ShinyHunters suspect arrested in the Netherlands

0:04A shiny hunter suspect has been arrested in the Netherlands. Apple fixes an iOS zero day found by Meta. Recent Citrix zero days see mass exploitation within hours. And NVIDIA launches an AI sandboxing platform. This is the Risky Bulletin, prepared by Katalin Kempanu and read by me, Claire Aird. Today is the 30th of September, and this podcast episode is brought to you by Portswigger. In today's top story, a suspected member of the Shiny Hunters hacking group has been arrested in the Netherlands. 24-year-old Pepijn van der Staap was arrested on September 16. He was in custody days later when the group claimed to have hacked FBI systems.

0:50He used the name Umbreon on hacker forums. At the time of his arrest, van der Staap was on probation, having served almost three years in prison over previous hacking-related charges. In a video message, the FBI described him as one of the group's leaders. The Bureau encouraged other Shiny Hunters members to rat out their friends or face arrest. Dutch police are also investigating van der Staap for attempting to arrange two murders. In other news, two recently patched Citrix Netscaler Zero Days are seeing widespread exploitation. Attacks began hours after detailed write-ups and proof of concepts were published on Monday.

1:31Citrix released patches for both of the bugs on the weekend after attacks were in the wild last week. According to Google, last week's attacks targeted European and North American government agencies and the financial, education and legal sectors. Apple has released an emergency security update to patch an actively exploited iOS zero day. The vulnerability allows attackers to run malicious code on iPhones via malcrafted files. Apple says the zero day was exploited in an extremely sophisticated targeted campaign. Meta's security team discovered the zero day. American software company Kiteworks has released a security fix for its file transfer platform.

2:16Kiteworks had told customers to take their file transfer servers offline last week after it received a warning from law enforcement agencies that hackers were preparing to launch attacks against its products. The company is now telling its customers it is safe to reconnect their servers to the internet. Hackers breached cryptocurrency platform BitGet last week by exploiting a zero-day in a third-party security product. The attackers extracted valid admin credentials from the security device and then pivoted to the platform's internal network. BitGet says the hackers injected fraudulent withdrawal commands and stole$388 million in crypto.

2:58Hackers have used a zero-day to breach Belgian internet service provider Belnet and steal emails. The stolen messages included emails sent to Belnet, plus one customer, between July 22 and September 25. Belnet says it's working with authorities to investigate the hack. The company is a government-funded internet provider that caters to the Belgian government, educational institutions and science and research centres. Hackers have breached Arizona's court system and copied backup files. The Arizona Supreme Court disclosed the breach on Friday and said most of the stolen files were considered public.

3:38The personal data of many of the state's residents was also stolen, but the court didn't say how many individuals are affected. UK communications watchdog Ofcom is investigating two telcos over alleged KYC failures that saw them allocate British phone numbers to scammers. Ofcom claims Vonage Business Limited and Voxbone SA failed to implement adequate know-your-customer checks when allocating the phone numbers. Some of the numbers were later used for scam calls and texts. A US judge has sentenced two Delaware men to prison over their roles in a BEC campaign. Chiji Oki Timothy Odemegwu and Harifat Mugaji broke into business email accounts to hijack payments.

4:26Both were members of the U.S. Air Force at the time of their crimes. They've been sentenced to nine and six years, respectively. The U.S. Justice Department has charged a Vietnamese national for defrauding victims via crypto investment scams. Trung Nguyen Van catfished his victims before stealing their money via fake crypto investments. He allegedly made more than$53 million from scams, with$16 million coming from a single victim. Security researchers have discovered a cluster of more than 30 malicious Chrome extensions posing as financial advice tools. The extensions use a dual structure. They show benign behaviour to scanners and reviewers but redirect real users to phishing sites.

5:10The extensions are available on the web store and some are still active. A new cyber espionage group is targeting Russia's military industrial complex and IT companies. The so-called Mimbrob group has been running spear phishing campaigns since April. Mimbrob's malware is coded to run only if Russian or other languages of the former Soviet republics are found on the target device. Meantime, Russian cyber espionage group Star Blizzard has pivoted to delivering malware via mass-scale phishing campaigns. The group previously used narrowly targeted spear phishing attacks and click-fix payloads to infect systems.

5:51The group's new phishing emails deliver malicious archive files that use virtual hard disks to create scheduled tasks. Those tasks periodically run the group's malware. The group is still focused on targeting Ukraine and its allies. Academics have discovered a new attack that can leak data from modern CPUs, Named the Branch Target Reuse Attack, it targets just-in-time code compilers. The attack works against JIT engines used in web browsers, language runtimes and OS kernels. It can leak data from CPUs due to how JIT compilers reuse allocated memory. Israeli spyware vendor Paragon and its American sister company, Red Lattice, will soon be publicly listed on the NASDAQ via a merger with a SPAC.

6:40Paragon's flagship product is the Graphite Mobile Surveillance and Espionage System. Paragon was founded in 2019 by veterans of Israel's intelligence community. It was acquired by AE Industrial Partners in 2024. And finally, NVIDIA has launched a new sandboxing platform to secure AI agents. The open agent safety platform will provide AI companies with secure runtimes and out-of-band monitoring technologies to keep AI agents in their containers and keep tabs on what they're doing. The aim is to prevent incidents similar to the recent hugging face hack. And that is all for this podcast edition. Today's show was brought to you by our sponsor, Portswigger.

7:25Find them at portswigger.net. Thanks for your company.