Search This Blog
Load More
Trendy Right Now

Popular Posts

Showing posts with label Dark Web. Show all posts
Unauthorized access
Asia bloomberg CCTV Cyber Security Dark Web Database Breach Telegram Unauthorized access

Data Centers Hacked to Collect Data from Multinational Firms

Over the past 18 months, there have been reports of cyberattacks against numerous data centers in various parts of the world, which have led to the leakage of information about some of the biggest corporations in the world and the publication of access privileges on the dark web.

Resecurity discovered several actors on the dark web, some of whom may have come from Asia, who were able to access customer records and exfiltrate them from one or more databases linked to particular apps and systems utilized by various data center firms during the campaign.

Initial access in at least one of the situations was probably obtained through a weak helpdesk or ticket management module which was connected with other programs and systems, allowing the threat actor to move laterally.

According to Resecurity, the threat actor was able to harvest credentials for data center IT personnel and clients, as well as a list of CCTV cameras and their corresponding video stream identifiers used to monitor data center settings.

Bloomberg said that two of the victim companies are GDS Holdings, based in Shanghai, and ST Telemedia Global Data Centres, based in Singapore. Resecurity did not identify the data center operators that were mentioned in the attack.

According to Bloomberg, GDS acknowledged that a customer assistance website was compromised in 2021 but insisted that there was no risk to the IT systems or data of its clients. It presented no risk to the clients, according to ST Telemedia.

According to Resecurity, businesses with a global presence in finance, investment funds, biomedical research firms, technology vendors, e-commerce sites, cloud services, ISPs, and content delivery network firms were among those whose information was exposed. According to the researchers, the companies are headquartered in the US, UK, Canada, Australia, Switzerland, New Zealand, and China.

Resecurity has not pinpointed any known APT groups as the perpetrators of the attacks. The experts point out that numerous, distinct perpetrators might compromise the victims.
Read more »
SEKOIA
Cyber Security Cyberattack CyberCrime Dark Web Infostealer malware Plymouth SEKOIA

Dark Web Malware Steals Your Data

 


As the dark web seeks new customers and victims, it appears that updated versions of information-stealing malware have made their way onto it and are now circulating the dark web. 

There have been reports from cybersecurity researchers from SEKOIA that they have found content promoting a new information stealer called Stealc on several underground forums and Telegram channels. 

Unlike some other info stealers, Stealc is not built from the ground up. Instead, it is an enhanced version of others, such as Vidar, Racoon, Mars, and Redline Stealer, which are popular information stealers. In January 2023, a report of the phenomenon was first noticed, but in February 2023, it gained more attention. 

It has been reported that Stealc was developed by a threat actor called Plymouth who is trying to advertise it as an attack against the country. There appears to be a new patch or update added somewhere between once a week and once a month, and it is currently at version 1.3.0.  Several new features have been added to the website, including a randomizer for C2 URLs, and a system that allows logging searches and sorts to be improved. 

There was also a report that the Ukrainian government spared the lives of those affected by Stealc. 

The SEKOIA team was able to analyze a sample of the info stealer in more depth and discovered that it uses legitimate third-party DLLs, is written in C, exploits Windows API functions to achieve its goals, is lightweight (only 80KB), uses RC4 and base64 to obfuscate most of its strings, and automatically exfiltrates stolen files (the threat actor need not do anything to do anything). 

It was also found that Stealc was capable of stealing data from 22 web browsers, 75 plugins, and 25 desktop wallets, which was also confirmed by SEKOIA.  

Plymouth was also busily deploying it to target devices to advertise it on the dark web as well as distributing it. To do so, they create fake YouTube tutorials as well as employ other ways to make it appear like they know how to crack software. The description of the exploit also provides a link that, in place of executing the advertised crack, instead launches the info stealer in place. That's very helpful since it prevents the use of the crack itself. 

The researchers have already discovered more than 40 C2 servers, thus leading them to conclude that Stealc is gaining quite a bit of popularity in the online world. 

They speculate that the popularity of stealer samples may be because crooks that can access the admin panel can easily generate new stealer samples, therefore allowing the range of stealer samples to extend.  SEKOIA believes that Stealc is quite popular since it is suitable for a wide range of hackers, including low-level hackers.   
Read more »
Safety
Cyber Attacks Dark Web Data data security Safety

The Initial Indications of a Cyberattack on the Dark Web

 


According to research, organizations were subjected to 38% more cyberattack attempts last year than in 2021. While some industry sectors performed better than others (education and research topped the table with 43 percent more attempted attacks, while hardware vendors ranked last with 25 percent), none of the figures are encouraging, no matter what business you're in. 

In reality, attempts and breaches are not synonymous. While you've probably heard from a slew of industry experts that it's "not a matter of if, but when" you'll be targeted, that's not the entire story. As the statistics show, attempted cyberattacks are unavoidable in today's world; however, perseverance and success are two very different metrics.

Cyberattacks rarely occur "out of the great blue yonder," particularly the structured attacks such as ransomware that keep security(opens in new tab) professionals awake at night. Threat actors, like everyone else, organize themselves. They conduct due diligence, perform reconnaissance on the organizations they are targeting, and look for and frequently purchase vulnerabilities that can be used to breach a company's defenses. 

This means that there are opportunities to detect malicious activity in the planning stages before an organization is attacked. Businesses can inform their cybersecurity(opens in new tab) efforts by monitoring the deep and dark web, which are used by threat actors when they are in the reconnaissance phase.

Understand your enemy

Organizations devote significant resources to bolstering their cybersecurity defenses, but they frequently have little understanding of who their attackers are and how they operate. At best, they are stretching their people and budgets thin by attempting to prioritize all risks at the same time. At worst, it can result in a defense misalignment for the threats they face - the cyber equivalent of erecting walls while criminals tunnel underground.

Dark web intelligence is one method for organizations to gain a better understanding of the specific threats to their business. For example, if a company discovers that the credentials and passwords of its employees are available for wholesale online, authentication becomes the obvious priority. Whereas high volumes of dark web traffic to a network port would necessitate increased network security.

Sometimes the hints are not even subtle. Many aspects of a data breach have been outsourced as cybercrime has become more professional. The same criminals launching a ransomware attack may not be the same gang that breached the network in the first place; they may have purchased that access from the aptly named "access brokers," who sell vulnerabilities on the dark web for others to exploit. They, like anyone else who sells a product, must market it. As a result, a company that monitors the dark web for its company name, IP address, or credentials may be able to detect access to its network as it is being sold.
Read more »
Social Media
ACCC Cyber Security CyberCriminal Dark Web Identity Theft Prevention Passwords Social Media

What Can Consumers Do to Protect Their Data?

 


There is a growing concern in Australia that the threat of cybercrime is not just increasing but exploding like crazy at a rapid rate. Recent data from the Australian Competition and Consumer Commission (ACCC) shows that from January to September of this year, Australians lost more than $47 million per month, as reported by ABC television. 

