Risky Bulletin: US will let private companies carry out offensive cyber ops

0:03The White House will let private companies carry out offensive cyber ops, an AI hacking campaign breached Taiwan's government, a macOS bug was exploited over the internet to drop crypto miners, and Kenya orders internet cafes to store logs. This is the Risky Bulletin, prepared by Katalin Kimpano and read by me, Claire Aird. Today is the 14th of August, and this podcast episode is brought to you by enterprise browser maker, Ireland. In today's top story, private companies will carry out offensive cyber operations against transnational criminal organisations under a new program laid out in a presidential memorandum.

0:44US President Donald Trump has directed the Department of Homeland Security to establish the new offensive cyber program which will allow private entities to surveil and disrupt criminal groups. All commercial operations will be overseen by the DHS and DOJ. Companies will be vetted for suitability when applying to join the program. In other news, Kenya's communications watchdog has ordered all internet cafes to store logs of customer activity. The logs must be kept for three years. The communications authority of Kenya says the new rule is designed to prevent the abuse of public computers to carry out cyber crimes.

1:22The new rules come into effect today, August 14. Brazil's Data Protection Agency has ordered Discord to suspend its live streaming feature. Discord is currently under investigation in the country after it failed to flag a live stream where a 13-year-old Brazilian girl was harassed and encouraged to commit suicide. The girl took her life shortly after the stream. Officials believe Discord failed to factor in child safety when rolling out new features. Suspected Chinese hackers have used publicly available AI tools to breach Taiwanese government networks. The intrusions are part of a hacking wave that's hit multiple governments' networks across Asia, which has included a breach of Thailand's Ministry of Finance.

2:08According to Dream Security, the hackers used Hermes and OpenClaw agents to automate reconnaissance, entry, lateral movement and data exfiltration. A ransomware attack has hit Colombia's Ministry of Justice. The hack took down systems related to the ministry's illicit drug monitoring program and legal processes. The incident took place five days before the country's presidential handover and a new government taking office. Hackers have stolen sensitive data from UK mental health charity LawCare. The charity is one of almost 1 ,000 organisations impacted by a breach at software provider Beacon CRM.

2:48The stolen data includes details on donors, supporters, volunteers and fundraising contacts. Most of the data belongs to British lawyers suffering from mental illnesses. The UK's Data Protection Agency has reprimanded the country's Criminal Records Office for getting hacked three times in two years. The breaches took place between 2021 and 2023 and impacted ACRO's customer portal website. The Information Commissioner's office said the breaches allowed hackers to steal the data of almost 11 ,000 individuals who requested criminal history checks via the site. The ICO says the agency had failed to patch the portal for known vulnerabilities for years, with the last patch being applied in 2019.

3:35Uber is investigating a breach at its freight transport business after hackers posted its internal data on the dark web. The Helix Group leaked the data after a failed extortion attempt. Helix is a new group that started hacking and extorting companies this month. The Shiny Hunters Hacking Group has leaked the data of 1.6 million customers of RingCentral. The files were stolen during a social engineering attack that took place last month. RingCentral has since notified all affected customers. The Klopp Data Extortion Group has listed more than 40 new victims on its dark web leak site. Among the new victims are some large corporations like Shell, Philips and General Electric.

4:18The recent batch of victims were likely hacked using a vulnerability in PTC Windchill and FlexPLM, two software packages for managing factories and production lines. Cryptocurrency exchange Bybit has sued the North Korean government in a DC court in an attempt to recover$1.5 billion worth of crypto assets stolen in February of last year. The lawsuit accuses the government and its intelligence service of the hack. Bybit has recovered only$48 million of the stolen funds and has claims against another$30 million frozen at other exchanges. Montenegrin police have arrested 50 foreign nationals on suspicion of high-tech crime.

5:03Most of the suspects were Ukrainian nationals. They were arrested this week in a large house near the capital of Podgoritsa. Authorities said they seized so many digital devices they needed a cargo vehicle to transport them. Meanwhile, back in Ukraine, authorities have disrupted 94 call centres involved in cyber scams. The call centres posed as bankers, brokers and law enforcement officers to trick victims into investing funds or paying non-existent fines. Authorities notified 26 suspects of charges, seized$2 million and more than 3 ,300 computers. Spanish authorities have arrested a man in the city of Murcia for attempted fraud.

