Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Hackers. Show all posts
Hackers
antivirus updates Cyber Attacks Cybersecurity eScan GuptiMiner malware Hackers

Hackers Utilize Antivirus Update Mechanism to Deploy GuptiMiner Malware

 

North Korean hackers have been utilizing the updating system of the eScan antivirus to infiltrate major corporate networks and distribute cryptocurrency miners via the GuptiMiner malware, according to researchers.

GuptiMiner, described as a highly sophisticated threat, possesses capabilities such as performing DNS requests to the attacker's DNS servers, extracting payloads from images, signing its payloads, and engaging in DLL sideloading.

The delivery of GuptiMiner through eScan updates involves a technique where the threat actor intercepts the normal virus definition update package and substitutes it with a malicious one labeled 'updll62.dlz.' This malicious file contains both the required antivirus updates and the GuptiMiner malware disguised as a DLL file named 'version.dll.'

Upon processing the package, the eScan updater unpacks and executes it as usual. At this stage, the DLL is sideloaded by legitimate eScan binaries, granting the malware system-level privileges.

Following this, the DLL retrieves additional payloads from the attacker's infrastructure, establishes persistence on the host through scheduled tasks, manipulates DNS settings, injects shellcode into legitimate processes, utilizes code virtualization, encrypts payloads in the Windows registry, and extracts PEs from PNGs.

To evade sandbox environments, GuptiMiner checks for systems with more than 4 CPU cores and 4GB of RAM, and it also detects the presence of certain security tools such as Wireshark, WinDbg, TCPView, and others, deactivating them if found.

Researchers from Avast suggest a potential link between GuptiMiner and the North Korean APT group Kimsuki, noting similarities in information stealing functions and the use of common domains.

The hackers deployed multiple malware tools, including enhanced versions of Putty Link as backdoors targeting Windows 7 and Windows Server 2008 systems, and a modular malware designed to scan for private keys and cryptocurrency wallets.

Additionally, the XMRig Monero miner was used in some instances, possibly to divert attention from the primary attack.

Following disclosure of the vulnerability to eScan, the antivirus vendor confirmed that the issue was addressed. eScan has implemented more robust checking mechanisms for updates and transitioned to HTTPS for secure communication with clients.

However, despite these measures, new infections by GuptiMiner persist, potentially indicating outdated eScan clients. A list of GuptiMiner indicators of compromise (IoCs) has been provided to aid defenders in mitigating this threat.
Read more »
Social Engineering
AI Cyber Attacks Hackers Intelligence Social Engineering

Where Hackers Find Your Weak Spots: A Closer Look


Social engineering is one of the most common attack vectors used by cyber criminals to enter companies. These manipulative attacks often occur in four stages: 

  1. Info stealing from targets
  2. Building relationships with target and earning trust
  3. Exploitation: Convincing the target to take an action
  4. Execution: Collected info is used to launch attack 

Five Intelligence Sources

So, how do attackers collect information about their targets? Cybercriminals can employ five types of intelligence to obtain and analyze information about their targets. They are:

1. OSINT (open-source intelligence)

OSINT is a hacking technique used to gather and evaluate publicly available information about organizations and their employees. 

OSINT technologies can help threat actors learn about their target's IT and security infrastructure, exploitable assets including open ports and email addresses, IP addresses, vulnerabilities in websites, servers, and IoT (Internet of Things) devices, leaked or stolen passwords, and more. Attackers use this information to conduct social engineering assaults.

2. Social media intelligence (SOCMINT)

Although SOCMINT is a subset of OSINT, it is worth mentioning. Most people freely provide personal and professional information about themselves on major social networking sites, including their headshot, interests and hobbies, family, friends, and connections, where they live and work, current job positions, and a variety of other characteristics. 

Attackers can use SOCINT software like Social Analyzer, Whatsmyname, and NameCheckup.com to filter social media activity and information about individuals to create tailored social engineering frauds. 

3. ADINT (Advertising Intelligence)

Assume you download a free chess app for your phone. A tiny section of the app displays location-based adverts from sponsors and event organizers, informing users about local players, events, and chess meetups. 

When this ad is displayed, the app sends certain information about the user to the advertising exchange service, such as IP addresses, the operating system in use (iOS or Android), the name of the mobile phone carrier, the user's screen resolution, GPS coordinates, etc. 

Ad exchanges typically keep and process this information to serve appropriate adverts depending on user interests, behavior, and geography. Ad exchanges also sell this vital information. 

