Risky Bulletin: Russia tells data centers to deploy drone defenses

0:03Russia tells data centres to deploy drone defences, Dropbox discloses a security breach, a new spyware wave hits Serbia, and CISA scraps six free cybersecurity assessment programs. This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 4th of September, and this podcast episode is brought to you by Dropzone AI. In today's top story, the Russian government has told data center operators to deploy defenses against drone strikes and other physical threats. Companies that don't comply risk having their data centre put under the state's administration. Last month, Russia's President Vladimir Putin signed a presidential decree allowing the state to take control of critical infrastructure if operators fail to protect it against Ukrainian hacks and drone strikes.

0:58There are more than 180 data centres in Russia. Over 80 % of them are in the country's European region, which is within the range of Ukrainian strikes. In other news, hackers stole data from almost 5 ,000 Dropbox accounts last month. The intruders gained access to the accounts by abusing Dropbox's integration with Lenovo's identification service. The hackers registered accounts on the Lenovo ID service with email addresses used for valid Dropbox accounts. Then they bypassed Lenovo's email verification process and, using the newly verified accounts, pivoted back to the equivalent Dropbox accounts.

1:39The FBI is investigating a dark web service that was selling scans of more than 153 million US and Canadian drivers' licenses. The Nexus service launched this week and was advertised on the Exploit Underground Hacking Forum, but it shut down hours after cyber security reporter Brian Krebs covered its launch. According to Krebs, the source of the stolen driver's license scans appears to be a New Orleans identity verification company, IDscan.net. At least 14 Serbians have been targeted with advanced spyware since January. Victims included at least one member of the Serbian parliament, a local government official and members of the Peaceful Student Pro-Democracy movement.

2:24Their devices were infected with either the Novi Spy or Pegasus Spyware families. They learned of the attacks when they received alerts from Apple in late August. Social media company X mitigated a password recovery attack this week that targeted hundreds of thousands of accounts. Engineers believe the attacker tried to breach accounts to then pivot to the company's X Money Digital Banking service. US Attorney General Todd Blanche said the DOJ is working with X to find the attackers. He said no accounts were compromised. Hackers compromised the Cloudflare infrastructure of a company named Coda to deliver malicious Terraform modules to its customers.

3:08The registries were live for 14 hours on August 31. Coda provides tools for developers to deploy secure cloud infrastructure for hosting AI applications. Hackers have stolen donor data from two organisations that raise money for Russian political prisoners and Ukrainians affected by the war. This week, Dvaitia and You Are Not Alone disclosed security breaches related to their payment systems. Hackers stole donor email addresses and limited credit card information. While run by Russians, both organisations operate from outside the country. They've linked the breach to the integration between payment processor Stripe and the WooCommerce WordPress plugin.

3:52Hackers have stolen the personal data of almost 40 million customers of South Korean video streaming service TVing. The company confirmed more than 70 types of personal data were stolen in June, including names, email addresses and phone numbers. TVing executives apologised for the incident in a public press conference. The company will compensate affected customers with about US$15 worth of streaming benefits per person. It also risks a fine from authorities for reporting the incident a day late. Bank IT provider Jack Henry has notified more than 7 ,200 customers of a recent security breach. Hackers used a voice phishing attack to gain access to the company's network and steal internal documents.

4:39The Shiny Hunters hacking group took credit for the attack, but Jack Henry says it won't pay a ransom. CISA has ended six free cybersecurity assessment programs for critical infrastructure operators. They include cyber resilience reviews, cyber resilience essentials surveys, ransomware readiness assessments, incident management reviews, external dependencies management assessments and cyber infrastructure surveys. The agency didn't explain why it's stopping the programs. The second Trump administration has laid off more than a third of CISA's staff since being sworn into office in 2025. An international law enforcement operation has disrupted the Salati peer-to-peer botnet.

5:25Authorities and security firms from the US and Europe have seized servers and domains and are now sinkholing traffic from infected devices. Salty was one of the oldest known botnets, having launched in 2003. It was primarily being used to steal cryptocurrency from infected devices, then rent out access to infected hosts to cybercrime groups. The US Justice Department has charged a Russian national in relation to a phishing campaign that targeted freelancers with malware. Sijudin Temerlanovich Act2Live was extradited to the US last month after being arrested in Cyprus last year. In 2016 and 2017, he used hundreds of fake accounts to send private messages to more than 80 ,000 users of a US freelancing platform.

6:16The messages contained malicious Excel files that deployed the TV spy and dark VNC malware on JobSeeker's devices. A Chinese cybercrime group is hacking Brazilian government and educational websites, hijacking visitor traffic and manipulating search engine results. The group hacks sites underlying Linux servers and deploys backdoors and malicious Apache modules. The hacked sites host ads for online gambling and sports betting and some incoming visitors are redirected to phishing pages. Checkpoint tracks the attackers as Gambling Goblin, a group that has previously used the same tactics across Southeast Asia.

6:57The US State Department is offering a$10 million reward for information about a top official in Iran's military cyber force. Amir Yaryab is the leader of Cyber Operations Command inside the Iran Islamic Revolutionary Guard Corp Cyber Electronic Command, also known as IRGC-CEC. He directs the activity of multiple Iranian hacking groups such as the Cyber Avengers, Shahid Hamad and Dada Afzir Aman. The groups have attacked US critical infrastructure operators since the US-Israeli strikes began in February. SonicWall has patched two actively exploited zero days in SMA-1000 mobile access gateways. The zero days allow attackers to bypass authentication and run malicious commands on the devices.

7:48There's no information on the recent attacks, but SMA-1000 gateways have regularly been targeted by state and e-crime actors in the last five years. Security researcher Nightmare Eclipse has released a zero-day in the CrowdStrike Falcon EDR. Named Falcon Flank, the vulnerability allows attackers to gain admin access over a Windows system. The same researcher recently released similar zero days for other security software such as Microsoft Defender, the Avast antivirus and the Kaspersky EDR. A Department of Defence government contractor has agreed to pay a$2 million fine for non-compliance with cybersecurity requirements related to aerospace contracts.

8:33Honeywell Aerospace admitted it did not comply with NIST standards. More than$375 ,000 off the fine will be paid to a former Honeywell employee who exposed the non-compliance. Microsoft will enable the Memory Integrity Security feature on more Windows devices from next month. The feature uses isolated virtual environments to run code that accesses the Windows kernel. Any malicious code is caught in the environment and doesn't interact with the kernel, but Microsoft has warned that the feature impacts performance. Tests have shown it can result in a drop of up to 20 % in gaming performance. All new Windows 11 installations ship with the feature enabled.

9:18And finally, OpenAI says it will soon release its newest GPT model, Astra. The company claims Astra can find and chain zero-day vulnerabilities together to execute end-to-end cyber attacks. The model is being rolled out now to select customers and will be enabled for plus and pro subscribers in guardrailed form in coming days. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Dropzone AI. Find them at dropzone.ai. Thanks to your company.

10:02you