Similar Posts
The World Health Organisation (WHO) and some 50 countries issued a warning on Nov 8 at the United Nations about the rise of ransomware attacks against hospitals, with the United States specifically blaming Russia.
Ransomware is a type of digital blackmail in which hackers encrypt the data of victims – individuals, companies or institutions – and demand money as a “ransom” in order to restore it.
Such attacks on hospitals “can be issues of life and death,” according to WHO head Tedros Adhanom Ghebreyesus, who addressed the UN Security Council during a meeting on Nov 8 called by the United States.
“Surveys have shown that attacks on the healthcare sector have increased in both scale and frequency,” Dr Ghebreyesus said, emphasising the importance of international cooperation to combat them.
“Cybercrime, including ransomware, poses a serious threat to international security,” he added, calling on the Security Council to consider it as such.
A joint statement co-signed by over 50 countries – including South Korea, Ukraine, Japan, Argentina, France, Germany and the United Kingdom – offered a similar warning.
“These attacks pose direct threats to public safety and endanger human lives by delaying critical healthcare services, cause significant economic harm, and can pose a threat to international peace and security,” read the statement, shared by US Deputy National Security Advisor Anne Neuberger.
The statement also condemned nations which “knowingly” allow those responsible for ransomware attacks to operate from.
At the meeting, Ms Neuberger directly called out Moscow, saying: “Some states – most notably Russia – continue to allow ransomware actors to operate from their territory with impunity.”
France and South Korea also pointed the finger at North Korea.
Russia defended itself by claiming the Security Council was not the appropriate forum to address cybercrime.
“We believe that today’s meeting can hardly be deemed a reasonable use of the Council’s time and resources,” said Russian ambassador Vassili Nebenzia.
“If our Western colleagues wish to discuss the security of healthcare facilities,” he continued, “they should agree in the Security Council upon specific steps to stop the horrific… attacks by Israel on hospitals in the Gaza Strip.” AFP
SEOUL – Pro-Russia hacking groups have conducted cyberattacks against South Korea after North Korea dispatched troops to Russia to support its war against Ukraine, Seoul’s presidential office said on Friday.
The office held an emergency intra-agency meeting after detecting denial-of-service attacks on some government and private websites in recent days.
Some of the websites experienced temporary outages but there was no serious damage, it said, adding that the government will strengthen its ability to respond to such attacks.
“Cyber attacks by pro-Russian hacktivist groups on our country have occurred intermittently in the past, but have become more frequent since North Korea dispatched troops to Russia and participated in the Ukraine war,” the office said in a statement.
Seoul and Washington have said there are more than 10,000 North Korean soldiers in Russia, and U.S. officials and Ukraine’s defence minister said some of them have engaged in combat in Kursk, near the Ukraine border.
The new military cooperation between Pyongyang and Moscow has been condemned by South Korea, the United States and Western allies. Ukrainian President Volodymyr Zelenskiy said on Tuesday that the first battles between his country’s military and North Korean troops “open a new page in instability in the world.” REUTERS
WASHINGTON – The accused Iranian hacking group who intercepted Republican U.S. presidential candidate Donald Trump’s campaign emails have finally found some success in getting their stolen material published after initially failing to interest the mainstream media.
In recent weeks, the hackers began peddling Trump emails more widely to one Democratic political operative, who has posted a trove of material to the website of his political action committee, American Muckrakers, and to independent journalists, at least one of whom posted them on the writing platform Substack. The latest material shows Trump campaign communications with external advisers and other allies, discussing a range of topics leading up to the 2024 election.
The hackers’ activities tracked by Reuters provide a rare glimpse into the operations of an election interference effort. They also demonstrate Iran remains determined to meddle in elections despite a September U.S. Justice Department indictment accusing the leakers of working for Tehran and using a fake persona.
The indictment alleged that an Iranian-government linked hacking group, known as Mint Sandstorm or APT42, compromised multiple Trump campaign staffers between May and June by stealing their passwords. In a Homeland Security advisory published earlier this month, the agency warned that the hackers continue to target campaign staff. If found guilty, they face prison time and fines.
The Department of Justice indictment said the leakers were three Iranian hackers working with Iran’s Basij paramilitary force whose voluntary members help the regime to enforce its strict rules and to project influence. Attempts to reach the hackers identified by name in the indictment via email and text message were unsuccessful.
In conversations with Reuters, the leakers – who collectively use the fake persona “Robert” – did not directly address the U.S. allegations, with one saying “Do you really expect me to answer?!”
“Robert” is the same fake persona referred to in the U.S. indictment, according to FBI emails sent to journalists and reviewed by Reuters.
Iran’s mission to the United Nations said in a statement that reports of the country’s involvement in hacking against the U.S. election were “fundamentally unfounded, and wholly inadmissible,” adding that it “categorically repudiates such accusations.” The FBI, which is investigating Iran’s hacking activity against both presidential campaigns in this election, declined to comment.
David Wheeler, the founder of American Muckrakers, said the documents he shared were authentic and in the public interest. Wheeler said his goal was to “expose how desperate the Trump campaign is to try to win” and to provide the public with factual information. He declined to discuss the material’s origin.