4. DARKINT (Dark Web Intelligence)

The Dark Web is a billion-dollar illegal marketplace that trades corporate espionage services, DIY ransomware kits, drugs and weapons, human trafficking, and so on. The Dark Web sells billions of stolen records, including personally identifiable information, healthcare records, financial and transaction data, corporate data, and compromised credentials. 

Threat actors can buy off-the-shelf data and use it for social engineering campaigns. They can even hire professionals to socially engineer people on their behalf or identify hidden vulnerabilities in target businesses. In addition, there are hidden internet forums and instant messaging services (such as Telegram) where people can learn more about possible targets. 

5. AI-INT (artificial intelligence)

In addition to the five basic disciplines, some analysts refer to AI as the sixth intelligence discipline. With recent breakthroughs in generative AI technologies, such as Google Gemini and ChatGPT, it's easy to envisage fraudsters using AI tools to collect, ingest, process, and filter information about their targets. 

Threat researchers have already reported the appearance of dangerous AI-based tools on Dark Web forums such as FraudGPT and WormGPT. Such technologies can greatly reduce social engineers' research time while also providing actionable information to help them carry out social engineering projects. 

What Can Businesses Do to Prevent Social Engineering Attacks?

All social engineering assaults are rooted in information and its negligent treatment. Businesses and employees who can limit their information exposure will significantly lessen their vulnerability to social engineering attacks. Here's how.

Monthly training: Use phishing simulators and classroom training to teach employees not to disclose sensitive or personal information about themselves, their families, coworkers, or the organization.

Draft AI-use policies: Make it plain to employees what constitutes acceptable and unacceptable online activity. For example, it is unacceptable to prompt ChatGPT with a line of code or private data, as well as to respond to strange or questionable queries without sufficient verification.

Utilize the same tools that hackers use: Use the same intelligence sources mentioned above to proactively determine how much information about your firm, its people, and its infrastructure is available online. Create a continuous procedure to decrease this exposure.

Good cybersecurity hygiene begins with addressing the fundamental issues. Social engineering and poor decision-making are to blame for 80% to 90% of all cyberattacks. Organizations must prioritize two objectives: limiting information exposure and managing human behavior through training exercises and education. Organizations can dramatically lower their threat exposure and its possible downstream impact by focusing on these two areas.

Read more »
password managers
Cyber Security Cybersecurity Digital Security Hackers master passwords password managers

Numerous LastPass Users Fall Victim to Highly Convincing Scam, Losing Master Passwords

 

The hackers now have their eyes set on a crucial target: master passwords. These passwords serve as the gateway to password managers, where users store all their login credentials in one secure location. While these managers provide convenience by eliminating the need to remember numerous passwords, they also pose a significant risk. If hackers obtain the master password, they gain access to all associated accounts, potentially wreaking havoc on users' digital lives.

The latest threat, known as CryptoChameleon, has caught the attention of cybersecurity experts. Unlike many cyberattacks, CryptoChameleon doesn't blanket the internet with its malicious activities. Instead, it selectively targets high-value entities like enterprises. David Richardson, vice president of threat intelligence at Lookout, notes that this focused approach makes sense for attackers aiming to extract maximum value from their efforts. For them, gaining access to a password vault is a goldmine of sensitive information ripe for exploitation.

CryptoChameleon's modus operandi involves a series of sophisticated manoeuvres to deceive its victims. Initially, it appeared as just another phishing kit, targeting individuals and organizations with tailored scams. However, its tactics evolved rapidly, culminating in a highly convincing impersonation of legitimate entities like the Federal Communications Commission (FCC). By mimicking trusted sources, CryptoChameleon managed to lure even security-conscious users into its traps.

One of CryptoChameleon's recent campaigns targeted LastPass users. The attack begins with a phone call from a spoofed number, informing the recipient of unauthorized access to their account. To thwart this breach, victims are instructed to press a specified key, which leads to further interaction with a seemingly helpful customer service representative. These agents, equipped with professional communication skills and elaborate scripts, guide users through a series of steps, including visiting a phishing site disguised as a legitimate support page. Unbeknownst to the victims, they end up divulging their master password, giving the attackers unrestricted access to their LastPass account.

Despite LastPass's efforts to mitigate the attack by shutting down suspicious domains, CryptoChameleon persists, adapting to evade detection. While the exact number of victims remains undisclosed, evidence suggests that the scale of the attack could be larger than initially estimated.

