Newsletters

US Secretary of State Marco Rubio has called for the State Department to push back against foreign state-backed propaganda and disinformation. Unfortunately for Rubio, he also dismantled the State Department's counter-propaganda office last year. It won't be recreated easily.

When it shut down its counter-propaganda office, the US government essentially left the detection of coordinated disinformation campaigns to private companies, at least some of which either don't care or are actively taking extreme positions: X is now a cesspool of disinformation. 

Last week, though, Rubio sent a memo to global US diplomatic posts directing them to launch their own campaigns combatting foreign propaganda. Per The Guardian:

Americans have lost almost $21 billion to cybercrime last year, more than any other since the FBI began tracking cybercrime data 25 years ago, the FBI said in its yearly Internet Crime Report [PDF].

Investment scams were again the top category in terms of losses, with $8.6 billion reported stolen, and almost $6.2 billion of that sum being stolen as cryptocurrency.

Cyber-enabled fraud accounted for 85% of last year's losses, almost $17.7 billion.

The Cambodian government passed a new law last week that introduces big fines and heavy prison sentences for the operators and workers of cyber scam compounds.

The new bill passed unanimously in the National Assembly and Senate and was sent to the country's king to be signed into law. It comes after major international pressure from both China and the US for the local government to crack down on its sprawling cyber scam ecosystem.

The law introduces tiered penalties depending on a suspect's roles in the scam operation, such as if they acted alone or part of a larger cybercrime syndicate.

The Russian government will tighten operating requirements for internet service providers in an effort to kill small neighborhood providers.

The new requirements will include higher license fees, larger minimum operational capital, and mandatory deployment of the FSB's SORM traffic interception equipment.

According to reports from Izvestia and RBC, the new proposed rules would give the Russian Ministry of Digital Development, Communications, and Mass Media the power to revoke licenses without a court order for those who fail to comply.

Computers are now incredibly good at finding and exploiting vulnerabilities. While we expect this will cause cyber chaos in industry, from a US government perspective, cyber organisations like NSA and Cyber Command need access to models from all domestic AI companies. Anthropic may be the 0day maestro this week, but there are no guarantees which firm will be crowned the champion of cutting edge when the dust settles. 

In the last week or so we've seen a stream of reports demonstrating a sudden step-change in the cyber capabilities of Anthropic's models. 

In early February Anthropic announced that it had used its latest model, Opus 4.6, to find and validate more than 500 high-severity vulnerabilities in open source software. These vulnerabilities were in well-tested code and some had been present for decades. The company said Opus 4.6 reasons about code the way a human researcher would. It looks at past bug fixes to find similar issues that weren't addressed, spots risky patterns and understands logic to determine what inputs would break software. Opus 4.6 was "notably better" at finding these vulnerabilities than previous models, even "without task-specific tooling, custom scaffolding, or specialized prompting". 

A suspected Iranian APT group has conducted a wide-ranging password spray attack against the Microsoft 365 accounts of governments and private sector organizations across the Middle East.

While password spraying campaigns are a dime a dozen, this one stood out to Check Point researchers because it targeted Israeli and UAE municipalities that were hit by Iranian drone and missile strikes.

The campaign started in early March, just as Iran began mustering its comeback after initial US and Israeli strikes that killed Iranian leader Ali Khamenei and tens of high-ranking government, military,  and intelligence officials in late February.

Apple has added a secret security feature to macOS to warn users about possible ClickFix attacks.

The feature was silently added to macOS 26.4, released last week.

It works by showing a popup on the screen whenever a user tries to copy-paste commands from a browser into the Terminal window.

NOTE: This newsletter was (initially) sent to Seriously Risky Business subscribers instead of Risky Bulletin subscribers by accident. If you are receiving this newsletter for a second time, that's why. Sorry!

The Russian government is working on a law that would require all mobile operators to use a custom domestically-developed encryption algorithm for the country's 5G mobile network.

If the bill passes, all phones sold in Russia going forward will have to support the NEA-7 algorithm or they will not be able to connect to Russian mobile networks.

In a Senate hearing last week FBI director Kash Patel said the Bureau is buying data that can be used to track Americans. The risk that the federal government could abuse purchased data was previously theoretical, but now feels more immediate. Lawmakers should act to protect Americans' civil liberties.  

When specifically asked about buying location data, Patel said the Bureau purchases information, "that's consistent with the Constitution and the laws under the Electronic Communications Privacy Act, and it has led to some valuable intelligence for us". 

We have seen US local law enforcement agencies using this kind of data to track people, but this is new for the FBI. In 2023, the Bureau's Director at the time, Christopher Wray, said it had once used commercial location data in a national security pilot program but had no further plans to use it. 

The CEO of a major spyware vendor says he is being scapegoated by the Greek government and is willing to testify and spill the beans on their illegal surveillance operations.

Intellexa CEO Tal Dillian is pissed out of his mind after a Greek court sentenced him, his wife, and two executives to more than 126 years in prison last month on generic charges of "violating the confidentiality of telephone communications."

The sentence is related to a major Greek political scandal known in Greece as Predatorgate, which this newsletter first covered back in December 2024.