Risky Bulletin: Two law firms pay giant ransoms

0:03Two American law firms pay multi-million dollar ransoms, a Metabase Zero Day is being used in data theft attacks. Russian hackers disrupted a second power plant in Poland. And there's a remote code execution bug in WordPress again. This is the Risky Bulletin, prepared by Katalin Kimparnu and read by me, Claire Aird. Today is the 10th of August, and this podcast episode is brought to you by enterprise browser maker, Ireland. In today's top story, two of America's largest law firms paid multi-million dollar ransoms to hackers this year. Wilma Hale paid at least$18 million and Goodwin Proctor$10 million.

0:44Both ransoms were paid to Lunar Moth, a group that targets law firms with voice phishing and social engineering. The group is also known as the Silent Ransom Group. In other news, the US Senate has confirmed Adam Cassidy as the next cyber ambassador. Cassidy's nomination passed with a 51 to 47 vote last week. Cassidy will serve under Marco Rubio at the US State Department, where he'll lead the Bureau of Cyberspace and Digital Policy. The Californian city, Sassoon, has declared a state of emergency after a cyber attack shut down emergency services. The incident impacted phone routing to police and fire dispatch.

1:25The city is currently rerouting its emergency calls through the county's 911 system. The Oklahoma city of Caweta has decided not to pay a ransom after its systems were encrypted in an attack last week. The attack impacted all of the city's computers except its website and online billing system. Caweta officials say they won't disconnect residents for not paying their water bills while they recover from the attack. Hackers have created admin accounts and backdoors on WordPress sites after a supply chain attack targeted a popular plugin developer. The attack hit BDThemes, whose plugins are installed on hundreds of thousands of sites.

2:06The hackers did not modify plugin code, but compromised an API that was shared across plugins. Promotional banners served by the API system were modified to backdoor all sites when admins logged in. The New Zealand government has imposed new sanctions on Russian hacktivists and disinformation operations. The list includes members of the Radit and Cyber Army of Russia Reborn over their links to the Russian military. The sanctions also cover entities and individuals involved in Russian online disinformation operations. Also sanctioned was the director of MediaLand, a cloud service provider known for hosting Russian hacking operations and fake news portals.

2:48Two executives at a data recovery firm have been sentenced in South Korea to three years in prison for working with a ransomware group. The operation allegedly made profits in excess of$18 million. The ransomware group would hack enterprises, encrypt their files, then add a unique file extension. The security firm would advertise data recovery services for those specific extensions, but decrypt victims' files using tools provided by the ransomware gang. The scheme ran from 2018 until 2022. Most of the funds went to the ransomware group. Poland has confirmed that a Russian cyber attack on a power plant in December 2025 also targeted another plant.

3:31The hackers disrupted programmable logic controllers that controlled the plant's steam turbine and water treatment system. On-site staff restored the system before it could disrupt heating or electricity supply to customers. An investigation found the hackers entered through a Fortigate device at a wind farm, hacked a router and pivoted to the power plant via a mobile network connection. A suspected Ukrainian APT group is hacking TrueConf video conferencing service and replacing their client installers with backdoored versions. The campaign began in June this year. The group has repeatedly targeted TrueConf servers due to their popularity across former Soviet countries.

4:13Hackers are using a zero-day vulnerability in Metabase to steal data. Metabase has confirmed attacks against its cloud-hosted systems and customers' self-hosted servers. The zero-day is an SQL injection that grants attackers admin access over the database and its contents. No CVE identifier has yet been assigned to the bug. The first known victim is Modular Laptop Maker Framework. Software maker Enable has released an additional hot fix for a zero day that's been actively exploited since late July. This is the company's third attempt to fix the bug and stop the attacks. The zero day is an authentication bypass that lets remote attackers take over N's central remote management servers.

5:00Microsoft is investigating cases where the zero day was used to deploy a new ransomware strain called StormCrypt. The WordPress security team has patched a fresh remote code execution vulnerability. The vulnerability is codenamed XSS2Shell. It allows attackers to inject their code in the WordPress login page and run it whenever an admin logs in. This is the second WordPress remote code execution vulnerability to be disclosed recently. Last month, it was a bug dubbed WP2 Shell. Hackers are exploiting a recent vulnerability to compromise Progress Kemp load balancers. The attackers are exploiting an unauthenticated command injection that lets them remotely run code on the device.

5:45The bug was patched in June and also impacts MoveIt web firewalls. CISA says so far, the attacks have only targeted Kemp loadmaster balancers. A new attack allows hackers to manipulate NAT tables and hijack, spoof or crash active network connections. NAT tables allow telcos and companies to connect a large number of customers to the internet through a small number of public IP addresses. The NATJAC attack poisons the NAT table that stores information about which customers use which IP addresses and ports. NatJack affects NAT implementations used for corporate networks and cloud services on both Windows and Linux.

6:29Portswigger's Gareth Hayes has developed a CSS-only attack that can exfiltrate data from webmail inboxes. The attack was successfully tested against the web interfaces of Gmail, Microsoft, Outlook, ProtonMail, Yahoo, FastMail and AOL. It could modify the user interface, steal passwords, leak tokens and manipulate AI agents. Chinese AI model Kimi escaped a test environment earlier this year during a private evaluation. The model exploited a misconfiguration in the environment to access the internet to cheat on a cyber security assignment. According to Frontier Security, which was running the test, no harm was done to any third party company.

7:12Kimi joins models from Anthropic, OpenAI and Meta, which all recently escaped test environments. AI coding assistants are generating bad patches that often fail to fix vulnerabilities. According to a 1Password study, LLMs generated good patches in only 46 % of tested cases. Of those that generated a proper fix, the patch code materially changed an app's normal behaviour 50 % of the time. And finally, a New Mexico court has fined Meta$567 million for failing to warn the public about the dangers its platforms and algorithms posed to children. In March, the same court fined Meta $375 million for exposing children to predators and sexually explicit material.

8:00The company is now on the hook for$942 million. Meta plans to appeal. And that is all for this podcast edition. today's show was brought to you by Island. Find them at island.io. Thanks for your company.