Risky Scan

Today in the space between war and peace...

Russia targets secure messaging apps – Russian state-aligned threat actors are aggressively exploiting Signal Messenger’s “linked devices” feature to intercept communications, using phishing and QR code-based attacks. This expands on earlier efforts targeting WhatsApp and Telegram, escalating digital espionage amid the ongoing Ukraine conflict. [Google Threat Intelligence]

Kremlin-backed disinformation continues hitting German elections – A U.S.-based propagandist, funded by Russia, has launched over 100 AI-generated fake news sites to influence Germany’s upcoming elections, primarily boosting the far-right. This marks an expansion of Moscow’s election interference playbook. [France24]

North Korea’s Kimsuky targets trusted platforms – The DEEP#DRIVE campaign leverages trusted services like Dropbox and PowerShell scripts to infiltrate South Korean government agencies and cryptocurrency users. This marks a shift to Living off the Land (LotL) techniques, making detection harder. [DarkReading]

Economic cyber-espionage surges despite global agreements – Despite the G20 pledging to curb intellectual property theft, cyber operations targeting business secrets have quadrupled since 2015, hitting emerging economies hardest. Nations like India and Brazil remain particularly vulnerable, while Five Eyes intelligence calls out China’s aggressive tactics. [ASPI Strategist]

China’s port strategy raises U.S. security concerns – Expert testimony before the House Committee on Homeland Security warns that Beijing’s investment in strategic ports across the Western Hemisphere could be used for military leverage and economic coercion, urging allied countermeasures. [Atlantic Council]

New ransomware alert from U.S. cyber agencies – The Ghost (Cring) ransomware, linked to China-based actors, exploits software vulnerabilities globally for financial and strategic gain. The U.S. government urges stronger defenses against these rapidly evolving threats. [CISA]