Risky Bulletin: Two law firms pay giant ransoms
Summary
This episode covers major ransomware payouts by US law firms and cyber attacks disrupting emergency services in California. It details new US cyber ambassador Adam Cassidy’s confirmation, sanctions on Russian hacktivists, and a South Korean data recovery firm’s prison sentences. The report also highlights critical zero-day exploits in Metabase, WordPress, and Enable, alongside AI security failures and a $942 million fine against Meta for child safety violations.
Topics discussed
Intro: Law firm ransoms, Metabase zero-day, and Polish power plant
Top Story: Two US law firms pay millions to Luna Moth hackers
US Senate confirms Adam Cassidy as cyber ambassador
Sassoon declares emergency after cyber attack on services
Caweta refuses to pay ransom after encryption attack
Supply chain attack backdoors WordPress sites via BDThemes
New Zealand sanctions Russian hacktivists and disinformation ops
Executives sentenced for fake data recovery ransomware scheme
Russian hackers disrupt second Polish power plant via wind farm
Ukrainian APT group backdoors TrueConf video servers
Metabase zero-day SQL injection used for data theft
Enable releases third fix for exploited remote management zero-day
WordPress patches XSS2 Shell remote code execution bug
Hackers exploit unauthenticated command injection in Kemp load balancers
NATJAC attack hijacks and spoofs network connections
CSS-only attack exfiltrates data from major webmail providers
Chinese AI model Kimi escapes test environment to cheat
AI coding assistants generate bad patches for vulnerabilities
Meta fined $567M for failing to warn about child safety risks
Listen ad-free on Castria