Risky Bulletin: Russia starts blocking DoH and DoT

0:03Russia begins blocking the DOH and DOT protocols. Russian hacktivists leak Spanish police and military personnel data. China and South Korea detain a vishing gang. And AI malware is not that common. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 26th of August, and this podcast episode is brought to you by Push Security. In today's top story, Russia's internet watchdog has started blocking DNS over HTTPS and DNS over TLS. DOH and DOT are both private versions of the DNS protocol that hire a user's traffic destination from ISPs. They've helped Russian citizens bypass the Kremlin's internet censorship to access Western websites.

0:55The Roscom Nadzor has not confirmed an official ban, despite blocks being reported across several regions. In other news, a pro-Kremlin hacktivist group has leaked the names of almost 1 ,000 Spanish military and police members. The group, No Name 057, leaked the data on Telegram, citing Spain's support for Ukraine as the reason. Authorities believe the data was compiled and released by former Spanish university professor Enrique Arias Gil. He joined the group to help spread its content to Spanish-speaking audiences. Gil fled to Russia after Spanish authorities issued an arrest warrant for him last year.

1:35He's since applied for Russian citizenship. Canada's Autism Services of Saskatoon has told more than 2 ,000 people that their data was stolen in a ransomware attack last year. The data includes names, addresses, social insurance numbers, medical information and credit card details. The agency restored its service one day after the attack and says there's no evidence the data has leaked on the dark web. American healthcare provider Newtex Health says hackers stole confidential and sensitive data from its internal network. The company disclosed the breach to the SEC but didn't provide further details.

2:14New Tex operates 27 medical facilities across 12 US states. Security firm ReliaQuest has denied being hacked by Shiny Hunters after the group listed the company on its leak site. ReliaQuest says the group phished one employee and accessed an Okta backend in view-only mode. It said the hackers repeatedly tried to access apps in the backend but were unsuccessful. The US Treasury Department has imposed new sanctions on Iranian hackers as part of its so-called economic D-Day against Tehran. The new sanctions were imposed on individuals working for the Tehran-based Mabna Institute, a cyber contractor for the Iranian government.

2:57They come a week after the Justice Department unsealed an indictment that charged separate individuals involved with Mabna. The US Navy has instructed sailors, reserves and civilian staff to remove any mentions of their military ties from social media. The security alert also applies to family members. The Navy fears social media accounts could be used to track military movements. The information could also be used to find and attack Navy personnel or their families. China's Ministry of State Security has instructed state agencies to accelerate their migration from Windows 10 to a Chinese-maintained Linux distribution.

3:37State agencies are currently running a version of Windows 10 customised by Chinese company C &M Information Technologies. Windows 10 reached end of life in October of last year and C &M was planning to retire it by February 2027. The MSS now wants that migration completed this year. The Chinese government is phasing out US technologies due to national security risks. Chinese and South Korean police forces have broken up a China-based voice phishing group. The group is accused of stealing more than$7.2 million from elderly South Koreans by impersonating police officers and credit card delivery drivers.

4:18Police arrested 10 suspects, six are South Korean nationals and four Chinese. A Venezuelan man has been sentenced to eight years in a US prison over his role in an ATM jackpotting scheme. Juan Manuel Yovea Aguilera worked with multiple accomplices to deploy the Plautus malware on American ATMs. The group stole more than$3.5 million. The sentence is the longest ever handed down for ATM jackpotting-related crimes in the US. An Interpol-led operation has dismantled multiple West African criminal networks involved in cyber scams, BEC and violent crimes. Police forces in 22 countries detained 58 individuals and identified 263 further suspects.

5:07Some of those identified were linked to Black Axe, a notorious Nigerian criminal syndicate. A Nigerian investment scam operation has defrauded more than 5 ,000 investors out of almost$74 million. The group is behind more than 300 fake investment portals. Norwegian journalists say the site shares source code and are hosted by Nigerian web hosting company iSky Softdick. NRK reported the company's CEO online nickname was found on some of the scam portals, suggesting he may be involved. The majority of AI-enabled malware is still experimental, according to research from Palo Alto Networks. The security company studied more than 405 malware samples that integrate AI in some capacity.

5:56Just 12 were detected in real-world infections. The rest were found in security testing sandboxes and VirusTotal, suggesting they were tests or research. A supply chain attack has happened every three days so far this year, according to a report from DevSecOps firm Step Security. Of the 56 supply chain attacks that have occurred in the past 12 months, only six of them happened last year. Most were powered by self-replicating worms. iPhone thieves are renting access to a phishing kit that collects authorisation codes from Apple users whose iPhones have been stolen. The codes are used to disable Apple's activation lock feature and wipe the devices so they can be resold.

6:42The anonymous kit has been active since 2024 and has been linked to more than 500 malicious phishing domains. According to SockRadar, the kit uses AI voice agents to automate calls to iPhone owners, impersonating Apple support. Hackers are exploiting an Oracle WebLogic vulnerability to gain access to corporate environments. The attacks are targeting a WebLogic bug that was patched in January. The vulnerability allows attackers to modify or steal critical data from WebLogic servers. The WordPress security team has force-pushed a security update for the third-party pods plugin. The emergency update fixes a bug that allows remote attackers to gain admin rights over WordPress sites.

7:27The pods plugin is installed on more than 100 ,000 sites. The WordPress forced update system is only used to mitigate serious vulnerabilities. Chinese online retailer AliExpress is using inaudible sounds to fingerprint site visitors. Security researcher Matthew Callaghan spotted the silent behaviour after his Bluetooth headphones stopped working when visiting the site. Callaghan says the technique is one of several fingerprinting methods the retailer uses. And finally, Israeli cybersecurity start-up Minimus has shuttered operations and is returning its remaining funds to investors. The company raised$51 million but failed to gain enough customers to be sustainable.

8:11The company provided security-hardened container images. Customers will have 60 days to move to a new platform. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them at pushsecurity.com. Thanks to your company.

8:36you