Risky Bulletin: Chinese APT exploits SS7, Diameter to spy on targets

0:03A Chinese APT exploits the SS7 and Diameter protocols. A remote code execution bug hits Apache. Brazil's largest port suffers a cyber attack. And Europol takes down three malware operations. This is the Risky Bulletin, prepared by Katalin Kimpano and read by me, Claire Aird. Today is the 13th of November, and this podcast episode is brought to you by Airlock Digital. In today's top story, a newly discovered Chinese APT group hacked six Asian telcos, then exploited weaknesses in the SS7 and diameter protocols to conduct espionage. The attacks targeted a very small number of individuals, including political figures and government officials.

0:50The majority of individuals who were targeted are connected in some way to Taiwan. The attackers ran SS7 and diameter commands that intercepted calls and SMS traffic and tracked device locations. Security firm Aenea tracks the group as silent air. In other news, the Apache Software Foundation has patched a remote code execution bug in its web server. The vulnerability allows remote, unauthenticated attackers to run malicious code on the server via HTTP2 connections. According to Wiz, 64 % of cloud environments are running vulnerable versions of Apache. Poland has temporarily suspended its ePWAP eGovernment portal after detecting a cyber attack this week.

1:36Minister of Digital Affairs Christophe Gavkowski says foreign adversaries are behind the attack. Government IT teams are working to restore the platform. A cyber attack has crippled the IT network of Brazil's largest port. The port of Santos in Sao Paulo has been operating on manual procedures for the past five days. The port's operator has restored some systems such as internet and telephone connectivity. The same port was also hit by the non-data extortion group in October but refused to pay a$26 million ransom demand. Hackers have stolen personal data from South Korea's financial security agency, FSEC.

2:17The agency confirmed the hack in a press release on Tuesday. Ironically, the hackers hit a website where financial institutions submit security assessments. A historic village in New Jersey has lost$26 million in an email scam. According to the Wall Street Journal, township staff were tricked into wiring money to the wrong account for a land purchase. The incident took place in September, but was only revealed three days after a township committee election. A threat actor is compromising Screen Connect panels to install malicious Screen Connect clients on connected endpoints. According to security firm Huntress, the attacker has compromised at least six managed service providers and pivoted to 288 endpoints at 48 organisations.

3:05ConnectWise says the hackers entered customer environments via a third-party extension called RMM+. The company has disabled the extension across 400 customer networks, including ones that were not yet exploited. One of the world's largest accounting firms is notifying customers of a security breach. Baker Tilly says hackers breached a third-party platform in September and stole customer data. The company is the ninth largest accounting firm in the world by revenue. AI Tools marketplace, Apify, has notified customers of a security breach. The company says hackers accessed customer accounts in an incident earlier this week.

3:47Amplify has revoked some OAuth connections, which it suspects were used to gain access to the accounts. It's also rotated some of its internal secrets as a precaution. Hackers abused credentials and tokens stolen from Railway.com customers last month to incur$740 ,000 in unauthorised AI usage. Railway.com says it's working with AI providers to refund the unauthorised costs or even cover them itself. In its post-mortem report, Railway says hackers stole and decrypted customer environment variables from about 100 ,000 customers, or around 1.85 % of its total customer base. The non-extortion group has taken credit for breaching the QBOL Data Lake platform.

4:35The group claims it stole almost a petabyte of data from all QBOL customers over a month's long intrusion. Non says it approached the company in private, but it wouldn't negotiate. India's oldest cryptocurrency exchange has suspended operations after a cyber attack last week. Unocoin pulled its platform offline after security firms noticed that more than 81 ,000 wallet addresses associated with the platform began showing a$0 balance last Friday. Almost a week after the hack, Unocoin has yet to reveal how much money was stolen. The UK government has launched a new program to help critical infrastructure organisations test their cyber defences.

5:18The new Cyber Adversary Simulation Scheme connects organisations with trusted cyber security providers that can mimic realistic attacks. Five cyber security companies have already been certified under the scheme. Europol has seized the service of three malware operations, Gootloader, Castle Rat and Steel Sea. More than 6.4 million user credentials were found on the seized servers. No arrests have been reported so far. Hungarian police have arrested a Chinese national for driving around with an SMS blaster in his car. The 27-year-old suspect was arrested in July after authorities tracked his blaster's signal from Budapest to the city of Piets near Hungary's southern border.

