FBI confirms North Korea behind Binance hack

0:04The FBI links the Binance hack to North Korea. Game developers are being extorted with game cloning threats. The Belarusian cyber partisans hack Russia's statistics service and Apple sends new mercenary spyware notifications. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 2nd of November and this podcast episode is brought to you by Sublime Security. In today's top story, the FBI and several cybersecurity companies have linked last week's Binance hack to TraderTrader, an elite North Korean hacking group that specializes in crypto heists. The group stole more than$6.34 billion from the cryptocurrency exchange on Thursday.

0:54Binance was able to freeze almost half of the funds, but the other half is considered unrecoverable. Early evidence suggests the group gained access via a compromised employee laptop. The incident is the biggest crypto heist of all time. Trader Trader was also behind the previous record heist, last year's$1.5 billion Bybit hack. In other news, scammers are extorting indie game developers by threatening to use AI tools to copy their games and release free versions of them. The extortion emails are targeting smaller independent developers that typically release demos to help promote their work to users and financiers.

1:34The campaign has prompted many developers to remove their demos from Steam to protect unreleased work. The threat actors are demanding extortion fees ranging from hundreds to thousands of US dollars. Hackers stole more than$2.65 million from prediction market platform Polymarket on Thursday. A threat actor compromised one of Polymarket's CDNs and injected a malicious script into the platform's website. That script drained funds from users who logged onto the site. The company has reimbursed all 700 users who reported losses. Blockchain analysis firm Chainalysis says a threat actor used agentic AI tools to gain access to its internal network last month.

2:20The company says it found no evidence that the attackers accessed investigation data or customer details. Chainalysis says the incident is not connected to the recent Binance hack. A threat actor placed SSH backdoors on 5 ,000 systems by publishing a malicious version of Anthropik's clawed code extension for VS Code. The malicious version was served from the Cursor IDE extension marketplace. Cursor removed the extension and worked with a cloud provider to take down the attacker's command and control server. A threat actor has breached the North Flank cloud platform and stolen customers' AI-related API keys.

3:02The company disclosed the hack on Saturday and urged customers to rotate API keys stored on its platform. North Blank is still investigating how the breach occurred. Belarusian and Ukrainian hacktivist groups claim to have stolen 23 terabytes of data from Russia's state statistics service, Rostat. The cyber partisans and silent crow groups said the stolen data includes some state secrets. The groups also said they wiped Rostat databases and internal systems. The groups said they breached the agency almost six months ago. Hackers have stolen more than$3.6 million worth of tokens from the VergeX AI trading platform.

3:46The hack took place on Saturday. Users reported receiving transaction verification codes via email for operations they didn't initiate. Thousands of users were affected and the largest single loss was$850. Hackers have stolen the personal data of 4.9 million students from Florida's Department of Education The data was stolen from the department's financial aid website The department said students' financial aid is not at risk An Accenture employee caused a major security incident earlier this year when they connected an AI agent to a secure Pentagon system The clawed code agent uploaded sensitive Department of Defense files to a third-party website.

4:33The files contained controlled, unclassified information but also login credentials. The agent ran on the Pentagon network for two months before it was discovered. Hackers breached Ukraine's official air alarm app and pushed out fake alerts for chemical and nuclear attacks targeting Kiev. The alerts were displayed in Russian. No air raid sirens sounded in the city when the fake alerts went out. Officials cancelled the alerts 15 minutes later and urged the population to remain calm. A US court has sentenced a member of the Syrian Electronic Army Hacking Group to three and a half years in prison.

5:12Ahmad Umar Aga used the hacker name The Pro and hacked almost 50 Western media companies, businesses, NGOs and government organisations. He was on the FBI's Cyber Most Wanted list for almost a decade until his arrest last year. A Virginia man has pleaded guilty to running a North Korean IT worker laptop farm at his home. John Allen Curl Jr. also let North Koreans use his identity to apply for U.S.-based jobs. He faces up to 20 years in prison. The US has extradited a suspect from Israel to stand trial for allegedly hacking cryptocurrency exchange Nomad Bridge. Alexander Gurivich, a Russian-Israeli dual national, is accused of exploiting a vulnerability in the platform in August 2022.

6:02He allegedly stole$2.89 million worth of crypto assets before demanding a$500 ,000 reward to return the funds and share details about the bug. Garivich was one of many to exploit the same bug. The Nomad Bridge lost more than$190 million in the resulting hacks. The U.S. Department of Justice has indicted five Kenyan nationals over a student loan fraud scheme. The group is accused of using stolen data to apply for student loans in the names of real American citizens from the U.S. Government Federal Student Aid Program. The group fraudulently applied for almost$3 million in student loans. Apple has sent out a new wave of mercenary spyware notifications to users in almost 100 countries.

6:49Apple did not provide details about any of the infections. The notifications come on the heels of a Citizen Lab report into a spyware campaign that used online ads to target devices with advanced spyware. A threat actor uploaded malicious models to Hugging Face that installed cryptocurrency miners on users' computers when they ran them. The 31 malicious models were uploaded in September and downloaded more than 32 ,000 times. The attack exploited Hugging Face's trust remote code feature, which allows models to run custom Python code locally once loaded. The same models were also uploaded to China's ModelScope portal.

7:30Online scammers are setting up fake prediction markets in an attempt to capitalize on the popularity of platforms like Klasashi and Polymarket. According to security firm Recorded Future, some fake portals are sold by operators of traffic distribution platforms, including Atlas Core and Magnetic Team. These groups also redirect web traffic from hacked sites to the fake prediction markets to help drive user sign-ups. They rent the platform and take a cut of the profits. The new ransomware group Non has spent more than$7 ,000 on AI inference to power its intrusion campaigns. The group launched in September and has since breached almost 100 organisations, including port authorities and maritime organisations.

8:18Researchers learned of the group's AI spending after it left a malware staging server exposed online. Security researcher Mark Blaschick has discovered an Android vulnerability that can crash devices with an SMS. The attack doesn't require user interaction. It can be triggered by sending a malformed WAP message to a target device and leaves no trace in the user's SMS inbox. Once exploited, the SMS of death attack can render devices unusable for up to 20 minutes. Google patched the bug in last month's Android security bulletin. Google has introduced a new top reward of$250 ,000 for its Google Cloud Vulnerability research program.

9:02The new top reward will be paid for high-impact bugs. This includes tenant isolation bypasses and complex cross-service logic flaws that can grant attackers full control over an organization's account. And finally, the Danish government has dropped a plan to replace Microsoft Office with an open-source alternative. A small pilot program launched last year where 38 employees used the open source Collabora Office suite instead of Microsoft Office. The Ministry for Research, Education and Digitisation ended the pilot after only six months after employees reported issues with file formats. Documents often turned up blank with text formatting issues or incorrect visual styles.

9:48And that is all for this podcast edition. today's show was brought to you by our sponsor sublime security find them at sublime.security thanks for your company