Newsletters

Unlike the IRA and Russia's other internet troll farms and influence operations, Ghostwriter works on a higher level. Operations are timed and planned to coincide before or during important political events or military exercises, often requiring public rebuttals and clarifications from the targeted governments or politicians.

Researchers say because the group mixes both cyber (hacking) and psyop (influence) components, the group has gone under the radar for many years and has yet to be fully understood. Their theory blames the West's confusion about who's supposed to investigate GhostWriter. Is it a country's cybersecurity or its intelligence agency? Is it the private infosec community, or is Ghostwriter official government spook business?

As the researchers point out, this confusion and lack of understanding of the level where GhostWriter operates had allowed the group to run around for four years between 2016 and 2020 before people caught on to what they were doing and that the group existed.

Exchange scanning update: Microsoft has updated the guidelines for scanning Exchange servers for malware, and the company is now advising the scanning of additional directories. These folder locations were previously used by antivirus solutions, but Microsoft says it has seen malware campaigns abuse these directories to hide their malware.

Signal would leave the UK: Megan Whittaker, the president of the Signal secure messaging service, has told the BBC the company plans to leave the UK market if the country passes the controversial Online Safety Bill. The bill, which is currently receiving pushback from both the private sector and local politicians, would require tech companies to scan encrypted messaging apps for child sexual abuse material (CSAM).

More Twitter layoffs: Twitter fired last week its democracy and national security lead, Neema Singh Guliani, which kind of explains why that entire network's trending section is just state-run propaganda campaigns these days. Other layoffs followed at Twitter over the weekend too.

Russian local officials called the incident "a provocation by supporters of the Kyiv regime."

The Russian Ministry of Emergency Situations confirmed the hack in a Telegram post, but they did not share any info on the attack or any attribution.

This is not the first time suspected Ukrainian hackers have hacked Russian radio stations. In June 2022, one such hacker hijacked Kommersant's FM radio to blast the Ukrainian anthem and anti-war songs, forcing the company to temporarily shut down its air programming and broadcast solely via the internet for a few hours.

Risky Business publishes sponsored product demos to YouTube. They're a great way for you to save the time and hassle of trying to actually get useful information out of security vendors. You can subscribe to our product demo page on YouTube here.

In our latest demo, Brett Winterford and Harish Chakravarthy demonstrate to host Patrick Grey how Okta can be used for passwordless authentication. These phishing resistant authentication flows — even if they are not rolled out to all users — can also be used as a high-quality signal of phishing attempts that can be used to trigger automated follow-on actions.

This Reddit post is a stellar example of unintentional "play stupid games, win stupid prizes" hilarity. The original poster, Suspendedbankaccs1, is baffled as to why their HSBC, Santander and Barclays bank accounts have been suspended.

RailYatri leak: The personal details of more than 31 million Indians is currently on sale on an underground hacking forum. The seller claims the data belongs to RailYatri, a ticket-booking app used by India's national railway. A government official told the Hindustan Times they are currently investigating the incident.

Virgin Media incident: Virgin Media Television broadcasts were impacted across Ireland after the company discovered an "unauthorised attempt to access [their] systems." According to Ireland's national television RTE, as a result of the attack, Virgin Media aired recorded programming on several channels on Monday, such as Virgin Media 3, 4, More, and VMTV Player.

DOD leak: The US Department of Defense has leaked sensitive emails after it left one of its Azure servers exposed on the internet without a password. According to TechCrunch, the server hosted internal mailboxes for US Special Operations Command, or USSOCOM, the US military unit tasked with conducting special military operations. Some of the emails exposed in the incident also contained SF-86 questionnaires used by DOD employees to apply for security clearances.

Ukraine cyber incident stats: The Ukrainian government says it recorded 2.8 times more cyber incidents throughout 2022 than in 2021. Officials say they registered 415 distinct cyber incidents throughout the year, most connected to Russia's military invasion.

Fines for SORM disobedience: The Russian Duma is working on a law that will introduce turnover-based fines for local telco providers that fail to install its SORM traffic monitoring system. SORM, initially introduced in the 90s, is special equipment installed in the telco's backend network that logs internet and telephony traffic and allows Russian law enforcement and intelligence services to search through the data. SORM is already mandatory for all Russian telcos, but no penalty was specified for companies that failed to implement it or refused to have the equipment working, which has been the case with the smaller operators. The fines will range from 0.001 to 0.003% of a telco's annual revenue, according to Russian news outlet Vedomosti.

