← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
A
Russia launches a criminal probe into Telegram's founder Two teenagers arrested for a South Korean bike share hack Anthropic accuses Chinese AI firms of distillation attacks and the US treasury sanctions a Russian exploit broker this is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 25th of February and this podcast episode is brought to you by Socket Security, a developer first security platform that prevents vulnerable and malicious open source dependencies from infiltrating software supply chains. In today's top story, Russian authorities have launched a criminal investigation into Telegram's founder and CEO, Pavel Durov is accused of facilitating terrorist activity on the messaging platform. The FSB intelligence service claims Telegram has been used to organise school shootings, harass military families and recruit spies and saboteurs. Russian authorities blocked voice calls on the platform last year and began throttling instant messaging this year. In 2024, Durov was also arrested in France and faced accusations that Telegram facilitated criminal activity. US fintech company Marquee is suing Sonicwall over a recent security breach. Marquee claims the firewall maker failed to secure its cloud service that backed up firewall configs. Hackers stole config configuration data from Sonicwall's service, which were used to breach Marquee in December. In September last year, Sonicwall confirmed the breach of its cloud service and blamed a state sponsored threat actor. Two high school students have been arrested in South Korea for hacking Seoul's bike sharing service. They're accused of breaching Terungi and stealing data about 4.6 million users. The hack occurred in June 2024 but was only discovered this year. The two suspects met on Telegram and learned about cybersecurity while they executed. Hack the Shiny Hunters group has taken credit for hacking Dutch ISP Odido. The hackers continued to demand a ransom this week, threatening to release the stolen data. Odido previously confirmed that 6.2 million customers were affected by the breach. The ISP is offering all affected customers vouchers for F Secure antivirus Hackers have gained access to the New Zealand healthcare app medimap. The app is used for medication management in hospice and elderly care. It took down its website on Sunday after discovering the hack. The intruders changed the names of some patients to Charlie Kirk and marked others deceased. Hackers have stolen $4.4 million worth of crypto assets from the Iotex platform. The attackers stole the funds after compromising a private key for one of the platform's integrations. The company has offered the hackers a bounty of 10% if they return the rest of the funds. A threat actor has exploited the Yieldblocks lending platform and stolen $10 million in crypto. The hackers manipulated prices on the stellar blockchain to withdraw more than they put in. Yieldblocks has also offered a 10% bounty for the return of the stolen funds. Step Finance has ceased operations after losing $30 million in a hack last month. The company says it failed to secure new funds or an acquisition following the breach. The two other platforms owned by the same company, Solana Floor and Remora Markets, are also shutting down. Anthropic has accused three Chinese AI companies of scraping its Claude model in distillation attacks. The company accused Deepseek, Moonshot AI and Minimax of setting up more than 24,000 Claude accounts. The company has used the accounts to run millions of queries and train their models on Claude's output. A former L3 Harris trenchant executive has been sentenced to 87 months in prison for selling the company's exploits to a Russian broker. Australian Peter Williams pleaded guilty to theft of trade secrets last year and was sentenced on Tuesday. A hearing to decide whether Williams will need to pay restitution to Trenchant is scheduled for May. His former employer is seeking $35 million. In related news, the U.S. treasury has sanctioned entities associated with Operation Zero. The Russian broker paid Peter Williams for the stolen exploits. The company supplies exploits and zero days to the Russian government. Sanctions were levied against Operation Zero's parent company, a UAE affiliate, CEO Sergei Zelinyuk, his assistant, and two business partners. The treasury says the business partners are also members of the Trikbot malware group and run an exploit brokerage company in the UAE and Uzbekistan. That company was also sanctioned. Spanish authorities have arrested two further members of the anonymous Phoenix hacktivist group. Two leaders were initially arrested in May last year. The latest two were detained last week. The four have been charged with launching DDoS attacks against government sites, political parties and public institutions. Four malicious.net packages have been available on the NuGet repository for more than a year. The packages worked together to deploy a proxy, steal ASP Net identity data and backdoor any locally developed apps. According to Socket Security, the packages have been downloaded more than 4,500 times. A Russian Armenian threat actor is behind a new phishing platform targeting the freight and logistics sector. The attacker has stolen more than 1,600 credentials from companies across the US and Europe. Security researchers have found overlaps between the phishing kit's infrastructure and Armenian logistics firms. Ukraine says Russian cyber attacks on its energy grid are being used to guide missile strikes. According to Ukraine's cybersecurity agency. Attackers have stopped trying to wipe the computers that control power. They appear more focused on mapping facilities, tracking repair crews and assessing recovery efforts. Russian state sponsored hackers are exploiting a Microsoft browser, 0day. Akamai has linked the attacks to APT28 and a cyber unit inside Russia's military intelligence agency. The zero day can allow attackers to bypass several browser security boundaries and run malicious code outside the sandbox. Microsoft patched the bug earlier this month and finally some cybercrime groups compromised the entire network within half an hour of initial entry, according to CrowdStrike. The company's annual threat report says breakout times are down from the 98 minutes recorded in 2021. The fastest breakout time recorded last was just 27 seconds. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Socket Security. Find them at socket.dev. thanks to your company.