Daily Drop (827): | Open Source AI | Telegram API | PHP Vul. | Paris Olympics | PyPI: macOS | HK: Cyber Law | AI Cyber Crime | RU: Shadow War | SK Hynix | Chrome | CN: PlugX | Apple AI | DoJ: TikTok |

07-27-24

Jul 27, 2024

Saturday, Jul 27 2024 // (IG): BB // ShadowNews // Coffee for Bob

Measures of Effectiveness (MoE):

MoEs are used to assess how well a system or operation achieves its intended goals. They are qualitative or quantitative metrics that reflect the success of achieving desired outcomes. For example, in a cybersecurity context, an MoE could be the reduction in successful cyber-attacks after implementing new security protocols.

Results: We are seeing an uptick in “163.com”, “189.com” and “QQ” subscribers.

Apple Joins U.S. Voluntary AI Risk Management Scheme

Bottom Line Up Front (BLUF): Apple Inc. has signed on to President Joe Biden's voluntary AI commitments, joining 15 other tech firms in a pledge to ensure AI technologies are used responsibly and safely.

Analyst Comments: Apple's participation in the U.S. government's voluntary AI risk management scheme highlights the growing consensus among tech giants on the importance of ethical AI development. This move aligns Apple with other leading firms, enhancing collaborative efforts to mitigate the risks associated with AI while promoting its benefits.

FROM THE MEDIA: Apple has signed onto U.S. President Joe Biden's voluntary AI commitments, joining firms like Google and Microsoft, which initially committed in July 2023. This initiative aims to prevent the misuse of AI technologies. As part of the commitment, these companies will adhere to guidelines ensuring AI's ethical development and deployment. This collective action underscores the tech industry's acknowledgment of the potential risks and its role in addressing them.

READ THE STORY: Reuters

Intel Hires Micron Executive to Lead Foundry Business

Bottom Line Up Front (BLUF): Intel has appointed Dr. Naga Chandrasekaran from Micron to oversee its foundry operations, aiming to transform its internal manufacturing into a profitable business.

Analyst Comments: This strategic move signifies Intel's commitment to revitalizing its foundry business amid rising operational costs and competition. Chandrasekaran's extensive experience at Micron positions him well to drive Intel's foundry ambitions, potentially making it a formidable competitor to industry leader TSMC by 2030.

FROM THE MEDIA: Intel has recruited Dr. Naga Chandrasekaran, a senior executive from Micron, to head its Foundry Manufacturing and Supply Chain organization. This appointment is part of Intel's strategy to pivot its internal manufacturing operations toward external contract manufacturing. Chandrasekaran, who has been with Micron since 2001, will assume his new role on August 12, 2024, and will report directly to Intel CEO Pat Gelsinger. This change comes as Intel aims to address the high costs of advanced fabrication technology and seeks to achieve profitability in its foundry business by 2027, with aspirations to become the second-largest global foundry by 2030.

READ THE STORY: The Register

Open Source AI Has Founders—and the FTC—Buzzing

Bottom Line Up Front (BLUF): Y Combinator recently hosted an event where founders, venture capitalists, and policymakers, including FTC Chair Lina Khan, discussed the burgeoning role of open-source AI in the tech industry and its implications for competition between startups and established tech giants.

Analyst Comments: The event underscores the growing significance of open-source AI as a competitive frontier. The presence of high-profile figures like Lina Khan indicates heightened regulatory interest in ensuring a level playing field. The discussions likely centered around balancing innovation with oversight to prevent monopolistic practices by big tech firms.

FROM THE MEDIA: On July 25, 2024, Y Combinator's event in San Francisco brought together a diverse group of stakeholders to explore the impact of open-source AI on the tech landscape. The discussions highlighted how startups can leverage open-source AI to challenge established tech companies. FTC Chair Lina Khan's participation signals increased regulatory focus on maintaining competition and preventing dominance by a few large players. This event reflects the broader industry trend of democratizing AI technology while navigating the regulatory challenges it presents.

READ THE STORY: Wired

Threat Actors Exploit Telegram APIs to Steal Login Credentials

Bottom Line Up Front (BLUF): Cybercriminals are using Telegram APIs to covertly steal user login credentials through sophisticated phishing campaigns. The attacks involve deceptive landing pages and malicious JavaScript to exfiltrate sensitive information to Telegram bots.

