Iran-linked hackers claim attack on US manufacturer.
Russia targeting Signal and WhatsApp accounts. Chatbots advise teens on violence. US crackdown on cyber scams.Spyware industry exploiting more “zero-day” flaws than governments. And the risks of oversharing online.
Iran
An Iran-linked hacktivist group says it was responsible for an attack on a major US-based manufacturer of medical equipment, highlighting the potential for disruption of civilian infrastructure as the war with Iran continues. The Handala group said it carried out the attack in retaliation for a missile strike on an Iranian school. The attribution has not been independently confirmed but the group has previously targeted Israeli and regional organisations and is widely believed to operate as a proxy for Iran. Stryker, which has customers in 61 countries, says the incident resulted in a global network outage that it’s still trying to resolve.
The conflict has also impacted the infrastructure that underpins the digital economy in the region. On Monday, Amazon said some of its data centres in the United Arab Emirates and Bahrain were damaged by drone strikes, disrupting cloud services and making a recovery “prolonged”. The outage affected financial institutions that use Amazon cloud services, leaving some bank customers unable to use payment apps. Given Iranian technical capabilities, if the war continues it may provide a case study in cyber warfare and its role in asymmetrical conflicts.
Meanwhile, other countries are busily exploiting the war to target organisations in the Middle East and further afield. Proofpoint reports that China, Belarus and Pakistan are likely responsible for campaigns using aspects of the conflict as topical phishing lures. It illustrates the rule that attackers will take advantage of any news event for strategic - or financial - gain. Our advice is that journalists and NGOs should be particularly vigilant. Unexpected invitations and research papers should be treated with caution.
Threats
Messaging: Courtesy of Dutch intelligence comes a great example of how attackers try to access the content of encrypted messaging services like Signal and WhatsApp. Journalists and government officials are among the targets that Russia has been trying to trick into entering credentials on fake login pages or scanning malicious QR codes. The only code you should ever enter is your security PIN or device-linking code that you requested yourself. Coincidentally, WhatsApp has just added a feature that will warn users when they receive suspicious requests to link a new device to their account.
Sextortion: A new wave of “I recorded you” sextortion emails is using passwords taken from data breaches and disposable email services to make threats appear credible. The attackers typically claim to have hacked webcams and demand cryptocurrency payments, but there’s rarely any evidence the victim was actually compromised. The messages are best ignored. Proofpoint
CleanMyMac: A cloned version of the popular utility is spreading information stealing software which can harvest browser data, passwords and cryptocurrency wallet information. It’s a reminder to only download software from official developer websites or trusted app stores. Cyble
Outlook: A campaign is using malicious calendar invitations to bypass email filters. The invites contain phishing links or malware downloads and exploit the fact that users often trust meeting requests more than emails. Treat unexpected calendar invitations with the same caution as suspicious emails. Microsoft
Teams: On the same theme, we’re increasingly seeing campaigns that target employees directly through Microsoft Teams messages rather than email. Attackers impersonate colleagues or IT staff and send links or files that enable remote access once opened. Unexpected Teams messages from external accounts need to be regarded with extreme scepticism. Proofpoint
Meet: Malicious websites posing as Google Meet update pages are being used to install remote-access malware with a single click. Victims are told they need a browser update or plugin to join a meeting, which actually grants attackers control of their computer. Only install software updates through the app’s settings, never from a website. Malwarebytes
AI
Violence: Research into 10 AI chatbots found most were willing to provide guidance to teenagers asking about school shootings, bombings and political violence. Although many responses included warnings, they still went on to offer practical suggestions or resources related to violent acts. Only Anthropic’s Claude and SnapChat’s My AI regularly refused, with Claude the most consistent to resist efforts to elicit assistance with violence. Further evidence, if it were needed, that the rush to attract users is not matched by suitable safety guardrails. CCDH/CNN
Integration: Google is integrating its Gemini AI assistant across Docs, Sheets, Slides and Drive. The update adds AI features to the apps, so users can summarise documents, generate content and analyse data within the applications themselves.
Deepfake: YouTube is expanding efforts to combat deepfakes to include a pilot group of government officials, journalists, and political candidates. “Likeness Detection” aims to identify impersonation attempts before they can spread. Meanwhile, Meta’s Oversight Board says the company’s policies for moderating deepfake videos remain inadequate and need stronger enforcement mechanisms.
