Risky Bulletin: Anthropic agents went hacking again

0:04Anthropic agents went hacking again. South Korea increases its data breach fines, Apple notifies three Turkish ministers of mercenary spyware attacks, and CISA is ready to hire 250 staff. This is the Risky Bulletin, prepared by Catalan Kimpanu and read by me, Claire Aird. Today is the 11th of September, and this podcast episode is brought to you by Authentic. In today's top story, Anthropic has disclosed a fourth incident of its AI agents escaping their test environment and hacking real targets. The latest incident involved the Opus 4.6 model escaping during a CTF challenge. The model broke its test environment, but due to a misconfiguration, it couldn't terminate its test.

0:51It continued to probe its environment until it reached and hacked a third party, stole credentials and modified settings for future access. The model's adventures ended when it ran out of tokens. Meantime, the OpenAI agents that recently congregated on a German wiki held secret conversations on almost a dozen more sites than initially reported. Last week, the company confirmed its agents escaped their sandboxes and hosted a secret community on a German language wiki portal. Researchers have since found the agents on more sites, including GitHub repositories, pastebin sites, a teacher's AP chemistry site and link shorteners run by two universities.

1:36In other news, Apple has notified three Turkish ministers that their devices were targeted with mercenary spyware. The company sent spyware alerts to users in 110 countries last week. According to Turkish media, the hacking attempts against the ministers weren't successful. Turkia's newly established Presidency of Cybersecurity inspected and replaced the devices. Three US lawmakers have urged the Department of Commerce to sanction three Indian hacker-for-hire firms. The companies, named in a letter to Howard Lutnick, the US Secretary of Commerce, are Beltrox, Cyberroot and Appen, now operating as Sunkist Organic Farms.

2:18The letter was signed by Democratic Senators Ron Wyden of Oregon, Sheldon Whitehouse of Rhode Island and Republican Congressman Pat Harrigan of North Carolina. They said the company should be banned for hacking American citizens and companies. CISA has sent job offers to 250 prospective employees and is currently waiting on their security clearances.

2:48staff. Last year, CISA laid off a third of its staff under Kristi Noam. The FBI wants to disrupt an increasing number of cybercrime operations. The Bureau's updated cyber strategy says it will prioritise working together with allies, the DOJ and its Virtual Assets Unit to target threat actors' money, infrastructure and supply chains. The new strategy also emphasises sharing more data with the private sector and arming its staff with more AI and big data analysis tools. The UK government has chosen a new commander for the country's national cyber force. The military agency is similar to US Cyber Command and carries out UK offensive cyber operations.

3:34The commander's name has not been publicly released. They'll replace Air Vice Marshal Tim Neal Hopes, who held the position since October 2023. The South Korean government has raised the fines for a data breach to 10 % of a company's revenue, which is up from 3 % previously. The new fine level will apply to any business that leaks the personal data of 10 million or more customers. The new data breach regulation also requires companies to notify users when a breach is likely to have occurred, even if it's not yet been confirmed. Companies also have to notify authorities of likely breaches within 72 hours.

4:15China and 46 other countries have established a new alliance to fight telecom scams. The International Alliance Combating Telecom and Cyber Fraud will also include 34 observer countries and four international organisations such as the UN and Interpol. The alliance's main goal will be to fight cyber scam compounds. VPN provider Surfshark says hackers breached an internal test server. The incident took place on September 2, was contained on the same day and no user data was accessed. Surfshark blamed the incident on a human error that left the test server exposed on the internet. A threat actor has compromised DeepLiveCam, a Python face-swapping application with 96 ,600 GitHub stars.

5:05The attacker modified a project dependency to add a cryptocurrency clipboard hijacker for Windows and macOS to the software. The compromise lasted nine hours. US police departments are warning officers that Meta smart glasses can be used to secretly record them or to film inside police facilities. A memo instructs police officers to conduct thorough inspections of all eyewear. According to The Guardian, more than a dozen such memos have been sent to police forces across the US. Multiple videos recorded with Metaglasses criticising prison conditions have been published on social media over the past year.

5:45The US Justice Department has seized telegram channels and cryptocurrency wallets operated by Shinbi Guarantee. The channels operated as a marketplace where threat actors would advertise services to cyber scam compound operators. The US Treasury Department has also sanctioned Xinbi and designated it a transnational criminal organization. In the same announcement, the Justice Department said 13 scam centers operated by Chinese nationals in Madagascar were also taken down. A US judge has sentenced a Ukrainian national to four years in prison for hacking US companies and deploying the Conti ransomware.

6:26Alexei Oleksayevich Litvanyenko was arrested in Ireland in July 2023 and extradited to the US last year. The 44-year-old was a member of the gang between 2020 and June 2022 and later moved to other cybercrime activities after the group disbanded. Threat actors are hosting malicious and fraudulent apps via the Google Play Store's early access program. The attackers are taking advantage of users being unable to leave ratings and reviews to warn others about malicious apps published under the Early Access Program. Bitdefender has seen threat actors use social media ads to lure users to apps hosted inside the Early Access Program.

7:10Anthropic says it's disrupted dozens of threat actors who are abusing its service. The company suspended accounts that were running surveillance operations in Mali and Middle Eastern countries and against Chinese religious groups. It also suspended accounts linked to a Chinese group that was running a deceptive dating app. Anthropic also took down accounts run by hacktivists targeting European political entities, the Shiny Hunters group and several exploit developers. It says its services were also being abused to run influence operations, write malware, conduct online fraud and even develop conventional and biological weapons.

7:48Russian state-sponsored hackers have deployed the DarkSword iOS exploit kit against several targets inside NATO countries. Identified targets include a Central European Presidential Office, a European Foreign Affairs Ministry, a US federal agency and a major European aerospace company. The campaign took place in late March, a week after Google and other security vendors publicly exposed the existence of the DarkSword kit. At least four different APT groups are using a new exploit kit to hack into Windows computers. The Blue Moon kit uses Chrome and Windows Zero Days to deploy malware on a user's computer if they click a malicious link inside a Chromium-based browser.

8:33The kit was spotted in late August. According to Proofpoint and Velexity, at least two of the four groups using the kit have a Chinese state nexus. Google has released patches for an actively exploited Chrome Zero Day. The zero day is a memory corruption bug in Chrome's V8 JavaScript engine and was discovered by a student at the Seoul National University. It's the seventh Chrome zero day Google patch this year. Security researcher Nightmare Eclipse has released a zero day in the Defender security suite. The vulnerability bypasses Microsoft's patches for a previous Defender zero day named Shield Break.

9:13The research had timed their release to come after Microsoft's Patch Tuesday security updates. And finally, AWS has fixed a vulnerability in its Athena serverless SQL service that exposed data and database queries to other customers. The vulnerability could have been exploited by adding the catalogue equal system parameter to any Athena SQL query. AWS disabled the parameter and fixed the issue across all regions within four days of being notified last month. And that is all for this podcast edition. Risky Bulletin will be taking a break next week. If you're in Sydney, we'll see you at Unprompted.

9:55Otherwise, we'll be back on Monday, September 21. Today's show was brought to you by Authentic. Find them at goauthentic.io. That's Authentic with a T-I-K. Thanks for your company.