Compared to the same period a year ago, the losses were 90 percent higher than they had been. The actual losses that cyber criminals perpetrate are likely to be quite large since only 13 percent of victims report losing their money to cyber crimes. 

Cybercrime rates surged before the multiple high-profile data breaches that were reported by large corporations in recent months, which occurred before the recent spike in cybercrime. Cybercriminals exploited the lapses in security to steal the details of most Australians and this provided them with the opportunity to commit fraud or to steal their identity. Several reports have already leaked to the media regarding losses caused by those breaches as a consequence of the security breaches. For the nation, this will be a costly time as far as its infrastructure is concerned. 

Identity Theft Prevention: What Can Individuals Do? 

Almost no one in modern society can avoid using the Internet to store data online. There are many services provided over the Internet, and even if you do not enter the data directly yourself, banks, insurers, government agencies, and companies with whom you interact daily will store the data of your accounts, including your financial information, in cloud services, even if you do not directly input the information. A breach could pose a threat to your data without you knowing anything about it or doing anything to expose it to risk. 

Whenever a data breach occurs, the business is legally obligated to inform its customers, so when your data has been compromised, you will know about it (unfortunately, the word "when" does not mean "if"). However, there is an additional proactive measure that you can take if you want to protect your own identity from theft. 

The sooner you act on a data breach, the less damage it will cause to your business. There are a variety of things that you can do to make sure that a breach does not compromise your data if it occurs. However, you may not be able to prevent it. 

1) Be on the lookout for suspicious activity: The common problem when it comes to a breach of a person’s data is that they are not able to take action on it right away. This is because it is not enough. This information will be needed for them to complete their investigation, so they will seek ways to find it. It is a wise idea to be wary if you receive phone calls or emails from sources that you do not know. In addition, you need to be careful if you receive messages that ask you to confirm account details or if your password has been changed. It is clear that if a cybercriminal is looking for more data about you and seeking to obtain it, then they may have some available. 

2) Ensure that you carefully review your account and credit card statements: In the event of any unusual purchases or purchases where you think you may have simply forgotten about the purchase, it would be a wise idea to flag them immediately, regardless of how small they are. 

3) If there has been any change in details: You should always check the date and who authorized any changes to any correspondence you have received from the company or service if you notice some details have changed. 

4) Consult an Identity Restoration Specialist to see if you need help: To gain a better understanding of the most effective approach in practice, as well as how to move forward, consulting with a specialist can be helpful.

In addition, you can take some steps to completely resecure your data right away. If cybercriminals do manage to compromise the system that you're on, then you can be sure that the rest of the information that they need is much more difficult to get, and as a result, it will be more difficult for them to commit identity fraud against you. 

1) Ensure all your passwords are changed and enable two-factor authentication (2FA): It is recommended that you get a dedicated token device or a second phone that you can utilize solely for that purpose. This is in addition to a dedicated token device, to use with 2FA. A strategy called “hijacking phones” has become part of cyber criminal strategies to circumvent your 2-factor authentication measures by convincing your phone company to transfer your number to their device. Once they have done this, any of these methods can be used to circumvent your 2FA measures. There is an easy way to find the telephone number of most people online. The amount of protection against phishing attempts can be increased by having a secure number that does not have any public information about it for 2FA. 

2) Make sure that personal information available on social media is removed as far as possible: A birthday message on your Facebook wall or a tweet on your Twitter feed might be something you look forward to. It is, however, one of the most common pieces of information used to verify your identity, which is your date of birth. There are several reasons why this is so significant since access to your accounts is dependent on it. 

3) You may want to consider freezing your credit rating as a precaution: If you notice any suspicious activity on your credit report, the credit ratings on your credit report should be frozen.  
 
Despite strategies and technologies designed to prevent security breaches, companies cannot be guaranteed to remain secure at all times. In fact, it is much more likely that they have already been compromised without even realizing it in the first place. A company can begin protecting and monitoring sensitive information once the inevitability of a breach is accepted. They begin accepting the necessity of minimizing the risk that could be associated with it.
Read more »
VPN
Cyber Crime Dark Web Email Frauds Encrypted Files Retail Industry Security Guidelines User Privacy VPN

Ways in Which Online Merchants Scam Customers

When attempting to unsubscribe from an email newsletter that the user never subscribed to, one discovers a jumble of text—some of it practically grayed out—at the bottom of the message, making it virtually impossible to find an 'unsubscribe' link? A 'dark pattern' is a kind of internet design that serves to 'deceive, insinuate, and obfuscate,' as seen in that example.

The web has traditionally been rife with shady activities, from viruses to scams. Harry Brignull, a UX specialist, did not turn shedding light on the deceptive internet strategies even the most well-known brands employ until 2010. Harry coined strategies such as the moniker 'dark patterns' to emphasize how detrimental they may be to the victim's mental and financial health.

According to a Which poll, 45% of respondents said that dark patterns made them feel tricked or annoyed, and 13% said that they had been persuaded to spend more money than they had intended. According to the U.S. Federal Trade Commission, consumers end up spending 20% more money when ticket prices are not disclosed upfront. Additionally, a website's dark designs can persuade you to divulge more information than users are comfortable with.

Ways that internet shopping might lure you into splurging:
  • Free delivery minimums
  • Email reassurance
  • Advertisements with retargeting
  • Discounted loyalty programs
  • Discounts for new clients
  • Discounts dependent on subscription
Dark patterns include tricky questions, adding unwanted items to your online shopping cart, and coercing you into disclosing sensitive information. The world's most popular internet retailer, Amazon, is the one deceiving consumers the most. It employs 11 of the 12 identified forms of dark patterns listed above, some of which have sparked inquiries from the FTC and EU regulators. On the other hand, Walmart, probably Amazon's biggest rival, employs just four.

Even though some expenses might be necessary, being aware of the strategies that merchants employ to increase your purchase will prevent you from falling for them. You must have encrypted internet service to receive highly relevant adverts from businesses, that monitor your online activity across multiple websites. VPN offers the highest level of encryption. Your online activities are all susceptible to being recorded and examined by interested parties without Internet privacy protection.


Read more »
Social Media
Cyber Fraud Dark Web Data Safety Security Social Media

Whizcase Study: How $6 Can Buy Compromised Social Media & Streaming Accounts From the Dark Web?

 

The latest Whizcase review reveals that watching the latest film or Netflix series is more affordable than ever, with $100 buying a complete suite of hacked accounts on the Dark Web. Social media accounts are the most abundantly available, with darknet markets overflowing with hacked social media profiles selling for as little as $6 per hacked account. 

