In today’s cybersecurity news…
Predator spyware spotted across several countries
Recorded Future’s Insikt Group reports that while US sanctions against Intellexa’s Predator spyware have seemingly slowed its overall use, it is still in use internationally. Researchers found evidence of its use in Iraq, Pakistan, Saudi Arabia, Kazakhstan, Angola, and Mongolia. Meanwhile, previous usage in Botswana, Egypt, and Trinidad and Tobago has fallen off. The researchers noted that this might not reflect a decline in actual usage. Instead, Intellexa made significant infrastructure changes to make it harder to detect. Amnesty International revealed this week that Intellexa can remotely access Predator customer logs, further exposing the company to liability for misuse.
Russia blocks FaceTime
Russia’s communications regulator, Roskomnadzor, announced it blocked Apple’s video-calling app as part of a continued crackdown on foreign tech allegedly used for criminal activity. The country has also recently imposed restrictions on YouTube, WhatsApp, Telegram, and Roblox. Without providing any evidence, the state regulator said, “According to law enforcement agencies, FaceTime is being used to organise and carry out terrorist attacks in the country, recruit perpetrators, and commit fraud and other crimes against Russian citizens.” So far, there has been no word from Apple on the move.
(Reuters)
Draft US cyber strategy set for January release
Cyberscoop’s sources say the Trump administration plans to release a five-page, six-part national cybersecurity strategy next month. This could also be followed by an executive order that would spur implementation. The six “pillars” in the document continue to focus on offensive cyber operations, making cyber regulations more uniform, strengthening the federal cyber workforce, streamlining procurement, protecting critical infrastructure, and planning for emerging technologies. Currently, the administration is soliciting feedback on the strategy from industry stakeholders, so the final text may change.
Brothers arrested for deleting government databases
The US Department of Justice arrested twin brothers Muneeb and Sohaib Akhter on charges related to insider threat activity against several government agencies. Both brothers worked as engineers at the federal contractor Opexus, using their access to allegedly delete up to 96 government databases impacting the IRS and General Services Administration back in February. In an even more bizarre twist, both brothers had previously pled guilty to charges tied to a US State Department data breach back in 2015, with each serving multiyear prison sentences. Both brothers denied wrongdoing in an interview with Bloomberg earlier this year.
(Axios)
Huge thanks to our sponsor, Vanta
Arizona sues Temu
Arizona Attorney General Kris Mayes announced the state filed suit against the Chinese online retail giant, claiming it collects large amounts of sensitive consumer information without consent. This includes GPS location data and apps installed on mobile devices. The state also alleges that Temu’s app code is deliberately designed to obfuscate security reviews. This isn’t the first state to take such action; Kentucky, Nebraska, and Arkansas also filed similar suits in recent months. All of this data collection comes against the backdrop that Temu is required to hand over data requested by the Chinese government, sparking potential national security concerns.
Reporters Without Borders targeted by Star Blizzard
Researchers at Sekoia report that the Russian-linked APT Star Blizzard carried out a phishing attack against a core member of Reporters Without Borders (RSF) using a ProtonMail account posing as a trusted contact. This email mentioned an attached document for review, but it was intentionally left off. When the contact asked for it, they sent a malicious PDF hosted on ProtonDrive. The attack was only unsuccessful because Proton blocked the user’s account. Sekoia found this a familiar pattern for Star Blizzard, seeing the approach used against other nonprofits as well, ultimately trying to inject malicious JavaScript into the victim’s ProtonMail sign-in page to steal credentials.
GhostFrame: a novel phishing framework
Iframe abuse is nothing new, but a new report from Barracuda details this new phishing framework built around it. GhostFrame uses an HTML file to spoof a landing page, with malicious behavior hidden in an iframe. Using the iframe allows attackers to quickly swap out phishing content and evade scanning while keeping its outward facade intact. The landing page uses dynamic code to generate a new, randomly generated subdomain every time a new visitor arrives. This then loads the iframe to harvest credentials. The lures to get the pages range from contract notices to HR updates.
Researcher flushes Kohler’s end-to-end encryption claims
Earlier this year, Kohler launched a smart camera for toilets called Dekoda, designed to analyze bowl content for gut health. In all its marketing, it claimed images sent for analysis were end-to-end encrypted. Security researcher Simon Fondrie-Teitler recently pointed out that, based on Kohler’s privacy policy, these are actually transmitted with TLS encryption. So they are encrytped in transit, but Kohler can access camera images. The researcher also pointed out that this opens the door for Kohler to use the images to train AI models. However, Kohler responded that its “algorithms are trained on de-identified data only.”