Risky Bulletin: Russian hackers jump on the fake job interview train

0:03Russian state hackers adopt fake job interview tactics. A Portuguese man will face trial for developing a malicious AI chatbot. An AI assistant hacks an Australian gym. And OpenAI releases cyber models for blue teams. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 12th of August, and this podcast episode is brought to you by enterprise browser maker, Ireland. In today's top story, an elite Russian military hacking group is targeting Ukrainian system administrators and IT professionals with malware during fake job interviews. Ukraine's CERT says the campaign began in May.

0:46The attacks have been linked to Sandworm, a cyber unit inside Russia's GRU military intelligence agency. Using fake job interviews to deliver malware is also a popular tactic used by Iran and North Korea. A Delta Airlines flight from Las Vegas to Atlanta was forced to shut down its passenger Wi-Fi following a hack. The flight crew notified the pilot that a passenger was jamming the plane's Wi-Fi and was running their own network with the same name. In a message to ground staff, the pilot blamed the incident on passengers travelling home from the DEFCON security conference. A security breach at the French shipping and logistics company, Siva, is impacting freight delivery across Europe.

1:30Hackers gained access to Siva's systems last week and have been leaking its customer data on the dark web. Impacted companies include Valve's Steam Hardware Business and Dutch online retailers Bol and Debyeokorf. The affected companies are notifying customers about the breach and expected delivery delays. Polish authorities are investigating a breach of MyDoctor, a healthcare platform used by the country's hospitals. The platform stores data about almost 19 million Polish citizens. Hackers claim they exploited an XXE vulnerability to breach the app and steal customer files and source code. The data is now being sold online.

2:12Thailand is considering resetting all government staff passwords and adopting multi-factor authentication following a wave of hacks. At least 20 state agencies have reported breaches. Some stolen data has been leaked on hacker forums, including employee credentials. The UK Royal Navy has removed internet connectivity from cameras installed on its Kraken Marine drones. According to The Telegraph, the cameras were sending heartbeat connections to China, potentially revealing their locations. The drones were due to be used in several planned golf missions. An unnamed US federal agency hired a North Korean remote IT worker.

2:54The FBI discovered the worker in late July and is investigating the incident. It's unclear how the employee passed the background and identity checks required for government jobs. America's Federal Trade Commission wants to regulate AI models for ideological bias. A proposed policy change would give the agency regulatory oversight over the entire AI sector, superseding state laws. According to CyberScoop, the proposal has drawn criticism across the political spectrum. The US National Institute of Standards and Technology is seeking public feedback on how to use AI to manage the NVD program. The agency is looking to automate vulnerability triage and management tasks.

3:39The NVD program is suffering from a significant backlog due to the increase in AI-discovered bugs being reported to vendors. US lawmakers have introduced a bill that would allocate$300 million each year to help improve the cybersecurity of water and wastewater utilities. The Water Cyber Shield Act would also grant the US Environmental Protection Agency the power to establish standards and regulate cybersecurity within the sector. The EPA would be authorised to conduct cybersecurity assessments and demand corrective actions. OpenAI has expanded access to its frontier models for cybersecurity professionals.

4:20On Monday, the company split its Daybreak Early Access program into Red and Blue team streams. Daybreak Red will be available to pen testers who will have access to the company's new GPT 5.6 model. Daybreak Blue will provide access to models with custom guardrails designed to help secure networks. OpenAI created the tier system for defenders after its models escaped a sandbox and hacked AI platform Hugging Face. The same models later hindered the Hugging Face investigation into the hack because of their aggressive guardrails. An AI assistant hacked an Australian gym when its owner asked it to book a class.

5:00The agent exploited the website's unsecured API to boot a customer from the class roster and move its owner into the vacancy. The misbehaving agent was identified as a local open claw instance. A man is on trial in Portugal for developing a malicious AI assistant for cyber criminals. He is accused of developing a tool named WormGPT that he advertised on the dark web. It worked similarly to ChatGPT but had no safety guardrails. He allegedly made€25 ,000 from selling the tool to hackers. He was arrested last year following a tip from the FBI. Croatian authorities have detained a suspected Serbian state-sponsored hacker.

5:43The suspect, identified as 33-year-old businessman Georgiev V, is accused of breaching several Croatian state institutions and public agencies. Victims included the Croatian Interior Ministry, the Croatian Tax Administration and the country's auto, pension and health insurance databases. Croatian officials believe he worked for Serbia's National Intelligence Agency, BIA. A 20-year-old has been sentenced to two years in a UK prison for coercing more than 100 girls into performing sexual acts and harming themselves. Justin Swaddle was an active member of the ComOnline community and used the aliases Epstein, Moscow and Rugen.

6:27Swaddle approached young girls via social media and gained their trust. He then extorted them to carve his name on their bodies, physically harm themselves or perform sexual acts. His victims were aged between 13 and 17. And the fact that he's got just two years in prison for this is an absolute disgrace. The FBI has advised Americans against storing sexually explicit content in cloud, email or social media accounts. The agency says hackers are specifically looking for such content to extort victims. The Bureau says hackers don't care if victims are underage. The North Korean hacking group Lazarus is using a zero-day privilege escalation vulnerability to take full control over Windows systems.

7:15According to Checkpoint, the group has used the zero day in its fake job interview campaigns this year. The bug exploits the Windows ancillary function driver to obtain admin rights and install malware with privileged context. Microsoft patched the floor this week. Cisco has patched a zero-day vulnerability that was being used in the while to crash its ASA, FMC and FTD firewalls. The company says the attacks were detected earlier this month. Zoom has patched a bug that could have allowed malicious meeting attendees to run code on the devices of other meeting participants. The so-called Zoom's Day bug required no interaction from users and worked on all Zoom OS clients.

7:59The bug was discovered with an AI tool. Cloudflare has mitigated more than 930 DDoS attacks that exceeded 1 terabits per second so far this year. The company says terabit-sized attacks saw a five-fold increase since January. Media websites saw the most attacks. Microsoft will disable support for old manifest V2 Edge extensions by the end of the year. The company says 95 % of the extensions in the Edge add-on store have already migrated their code to the MV3 extensions API. And finally, Mozilla has rotated a GPG signing key after it was accidentally committed to a private GitHub repository. The key is used to sign Firefox and Thunderbird artifacts and ensure their authenticity.

8:47Mozilla says it found no evidence that the leaked key was abused. And that is all for this podcast edition. Today's show was brought to you by Island. Find them at island.io. Thanks for your company. Thank you.