Risky Bulletin: BEC campaign steals €35 million from French notaries

0:03Hackers steal€35 million from French notaries, OpenAI agents hacked a German wiki, A new bill will allow the Pentagon to use cyber contractors. And the Five Eyes members tell hacked companies to drop PR spin. This is the Risky Bulletin, prepared by Catalan Kempanu and read by me, Claire Aird. Today is the 7th of September and this podcast episode is brought to you by Authentic. In today's top story, a BEC gang has stolen more than 35 million euros from French notaries over the past four years. Hackers breached more than 500 victims, then modified transaction details to hijack wire payments. According to Le Monde, 7 % of all French notaries were hacked, including the country's notary supervisory agency.

0:55France's cybersecurity agency has been investigating the hacks for two years and has helped notaries deploy better protections. In other news, OpenAI agents escaped their testing environments again, this time hacking a German wiki website. In late August, the agents created a secret bulletin board where other agents could share details on how to escape sandbox environments, cheat on tasks, and evade OpenAI's monitoring. The agents shared more than 15 ,000 messages across the board, which was live for a week before it was discovered. OpenAI has acknowledged the incident. Cryptocurrency company Blockstream has paused its liquid network platform after an unauthorised withdrawal of$320 million in Bitcoin.

1:45In a message on the platform's blockchain, the attackers claimed to be white hat security researchers and urged the company to reach out. Blockstream has confirmed it is trying to make contact. If the incident is a malicious hack, it would be the biggest crypto heist of the year. The US military has disabled advertising identifiers on government-owned phones and computers used by troops across the Air Force, Army and Special Operations Command. The Pentagon took the step after reports that Iran used ad network-sourced location data to target American troops in the Middle East. The National Defence Authorisation Act for fiscal year 2027 includes a provision authorising the DoD to use cyber contractors to carry out military cyber operations.

2:35Under the bill, Cyber Command would be tasked with creating a pilot program to test out the arrangement. Critics of the bill have called the provision the privatisation of military hacking operations. Cyber security agencies from the Five Eyes countries have told HAC companies to drop the PR spin from their data breach notifications. The agencies have urged companies to be transparent, provide technical information and publish clear incident timelines. 29 EU parliamentarians have called for the bloc to suspend Serbia's EU membership application over its repeated spyware abuse. Multiple reports have blamed the government of using Nova Spy and Pegasus spyware against student protesters, journalists and political activists.

3:23French authorities have arrested two people suspected of hacking the country's tax agency last month. The first suspect was arrested on August 18, the day after the hack became public. He's believed to be Zero Bites, the hacker who publicly took credit for the intrusion. Prosecutors say he's 18. In 2024 and 2025, he was indicted and bailed over separate hacking cases. The second suspect was arrested eight days later on August 26. Hackers gained access to the JetBrains Cadence cloud-based LLM training platform last month. The hackers exploited a vulnerability in JetBrains' own Team City service to get in.

4:06JetBrains says the intruders stole source code and credentials stored by customers in cadence instances. The city of Roanoke, Virginia, took three months to notify residents of a data breach. Hackers maintained access to a local government department system for five days in May and stole internal documents. City officials are under fire for taking months to notify residents, not saying which department was hacked or how many residents were affected. Hackers breached the Berlin city government after an employee installed malware on the city's network during a click-fix attack. The intrusion was later weaponised to deploy the RISEDA ransomware.

4:47The RISEDA group eventually dumped the city's data after Berlin officials refused to pay a$2 million ransom demand. The University of California, Berkeley, took several systems offline after a cyber attack late last month. The incident impacted the Department of Electrical Engineering and Computer Sciences. Central campus IT services were not affected and courses took place as normal. The developers of the Node Steeler malware have used an AI coding assistant to turn their InfoSteeler into fully featured spyware. New features include the ability to log keystrokes, monitor the clipboard, take screenshots of the user's screen and steal Wi-Fi passwords.

5:32Security firm Netscope says the massive set of features were added out of the blue and that the new code looks like it was LLM generated. Google has released a security update to patch an in-the-wild Chrome Zero Day. The bug is a tight confusion in Chrome's V8 JavaScript engine. The vulnerability was discovered by Italian security researcher Salvatore Gulizia. It's the sixth Chrome Zero Day to be patched this year. Hackers are exploiting two zero-day vulnerabilities to create backdoor admin accounts on MicroTik routers. Only devices with their SSH service accessible from public networks are vulnerable.

6:14Attacks were spotted last week by the Polish and Latvian certs. MicroTik released security patches for the bugs on Thursday. Hackers are using a new zero-day to take over Adobe Commerce and Magento online stores. Security firm Sansec discovered the zero-day, but says it saw no evidence the intruders deployed additional malicious scripts. It tracks the zero-day as style smuggler. Software maker Enable has released a security update to patch a major bug that can let attackers hijack N-central servers. The vulnerability is a pre-authentication remote code execution with a severity of 10. Enable says the bug has not been exploited in the wild, but recommends that customers apply the patches as soon as possible.

7:01Threat actors are exploiting a new vulnerability in Citrix ADC and Netscaler Gateway devices. The vulnerability was patched in August and allows attackers to bypass authentication and run commands on the device. Security firm Providian detected in the wild exploitation last week. Microsoft is releasing a new Windows API that can infer the age of users. The Windows Age API will also share the inferred age of users with local apps so they can modify their features based on a user's age category. The API will only be available on Windows 11. And finally, Microsoft has announced Project Zenith, a developer-optimized version of Windows 11.

7:47Project Zenith devices will ship pre-installed with Python, Node.js, the Azure and GitHub CLIs, PowerToys, Visual Studio Code, and more. Windows settings will also be tweaked for development tasks. And that is all for this podcast edition. Today's show was brought to you by Authentic. Find them at goauthentic.io. That's Authentic with a T-I-K. Thanks to your company. Thank you.