Loading summary
Transcript1 lines
- [00:04]
Claire Aird
The Scattered Spider group targets the aviation sector Russia throttles traffic from Cloudflare A Mexican cartel hired hackers to track an FBI official and Canada tells hikvision to cease operations this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 30th of June and this podcast episode is brought to you by Sand Fly Security. The Scattered Spider cybercrime group is now targeting the aviation sector. Individuals associated with the group have been linked to recent intrusions at WestJet and Hawaiian Airlines. Scattered Spider was linked to disruptions at UK retailers Marks and Spencers and Co Op earlier this year. More recently, it attacked insurance firms Aflac, Erie Insurance and Philadelphia Insurance. In other news, the Sinaloa drug cartel hired a hacker in 2018 to track an FBI official's phone. A DOJ report released last week said the hacker obtained call records and geolocation data. According to the FBI, the hacker also used Mexico City's camera system to track the agent's movements. The cartel used the data to identify and kill informants in a case against its leader, Joaquin El Chapo Guzman. Russian Internet service providers are throttling traffic to Cloudflare. The throttling is a de facto block, as users can only load 16 kilobytes of data from Cloudflare before the connection is reset. Their restrictions began in early June. Cloudflare says it's not received formal communication from the Russian government. The Kremlin also blocked YouTube in the same way in February. Canada has ordered Chinese security camera maker Hikvision to cease operations in the country. Officials said the company is a threat to Canada's national security. Government agencies have been banned from purchasing new hikvision products. The US previously sanctioned the company over helping the Chinese government surveil the Uyghur minority in western China. A cybercrime group has stolen more than 1 million pounds from customers of the French bank Societe Generale. The group carried out sim swapping to gain access to accounts. An intern at the bank is believed to have provided the customer details. The group also included one man who forged documents, one who conducted the SIM swaps and two who laundered stolen funds. All five were arrested earlier this month. A Russian man has been sentenced in Belgium to seven years in prison for developing the Grylok ransomware. A Russian woman also received a five year sentence for advertising the ransomware and negotiating with victims. Both sentences included an additional two years for refusing to hand over passwords for their devices and crypto wallets. The couple is believed to have made over 3 million euros and infected more than 400,000 users. The two were detained in Spain in 2023 before being extradited to Belgium. A 31 year old man has been sentenced to more than seven months in prison for sabotaging his former employer in the uk. A day after being suspended from work, Mohammed Umar Taj changed login credentials and Multi Factor Authentication settings. The sabotage caused IT outages for the company's customers in the uk, Germany and Bahrain. The company has not publicly named. The incident led to at least 200,000 pounds in lost business and reputational damage. Hackers have stolen $10 million worth of crypto assets from the Resupply Defi platform. The attackers exploited a vulnerability that allowed them to deposit $200,000 and withdraw millions in return. The hackers used the Tornado cash mixer to launder the funds and have not been identified. Patrick Ware has been named the new executive director of U.S. cyber Command. Ware will occupy the number three spot inside the U.S. military Cyber Operations Branch. Ware served 34 years with the NSA and has replaced Morgan Adamsky. Two U.S. senators have introduced a bill that would ban U.S. federal agencies from using AI tools developed by foreign adversaries. This would include AI technologies produced in China, Russia and Iran. Several agencies and US states recently banned banned employees from using the Chinese AI tool Deepseek. Meanwhile, Berlin's Data Protection Agency wants to ban Deepseek in Germany. The agency says Deepseek illegally transfers user data to China. It reported the app to the Apple and Google stores last week for violating the gdpr. According to cnbc. Germany's action may lead to an EU wide ban. Brazil's Supreme Court has ruled that social media networks are liable for their users posts. Social networks will have to monitor and remove user posts that contain hate speech, racism and calls for violence. The Trump administration previously threatened tariffs for countries that applied fines, taxes or content moderation to US tech firms. The Terragram online community has been designated a terrorist organisation by the Australian government. The group operates on Telegram, where it recruits and encourages members to carry out murders, physical attacks and other hate crimes. Two admins were arrested in the US last week following following violence in Slovakia and Turkey. Australia sanctioned the group's members in February. Cybercrime accounts for more than 30% of all reported crimes in Western and eastern Africa. An Interpol report revealed that online scams, ransomware, BEC and digital sextortion are the most common incidents. Most African countries said their legal systems are not equipped to handle the scale of the problem. North Korean hacking groups are abusing chatgpt to automate OSINT reconnaissance and cryptocurrency thefts. Hackers linked with the Andariel and Kimsuki groups have used ChatGPT to generate malicious code that automatically empties crypto wallets. They also used it to analyze public data to find targets for attacks. South Korean officials found traces of this activity on 39 servers seized last year. Dozens of pro Scottish independence social media accounts went silent at the start of Israel's military operation in Iran, an investigation by the UK Defence Journal found. The accounts remained quiet during Iran's Internet blackout and power outages from Israeli strikes. Iran is known to run influence operations internationally, where it blends local political themes with its own foreign interests. Microsoft is previewing new Windows technology that will allow antivirus and security tools to run without kernel Access. The new endpoint security platform was developed in response to last year's CrowdStrike bug that took down over 8.5 million Windows systems. Several EDR vendors are working with Microsoft to test the new technology. Google has added a new security feature to Chrome that automatically escapes less than and greater than characters inside HTML attributes. The new feature is designed to prevent cross site scripting attacks that rely on sneaking malicious code into web pages. The feature shipped with Chrome 138 last week. Hackers are exploiting a new Citrix vulnerability, according to security firm Reliaquest. The vulnerability is an out of bounds read that lets attackers extract some data from the server's memory. The exploit could be used to steal session tokens and gain access without having to authenticate. Citrix has not confirmed the attacks or Relioquest's findings. And finally, the CentOS webpanel project has fixed a vulnerability that could have allowed threat actors to hijack web hosting services servers. If attackers know at least one username, the vulnerability allows them to take over the underlying server. The attack bypasses authentication and proof of concept code has been published and that is all for this podcast edition. Today's show is brought to you by Sandfly Security. Find them@sandflysecurity.com thanks for your company Sam.