Risky Business #798 -- Mexican cartel surveilled the FBI to identify, kill witnesses

On this week’s show Patrick Gray and Adam Boileau discuss the week’s cybersecurity news:

• Australian airline Qantas looks like it got a Scattered Spider-ing

• Microsoft works towards blunting the next CrowdStrike disaster

• Changes are coming for Microsoft’s default enterprise app consenting setup

• Synology downplays hardcoded passwords for its M365 cloud backup agent

• The next Citrix Netscaler memory disclosure looks nasty

• Drug cartels used technical surveillance to find, fix and finish FBI informants and witnesses

This week’s episode is sponsored by RAD Security. Co-founder Jimmy Mesta joins to talk through how they use AI automation to assess the security posture of sprawling cloud environments.

This episode is also available on Youtube (youtu.be/mpu3prpQrOU).

Show notes

• Qantas hit by cyber attack, leaving 6 million customer records at risk of data breach (abc.net.au/news/2025-07-02/qantas-cyber-attack…)

• Scattered Spider appears to pivot toward aviation sector | Cybersecurity Dive (cybersecuritydive.com/news/scattered-spider-ap…)

• Microsoft to make Windows more resilient following 2024 IT outage | Cybersecurity Dive (cybersecuritydive.com/news/microsoft-windows-r…)

• (384) The Ultimate Guide to App Consent in Microsoft Entra - YouTube (youtube.com/watch?v=JBt-sB0qXqk)

• When Backups Open Backdoors: Accessing Sensitive Cloud Data via "Synology Active Backup for Microsoft 365" / modzero (modzero.com/en/blog/when-backups-open-backdoor…)

• AT&T deploys new account lock feature to counter SIM swapping | CyberScoop (cyberscoop.com/att-wireless-account-lock-sim-s…)

• Iran-linked hackers threaten to release Trump aides' emails | Reuters (reuters.com/legal/government/iran-linked-hacke…)

• US government warns of new Iran-linked cyber threats on critical infrastructure | Cybersecurity Dive (cybersecuritydive.com/news/iran-cyberattacks-w…)

• Actively exploited vulnerability gives extraordinary control over server fleets - Ars Technica (arstechnica.com/security/2025/06/active-exploi…)

• Critical vulnerability in Citrix Netscaler raises specter of exploitation wave | Cybersecurity Dive (cybersecuritydive.com/news/critical-vulnerabil…)

• Identities of More Than 80 Americans Stolen for North Korean IT Worker Scams | WIRED (wired.com/story/identities-of-80-plus-american…)

• Cloudflare confirms Russia restricting access to services amid free internet crackdown | The Record from Recorded Future News (therecord.media/cloudflare-russia-restricting-…)

• Mexican drug cartel used hacker to track FBI official, then killed potential FBI informants, government audit says | CNN Politics (edition.cnn.com/2025/06/28/politics/mexican-dr…)

• Audit of the FBI's Efforts to Mitigate the Effects of Ubiquitous Technical Surveillance - Redacted Report (oig.justice.gov/sites/default/files/reports/25…)

• NATO members aim for spending 5% of GDP on defense, with 1.5% eligible for cyber | The Record from Recorded Future News (therecord.media/nato-agreement-5percent-gdp-de…)

• US sanctions bulletproof hosting provider for supporting ransomware, infostealer operations | CyberScoop (cyberscoop.com/bulletproof-hosting-provider-ae…)

• US, French authorities confirm arrest of BreachForums hackers | TechCrunch (techcrunch.com/2025/06/26/us-french-authoritie…)

• Spanish police arrest five over $542 million crypto investment scheme | The Record from Recorded Future News (therecord.media/spain-europol-cryptocurrency-i…)

• Scam compounds labeled a 'living nightmare' as Cambodian government accused of turning a blind eye | The Record from Recorded Future News (therecord.media/cambodia-scam-compounds-amnest…)