Risky Bulletin: Moldovan public services crippled by cyberattack

0:04Moldova takes down more than 80 public services after a cyber attack. The White House launches a new cyber security pilot program. South Korea arrests an AI-assisted cyber crime ring. And the Electrum wallet patches a crypto-stealing bug. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 28th of October, and this podcast episode is brought to you by Nebulok. In today's top story, the Moldovan government temporarily shut down 82 online services after a cyber attack targeted government networks. The incident took place last week, with hackers stealing the data of 750 ,000 citizens, roughly one-third of the country's total population.

0:51The stolen data includes names, national ID numbers, family details, pension and social security information, driver's licence details, photos and even banking data. After being evicted, the attackers tried to breach the same systems again on both Sunday and Tuesday. The country's digital agency began restoring services this week. The University of New Mexico health system was forced to redirect ambulances to nearby hospitals this week after a cyber attack crippled crucial internal systems. The healthcare provider also cancelled patient appointments at more than 30 clinics on Monday. Scheduled doctor appointments and emergency care resumed the following day.

1:35A similar cyber attack also impacted university hospitals in Ohio. In related news, the White House has launched a cybersecurity pilot program that will provide free cybersecurity tools to rural hospitals. Partner companies include Cisco, Sierra, Microsoft, Trellix and Zscaler. The White House launched a similar pilot program last month, with that one targeting water utilities in Texas. South Korean police have arrested seven people suspected of using AI tools to hack more than 60 companies. The suspects' alleged victims include hospitals, universities and private businesses. The group stole data on more than 8.2 million individuals and attempted to extort some organisations.

2:22The group was led by a 32-year-old. A Ukrainian national has been sentenced to almost six years in a US prison over his role in Hive and Nephilim ransomware attacks. Artum Stryzhuk served as an affiliate to both ransomware operations. He was arrested in Spain in 2024 and extradited to the US last year. Web hosting provider DreamHost has reset customer passwords following a security incident. The company sent password change notifications to all affected customers last week. Accounts will be blocked until new passwords are set. Hackers breached cloud platform Warp on Friday. The company's founder, Zach Lloyd, says the intruders used a swarm of AI agents to breach one of its infrastructure suppliers.

3:13The hackers stole agent trace and telemetry data from roughly 1 % of customers. Hackers have breached the eSignFlow document signing platform. The platform is operated by Vandenbruele, a major software supplier to the Belgian government. The company took down eSignFlow systems on Friday in response to the hack. The Electrum cryptocurrency wallet has patched a bug that allowed malicious servers to trick wallet owners into signing fraudulent transactions. Electrum says several wallet servers are exploiting the bug in the wild. At least one user has lost cryptocurrency to the vulnerability. Cryptocurrency hardware wallet maker Keystone will destroy almost 19 ,000 devices after a hacker stole its WebAuth device authentication key.

4:03The company has suspended all wallet deliveries until devices with a new key are ready to ship. The authentication key is baked into the device when it's manufactured and can't be changed. It's used to verify that a device is authentic. Keystone says the key can be used to create counterfeit devices with backdoors. Hackers have breached Blastmail, an email service provided by Japanese cloud provider Laxlight. The company shut down the service shortly after it detected the attack on October 21. The service is still down as of the time of recording. Israeli advertising company Discover Tech was the primary source of malicious adverts shown to Starlink users in a large-scale espionage campaign.

4:49According to a recent Citizen Lab report, the advertisements were used to deliver zero-click spyware. A new trend micro report has also found that Discover Tech was the top bidder for ad space for Starlink users across more than 100 countries. Its ads even showed up in countries where Starlink is banned or restricted. A Brazilian hacking group has breached e-commerce platform Converter and deployed a credit card skimmer via its analytics script. The hackers appear to have breached the company via the plausible open-source analytics platform. The group responsible for the attack is a known threat actor that's been active since 2024.

5:29It specialises in mage card-style attacks. A threat actor is stealing secrets and tokens from GitHub repositories. According to Wiz, the campaign began in mid-September. The attacker is using already compromised GitHub tokens to access accounts and send commands to all repos to print their secrets in workflow logs. The attacker then collects the logs before deleting them. Wiz has found more than 850 compromised accounts and more than 13 ,000 affected repositories. Security firm Diffused says threat actors are testing exploits for a recently patched vulnerability in the Oracle eBusiness suite. The vulnerability is an unauthenticated SQL injection that can run malicious code on the platform.

6:15It was discovered by security firm Horizon 3 and patched last week. Sony has awarded a$50 ,000 bug bounty for a vulnerability that could have allowed users to run Linux on PlayStation 5 gaming consoles. The bug was found with AI and reported via HackerOne. OpenAI has disabled internet access for its AI testing environments to prevent agents hacking real-world targets. The company has also resumed model training after pausing it this month to focus on securing its models. OpenAI joins Anthropic, which also cut internet access to its AI cyber tests in early October. And finally, Microsoft has offered voluntary buyouts to more than 60 ,000 employees, or around 25 % of its staff.

7:05The offer is only valid for long-tenure employees in the US, Canada, India and the UK. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Nebulok. Find them at nebulok.io. Thanks for your company.

7:32it's eran