According to the report, there is a thriving market for hacked entertainment service accounts: 
  • LinkedIn account: $45
  • Facebook account: $14
  • Instagram account: $12
  • Discord account: $12
  • Snapchat account: $12
  • TikTok account: $6
The majority of these are obtained through social engineering or phishing campaigns after hackers have compromised users' registration email addresses. These accounts are typically linked to their original owners' payment processing solution, which hackers frequently compromise. The original owners have been locked out of these accounts and are unable to unlink their credit card information from them. In these cases, the only option is to cancel the attached credit or debit card.

Whizcase revealed that a hacked account from any major social media network could be purchased for $127. The cheapest is Reddit, which costs $6, and the most expensive is an Instagram account, which costs $12. LinkedIn was the most expensive social profile, costing $45.

When it comes to communication methods, hacked Gmail accounts are the most expensive, costing $45 each. This comes as no surprise given that most businesses use Gmail on a daily basis. Accounts for WhatsApp, Skype, and Telegram range from $18 to $8.

This opens the door for cybercriminals to use these accounts to reset passwords used by their original owners to sign up for various services. This could include both financial and payment accounts. According to the review, many hackers use compromised accounts to run "sophisticated bot farms" for manipulating social media engagement. The advantage is that the manipulation campaigns are much more difficult for social networks to detect.

Purchasing social media engagement is also extremely inexpensive. For only $25, one could purchase 1,000 Twitter retweets from what appeared to be legitimate accounts. Just $8 will get you 1,000 Facebook likes on a page or post. You can select the country of origin for the Likes or retweets for a few dollars more. This demonstrates the importance of exercising caution when looking at popular or highly engaging things on social media. 

Keeping social media and entertainment software accounts secure, as per Whizcase, reduces social disruption, identity fraud, and outright theft. Otherwise, cybercriminals can utilize cybercrime exploits or social media campaigns to disseminate false information, defraud or rob others of money or gaming tokens, or even embezzle their identity.
Read more »
User Privacy
Credit Card Fraud Cyber Criminal Cyber Fraud Dark Web US User Privacy

US Criminals Responsible for Widespread Credit Card Fraud

 

In a case that sounds like a script, US criminals stole more than $1 million by using hundreds of credit cards that were advertised for sale on the dark web. A portion of the details surrounding this complex criminal enterprise have become public after a federal indictment by the U.S. Department of Justice.

The defendant in the case of United States v. Trevor Osagie admitted to planning to steal credit card data between 2015 and 2018. Osagie worked with a gang of robbers to cause damages totaling more than $1.5 million. 

At least 4,000 people were affected. Osagie could be sentenced to up to 30 years in prison and must pay a $1 million fine, according to Bleeping Computer. May 25, 2023, has been designated as the judgement date. The top search engines do not index the websites and services found on the dark web, and only obscure methods are used to access them. The dark web isn't always used for illegal activities, but because of its encryption and anonymity, criminals are drawn to it. 

Using the dark web, Osagie was able to recruit and supervise additional conspirators who played different roles in the fraud. Hamilton Eromosele is charged with leading a criminal organisation that used social media to identify "employees" who would use stolen credit cards to make expensive purchases.

Ismael Aidara then opened fake bank accounts and credit cards while Malik Ajala provided the stolen card information. There are six additional characters in this story, all of whom went to the US to participate in any activity requiring their actual presence. The indictment's namesakes all entered guilty pleas, demonstrating the prosecution's strong case. 

This is what happened. Members of this criminal network received the information after it had purchased flights to the United States, rentals, and lodging using stolen credit and debit card information from the dark web. As the shopping spree continued, expensive items and gift cards would be purchased. 

Social media promoted travel and enormous profits alongside the "workers" who travelled and purchased items for other group members. A portion of the funds were given to the criminal organisation. The police caught the criminals after a chaotic three-year rampage.
Read more »
Typo Squatting
Advertisements Crytocurrency Fraud Dark Web Google Google Ads Hacking MaaS malware OBS Platform Rhadamanthys malware Typo Squatting

Rhadamanthys: Malware Hidden in Google Ads


Threat actors are establishing fraudulent websites for popular free and open-source software in order to promote malicious downloads via advertisements present in the Google search result. 

The info-stealing malware Rhadamanthys uses Google advertisements as a means of luring people into downloading malicious software. The malware steals information including email addresses and passwords in addition to focusing on cryptocurrency wallet credentials. 

Rhadamanthys is sold to criminals as malware-as-a-service (MaaS), and its utility has multiplied as infostealers become a popular tactic to attack targets. 

As of yet, at least one prominent user on the cryptocurrency scene has fallen prey following the malware campaign. According to the victims, the hackers had stolen all their digital crypto assets, along with having access to their professional and personal accounts. 

What is Rhadamanthys? 

According to threat researcher Germán Fernández, Rhadamanthys, named after the demigod child of Zeus and Europa in Greek mythology, has been dominating Google advertising for the widely used OBS (Open Broadcasting Tool) platform, a free video recording, and streaming service. 

Since November 2022, Rhadamanthys’ popularity has been growing rapidly. It has now advanced to a point where, if an online user searches for an OBS, they will eventually encounter five malicious ads at the apex of their Google searches, before seeing legitimate results below. 

A user may download malware, alongside legitimate software after he clicks on these advertisement links. 

In one such instance, 'Alex', a crypto influencer, better known by his online persona NFT God, was hacked following the download of a fraudulent executable for the OBS video recording and streaming program, through Google’s search results. His life was permanently altered when he mistakenly clicked on the fraudulently sponsored advertisement rather than the genuine one. 

“Last night my entire digital livelihood was violated. Every account connected to me both personally and professionally was hacked and used to hurt others. Less importantly, I lost a life changing amount of my net worth,” he tweeted. 

How does Rhadamanthys work? 

According to a report by the security firm Cyble, Rhadamanthys is offered for sale on the dark web and is distributed via spam emails along with Google advertisements. 

Rhadamanthys will start by obtaining relevant device data after a successful intrusion. The data often includes the device's name, model, operating system, OS architecture, hardware details, installed software, IP addresses, and user credentials 

“The Rhadamanthys program is capable of executing certain PowerShell commands[...]It also targets document files, the theft of which (depending on the sensitivity of their data) can cause severe issues for victims,” reads a blog post by cybersecurity firm PCrisk. 

In addition to this, the MaaS targets cryptocurrency wallet credentials by attempting to extract crytowallets’ passwords in order to acquire control of them and their funds. 

“In summary, the presence of stealer-type malware like Rhadamanthys on devices can result in serious privacy issues, significant financial losses, and even identity theft,” PCrisk concluded. 

How Can You Protect Yourself? 

In order to delay the victim’s response, users are advised to evade the malware activity by checking the URL, since the malicious links may seem identical to the official OBS site. The fraudulent URL may contain subtle spelling mistakes, a malicious tactic used to create fake URLs, called Typosquatting.   

