A vast cyberespionage operation. Cloud storage users targeted. Security and AI agents.
Gutting US election protections. Lockdown Mode frustrates the FBI. And the reality of "pig-butchering" compounds.
Hacked
Details have been emerging about a global cyber espionage operation that breached the systems of 37 governments and carried out reconnaissance in 155 countries. Palo Alto Networks has declined to identify who was behind the operation but it’s notable that many of the targets would have been of interest to China. Among the organisations affected were five national law enforcement and border control agencies, three ministries of finance, one country’s parliament and a senior elected official in another. “They use highly-targeted and tailored fake emails and known, unpatched security flaws to gain access to these networks,” Palo Alto’s Unit 42 said.
In one phishing campaign, European governments received emails appearing to reference ministry or departmental reorganisations. The emails included a link to a ZIP file containing a program designed to bypass security scans and deploy malicious software. The operation is the most extensive attributed to a single government hacking group since the 2020 SolarWinds breach. It’s notable that government agencies and critical infrastructure organisations based in the US and UK weren’t targeted in what Unit 42 says may have been an attempt to avoid attracting too much attention to their activities.
Meanwhile, authorities in France and Greece have made arrests in separate operations against alleged Chinese espionage. The targets included NATO technology and the Starlink satellite internet system. In Greece, a colonel was detained on suspicion of providing classified and top secret information to Beijing. In France, four people, including two Chinese nationals, have been charged with suspected interception of sensitive military data. The case began when suspicions were raised over the installation of a satellite dish at an Airbnb apartment rented by the Chinese nationals. The dish was some two metres in diameter and its arrival coincided with a local internet outage.
Threats
Cloudy: A widespread campaign is bombarding cloud storage users with repeated false warnings about payment failures, data limits, and the risk of losing information. Clicking on links in the emails leads to checkout forms designed to harvest financial information. A separate campaign is targeting Dropbox users with a procurement-themed scam that aims to obtain account credentials.
Compliance: Fake “audit/compliance confirmation” emails are being used to target macOS users in the hope of stealing sensitive data. Chainbase Lab
Apple: Phishing emails posing as Apple fraud warnings are designed to pressure users into calling malicious phone numbers. They add a sense of urgency by referring to blocked Apple Pay transactions involving large sums. apple insider
Amazon: A new wave of highly convincing scam texts impersonates Amazon’s product recall messages with the aim of accessing user accounts. The texts include a link to an Amazon sign-in page that looks exactly like the real thing. Guardio
Zendesk: There are reports of another flood of automated emails generated through companies’ unsecured support systems. After this happened last month, Zendesk said it had introduced controls to stop a repeat. Bleeping Computer
AI
Agents: As we said last week, security is the most important consideration when thinking about using AI agents (i.e. tools that can take action on behalf of the user rather than simply answer questions). This applies particularly to OpenClaw (known previously as Clawdbot and Moltbot). There are already reports of hundreds of malicious ‘skills’ which are supposed to simplify the use of OpenClaw. In reality, they’re designed to access and steal sensitive information.
Confidence: Adoption of AI is up but confidence in it is down, according to research by ManpowerGroup. A common refrain is that so much time is spent refining prompts and checking the output of AI assistants that one might as well have just done the task manually. ZDNET
Distortion: Anthropic has been looking at how its Claude.ai assistant could affect the beliefs of the people who use it. The results are not altogether reassuring. While affecting only a small percentage of users, Anthropic says it found “several concerning patterns, such as validation of persecution narratives and grandiose identities.” And while small in percentage terms., the vast number of people using AI assistants could result in a large number overall.
Jobs: An AI security firm is probably not the most obvious target for a deepfake job scam but that’s what happened to a US company when it posted some vacancies on LinkedIn. It took only a couple of hours for the attempted scam to begin (with a message recommending a candidate). The Register explains what happened and what to look out for.
Trump
Elections: CNN reports on US government operations to protect the 2024 elections, and the Trump administration’s decision to gut the agencies that carried them out. These cuts took place despite a threat assessment released by the Office of the Director of National Intelligence warning that foreign powers will continue to try to influence US elections.