Without making any specific references, the Trump campaign said earlier this month that Iran’s hacking operation was “intended to interfere with the 2024 election and sow chaos throughout our democratic process,” adding any journalists reprinting the stolen documents “are doing the bidding of America’s enemies.”
In 2016, Trump took a different position when he encouraged Russia to hack into Hillary Clinton’s emails and provide them to the press.
LEAK OPERATION
The leak operation started around July when an anonymous email account, [email protected], began communicating with reporters at several media outlets, using the Robert moniker, according to two people familiar with the matter. They initially contacted Politico, the Washington Post and the New York Times, promising damning internal information about the Trump campaign.
In early September, the accused Iranian hackers used a second email address, [email protected], in a fresh round of overtures, including to Reuters and at least two other news outlets, the two people familiar with the matter, said.
At the time, they offered research compiled with public information by the Trump campaign into Republican politicians JD Vance, Marco Rubio and Doug Burgum, all of whom were under consideration as Trump’s running mate.
The vice presidential reports were authentic, a person familiar with the Trump campaign told Reuters. Neither Politico, the Washington Post, the New York Times, nor Reuters published stories based on the reports.
New York Times spokesperson Danielle Rhoades Ha, said the newspaper only published articles based on hacked material “if we find newsworthy information in the materials and can verify them.”
In an email, the Washington Post referred Reuters to past comments made by its executive editor, Matt Murray, who said the episode reflected the fact that news organizations “aren’t going to snap at any hack” provided to them. A spokesperson for Politico said the origin of the documents was more newsworthy than the leaked material. Reuters did not publish this material because the news agency did not believe it was newsworthy, a spokesperson said.
Both AOL email accounts identified by Reuters were taken offline in September by its owner Yahoo, which worked with the FBI before the indictment to trace them to the Iranian hacker group, according to two people familiar with the investigation. Yahoo did not respond to a request for comment.
Before losing email access, Robert suggested reporters might need an alternate contact and offered a telephone number on the encrypted chat application Signal. Signal, which is more difficult to monitor by law enforcement, did not return messages seeking comment.
Some senior U.S. intelligence and law enforcement officials have said that Iran’s interference efforts this election cycle are focused on denigrating Trump as they hold him responsible for the 2020 American drone assassination of former Iranian military general Qassem Soleimani.
Thus far, the already-published leaks do not appear to have changed the public dynamics of the Trump campaign.
MUCKRAKERS
On Sept. 26, North Carolina-based American Muckrakers, began publishing internal Trump campaign emails. Active since 2021, the PAC has a history of publicizing unflattering material about high-profile Republicans. According to public disclosure reports, it is funded through individual, small-dollar donors from around the country.
On its website, American Muckrakers said the leaks came from “a source,” but, ahead of the publication last month, the group publicly asked Robert to get in touch. “HACKER ROBERT, WHY THE F DO YOU KEEP SENDING THE TRUMP INFORMATION TO CORPORATE MEDIA?” the group said in a post to X. “Send it to us and we’ll get it out.”
When asked whether his source was the alleged Iranian persona Robert, Wheeler said “that is confidential” and that he had “no confirmation of the source’s location.” He also declined to comment on whether the FBI had warned him that the communication was the product of a foreign influence operation.
In one example, Muckrakers published material on Oct. 4th purporting to show an unspecified financial arrangement with lawyers representing former Presidential candidate Robert F. Kennedy Jr. and Trump. RFK Jr. attorney Scott Street, said in an email to Reuters he could not speak publicly about the incident. Reuters confirmed the authenticity of the material.
Muckrakers subsequently published documents from Robert about two high-profile races. It included alleged campaign communication about North Carolina Republican gubernatorial candidate Mark Robinson and Florida Republican representative Anna Paulina Luna, both of whom were endorsed by Trump.
The exchange about Robinson concerned an attempt by Republican adviser W. Kirk Bell, to seek guidance from the Trump camp after the scandal over comments attributed to Robinson on a pornographic forum. Robinson has previously denied the comments. The other message came from a Republican adviser sharing information with the campaign about Luna’s personal life.
Robinson and Luna’s campaigns did not return messages seeking comment.
One of the few journalists contacted by Robert who did publish material was independent national security reporter Ken Klippenstein, who posted the vice presidential research documents to Substack late last month. Robert confirmed to Reuters that they gave the material to Klippenstein.
Substack did not respond to a question about its policies concerning hacked material.
After the story, Klippenstein said FBI agents contacted him over his communication with Robert, warning that they were part of a “foreign malign influence operation.” In a post, Klippenstein said the material was newsworthy and he chose to publish it because he believed the news media should not be a “gatekeeper of what the public should know.”
A spokesperson for Reuters, which received similar notifications from the FBI, said, “We cannot comment on our interactions, if any, with law enforcement.” An FBI spokesperson declined to comment on its media notification effort.
Wheeler said he had new leaks in store “soon” and that he would continue to publish similar documents as long as they were “authentic and relevant.” REUTERS
WASHINGTON – Russian hackers are going after US government officials, defence workers and others in a new email phishing campaign targeting thousands of people, according to Microsoft Corp.