Read more »
Russia-Ukraine War
CNI Cyber Security Dark Web Energy Security Russia-Ukraine War

Protecting the World's Energy Systems: Physical and Cybersecurity Need to Coexist

 

Critical national infrastructure (CNI) is under greater physical threat than ever. It is still unknown who was responsible for the attack that destroyed at least 50 metres of the Nord Stream 1 and 2 underground pipelines that once carried Russian gas to Germany. 

More recently, Russia has also changed the focus of its conflict in Ukraine to attack energy infrastructure with its own missiles and drones supplied by Iran, known as the Shahed-136. Volodymyr Zelensky, the president of Ukraine, stated in a tweet on October 18 that "30% of Ukraine's power stations have been destroyed, causing massive blackouts throughout the country," and in a meeting with Kadri Simson, the European Commissioner for Energy, on November 1, Zelensky stated that between "30% and 40% of [the country's] energy systems had been destroyed." 

Increasing threat to cybersecurity

The conflict in Ukraine and the escalating tensions between the East and West aren't the only significant threats to our CNI, though. A growing cybersecurity threat is also present. The Houston, Texas-based Colonial Pipeline, which transports gasoline and jet fuel to the southeast of the United States, had to halt all of its operations on May 7, 2021, in order to stop a ransomware attack. 

Hackers gained access to the company's systems through a VPN (virtual private network) account in this attack, which allowed staff to log in remotely using a single username and password obtained from the Dark Web. Shortly after the attack, Colonial paid the hackers—affiliates of the cyberterrorist organisation Darkside with ties to Russia—a $4.4 million ransom. 

A threat group known as Sandworm, which is allegedly run by the Russian GRU's cybermilitary division, attempted to shut down an unnamed Ukrainian power company less than a year later. The State Service of Special Communications and Information Protection of Ukraine (SSSCIP) said in a statement that the attackers "attempted to take down several infrastructure components of their target, including: Electrical substations, Windows-operated computing systems, Linux-operated server equipment, [and] active network equipment." 

The attempted intrusion involved the use of ICS-capable malware and regular disc wipers, according to Slovak cybersecurity firm ESET, which worked with Ukrainian authorities to analyse the attack. The adversary also released an updated version of the Industroyer malware. 

According to ESET, "the Sandworm attackers attempted to use the Industroyer2 malware against high-voltage electrical substations in Ukraine." It is believed that the victim's power grid network was breached twice, with the first intrusion occurring around the time of Russia's invasion of Ukraine in February 2022 and the second intrusion taking place in April, which enabled the attackers to upload Industroyer2. 

Environmental Digitization

It is now beyond question that cybercriminals pose an ever-increasing threat to critical national infrastructure, according to John Vestberg, CEO of Clavister, a Swedish company that specialises in network security software. CNI, such as oil and gas, is a key target for ransomware gangs, he continues. He thinks that energy companies and their suppliers need to use predictive analytics, tools like artificial intelligence (AI), and machine learning (ML), and a more proactive approach to cybersecurity as opposed to a reactive one. 

The CEO and founder of Flexxon brand X-PHY, Camellia Chan, agrees: "It's crucial that CNI organizations never take their eyes off the ball." In order to detect every type of attack and contribute to the development of a more effective cybersecurity framework, it is crucial to embrace emerging technology, such as AI, as part of a multilayered cybersecurity solution. Neither are the well-organized, frequently state-sponsored ransomware gangs CNI organisations deal with the only issue. Part of the problem is that as industrial organisations (including utilities like water and energy companies) digitise their environments, they are much more exposed than in the past to potential security flaws and vulnerabilities. 

Grid Edge Danger 

The potential for large rewards is one of the things that draws cybercriminals to target energy companies, according to Trevor Dearing, director of critical infrastructure solutions at zero-trust segmentation company Illumio. Many gangs are realising that businesses are more likely to pay the ransom if they can stop the service from being delivered to customers rather than just stealing data, he claims. 

He adds that the fact that energy systems no longer only consist of the conventional grid with power plants and power lines is another issue. The "grid edge," which consists of decentralised devices like smart metres, solar panels, and batteries in people's homes and businesses, is what's emerging in its place. When threat actors used a known vulnerability in Cisco firewalls to disrupt communications over the course of about 12 hours in March 2019, the Utah-based company sPower, which owns and operates more than 150 generators in the US, was thought to be the first renewable energy provider to be targeted by a cybersecurity attack. 

The inverters in renewable energy systems are one area where they are particularly open to attack. These act as a bridge between solar panels and the grid, converting the DC (direct current) energy produced by PV (photovoltaic) solar panels into AC (alternating current) electricity supplied to the mains. The inverter's data could be intercepted and manipulated in a manner similar to earlier attacks in the US and Ukraine if its software isn't up to date and secure. Additionally, a hacker could insert malicious code into an inverter to spread throughout the larger power system, causing even more harm. 

The co-author of a 2018 paper evaluating the cybersecurity risk of solar PV, Ali Mehrizi-Sani, an associate professor at Virginia Polytechnic Institute and State University, claims that hackers can artificially cause a PV system to malfunction in order to launch cyberattacks against the inverter controls and monitoring system. In November 2020, he told the website PV Tech, "This is a vulnerability that can be, and has been, exploited to attack the power system." Since the technology hasn't yet reached critical mass, the risk of a cybersecurity attack on solar power networks is currently low. 

However, as the industry becomes more decentralised, with solar panels installed in public spaces and on top of buildings, managing networks will depend more and more on strong, cloud-based IoT security.

Greater Control 

Implementing standards is one way that both organisations and governments can guarantee the highest levels of CNI protection. The ISO 27001 family of standards for information security management systems (ISMS) are required of all network providers, operators, and other CNI businesses in Germany, for instance, and there are obligations set forth in the UK's BSI Criticality Ordinance to demonstrate a comprehensive IT security strategy to secure the operation of critical infrastructure. 

Similar to how NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) governs critical infrastructure in the US, this set of regulations only applies to the electricity sector and excludes the oil and gas sectors. Cliff Martin, head of cyber incident response at GRCI Law, a legal, risk, and compliance consultancy firm, asserts that personnel in charge of CNI must receive the appropriate training and comprehend that their actions may have real repercussions. This means they are unable to simply transfer existing traditional IT cybersecurity measures to the IT environment because that is simply not how it works.

But according to Illumio's Dearing, an increasing number of businesses are creating a single strategy for both OT and IT environments. "He explains that the secret is to prepare as though you will be attacked. An attack on one part of your infrastructure won't necessarily have an impact on the other parts if you segment it by separating out all the various components." 

Companies have been made aware of the physical threat to energy infrastructure, especially during the coldest months of the year in the northern hemisphere, thanks to the conflict in Ukraine and the attacks on the Nord Stream pipelines. That's not the only issue, though. Attacks on CNI's cybersecurity are on the rise, in part due to a rising threat from nation-state actors but also because cybercriminals are becoming more aware of the potential financial rewards of depriving customers of a crucial service. The convergence of OT and IT technologies is also giving cybercriminals a potentially much bigger attack surface to work with.

