Newsletters

A threat actor is registering expired web domains in order to take over email servers, reset passwords on abandoned developer accounts, and publish malware on the Canonical Snap Store for Linux packages.

At least two developer accounts have been hijacked using this technique, also known as a domain resurrection attack, namely for Snap packages published using email addresses from storewise.tech and vagueentertainment.com.

According to Linux expert and former Canonical dev Alan Pope, the threat actor behind this campaign is a group he believes are located in Croatia.

German lawmakers are working on a new law that will grant the country's intelligence agency new and extensive hacking and surveillance powers.

The primary intent of the new law is to free up the Bundesnachrichtendienst (BND) from relying on the US National Security Agency (NSA) for threat information and bring its interception capabilities on par with other European countries, such as France, Italy, the Netherlands, and the UK.

According to a draft of the new law obtained by German media, the BND will have the power to intercept full internet communications and not just metadata as it is allowed today.

The current price hikes and supply shortage of DRAM memory chips are expected to also impact firewall makers and the cybersecurity market.

Powerful DRAM is a crucial component for the manufacturing of modern next-gen firewalls, a staple in the cybersecurity defense of any major enterprise.

Investment advisory firm Wedbush says firewall companies will see thinner margins this year due to the rising DRAM costs. This will impact their bills of materials, with the extra costs being passed down to customers as product price increases. This will likely lead to lower sales, smaller profit margins, and weaker investor yields.

China's recent crack down on Southeast Asian scam compounds is clearly good news. But its efforts to tackle the scourge are domestically driven and may even cause scammers to shift their focus to Americans. 

Last week authorities announced that an alleged scam kingpin, Chen Zhi, had been arrested by Cambodian authorities and extradited to China. Chen is the founder of the Prince Group, which is ostensibly a Cambodian corporate conglomerate, but which US authorities allege was a transnational criminal organisation that operated forced-labour scam compounds engaging in various fraud schemes. 

US authorities had taken action against Chen Zhi. Back in October of last year, he was sanctioned and indicted and had a whopping USD$15 billion worth of cryptocurrency seized by the US. But China had the regional clout to actually get him in handcuffs. 

Modern security systems designed to protect user voices from getting cloned are still weak and can be bypassed with the proper tools.

These systems work by injecting random noise in voice audio recordings in order to prevent AI-based cloning technology from copying a user's voice. Voice cloning attacks are still possible, but they produce low quality output that can be easily detected and flagged by both manual reviewers and automated systems.

But three researchers from the University of Texas, in San Antonio, say that these systems are not complex enough and can be easily bypassed if attackers account for the added noise.

Respawn Entertainment has patched an exploit in the Apex Legends game that allowed third-parties to take remote control over a player's in-game character.

The exploit was used against several Apex streamers over the past week.

Hackers emptied their inventory (backpack) and moved their in-game avatar off the map, ending their games.

China hacks US House committees: Chinese hacking group Salt Typhoon has hacked the email systems used by congressional staff on multiple committees in the US House of Representatives. [Financial Times]

Jaguar sales slump after cyberattack: Jaguar Land Rover says its sales fell by 43% in Q3 following a ransomware attack that stopped production at its factories last fall for almost a month.

Sedgwick ransomware incident: IT company Sedgwick has confirmed that a ransomware attack has impacted its government contracting subsidiary over the New Year's Eve. The incident was claimed by the TridentLocker ransomware gang. [The Record]

R6S hacked: A threat actor hacked the backend servers of Ubisoft's Rainbow Six Siege FPS game and assigned billions in in-game currency to user accounts. Ubisoft confirmed the breach, took down servers, and rolled back the bans for users who received the currency and were automatically flagged and banned by the backend. The hack was linked to a MongoDB vulnerability known as MongoBleed, CVE-2025-14847, disclosed two days before Christmas and which very few companies had a chance to patch. [Dexerto]

Conde Nast gets hacked: A hacker breached news powerhouse Conde Nast and leaked the data of 2.3 million WIRED subscribers. The newest data points are from September 2024, the date of the presumed breach. Conde Nast has yet to confirm due to the winter holiday break. [DataBreaches.net]

ESA breach: Hackers breached the JIRA and Bitbucket servers of the European Space Agency (ESA). [BleepingComputer]

Docker Hardened Images are now free: Docker has made Hardened Images free for every developer. These are server images managed by Docker that are constantly updated and patched for the most recent security flaws. Devs previously needed some sort of subscription to use Hardened Images.

Piracy group leaks Spotify song database: A piracy and open-source group named Anna's Archive has leaked 256 million Spotify tracks. Spotify said it found and suspended the accounts that scraped its site.

TikTok signs divest deal: Chinese social media network TikTok has signed a deal to divest and sell its US division to a group of Trump allies. More than half the company is now owned by tech company Oracle, private equity firm Silver Lake, and Emirati-backed investment firm MGX. ByteDance and existing shareholders hold the rest. [CNN]

Belarusian authorities are deploying spyware on the smartphones of local journalists during police interrogations.

The ResidentBat spyware was spotted this year after a reporter who was interrogated by the Belarusian KGB intelligence service started receiving malware alerts on his device, days after being questioned by authorities.

The spyware can collect call logs, record through the microphone, take screen captures, collect SMS messages and messages from encrypted messaging apps, and exfiltrate local files.