Risky Bulletin: Hacker breaches Hungary's State Treasury

0:03A hacker breached Hungary's state treasury. Russia will mandate 40 apps on all smartphones next year. Hackers steal Lichtenstein's business database and an AI agent got real CVEs for hallucinated vulnerability reports. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 5th of August and this podcast episode is brought to you by Permiso Security. In today's top story, a hacker has stolen sensitive government data from Hungary's state treasury. The incident occurred last week. The State Treasury says the breach only impacted its Agricultural and Rural Development Office.

0:46Hungarian officials say no data was lost. A hacker named Bite2Breach was behind the hack. The same individual also wiped Romania's land registry database last month. Meantime, hackers have stolen data from Liechtenstein's business register. The database contains information about the owners of companies in Liechtenstein. There are more than 31 ,000 businesses registered in the small European country. Hackers have breached more than 200 accounts at the Swiss national IT agency, BIT. The intrusion targeted the agency's Microsoft SharePoint servers. BIT says it found no evidence of data exfiltration.

1:27The agency manages more than 50 ,000 workstations for government workers and more than 1 ,000 government apps. The UK's state investment body exposed sensitive information online for two days due to an employee error. The agency's recent annual report said the personal information of 51 government officials was exposed during the incident. The agency, UK Government Investments, says the staffer did not follow security protocols. At least a dozen US states are responding to Iranian cyber attacks against local water systems. The number of affected states has risen from previous reports of seven.

2:08Incidents have now been reported in Clayton County, Georgia, and the city of Duchenne, Utah. Last week, Clayton County customers reported low pressure or no water in the middle of the night. In Utah, the cyber attack made pumps run dry, while control panels said they were pumping water. The incident also impacted an oil field's wastewater disposal system, but didn't cause environmental damage. Crypto wallet maker CoinKite will stop selling cold card hardware wallets following the discovery of a major bug. Hackers exploited the vulnerability last week to steal$130 million in cryptocurrency. The company has released a patch for the cold card wallets that are already in use.

2:53The vulnerability is still being actively exploited against users who have not installed the update. Hackers have stolen data from the customer management platform Beacon CRM, which is used by UK charities. Numerous UK charities began notifying donors this week. Affected organisations include the English National Ballet, the Centre for Sustainable Energy and the Gardens Trust. Beacon serves more than 1 ,000 charities. The Russian government will require that all smartphones sold in the country are shipped with 40 apps pre-installed on them. The apps include the government's official messenger, Max, the Mir payment app, Kaspersky Antivirus, Russia's Play Store alternative, Roostore, and several Yandex and VK apps.

3:41The order comes into effect next year. Meanwhile, Russia's internet watchdog banned 20 more VPN services this week, bringing the country's total block list to around 500 apps and services. Some banned VPN providers reported losing access to their Russian IPs. The government is preparing an allow list of VPN services for business and corporate use. And still with Russia, the websites of at least seven major Russian banks were showing errors on Monday after they switched to Russian government-issued TLS certificates. Errors were reported on the sites of VTB, Sberbank, Alphabank, Roselk-Hosbank, Promsviasbank, UralSib and the St Petersburg Bank.

4:27The portals switched to using the domestic certificates after their existing certs were revoked by Western CAs. The new certificates are not trusted by mainstream browsers. In other news, a US House China Committee investigation has found three Chinese telcos have maintained presence on the U.S. market despite an FCC ban. The report, seen by NextGov, revealed that China Mobile, China Telecom and China Unicom still have network connections, equipment and data center space in the U.S. American lawmakers fear the leftover equipment and connections could be used to hack and spy on U.S. targets. Meantime, the US Federal Communications Commission is working on an important ban of Chinese-made data centre equipment.

5:15The order will primarily target optical transceivers, which are used to transfer data inside data centres. Officials are citing national security as a reason for the ban. The US has already banned the import of various Chinese-made routers, drones, robots and solar inverters. The White House says it's finalised a framework for evaluating AI models. The Trump administration set an August 1 deadline for the framework. The White House invited major AI frontier labs to read and test the framework on Tuesday. Officials don't plan to release it publicly. A new worm is spreading across the NPM ecosystem.

5:57The initial spread point has been traced back to the Kiwi and cacheable NPM packages, which are both managed by the same developer. The so-called Chain Drop Worm has already spread to more than 100 NPM libraries. It runs in the Bun runtime, harvests cloud and CI credentials, then spreads to other packages. Hackers have compromised the QuickFox VPN app to deploy a backdoor on its user systems. The malware has been active in the QuickFox app since August last year. The app is used by Chinese international students and expats to access gaming servers and websites inside China. According to Fortinet, open source evidence suggests the China-linked Twill Typhoon APT group may be behind the attack.

6:45OpenAI has banned chat GPT accounts used by a Cambodian scam centre. The centre used the technology to assist with romance, investment and law enforcement impersonation scams. The chat GPT accounts were also used to craft fake job ads to recruit Indian nationals and lure them to Cambodia. OpenAI says the scam compound operated near the city of Puypet. Chinese authorities have arrested a 31-year-old for SMS blasting in Hong Kong. The suspect allegedly drove around the city sending messages to phish WhatsApp users for device pairing codes. Once account access was gained, the hackers would demand money from the victim's friends and family.

7:28More than half of African cybercrime police cases in the last year involved the use of AI. According to Interpol, AI is now used in all stages of a cyber attack, from reconnaissance to malware development. The agency says there's been a dramatic increase in AI use from previous years, which shows a shift in criminal methodology. Security researchers have found malicious links within 1.7 % of AI summaries about major banks and retail brands. These included phishing pages and malware downloads. The test included summaries from ChatGPT, Copilot, Gemini and Perplexity. Perplexity returned the highest number of malicious links.

8:10Copilot had the fewest. Software maker Enable has patched an actively exploited zero day targeting its N-Central remote management product. Every N-Central version is impacted. Attacks were first spotted last Friday. This is the company's second set of patches to address the same issue after the first set didn't work. An AI vulnerability scanner has obtained CVE identifiers for 55 hallucinated bug reports. In most cases, the cited vulnerable code didn't exist, mentioned unrelated functions, or the POCs didn't work. One of the hallucinated bugs was an SQLite vulnerability with a severity of 10 out of 10.

8:52All the CVE identifiers have since been withdrawn. Microsoft is reducing the lifetime of new NuGet API keys from 365 to 30 days. The new change will enter into effect starting August 17. On November 1, Microsoft also intends to invalidate any NuGet API keys created before August 17. The shorter lifespan is meant to reduce the blast radius of supply chain attacks. And finally, Samsung will ban smart TV apps that join the company's televisions to residential proxy networks. Samsung becomes the second smart TV maker to ban apps with proxy functionality from their app stores. Research published in June found that more than a third of all LG and Samsung smart TVs were running apps that secretly shared their internet connection with proxy services.

9:47And that is all for this podcast edition. Today's show is brought to you by Permiso Security. Find them at permiso.io. Thanks to your company.

10:05you