The Morning Risk Report: Amazon Ties North Korea to String of Cyberattacks on Open-Source Software By Richard Vanderford | Dow Jones Risk Journal
Good morning. Amazon linked a string of attacks on open-source software packages to a single North Korean hacking group, arguing that what appeared to be individual hacks were actually part of a coordinated campaign
targeting the global software supply chain.
Tracing the hacks: The tech giant's threat-intelligence unit said Wednesday it had tied the compromises of the Axios, Debug, Chalk and typo-crypto software packages to a group connected to the North Korean government.
Troubling attacks: Amazon's findings add new context to a series of attacks that have alarmed security researchers, because they targeted open-source software libraries incorporated into millions of applications globally.
AI worries: Amazon warned that artificial intelligence is making supply-chain attacks far easier to execute and harder to detect. Rick Anthony, senior manager for Amazon Inspector, the company's automated vulnerability scanning service, said attackers are increasingly using AI to appear to be legitimate software developers.
We had a glitch yesterday. To read Clara Hudson's article on artificial intelligence risks showing up in corporate disclosures, use this link .
Compliance
FTC sues Hims & Hers, alleging unlawful sharing of data, deceptive billing.
The Federal Trade Commission sued Hims & Hers Health , alleging the telehealth company shared users' information with third-party advertising platforms despite pledging to protect patient privacy.
The FTC, joined by Utah and California, also allege Hims & Hers deceived users about its billing and cancellation practices, charging patients before they met with providers and making it difficult to cancel subscriptions.
Hims & Hers disputed the lawsuit and said it would defend itself against the claims.
Mark Zuckerberg says U.S. should accelerate AI development, not restrict it.
Mark Zuckerberg thinks artificial intelligence is working out great for humanity. His fear: that the people who think otherwise will influence who has access
to the fast-evolving technology.
The Trump administration is in the process of implementing an executive order establishing a voluntary 30-day review period for new models. Zuckerberg said he thinks any such review should be done as efficiently as possible.
"I think saying, 'Hey, we want to review stuff for'-whatever it is-30 or 60 days, it may not sound like that much," he said. "But the field is moving so quickly, that actually is quite a meaningful amount of time."
DoorDash said it has secured a key certification
from the Federal Aviation Administration to make commercial deliveries using drones.
Risk Journal reports: The Trump administration should force phone companies to beef up their know-your-customer checks
as a way to stop annoying robocalls, a bipartisan group of state attorneys general said (free link). Risk
U.S. retaliates against Iran for Tuesday's surprise attack
American forces carried out strikes against Iran
on Wednesday night, in what the U.S. military called a "powerful response" to Iran's missile attacks on U.S. forces in Jordan .
The strikes came hours after President Trump vowed to retaliate for the surprise ballistic missile strike, dashing hopes for an imminent diplomatic breakthrough. Though the assault was larger in scope than previous U.S. attacks, it didn't amount to a return to major combat operations, according to a U.S. official.
U.S. forces carried out a "heavy wave" of strikes, attacking dozens of targets, including military command centers, missile and drone facilities, coastal surveillance and defense sites, and maritime capabilities, said U.S. Central Command after the strikes were completed. "The strikes aimed to further diminish threats posed by Iran and its proxies to American forces, commercial shipping, and neighboring Gulf countries," the command said.
China went from dream customer to a nightmare for Big Oil.
China went on a crash diet with oil soon after the Strait of Hormuz closed, Carol Ryan writes in a column. The country imported 11.6 million barrels of crude a day on average in 2025, data from the American Petroleum Institute shows. By June this year, imports had collapsed to around seven million barrels a day.
The pullback in oil purchasing has acted as a shock absorber for the global economy, keeping a lid on prices, and was a big surprise to commodities traders. They are now trying to figure out
how much longer China can stay quiet in the market.
It is an important question because global inventories are draining fast, and countries have few options left to shield themselves from high energy prices.
Russian authorities issued formal charges
Wednesday against Russian-born billionaire Pavel Durov, the founder of the Telegram messaging app, accusing him of aiding terrorism by turning a blind eye to how Ukraine uses the platform to plan attacks in Russia. The Kremlin is working to boost its ability to monitor and censor the internet.
Canada will abandon efforts
to compel foreign streamers to make mandatory financial contributions to the domestic entertainment industry. U.S. officials viewed a recent regulatory ruling on the matter as a new trade barrier Canada was looking to impose. What Else Matters Professional services adviser CBIZ has agreed to be taken private
by Grant Thornton Advisors for more than $3 billion in cash.
Federal Reserve officials held interest rates steady
Wednesday over the objections of three bank presidents who wanted an increase, underscoring how pressure is building inside the central bank to act on inflation that has run above its target for five years.
Dr. Anthony Fauci, the longtime government scientist who became the face of the U.S. response to the Covid-19 pandemic, repeatedly invoked the Fifth Amendment
on Wednesday amid a barrage of heated questions and sharp accusations on Capitol Hill.
New York City released a list
of property owners who may be subject to Mayor Zohran Mamdani's new tax on luxury second homes.
The Wall Street Journal's Lauren Weber attended a secluded getaway for burned out executives. It got existential . About Us
Follow us on LinkedIn . Send tips to our reporters Max Fillion at [max.fillion@dowjones.com], Clara Hudson at [clara.hudson@wsj.com], Yusuf Khan at [yusuf.khan@wsj.com] and Richard Vanderford at [richard.vanderford@wsj.com].
You can also reach us by replying to any newsletter, or by emailing our editors Perry Cleveland-Peck at and David Smagalla at [david.smagalla@wsj.com].
This article is a text version of a Wall Street Journal newsletter published earlier today.
Comments