Rules: The White House has announced that software security guidance issued during the Biden administration has been rescinded due to “unproven and burdensome” requirements. The Office of Management and Budget said the guidance prioritised administrative compliance over meaningful security investments. Individual agencies will now be responsible for developing policies based on their specific needs and risk assessments. Security Week
Socials: The Department of Homeland Security has been trying to force Meta to hand over the identities of anonymous accounts that post videos and locations of Immigration and Customs Enforcement agents on social media. DHS lawyers said information suggested ICE agents were being stalked. Civil rights organisations said this was nonsense. Homeland Security eventually abandoned its attempts, as it did in at least six other cases last year. Bloomberg
Siren: Democratic Senator Ron Wyden is someone we, and many in the cybersecurity community, keep an eye on. He has a deep understanding of technology and civil rights, and he has a track record of calling out US agencies when they abuse the latter by exploiting the former. The problem for Senator Wyden is that frequently he’s not allowed to specify the issue because it’s classified. His solution is to publish letters he has written to administration officials that ask difficult questions. The latest was sent to the head of the CIA. It says only, “I write to alert you to a classified letter I sent you earlier today in which I express deep concerns about CIA activities.” No-one has any idea what this is about, but we’d wager it’s important. These questions have become known as the “Wyden siren.” As soon as we know, we’ll let you known what prompted the latest one. techdirt
In brief
Lockdown: Apple’s Lockdown Mode is designed to protect iPhones from sophisticated spyware, but it turns out it can also keep out the FBI. The agency has admitted that it was unable to access an iPhone seized from a Washington Post reporter last month because the mode was activated. The case also highlights the importance of turning off biometric access if there’s a risk of a device being taken, although the effectiveness of this very much depends on where you’re working. As we say in our awareness courses, you’re unlikely to refuse to hand over your passcode if the person demanding it is threatening you with a gun. It’s worth noting that Stolen Device Protection also hampers the sort of software used by law enforcement to access iPhones.
Scams: Nearly one in three Meta ads shown in the EU and the UK over a 23-day period pointed to online scams, according to research by Gen Digital. It found that ten advertisers were responsible for over 56% of the malicious ads, which shared infrastructure linked to China and Hong Kong. As Gen Digital says, “Malicious advertising has surged because it gives criminals what every marketer wants: instant reach, precise targeting and scale.”
WhatsApp: You may have seen talk of Meta’s messaging app being insecure. More specifically, a lawsuit filed last month claims Meta “can access virtually all” private communications on WhatsApp. We were going to ignore this but several people have asked us about it. Our view is that, although we don’t recommend WhatsApp for sensitive communications, neither do we believe Meta is reading people’s messages. For an in-depth take, distinguished encryption expert Matthew Green examines the issue and the noise around it.
Lobbying: Human rights groups say spyware manufacturer the NSO Group is trying to hijack diplomatic initiatives designed to limit commercial hacking. NSO released an amusingly misnamed “transparency report” last month in which it highlighted its participation in the Pall Mall Process, an initiative designed to stop misuse of spyware while recognising such products have a role in combating crime and terrorism. The Record
Ban: Spain says under 16s will no longer be able to access social media platforms from next week. “Social media has become a failed state, a place where laws are ignored, and crime is endured, where disinformation is worth more than truth, and half of users suffer hate speech,” Prime Minister Pedro Sanchez said. The ban is one of a package of measures that will hold managers responsible for infringements committed on their platforms if content that violates the law or is considered hateful is not removed.
Intercepts: European security officials believe Russia has intercepted the communications of at least a dozen key satellites over the continent, the Financial Times reports. Officials say the communications were accessed via Russian space vehicles that have been shadowing European satellites more intensively over the past three years.
Butchered: The grotesquely-named business of “pig-butchering” is run to a large extent from huge compounds in South-East Asia where enslaved scammers lure vulnerable victims into fake relationships. WIRED has a long-read based on someone who was lured to one of these compounds to work as a scammer but ended up telling WIRED how the operations work before managing to escape. The article is worth your time.
Royal: A Nigerian-based fraudster posed as Dubai’s crown prince to steal $2.5 million from a Romanian businesswoman. The elaborate romance scam persuaded the victim that she was being recruited for a humanitarian investment by the UAE royal family. OCCRP traced the fake prince to the doorstep of his newly purchased mansion in Abuja.
Updates
Microsoft: An Office vulnerability illustrates why it’s important to make sure updates are installed as quickly as possible. Trellis says Russia successfully exploited the issue within 48 hours of Microsoft releasing a fix for it. As a result, they were able to compromise devices inside diplomatic, maritime, and transport organisations in more than half a dozen countries.
Apple: Apple Home users need to check that they’re using the latest version, otherwise their system will stop working on February 10.
Cisco: Five security advisories for its firewall products.
Zimbra: Version 10.1.16 addresses multiple security vulnerabilities as well as “enhancing” Backup and Restore functionality.