Risky Bulletin: Pro-Kremlin hacktivists dox EU politicians, law enforcement

0:03Pro-Kremlin hacktivists, dox EU politicians and law enforcement personnel, a deepfake gang arrested on US charges, Sonic wall patches a zero day, and SSHoll is being exploited in the wild. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 9th of November and this podcast episode is brought to you by Airlock Digital. In today's top story, a pro-Kremlin hacktivist group has published the personal information of 18 high-profile European politicians and law enforcement officials. They include Italy's Foreign Minister, the President of the EU's Agency for Criminal Justice Corporation, leaders of Germany's Federal Criminal Police, the BKA, and the director of Europol's European Cybercrime Centre.

0:55Three German journalists who investigated Russian hackers and influence operations were also doxed. The no-name 057 group published the information on the dark web on Friday. Earlier this year, the group offered cryptocurrency rewards for personal data of anti-Russia politicians. In other news, cloud platform WorkOS has blamed a recent security breach on a runaway AI agent that escaped a security researcher's test environment. The unnamed researcher contacted WorkOS after the company disclosed the incident last week. The researcher's Artex AI agent collected data from an internal WorkOS system used by the company's sales team.

1:38WorkOS says the researcher deleted the data. South Korean cryptocurrency exchange GOPACS has temporarily suspended operations after being threatened by hackers. The company received an email threatening to hack the platform on Friday. GOPACS moved customer assets to offline storage and is manually processing withdrawals, with users needing to email support to withdraw their assets. Hackers have stolen the information of NossusPay cryptocurrency Visa card holders. The incident took place last week and impacted a network used for Nossus-branded visa cards. The company says white-label cards issued on behalf of other companies are not affected.

2:22Nossus didn't specify what data was stolen. The company has enabled 3D secure verifications for all Nossus visa card holders until December 20 when the company's consumer card network is scheduled to be retired. Hackers have stolen patient data from Singaporean telehealth provider Dr Anywhere. The stolen data includes full names, email addresses, identification and passport numbers, dates of birth, emergency contact details and bank account information. The company didn't share technical details about the attack. A new ransomware and data extortion group named White Armour claims to have breached Danish logistics giant Maersk.

3:06The group says it stole 10 gigabytes from the company's systems, including driver records and delivery receipts. The group is demanding$5 million in Bitcoin. Maersk has not acknowledged the incident. The White Armour Group began operating three weeks ago. Maersk is one of 14 victims listed on its leaked site. The U.S. Department of Justice has launched a new task force to combat AI-related crimes. The Superintelligence Task Force will focus on individuals, cybercrime groups and foreign state actors that use American AI technology to commit crimes. The task force will be led by Associate Attorney General Stanley Woodward and Associate Deputy Attorney General Stephen Weiss.

3:50Russia's internet watchdog has added Apple and Microsoft to the state's surveillance registry. Companies listed in the registry have a legal obligation to store user activity logs for three years and provide data to Russian authorities on request. Companies that refuse can have their services blocked in Russia. Ukrainian police have arrested four people accused of stealing€4.3 million through cryptocurrency investment scams. The group operated scam call centres that targeted Europeans. Group members posed as brokers and financial advisors and directed victims to fake investment platforms. The US has charged three men with defrauding companies out of$129 million.

4:35The group used AI deepfakes to impersonate corporate executives and lawyers to hijack business payments. Victims included hospitals, banks, financial firms and a pet food company. Two suspects were arrested in Spain and a third man was detained in the UK. All three are pending extradition to the US. The US Treasury Department has banned Mexican cryptocurrency exchange MEXC from the US financial system. The Treasury says MEXC helped Iran, North Korea and Russia to move more than$16 billion in violation of sanctions. The order was issued on Friday and prevents U.S. financial firms from processing fund transfers involving MexC.

5:19MexC says it's launched a review of its anti-money laundering and sanctions controls. A former FBI agent has pleaded guilty to stealing cryptocurrency from wallets controlled by foreign state actors. Patrick Stephen Yarok stole almost$2.5 million across 100 transactions while employed in the FBI's Counterintelligence and Espionage Division. Before his arrest earlier this year, Yarok asked ChatGPT how to optimise his profits and acted on the chatbot's advice to move to Portugal and buy a vineyard. Claude code users have leaked more than 2 ,500 credentials and secrets onto GitHub, according to research from Apiro.

6:02The credentials were found in Clawed local settings files that users accidentally uploaded to public GitHub repos. Clawed code uses the file to store credentials the user has approved the agent to remember for future tasks. A cybercrime group is hacking refrigerator control panels to send spam emails. Attacks have targeted Copeland XWeb Pro controllers. Copeland devices are among those that were hacked to defrost freezers at European supermarkets in recent weeks. SonicWall has released security updates to patch seven vulnerabilities in its SSL VPN product. The company says that one of the bugs has been exploited in the wild.

6:45The vulnerability can allow attackers to bypass SAML authentication controls and MFA using credentials for different authentication methods. Threat actors began exploiting the SSH hole vulnerability less than 24 hours after it was publicly disclosed. The vulnerability allows attackers to bypass authentication on some open SSH servers using any password as long as it exceeds 256 characters. According to security firms Providian and Watchtower, Crypto Miners and IoT Botnets are behind the attacks. Network equipment maker D-Link has notified customers of upcoming security updates for its gigabit switches.

7:29Vulnerabilities in the D-Link discovery protocol can bypass authentication and compromise the devices. The company's urged customers to disable the protocol and restrict access to the switch's management interfaces until the patches are available. Microsoft has re-released a security update to fix a remote code execution vulnerability in the MS Paint app. The company meant to ship the patch with October's Patch Tuesday updates. System administrators reported that despite being included in the update manifest, their systems never received the actual patch. And finally, gaming studio 2K is recalling Civilization 7 game cartridges after the discovery of a vulnerability that could allow modders to hack Nintendo Switch to handheld consoles.

8:19The vulnerability can be triggered via in-game chat and allows Switch modders to run code on the console via a USB-connected device. A public exploit is also available on GitHub. hub. And that is all for this podcast edition. Today's show was brought to you by Airlock Digital. Find them at airlockdigital.com. Thanks for your company.