Analyst Comments: This incident underscores the growing sophistication of phishing attacks, leveraging popular communication platforms like Telegram for covert data exfiltration. The integration of API misuse in phishing schemes highlights the need for heightened vigilance and advanced security measures to protect against such evolving threats. Regularly updating security protocols and educating users about phishing tactics are crucial to mitigate these risks.

FROM THE MEDIA: Threat actors are exploiting Telegram APIs to conduct phishing attacks aimed at stealing users' login credentials. Victims are lured by phishing emails with disguised URLs leading to deceptive landing pages. These pages use JavaScript and jQuery to handle form submissions and send stolen credentials to Telegram bots. The script captures email, password, IP address, and browser details, and communicates this data to a Telegram chat. Despite the sophistication of these attacks, vigilant security practices and user awareness can help mitigate the risks posed by such phishing schemes

READ THE STORY: CSN

New Chrome Feature Scans Password-Protected Files for Malicious Content

Bottom Line Up Front (BLUF): Google has enhanced Chrome's security by introducing new warnings for suspicious and malicious downloads and adding automatic deep scans for files, including those within password-protected archives. This update aims to help users make informed decisions and improve download protection.

Analyst Comments: This update is a significant advancement in browser security, particularly for users who handle sensitive information and frequently download files. By offering detailed warnings and deep scan options, Google is proactively addressing potential threats, thereby enhancing user trust and safety. However, the feature's reliance on users to opt into Enhanced Protection mode might limit its overall effectiveness.

FROM THE MEDIA: Google has updated Chrome to provide more nuanced warnings for potentially dangerous downloads and introduced automatic deep scans for Enhanced Protection mode users. This includes the ability to scan password-protected files if users provide the password. The new system aims to better inform users about the nature of download risks and enhance overall browser security.

READ THE STORY: THN

SideWinder APT Group Targets Maritime Facilities in Possible Espionage Campaign

Bottom Line Up Front (BLUF): The SideWinder APT group, suspected to be of Indian origin, is conducting a sophisticated espionage campaign targeting maritime facilities in the Indian Ocean and Mediterranean Sea, exploiting older Microsoft Office vulnerabilities.

FROM THE MEDIA: Researchers have identified a new campaign by the SideWinder APT group targeting maritime facilities in the Indian Ocean and Mediterranean Sea. The campaign, likely aimed at espionage, targets ports in Pakistan, Egypt, and Sri Lanka, with subsequent stages focusing on Bangladesh, Myanmar, Nepal, and the Maldives. SideWinder employs sophisticated spear-phishing techniques, exploiting older Microsoft Office vulnerabilities (CVE-2017-0199 and CVE-2017-11882). The attack begins with phishing emails containing malicious documents mimicking legitimate port infrastructure communications. Upon opening these documents, a remote template injection technique is used to gain initial access, followed by further exploitation using rich text format (RTF) files. The campaign employs various obfuscation techniques, including the use of an old Tor node to mask online traffic. Researchers emphasize the importance of patching systems and implementing advanced email filtering and threat detection solutions to counter such sophisticated attacks.

READ THE STORY: The Cyber Express

SK Hynix to Invest $6.8 Billion in New South Korea Chip Plant

Bottom Line Up Front (BLUF): SK Hynix, the world's second-largest memory chip maker and a key Nvidia supplier, has announced a $6.8 billion investment in a new semiconductor plant in Yongin, South Korea, to meet rising AI chip demand.

Analyst Comments: This strategic investment underscores SK Hynix's commitment to expanding its manufacturing capabilities and capitalizing on the growing demand for AI semiconductors. By establishing a significant presence in Yongin, SK Hynix aims to strengthen its competitive position and ensure long-term growth in a rapidly evolving tech landscape.

FROM THE MEDIA: SK Hynix will invest approximately 9.4 trillion won ($6.8 billion) in its first chip plant in Yongin, South Korea, as part of a larger plan to construct four plants in the semiconductor cluster. This initiative is driven by the rising demand for AI semiconductors and the company's recent strong earnings performance. The investment will cover infrastructure and a research facility, to bolster mid- to long-term growth. This move follows SK Hynix's earlier announcement of a $3.87 billion investment in an advanced packaging plant in Indiana, USA.

