← Risky Bulletin
Risky Bulletin
Risky Bulletin: Public transport in Tbilisi is free after anti-government hack
00:05:51
Loading summary
Transcript1 lines
- [00:04]
Clare Aird
Public transport in Tbilisi is free after an anti government hack. Zyxel firewalls are stuck in a reboot loop of doom. UnitedHealth doubles its estimate of the number of users hit by the change ransomware attack and crypto exchange Femex gets hacked for $70 million this is the risky bulletin prepared by Catalyn Kimparnu and read by me, Clare aird. Today is the 27th of January and this podcast episode is brought to you asset inventory and network visibility company RunZero. In today's top story, anti government protesters have hacked public transport payment systems in Georgia's capital Tbilisi to play pro European songs and slogans. The incident took place on Friday morning as residents headed to work. Ticket scanners and point of sale devices were hacked to play the national anthems of Georgia and the European Union, along with pro EU speeches from local politicians. Local authorities shut down the payment system and made travel free until the hacked systems are restored. Georgia's bid to join the EU was halted in late 2024, leading to three months of protests. In other news, Palestinian hacktivist group Handala breached the Israeli Ministry of National Security and sent false missile alerts to schools and kindergartens. Fake alerts were sent via SMS to thousands of phones and to emergency audio announcement systems installed in schools and kindergartens. The group claims it wiped the system after sending the alert. London police have arrested a former British Museum employee who broke into the museum and shut down several IT systems. Officials say the man's actions took down the museum's ticketing system. Several exhibitions were closed on Friday as a result of the intrusion. Turkish officials are fast tracking a cyber security bill that would create a National Cyber Security Directorate. It also contains a provision that effectively criminalises reporting on unconfirmed security incidents. The country's opposition claims the bill lays out a legal foundation for a sprawling surveillance apparatus. The US government reported 39 bugs to software vendors in fiscal year 2023 via its vulnerability equities process. According to an unclassified report, 10 of the vulnerabilities had been discovered in previous years and kept by the intelligence community to use in espionage and offensive cyber operations. The U.S. department of justice has indicted two North Koreans who posed as Westerners to obtain jobs at U.S. companies. The two, along with other co conspirators. Conspirators are believed to have generated almost $900,000 for the regime over the past six years. The DOJ has also charged two US nationals for running a laptop farm that allowed the North Koreans to disguise their location. Russian backed disinformation groups are lining up behind the German right wing populist party. According to multiple reports, the campaign has been linked to a threat actor tracked as Storm 1516. The group is allegedly coordinated by US fugitive turned Kremlin propagandist John Dugin. According to German intelligence services, Russian authorities allocate over $2 billion each year for disinformation operations. UnitedHealth says that 190 million Americans had their data stolen in the ransomware attack against its Change Healthcare subsidiary last year. That number is nearly double its initial estimate of 100 million. UnitedHealth says it's now notified most of the affected individuals. Change Healthcare was hit by the AlphaV ransomware gang last February in an incident that caused issues with healthcare payments and prescriptions all over the country. A threat actor has stolen $70 million worth of crypto assets from Singapore based exchange Femex. The attackers stole multiple types of crypto in a coordinated attack last Thursday. Femex paused operations while it responded to the hack. Security researchers say the techniques used in the attack are reminiscent of North Korean hacking group Traitor Traitor Staying with crypto theft and an attacker has stolen $8 million worth of crypto assets from crypto P2Pmarketplace no Ones. The hack took place on the first day of the year and exploited a vulnerability in the platform's Solana Bridge, according to open source investigators. The stolen funds were laundered via the Tornado cash mixing service. A faulty update has bricked Zyxel firewalls, leaving them stuck in a reboot loop. The bug is impacting the company's USG Flex and ATP series dev. Axel says device recovery is possible, but requires physical access to connect a serial cable to the firewall. Over 18,000 users have infected themselves with a backdoor after they downloaded a cracked malware builder. Security firm Cloudsec says the builder was advertised using online tutorials YouTube and Telegram. The backdoor was hidden inside a builder for the Xworm remote access Trojan. Users who attempted to use the builder had their browser discord and Telegram data stolen. And finally, researchers Researchers have disclosed a bug that allows threat actors to steal a victim's git credentials when they clone a malicious repository named Clone to Leak. The bug impacts the git codebase, official GitHub desktop and CLI apps, and third party repo managers. It was discovered by researchers at FlatSecurity, and that is all for this podcast edition. Today's show was brought to you by our sponsor RunZero. Find them@runzero.com thanks to your company.