While historically security has not been viewed as a crucial factor for OT, this needs to change with a greater focus on technical solutions like network traffic segmentation and continuous monitoring. Only then will businesses be able to stop a potentially catastrophic breach to CNI.
Read more »
User Security
Dark Web Data Breach Data Leak Private Data San Francisco User Security

Hackers Release Private Information Following an Attack on the San Francisco Transit Police

 

Malicious hackers have uploaded a vast collection of private documents from the police department of a San Francisco Bay Area transit system to the internet, including specific claims of child abuse. 

The Bay Area Rapid Transit (BART) Police Department is responsible for the breach. BART's chief communications officer, Alicia Trost, stated in an email that authorities were looking into the uploaded files and that there had been no impact on BART services as a result of the hackers. The exact date of the hack is unknown. 

The culprits are part of a well-known ransomware hacker group that targets particular businesses and either encrypts private files or threatens to post them on the dark web. A review by NBC News found that the website where the BART Police leaks were posted contains more than 120,000 files.

Among the files are at least six scanned, unredacted reports describing alleged child abuse. These reports include the names and dates of birth of the children who are in danger, as well as descriptions of the alleged adult abusers in some cases. 

To prevent file sharing, ransomware hackers frequently demand money. Trost declined to provide more details, but Brett Callow, an analyst at the cybersecurity company Emsisoft, believes that the fact that the files are currently accessible online suggests that BART declined to make payment. 

A police officer can recommend a person for a mental health evaluation using the website's mental health record form. Other files include hiring paperwork for potential officers, police reports that name suspects in various crimes, and the names and licence numbers of contractors who have worked on BART projects.

Even though cyber extortion attacks on American public sector organisations, including police departments, have increased in frequency, such sensitive police file leaks are still uncommon. According to a survey conducted by Emsisoft, ransomware hackers successfully attacked over 100 networks connected to local government organisations last year. 

According to a Treasury Department estimate, ransomware attacks cost American businesses $886 million in 2021, the most recent year for which data is available. 

“Unfortunately, not enough progress has been made in securing public sector organizations,” Callow stated. “They can compromise investigations, resulting in exceptionally sensitive information leaking online, and even put people’s lives at risk — both officers and the public's.” 

A different hacker group broke into the Washington, D.C., Metropolitan Police Department in 2021 and released private information about 22 officers after the department refused to pay. 

Such hackers frequently target school districts in their attacks. Due to a "cyber security incident," which is a phrase frequently used to refer to a ransomware attack, Des Moines Public Schools cancelled classes on Tuesday. According to Emsisoft, ransomware affected nearly 2,000 American schools in 2022.
Read more »
Threat Group
Cybersecurity Dark Web Internet Security. malware PureCoder TG Soft Threat Group

Multiple Malware Being Sold on Darkweb Forums


Researchers have recently discovered a new threat group, PureCoder, apparently selling numerous malware on the dark web. They listed malware such as miners, information stealers, and crypters, used by threat actors for their campaigns. 

Spread of PureLogs/PureCrypt 

Two of the most efficiently advertised malware, sold by Purecoder include PureLogs and PureCrypt.

The threat actors as well have posted details of the aforementioned malware in cybercrime forums in order to garner the interest of their customers. 

PureLogs and PureCrypt

  • PureLogs: A malicious DotNET program created for stealing browser data, crypto wallets, and other applications. Reportedly, these malwares are being sold at $99 for a year subscription. 
  • PureCrypter: This malware distributes multiple RATs and stealers. It is being sold for $59, for a one-month subscription and $245 for a lifetime subscription. 

Used by Other Threat Groups 

Most recently, an Italian cybersecurity company TG Soft discovered that PureLogs information stealer was being used by Alibaba2044 threat actors, that was being utilized for launching a spam campaign targeting Italian online users.

  • Fraudulent emails attached with a link were being used to download the password-protected zip file. 
  • The email contained a cabinet file that was disguised as a batch file and contained a malicious executable and the password to open the file. 
  • The batch file, once opened by the targeted victims, will further lead to the (PureLogs stealer) being executed on their systems. 

Various Tools on Offer 

Moreover, the PureCoder group is offering various additional malicious software besides PureLogs and PureCrypter, such as: 

  • PureMiner: The cost of the tool is $99 for a year of access and $199 for lifetime access. It functions as a covert, stealthy, and silent miner. 
  • BlueLoader: A significant number of bots are managed by the BlueLoader botnet, which may be purchased for $99 for a year or $199 for a lifetime. 
  • PureHVNC: A hidden stealth VNC to control systems, sold for one-year use at $99. 

Easy and affordable access to such malicious tools is a serious matter of concern to online users. As a precautionary measure, users are advised to avoid opening suspicious links and email attachments. Moreover, use reliable anti-malware and Internet security software.  

Read more »
Metaparasites.
Cyber Fraud Cyber Scams Cybersecurity Dark Web Metaparasites.

Dark Web Metaparasites & Scammers: A Quick Look

 


In many cases, cybercriminals are seen as parasites, always looking for victims of all sizes and stripes and preying on them. 

The trend has resulted in an array of bottom-feeding "metaparasites" flocking to the Dark Web marketplace, seeking to take advantage of their own set of victims. 

A common side effect of this phenomenon is that it provides researchers with a rich vein of threat intelligence, including contact details and locations of cybercriminals. This intelligence can help them identify threats. 

Matt Wixey, the Sophos senior threat researcher, spoke at Black Hat Europe 2022 about the ecosystem of metaparasites. In his talk titled, "Scammers Who Scam Scammers, Hackers Who Hack Hackers," he explained how this contributes to the proliferation of scams and phishing scams. 

According to the research Wixey and his fellow researcher, Angela Gunn, conducted, the underground economy is riddled with a large variety of fraudsters. Every year these fraudsters collect millions of dollars from fellow cybercriminals who collaborate with them. 

A study conducted by The Dark Web Research team (Russian-speaking Exploit and XSS forums as well as English-speaking Breach forums) reveals that there have been thousands of successful scam attempts in the past 12 months. 

According to the report, scammers have cheated users by about $2.5 million over the past year. The amount can vary from as little as $2 up to low six-figure money. The amount per scam varies, depending on the type of scam. 

Even though tactics vary, a common and effortless tactic is called "rip and run." There are two versions of the term "rip." First, a buyer receives goods, such as an exploit, sensitive data, valid credentials, credit card numbers, etc. In the second version, a seller receives the payment but never delivers what he promised. There is also the phrase "run." This refers to how the scammer has disappeared from the marketplace and has refused to answer any questions that they have received. 
It depends on the dine-and-dash concept on the Dark Web. 

