Transcript
Caitlin Sorey (0:04)
Sentinel One dodges a Chinese APT hack Anonymous sources point to more Salt Typhoon victims A cyber attack disrupts grocery deliveries in the US and 140 arrested in Kazakhstan for selling citizens data. This is the risky bulletin prepared by Catalyn Campanu and read by me, Caitlin sorey. Today is June 11th and this podcast episode is brought to you by Push Security. Security firm SentinelOne said Chinese hackers breached its hardware logistics vendor. The company said it stopped the intrusion before it reached Sentinel One's network. It linked the attacks to a group hacking on behalf of the Chinese government. Sentinelone said it also observed extensive reconnaissance of its Internet exposed systems. Chinese hackers may have breached telecommunications company Comcast and data center operator Digital Realty. Anonymous sources inside CISA and the NSA revealed the breaches to the publication nextgov. They linked them to Chinese cyber espionage group Salt Typhoon. The companies have not publicly confirmed the breaches. A cyber attack is disrupting the operations of U.S. grocery distributor United Natural Foods. The company said it proactively took some IT systems offline after discovering the attack last week. The company's ability to fulfill and distribute customer orders has been impacted. United Natural Foods is the country's largest grocery distributor. U.S. director of National Intelligence Tulsi Gabbard says the intelligence community should move away from building its own tools. Gabbard says U.S. agencies should buy tools from the private sector sector and focus on their core missions. The Biden administration's DNI Avril Haynes had also urged agencies to tap the private sector's knowledge and capabilities. Brett Leatherman has been named to lead the FBI's cyber division. Leatherman has been with the FBI for 22 years and was involved in the Lock Bit Salt Typhoon and Vault Typhoon investigations. He replaces Brian Vondren, who left to become Microsoft's new deputy chief information security officer. Hackers have stolen More than 300,000 crash reports from the Texas Department of Transportation. The breach took place on May 12 after a hacker compromised an employee account. The stolen reports include names, addresses, vehicle registration details and insurance information. The department is currently notifying everyone affected. Spyware maker Paragon Solutions has ended its contract with Italy. Paragon cut the government's access to its platform in February after reports that Italy had targeted journalists and activists. The Israeli spyware maker said it ended the contract after the the Italian government refused its help in investigating the alleged abuses. Italian company NEG has been contracted to provide replacement surveillance capabilities. 140 people have been detained in Kazakhstan accused of selling citizens personal data on Telegram. The group allegedly extracted the data from government databases Some of the information was also shared with debt collection agencies. Russian border authorities are denying entry to Ukrainians with phones that have been wiped clean, according to court documents. Authorities denied entry to users who deleted their image galleries, messages to chats or YouTube watch history. Some Ukrainian travellers who had their entries denied unsuccessfully challenged the decisions in court. A cyber espionage group has been using a Windows WebDAV zero day in phishing attacks. Users who clicked on malicious WebDAV links had malware installed on their systems. Check Point linked the attacks to Middle Eastern APT Group Stealth Falcon. Microsoft released patches for the zero day in this month's patch Tuesday. Microsoft will block two more file extensions in Outlook due to increased abuse. Outlook will block Library Ms. And Search Ms. File types from July. Both file types have been used to abuse Windows features and install malware. A memory leak in the Danabot malware command and control servers exposed information about its operators. Security firm Zscaler said it silently exploited the bug for three years to collect data. The vulnerability exposed details such as threat actor names, their IP addresses and cryptographic keys. Authorities seized Danabot infrastructure in May and charged 16 suspects. Two thirds of all online reconnaissance is due to mass scans for git secrets and environment files. These files contain credentials that can be used to enable other intrusions. Human security says that mass Internet scanning now accounts for almost 70% of the bot traffic it sees. One of the biggest sources of Internet scams this year was the hacked network of a major Romanian distillery. Google has patched a bug that exposed account holders, real names and phone numbers. The attack abused Google's Looker Studio data visualization product to reveal usernames. Phone numbers were extracted from the no JAR Script version of the password recovery interface. The bug was discovered by security researcher Brute Cat, who received a $5,000 reward from Google. A security researcher has accused Apple of silently patching a zero click iMessage exploit. Joseph Goydish claims the exploit could have allowed remote code execution attacks and the theft of secure enclave keys and crypto wallet data. He accused Apple of patching two bugs related to the exploit chain in April without credit or acknowledgment despite responsible disclosure. That's all for this podcast edition. Today's show was brought to you by our sponsor, P Security. Find them@PushSecurity.com.