Risky Bulletin: Two TeamPCP members arrested in Australia

0:03Two members of Team PCP arrested in Australia. Chi Lin hits the US Firearms Agency, America seizes two more Chinese botnets, and SISA says most cyber activity is opportunistic. This is the Risky Bulletin, prepared by Catalan Kimpanu and read by me, Claire Aird. Today is the 28th of August and this podcast episode is brought to you by Push Security. In today's top story, the Australian Federal Police has arrested two suspected members of the Team PCP hacking group. The suspects were arrested on Wednesday in Cottesloe and Mandurah near Perth. They were identified by the press as 21-year-old Ruben Thompson, the group's alleged leader, and 23-year-old Lewis Giebler.

0:50The Team PCP group carried out multiple software supply chain attacks using a self-replicating NPM worm. They compromised open source coding libraries, spread to corporate networks, stole enterprise credentials, and then victim data. Some victims were ransomed while others had their data published online. In other news, the Trump administration has banned the use of foreign-made equipment in the US electric grid. The White House executive order that enacted the ban cited concerns about possible backdoors and software vulnerabilities that could be used to sabotage the US power grid. The order specifically covers equipment used for the bulk power system, which refers to the network of high-voltage lines, substations and power plants.

1:37Meantime, the Trump administration is preparing a new cybersecurity program to protect the water sector from foreign hackers. The initiative will be led by the Office of the National Cyber Director and will be announced next week. It will enlist private security firms to provide free cybersecurity services to vulnerable U.S. water facilities. The program will first roll out in Texas for a testing phase before its expansion to other states. The US Department of Justice has seized two botnets used by Chinese state hacking groups to breach US government networks. The botnets were used in attacks targeting NASA, the Federal Reserve, the US Senate and the DOJ itself.

2:19One of the botnets was used to scan and hack IoT devices, while the second was used as a proxy network. The DOJ says the botnets were part of a commercial hacking platform named QTFY that was rented to Chinese state groups. The platform was allegedly developed by a Chinese company named Nanjing Xinjui Network Technology. Hackers have stolen the data of 8.7 million travellers who passed through three UK airports. The stolen data includes email addresses used to sign up for airport Wi-Fi. The Manchester Airports Group disclosed the hack this week after refusing to pay a ransom. The company owns the Manchester, East Midlands and London Stansted airports.

3:04The US Treasury Department has launched a task force to help American companies to adopt quantum-resistant encryption algorithms. The Quantum Readiness Task Force will primarily work with banks and financial firms to secure the country's financial network and payment systems. It will also work with third-party vendors and the cryptocurrency space to secure their transitions. The Egyptian government has launched a national biometric verification system. The new system will allow users to verify their identity using a smartphone's biometric capabilities. The system has already been implemented by local telcos, with users being able to prove their identity without visiting a local branch.

3:47The government also plans to use it for its online portals. The Chilin Ransomware Group has breached the US Bureau of Alcohol, Tobacco, Firearms and Explosives. The ATF confirmed the incident this week but says hackers only accessed one standalone system. The agency says its wider network was unaffected and all ATF portals are up and running. A cyber attack this week has disrupted the global operations of medical device maker Boston Scientific. The incident impacted systems used to process and ship customer orders. The company has almost 60 ,000 employees worldwide. The Shiny Hunters hacking group has leaked the data of almost 13 million customers of clothing retailer Carhartt.

4:34The hackers published the data after the company refused to pay a$3.3 million ransom demand. According to Have I Been Pwned, the data also contained millions of synthetic fake records. Some bookstores in Australia are running out of stock after a cyber attack disrupted a book distribution system managed by Hachette Australia. Hackers hit the Alliance distribution services in mid-July. Six weeks later, Hachette has yet to restore the platform. A ransomware group has breached the systems of Microcom, a company that makes software for American water utilities. The incident is unrelated to the Iranian cyber attacks that hit water utilities across the US.

5:19A new ransomware group named Barracuda claimed credit for the intrusion and leaked Microcom's data after a failed extortion. The company's main product is the SkadaView CSX system. North Korean remote workers are changing their tactics and applying for jobs outside the realm of IT and technology. Remote workers are now applying to jobs in sales, marketing and medical professions. Security firm Huntress spotted the change in tactics this month while studying their server infrastructure. The source code of the MooBot botnet has leaked thanks to a misconfigured server directory. The original MooBot was developed in 2019 and has been used by both e-crime groups and Russian military hackers.

6:07The FBI seized a version of the botnet in 2024. That was being used by APT28, a cyber unit inside Russia's military intelligence agency. Social media giant Meta has disrupted the operations of six spyware and surveillance for a hire vendors active on its platforms. Meta says it took down a network of Facebook and Instagram accounts created by Israeli surveillance for hire vendor Bindasi. It also took down new accounts registered by Intellexa and NSO to spread their spyware in what Meta described as recidivist activity. Meta also disrupted Facebook and Instagram activity associated with two Chinese companies, Surf Filter Network Technologies and Sinovatio, which specialise in network traffic interception and analysis.

6:58Finally, met a disrupted Italian surveillance company, a SIGINT that created a fake iOS version of WhatsApp. More than 100 tech companies have signed an open letter calling on governments and private companies to bolster cyber defences against AI-powered cyber attacks. The companies have urged governments to expedite model reviews and grant more customers access to high-end cyber models. Signatories warn that AI-enabled attacks will likely become more widespread and complex in the coming months. Most cyber activity that hit US government networks in 2024 and 2025 came from opportunistic criminals scanning the internet for known vulnerabilities.

7:40According to a CISA report analysing activity over the two-year period, zero-day exploits were very rare. Most of the attacks targeted a small number of vulnerabilities. CISA says continuing its Secure by Design initiative should help secure against easy targeting and insecure software in the long run. Researchers from Volncheck have discovered two more backdoors in ZBT home routers firmware. One, named Dark Lantern, listens to incoming network packets for commands, while the other, Speaking Stone, phones home to a preset domain at regular intervals. They were discovered less than a month after Volncheck found a separate backdoor system in ZBT routers.

8:22The company believes that Speakingstone was designed as a domestic Chinese surveillance technology to only be deployed in China. Hackers are exploiting a zero-day vulnerability in Papercut print management servers to steal sensitive data from corporate networks. Papercut confirmed the attacks against its MF and NG platforms and released security updates on Thursday. No details about the vulnerability have been disclosed. Google is rolling out support for encrypted client hello on Android 17. The feature allows users to hide the destination of their HTTPS traffic. ECH support will roll out at the operating system level to protect all traffic out of an Android device.

9:07Meanwhile, Google is also adding a feature to protect against SMS blaster attacks. The attacks use fake mobile towers to downgrade users' connections to the 2G protocol. From there, an attacker can send spoofed SMS messages that appear to be from official numbers. The Android 17 feature allows telcos to forcibly disable 2G on their customers' devices. And finally, Meta has agreed to pay almost$18 billion in a settlement with almost 50 US attorneys general. The suit alleged the company was harming children through its addictive design and algorithms on both Facebook and Instagram. Meta will introduce restrictions for teen users, including daily limits, automatic breaks after 15 minutes of continuous use, and a nighttime block.

9:55The company will also implement limited push notifications during school days and improved parental controls and age verification. Meta's agreement to pay is conditional on YouTube and TikTok, taking similar steps. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Push Security. Find them at pushsecurity.com. Thanks for your company.