Defending against CryptoChameleon and similar threats requires heightened awareness and scepticism. Users must recognize the signs of phishing attempts, such as unsolicited calls or emails requesting sensitive information. Additionally, implementing security measures like multifactor authentication can provide an additional layer of defense against such attacks. However, as demonstrated by the experience of even seasoned IT professionals falling victim to these scams, no defense is foolproof. Therefore, remaining vigilant and promptly reporting suspicious activity is paramount in safeguarding against cyber threats.
Read more »
Middle East
CR4T backdoor Cyber Attacks Cyberattack Cybersecurity evasive governments Hackers Middle East

Cyberattackers Employ Elusive "CR4T" Backdoor to Target Middle Eastern Governments

 

A recent revelation by Russian cybersecurity firm Kaspersky sheds light on a covert cyber campaign dubbed DuneQuixote, which has been clandestinely targeting government bodies in the Middle East. This campaign involves the deployment of a newly identified backdoor called CR4T.

Kaspersky's investigation, initiated in February 2024, suggests that the operation might have been underway for at least a year prior. The perpetrators have taken sophisticated measures to evade detection, employing intricate methods to shield their implants from scrutiny and analysis.

The attack commences with a dropper, available in two versions: a standard executable or a DLL file, and a manipulated installer for a legitimate software tool called Total Commander. Regardless of the variant, the dropper's main task is to extract a concealed command-and-control (C2) address, utilizing a unique decryption technique to obfuscate the server's location and thwart automated malware analysis tools.

The decryption process involves combining the dropper's filename with snippets of Spanish poetry embedded in its code, followed by calculating an MD5 hash to decode the C2 server address. Upon successful decryption, the dropper establishes connections with the C2 server and fetches a subsequent payload, employing a hardcoded ID as the User-Agent string in HTTP requests.

Kaspersky notes that the payload remains inaccessible unless the correct user agent is provided, indicating a deliberate effort to restrict access. Additionally, the payload may only be downloaded once per victim or for a limited time following the malware's release.

Meanwhile, the trojanized Total Commander installer exhibits some variations while retaining the core functionality of the original dropper. It omits the Spanish poem strings and incorporates additional anti-analysis checks to detect debugging or monitoring tools, monitor cursor activity, check system RAM and disk capacity, among other measures.

CR4T, the central component of the campaign, is a memory-only implant written in C/C++, facilitating command-line execution, file operations, and data transfers between the infected system and the C2 server. Kaspersky also identified a Golang version of CR4T with similar capabilities, including executing arbitrary commands and creating scheduled tasks using the Go-ole library. The Golang variant employs COM objects hijacking for persistence and utilizes the Telegram API for C2 communication, indicating a cross-platform approach by the threat actors.

The presence of the Golang variant underscores the threat actors' ongoing efforts to refine their techniques and develop more resilient malware. Kaspersky emphasizes that the DuneQuixote campaign poses a significant threat to entities in the Middle East, showcasing advanced evasion tactics and persistence mechanisms through the use of memory-only implants and disguised droppers masquerading as legitimate software.
Read more »
Hacking
Cyber Crime cybercriminals data security Ethical Hacking Hackers Hacking

Unveiling the New Era of Hacking Ethics: Profit Over Principles

 

Hacking, once a realm of curiosity-driven exploration, has morphed into a complex ecosystem of profit-driven cybercrime. Originating in the 1960s, hacking was fueled by the insatiable curiosity of a brilliant community known as "hackers." These early pioneers sought to push the boundaries of computing and digital technology, driven by a passion for discovery rather than malicious intent. 

However, the perception of hacking has since undergone a dramatic transformation. Today, the term "hacking" often conjures images of lone individuals in hoodies, exploiting vulnerabilities to steal data or wreak havoc from the safety of dimly lit rooms. While this stereotype may be exaggerated, it reflects a disturbing reality: the rise of cybercriminals who exploit technology for personal gain. 

In recent years, there has been a notable shift in the attitudes and behaviours of hackers, particularly within criminal cyber rings. Once governed by unwritten codes of ethics, these groups are now redefining the rules of engagement, prioritizing profit above all else. What was once considered off-limits—such as targeting hospitals or critical infrastructure—is now fair game for profit-driven hackers, posing significant risks to public safety and national security. 

One of the most alarming trends is the rise of ransomware attacks, where hackers encrypt sensitive data and demand payment for its release. These attacks have become increasingly brazen and aggressive, targeting organizations of all sizes and industries. The Colonial Pipeline attack, while technically not disrupting deliveries, sent shockwaves through the cybersecurity community, highlighting the audacity and impunity of modern cybercriminals. 