READ THE STORY: Reuters

PHP Vulnerability Exploited for Malware and DDoS Attack

Analyst Comments: The rapid exploitation of CVE-2024-4577 highlights the critical need for timely updates and proactive cybersecurity measures. The ability of threat actors to quickly weaponize such vulnerabilities underscores the importance of maintaining up-to-date software and employing robust security practices. This incident serves as a reminder of the ever-evolving nature of cyber threats and the necessity for constant vigilance.

FROM THE MEDIA: The PHP vulnerability CVE-2024-4577, with a critical severity score of 9.8, is being actively exploited by cybercriminals to deliver various malicious payloads, including crypto miners, DDoS botnets, and remote access trojans. First discovered in June 2024, the flaw allows attackers to execute malicious commands on Windows systems by escaping the command line and passing arguments directly to PHP. Researchers from Akamai and Imperva observed exploits against their honeypot servers within 24 hours of the vulnerability becoming public knowledge. The attackers used this flaw to deploy malware like Gh0st RAT, RedTail, XMRig, and the DDoS botnet Muhstik. The urgency of updating PHP installations to the latest versions is paramount to mitigate these threats and safeguard against potential attacks

READ THE STORY: Security Boulevard // PoC: CVE-2024-4577

French Authorities Launch Operation to Remove PlugX Malware from Infected Systems

Bottom Line Up Front (BLUF): French judicial authorities, in collaboration with Europol, have initiated a "disinfection operation" to remove PlugX malware from compromised systems across several European countries. This effort follows the acquisition of a command-and-control server by cybersecurity firm Sekoia, which led to the identification of nearly 100,000 infected IP addresses.

Analyst Comments: The extensive use of PlugX by China-affiliated threat actors highlights the persistent threat of sophisticated malware in global cyber operations. This coordinated response by French authorities and Europol underscores the importance of international collaboration in combating cyber threats. The success of such operations relies heavily on timely intelligence sharing and robust response mechanisms.

FROM THE MEDIA: The operation to dismantle PlugX malware, led by French authorities and Europol, began on July 18 and is expected to last several months. Nearly 100,000 IP addresses were found to be sending PlugX requests daily to a seized command-and-control server. The malware, used extensively by Chinese threat actors, is known for its ability to execute arbitrary commands and propagate via USB drives. The disinfection effort is already benefiting victims in multiple European countries, showcasing the importance of international cooperation in addressing cyber threats.

READ THE STORY: THN

Nigeria's Dangote Refinery Reselling Crude Amid Technical Issues

Bottom Line Up Front (BLUF): Nigeria's Dangote Refinery has been reselling U.S. and Nigerian crude oil due to operational issues, although the refinery's spokesperson denies these claims. This development impacts crude prices and raises questions about the refinery's operational stability.

Analyst Comments: The reselling of crude oil by the Dangote Refinery, reportedly due to technical problems, underscores potential challenges in achieving operational stability. This situation highlights the refinery's critical role in Nigeria's fuel independence ambitions and its potential impact on the global oil market. Resolving these issues is crucial for maintaining investor confidence and ensuring the refinery's long-term success.

FROM THE MEDIA: The Dangote Refinery, the largest in Africa and set to transform Nigeria's fuel market, has reportedly been reselling cargoes of U.S. and Nigerian crude due to technical issues. The refinery began production in January and aims to reduce Nigeria's reliance on fuel imports. Despite official denials, sources indicate that grades like Nigerian Escravos and U.S. WTI Midland crude are being offered for resale. This has contributed to a decline in crude prices, with Brent crude falling towards $80 a barrel before stabilizing above $81.

READ THE STORY: Reuters

Paris Olympics’ Cyber Team Braces for Onslaught From Hackers

Bottom Line Up Front (BLUF): With the Paris Summer Olympics on the horizon, organizers are gearing up for an anticipated wave of cyberattacks. Previous attacks on events and ongoing geopolitical tensions have heightened concerns. A coordinated effort involving local and international cybersecurity experts aims to safeguard critical infrastructure and minimize disruptions.

