Risky Bulletin: DataSuckers suspects arrested in Russia

0:03Three data suckers hacking group suspects arrested in Russia. Al Jazeera employees targeted with Candy Roos spyware. The US disrupts 40 North Korean laptop farms. And an OpenAI employee was arrested for planting a spy device. This is the Risky Bulletin, prepared by Katalin Kimpano and read by me, Claire Aird. Today is the 16th of October, and this podcast episode is brought to you by cloud security company Prowler. In today's top story, Russian authorities have arrested three members of the Datasuckers hacking and extortion group. One of the three, a 19-year-old man, was arraigned in a Moscow court on Wednesday.

0:46He was identified after using his home IP address to access a hacked system. Authorities said Datasuckers has four members in total. The group started operating this year and has been linked to the hacks of Ukrainian supermarket chain ATB Market and Russian companies Teztua and Dodo Pizza. They've been described as Russia's own shiny hunters or lapsus group. Israeli advertising company Discover Tech assisted spyware maker Candy Roo in deploying its payloads via targeted ads. According to a Citizen Lab report, infections have been confirmed at Al Jazeera headquarters. Other ad clusters identified by Citizen Lab suggest EU governments, NATO and UN networks, global news organisations and chip and semiconductor manufacturers were also targeted.

1:36Google has booted Discover Tech from its advertising platforms and IAB Europe has removed the company from its approved vendor list. A hacker claims to have breached phones belonging to people in Israeli Prime Minister Benjamin Netanyahu's inner circle. This week, the hacker leaked photos and videos allegedly stolen from the Prime Minister's wife, Sarah Netanyahu, his advisor, Yonatan Urik, and Israel's ambassador to the UAE, Yossi Shelley. Israeli newspaper Haaretz has verified some of the leaked content. The leaks come just weeks before Israel's legislative elections, which are scheduled to be held on October 27.

2:17A cyber attack has halted construction work on a tunnel connecting Denmark to Germany. The hack hit FamineLink Contractors, the consortium building the Famine Belt Tunnel. The incident has affected some equipment and employee access cards. Once complete, the Famine Belt is set to become the world's longest road and rail tunnel. Security researchers claim to have found spy chip implants in Trezor cryptocurrency wallets. The discovery comes days after similar implants were found in ledger devices being sold by a Southeast Asian reseller. Trezor has denied the accuracy of the reports, but said it would reduce its number of resellers from next year.

2:58The cyber attack that defrosted refrigerators in French supermarkets targeted more equipment than initially reported. According to France's Cyber Security Agency, the attacks targeted Copeland and Dixon devices on top of the previously reported Danfoss controllers. Hackers accessed the freezer and refrigerator web panels over the weekend and increased their temperatures to as high as 50 degrees Celsius. The freezers defrosted and some even caught fire. Most of the affected devices belonged to French supermarket chain Entomarche. A suspected Kazakh cyber espionage group has been targeting former Soviet states in a years-long campaign.

3:39The group gathered intelligence on environmental policy, water resources and forestry mainly due to the shared river systems and interconnected energy and transport infrastructure within the region. According to joint reports from Cisco and Recorded Future, the group has evolved its operational tactics and malware capabilities since its first attacks last year. U.S. authorities have disrupted 40 North Korean laptop farms operating in Texas. Authorities seized 187 laptops that were being used by North Koreans posing as U.S. residents to obtain jobs. The Department of Justice also charged a total of 14 individuals.

4:20Two U.S. nationals were arrested. The scheme impacted more than 70 U.S. companies and generated$3 million in revenue for North Korea. The FBI has arrested an open AI employee for planting a covert listening device in a conference room at the company's San Francisco office. The 35-year-old Saudi national, Abdulrahman Alphozan, planted the device behind a television. CCTV footage shows him scouting the conference room and the TV before planting the device. He also placed a second listening device in a bag he left unattended in a different room. Thai authorities have arrested 39 suspects accused of running online investment scams.

5:01The group ran a fake stock trading app that scammed users out of$14.8 million. North Macedonian authorities have arrested the administrator of cybercrime marketplace OLVX. The 20-year-old was detained in the village of Gullama Rechitsa this week. OLVX launched in 2023 and sold access to phishing kits and stolen credentials. The suspect, whose name has not been released, also ran One Millie, a Telegram channel that sold tools to help criminals run refund fraud schemes. Japan's police force, together with Microsoft and other tech firms, have disrupted three Chinese cybercrime services. The first two, Code GUI and Iron Man, sold phishing kits.

5:46The third, YamStore, sold compromised accounts collected by the first two. Microsoft says the kit sent one billion phishing messages, with 75 % of those targeting its services alone. The company's legal team seized domains and more than 20 ,000 associated accounts. Attorneys-General from eight US states are suing OpenAI, claiming the company's chat GPT AI chat assistant caused harm. Prosecutors say the chatbot encourages users to engage in dangerous behaviour such as acts of violence and mass shootings. The suit accuses the company of unjust enrichment, creating a public nuisance and failing to warn consumers of chat GPT's risks.

6:32The US Federal Trade Commission has sued a company that defrauded victims of sextortion schemes. The FTC says the Digital Forensics Corporation charged sextortion victims for assistance but never rendered any services. The company allegedly made more than$60 million from victims wanting to prevent hackers from publishing their sensitive material online. A threat actor is hijacking internet-exposed devices and enrolling them in residential proxy networks to earn commission. Attacks have been detected against Ubiquity NBRs, D-Link NAS devices and SAP NetWeaver servers. According to Grey Noise, the devices are being enrolled in the IP Royal Residential Proxy Service.

7:15Chinese threat actors are developing a new exploitation framework designed to target iOS 26. The Divine Seagull tool was built on top of Karuna and Dark Sword, two professional iOS hacking tools that leaked this year. Both have been widely adopted by the Chinese cybercrime ecosystem over the past months. Social media platform X has suspended 13 ,000 accounts involved in influence operations from Iran, Russia and China. The campaigns aim to direct US political discourse. This is X's first crackdown on influence operations in years. Cisco has released a firmware update to patch yet another zero day in its secure email gateway servers.

8:00This zero day resides in the server's advanced malware protection. It allows unauthenticated remote attackers to write files on the server's underlying operating system and then execute commands with root privileges. This is the third secure email gateway exploited in the wild in the space of a year. Palo Alto Networks has released fixes for a new zero-day in PanOS devices. The zero-day allows remote code execution attacks against the device's management interface. Valid credentials are required. Vulnerable devices include PA Series and BM Series firewalls and the Panorama Unified Management Portal.

8:41Collabora has released a security update to patch an actively exploited zero day in its NextCloud Office integration app. The vulnerability has been used to plant web shells on NextCloud service since September. The Collabora online app integrates LibreOffice online office with the NextCloud platform. Expo researchers used AI tools to create a three-part exploit chain in Chrome that could be used to take over the underlying Windows OS. Google paid the researchers its top reward of$250 ,000 for the exploit chain. This is just the second time Google has paid this amount in a single bounty payment.

9:21And finally, Israeli security firm Checkpoint is poised to leave the Russian market. According to Russian news agency TASS, the company will not renew its state license and will likely exit Russia next year. The same sources claim the company has already turned down several public and private sector contracts. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Prowler. Find them at prowler.net. Thanks for your company.