Risky Bulletin: Supply chain attack lets ransomware group inside 40 shipping companies

0:03A ransomware group used a supply chain compromise to hack around 40 shipping companies. The Pentagon assembles a technology sabotage unit, PHP to shell exploitation gets underway, and GoDaddy revokes 400 ,000 certs. This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 23rd of October, and this podcast episode is brought to you by Sondera. In today's top story, a new ransomware and data extortion group has breached around 40 maritime and global shipping companies. According to security firm Sidome, the so-called non-group breached a shared IT service provider and then pivoted to customer networks.

0:52Sidome researchers believe the breached provider is South Korean company CyberLogitech. According to the listings on its leak site, Non is demanding more than$1.2 billion in ransoms from the hacked companies. In other news, the PHP Foundation released security updates for two major vulnerabilities on Wednesday. The Foundation released the patches a day earlier than it had planned, after a security vendor published details about them online. According to the PHP Foundation, one of the so-called PHP 2 shell bugs was discovered in 2024 but was deemed unexploitable at the time. The vulnerabilities impact all PHP versions released since March 2012.

1:39Cybersecurity agencies from multiple countries warned of the threat of immediate exploitation and advised companies to take PHP servers offline until they applied patches. As predicted, active exploitation began hours after the official patch was released. According to AWS, some attacks took place prior to public disclosure. GitLab has patched a major vulnerability that can allow hackers to take over self-hosted servers. The vulnerability is a pre-authentication remote code execution with a perfect CVSS severity score of 10 out of 10. It impacts all GitLab versions since version 7.0, released in 2014.

2:25The Pentagon has quietly created a new unit tasked with sabotaging foreign military technology programs. The Technology Support Office was established in April. According to Politico, the TSO could carry out supply chain disruptions, launch cyber attacks and disinformation operations, and trick adversaries into installing faulty components. Hackers have compromised the Lite LLM project and added malware to its Docker and PyPI releases. An info stealer was added to Lite LLM version 1.107.0, which was released on Wednesday. The stealer searches for and steals cloud credentials, developer secrets and AI provider keys.

3:09This is the project's second security incident this year. It was also hit in the Trivi supply chain attack that took place in March. Hackers have breached cloud provider Railway.com and stolen encrypted environment variables from customer accounts. Railway says it's likely that the attackers decrypted some of the variables to obtain access to API keys and other credentials. It believes the incident is part of a larger wave of attacks against AI providers. Railway notified the relevant AI companies so they could revoke customers' compromised API keys. The Fulcrum Sec Hacking Group has breached the TIE DB cloud service.

3:51The group claims to have gained access to back-end systems, CRM data, Jira tickets, source code and service analytics. According to TIE DB developer Pingcap, hackers had access to its systems between September 9 and October 7. A hacker breached Japanese VPS provider Onome and installed malware on more than 26 ,000 desktop servers. The incident took place on Tuesday and the provider shut down all affected servers within a day. Onome says the hackers sought to steal credentials for trading and securities tools. Staying in the region and hackers have also breached Japanese securities company IYE Cosmo and made unauthorized transactions.

4:38The attackers breached the company's internet trading system, TradeWorks, accessed the data of nearly 5 ,000 traders and placed purchase orders on at least seven accounts. IYE Cosmo described the orders as unintentional, suggesting the hackers were likely testing their access. The EU has launched an investigation into travel service Booking.com over its failure to address fraudulent listings and phishing scams. The investigation comes after a wave of reports from Booking.com customers. The company has failed to address years of customer complaints about reservations at non-existent properties, misleading accommodation details and impersonation scams.

5:21The EU says Booking.com has also failed to secure user data, which is often stolen from accommodation providers and used to fish travellers or solicit fraudulent payments. Booking.com phishing campaigns have exploded this year, especially across Western Europe. An Interpol operation has detained more than 1 ,400 suspects across 21 countries on cybercrime-related charges. The suspects were allegedly involved with online scams, BEC and ransomware attacks. Authorities dismantled scam call centres, seized server infrastructure and recovered$105 million in stolen assets. The arrests were part of Operation Serengeti 3.

6:07Microsoft says that a Chinese state-aligned group is responsible for the ConnectWise cloud backup hack last week. The hack was part of a larger AI-automated hacking spree that hit hundreds of targets around the globe. Microsoft tracks the group as Storm 0940. The group's main weapon is the Artex AI agent. The same agent was also used in recent months to breach Japanese and South Korean organizations. A Russian military cyber unit has wiped the internal systems of a Ukrainian grain export company. The attack made use of a novel backdoor that stores its command and control server inside Yggdrasil, an IPv6 mesh network.

6:49The grain company was initially hacked by a group tracked as UAC 0099, which later handed off access to the more experienced Sandworm Group. Arista Networks has released a patch to fix a new zero-day in on-premise VeloCloud orchestrator servers. The zero-day allows remote attackers to access internal functions without authentication. This is the third VeloCloud zero-day to be patched this year. Dutch security firm iSecurity has unilaterally uninstalled the Popcorn Time piracy app for more than 2 million Windows and Mac OS PCs. Popcorn Time is an abandoned project and the software contains dangerous vulnerabilities.

7:35iSecurity registered an expired Popcorn Time domain and pushed an update that removed the app from systems. i did it with no law enforcement oversight and the update package was later marked as malicious by some security apps. The developer behind the Steel Sea Info Stealer has returned to the cybercrime underground with a new remote access trojan after Europol seized their infrastructure in June. The new Stadia malware is a fully-fledged remote access trojan built on top of the Steel Sea Info Stealer. Steel Sea joins a long list of malware that's made a comeback after law enforcement takedowns.

8:17Cybersecurity company Blackfog has discovered a remote access Trojan that ships with a built-in browser. Named DarkCore, the Trojan's browser allows attackers to access hacked accounts using stolen sessions and make it appear as coming from the real owner's IP address. This is done via a hidden socks tunnel to the infected host. A judge in New Mexico has fined social media company Meta$25 billion for breaking the state's consumer protection laws. The fine relates to the 2016 Cambridge Analytica scandal. A jury trial found that Meta failed to investigate the incident and misled New Mexicans about how it collects and protects user data.

8:59Meta says it will appeal. Indian Certificate Authority eMudra is getting out of the SSL certificate business. The company's decision comes after Apple, Google and Mozilla all nuked its root certificate this week. Browser makers untrusted its root after it used weak private keys to generate eight intermediary certificates. The weak cert keys were live for 18 months before they were discovered. Web hosting giant GoDaddy has revoked more than 400 ,000 certificates due to documentation errors. The revocation process started last week and finished on Wednesday. The vast majority of the certificates were issued by GoDaddy subsidiary Starfield Technologies.

9:45And finally, Google Chrome has begun showing alerts to all users who try to connect to websites via insecure HTTP connections. The warning rolled out to all users this week and is enabled by default. The rollout bookends Google's decade-long effort to transition Chrome users to HTTPS. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Sondera. Find them at sondera.ai. Thanks for your company.

10:25Thank you.