Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

0:04Ukraine's top prosecutor resigns amid a scam call centre scandal. The US accuses Chinese AI companies of industrial-scale distillation. A cyber attack hits medical practices in Luxembourg. And the liquid network attacker returns some stolen Bitcoin but keeps a$50 million bounty. This is the Risky Bulletin, prepared by Katalin Kimpanu and read by me, Claire Aird. Today is the 9th of September, and this podcast episode is brought to you by Authentic. In today's top story, Ukraine's top prosecutor Ruslan Kravchenko resigned this week amid allegations that his office accepted bribes in exchange for protecting investment scam call centres.

0:49According to Ukraine's anti-corruption body, NABU, officials from Kravchenko's office began taking bribes last year and protected up to 500 call centres. Each call centre was paying a protection fee of$7 ,000 a month, which netted officials between$700 ,000 and$3.5 million in monthly bribes. Investigators say the group was led by Serhii Kropova, the deputy head of the Department of International Cooperation, inside Kravchenko's Office of the Prosecutor-General. Authorities arrested Kropova last week. Two further suspects were detained on Monday. In other news, the US government has accused Chinese technology companies of orchestrating industrial-scale distillation attacks against American AI models.

1:39In a joint advisory on Tuesday, CISA, the FBI and the NSA said the Chinese government was likely aware of the distillation campaigns. The six Chinese companies named in the advisory are DeepSeek, Moonshot AI, Alibaba, Minimax, Stepfun and ZAI. The targeted US models include Claude, GPT, Gemini and Grok. France's cybersecurity agency has established a new incident response team dedicated to dealing with security incidents at government agencies. The new team is named Reactive. Its launch follows several breaches at French government agencies this year. The Swiss government plans to gradually replace Microsoft 365 with European office platform OpenDesk.

2:28The switch will begin in late 2027 with OpenDesk initially running in parallel with Microsoft 365. The platform will be used by roughly 3 ,000 employees and will cost the Swiss government around$11 million. OpenDesk will include email, calendar, documents, presentations, telephony and audio and video conferencing. A cyber attack has crippled more than 80 medical practices across Luxembourg. The attack hit BMS Engineering, the developer of a payment system used by the local medical sector. The company said it's investigating whether patient data was stolen from its cloud servers. The city of Springfield in Massachusetts closed 64 public schools on Tuesday after a cyber attack hit the local school district.

3:17The district told teachers and students to stay off school networks until the incident is resolved. The schools will remain closed while the district investigates the incident and restores affected systems. The Shiny Hunters Hacking Group claims to have breached Florida's Department of Motor Vehicles. The group says it will release more than 200 ,000 driver records stolen from the department's internal databases unless the DMV pays a ransom. Shiny hunters released the driving record of deceased sex offender Jeffrey Epstein as proof of the hack. A misconfigured Elasticsearch instance has leaked the personal details of more than 220 million passengers and airline crew members who flew through a Vietnamese airport.

4:04The data is believed to have leaked from an Advanced Passenger Information System, a database that stores information on people travelling through airports. According to Kinryu Labs, the database came from a Vietnamese airport, but they couldn't say which one. Hackers have stolen more than a million user records from math tutoring platform Mathspace. The attackers breached the company's Metabase database last month as part of a global hacking campaign that hit hundreds of companies. The stolen data includes information on students, guardians and school staff. Only users in Australia and New Zealand are affected.

4:43The hacker, who stole$320 million in Bitcoin from the Liquid Network cryptocurrency platform, has returned 85 % of the funds. The company says it's patched the blockchain nodes that allowed the hack. The attacker claims to be a white hat security researcher and has kept almost$50 million as a self-awarded bug bounty. Italian hacktivist and hacker collective Altistici Inventati has shut down its online platform after the U.S. declared it a terrorist organization last month. The group built and operated encrypted chats and email services, web hosting, secure video conferencing and streaming, and other anonymity tools.

5:27The U.S. State Department claimed Inventati's platforms were used by violent Antifa cells and far-left militants. The U.S. Treasury also sanctioned the group. The US has extradited a Russian national from the country of Georgia to face hacking charges. Sergei Anatolyevich Filimonov is accused of phishing online banking users and attempting to steal their money. Filimonov successfully stole 5 ,000 login credentials and attempted to steal millions of US dollars. The DOJ didn't say if he was successful. A Singaporean man has pleaded guilty in a US court to stealing$245 million from a single cryptocurrency investor in 2024.

6:12Malone Lam was part of a group that hijacked the victim's Google account by posing as Google support. The group used the victim's private crypto wallet key to steal the funds. They spent the proceeds of the theft on international travel, nightclubs, luxury cars, watches, jewellery, designer handbags and rental homes in Los Angeles and Miami. Lamb was arrested in September 2024. Dutch police have published a recording of the voice phishing attack that compromised Dutch ISP Odido in February. Police have yet to identify the hackers more than seven months after the breach and are hoping members of the public will recognise the voice.

6:53The recording was also played on Dutch TV station NPO2. Software maker Enable has patched an actively exploited Zero Day in its Ncentral platform. The Zero Day is different from the two critical vulnerabilities patched by the company on Friday. The company's Ncentral products were also targeted with another Zero Day last month. And finally, security researchers have developed a first zero-click worm that spreads via WeChat voice calls. The worm works across both Android and iOS and doesn't require users to answer the incoming call. It's powered by an RCE exploit that Tencent has now patched. And that is all for this podcast edition.

7:38Today's show was brought to you by Authentic. Find them at goauthentic.io. That's authentic with a T-I-K. Thanks to your company.