Risky Bulletin: Team Cymru unmasks shady Chinese proxy network

0:03A network of 10 ,000 AI servers is masking malicious Chinese AI activity, Ukrainian hackers leak Russia's naval secrets, shiny hunters hacks the FBI, and the evil tokens phishing service is disrupted by tech companies. This is the Risky Bulletin, prepared by Katalin Kimpano and read by me, Claire Aird. Today is the 23rd of September, and this podcast episode is brought to you by SpecterOps. Security researchers have discovered a network of more than 10 ,000 proxy servers that are enabling Chinese distillation of American AI models and other illicit activities. Security firm Team Cymru analysed 100 of the servers and found they were being used to bypass region bans and carry out distillation attacks.

0:52Most of the servers ran open source AI gateway server software. Some of these open source projects are being sponsored by illicit service providers, including API relay resellers, residential proxy vendors and people who are selling compromised AI accounts. In other news, a Ukrainian hacking group has leaked technical documents about more than 70 Russian naval projects. The files were allegedly stolen from Russian scientific research centres and manufacturers. They include in-depth details on submarines, warships, navigation systems, sonar technology and autonomous underwater vehicles. A group calling itself Ukrainian Militant has taken credit for the leak.

1:37E-commerce platform BigCommerce has notified merchants of a security incident involving a third-party app named Ribbon. Hackers stole a Ribbon access key and used it to inject malicious scripts on stores hosted on the BigCommerce platform. The scripts were live for five days in September. Big Commerce revoked the key on September 17 and uninstalled ribbon from all stores. Attackers are believed to have collected customer details from all affected stores. The Shiny Hunters group claims to have stolen data about most FBI agents, as well as individuals who applied for jobs with the Bureau. The group also defaced the FBI job portal, which the agency took offline on Tuesday.

2:23Shani Hunters claims the Bureau's recent security alert on the group's tactics contained incorrect information. The group said it would release the stolen data if the agency didn't correct or take down the alert within a week. The US National Institute of Standards and Technology will award eight states more than$1.7 million in total to help address the shortage of qualified cybersecurity professionals. The money will go to educational and community organisations to establish cyber security training programs. It will also cover internships, apprenticeships and hands-on projects. Ireland's Data Protection Agency has fined Google€403 million for breaking GDPR data processing rules.

3:09The agency says Google manipulated users into sharing their location data through complicated account settings. It began investigating the company six years ago, following multiple complaints from data privacy organizations. A California court has ordered two software companies to stop mass-scraping LinkedIn profiles. LinkedIn sued ProAPIs, NetSwift and their CEOs last October. LinkedIn alleges the company used millions of accounts to harvest profile data and user activity. A coalition of tech companies has disrupted the Evil Tokens phishing platform. The service launched in February this year and quickly became popular due to its ability to carry out device code phishing as well as regular phishing campaigns.

3:55Microsoft says the service was used to hack at least 12 ,000 email accounts. Microsoft's legal team seized domains and servers while other companies tracked Evil Tokens profits and identified its operators and customers. UK police also arrested two of the service's suspected operators earlier this month. A Chinese-speaking threat actor is hacking a large assortment of web apps, servers and devices and deploying backdoors on them. The Red Heron Group has been linked to attacks on GT repositories, Ubiquiti devices, Zyxel switches, WordPress sites and AI servers. Security firm Grey Noise believes the attacker is focused on data theft and uses LLMs to assemble its attack tools.

4:43A Chinese-sponsored hacking group has breached shipping and maritime organisations in four EU member states and government agencies in three others. The hacks took place last year and involved compromised USB devices. The EU's cybersecurity agency described the Chinese activity in a report. The same report found Iranian hackers had also targeted the EU's transportation sector but had focused mainly on airlines. A Russian threat actor has been using an arsenal of exploits to spy on Ukraine's defence and aerospace sector. The campaign began in June last year and is ongoing. Security firm Sockradar discovered the operation after the threat actor misconfigured its command and control server and leaked more than 8 ,400 files.

5:32Most of the attacker's exploits target older vulnerabilities in enterprise and edge network software. Checkpoint has patched an actively exploited zero day in its security management server product. The server is used in large networks to manage Checkpoint products from a central location. The patch fixes a directory traversal vulnerability that allows unauthenticated attackers to upload and execute arbitrary scripts. The company also marked a separate vulnerability as exploited in the wild. That one impacts the checkpoint site-to-site VPN and was patched last week. Meanwhile, F5 has patched an actively exploited zero day in the Big IP Access Policy Manager component.

6:17The zero day allows an unauthenticated attacker to run malicious code on the Big IP server. Exploitation requires a specific big IP access policy and OAuth profile to be configured on the server. No details about the attacker have been released. Arista Networks has patched a Zero Day in its Bello Cloud Orchestrator on-prem server. The vulnerability allows remote attackers to access internal functions without authentication. Security researcher Nightmare Eclipse has released a new Windows Defender Zero Day. The so-called Big Disk Buster vulnerability is a denial-of-service bug that prevents Defender from performing platform and signature updates.

7:01The researcher published the exploit days after he also revealed his real name is Abdelhamid Nachari. Security researchers have found malware in two Terraform providers and two Go modules. This is the first known case of malware on the Terraform registry. The malware is a Go port of the Grafalgo NPM malware that was found in February. It uses a Slack channel as a command and control server and deploys a rat on selected workstations. Microsoft has added a new feature to its Windows recovery process. The new feature is named Cloud Rebuild. It can perform a full OS reinstall and can even be used when the OS isn't booting or the user can't use USB media.

7:48Apple has shipped a new security feature designed to detect active social engineering scams. Impersonation Risk Detection shipped in iOS 27. It allows users to share sensitive data with third-party apps so the apps can detect scams. Shared data can include download history, past purchases and email and phone call data. And finally, Cisco Talus has released a tool that detects malware that was built with or uses AI components. The Cognitive Artifact Intelligence Research Network, or CAN framework, works exclusively with VirusTotal metadata. It searches VirusTotal file uploads for specific artifacts left behind by AI toolkits.

8:33CAN is open source and available on GitHub. And that is all for this podcast edition. today's show was brought to you by our sponsor SpecterOps. Find them at specterops.io. Thanks for your company.