Moreover, hackers are no longer content with targeting individuals or businesses just once. Exploiting vulnerabilities multiple times has become commonplace, reflecting a growing sophistication and ruthlessness among cyber criminals. Several factors have contributed to this evolution of hacking ethics. Global tensions, technological advancements, and the proliferation of online platforms have all played a role in shaping the behaviour of modern hackers. 

The accessibility of hacking tools and information has lowered the barrier to entry, attracting individuals of all ages and skill levels to the world of cybercrime. Despite efforts by law enforcement and cybersecurity professionals, the threat of cybercrime continues to loom large. 

Businesses and individuals must remain vigilant, investing in robust cybersecurity measures and staying informed about evolving threats. By understanding the changing landscape of hacking ethics, we can better defend against cyber attacks and protect our digital assets and identities in an increasingly connected world.
Read more »
Hackers
AI AI Chatbot Cyber Security Google Gemini AI Hackers

Private AI Chatbot Not Safe From Hackers With Encryption


AI helpers have assimilated into our daily lives in over a year and gained access to our most private information and worries. 

Sensitive information, such as personal health questions and professional consultations, is entrusted to these digital companions. While providers utilize encryption to protect user interactions, new research raises questions about how secure AI assistants may be.

Understanding the attack on AI Assistant Responses

According to a study, an attack that can predict AI assistant reactions with startling accuracy has been discovered. 

This method uses big language models to refine results and takes advantage of a side channel present in most major AI assistants, except for Google Gemini.

According to Offensive AI Research Lab, a passive adversary can identify the precise subject of more than half of all recorded responses by intercepting data packets sent back and forth between the user and the AI assistant.

Recognizing Token Privacy

This attack is centered around a side channel that is integrated within the tokens that AI assistants use. 

Real-time response transmission is facilitated via tokens, which are encoded-word representations. But the tokens are delivered one after the other, exposing a flaw known as the "token-length sequence." By using this route, attackers can infer response content and jeopardize user privacy.

The Token Inference Assault: Deciphering Cryptographic Reactions

Researchers use a token inference attack to refine intercepted data by using LLMs to convert token sequences into comprehensible language. 

Yisroel Mirsky, the director of the Offensive AI Research Lab at Ben-Gurion University in Israel, stated in an email that "private chats sent from ChatGPT and other services can currently be read by anybody."

By using publicly accessible conversation data to train LLMs, researchers can decrypt responses with remarkably high accuracy. This technique leverages the predictability of AI assistant replies to enable contextual decryption of encrypted content, similar to a known plaintext attack.

An AI Chatbot's Anatomy: Understanding of Tokenization

AI chatbots use tokens as the basic building blocks for text processing, which direct the creation and interpretation of conversation. 

To learn patterns and probabilities, LLMs examine large datasets of tokenized text during training. According to Ars Technica, tokens enable real-time communication between users and AI helpers, allowing users to customize their responses depending on environmental cues.

Current Vulnerabilities and Countermeasures

An important vulnerability is the real-time token transmission, which allows attackers to deduce response content based on packet length. 

Sequential delivery reveals answer data, while batch transmission hides individual token lengths. Reevaluating token transmission mechanisms is necessary to mitigate this risk and reduce susceptibility to passive adversaries.

Protecting the Privacy of Data in AI Interactions

Protecting user privacy is still critical as AI helpers develop. Reducing security threats requires implementing strong encryption techniques and improving token delivery mechanisms. 

By fixing flaws and improving data security protocols, providers can maintain users' faith and trust in AI technologies.

Safeguarding AI's Future

A new age of human-computer interaction is dawning with the introduction of AI helpers. But innovation also means accountability. 

Providers need to give data security and privacy top priority as vulnerabilities are found by researchers. Hackers are out there; the next thing we know, they're giving other businesses access to our private chats.
Read more »
Technology
Cyber Threats Risk Cyberattacks CyberCrime Device Security Hackers Hacking Rises Internet IoT Operatinoal Technology Technology

Unveiling the Underbelly of IoT: An In-Depth Analysis of Hacking Risks

 


In terms of versatility, the Internet of Things (IoT) is a technology that is easily one of the most versatile technologies in the world today. In the era of the internet, the network connection capacity is increasing and the number and diversity of connected devices are enabling the IoT to be scaled and adapted to meet the changing needs of the user. Among the industries the Internet of Things (IoT) has revolutionized are several sectors such as food production, manufacturing, finance, healthcare, and energy. 