6:05Authorities say the suspect was spamming phones with fake traffic fines. A threat actor is pushing malicious workloads to GitHub repositories that steal secrets and cloud credentials from GitHub actions. According to Aikido Security, the attacker is using more than 4 ,800 hacked GitHub accounts to push the workloads. Malicious payloads have been spotted on over 61 ,000 repositories. Threat actors are using an agentic penetration testing framework named Antifox to hack public cloud services. Antifox is the work of a Chinese developer and was forked from the highly popular Artex AI framework. Security firm Arctic Wolf says the framework is currently being used to hack AWS environments.

6:51environments. Linux servers are being infected with a new and highly sophisticated crypto miner named Sansa. The malware uses several never-before-seen techniques to stay undetected in compromised environments. Sansa uses an NVIDIA library to falsify GPU activity readings and a rootkit to hide all its processes. It also uses a mixed Tor and Ethereum-based command and control system to prevent easy detection and takedowns. State-sponsored hackers working for Kazakhstan have stolen thousands of defence-related government documents from neighbouring Tajikistan. The Silent Links APT used DeepSeq models and the Hermes AI framework to automate the intrusion.

7:37Security firm CloudSec discovered the hacks after Silent Links operators left a misconfigured folder online. The same folder contained evidence of similar campaigns targeting Tajikistan's railway network and Uzbekistan's smart forestry platform. Security researchers have doxxed two members of an FSB-aligned APT group known as Void Blizzard or Laundry Bear. Anton Listarov and Vyacheslav Zupkov targeted Russian opposition activists while working for two Russian companies, IAC Emicom and Utec NN. They got their orders from an FSB officer named Dennis Abretzko, who was arrested in Thailand and extradited to the US this year.

8:22A threat actor is exploiting the PHP 2 shell vulnerability to take over checkpoint security gateways. Attacks against the gateways began on October 30 and targeted Israeli organisations with destructive attacks. A second wave followed days later and targeted gateways in other countries with web shells and backdoors. Checkpoint is the second security firm after Palo Alto Networks to have its devices exploited via the PHP 2 shell vulnerability. A security researcher with Dutch cyber security firm Midnight Blue has found five remote code execution vulnerabilities in Danfoss refrigeration management systems.

9:02Danfoss is one of the vendors targeted in the recent wave of freezer hacks across Europe over the past month. The researcher Carlo Meier found the bugs in less than an hour of manual code inspection. The vulnerabilities can lead to full takeover or can be used to brick the controllers. The bugs have been reported to the vendor but no patches are available yet. Security researcher Nightmare Eclipse has released a new Windows Zero Day named SignDrop. The Zero Day can allow attackers to elevate privileges on Windows systems. It works by exploiting Microsoft's mitigations against CLFS authentication attacks.

9:42The researcher published the exploit shortly after Microsoft released this month's Patch Tuesday security updates. Only 442 of the nearly 38 ,000 vulnerabilities found using Anthropics Project Glasswing have received a CVE identifier, and only two of them have been exploited in the wild. According to security firm Volncheck, more than 80 % of the glass wing findings have not been made public months after the project launched. In the case bug reports became public, the project overwhelmed open source maintainers with duplicates or unvalidated work. Indian Certificate Authority eMudra has revoked another eight intermediate certificates after it mishandled their private keys.

10:28The company revoked eight different certificates last month after researchers found they were generated using weak private keys with eight bits of entropy. The company has since left the SSL certificate market. United Airlines has blocked AI agents from booking flights, citing cybersecurity risks. United says AI agents can make unwanted purchases and can also accidentally collect and then expose sensitive account data. The airline says a human's presence is still needed during flight reservations and during check-in processes to confirm bags don't contain dangerous substances. And finally, NVIDIA CEO Jensen Huang has resigned after reports of two extramarital affairs, including one with a suspected Chinese spy.

11:15NVIDIA has appointed Colette Kress as interim CEO. She's the company's current executive vice president and chief financial officer. And that is all for this podcast edition. Today's show is brought to you by Airlock Digital. Find them at airlockdigital.com. Thanks for your company.