Risky Bulletin: Ukraine's top prosecutor resigns amid scam call center scandal

0:00Ukraine's top prosecutor resigns amid a scam call centre scandal. The US accuses Chinese AI companies of industrial scale distillation. A cyber attack hits medical practices in Luxembourg and the liquid network attacker returns some stolen bitcoin but keeps a $50 million bounty. This is the Risky Bulletin, prepared by Catalan Kim Pano and read by me, Claire Eard. Today is the 9th of September and this podcast episode is brought to you by Authentic. In today's top story, Ukraine's top prosecutor Ruslan Kravchenko resigned this week and made allegations that his offer seccepted bribes in exchange for protecting investment scam call centres. According to Ukraine's anti-corruption body, NABU, officials from Kravchenko's office began taking bribes last year and protected up to 500 call centres.

1:01Each call centre was paying a protection fee of $7,000 a month which netted officials between $700,000 and $3.5 million in monthly bribes. Investigators say the group was led by Sir Hig Kropovah, the deputy head of the Department of International Cooperation, inside Kravchenko's office of the prosecutor general. Authorities arrested Kropovah last week to further suspects were detained on Monday. In other news, the US government has accused Chinese technology companies of orchestrating industrial-scale distillation attacks against American AI models and a joint advisory on Tuesday, CISA, the FBI and the NSA said the Chinese government was likely aware of the distillation campaigns. The six Chinese companies named in the advisory are Deepseek, Moonshot AI, Alibaba, Minimax, Stepfun and ZAI. The targeted US models include Claude, GPD, Gemini and GROC.

2:05France's Cybersecurity Agency has established a new incident response team dedicated to dealing with security incidents at government agencies. The new team is named Reactive. Its launch follows several breaches at French government agencies this year. The Swiss government plans to gradually replace Microsoft 365 with European Office Platform OpenDESC. The switch will begin in late 2027 with OpenDESC initially running in parallel with Microsoft 365. The platform will be used by roughly 3,000 employees and will cost the Swiss government around $11 million. OpenDESC will include email, calendar, documents, presentations, telephony and audio and video conferencing. A cyber attack has crippled more than 80 medical practices across Luxembourg. The attack hit BMS engineering, the developer of a payment system used by the local medical sector. The company said it's investigating where the patient data was stolen from its cloud

3:07servers. The city of Springfield in Massachusetts closed 64 public schools on Tuesday after a cyber attack hit the local school district. The district told teachers and students to stay off school networks until the incident is resolved. The schools will remain closed while the district investigates the incident and restores affected systems. The Shiny Hunters Hacking Group claims to have breached Florida's Department of Motor Vehicles. The group says it will release more than 200,000 driver records stolen from the department's internal databases unless the DMV pays a ransom. Shiny Hunters released the driving record of deceased sex offender Jeffrey Epstein as proof of the hack. A misconfigured, elastic search instance has leaked the personal details of more than 220 million passengers and airline crew members who flew through a Vietnamese airport. The data is believed to have leaked from an advanced passenger information system, a

4:09database that stores information on people travelling through airports. According to Kinryu Labs, the database came from a Vietnamese airport but they couldn't say which one. Hackers have stolen more than a million user records from math tutoring platform, Math Space. The attackers breached the company's Metabase database last month as part of a global hacking campaign that hit hundreds of companies. The stolen data includes information on students, guardians and school staff. Only users in Australia and New Zealand are affected. The hacker who stole $320 million in Bitcoin from the Liquid Network, cryptocurrency platform, has returned 85% of the funds. The company says it's patched the blockchain nodes that allowed the hack. The attacker claims to be a white hat security researcher and has kept almost $50 million as a self-awarded bug bounty. Italian Haktivist and hacker collective Altistaghi Inventati has shut down its online platform

5:14after the US declared a terrorist organisation last month. The group built and operated encrypted chats and email services, web hosting, secure video conferencing and streaming and other anonymity tools. The US State Department claimed Inventati's platforms were used by violent antifascals and far-left militants. The US Treasury also sanctioned the group. The US has extradited a Russian national from the country of Georgia to face hacking charges. Sergei and Atolovich, Philly Monov, is accused of fishing online banking users and attempting to steal their money. Philly Monov successfully stole 5,000 login credentials and attempted to steal millions of US dollars. The DOJ didn't save he was successful. As Singaporean man has pleaded guilty in a US court to stealing $245 million from a single cryptocurrency investor in 2024. Malone Lam was part of a group that hijacked the victims' Google account by posing as

6:17Google support. The group used the victim's private crypto wallet key to steal the funds. They spent the proceeds of the theft on international travel, nightclubs, luxury cars, watches, jewelry, designer handbags and rental homes in Los Angeles and Miami. Lam was arrested in September 2024. Dutch police are published a recording of the voice-fishing attack that compromised Dutch ISP, Odido, in February. Police have yet to identify the hackers more than seven months after the breach, and hoping members of the public will recognise the voice. The recording was also played on Dutch TV station NPO2. Software maker Ann Abel has patched an actively exploited zero-day in its Ncentral platform. The zero-day is different from the two critical vulnerabilities patched by the company on Friday. The company's Ncentral products were also targeted with another zero-day last month.

7:17And finally, security researchers have developed a first zero-click worm that spreads via WeChat voice calls. The worm works across both Android and iOS and doesn't require users to answer the incoming call. It's powered by an RCE exploit that Tencent has now patched. And that is all for this podcast edition. Today's show is brought to you by Authentic. Find them at goauthentic.io. That's Authentic with the TIK.