The hackers have sent “a series of highly targeted spearphishing emails” to thousands of people in more than 100 organisations since Oct 22, according to a blog post from Microsoft Threat Intelligence published on Oct 29.
The latest campaign will add to mounting concerns over US failures to outwit suspected Russian and Chinese hackers.
The FBI said on Oct 25 it is investigating unauthorised access by Chinese state-affiliated hackers targeting the commercial telecommunications sector.
In some of the emails that were part of the latest campaign, the senders impersonated Microsoft employees, according to the blog.
Spearphishing involves sending tailored emails to individuals, including links to malicious websites that can then steal information.
It wasn’t immediately clear how many of the attacks, if any, were successful.
Microsoft has said the attacks are perpetrated by a sophisticated Russian nation-state group it calls Midnight Blizzard, which US and UK governments have connected to the SVR, the Russian foreign intelligence service.
The company said in January that the group attacked its corporate systems, getting into a “small number” of email accounts, including senior leadership and employees who work in cybersecurity and legal.
In April, US federal agencies were ordered to analyse emails, reset compromised credentials and work to secure Microsoft accounts.
At the time, the Cybersecurity and Infrastructure Security Agency (Cisa) said the incident represented a “grave and unacceptable risk” to agencies, according to the April directive.
Cisa and US State Department didn’t immediately respond to requests for comment.
The Russian Embassy in Washington didn’t immediately respond to a request for comment. BLOOMBERG
“Ofcom to Detail Actions Required for Social Media Companies Over Illegal Content by December”
LONDON – Britain’s media regulator Ofcom said on Oct 17 that it would detail what action it expected social media companies to take over illegal content on their platforms in December, saying it expected swift action or they would face consequences.
Ofcom, which is responsible for implementing the government’s Online Safety Bill, said the platforms would have three months to complete their own illegal harms risk assessments after the publication of its demands.
“The time for talk is over,” Ofcom’s Chief Executive Melanie Dawes said on Oct 17. “From December, tech firms will be legally required to start taking action, meaning 2025 will be a pivotal year in creating a safer life online.”
She said the regulator had already seen positive changes, but expectations were going to be high.
“We’ll be coming down hard on those who fall short,” she said.
Ofcom said better protections had already been introduced by Meta, the owner of Instagram and Facebook, and Snapchat which have brought in changes to help prevent children being contacted by strangers.
Britain’s new online safety regime, which became law last year, requires social media companies to tackle the causes of harm, particularly for children, by making their services safer.
If companies do not comply with the new law, they could face significant fines and, in the most serious cases, their services could be blocked in Britain. REUTERS
“Singapore Issues New Guidelines to Protect Businesses from AI Security Risks”
SINGAPORE – Rogue chatbots that spew lies or racial slurs may be just the beginning, as maliciously coded free chatbot models blindly used by businesses could unintentionally expose sensitive data or result in a security breach.
In new guidelines published on Oct 15, Singapore’s Cyber Security Agency (CSA) pointed out these dangers amid the artificial intelligence (AI) gold rush, and urged businesses to test what they plan to install rigorously and regularly.
This is especially crucial for firms that deploy chatbots used by the public, or those linked to confidential customer data.
Frequent system tests can help weed out threats like prompt injection attacks, where text is crafted to manipulate a chatbot into revealing sensitive information from linked systems, according to the newly published Guidelines on Securing AI Systems .
The guidelines aim to help businesses identify and mitigate the risks of AI to deploy them securely. The more AI systems are linked to business operations, the more they should be secured.
Announcing the guidelines at the annual Singapore International Cyber Week (SICW) at the Sands Expo and Convention Centre on Oct 15, Senior Minister and Coordinating Minister for National Security Teo Chee Hean said the manual gives organisations an opportunity to prepare for AI-related cyber-security risks while the technology continues to develop.
Mr Teo said in his opening address that managing the risks that come with emerging technology like AI is an important step to build trust in the digital domain. He urged the audience to learn lessons from the rapid rise of the internet.
“When the internet first emerged, there was a belief that the ready access to information would lead to a flowering of ideas and the flourishing of debate. But the internet is no longer seen as an unmitigated good,” he said, adding that there is widespread recognition that it has become a source of disinformation, division and danger.
“Countries now recognise the need to go beyond protecting digital system to also protecting their own societies,” he said. “We should not repeat these mistakes with new technologies that are now emerging.”
The ninth edition of the conference is being held between Oct 14 and 17 and features keynotes and discussion panels by policymakers, tech professionals and experts.
AI owners are expected to oversee the security of AI systems from development, deployment to disposal, according to CSA’s guidelines, which do not address the misuse of AI in cyber attacks or disinformation.
In a statement released on Oct 15, CSA said: “While AI offers significant benefits for the economy and society… AI systems can be vulnerable to adversarial attacks, where malicious actors intentionally manipulate or deceive the AI system.”
Organisations using AI systems should consider more frequent risk assessments than with conventional systems to ensure tighter auditing of machine learning systems.