Zelenskyy Deep Fake Video Posted Following Hack of Ukraine 24

Former U.S. spies banned from foreign government work for 30 months following retirement, Iranian hackers allegedly compromised phone of Mossad director's wife, Avast purchase hits a snag, more

Mar 17

Check out my latest CSO column that delves into how the hidden costs of ransomware attacks can reach millions and even tens of millions of dollars.

A deepfake video of Ukraine’s President Volodymyr Zelenskyy appearing to tell Ukrainians to surrender began to go viral online following a hack of Ukrainian television news outlet Ukraine 24.

Ukraine 24 said in a Facebook post that “The running line of the ‘Ukraine 24’ TV channel and the ‘Today’ website were hacked by enemy hackers and broadcast Zelenskyy's message about alleged ‘capitulation’❗️❗️❗️ THIS IS FAKE! FAKE !” No one has claimed responsibility for the alleged hack or the fake video. (Samantha Cole / Motherboard)

Jane Lytvynenko @JaneLytv

I shouldn't laugh but the deepfake of Ze is hilarious I can't stop cackling. It looks like that thicc zucc meme. This was posted to Ukraine 24's website, which was hacked earlier today. If yer gonna go through all the trouble, at least match the neck to the face!

ʝօɦռռʏӼʍǟֆ @J0hnnyXm4s

And with that, everything we claimed would happen with deepfakes has come to pass. Luckily the Russians seem to only have a single GPU from 2004, so the fake is awful and obvious, especially given the real Zelenskyy constantly being in the public eye for comparison

Zack Whittaker @zackwhittaker

The deepfakes have arrived. "Ukraine 24 posted a warning that its broadcast and website were hacked. Adding to the chaos is a deepfake video of Zelenskyy appearing to tell Ukrainians to surrender began to go viral online at the same time." — @samleecole https://t.co/4AUfapRe5g

As part of the omnibus $1.5 trillion spending bill passed last week and signed into law by President Biden, United States' former spies are barred from hiring themselves out to foreign governments right after they stop working for Washington.

The legislation prohibits U.S. intelligence officials with knowledge of spycraft and national security secrets from selling their services to other countries for 30 months after retiring. The legislation was spurred by a Reuters series that showed former National Security Agency hackers helped the United Arab Emirates spy on journalists, dissidents, and other Americans. (Joel Schectman and Christopher Bing / Reuters)

Kim Zetter @KimZetter

New law bars former US intel officials with knowledge of spycraft/national security secrets from selling their services to other countries for 30 months after retiring. As Chris notes in thread, this came out of Reuters reporting about former NSA hackers who went to work for UAE

Chris Bing @Bing_Chris

U.S. bars ex-spies from becoming 'mercenaries,' following Reuters series https://t.co/pac9Zj5DTl

An investigation by Forbes showed how a self-styled marketing guru, Heather Morgan, and her husband, Ilya Lichtenstein, accused of laundering billions from the Bitfinex exchange hack in 2016, came from humble origins and still have $1 billion in unseized coins that had been transferred through the Russia-based darknet market Hydra.

Prosecutors say that Morgan’s unwavering devotion to the man some called her “Crypto Clyde,” forged by love and misadventure, could be seen fraying with “possible resolutions short of trial,” otherwise known as a plea bargain, possibly in the offing. (Cyrus Farivar, David Jeans, Thomas Brewster / Forbes)

Tim Copeland @Timccopeland

wow strong feature by @DavidJeans2, @cfarivar and @iblametom.

Razzlekhan: The Untold Story Of How A YouTube Rapper Became A Suspect In A $4 Billion Bitcoin FraudForbes reveals how a self-styled marketing guru from small-town America and her husband became heist suspects.forbes.com

Iranian hackers published a video on an anonymous Telegram channel featuring personal photos and documents allegedly obtained from a phone used by the wife of Mossad Director David Barnea. "We've got a small gift for the Mossad; 'With LOVE for David'. Happy Purim," a post on the channel read, referring to the Jewish holiday celebrated this week.

The video was posted on the "Open Hands" channel, which according to Israeli media, was created on Tuesday. Its owners claimed to have obtained the information in a "lengthy intelligence operation" against Barnea, which began in 2014. The channel also published a quote from the Koran and a promise that more personal information on the Mossad chief would be released soon. Mossad says, "This is old information. The documents in questions were not extracted from the Mossad chief's phone." (Lilach Shoval and ILH Staff / Israel Hayom)

NortonLifeLock's $8.6 billion purchase of Avast hit a snag after Britain's anti-trust regulator said it would launch a deeper investigation into the proposed cybersecurity merger following competition concerns.

Britain's Competition and Markets Authority (CMA) said the deal could harm competition and lead to British customers getting a worse deal when looking for security software, sending Avast shares tumbling 11%. NortonLifeLock said the investigation would delay the deal's completion, which was initially expected to close last month, then on April 4, but is now expected to close in mid-to-late 2022. (Yadarisa Shabong / Reuters)

OpenSSL released a security update to address a vulnerability in the library that, if exploited, activates an infinite loop function and leads to denial of service conditions.