Analyst Comments: The Paris 2024 Summer Olympics faces significant cybersecurity challenges, echoing previous incidents where major events were targeted. With Russia's exclusion from the Games and the heightened geopolitical landscape, the threat environment is particularly volatile. The coordinated efforts between French and US cybersecurity agencies, alongside private sector partners, reflect a comprehensive approach to mitigating these risks. Nonetheless, the focus on less obvious targets, such as hotels and restaurants, underscores the complexity and breadth of potential vulnerabilities.

FROM THE MEDIA: Last month, websites for a French film festival and the Grand Palais in Paris were shut down by cyberattacks linked to Russian-affiliated hacktivists. These incidents are seen as precursors to larger-scale attacks during the Summer Olympics. A cybersecurity task force, involving over 500 entities and a joint operations center with US CISA, is actively working to secure the Games. While traditional targets are expected to be well-protected, concerns remain about the vulnerability of "soft targets" like hotels and restaurants. Historical precedents, such as the 2018 Winter Games attacks, highlight the persistent threat posed by state-affiliated hackers. Ongoing disinformation campaigns further complicate the cybersecurity landscape, aiming to undermine public confidence and disrupt the event.

READ THE STORY: Bloomberg

Malicious PyPI Package Targets macOS to Steal Google Cloud Credentials

Bottom Line Up Front (BLUF): A malicious PyPI package named "lr-utils-lib" targeting macOS systems has been discovered. It was designed to steal Google Cloud credentials from a specific set of machines. Although it had only 59 downloads before removal, it highlights the ongoing risks of supply chain attacks.

Analyst Comments: This incident underscores the persistent threat posed by supply chain attacks, particularly those targeting specific environments like macOS. The use of predefined hashes to target specific systems indicates a high level of sophistication and prior reconnaissance by the threat actors. Enterprises must enhance their security measures to detect and mitigate such threats, especially in development environments where third-party packages are commonly used.

FROM THE MEDIA: The malicious package "lr-utils-lib" was uploaded to PyPI in June 2024 and downloaded 59 times before being taken down. It targets macOS systems, using predefined hashes to identify specific machines and steal Google Cloud credentials. The stolen data is sent to a remote server. This attack follows a similar pattern to previous campaigns, showing that threat actors have specific targets and are using sophisticated methods to distribute their malware. This emphasizes the need for vigilance and robust security practices in managing dependencies and third-party packages.

READ THE STORY: THN

US DOJ Requests Court to Uphold TikTok Sale Mandate

Bottom Line Up Front (BLUF): The US Department of Justice (DOJ) has asked a federal appeals court to uphold a law requiring ByteDance to sell TikTok's US assets by January 19, 2025, or face a ban, citing national security concerns.

Analyst Comments: The DOJ's push to enforce the sale of TikTok’s US assets underscores ongoing tensions between the US and China over data security and digital sovereignty. With TikTok having a significant user base in the US, the decision will have major implications for social media, data privacy, and US-China relations. The timing of the court hearing, close to the 2024 presidential election, adds a layer of political complexity, influencing public sentiment and potential election outcomes.

FROM THE MEDIA: The DOJ's recent filing argues that TikTok, under Chinese ownership, poses a national security threat due to potential data access and covert content manipulation by the Chinese government. Despite TikTok's denials of data sharing or content manipulation, the DOJ emphasized the need to mitigate risks before any detrimental actions occur. This legal challenge puts the spotlight on the broader implications of tech ownership and data privacy in international relations.

READ THE STORY: Reuters

Hong Kong Moves Toward First Cybersecurity Legislation

Bottom Line Up Front (BLUF): Hong Kong has unveiled its first comprehensive cybersecurity legislation to regulate Critical Infrastructure Operators (CIOs) and Critical Computer Systems (CCS), aligning with similar frameworks in mainland China, Australia, and the United States. The proposed legislation aims to enhance the security and reliability of critical infrastructure amidst rising cyberattacks.

Analyst Comments: Hong Kong's initiative to introduce its first cybersecurity legislation marks a significant step towards fortifying its digital defenses. This framework mirrors regulatory measures in other regions, emphasizing the importance of regular risk assessments, incident reporting, and the establishment of dedicated cybersecurity teams. The proposed measures, though ambitious, face challenges, including tight compliance timelines, sector definitions, third-party provider impacts, and talent shortages. Balancing robust security with operational feasibility will be critical for successful implementation.

