In order to sabotage the online black market, the NCA set up a number of fictitious DDoS websites and offered booter or DDoS-for-hire services. It is important to keep in mind that the UK's Computer Misuse Act of 1990 makes DDoS attacks illegal. 

All of these websites were created by the NCA to appear genuine, giving the visitor the idea that they could initiate DDoS attacks using the provided tools and services. 

According to the agency, many a thousand individuals have visited the sites, although, after registering on the site, visitors are instead presented with a splash screen telling them that their data has been captured and law enforcement authorities would contact them instead of receiving the services they had signed up for. 

In the most recent report, the NCA confirms to have identified one of the websites it was operating, with a message that the data of users has been collected and that they “will be contacted by law enforcement.” 

The individuals who are currently in the UK will be contacted by the NCA or police and are warned about engaging in any cybercrime-related activity, whereas, the details of those overseas are being handed out to international law enforcement. 

DDoS Attacks 

In a DDoS attack, compromised computer systems bombard a target (server or website), causing severe financial or reputational damage to the targeted organization. “DDoS-for-hire, or ‘booter’, services allow users to set up accounts and order DDoS attacks in a matter of minutes […] Such attacks have the potential to cause significant harm to businesses and critical national infrastructure, and often prevent people from accessing essential public services,” said the NCA. 

Alan Merrett, member of NCA’s National Cyber Crime Unit says “booter services” are a key enabler of cybercrime. “The perceived anonymity and ease of use afforded by these services means that DDoS has become an attractive entry-level crime, allowing individuals with little technical ability to commit cyber offences with ease,” he said. 

He added that traditional site takedowns and arrests are key components of law enforcement’s response to threats while adding, “We have extended our operational capability with this activity, at the same time as undermining trust in the criminal market.” 

The NCA says that it will not reveal how many sites it has or for how long they have been running. Therefore, they have urged individuals looking for these services to stay cautious as they might not know who is operating them. 

Mitiga researchers found that if users unintentionally type their passwords in the "username" field when logging in, the IAM system saves them to audit logs. Threat actors who have acquired access to a company's system can then quickly harvest them, lift privileges, and gain access to several corporate assets that make use of Okta. 

In a post, Doron Karmi, Okta senior security researcher and principal security researcher and developer wrote, "In our research, we could easily use the logs to match the password with the valid user, resulting in gaining credentials to the Okta user account." They added further when adversaries log in to Okta as those users, it "expands the blast radius of the attack to the many platforms that Okta secures, and gaining further access to systems." 

Since Okta audit logs include specific data pertaining to user activity, such as usernames, IP addresses, and login timestamps, the vulnerability exists. The logs also reveal whether login attempts were made using a web browser or a mobile app and whether they were successful or failed. 

In Defense of Okta Features 

The cloud-based enterprise-grade IAM service, Okta, which links business users across applications and devices is now utilized by more than 17,000 customers around the globe. Although it was designed for cloud-based systems, many on-premises apps can also use it. 

According to a statement from the company released by Mitiga, representatives from Okta agree that preserving cleartext passwords in audit logs is "expected behavior when users mistakenly enter their password in the username field." Furthermore, only platform administrators, who are the system's most privileged users, have access to audit logs that store cleartext passwords, and they "should be trusted not to engage in malicious activities." 

It is not the first time the business has had to defend a platform feature that governs how user passwords are handled. In response to a report by Authomize researchers, Okta's architecture for password syncing allows malicious actors signed in as an app administrator of a downstream app to access passwords in plaintext, including admin credentials, even over encrypted channels, the company published a blog post in July of last year. 

The news followed claims made by the threat organization Lapsus$, which posted screenshots they claimed were taken from internal systems and claimed to have breached Okta using "superuser" account credentials. Although Okta later claimed it only discovered two actual breaches, it was revealed that 366 Okta customers could have been negatively impacted by that incident.   

Banking fraud has increased in recent years. There has been an increase in digital phishing attacks claimed by HDFC Bank customers as the social media outcry has mounted in recent days. Several HDFC Bank customers reported to the authorities that many of the incidents involved phishing SMSes that they received in February. 

There are indications that they have adopted a revised method of operation to step up their efforts to protect others which may have been the case. To strengthen cybersecurity measures, phishing links masquerade as verification processes as part of their phishing campaign. 

