Loading summary
Transcript1 lines
- [00:04]
A
A Russian man prosecuted for extorting the Conti ransomware group. Google takes down a Chinese cyber espionage operation, Anthropic tells Department of War to pound sand over AI restrictions and a Cisco Zero day was exploited in the wild for three years. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire airdrop. Today is the 27th of February and this podcast episode is brought to you by Socket Security, a developer first security platform that prevents vulnerable and malicious open source dependencies from infiltrating software supply chains. In today's top story, a Russian man is facing up to 10 years in prison for impersonating an FSB officer to extort the Conti ransomware group. Ruslan Satuchin was detained in October last year. His scheme began after internal Conti documents and chats were leaked online. In 2022. The Contigroup made an estimated $150 million from its ransomware attacks. In other news, Anthropic has told the Pentagon it will not alter its AI model's safeguards. Earlier this year, Defence Secretary Pete Hegseth demanded that the company remove its restrictions for the Department of Defence. Anthropic does not allow its agent to be used by the military for autonomous weapons or or domestic mass surveillance. In a statement today, CEO Dario Emedei said the company would not change its position. He continued that if the Department of War chooses to end its contract with Antropic, it will help the Pentagon transition to another provider. A hacker has stolen more than 150 gigabytes of data from Mexican government agencies. The attacker allegedly used the Claude AI tool to assist with the hacking, according to Bloomberg. He breached Mexico's tax authority, the the National Electoral Institute and several state water utilities. The stolen data includes 195 million taxpayer and voter records, government employee credentials and civil registry files. Belarusian hacktivist group the Cyber Partisans claims to have hacked local industrial giant Kim Volokno. The company is Russia's largest supplier of nylon thread for military helmets and body armour. The Cyber Partisans say they hacked Kim Volokno on the fourth anniversary of Russia's invasion of Ukraine. The group said it took less than a day to gain full admin access to destroy service and more than 1,000 workstations. The UK Cybersecurity Agency says its vulnerability monitoring service has led to bugs being fixed six times faster data since the service launched in January last year says bugs and misconfigurations are now being patched in eight days, down from the previous average of almost two months. The NCSC vulnerability monitoring service works by continuously scanning the networks of more than 6,000 UK public sector bodies. It currently processes and resolves around 400 issues a month. The Russian government is planning to block all Telegram traffic from April, according to local media. The country's Internet watchdog has been blocking some Telegram features and throttling traffic since August last year. Earlier this week, the country also launched a criminal probe of Telegram founder and CEO Pavel Durov. He's accused of facilitating terrorist activity on the platform. Four individuals have been sentenced to prison over the use of the Predator's spyware in Greece. Three executives from Predator's developer Intellexa and one from local reseller Krikal have collectively been sentenced to more than 126 years in prison. They'll each serve at least eight years pending an appeal. Amongst those sentenced is Intellexa founder Tal Dillian. No Greek government officials were on trial despite having purchased the spyware to use against journalists and political opponents. Finnish hacker Alexandri Kivimaki has had his sentence increased by eight months after losing an appeal in 2024. Kivimaki was originally sentenced to eight years and three months for hacking the Vastamo psychotherapy chain and extorting patients. Last year, he was released as part of the appeal process. Kivamaki's lawyer says he's left the country but plans to return to Finland to complete his sentence. Medical device manufacturer UFP Technologies has confirmed a recent breach. The company investors it deployed its backups after attackers stole and destroyed some of its data in February. No ransomware group has taken credit for the attack. The Scattered Lapsus Hunters hacking group is recruiting women to carry out voice phishing attacks against corporate help desks, according to threat intelligence firm Dataminer. Female voices are more likely to convince help desk staff to ignore their security training. Female recruits are being offered up to $1,000 cents. Perhaps I should throw my hat in the ring. Google has taken down infrastructure that was used by a Chinese cyber espionage group to attack telcos and governments. The company disabled cloud servers and Google sheets that were used as command and control for the grid tied backdoor. Google says the malware is the work of a group IT tracks as UNC2814. OpenAI has taken down ChatGPT accounts linked to a Chinese intelligence operation. The AI agent was used to compose emails and perform reconnaissance. The attackers pretended to be a corporation, but chatbot interactions were focused on geopolitical topics. OpenAI also took down clusters running online scams, Russian influence operations in Africa and a Chinese disinformation campaign targeting Japan's prime minister. Cisco has patched an actively exploited zero day in Catalyst SD WAN devices. Attackers are exploiting a flaw in the peering authentication system to obtain admin privileges. It has a CVSS severity rating of 10. The attacks were discovered by the Australian Signals Directorate. Cisco attributed the attacks to a group it tracks as UAT8616 and found evidence that the campaign began at least three years ago. More than 900 free PBX telephony servers have been infected with the Insist PHP web shell. The attacks are exploiting a vulnerability that was patched in November. It allows attackers to inject commands in the server's administrative interface. Almost half of the infected servers are located in the US Chinese drone manufacturer DJI has patched a flaw that could have allowed attackers to take over its Romo Smart Vacuums. Security researcher Sami Azdouful said DJI's cloud service returned data without any authentication beyond a serial number, as Doofel was able to map the locations of more than 7,000 Romo Smart vacuums and as well as 3,000 portable power stations sharing the same server. The let's Encrypt Free certificate Authority has stopped issuing certificates for excessively long domain names. The project said the issue was a result of misconfigured servers. Some web servers can be configured to automatically request new certificates on demand. Internet scans hitting the servers were triggering this process and flooding. Let's Encrypt academics have developed a new attack that breaks WI FI client isolation. The airsnitch attack exploits the normal functioning of WiFi's layer 2 network topology that it inherited from traditional wired Ethernet. It was successfully tested against routers from Netgear, D Link, Ubiquiti and Cisco. A security firm has gained access to a malvertising test platform and helped block more than 59 million malicious ads. Confiant says the test platform was operated by the Malvertizer group Deshorties. The platform allowed Confiant researchers to get a preview of upcoming campaigns, which they shared with the adtech industry. And finally, US Diplomats have been instructed to lobby against restrictions on American tech companies processing of foreign data. The State Department says data sovereignty laws will hinder America's AI sector The Trump administration has been vocal about its opposition to data privacy and protection laws, and that is all for this podcast edition. Today's show was brought to you by our sponsor, Socket Security. Find them at socket.dev thanks to your company.