CCTR.10.FEB.24
APT28, Ubiquiti, iSOON, Hugging Face, PyRIT
Last updated
APT28, Ubiquiti, iSOON, Hugging Face, PyRIT
Last updated
A Russian state-sponsored cyber actor, 🐻APT28, has been globally utilizing compromised Ubiquiti EdgeRouters for malicious cyber operations since at least 2022. Due to the widespread popularity of EdgeRouters, it is crucial for users to take precautions. If you own a Ubiquiti Inc. EdgeRouter, it's probably a good idea to perform a hardware factory reset, update to the latest firmware, change default credentials, and avoid exposing remote management services to the internet. Ref Data from iSOON, also known as Anxun Information, a contractor for the Chinese Ministry of Public Security (MPS) specializing in network penetration research, was leaked on GitHub. The iSOON leak stands out as a significant cyber threat development related to China in recent years. The tools provided by iSOON and the campaigns orchestrated by its operators highlights how both the MPS and the Chinese Ministry of State Security (MSS) delegate their intelligence gathering to commercial surveillance vendors. This leak reinforces the idea that APT groups 🐼 in China are interconnected, resembling the cybercrime underground in many ways. Did you know that fleet tracking systems credentials leaked in the dump may or may not still be valid? 🤯 Ref Over 100 instances of malicious AIand machine learning (ML) models were discovered on the Hugging Face platform. Some of these models have the capability to execute code on the victim's machine, establishing a persistent backdoor for potential attackers. Hugging Face, a tech firm specializing in AI, natural language processing (NLP), and ML, serves as a collaborative platform for sharing models, datasets, and applications. This incident serves as a reminder of the insufficient attention given to the security risks associated with AI and ML models, emphasizing the need for increased vigilance and proactive measures to protect the ecosystem from malicious actors. Ref Microsoft has launched PyRIT (Python Risk Identification Toolkit), an open automation framework designed to assess the security of generative AI systems. This toolkit can come in handy in detecting and addressing risks within gen-AI systems, marking a substantial advancement in Microsoft's approach to mapping, measuring, and mitigating AI risks. Ref
