Loading summary
Transcript1 lines
- [00:04]
A
Russian police arrest the Meduza stealer Trio. A former L3Harris manager pleads guilty to selling exploits to Russia. The US hacked Venezuela in 2020 and Windows 11 administrator protection goes live. This is the Risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 31st of October and and this podcast episode is brought to you by Knock Knock. In today's top story, three suspects believed to be behind the Meduza infostealer have been arrested in Moscow. The Interior Ministry said the malware was used in attacks on Russian government networks. The malware was advertised on underground hacking forums and offered as a service on Telegram. In other news, CNN has reported that the CIA hacked Venezuela's intelligence service in 2020, around the same time US cyber comm cut off satellite communications for Russian Wagner troops stationed in Venezuela. Sources told CNN the attacks were used to placate President Trump during his first term when he pushed for military action against the Maduro regime. The Israeli government demanded that Amazon and Google notify them when Israeli data was shared with foreign courts or law enforcement. Notifications were made through a secretive system where payments were sent to the Israeli government. The value of the payments started with the country COD that had requested data. Amazon and Google were required to set up the system in order to receive Israeli government contracts. The FCC plans to eliminate recent cyber security rules for US Telcos. The requirements were implemented by the Biden era FCC in January following the SALT typhoon intrusions. They dictated that telcos adopt cyber security plans and consider supply chain attacks. The agency now says that telcos have strengthened cybersecurity defences on their own and there's no need for the rules. Meantime, the FCC will no longer allow US retailers to sell devices that contain parts from sanctioned Chinese companies. The agency will also consider revoking authorisations for previously approved devices. Chinese Companies on the FCC's list include Huawei, ZTE, China Mobile and China Telecom. Earlier this month, the FCC warned US retailers to remove those companies devices from stores. Several US Federal agencies support banning the sale of TP Link products in the U.S. the Commerce Department proposed the ban and said the devices pose a national security risk. TP Link is a Chinese company with close ties to the Communist Party. The Commerce Department began investigating its products and practices earlier this year. TP Link has called the potential ban nonsensical. A state sponsored hacking group has breached a US telco services company. Ribbon Communications was breached in December last year, but the intrusion was not detected until last month. Ribbon provides voice and data transfer services between different platforms and providers. According to Reuters. The hackers managed to move downstream into at least three of Ribbon's customers. Hacktivist groups have breached three ICS networks across Canada in recent weeks. Attackers altered a water facility's pressure readings, triggered a false alarm at an oil and gas company and adjusted temperature and humidity levels at a farm's grain silo. All the hacked systems were exposed on the Internet. Canada's Cyber Security Agency has urged organisations to review ICS systems authentication. A former manager of a US defence contractor has pleaded guilty to selling exploits to a Russian zero day broker. 39 year old Australian national Peter Williams worked at American company L3Harris Trenchant. He allegedly made $1.3 million from selling eight exploits to Russian company Operation Zero, according to his plea deal. He faces a maximum sentence of nine years. The CEO of Italian spyware company Memento Labs has confirmed that Kaspersky caught the company's spyware. Paolo Lezzi told TechCrunch the spyware was deployed by a government customer. He said the customer used an older version of the Dante spyware that Memento Plan plans to deprecate by the end of the year. Kaspersky and other Russian security firms found the spyware in attacks against Russian and Belarusian targets. Polish Authorities have arrested 11 suspects accused of running investment scams. The group used overseas call centres to trick Polish citizens into giving their money to fake investment websites. The gang allegedly made more than $20 million from at least 1,500 victims. Australian police have recovered $6 million worth of crypto by cracking a criminal's wallet. The wallet contained payments received from renting out the Ghost encrypted comms app to other criminals. Officers found an encoded version of the wallet password in a password protected note on his phone. A cluster of 126 malicious npm packages infected users with malware using invisible dependencies. The technique relied on using malicious dependencies hosted on custom domains. The libraries are not scann by most NPM security tools. According to Koi Security, the malicious packages dropped malware that stole authentication tokens, CI CD secrets and GitHub credentials. Simperium has discovered more than 760 Android apps that can relay contactless payment card data. The stolen NFC data is used to withdraw funds from users accounts or make purchases. Android NFC relaying is part of a growing trend in China and Russia. Remote access solutions like VPNs were the primary entry point for ransomware attacks last year. Cyber insurance provider Attbay says 80% of ransomware attacks were traced to remote access devices in the last five years, Atbay has recorded a shift from remote desktop towards VPNs as the main entry point. The company said organisations with Cisco and Citrix VPNs were seven times more likely to fall victim to an attack than Those with no VPN. Two vulnerabilities allow threat actors to break the Lux 2 encryption used in eight confidential computing projects. The vulnerabilities allow attackers with access to the underlying disk to trick a trusted execution environment into encrypting data with a null cipher. Attackers can then extract or modify data inside the secure environments. A Chinese cyber espionage group is Behind a recent zero day in the Motec's landscape, endpoint manager. The attacks began in mid-2025. Security fir sophos linked the attacks to a group known as Bronze Butler. The group is also known as TIC and has a long history of targeting Japan and South Korea. And finally, the Administrative Protection Security feature is now live in Windows 11. The feature will require admins to enter a password, PIN or other form of authentication if they want to perform highly sensitive actions. It's designed to prevent threat actors from abusing compromised admin accounts. This feature is turned off by default and that is all for this podcast edition. Today's show was brought to you by Knock Knock. Find them at knocknock IO thanks to your company.