Furthermore, it has led to the development of smart buildings, homes, and even cities at the same time. Generally, IoT attacks are malicious attempts to exploit vulnerabilities in devices connected to the internet, for example, smart homes, industrial control systems, and medical devices. There is a possibility that hackers may gain control of the device, steal sensitive information from it, or use the device as part of a botnet to accomplish other malicious acts. 

The term "IoT hacking" is frequently used by researchers to describe the process of removing gadgets, examining their software, and learning how they work. However, there are more challenges involved with IoT hacking than just technical ones. Cyber threats are evolving to reveal a world of virtual battles that go on behind the scenes. Hackers are increasingly targeting IoT (Internet of Things) and OT (Operational Technology) systems, which are extremely important for the future. 

In addition to tech gadgets, they are also the foundation for many services that keep us running in our society and economy. Hackers are not just messing with machines when they target these systems, they are threatening the very services that nations rely on every day. IoT devices can introduce several new and preventable attack vectors when not properly secured. Researchers who work in cybersecurity keep showing that critical systems are being attacked more frequently than they realize.

The risks are not that complicated to identify and understand, for example, operating systems that are not patched or insecure passwords that make it easy for brute force attackers to find them. A security team must take into account both simple and complex risk factors specific to the world of IoT to manage the operational reliance on these devices in virtually every industry. There are a few security risks and attacks associated with IoT that people should be aware of. 

Botnets 

Since IoT devices have no built-in security mechanisms, they are particularly vulnerable to malware attacks compared to more advanced machines and computers that have these security mechanisms. In general, they are machines that are primarily focused on functionality, which means they usually do not provide the same level of storage space or processing power that computers offer. In light of this, attackers tend to view IoT devices as a low-hanging fruit attack vector that they can easily attack. 

IoT devices should be secured properly to protect them from botnets, and to prevent them from getting into the wrong hands. Companies must keep a plan in place to detect and respond to DDoS attacks, as well as to change default passwords, keep firmware up to date, and limit access to the device. 

Ransomware 

While IoT devices do not typically store valuable data locally, that doesn’t mean they are immune to ransomware attacks. Instead of threatening an organization with a ransom payment, ransomware attacks on IoT devices usually disable their core functionality instead of stealing information. Possibly the best way to accomplish that is to shut down the operation of an industrial device, without which fundamental business operations would not be possible, or to stop the recording of the feed being monitored by a camera or microphone. 

Several security flaws in IoT devices can affect companies. One of the researchers' keen-eyed researchers discovered that a big security hole existed in a popular broadcasting device that sent audio over the internet. It's important to note that the researchers did the right thing, and notified the device manufacturer that the problem was caused by an OS Command Injection, which is a serious issue because hackers can take control of a device by doing so. This was done by researchers who did the right thing since it was an OS Command Injection. 

There was a problem with the software on the device, and they were trying to fix it by updating it so that someone from the outside would not be able to exploit it anymore. Companies often take quick measures to fix security gaps when they find out about them. The problems these companies have faced are similar to putting band-aids on a wound without actually treating it. 

Many people have witnessed how a company patched a device so that it looked safe from the outside, but the same problems were still there once people got inside. In some cases, fixes do not solve the problem. They just hide it and do not take care of it. As a result, it is as if one locks the front door and leaves the back door wide open at the same time. 

In today's digital world, ensuring the safety of the IoT world cannot be done by one individual. For this to work, it needs to be a team effort between the manufacturers, security experts, and even the government itself. The biggest priorities should be setting strict security rules, being open about the problems they find, and helping all of the people in the organization understand how they can be protected. 

As people move through the tricky territory of this online and offline world, they must do a lot more to look after the two worlds simultaneously to get the best outcome. To make sure that their connected devices are protected and managed effectively, they must be proactive and take an all-in approach.
Read more »
Software Protection
API API Integration Secure cyber attack Data Theft Hackers Software Protection

5 Simple Steps to Bulletproof Your API Integrations and Keep Hackers at Bay


In today's tech-driven world, APIs (Application Programming Interfaces) are like the connective tissue that allows different software to talk to each other, making our digital experiences seamless. But because they are so crucial, they are also prime targets for hackers. 

They could break in to steal our sensitive data, mess with our systems, or even shut down services. That is why it is super important for companies to beef up their API security, protecting our info and keeping everything running smoothly and this is where API Integration Secure name comes up. 

