Risky Bulletin: Crime Stoppers puts bounty on INC ransomware group

0:03A non-profit puts a$22 ,000 bounty on the Inc. Ransomware group. Hackers breach the UK Department for Education. Russia charges Telegram founder Pavel Durov. And the FCC bans foreign robots and power inverters. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 31st of July, and this podcast episode is brought to you by Airlock Digital. In today's top story, Crimestoppers International is offering a$22 ,000 bounty for information on the Inc. Ransomware Group. The global non-profit organisation allows people to report information about crimes anonymously.

0:46The organisation said to receive the reward, the information must lead to the identification, arrest or disruption of the gang's operations. The Inc. Ransomware Group is currently one of the most active ransomware operations. In other news, the US Senate has confirmed Jay Clayton as the next Director of National Intelligence. Clayton replaces Tulsi Gabbard, who resigned in May. Trump ally Bill Pulte is currently serving as Interim Chief and recently announced a 30 % cut to ODNI staff. The US government has banned the import of foreign-made robots and power inverters, citing national security. The ban applies to advanced humanoid and four-legged robots, as well as power inverters used with solar panels and large-scale batteries.

1:35Most of the affected products are made in China. Hackers are extorting the UK Department of Education following a breach. The Exfil Squad Group claims to have stolen 600 ,000 records from the department, including names, email addresses and phone numbers. The data was allegedly stolen from two web portals, including the agency's help desk. The group also claims to have breached the UK Police National Legal Database, American Semiconductor Maker Analog Devices and Microsoft. A hacker deployed a cryptocurrency stealer through the Adform Advertising Network. The malicious code has been live in an Adform JavaScript file for at least a week.

2:19The code hijacks user clipboards and browsers to enable cryptocurrency theft. A cyber attack has disrupted Angola's largest telco. The attack on Unitel affected mobile services and internet access and occurred hours before the telco's IPO. The state-owned operator has more than 21 million customers, which is more than half of Angola's population. A hacker is selling data stolen from a VPN provider Russians use to bypass the Kremlin's internet censorship. The data from SplitVPN includes details on more than 23 million customers. It also includes browsing data, which the company had claimed it didn't collect.

3:02A DNS hijacking attack has hit CubePilot, an Australian company that makes flight controllers for drones and UAVs. The incident took place last week. CubePilot has urged all customers who recently logged in to change passwords. The company is currently auditing the integrity of its drone controller firmware. South Korean authorities have handed telecom provider KT a$37 million fine over its 2024 and 2025 security incidents. Hackers planted malware on KT's servers and stole the information of more than 16 ,000 subscribers. The size of the fine reflected the company's attempt to hide the breach from authorities.

3:47US health tech giant CareCloud is notifying users whose medical records were stolen in a breach this year. The breach occurred in March and impacted more than 350 ,000 patients. The data was stolen from one of the company's six electronic health record data storage servers. The Russian government has issued an international arrest warrant for Telegram founder Pavel Durov. Durov has been charged with complicity in terrorism. The FSB intelligence service said Telegram failed to remove channels used by Ukraine's intelligence agencies to recruit saboteurs. It also failed to remove channels used by scammers and extremist organisations.

4:29Durov said the charges are politically motivated in order to ban the app in Russia. The Russian Prosecutor General is also seeking to designate Telegram an extremist organisation. Meantime, the Australian government has launched a legal action against Telegram over its lax content moderation. Australia's eSafety Commissioner claims Telegram has failed to remove videos of violent extremists, mass shootings and executions. If proven, the platform risks a fine equivalent to US$38 million. A US court has sentenced a Ghanaian to 85 months in prison for stealing more than$10 million through romance scams.

5:11$4.2 million of that was stolen from just two of Derek Van Yeboa's victims. He also engaged in BEC scams targeting businesses. A teenager hacked and defaced two Indian universities after he was denied admission to their cyber security programs. Messages requesting a second chance were left on the home pages of the Kanpur and Madras Institutes of Technology. Instead of jail time, the Kanpur University has now invited the team to a hackathon as part of a future admission process. A new supply chain attack has hit the Arch Linux community and its AUR third-party package repository. A threat actor adopted dozens of abandoned packages and added malware to their code.

5:57In response to the attack, the AUR repository disabled package adoption on Thursday. A similar attack hit the repository in June. In that incident, hackers hijacked almost 2 ,000 Arch Linux packages to deploy rootkits and infostealers. A credential stuffing attack is targeting SonicWall VPN and firewall devices. The attacks began on July 25. According to security firm Huntress, Sonic wall devices at around 30 organisations have been compromised so far. A North Korean hacking group has been linked to a year-long watering hole campaign that deployed backdoors and ransomware to selected targets. The watering hole sites exploited a vulnerability in the South Korean financial security software AnySign4PC to deploy the malware payloads.

6:4715 sites were hacked to host the attack, which compromised at least 72 organisations. The ransomware used in some of the attacks was the gun restraint. Russian espionage group Laundry Bear is behind a Microsoft Exchange Zero Day discovered in May. The Zero Day was primarily used against American and European government organisations. The vulnerability allowed hackers to plant malicious code in inboxes that executed when users read their emails. The hackers used the bug to execute a tool named OWA Reaper that stole credentials. and emails from the victim's accounts. Cisco has patched an actively exploited zero day in its secure firewall management centre software.

7:32The software contained hard-coded credentials for a low-privileged account. Attackers were logging in via that account, then using privilege escalation bugs to take over the devices. Security firm Horizon 3 found the bug and the attacks. Microsoft has patched a vulnerability in the Azure Cosmos DB database service. The patches fix a vulnerability named Cosmos Escape. The bug would have allowed threat actors to gain full read and write access to every Cosmos DB database in the Azure cloud. And finally, a bug in Microtick routers allows attackers to bypass login rate limiting to carry out brute force attacks.

8:13The issue impacts both on-premise and cloud-hosted routers. The vulnerability has been traced to a bug in the RouterOS authentication API. No patch is available. And that is all for this podcast edition. Today's show was brought to you by Airlock Digital. Find them at airlockdigital.com. Thanks for your company.