Newsletters

A mysterious hacking group has stolen the personal and financial information of Moldovan citizens from the country's national healthcare database.

Moldova's national health insurance agency, CNAM, confirmed that data was stolen but denied initial news reports that almost a third of the database had been destroyed in the attack.

Ion Vintilă, an adjunct director for Moldova's Cybersecurity Agency, had told reporters in a taped interview that almost 30% of the agency's data was impacted in the incident, but didn't specify in what manner.

The US government has committed to countering Chinese 'distillation attacks' which are being used to steal the proprietary capabilities of American frontier AI models. We love a little governmental fist-shaking, but we don't think its plan will have China's AI labs shaking in their boots. 

Distillation attacks, also known as model extraction attacks, upskill less capable models on the cheap by training them on the outputs of more advanced models. 

Back in February, OpenAI, Google and Anthropic each said that they had been victims of distillation attacks. Anthropic said that Chinese labs had collectively generated "16 million exchanges" with Claude, across 24,000 fraudulent accounts. Google cited an attack that involved 100,000 queries to Gemini. 

The UK's cybersecurity agency has advised public and private organizations against relying too much on bad metrics to evaluate the efficiency of their security operations centers (SOCs).

Officials say bad metrics incentivize SOC teams to be careless about their jobs and rush through tickets and detections rather than be dedicated to protecting their networks.

While metrics can be used for other IT departments to evaluate their effectiveness, the true value of a SOC team comes from insight and not speed or quantity, hence SOC teams should not be treated as any other department that needs to be optimized.

Firefox and Tor Browser users are advised to install the latest security patches to address a bug that can allow threat actors to track them across the internet.

The bug works in normal browsing mode, in private browsing windows, and, in the case of Tor, across different Tor sessions.

The issue, found by the team at Fingerprint, resides in IndexedDB, a Firefox API that allows websites to store data inside a user's browser for future visits.

An ugly-looking web panel has been linked to 94 SIM farms located across 17 countries around the globe.

ProxySmart, as the panel is called, is among the first SIM-Farm-as-a-Service providers observed in cybercrime underground circles.

According to security firm Infrawatch, the panel was developed by a group operating out of Belarus, a group the company describes as "individuals with long-running involvement in SIM farm and mobile proxy operations."

Elon Musk has refused to appear at a voluntary interview relating to a French criminal investigation into illegal content on X and sexual abuse material created by the Grok chatbot.

The strategy of applying pressure directly on technology company executives is one that French authorities have used before. This incident reminds us of the arrest of Telegram founder and CEO Pavel Durov in Paris back in 2024. 

Both Telegram and X are being investigated by the same aggressive French cybercrime unit, but the problems these platforms present to authorities are different. Prior to Durov's arrest, Telegram was notoriously reluctant to cooperate with authorities and child safety groups. Massive criminal marketplaces flourished on the app. X, on the other hand, does actually enforce rules and policies, albeit imperfectly. While it has stepped back from countering bias or misinformation and has become an amplifier of Musk's own extreme right-wing views, this is not in the same league as allowing criminal activity to flourish.

A former FBI cyber official has urged Congress to investigate if ransomware groups that target hospitals and critical infrastructure can be designated as terrorist organizations.

Former FBI Cyber Deputy Director Cynthia Kaiser says the designation would allow prosecutors access to a broader set of tools and legal levers in tracking and taking down operations.

Kaiser, who served in the FBI for 20 years, including as the agency's Cyber Deputy Director, has also urged lawmakers to examine if ransomware operators can be charged with murder or manslaughter if any attacks lead to a human death.

Security researchers at British security firm Darktrace have found a new and interesting piece of malware that was specifically designed to infect and sabotage the operations of Israel's national water management network.

Named ZionSiphon, the malware is one of the rare malware strains created to target operational technology (OT), which are the type of networks from which staff manage industrial equipment.

The malware is a very targeted operation that only works inside networks hosted on Israeli IP address ranges and where the malware finds specific text strings containing the names of common Israeli companies that manage water treatment and desalination systems.

The US National Institute of Standards and Technology announced on Wednesday a new policy regarding the US National Vulnerability Database, which the agency has been struggling to keep updated with details for every new vulnerability added to the system.

Going forward, NIST says its staff will only add data—in a process called enrichment—only for important vulnerabilities.

This will include three types of security flaws, which the agency says are critical to the safe operation of US government networks and its private sector.

A recent deep dive into the American adtech surveillance system, Webloc, highlights the national security and privacy risks of pervasive and easily obtainable geolocation data. It brings home, once again, that the US needs to clamp down on the collection and sale of geolocation data.

The report, from Citizen Lab, documents what Webloc says it can do, who uses the product and its relationship with other commercial intelligence products. 

Webloc was developed by Cobweb Technologies, but is now sold by the US firm Penlink after the two companies merged in 2023. A leaked technical proposal document, obtained by Citizen Lab, says that Webloc provides access to records from "up to 500 million mobile devices across the globe". These records contain device identifiers, location coordinates and profile data from mobile apps and digital advertising.