Risky Bulletin: Slovakia finds Russian backdoors on its speed cameras

0:19This is the Risky Bulletin, prepared by Catalan. Kim Panu and read by me, Claire Aird. Today is the 19th of August and this podcast episode is brought to you by Socket. In today's top story, traffic speed cameras recently installed across Slovakia contain a backdoor link to a Russian company. According to Slovakia's security service, the backdoor executes malicious code received via SMS from specific Russian phone numbers. The agency has advised the government to remove all Niro R1 speed cameras. The cameras are allegedly a rebrand of a Russian traffic camera model, Cordon Pro-M. According to Slovak Media, the Interior Ministry bought more than 270 of the cameras from a Cyprus shell company that was using fake certifications.

1:09In other news, a scammer posed as White House Chief of Staff Susie Wiles, and attempted to scam UK Prime Minister Andy Burnham. Burnham detected the scam himself and the UK embassy notified the White House. Multiple US senators, governors and executives were targeted by scammers, posing as Wiles last year. At the time, the White House said a hacker obtained a copy of her cell phone contacts. A cyber attack has disrupted two Berlin city government departments. The attack took down emails, gateways and internet connections across the transport and urban development departments. The two agencies have been disconnected from the city network to prevent the incident spreading.

1:52A cyber attack has disrupted the Ukrainian agency that manages seized Russian assets. The attack occurred this week as the agency was preparing to assign a new manager to seized beverage company IDS Ukraine. Ukraine seized IDS from Alphabank co-founder Mikhail Fridman shortly after Russia's invasion. French law enforcement used a public exploit hosted on GitHub in 2020 to hack encrypted phone network EncroChat. The exploit targeted the bad binder Android vulnerability and had been shared online a few months earlier. EncroChat discovered the hacks after French police deployed a second exploit that failed.

2:34Genetics testing company Baylor Genetics is notifying users of a breach that exposed their personal details. The breach occurred in June. Both patient and employee data was compromised. The company has not disclosed how many people were affected. An ongoing ransomware attack against Winnipeg's largest hospital has disabled its access card system and air conditioning. The Winnipeg Health Sciences Centre increased on-site security while the access card system is still down. The hospital says patient care and clinical operations are not impacted. An Iranian hacktivist group hit Blue Sky and GitHub with DDoS attacks this week.

3:13The attacks on Sunday and Monday caused prolonged outages at both companies. A group known as the 313 team has taken credit for the attacks. The same group was behind a separate wave of DDoS attacks in April. Hackers have stolen the personal information of 40 ,000 customers of hardware crypto wallet provider SafePal. The incident impacted all customers who ordered SafePal wallets between March 2, 2025 and April 11 this year. SafePal says no seed phrases or private keys were impacted. The stolen data could enable wrench attacks on wallet holders. A threat actor is claiming to have stolen employee data from almost a dozen Fortune 500 companies and is offering it for sale.

3:59The hacker, who goes by the name The Hat Man, said they used stolen credentials to steal the data from Azure environments. They claim to have breached McDonald's, Vodafone, Gap and the Intercontinental and Wyndham hotel chains. Malaysian authorities have arrested a 65-year-old man suspected of SMS blasting. The suspect was arrested near the border crossing between Johor Bahru and Singapore. He's the second person arrested in Johor Bahru this month for SMS blasting. Swiss prosecutors are seeking a 12-year prison sentence for a Ukrainian man linked to ransomware attacks on local companies. Officials claim the suspect was a developer who worked for the Locker Goga, Megacortex and Nephilim ransomware groups.

4:44He's pleaded not guilty. He says he was working as a consultant for a cyber security firm when he was detained and the ransomware source code was found on his devices. A scammer is posing as a data recovery firm to shake down ransomware victims. Using the name Ransom Busters Limited, The group contacts companies and offers to delete their data from ransomware gang servers for a fee of$20 ,000 to$60 ,000. GuidePoint Security believes the operators of the group signed up as an affiliate on ransomware-as-a-service platforms so it could see which companies have been hacked and then target them with the scam.

5:23A threat actor has hacked more than 14 ,500 Dahua security cameras across Ukraine and Russia. Researchers at Hunt Intelligence discovered the botnet after finding an open directory belonging to the hacker. The hacker exploited old vulnerabilities as well as hard-coded accounts in some of the devices. Iranian state hackers have intensified spear phishing attacks against Israeli journalists. The country's intelligence and cybersecurity agencies issued a security alert warning about the attacks last week. The agencies say hackers are seeking to obtain information from journalists reporting on political and national security.

6:04The US has unsealed a superseding indictment against 17 Iranian hackers. The suspects are employees of the Mabna Institute, a cyber contractor for Iran's Islamic Revolutionary Guard Corps. The Justice Department claims Mabna hackers breached universities globally, stole research and sent it to Iranian counterparts. The charges replace the 2018 indictment and expands the number of suspects from 9 to 17. The State Department has also offered a$10 million reward for information that may lead to the arrest of any of the suspects. The Mabner Institute hacking campaigns are tracked by security firms under the codename of Cobalt Dickens.

6:47And finally, Microsoft delayed a major update for Exchange Subscription Edition servers due to an influx of AI-discovered vulnerabilities. The update was supposed to go live in late June. Microsoft says it didn't want to release its biannual feature update, only to release multiple batches of security fixes immediately afterwards. The company plans to wait to fix all security bugs before releasing this year's first cumulative update for Exchange SE. Microsoft says employees discovered the security flaws as part of an internal push to use AI tools for bug discovery. And that is all for this podcast edition.

7:26Today's show was brought to you by our sponsor, Socket. Find them at socket.dev. Thanks for your company.