Let’s Understand What is API Integration Secure and Why Is It Important 

API integrations are made secure through a combination of measures designed to protect the data and systems involved. This includes using encryption to safeguard information as it travels between systems, implementing authentication and authorization protocols to ensure that only authorized users and applications can access the API, and regularly monitoring for any suspicious activity or attempted breaches. 

Additionally, following best practices in API design and development, such as limiting the data exposed through the API and regularly updating and patching any security vulnerabilities, helps to further enhance security. Overall, a multi-layered approach that addresses both technical and procedural aspects is key to ensuring the security of API integrations. 

Here Are Five Ways to Keep API Integrations Secure: 


Use an API Gateway: Think of it as the guardian of your APIs. It keeps an eye on who is trying to access your data and blocks anyone suspicious. Plus, it logs all the requests, so you can check who has been knocking on your digital door. 

Set Scopes for Access: Just because someone was allowed in does not mean they can see everything. Scopes make sure they only get access to the stuff they really need, like a limited view of a database. It is like giving someone a key to one room instead of the whole house. 

Keep Software Updated: You know those annoying software updates that pop up? They are actually super important for security. They fix any holes that hackers might try to sneak through. So, always hit that update button. 

Enforce Rate Limits: Imagine a crowded street during rush hour. Rate limits make sure not too many cars (or requests) clog up the road at once. It helps prevent crashes and slowdowns, making sure everyone can get where they need to go smoothly. 

Monitor Logs with SIEM: It is like having a security guard watching CCTV cameras for any suspicious activity. SIEM collects all the logs from API calls and flags anything fishy. So, if someone is trying to break in, you will know right away and stop them in their tracks.
Read more »
Trade comminssion
Cyber Attacks CyberCrime Cybersecurity Hackers Scammers Tax Scams Trade comminssion

Tax Season Vigilance: Guarding Against Fraudulent Schemes

 


When people think about filing taxes, they get stressed out and intimidated. In this respect, they may be more susceptible to deception, including scammers' attempts to obtain valuable personal information from them, claim refunds under their names, and trick them into paying for fraudulent tax services, among others.

It is at the beginning of the tax season, which began on Jan. 29, when the Internal Revenue Service began processing and accepting federal income tax returns for 2023, that scammers will begin to attack us with scams. Tax season is coming up and the IRS is expecting more than 146 million individual returns to be filed by April 15, the due date. 

The Federal Trade Commission's Division of Financial Practices, led by an attorney who is a former employee of the agency, says that scammers use tax time to steal personal and financial information from individuals. 

To accomplish this, they pose as representatives of the Internal Revenue Service (IRS) and make people hand over their Social Security number and bank account information by contacting them over the phone using various high-pressure tactics. 

To maintain the trust of consumers, the IRS will not use aggressive techniques to obtain a taxpayer's personal information. They will initiate contact by letter and not use aggressive tactics to obtain the taxpayer's personal information. There are certain circumstances where the IRS may call users, but in most cases, they will send them mail messages or notices as a prelude to making the call. 

There have been a disturbing number of instances where people have been defrauded through the mail as well. It has been reported that in 2023 a scam in the mail was perpetrated by spoofing the IRS masthead, informing recipients that they had unclaimed refunds. There was a request in the letter for taxpayers to call a number to figure out more details, and also a request to provide sensitive information such as a photograph of the taxpayer's driver's license. 

Besides spoofing IRS caller IDs as well as other sophisticated tricks for fooling consumers, Dwyer says there are other methods for fooling consumers. A scammer in this case has altered the caller ID so that it appears as though the IRS is calling rather than some other unknown number. 

When the caller calls you, Dwyer advises that you let it go to voicemail and then search online to see if the number has already been reported as part of a scam before waiting to answer it. A scammer is also capable of sending emails that masquerade as IRS correspondence, with e-mail addresses, signatures, and logos that appear to be authentic, but are fakes. 

They may ask recipients to enter personal information on fraudulent websites when they click on the links in these emails. If a consumer has not heard back from the government agency about their tax filing or refund, they should generally view any phone calls or emails claiming to come from the IRS as highly suspicious. 

The IRS pays the consumer electronically in the form of a refund when they file a return in their name and provide the IRS with their bank account information, and the scammer then receives the refund by filing a return in the name of the consumer. There is no way they can accomplish this without possessing stolen personal information, including a Social Security number, which they can use to commit this crime. 