In addition to the vast number of scammers hawking fake goods out there, those scammers can also be found hawking fake accounts - often nonexistent crypto accounts, macro builders that create nothing malicious, fake data, or databases that have previously been leaked or are available online. Depending on the situation, they can get pretty creative, according to Wixey. 

"Our research led us to find a service that claimed it could bind an. EXE script to a PDF so that when a victim taps on the PDF to open it, the. EXE would run silently in the background while the PDF would load," Wixey further explained. 

The scammer sent the buyer a document with the PDF icon, but it did not contain a PDF, nor did it contain an. EXE. He just sent them a document appearing as a PDF. They hoped that buyers would not know what they were asking for or how to check it. 

A scam is also common when a seller publicized that the goods they are selling are of a certain quantity but the quality of the goods might not live up to what has been advertised, like credit card data that claims to work 30% of the time when only 10% of these cards are working. The databases might be real, but they are being marketed as "exclusive" while the seller is reselling them to, a multitude of parties to make a profit. 

The fraudsters may often work in conjunction in some cases, and they may be involved for a longer period, Wixey said. According to Wixey, the fact that most sites are exclusive makes it possible for them to create "a degree of intrinsic trust" that they can play off of." 

There are a variety of ways one can use this technique. First, one builds rapport with a target and suggests they can help; then the victim will say that they know someone else who can do the job much better, who is an expert in this field.  

Most often, they direct the victim to a fake forum that is operated and monitored by another person. This forum often asks for a deposit or registration fee, which is then paid by the victim. Both scammers then simply disappear. 

What forum moderators are doing to fight back

Wixey noted that the activity has a detrimental impact on the use of Dark Web forums - acting as an "effective tax on criminal marketplaces, which makes them more expensive and more dangerous for everyone, as well as more unsafe for the criminal community." Despite this, ironically, many markets are implementing security measures to curb the tide of fraud in the market. 

Putting protections on forums can be difficult due to the following factors. Firstly, there is no recourse to law enforcement or regulatory authorities. Secondly, it is a semi-anonymous culture, which makes it challenging to track down perpetrators. To combat fraud, anti-fraud controls have been implemented to track activity and issue warnings to prevent fraud. 

A popular industry-standard practice of some sites is to provide a plug-in that checks a URL to check if it links to a verified cybercrime forum, as opposed to a fake site where users are defrauded through a bogus "joining fee." Other sites offer a "blacklist" of known scammers and their tools and user names. Users can also file a scam report with many of the companies that have a dedicated arbitration process in place. 

According to Wixey, "If you have been scammed by another person of a forum, you should go to one of these arbitration rooms and create a forum thread and provide some information about what you have been scammed by." As much information as possible is required, such as a username, contact information for the scammer, proof of a purchase or wallet transfer, screenshots, as well as chat logs, and screenshots, as well as any additional details of the scam. 

"A moderator will review and respond to the report, requesting more information if necessary to complete the process. Later, they will tag the accused person and give them somewhere between 12 and 72 hours to respond to the complaint, depending on what forum it is on," Wixey explained. 

There may be cases where the accused makes restitution, but that is not very common. What is more common is that the scammer disputes the report, claiming that the report was wrong and there was a misunderstanding about the terms of the sale. 

The use of a guarantee is another security option available to forum users. This is because it shows that this resource has been verified by the site and acts as an escrow account. Until the goods or services involved in the exchange are confirmed as legitimate, the money destined for trading is parked there. 

Despite this, it is common for fraudsters to impersonate the guarantees themselves.
Read more »
User Privacy
Dark Web Data Breach Hackers Phishing Attack Ransomware Attacks. User Privacy

Cyberattack on the City of Antwerp's Servers Triggered via PLAY Ransomware

The PLAY group has warned that on December 19, it will start disclosing data that was stolen from Antwerp. The information that was stolen remains unknown.

The IT, email, and phone services in Antwerp were interrupted last week as a result of a ransomware attack on Digipolis, the IT firm in charge of overseeing the city's IT infrastructure.

According to VRT News, a cyberattack on Monday also affected the city of Diest, which has around 20,000 citizens. The portal is used by the ransomware gang to showcase victims. 

According to VRT News, a cyberattack on Monday also affected Diest, a city of around 20,000 people. The page is used by the ransomware organization to highlight victims. 

According to journalist Tim Verheyden of VRT News, Play is well-known in the hacker community. The United States, Canada, Bulgaria, and Switzerland have all experienced significant cyberattacks from them, and now they claim the attack on the City of Antwerp.

Brett Callow, an Emsisoft security analyst, saw that the Play ransomware campaign began mentioning Antwerp as one of its victims over the weekend. According to this Antwerp item on the data leak website, the incident resulted in the theft of 557 GB of data, including personal data, passports, IDs, and financial papers.

Data from the city has not yet been disclosed, despite the threat actors' assurances that they will start doing so in a week if a ransom is not paid.

Johan de Muynck, general manager of Zorgbedrijf Antwerpen an Antwerp Healthcare, issued a warning that the system the business relied on to keep track of who ought to receive which medicines was not functioning at the moment. Instead of conventional computerized prescriptions, patients currently receive paper prescriptions that have been signed by doctors.

Despite the fact that the server issues had not been fixed, Zorgbedrijf Antwerpen announced in a statement posted to its website on Monday that limited telephone access to customer service was now available as a result of an emergency fix.
Read more »
User Privacy
Dark Web Email Fraud Have I Been Pwned MFA Password Phishing Attacks Privacy User Privacy

 Find Out if Your Email Address Is Being Sold on the Dark Web


Almost everybody uses email. You have probably had a data breach if your private information, like your email address, is discovered on the dark web. There are numerous methods to sell and use your personal information.  

The portion of the Internet that is hidden and inaccessible with a standard web browser is known as the dark web.  The dark web's material is encrypted and needs special permission to access. The most popular method for accessing the black web is Tor, a program that masks IP addresses and locations. Additionally, hackers can easily purchase and sell identity-related information on the dark web, including credit card data, Social Security numbers, medical records, passports, etc. 

How to search for your email on the dark web

1. Launch a computer scan

Unusual or suspicious activity is a certain indication that your email account has been hijacked. Monitoring your laptop for viruses. For instance, it is very likely that your account has been hijacked if you find that your recovery email address or phone number has changed. 

2. Search Have I Been PWned?

You can utilize the website Have I Been Pwned to determine whether your data has been exposed as a result of a breach. The free tool gathers data while searching the internet for database dumps.

3. Employ a password manager

The entire objective of password managers is to assist users with all aspects of password management. A built-in password generator is typically included with password managers, allowing you to create complicated, secure passwords right away. 

4. Make use of two-factor authentication

A hacker will have a much harder time gaining access thanks to the additional layer of security provided by two-factor authentication. 