5:45The suspect allegedly used AI face-swapping technology to try to obtain digital signing certificates from government agencies. He used the AI technology during video calls to try to defeat identity checks. He tried posing as 30 different people. He was caught after the AI software glitched for a second and exposed his real face. More than 78 ,000 credentials and secrets stolen by Team PCP Hacking Group have leaked online. The creds were stolen from more than 2 ,500 organisations in a 40-minute window in March during the Light LLM supply chain attack. The data was found in a massive 153 gigabyte RAR archive.

6:30Google has removed 737 malicious Chrome extensions from the official web store. The extensions posed as VPN services and targeted Russian users seeking to bypass the Kremlin's internet censorship. According to Socket Security, the extensions routed traffic through the same infrastructure, intercepted web traffic, and defrauded users who tried to buy premium access to VPN servers. Security researchers have found malware in Firewall Falcon Manager, a tool used to manage VPN server infrastructure. According to security firm Flare, the backdoored tool appeared to target VPN resellers and infrastructure operators.

7:11A threat actor is conducting a mass internet scan and disguising the malicious traffic as AI crawlers. The activity began on August 3 and most of the traffic presents as open claw. The attacker is trying to steal credentials and configuration data stored in directory paths used by AI coding tools. The cybercrime underground is seeing an influx of ads for AI-based hacking tools. The tools on offer range from coding assistants that write malware without guardrails to full offensive AI frameworks. Others are designed to help cheat during job interviews or encrypt malware and evade detection. Security company Trellix says Black Hat AI tools are no longer experimental and are succeeding commercially well-maintained and being actively used.

7:58A Chinese APT group is running its cyber espionage operations from the same back end it uses for its private cryptocurrency fraud activities. Jewelbug's victims include Southeast Asian and Middle Eastern government agencies, as well as Chinese crypto theft victims. All targets are managed from XGWeb, a web panel for managing systems infected with the group's back doors. Broadcom believes the APT is a hired contractor operating out of China's Hunan province. Threat actors are mass exploiting a macOS vulnerability to install a cryptocurrency miner on vulnerable systems. The bug allows attackers to bypass authentication in the screen sharing feature to gain device access.

8:43Apple patched the bug in macOS Tahoe, Sequoia and Sonoma last week. Users who can't patch are advised to block access to port 5900 on their macOS devices or disable screen sharing. Hackers are exploiting a VMware vulnerability to gain access to vCenter servers. VMware patched the bug in late July, but exploitation began last week. Attacks are targeting a directory traversal bug to run code on the vCenter central management server. German security firm Quirso says the hackers have compromised at least 360 servers so far. Threat actors can trick Windows into installing vulnerable drivers by plugging in or emulating malicious USB devices.

9:29Named Plug and Pwn, the new attack takes advantage of a Windows feature that automatically downloads and installs vendor software and drivers when one of their devices is plugged in via USB. Threat actors can use this technique to force Windows to install vulnerable drivers, then exploit them to gain elevated privileges. The attack technique requires no user interaction. Security researcher Nightmare Eclipse has published a new Windows Defender Zero Day. The so-called Shield Break exploit abuses Windows Defender security software to gain admin access on Windows systems. It works on both Windows 10 and 11.

10:09The researcher published the zero day after Microsoft's Patch Tuesday updates. A new WhatsApp feature will deploy a lightweight local AI model to user devices to detect possible scam messages. Named Scam Alert, the feature is optional and will not share any messages with Meta. A beta version of the feature is being rolled out this week. And finally, cybersecurity firm Rapid7 has laid off around 300 employees. The redundancies equate to about 12 % of the company's total staff. The cuts come two months after Wael Mohamed stepped in as CEO. And that is all for this podcast edition. Today's show was brought to you by Island.

10:52Find them at island.io. Thanks for your company.

11:07Thank you.