FROM THE MEDIA: In response to increasing cyber threats, Hong Kong has proposed its first cybersecurity framework targeting Critical Infrastructure Operators (CIOs) and Critical Computer Systems (CCS). The framework will be overseen by a new Commissioner’s Office under the Security Bureau. Key elements include organizational, preventive, and incident response obligations for CIOs. The framework's design aligns with cybersecurity regulations in regions like Singapore and China but also presents unique challenges, such as compliance timelines and sector definitions. The government aims to introduce a bill by the end of 2024, with enforcement expected by late 2025 or mid-2026.

READ THE STORY: The Cyber Express

China Warns Philippines Over US Missile Deployment

Bottom Line Up Front (BLUF): Chinese Foreign Minister Wang Yi has cautioned the Philippines against deploying US intermediate-range missiles, claiming it could escalate regional tensions and spark an arms race. The warning comes amid heightened China-Philippines confrontations in the South China Sea.

Analyst Comments: The deployment of US missiles in the Philippines marks a significant escalation in the geopolitical tensions between China, the US, and their respective allies in Southeast Asia. China's response highlights its concern over US military influence in the region, which Beijing views as a direct threat to its strategic interests. This development could potentially destabilize the already volatile South China Sea, where sovereignty disputes have been a longstanding issue. The situation underscores the delicate balance of power in the region and the need for diplomatic engagement to prevent further escalation.

FROM THE MEDIA: Chinese Foreign Minister Wang Yi warned that the introduction of US intermediate-range missiles in the Philippines would create regional tension and provoke an arms race. This statement was made during a meeting with Philippine Foreign Secretary Enrique Manalo in Laos. Wang emphasized that China's relations with the Philippines are at a critical juncture and called for dialogue and consultation. He also mentioned a recent temporary arrangement with the Philippines concerning the Second Thomas Shoal to maintain maritime stability. The Philippines' military and foreign ministry have not yet responded to these remarks.

READ THE STORY: Reuters

AI-Powered Cybercrime Service Targets Global Financial Institutions with Phishing Kits and Malicious Android Apps

Bottom Line Up Front (BLUF): The GXC Team, a Spanish-speaking cybercrime group, is using AI to enhance phishing-as-a-service (PaaS) platforms, bundling phishing kits with Android malware. This sophisticated service targets users of 36 Spanish banks and other institutions worldwide, including in the US, UK, Slovakia, and Brazil.

Analyst Comments: The integration of AI into cybercrime services represents a significant escalation in the sophistication and effectiveness of phishing attacks. By leveraging AI, threat actors can create more convincing phishing scenarios and automate complex tasks, making it easier to target a broader range of victims and evade detection. The combination of phishing kits with malicious Android apps highlights the growing trend of multifaceted cyber threats that exploit various vectors to maximize impact.

FROM THE MEDIA: The GXC Team has developed a sophisticated AI-powered PaaS platform that includes phishing kits priced between $150 and $900 a month. A bundled package with Android malware is available for $500 per month. This service targets users of financial institutions and other sectors globally, using 288 identified phishing domains. The phishing attacks prompt victims to download a fake banking app, which intercepts OTPs and exfiltrates them to a Telegram bot controlled by the attackers. Additionally, AI-powered voice-calling tools are used to enhance phishing attempts, making them more convincing. This development underscores the rapid adoption of AI tools by cybercriminals to transform traditional fraud scenarios into more sophisticated tactics.

READ THE STORY: THN

Russia’s Shadow War Against Europe: Cyber Attacks on Microsoft Infrastructure Surge

Bottom Line Up Front (BLUF): New research reveals a significant increase in brute force cyber attacks originating from Russia targeting corporate and institutional networks across Europe. Russian threat actors are exploiting Microsoft infrastructure to avoid detection, aiming to exfiltrate sensitive data, disrupt services, and deploy malware.

Analyst Comments: The surge in brute force attacks linked to Russian IP addresses underscores the ongoing cyber warfare against European entities. By leveraging Microsoft's infrastructure, Russian threat actors can enhance their attack range and effectiveness while evading detection. This strategy not only highlights the sophistication of these cyber operations but also the importance of robust cybersecurity measures across Europe to mitigate such threats.