Moltbook: Meta appears to have been so impressed by Moltbook that it’s shelled out an undisclosed sum to buy it. In case you need a reminder, Moltbook is the social networking platform designed to allow AI agents to exchange information and interact. It was started as a niche experiment in January, attracted mass coverage (partly as a result of fake posts), and has been variously dismissed as a fad and held up as a glimpse of the future. TechCrunch
Trump
Order: President Trump has signed an executive order directing federal agencies to prioritise investigations into cyber fraud, phishing, sextortion and ransomware. In 2024 alone, cyber-enabled fraud schemes resulted in losses of $12.5 billion - and those are just the incidents that are reported.
China: US officials say Chinese state-linked hackers breached an FBI system used to store wiretap data and surveillance warrant information. The compromised network includes phone records and routing data. Investigators are still trying to figure out whether the incident is linked to previous breaches of telecom companies. CNN
In brief
Spyware: Google says commercial spyware vendors are now exploiting previously unknown software vulnerabilities to a greater extent than government intelligence agencies. There’s a thriving market in buying and selling flaws that haven’t been seen before (so called “zero-day” vulnerabilities). This is a fundamental weakness in the technology ecosystem on which the modern world depends - which neither governments nor manufacturers appear capable of addressing.
Disinformation: DomainTools has a report detailing the complexity and sophistication of Russia’s disinformation efforts. “At its core, the ecosystem relies on systematic media brand impersonation executed at scale,” its report says. The operation is known both as Doppelgänger and as “Reliable Recent News.” Tactics vary depending on the target country but the underlying aim is the same; to undermine democratic structures by sowing distrust and polarisation.
Privacy: Proton makes a big deal of its focus on protecting its users’ privacy. The only problem is that when push comes to official shove there’s only going to be one outcome. Not surprising then that Proton has just handed billing information about a user to Swiss police, who promptly passed it on to the FBI. The reality is that no hosted service can guarantee the privacy of its users.
Oops: Some lessons from an incident in which the Western Australia government lost the data of residents as well as thousands of dollars.
The state auditor found that government agencies had failed to configure Microsoft 365 securely, using legacy authentication methods, weak MFA methods, and failing to enable data loss protection controls.
Suspended: X says it removed 799 million accounts for spam and manipulation in 2024. It’s an impressive number, especially as it’s nearly double the number of monthly users reported for that period. For context, X told a UK parliamentary committee that “every single day there are billions of attempts to create accounts on X that we are able to thwart.”
Oversharing: We’re firm believers that nothing should be shared online unless you’d be comfortable seeing it made public online. Because you can bet sooner or later it will be. So it proved with a popular app that promised to help men stop watching pornography. As 404 Media reports, Quittr managed to leak intimate data about hundreds of thousands of its users. And when told about the issue, failed to fix it.
Updates
Apple: Updates for older iPhone and iPad models running iOS 15 and iOS 16, addressing the Coruna spyware kit we covered last week. Do install the update if you have an iPhone or iPad that no longer receives the latest operating system versions.
Microsoft: Windows Hotpatch will be enabled by default for supported systems starting in May. The feature allows security updates to be installed without restarting the operating system. The aim is to reduce downtime and make it more likely that updates are applied promptly.
Google: Maps is the latest Google app to get the Gemini AI treatment. It’s billed as delivering the largest navigation upgrade in more than a decade and, among other things, will introduce 3D driving directions and allow users to ask detailed questions.
Apple: We don’t usually cover much news about hardware, but Apple’s announcement of a budget laptop has caused sufficient upset among PC manufacturers that it’s worth a mention. The MacBook Neo uses the same type of processor found in iPhones. It sells for $600/£600 and early reviews are excellent. Competitors admit they’re working out how to react.
WhatsApp: Meta is introducing parent-managed accounts for users under 13. The restricted accounts won’t include features such as Meta AI, Channels and Status updates.
Chrome: Google has issued an emergency update to address two previously unknown (“zero-day”) issues that are already being exploited.
Patch Tuesday: Monthly security updates from Adobe, Microsoft,IBM, Dell, SAP, HPE,Fortinet, Ivanti,Intel, and Firefox.