By filing your taxes as soon as possible, you can help prevent this outcome from occurring in the future. The consumer would not be made aware of the theft of their refunds until they attempt to file their tax returns after the refund has been stolen. Moreover, it would be a good idea to avoid sharing any personal information with identity thieves which would allow them to file a fake tax return to claim a refund that is not theirs. 

Scammers who ask for sensitive information by posing as people are not restricted to tax season only, so be mindful of their requests throughout the year. Individuals who have fallen victim to identity theft or are aware of a breach in their sensitive data are advised to exercise heightened caution and consider utilizing a credit monitoring service to ascertain if their information has been used for unauthorized account openings. 

Those affected by identity theft can leverage the services offered by the Federal Trade Commission's (FTC) website, IdentityTheft.gov, to formally report the theft and access a comprehensive recovery plan. This plan guides individuals through crucial tasks such as closing compromised accounts, rectifying inaccuracies in credit reports, and reporting the misuse of a Social Security number. 

For taxpayers grappling with the repercussions of a scam affecting their tax returns, seeking assistance from the federal Taxpayer Advocate Service is recommended. This independent organization, affiliated with the Internal Revenue Service (IRS), extends support to taxpayers unable to independently resolve tax-related issues. Advocates from this service are available to provide guidance and assistance in navigating challenges stemming from fraudulent activities.
Read more »
security measures
Axie Infinity co-founder crypto community cryptocurrency theft Cyber Security Cybersecurity Breach Digital Assets Hackers personal accounts security measures

Hackers Steal Nearly $10 Million from Axie Infinity Co-founder’s Personal Accounts

 

A significant amount of cryptocurrency, valued at nearly $10 million, has been reported stolen from personal accounts belonging to Jeff "Jihoz" Zirlin, one of the co-founders associated with the video game Axie Infinity and its affiliated Ronin Network.

According to reports, Zirlin's wallets were compromised, resulting in the theft of 3,248 ethereum coins, equivalent to approximately $9.7 million. Zirlin took to social media to confirm the incident, stating that two of his accounts had been breached. 

However, he emphasized that the attack solely targeted his personal accounts and did not affect the validation or operations of the Ronin chain or Axie Infinity,as reiterated by Aleksander Larsen, another co-founder of the Ronin Network.

The method through which the intruders gained access to Zirlin's wallets remains unclear. The Ronin Network serves as the underlying infrastructure for Axie Infinity, a game renowned for its play-to-earn model based on ethereum, particularly popular in Southeast Asia. 

Notably, the system had previously fallen victim to a $600 million cryptocurrency heist in March 2022, an attack attributed by U.S. prosecutors to the Lazarus Group, a cybercrime operation allegedly backed by North Korea.

Analysts tracking the recent theft traced the stolen funds to activity on Tornado Cash, a cryptocurrency mixer designed to obfuscate the origin of funds. It's worth noting that Lazarus had previously utilized this mixer to launder proceeds from the 2022 hack. The U.S. government, in response, had separately imposed sanctions on Tornado Cash.

Blockchain investigator PeckShield described the incident as a "wallet compromise," indicating a breach in security measures. Despite the breach, Zirlin assured stakeholders of the stringent security protocols in place for all activities related to the Ronin chain.
Read more »
Malware Distribution
banking trojan campaign Cisco Talos Cyber Security Cyber Threats Cybersecurity Google Cloud Run Hackers Malware Distribution

Cybercriminals Exploit Google Cloud Run in Extensive Banking Trojan Scheme

 

Security experts have issued a warning about hackers exploiting Google Cloud Run to distribute significant amounts of banking trojans such as Astaroth, Mekotio, and Ousaban.

Google Cloud Run enables users to deploy various services, websites, or applications without the need to manage infrastructure or worry about scaling efforts.

Starting from September 2023, researchers from Cisco Talos observed a notable surge in the misuse of Google's service for spreading malware. Brazilian actors initiated campaigns utilizing MSI installer files to distribute malware payloads. According to the researchers' findings, cybercriminals are increasingly drawn to Google Cloud Run due to its cost efficiency and its ability to circumvent conventional security measures.

The attack methodology typically begins with phishing emails sent to potential victims, disguised to resemble authentic communications such as invoices, financial statements, or messages from local government and tax authorities. While most emails in these campaigns are in Spanish to target Latin American countries, some also use Italian. These emails contain links that redirect to malicious web services hosted on Google Cloud Run.