You must confirm the login attempt after providing your normal information. Usually, to do this, you will get a text message with a random number that you must enter in order to access your account. By doing this, even someone who knows your email and password cannot access your accounts.  

In some circumstances, opening a new email account could be the best and safest choice. From social media to banking, disconnect all of the accounts from the compromised address and link them to a new one.  

Users ought to use more than one email account to achieve optimal security. Decentralizing your online presence and protecting your devices from cyber risks can be accomplished in large part by setting up distinct accounts for work, banking services, social networking, and newsletter subscriptions. Users must ensure they are aware of cybersecurity fundamentals because maintaining online safety takes more than just securing their email account.
Read more »
Security Firm Hack
Confluence servers Cyber Attacks Dark Web Data Theft Indian Cybersecurity Firm Security Firm Hack

CloudSEK Blames Another Cybersecurity Company for the Hack

 

An Indian cybersecurity company claimed that another cybersecurity company had accessed its internal training website using a credential from a compromised collaboration platform. 

The CEO of Bengaluru-based CloudSEK, Rahul Sasi, declined to name the alleged offender other than to describe it as a "notorious Cyber Security organization that is into Dark web monitoring." 

An update to an ongoing cybersecurity incident was posted late Tuesday night by CloudSEK, which claims to use artificial intelligence to predict cyber threats. It stated that someone had obtained an employee's login information for the company's Atlassian Jira issue-tracking platform and used it to access the Atlassian Confluence server. 

Although "no database or server access was stolen," Sasi noted, the attacker grabbed "certain internal details including screenshots, issue reports, names of clients, and schema Diagrams." About two hours later, Sasi filed an update stating that attack indicators had pointed to the unnamed dark web monitoring firm. 

Sasi also reported that a hacker going by the handle "sedut" joined several forums for cybercriminals and refuted claims that they had gained access to the company's VPN, primary database, and Twitter account. CloudSEK acknowledges that a hacker did gain access to its Jira instance and retrieve some customer purchase orders. 

The company claims the hacker compromised a takedown account but was unable to reach the company's primary Twitter account. It continues that the allegedly authentic screenshots and video of the database that "sedut" released online was really stolen from training webpages that were published on Atlassian servers. The business claims that while the hacker did not obtain VPN login credentials, they did access its VPN IP addresses. 

Concerning how the employee's Jira credentials were hacked in the first place, the business claims that it shipped a broken staff laptop to a third-party vendor, who then returned it with the Vidar Stealer pre-installed. According to CloudSEK, the information thief operator published the employee's session cookies to a black market on the same day that the attacker bought them. 

An advertisement for supposed CloudSEK data has been posted in a criminal forum by a "sedut": $10,000 for the database, $8,000 for the code base, and $8,000 for employee and engineering product documentation. No "suspicious behavior" has been discovered, according to CloudSEK, in its code repositories.
Read more »
Palo Alto Networks' Unit 42
BEC Attacks Cyber crimes Dark Web Palo Alto Networks Palo Alto Networks' Unit 42

Cybercrimes are More Interconnected and are Likely to be More Prevalent


According to two senior representatives from the cyber-security company, Palo Alto Networks, cybercrime and online scams are anticipated to be more prevalent than in previous years. 

Among various cyber threats, business e-mail compromise (BEC) and ransomware attacks continue to be on the top of the global watch list. 

As per Ms. Wendi Whitmore, Palo Alto Network’s Unit 42 senior vice-president, BEC scams, targets both corporations and individuals making genuine transfer-of-funds requests. It makes BEC the most common and costly threat to organizations worldwide. 

“We see (criminal) organizations where you’ve got a member in Nigeria that’s closely communicating (on the Dark Web) with someone in Eastern Europe, and maybe communicating closely with someone in Asia […] I think that as the economy continues to have more challenges, we’re going to see even more of that level of interconnectivity,” says Ms. Whitmore. 

On the FBI Internet Crime Complaint Centre report 2021, BEC continues to hold the apex position, for the sixth year. 

Does Dark Web Harbor Cybercrime? 

Mr. Vicky Ray, a principal researcher at Unit 42 who studies data and telemetry used in such global cyberattacks, believes that the Dark Web has become a breeding ground for cybercrime. 

On the Internet or the ‘Surface web,’ which is readily accessed by the general public, one can look for a variety of information or participate in forums. On the other hand, in order to access Dark Web, one needs a certain browser and a known URL. Some Dark Web forums demand that new members have a known party vouch for them. 

According to Palo Alto, the growth of Darknet markets in Asia has given cybercriminals more flexibility, since the platform's anonymity makes it less likely that they will ever be tracked. 

“It’s hard, but at the end of the day, it is our job to connect these dots together to really answer... the hard question of who may be behind it (a cyberattack) or what the motivation is.” Mr. Ray told The Straits Times. 

No matter if the attack is a ransomware attack or a data breach, cyber criminals are in an ecosystem where “everyone supports each other and collaboration is everywhere”, he continues, showing a screengrab of a malware developer apparently receiving feedback on a Dark Web forum. 

“What has changed in the past three years has been the tactics of ransomware as a service […] These gangs who were actually creating and using the ransomware to target victims, or potential victims back in the day, what they have realized is, if they provide that to other criminals, who are called affiliates, they can be more profitable,” he adds. 

Cybercrime on Dark Web

Criminals on the Dark Web co-operate in an operation in a variety of ways, from "consultants" who offer professional guidance to affiliates who buy malware from developers. 

However, there also lies a similar collaboration between law enforcement and business parties, like Palo Alto, which shares its criminal research with Interpol. 

In one such case, for instance, in 2021, the Nigerian Police Force detained 11 members of certain cybercrime gangs, who are assumed to be part of a threat group ‘SilverTerrier’ recognized for their BEC scams, said Interpol on its website. 

During Operation Falcon II, which ran from December 13 to December 22, 2021, investigators analyzed data from the network's BEC scams, which were allegedly linked to 50,000 individuals. One suspect had more than 800,000 potential victim domain credentials on his laptop, while no monetary amount was disclosed. 

In regards to this, Interpol said, “Through Interpol’s Gateway initiative, Palo Alto Networks’ Unit 42 and Group-IB (a cyber-security firm) have contributed to investigations by sharing information on ‘SilverTerrier’ threat actors, and analyzing data to situate the group’s structure within the broader organized crime syndicate. They also provided key technical expertise consultancy to support the Interpol teams.” 

The Gateway Initiatives aid law enforcement agencies and corresponding private companies to communicate information in a secure and quicker manner, in order to mitigate and disrupt cybercrime.

