Loading summary
Transcript1 lines
- [00:04]
Claire Aird
The Trump administration stops treating Russian hackers as a threat Meta seeks a permanent NSO injunction New celebrite zero days come to light and big name Russian cybercriminals get home detention this is the risky bulletin prepared by Catalyn Kim Panu and read by me, Claire aird. Today is the 3rd of March and this podcast episode is brought to you by cloud security company Prowler. The Trump administration has instructed CISA and Cyber Command to stop worrying about Russia. In a memo, Defence Secretary Pete Hegseth ordered Cyber Command to cease active operations targeting Russia. The Guardian reported that a second order sent to CISA prioritised Chinese threats and the protection of US systems for the agency. Russian hackers were noticeably absent. Staff were allegedly told verbally to stop working on anything Russia related. No similar order was issued to the national security agency. The US government has cancelled a $95 million contract with IBM that aimed to boost the cybersecurity defences of European and Asian allies. Under the contract, IBM deployed cyber security experts to countries like Albania, Azerbaijan and Kosovo to bolster their cyber security defences. The contract was provided through the US aid agency and was cancelled as part of government efforts to cut spend. Iranian authorities are seizing the Instagram accounts of anti government dissidents. Influencers are being arrested and forced to hand over their passwords. Once authorities have access to the accounts, their posts are deleted and replaced with confiscation messages. Amnesty International and Google have identified three vulnerabilities used by the cellebrite phone unlocking toolkit. All three zero days are in the Linux USB stack and were used to hack Android devices. One bug was patched in the Android Android security update in February. The other two are fixed in the upstream Linux kernel but are yet to make their way into an Android update. The company banned Serbian authorities from its service last week after learning of the misuse from Amnesty International. Meta is seeking a permanent injunction against Israeli spyware maker NSO Group that would ban it from its platforms. A temporary injunction already prevents NSO from accessing WhatsApp. It was put in place after Meta sued NSO in 2019. In December last last year, a judge found NSO Group liable for attacks that targeted over 1,400 WhatsApp users. A bug in mobile's spyware app Spyse has exposed the email addresses of all its users. The bug was discovered by an anonymous researcher who exploited the issue to track signups to Stalkerware. The researcher says Spysee has more than half a million registered users. If this sounds familiar, the same researcher exposed sign sign up data for two other spyware apps last week. Software automation company Zapier has disclosed a security breach after a hacker gained access to its internal code repositories. The company says the attacker may have gained access to limited customer information that was included in some repositories. Zapier is emailing customers to notify them about the breach. US authorities have recovered $31 million worth of crypto assets stolen from Uranium Finance. The funds were part of a $53 million CRYP heist in April 2021, shortly after the platform launched. Crypto investigation firm TRM Labs says it spent two years tracking the stolen funds across multiple blockchains. A new botnet named 1111 Bot has infected more than 30,000 devices and has launched large scale DDoS attacks against telecom providers and gaming platforms. Most of the infected devices are security cameras and network video recorders, most of which are located in Iran, according to Nokia. The bot behind a DDoS attack that peaked at 6.5 terabytes per second, the largest volumetric DDoS attack ever documented. The previous record was 5.6 terabytes per second recorded by Cloudflare in October last year. Russian courts have handed down light sentences to two well known ransomware gang members. Lockbit affiliate Mikhail Matveev, better known as Wazawaka, was sentenced to one and a half years Restriction of Freedom, which is Russia's version of home detention. He's not allowed to travel and must check in with authority authorities each month. Revil affiliate Alexander Ermakov was sentenced to two years Restriction of Freedom for his role in developing the SugarLocker ransomware. Wozawaka is known for his attack on the Washington D.C. police, while Ermakov was behind the Medibank ransomware attack in Australia. Both were detained last year for charges unrelated to cases filed in the US. Europol has detained 25 suspects in multiple countries who used generative AI to produce and distribute CSAM imagery. The content was distributed through an online platform run by a Danish national who was arrested last November along with some of the platform's users. Hackers are exploiting a reflected cross site scripting vulnerability in a JavaScript library to advertise pornography. The campaign leverages a bug in Krpano, a library used to build VR environments and virtual tours. Security researcher Oleg Zayetsev uncovered the campaign when he received the results from yale.edu when searching for pornography. Russian infosteelers dominated malware rankings in 2024, with Luma C2 being the most active, according to security firm recorded future. Luma C2 accounted for 35% of all infosteeler C2 discovered online. Lactrodectus was the most common malware dropper, Async Rat was the most common access Trojan and Hook was the most popular Android malware strain. Microsoft will shut down its Skype instant messaging app on May 5th in order to focus on its Teams service. The company has urged users to migrate their Skype accounts to teams or export their content. Skype launched in 2002 and had over 300 million active users at its peak. Microsoft acquired the app in 2011 for $8.5 billion and used it to launch its Teams collaboration platform in 2017. The teammate business compliance app has blamed a security researcher for a recent security breach. The New Zealand company accused security researcher JLT of hacking Teammate's service and threatened to report him to authorities. The researcher claimed there was no hacking involved since the company left its MongoDB database exposed online without a password and finally, certificate authority. Sectigo says it received a cease and desist letter from rival CA Digicert after one of its employees reported a bug in DigiCert's infrastructure. DigiCert claims the Certigo staffer posted misleading information about its services, even if DigiCert eventually had to revoke some of its certificates. Despite the letter, Sectigo refused to censure its employee and that is all for this podcast edition. Today's show is brought to you by our sponsor, Prowler. Find them@prowler.com thanks for your.