The high-severity OpenSLL problem lies in a bug on the BN_mod_sqrt() function, that if served a maliciously crafted certificate to parse, it will enter an infinite loop. Google’s security researcher Tavis Ormandy discovered the certificate parsing vulnerability and reported his findings to the OpenSSL team on February 24, 2022. (Bill Toulas / Bleeping Computer)

The developer behind the popular npm package node-ipc, which has been downloaded a million times, released sabotaged versions of the library in protest of the ongoing Russo-Ukrainian War.

Newer versions of the 'node-ipc' package began deleting all data and overwriting all files on developer's machines, and creating new text files with "peace" messages. On March 8th, developer Brandon Nozaki Miller, aka RIAEvangelist, released open-source software packages called peacenotwar and oneday-test on both npm and GitHub as an apparent means of peaceful protest. (Ax Sharma / Bleeping Computer)

Chris Wysopal @WeldPond

Sabotage by OSS library. The malicious code, committed as early as March 7th by the dev, would read the system's external IP address and only delete data by overwriting files for users based in Russia and Belarus.

BIG sabotage: Famous npm package deletes files to protest Ukraine warThis week, the developer of the popular npm package ‘node-ipc’ released sabotaged versions of the library in protest of the ongoing Russo-Ukrainian War. The ‘node-ipc’ package, which gets downloaded over a million times weekly, began deleting files on developer’s machines, in addition to creating ne…bleepingcomputer.com

Researchers at 360Netlab found a honeypot system capture an unknown executable and link (ELF) format Linux file propagating through a Log4j vulnerability.

The researchers say that the network traffic generated by this sample triggered a DNS Tunnel alert in their system. The researchers investigated further and found a new botnet family, which they named B1txor20 based on it using the file name “b1t,” the XOR algorithm, and the RC4 algorithm key length of 20 bytes. Casey Ellis at Bugcrowd said that “aside from finding and patching Log4j wherever possible, monitoring and restricting outbound DNS requests is the only practical defense for this." (Steve Zurier / SC Media)

Related: The Register, The Hacker News, TechRadar, Netlab

Windows admins were hit by a wave of Microsoft Defender for Endpoint false positives where Office updates were tagged as malicious in alerts pointing to ransomware behavior detected on their systems.

Following a surge of reports, Microsoft confirmed the Office updates were mistakenly marked as ransomware activity due to false positives. The software giant deployed a code update to correct the problem, ensure no new alerts would be sent, and re-processed a backlog of alerts to remediate the impact. (Sergiu Gatlan / Bleeping Computer)

Related: PCMag.com, Neowin, Softpedia

Researchers at Sophos say that scammers are abusing two legitimate Apple features to bypass App Store vetting requirements and trick people into installing malicious apps.

New methods used by an organized crime campaign dubbed CryptoRom push fake cryptocurrency apps to unsuspecting iOS and Android users. Some of the victims had been instructed to install what appeared to be BTCBOX, an app for a Japanese cryptocurrency exchange. iOS users who took the bait received a link that, when clicked, caused Apple’s TestFlight app used for beta testing of new apps to download and install the fake cryptocurrency app. (Dan Goodin / Ars Technica)

Related: Neowin, Sophos

SolarWinds warned customers of attacks targeting Internet-exposed Web Help Desk (WHD) instances and advised removing them from publicly accessible infrastructure.

Although SolarWinds did not provide any details on what tools or techniques were used in the attack, at least four different security vulnerabilities an attacker could exploit to target an unpatched WHD instance. SolarWinds said it had received a report from one customer about an attempted attack that was not successful. (Sergiu Gatlan / Bleeping Computer)

Andrew Healey @healeyio

All these companies snatching up years of ITSM tech debt and letting it fester. Some of those install and upgrade docs expose a bit of what to expect under the hood...

SolarWinds warns of attacks targeting Web Help Desk instancesSolarWinds warned customers of attacks targeting Internet-exposed Web Help Desk (WHD) instances and advised removing them from publicly accessible infrastructure (likely to prevent the exploitation of a potential security flaw).bleepingcomputer.com

The Cybersecurity & Infrastructure Security Agency (CISA) has added fifteen additional flaws to its list of actively exploited vulnerabilities known to be used in cyberattacks.

Most flaws in the new set highlighted by CISA concern privilege escalation problems on Windows, of which one, CVE-2019-0841, has a published proof-of-concept (PoC) exploit that threat actors can pick up and use immediately on vulnerable systems. CISA has given federal agencies a deadline of April 5, 2022, to apply the available security updates for the 15 highlighted older vulnerabilities disclosed in 2015 through 2020. (Bill Toulas / Bleeping Computer)

Related: US-CERT

Image: Facebook screenshot from Ukraine 24 Facebook page.

Metacurity