Newsletters

The Cambodian government passed a new law last week that introduces big fines and heavy prison sentences for the operators and workers of cyber scam compounds.

The new bill passed unanimously in the National Assembly and Senate and was sent to the country's king to be signed into law. It comes after major international pressure from both China and the US for the local government to crack down on its sprawling cyber scam ecosystem.

The law introduces tiered penalties depending on a suspect's roles in the scam operation, such as if they acted alone or part of a larger cybercrime syndicate.

The Russian government will tighten operating requirements for internet service providers in an effort to kill small neighborhood providers.

The new requirements will include higher license fees, larger minimum operational capital, and mandatory deployment of the FSB's SORM traffic interception equipment.

According to reports from Izvestia and RBC, the new proposed rules would give the Russian Ministry of Digital Development, Communications, and Mass Media the power to revoke licenses without a court order for those who fail to comply.

Computers are now incredibly good at finding and exploiting vulnerabilities. While we expect this will cause cyber chaos in industry, from a US government perspective, cyber organisations like NSA and Cyber Command need access to models from all domestic AI companies. Anthropic may be the 0day maestro this week, but there are no guarantees which firm will be crowned the champion of cutting edge when the dust settles. 

In the last week or so we've seen a stream of reports demonstrating a sudden step-change in the cyber capabilities of Anthropic's models. 

In early February Anthropic announced that it had used its latest model, Opus 4.6, to find and validate more than 500 high-severity vulnerabilities in open source software. These vulnerabilities were in well-tested code and some had been present for decades. The company said Opus 4.6 reasons about code the way a human researcher would. It looks at past bug fixes to find similar issues that weren't addressed, spots risky patterns and understands logic to determine what inputs would break software. Opus 4.6 was "notably better" at finding these vulnerabilities than previous models, even "without task-specific tooling, custom scaffolding, or specialized prompting". 

A suspected Iranian APT group has conducted a wide-ranging password spray attack against the Microsoft 365 accounts of governments and private sector organizations across the Middle East.

While password spraying campaigns are a dime a dozen, this one stood out to Check Point researchers because it targeted Israeli and UAE municipalities that were hit by Iranian drone and missile strikes.

The campaign started in early March, just as Iran began mustering its comeback after initial US and Israeli strikes that killed Iranian leader Ali Khamenei and tens of high-ranking government, military,  and intelligence officials in late February.

Apple has added a secret security feature to macOS to warn users about possible ClickFix attacks.

The feature was silently added to macOS 26.4, released last week.

It works by showing a popup on the screen whenever a user tries to copy-paste commands from a browser into the Terminal window.

NOTE: This newsletter was (initially) sent to Seriously Risky Business subscribers instead of Risky Bulletin subscribers by accident. If you are receiving this newsletter for a second time, that's why. Sorry!

The Russian government is working on a law that would require all mobile operators to use a custom domestically-developed encryption algorithm for the country's 5G mobile network.

If the bill passes, all phones sold in Russia going forward will have to support the NEA-7 algorithm or they will not be able to connect to Russian mobile networks.

In a Senate hearing last week FBI director Kash Patel said the Bureau is buying data that can be used to track Americans. The risk that the federal government could abuse purchased data was previously theoretical, but now feels more immediate. Lawmakers should act to protect Americans' civil liberties.  

When specifically asked about buying location data, Patel said the Bureau purchases information, "that's consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us". 

We have seen US local law enforcement agencies using this kind of data to track people, but this is new for the FBI. In 2023, the Bureau's Director at the time, Christopher Wray, said it had once used commercial location data in a national security pilot program but had no further plans to use it. 

The CEO of a major spyware vendor says he is being scapegoated by the Greek government and is willing to testify and spill the beans on their illegal surveillance operations.

Intellexa CEO Tal Dillian is pissed out of his mind after a Greek court sentenced him, his wife, and two executives to more than 126 years in prison last month on generic charges of "violating the confidentiality of telephone communications."

The sentence is related to a major Greek political scandal known in Greece as Predatorgate, which this newsletter first covered back in December 2024.

GitHub is slowly becoming a very dangerous website as more and more threat actors are starting to use it to host and distribute malware disguised as legitimate software repositories.

What started as an infrequent sighting in early 2024 is now at the center of an increasing number of infosec and malware reports.

The tactic is usually the same. A threat actor would take a legitimate repository, add malware to the files—typically an infostealer or a remote access trojan— and then upload the boobytrapped repo back on GitHub.

Amazon Web Services has rolled out a new security feature last week that will help customers prevent a type of attack known as S3 Bucket Namesquatting, or Bucketsquatting.

The attack was first described by cloud engineer Ian Mckay in 2019. It happens when an attacker abuses the predictable naming conventions in AWS bucket names to register buckets that have expired or have been deleted by their original owners.

If traffic still flows to the old buckets, this allows attackers to collect data from internal networks or public-facing apps, leading to serious security incidents.