There has been a significant number of customers who have been receiving false text messages in the last few days, which claim that they have been blocked or suspended because they have not updated their Permanent Account Numbers (PAN) because their PAN has not been updated. The message you are receiving is a fake one, so keep an eye out and be aware of it. 

The Public Information Bureau (PIB) has recently issued a warning to the customers of the State Bank of India (SBI) regarding fake messages purporting to be from SBI officials that claim the recipient's YONO account has been disabled as a result of a power cut. 

One of the most common ways scammers use to trick people is through phishing SMS messages, which is one of the methods they use to steal their money in different ways. Cyber fraudsters use phishing bank SMS as a means of scaring people away by telling them their bank account has been suspended by cyber thieves. 

A link is attached to the SMS and it asks the users to click on it to update their KYC or PAN details. The problem arises, however, when someone is tricked into believing that the SMS is legitimate and clicks on the link, and their phone is hacked and money is lost. 

Often more common than you might think is phishing SMS fraud. Most banks have issued an advisory informing customers not to be fooled by them. Earlier this month, HDFC alerted its customers that these types of frauds have been taking place. 

There was a viral HDFC bank SMS sent to some of its users that they received on their mobile phones. Some of their users tagged the bank with the message. There has been an attempt by fraudsters to create a fake HDFC Bank website, giving the false appearance that there is a verification process when it is not. HDFC customers have now received a link with the details of the offer.  

An alert was sent by Manoj Nagpal, the CEO of Outlook Asia Capital, who posted a picture of the infected email to Twitter with a description of what he had seen. The same message has also been received by many other customers as well. It has been recommended by Nagpal that people should refrain from clicking on links that have been sent via email or SMS.  

What Are the Methods Used by Fraudsters?

To use fraudsters to commit fraud. Here is how HDFC bank explains how this happens. 

First step: The fraudsters create bogus emails impersonating bank employees that ask consumers to activate a link in the email that instructs them to verify or update the account information in their accounts as soon as possible. 

Second step: When a customer clicks on the link provided by the email, the victim is taken to a fake site that appears to be the official website of the Bank. There is a web form on this site that allows the customer to enter their personal information so that we can communicate with them. 

If you doubt any SMS request, report any suspicious SMSes, or confirm a bank alert with a bank manager to avoid having your account hacked, make sure to check the sender's identity before acting on it.   

 A two-factor authentication system should be implemented for online banking to keep personal information secure. The OTP and password that you used to access your account must be entered every time you want to access it. Using your fingerprints as a second password is even possible if you have a secure device. The message you receive should not be clicked on and any unidentified links should be deleted.    

The most recent threat activities conducted were primarily targeted at organizations in Colombia, involving sectors like “health, finance, law enforcement, immigration, and an agency in charge of peace negotiation in the country.” 

Check Point researchers, who recently examined the Blind Eagle, also known as APT-C-36, noted the adversary and its advanced toolset that includes Meterpreter payloads, distributes through spear-phishing emails. 

How Does APT-C-36 Operate? 

Blind Eagle’s phishing emails lure its victims over the false impression of fear and urgency. The email notifies its recipients that they have "obligaciones pendentes," or "outstanding obligations," with some letters informing them that their tax payments are forty-five days overdue. 

The cleverly-crafted emails are being provided with a link, navigating users to a PDF file that appears to be hosted on DIAN’s website but actually installs malware to the targeted systems, effectively launching the infection cycle. 

The BlackBerry researchers explain it further: 

"The fake DIAN website page contains a button that encourages the victim to download a PDF to view what the site claims to be pending tax invoices," says the BlackBerry researchers. "Clicking the blue button initiates the download of a malicious file from the Discord content delivery network (CDN), which the attackers are abusing in this phishing scam." 

"A malicious [remote access trojan] installed on a victim's machine enables the threat actor to connect to the infected endpoint any time they like, and to perform any operations they desire," they further add. 

The researchers also noted that the threat actors utilize dynamic DNS services such as DuckDNS in order to take control of the compromised hosts. 

Blind Eagle’s Operators are Supposedly Spanish 

Owing to the use of Spanish in its spear-phishing emails, Blind Eagle is believed to be a group of Spanish-speaking hackers. However, the headquarters from where the attacks are conducted and whether the attacks are carried out for espionage or financial gain are both currently undetermined. 

"The modus operandi used has mostly stayed the same as the group's previous efforts – it is very simple, which may mean that this group is comfortable with its way of launching campaigns via phishing emails, and feels confident in using them because they continue to work," BlackBerry said.  

