A (0:04)

A supply chain attack plants backdoors on Android tablets the EU blocks AI from lawmakers devices cellebrite was used against a Kenyan politician and a Chinese APT is exploiting a del0day. This is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 18th of February and and this podcast episode is brought to you by Run Zero, the Total Attack surface and exposure management platform. In today's top story, a supply chain attack has planted backdoors in the firmware of several Android tablet makers. Threat actors use the Qiandu backdoor to perform click fraud, hijack browser search settings, or deploy unwanted apps in pay per install schemes. The backdoor has been spotted as far back as August 2023. At least 13,000 users have been infected. In other news, Europe has disabled AI features on work devices used by parliamentarians and their staff. Members of Parliament were notified of the change. In an email on Monday, the Parliament IT department cited cybersecurity and data safety concerns. They said AI tools sent data to cloud servers outside Europe's control. The EU's data protection authorities will support the commission's effort to simplify the bloc's tech rules. The authorities support the digital regulatory framework but warned against weakening the GDPR. The EU's digital omnibus regulation is set to narrow the definition of personal data and remove anonymised information from the personal data category. The European Data Protection Board and the European Data Protection Supervisor also support incorporating user consent inside browser settings to reduce consent fatigue. The head of CISA's threat hunting unit is leaving the agency. Jermaine Roebuck announced his departure in an internal meeting last week. Roebuck is leaving volunteers voluntarily to take a job in the private sector. Russia's FSB intelligence service has been granted the power to cut mobile and Internet connections even if there's no threat to national security. The Juma passed the law after its third reading, when the national security requirement was removed. The law was proposed in November to counter Ukrainian drone attacks. Kenyan authorities used Cellebrite's phone cracking software against the device of an activist and political opponent. Boniface Mwangi says his phone was exploited when he was arrested in July last year. Researchers at Citizen Lab found traces of Cellebrite's software on Mwangi's Samsung phone. Mwangi plans to run for president in Kenya's 2027 elections. Passport and ID scans of more than 700 attendees at ABU Dhabi Finance Week have been leaked. The leak is believed to have exposed personal details of billionaires and political figures Conference attendees included former British Prime Minister David Cameron, hedge billionaire Alan Howard and former White House communications director Anthony Scaramucci. The exposed cloud server has now been secured A ransomware attack has hit the Land and Agricultural Development bank of South Africa. The incident took place last month. The bank shut down some IT systems and issued new laptops to employees. The attackers allegedly asked for $3 million in ransom. No group has taken credit for the attack. Tulsa International Airport has fallen victim to a ransomware attack. The airport recovered three days after the Jan. 17 incident. Airport Authority says employees personal data was exposed, including Social Security numbers and banking data. Polish authorities have arrested a 47 year old man for using the Phobos ransomware. At the time of his arrest, the suspect was in possession of hacked credentials and was in communication with the Fobos ransomware group. His arrest is part of Europol's Operation Ether, which is targeting the Phobos group and its affiliates. Almost 4000 WhatsApp accounts have been hacked in Armenia. Attackers use the hacked accounts to register WhatsApp business profiles and send spam. CyberHub AM, a non profit that works as a cert for Armenian civil society, claims attackers have exploited weaknesses in WhatsApp's SMS two factor authentication. The Kimwolf IoT botnet has accidentally swamped the i2P anonymity network. The disruption started two weeks ago and are preventing legitimate users from connecting to i2p resources. The issues began after Kim Woof started using i2p to host some of its command and control servers. The extra connections from millions of hacked routers and set top boxes flooded the network. Google has patched a Chrome zero day being exploited in the wild. The zero day is a memory corruption issue in how Chrome Chrome processors font names. The vulnerability can be used to run malicious code inside the Chrome sandbox. A suspected Chinese apt is exploiting a zero day indel recover point for virtual machines. Google has linked the attacks to a group it tracks as UNC6201. The zero day is a set of hard coded admin credentials for the app's integrated Tomcat server. Google says the group uses the credentials to upload a malicious WAH file to run commands as root on the appliance. Iranians are being targeted with a new Windows backdoor named Crescent Harvest. The campaign began shortly after this year's anti government protests in the country. It targets individuals who attend protests in Iran as well as the West. Security firm Acronis has not attributed the attacks, but says this is likely the work of an Iranian aligned group. According to multiple reports. The Iranian government is also using mobile telephony data to track down protest attendees. At least two Iranian cyber groups deployed data wiping malware against Israeli critical sector organisations during last year's conflict. Security firm Dragos didn't specify if the attacks were successful. The company tracks the group as Bauxite and Pyroxene, but they're more broadly known as Cyber Avengers and APT35. Pyroxene is one of three new groups Dragos has spotted targeting industrial control systems. Academics have found 27 vulnerabilities in four cloud based password managers. The worst bugs allowed the attackers to leak metadata, downgrade encryption or grant access to stored credentials. The research considered a scenario where a malicious party had taken control of the cloud server and was launching attacks against users and the app's encryption. Bitwarden, LastPass, Dashlane and 1Password have all addressed the researchers findings. Apple will enable its stolen device protection feature by default. Users will be required to authenticate using Face ID or Touch ID before making changes to sensitive device settings. Setting changes will also have a one hour delay. Apple added the feature in 2023. It will be enabled for all users in the upcoming iOS version 26.4. Samsung has developed a feature that reduces the viewing angle of phone displays. The privacy display uses a new type of OLED panel that prevent people nearby from reading screens from an angle. The new feature will be available in the company's upcoming S26 models. And finally, the Notepad text editor has improved its update system. The app now verifies the update information received from Notepad servers and the installer itself. The changes come after a Chinese APT hijacked the app's update servers last year and launched targeted attacks. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Run Zero. Find them@runzero.com thanks for your company.