Cyber Brief Covers Blood-Bank OT Attacks, Phishing, Malware and Mobile Exploits
· 1:39:02 · Watch on YouTube ↗
Summary
The episode covers attacks on French blood-bank refrigeration, phishing that stole live Google sessions, malware delivered through a Chinese keyboard app, mobile exploits linked to AP29, a compromised game launcher, a French bank heist and a misinformation breach.
Key points
- Hackers reportedly changed refrigeration settings at equipment in three French blood-bank sites. Alarms prompted staff to secure equipment or move supplies; no blood products or samples were lost and no health impact was identified.
- The host recommends changing default credentials, monitoring refrigeration systems, setting alarms and planning manual intervention to protect operational technology.
- Anthropic's research prototype uses cryptographic proofs to verify which AI model generated a response while keeping model weights private. Tests required roughly 70–95 times the GPU work of ordinary inference; there were no deployment plans.
- Material Security reported phishing invites from compromised Google Calendar accounts that used a proxy of Google's sign-in page to relay passwords and MFA prompts and steal live sessions. The host recommends user education, non-punitive reporting and layered detection.
- A report linked DNS manipulation of SoJo's unencrypted promotion feature to delivery of Dark Vigil and described the group as China-aligned Slippery Nunchucks; where the manipulation occurred is unknown. Version 16.10.10 closed that route with HTTPS and certificate pinning, though stronger download checks were still needed.
- Credit Mutuel Arkea said hackers reached a provider and transferred money from the bank's own account. Zack XBT estimated the theft at more than $133 million; the bank broadly confirmed the scale, but the final loss was unknown.
- Sequoia researchers linked a mobile spying campaign to Russia's AP29. Compromised websites and a poisoned analytics script delivered exploits for patched flaws on iOS and Android; the host urged users to update phones and browsers.
- The developer of the Goddess of Victory: Nike PC launcher confirmed tampering and issued a fix. A researcher reported a backdoor, while BleepingComputer verified malicious loaders and a crypto-wallet-stealing component; deployment and theft remained unconfirmed.
- The Kiev Independent said its website and newsletter systems were breached to spread fabricated claims. The outlet suspected Russian actors but provided no technical evidence tying them to the breach; it said donor and banking-member data were not compromised.
Article Details
- Topics
- [14:44] Attacks on French blood-bank refrigeration and OT protection
- [20:33] Anthropic's cryptographic proof prototype for AI model identity
- [24:38] Calendar-invite phishing and live Google session theft
- [31:52] SoJo traffic manipulation and Dark Vigil delivery
- [42:22] Reported French bank heist and estimated losses
- [47:29] AP29-linked mobile spying campaign and patched flaws
- [52:29] Goddess of Victory: Nike launcher compromise
- [57:56] Kiev Independent breach and fabricated claims
MITRE ATT&CK
T1056.001 · KeyloggingThe host described client-side JavaScript injection and keylogging in the phishing flow to capture victim input and session data.T1189 · Drive-by CompromiseThe mobile campaign used compromised and lookalike websites, with a poisoned script delivering exploits to visitors' devices.T1195.002 · Compromise Software Supply ChainThe Goddess of Victory: Nike PC launcher was reportedly compromised through tampered scripts on the publisher's network.
Products
AndroidThe mobile spying campaign reportedly delivered exploits to Android devices with certain older Chrome versions.Google CalendarThe reported phishing invites came from compromised Google Calendar accounts and lured victims toward a proxied sign-in page.iOSThe mobile spying campaign reportedly delivered exploits for patched flaws on iOS devices, including versions 16.7 and 18.5.