FROM THE MEDIA: Heimdal's research indicates a dramatic rise in brute force attacks targeting European networks, primarily from Russian IP addresses. These attacks, active since at least May 2024, exploit Microsoft infrastructure in the Netherlands and Belgium. The attackers use techniques such as SMBv1 and RDP crawlers to crack weak passwords and gain access to critical systems. Over 60% of the attack IPs are new, with the remainder being previously compromised. The motivations behind these attacks include data theft, service disruption, and financial gain. Heimdal's founder, Morten Kjaersgaard, notes that the attacks represent a hybrid war on Europe, potentially involving state or other nefarious actors with strong ties to China.

READ THE STORY: Tech Radar

Google DeepMind's AI Models Earn Silver Medal at Math Olympiad

Bottom Line Up Front (BLUF): Google DeepMind's AlphaProof and AlphaGeometry 2 AI models secured a silver medal at the International Mathematical Olympiad (IMO), solving complex math problems but struggling with time constraints.

Analyst Comments: DeepMind's achievement underscores significant advancements in AI's ability to tackle complex mathematical problems. Despite their success, the models' need for prolonged problem-solving time highlights ongoing challenges in AI efficiency and real-time application. This progress, however, marks a crucial step towards more sophisticated AI capable of aiding in fields requiring rigorous logical reasoning and formal verification.

FROM THE MEDIA: Google DeepMind's AI models, AlphaProof and AlphaGeometry 2, have achieved a silver medal-level performance at the International Mathematical Olympiad (IMO), solving four out of six problems. AlphaProof utilizes a combination of a language model and the AlphaZero reinforcement learning algorithm to generate and verify mathematical proofs. AlphaGeometry 2 integrates a neural language model with a rule-bound deduction engine for geometric proofs. Although successful, the models took much longer than the allotted competition time, requiring up to three days to solve some problems. DeepMind continues to refine these models, aiming for faster and more accurate performance in future iterations.

READ THE STORY: The Register

Items of interest

Ukraine's Cyber Offensive Targets Russian Financial and Digital Infrastructure

Bottom Line Up Front (BLUF): Ukrainian Defense Intelligence (GUR) has launched a significant cyberattack on Russian digital infrastructure, impacting major banks, payment systems, social media, and internet providers. The attack aims to disrupt the Kremlin's war efforts, resulting in widespread service outages across Russia.

Analyst Comments: This cyber offensive by Ukraine marks a notable escalation in the digital battleground of the ongoing conflict. Targeting critical financial and communication systems aims to create widespread disruption and undermine Russia's stability from within. This strategy reflects the increasing role of cyber warfare in modern conflicts, highlighting the need for robust cyber defenses and resilience planning in national security frameworks.

FROM THE MEDIA: Ukrainian GUR's cyberattack began on July 23, focusing on Russia's largest banks, including Alfa Bank, SberBank, and VTB Bank. The attack expanded to include social media platform VK, Discord messenger, and key payment systems like SBP and NSPK. As a result, many financial services in Russia are disrupted, with users unable to access accounts or complete transactions. The attack also affected major internet providers, further complicating communication and service restoration efforts. Some Russian media have labeled the incident as an "Internet apocalypse," indicating the scale and impact of the cyber offensive.

READ THE STORY: UKRINFORM

Drone attack: 75 Ukrainian drones hit targets across Russia (Video)

FROM THE MEDIA: Smoke can be seen rising from the refinery buildings after several successful hits. Morozovsk airfield, around 100 miles east of Luhansk, was also targeted. It is the third time the airfield, which houses Su-34 jets, has been struck by drones. The previous attacks damaged aircraft hangars and may have disabled some aircraft. Another airfield, this one in nearby Millerovo, was also among the Ukrainian targets. Video showed a large fire as fuel burned, with locals reporting 16 explosions.

Are Hackers the Biggest Threat to America’s Critical Infrastructure? (Video)

FROM THE MEDIA: As Iran ramps up its offensive cyber operations, American critical infrastructure is increasingly vulnerable to attacks.

The stories selected cover a broad array of cyber threats and are intended to aid readers in framing key publicly discussed threats and overall situational awareness. InfoDom Securities does not endorse any third-party claims made in their original material or related links on their sites; the opinions expressed by third parties are theirs alone. For further questions, please contact InfoDom Securities at dominanceinformation@gmail.com.

Bob’s Newsletter

Discussion about this post