← Risky Bulletin
Loading summary
Transcript1 lines
- [00:04]
Claire Aird
Russian military personnel targeted with Android spyware Trump defends HEGSETH After a second Signalgate scandal CISA's Secure by Design leaders depart the agency and force labor cyber scam compounds expand globally this is the risky bulletin prepared by Catalyn Kimpanu and read by me, Claire aird. Today is the 23rd of April and this podcast episode is brought to you by Device an unknown threat actor has targeted Russian military personnel with spyware hidden in Android mapping apps. The spyware was concealed in legitimate versions of Alpine Quest, a mobile app used by Russian troops to coordinate operations in Ukraine. Russian security firm Dr. Webb spotted the spyware being spread via Telegram channels advertising a pirated version of the app. The spyware collected documents sent via Telegram and WhatsApp, as well as the locations of users. The tactics are similar to what Russian hackers have used to spy on Ukrainian troops in the past. In other news, US President Donald Trump has said he has great confidence in Defence Secretary Pete Hegseth in the wake of a second group chat scandal, it was revealed this week that Hegseth sent details about strikes in Yemen to a signal group that contained members of his family. The group was allegedly named Defence Team Huddle as, and it was created by Hegseth himself. According to the New York Times, he shared the same information in this signal group that was accidentally shared with the journalists from the Atlantic. We trust you're familiar with that incident. Two top CISA officials who led the Secure by Design program have left the agency. Bob Lord and Lauren Zaberich announced their departures on LinkedIn this week. CISA says the program will continue despite the departures. According to reports, the agency is set to fire up to 1,300 employees. The UK's communications watchdog has banned telecom operators from leasing global titles on their phone networks. Global titles are the addresses used for communications between Telcos in the SS7 network, like an Internet provider but for telcos. Threat actors have historically abused global titles to track the physical locations of targets or intercept text messages. Ofcom launched an investigation into the abuse of global titles last year. Forced labor Cyberscam compounds are spreading beyond Southeast Asia, according to a new UN report. Cyberscam centres have been found operating in Africa, South Asia, the Middle east and some Pacific islands. They have ties to the same cybercrime groups as Southeast Asia and operate at the same industrial scale. The centres also use centre similar recruiting, human trafficking and money laundering tactics. Hackers have added malicious code to the Ripple Cryptocurrency Foundation's NPM repository, according to Aikido security. The code was designed to steal private keys and gain access to customer wallets. The malicious versions were only live on GitHub and NPM for a few hours. The Ripple Ledger JavaScript library has more than 140,000 weekly downloads and is used by hundreds of thousands of apps and websites. South Korea's largest mobile operator has reported that hackers have gained access to some subscriber SIM card data. SK Telecom says a computer with access to SIM card data was infected with malware. The company says it's investigating the breach and whether the data was used for unauthorised SIM transfers or registrations. Microsoft says it's improved the security of its internal infrastructure to meet its CISA Secure by Design pledge. The company said it's inventoried 99% of its network assets and is using Proof of Presence MFA to protect 80% of its production codebase. All new Azure tenants will be automatically enrolled in Microsoft's Security Emergency Response System. Microsoft says it's started rotating access token signing keys. Those keys were famously compromised by Chinese hackers in 2023. Microsoft has awarded more than $1.6 million in its inaugural Zero Day Quest hacking contest. Security researchers submitted more than 600 vulnerabilities in Microsoft cloud and services. The company says it intends to hold the event annually. Russian hackers have reportedly attempted to sabotage Dutch critical infrastructure. In its annual report, the Dutch military intelligence agency said the unsuccessful attack occurred last year. Dutch officials say Russia also began pre positioning for physical attacks on Internet cables and energy supply. Websites of political parties and public transport companies were also targeted during the country's elections. Meta has suspended a Facebook group aimed at fighting disinformation in Romania. The group had more than 10,000 members. It was started in December last year after Romania's presidential election was cancelled when a disinformation campaign boosted one candidate. The group claimed it was the target of a coordinated mass reporting attack by Troll Farms. Facebook has not commented on the suspension. Google's messaging platform will warn users if they're about to send or view an image that may contain nudity. The new safety feature was announced last year and is currently being rolled out. It will be disabled by default for adult users, but automatically enabled for children. And finally, Google Chrome will continue to support third party cookies for the foreseeable future. Google had previously planned to deprecate third party cookies, a widely used mechanism to track users. The company changed its mind after its privacy sandbox technology failed to gain the support of the adtech industry. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Device. Find them@deviceeat.com thanks for your company.