Hackers steal sensitive data

The incident happened when threat actors got into the U.S. Marshals Service's internal systems, which stored confidential data on federal fugitives, as well as details of people involved in witness protection programs. The cybercriminals were able to get these details by abusing a flaw in the federal agency’s systems.

"The affected system contains law enforcement sensitive information, including returns from legal process, administrative information and personally identifiable information pertaining to subjects of USMS investigations, third parties and certain USMS employees," said Drew Wade, the chief of the Marshals’ public affairs office, to Reuters. 

About U.S. Marshals Service

The U.S. Marshals Service is an important law enforcement agency that plays a crucial role in hunting down criminals and making sure the protection of witnesses. The agency's capability to carry out these functions depends greatly on the functioning of its internal computer systems. The attack has impacted the U.S. Marshals Service's ability to do its operations.

Besides the potential damage to the agency, the cyber attack has also risked the security of victims whose data was stolen. The compromised data in the federal agency's computer system includes important personal data, like home addresses and social security numbers. Threat actors can misuse the stolen to perpetrate identity theft or other types of scams.

The rising threat of cyberattacks on government agencies

To prevent future breaches, the U.S. Marshals Service must take steps to strengthen its cybersecurity measures. This includes implementing stronger access controls, conducting regular security assessments, and providing ongoing training to staff on how to detect and respond to cyber threats.

The attack also raises questions about the urgent need for implementing strong cybersecurity measures throughout all levels of government. With the increase in numbers and the threat of cyber-attacks, it is important that government agencies prioritize cybersecurity and take preventive measures to safeguard their sensitive data.

The U.S. Marshals Service breach is a grave warning of the growing threat of cyber attacks on government and federal agencies. It is a sign that threat actors are becoming more sophisticated as each day passes. Therefore cybersecurity experts should be vigilant in finding and responding to cyber threats. If we follow these steps, it can help government agencies to perform their duties and protect the personal data of the individuals they serve.

The contributions made by the Peel Regional Police are one of the reasons why Canadian flag is among the icons displayed on what was the dark website for the Russian-linked ransomware group Hive, along with the logos of the U.S. Department of Justice, the FBI, and a variety of police forces around the globe. 

According to Detective Const. Karim Hussain in an interview with CTV News Toronto, Peel's detectives got engaged early when a local firm contacted them in 2021 claiming that their systems were down and a text message on their desktops revealed a ransom note. 

“We had one of the first cases in Canada of Hive ransomware[…]It was the first to market. At the time we started gathering evidence, Hive was a fairly new ransomware group. Everything we brought to the table was interesting because no one had seen it before,” he says. 

The attributes of the Hive case were similar to numerous other high-profile incidents, like a hospital in Louisiana where threat actors had accessed data of around 270,000 patients, and a Ohio hospital that was attacked and made them incapable of accepting new patients even during the massive surge of COVID-19. 

Those were only a few of the more than 1,500 attacks throughout the globe that had the digital traces of Hive, an organization whose associates, according to authorities, have made $150 million since 2021 as they demand money from companies in exchange for access to their data or system. 

The attacks are carried out via a "ransomware as a service" (RaaS) model, in which a small group of individuals create malicious software and then distribute it to numerous users, allowing them to quickly scale up their attacks before the security flaws they exploit are addressed. 

“You have an overarching group that provides everything down to the infrastructure, to lesser-capable cyber criminals, and they provide them the tools to conduct the hack,” Hussain said. 

The case brought the RCMP, the FBI, the police from France, Germany, Norway, and Lithuania together with Peel Police and other agencies dealing with Hive's impact. 

In retaliation, the group took over Hive's website earlier this year and replaced it with a landing page with the logos of numerous investigative agencies. “Simply put, using lawful means, we hacked the hackers,” said U.S. Deputy Attorney General Lisa Monaco in a press conference in January. 

Adding to this, she says that the police had found and then openly disseminated decryptor keys that may aid anyone who had been assaulted in independently recovering their data or liberating their systems. 

According to Christopher Wray, director of the FBI, these actions have prevented around $130 million in ransom from being paid. “This cut off the gas that is fueling Hive’s fire,” Wray said. 

According to Hussain, the inquiry is still ongoing as the prevalence of ransomware grows. Ransomware assaults made up 11% of all cyber security incidents in 2021, according to Statistics Canada. 

“There’s no end in sight to cybercrime right now,” Hussain said.