 1400 users. GitHub has hidden the repositories and is notifying everyone affected. Three Chinese tech companies behind the global hacking campaign Salt Typhoon. The intrusions have targeted telecommunications, government, transportation and military networks in more than 80 countries. Cybersecurity agencies from 13 countries have linked the intrusions to Sichuan Juxhen network technology, Beijing Wanyu Tenshon information Technology and Sichuan Shixing Raishi network technology. Google is establishing a cyber disruption unit. The Trump administration has advocated for the US to become more aggressive in offensive cyber operations. Legislation has been proposed that, if passed, would authorise the private sector to hack back against specific foreign adversaries. A ransomware attack has disrupted the activity of more than 200 Swedish municipalities and regional governments. More than 80% of local city governments have been impacted. The attack hit a shared IT provider, Meliodota. The attackers have reportedly demanded a ransom of 1.5 bitcoin, which is about $160,000. A German man has been charged with hacking the local subsidiary of Russian state owned oil company Rosneft. The suspect is accused of hacking Rosneft in March 2022, shortly after the invasion of Ukraine. He stole 20 terabytes of data and deleted crucial systems. The incident shut down the company's operations for days. The company has estimated the damages to be 9.75 million euro. Spanish police have arrested a hacker for breaking into an education management system and changing grades. The hacker allegedly used compromised teacher credentials to access the Sanaka scoring platform. They then changed the baccalaureate and university entrance exam grades. One of the teachers spotted the intrusion and alerted authorities. Police found a notebook listing the adjusted grades at the hacker's home in Seville. The suspect allegedly has a history of similar crimes. Taiwanese authorities have detained two local men for trading hacked data. The two allegedly sold data that had been stolen from Taiwanese organisations by the Chinese ransomware crew Crazy Hunter. The attacks hit 11 Taiwanese organisations, including three major hospitals. US authorities have charged eight men for a large scale fraud operation targeting grocery delivery services. The group is accused of stealing more than $30 million from Instacart and Shipt. According to Forbes, they placed orders that were allocated to hacked shopper accounts. When orders are made, delivery services pre pay gig workers to cover the costs of purchasing items. The suspect used that money to buy gift cards and cryptocurrency before cancelling the original orders, according to the FBI. The group did this with more than 7,500 hacked accounts. Since 2022, US and Dutch authorities have seized an online service that sold forged IDs. The Verif tools service has sold fake driver's licenses, passports and other identification documents since 2022. The site made at least 1.3 million euros. South Korea's largest telco has been fined $97.2 million over a major security breach. Hackers breached SK Telecom in April and stole the SIM card data of more than 23 million customers. The fine is the largest penalty imposed for a hack in South Korea. The Personal Information Protection Commission said SK Telecom failed to protect user data and did not report the breach to authorities. In Due time, the EU's new Cybersecurity Reserve will be managed by its cybersecurity agency Inesa. The agency will receive funding of 36 million euros to contract cybersecurity providers. The Cybersecurity Reserve will provide incident response support during major cyber incidents at member states or EU bodies. Two Republican lawmakers have launched an investigation into attempts to manipulate Wikipedia. James Comer and Nancy Mace highlighted campaigns that pushed anti Israel and pro Kremlin narratives on the site. They have requested that the Wikimedia foundation provide details of the accounts involved and of its response. The telegram group Purgatory is behind a recent series of fake active shooter warnings at US Universities. The group sells swatting services as well as intimidation tactics such as tyre slashing and brick throwing. Purgatory's admin claims to have made more than $100,000 since the swatting spree began on August 21st. According to Wired, the group has connections to the online community known as the. Com. A group tracked as Storm0501 is stealing and deleting data from cloud environments and demanding ransoms. The group previously targeted corporate systems with classic ransomware. It switched to hybrid cloud environments last year before focusing primarily on cloud attacks. This year, a suspected Chinese espionage group is delivering malicious updates through an expired domain for an end of life application. The campaign targeted Suyin, an input mechanism for traditional Chinese characters. Several hundred victims have been infected with malware. Trend Micro says the campaign targeted Eastern Asian dissidents, journalists, researchers and business leaders. And finally, hackers are exploiting a zero day vulnerability in the free PBX open source telephony software. The attacks are targeting free PBX systems that have their control panel exposed on the Internet. The first known attacks began on August 21st. A patch was released yesterday. That's all for this podcast edition. Today's show was brought to you by our sponsor, Octa. Find them@okta.com thanks for your company.