Centralized database of fraudsters: Elvira Nabiullina, the head of the Central Bank of Russia, wants to create a centralized database of fraudsters to improve the security of Russian banks and their customers. We wonder if Mrs. Nabiullina's "centralized database" will also include all the Russian cybercrime groups and money launderers operating within Russia's borders.

"It is kind of a weird joint publication given that it talks about 'recently conducted malicious cyber activities' but then goes on to mention examples as far back as July 2021," Stefan Soesanto, a Senior Cyber Defence Researcher at the Center for Security Studies at the Swiss Federal Institute of Technology (ETH) in Zurich, tells RiskyBizNews.

"On the one hand, this read to me as a stern reminder but also fairly desperate attempt by CERT-EU and ENISA to appeal to European public and private sector organizations.

"On the other hand, it was great to see all these past incidents being re-highlighted and Chinese threat actors being mentioned in the context of 'sustained activity'," Soesanto adds.

Last week we covered the Chinese spy balloon and noted that several previous balloons had apparently transited the US without being detected. The US commander of NORAD said the US military "did not detect these threats" and described the lack of visibility as a "domain awareness gap".

We speculated that defence contractors would be lining up to close this gap, but in news that will no doubt sadden the growth team at Lockheed Martin, the USA was able to tune up its existing detections to identify balloon-like objects. A US official told the Washington Post that adjustments to filters on various sensors closed the gap:

When you look, you find, and this has led to a string of objects being found and shot down. At time of writing, the US military has now downed three additional objects over the US and Canada since our last edition. It's not clear exactly what these craft were but given the sheer number of balloons launched every year they probably aren't of any intelligence significance (and certainly not alien spacecraft) but were downed because of the potential threat they posed to civilian air traffic.

Horny DOD: The Office of the Inspector General for the Department of Defence has found that DOD employees often flaunt rules and install unauthorized apps on government devices, exposing themselves to cybersecurity risks. An audit of DOD employee smartphones has found dating apps, third-party VPNs, cryptocurrency apps, Chinese drone apps, games, and apps related to multi-level marketing schemes installed on DOD devices. The DOD-OIG has recommended that the DOD employees remove the apps, remove access to unmanaged app stores, and require DOD employees to forward a complete list of DOD messages sent via unauthorized messaging apps installed on their work devices so officials can address any possible leaks and risks. [More in Gizmodo]

What a massive surprise: Everyone at RiskyBiz is absolutely shocked that the emails of a UK MP who showed support for Ukraine and were allegedly hacked by Russian intelligence services have reached the hands of a former UK politician peddling pro-Kremlin propaganda like "NATO blew up NordStream 2" and "NATO provoked Russian into invading Ukraine."

Airlock Digital is one of this newsletter's four main supporters and this week's featured sponsor. Earlier this year, in May, Airlock Digital CEO David Cottingham held a product demo with Patrick Gray, the host of the main Risky Business podcast, showing how Airlock's allow-listing product works.

New Ali's Justice (Edalat-e Ali) hack: Iranian hacktivist group Ali's Justice (Edalat-e Ali) has hijacked the signal of Iran's state television channel IRIB on the 44th anniversary of the Iranian Revolution, which took place on Saturday, February 11. The hacktivist group interrupted a speech from Iran President Ebrahim Raisi and replaced it with a call to the Iranian people to withdraw money from government banks and to assemble in new anti-government protests to take place on February 16. The interruption only lasted one minute and was also accompanied by a "Death to Khamenei" slogan.

MSDT EOL: Microsoft has announced the end-of-life for its Microsoft Support Diagnostic Tool, a built-in tool that shipped with many previous Windows versions and would work by launching automatically to diagnose and correct common problems for a variety of Windows features. Microsoft says that starting this year, MSDT will start redirecting users to the Get Help troubleshooting platform, and the MSDT platform will be removed completely in 2025.

CHERIoT: Microsoft has open-sourced CHERIoT, a security-first real-time operating system (RTOS) and software stack for running on embedded devices with under 256 KiB of SRAM. The name stands for Capability Hardware Extension to RISC-V for Internet of Things.