“We really see the significance of these (partnerships)... So you will see a lot of the law enforcement now openly talking to us and collaborating,” adds Mr. Ray  

Read more »
User Privacy
Dark Web Data Breach Malicious actor Medibank User Privacy

Deutsche Bank Denied Despite Data Sold on Telegram

The hacking gang that breached Medibank's systems may also be the hackers who are providing access info to Deutsche Bank's systems on the darknet. As a result, there has been a significant attack on Deutsche Bank. 

Malicious actors (0x dump) are allegedly selling internet access to the network of the large international investment bank Deutsche Bank after claiming to have hacked it. The bank's internal networks appeared to be available for sale on Telegram by an initial access broker, but Deutsche Bank has denied that its systems have been compromised (IAB). 


Data Breach Incident

Hackers said, "We are offering further network access of a specific bank, We have DA (direct access), the domain contains about 21 k workstations set primarily with Windows."

The notice was placed next to an image of the Frankfurt headquarters of Deutsche Bank with the Deutsche Bank emblem overlaid on it. 

One of several experts to disclose the revelation made by the initial access broker on Telegram was the security researcher Dominic Alvieri. 

The IAB asserts access to some 21000 Windows-based machines on the bank's network. It further states that a Symantec EDR solution with 16 terabytes of data was used to defend the hacked devices.

Access to 7.5 Bitcoin from the Deutsche Bank, valued at about $156,274, is being made available by the IAB. 

According to ransomware researcher Dominic Alvieri, Ox dump is the same broker who provided access to Medibank's systems, the Australian health insurance company that had 9.7 million client and employee details stolen last month.

Personal information exposed in the data breach includes names, addresses, dates of birth, phone numbers, email addresses, Medicare numbers for clients, and occasionally passport numbers for our overseas students. It also includes some information about health benefits.

According to Lawrence Abrams of Bleeping Computer, it is not the same hackers who took the data from Medibank, rather, it is a suspected initial access broker. However, it might be the same individual who provided the ransomware gang with access to the network.
Read more »
im Deep Web
Cyber Crime Dark Web Deutschland Hydra im Deep Web

German Police Arrests Student Operator of Dark Web, Likely to Face 10 Years


Student operating biggest dark web forum arrested

A 22-year-old student, that German federal police suspect to be the leader of one of the biggest German-speaking, dark-web forums has been captured.

The accused, whose identity has not yet been disclosed, is charged with operating a criminal trading platform and will face up to 10 years in prison if found guilty. 

He was caught in October when officers and federal cops from the Central Office for Cybercrime Bavaria (ZCB) inspected two homes and seized systems, smartphones, and other evidence. 

Dark web responsible for shooting rampage at Munich Mall

As per German law enforcement, the student is from Lower Bavaria, and who worked as an operator of the third variant of Deutschland "im Deep Web" since November 2018. 

The initial version's tor website surfaced on the criminal underground landscape in 2013. After three years, an 18-year-old bought a gun and 300 rounds of ammo via the illegal marketplace before killing at least 9 people in a shooting frenzy at a Munich mall. 

Police closed the operation, however, new versions appeared

German police closed down Deutschland im Deep Web in 2017 after the murderous rampage, and also captured the operator during the time, who was convicted to seven years in prison in 2018. 

After that, however, two new variants of the marketplace surfaced, selling weapons, illegal goods, and weapons, under the motto "No control, everything allowed." 

The police closed down the latest version of the dark-web souk in March 2022. During the time, it had nearly 16,000 registered users and 72 active traders, as per law enforcement. 

The site currently shows a banner that says: "The platform and the criminal content have been seized by the Federal Criminal Police Office and the Bavarian Central Office for the Prosecution of Cybercrime."


Deutschland Arrest, joint effort by federal agencies

The Deutschland im Deep Web arrest comes after another dark web shut down earlier this year through a joint effort by German federal police and US law enforcement agencies. 

In April, the two countries slayed Hydra, the longest-operating known dark-web marketplace trafficking in illicit drugs and money-laundering services. 

First, German police captured Hydra servers and cryptocurrency wallets having $25 million in Bitcoins, therefore closing down the online souk. 


Charges pressed, dark web sanctioned


Also, the US Justice Department declared criminal charges against one of the suspected Hydra leaders and system admins, 30-year-old Dmitry Olegovich Pavlov from Russia, and the US treasury Department sanctioned the dark-web atrocities. 

The U.S. Department of the Treasury in its press release said:

"Russia is a haven for cybercriminals. Today’s action against Hydra and Garantex builds upon recent sanctions against virtual currency exchanges SUEX and CHATEX, both of which, like Garantex, operated out of Federation Tower in Moscow, Russia. Treasury is committed to taking action against actors that, like Hydra and Garantex, willfully disregard anti-money laundering and countering the financing of terrorism"

Read more »
Shadowy Websites
Cyber-attacks Dark Web Data Breach Fake Accounts malware Shadowy Websites

Dark Web Threats: How Can They Be Combated?





The Dark Web is often considered one of the most dangerous sources of brand reputational threats. Another very significant source of threats is the so-called shadowy websites. To keep themselves safe from cybercrime, organizations need to be able to monitor this ecosystem.

In the past, reputational missteps resulted from one of the primary causes of reputational damage: poor judgment and malfeasance. It has done great damage, both from an economic and ethical point of view. It is estimated that Volkswagen's quarterly operating profit dropped by almost 450 million euros six months after the diesel emissions scandal broke.  

Several dozen fake accounts were exposed at Wells Fargo and the bank was fined $185 million. There have also been instances when digital problems have been as powerful as traditional ones. In 2013 the infamous Target data breach turned out to be a $162 million loss for the company, as a result of the breach that occurred.  

Big enterprises create several systems to guard themselves against attacks that can cause disasters, in 2016 the estimated number of systems was 75.

The CEO of the security platform mentioned that scanning the web supports business and help them to safeguard from cyberattacks or find exfiltrated data previously.

A cyber-attacker who is planning to attack your company may seek advice from a third party or try to obtain resources, such as a botnet, on the Internet to deliver malicious payloads to your computer. Essentially, if you know where to look for them, you can find information that might alert you to an upcoming attack, so you need not worry about not being able to find it.

If a set of credentials is in the wrong hands, it only takes one set of credentials for your company to suffer a major blow in terms of its reputation. Detecting stolen credentials is not difficult - they are in the market for sale, so you can scan them for free! 

VIPs and corporate executives are of particular interest to hackers because they contain personal information about them. The information can be used to build convincing spearfishing attacks to gain access to sensitive information or intellectual property by using convincing spearfishing attacks. It is possible for some information, such as travel plans, to even put these individuals in a dangerous situation.

On a positive note, it is also good news that vulnerabilities about malware are one of the main topics of discussion on the dark web. With the proper threat intelligence, you can learn whether you are susceptible to potential cyber threats and if so, what you need to do to protect yourself. Thus, if you prepare in advance, you will be in a better position to deal with surprises in the future.
Read more »
Subscribe to: Posts (Atom)