In certain instances, the malware payload is delivered through MSI files, while in others, the service redirects to a Google Cloud Storage location, housing a ZIP archive containing a malicious MSI file. Upon execution of these malicious files, additional components and payloads are downloaded and executed on the victim's system.

Furthermore, the malware establishes persistence on the victim's system to survive reboots by creating LNK files in the Startup folder, configured to execute a PowerShell command that triggers the infection script.

The campaigns exploiting Google Cloud Run involve three primary banking trojans: Astaroth/Guildma, Mekotio, and Ousaban. Each of these trojans is designed to infiltrate systems covertly, establish persistence, and extract sensitive financial data, which can be utilized for unauthorized access to banking accounts.

Astaroth employs advanced evasion techniques and has expanded its targets beyond Brazil to encompass over 300 financial institutions across 15 Latin American countries. It has recently begun targeting credentials for cryptocurrency exchange services.

Similarly, Mekotio, active for several years, focuses on the Latin American region, specializing in stealing banking credentials, personal information, and executing fraudulent transactions.

Ousaban, another banking trojan, conducts keylogging, captures screenshots, and engages in phishing for banking credentials using counterfeit banking portals. Cisco Talos suggests a potential collaboration between the operators of Astaroth and Ousaban due to the latter being delivered in the later stages of the former's infection chain.

In response to these findings, Google has taken action by removing the malicious links and is exploring ways to enhance its mitigation efforts to combat such malicious activities.
Read more »
Schneider Electric
Cactus ransomware Cyber Threats Cybersecurity Hackers malware Schneider Electric

Cactus Ransomware Strikes Schneider Electric, Demands Ransom

 


In a recent cyber attack, the Cactus ransomware group claims to have infiltrated Schneider Electric's Sustainability Business division, stealing a substantial 1.5 terabytes of data. The breach, which occurred on January 17th, has raised concerns as the gang now threatens to expose the stolen information if a ransom is not paid.

The ransomware group has already leaked 25MB of allegedly pilfered data on its dark web leak site, showcasing American citizens' passports and scans of non-disclosure agreement documents. Schneider Electric, a French multinational specialising in energy management and automation, is being coerced by the hackers to meet their ransom demand to prevent further leaks.

While the specific nature of the stolen data remains unknown, Schneider Electric's Sustainability Business division provides services related to renewable energy and regulatory compliance for major global companies such as Allegiant Travel Company, Clorox, DHL, DuPont, Hilton, Lexmark, PepsiCo, and Walmart. This implies that the compromised data might include sensitive information about customers' industrial control and automation systems and details regarding environmental and energy regulations compliance.

Cactus ransomware, a relatively new player in the cybercrime landscape, emerged in March 2023, employing double-extortion attacks. The group gains access to corporate networks through various means, including purchased credentials, partnerships with malware distributors, phishing attacks, or exploiting security vulnerabilities.

Once inside a target's network, the hackers navigate through the compromised system, stealing sensitive data to use as leverage in ransom negotiations. Since its inception, Cactus ransomware has targeted over 100 companies, leaking data online or threatening to do so while still engaging in ransom negotiations.

This incident is not the first time Schneider Electric has fallen victim to cyber threats. In the past, the company experienced data theft attacks orchestrated by the Clop ransomware, impacting over 2,700 other organisations. Schneider Electric, with a workforce exceeding 150,000 people globally, reported a substantial $28.5 billion in revenue in 2023.

Both companies and individuals need to stay alert to potential threats. Cybersecurity experts stress the significance of adopting strong security practices, regularly updating computer programs, and ensuring employees are well informed about potential risks. These measures are crucial for minimising the potential fallout from ransomware attacks, underlining the need for a proactive approach to safeguarding digital assets.

The Cactus ransomware attack on Schneider Electric is a stark reminder of the increasing sophistication and frequency of cyber threats in today's digital age. Businesses and individuals must prioritise cybersecurity to safeguard sensitive information and prevent financial and reputational damage.


Read more »
Security
Cyber Fraud CyberCrime Hackers Miami-Dade police officers prosecutors Safety Secure Security

Hackers Target Police Officers and Prosecutors in Miami-Dade

 

The police officers in North Miami Beach were misled by a counterfeit email masquerading as an official communication from the Miami Dade State Attorney's Office, as per sources knowledgeable about the scheme.

Utilizing the guise of an SAO investigator probing human trafficking, a scammer circulated the fraudulent email, successfully duping several employees of the North Miami Beach Police Department earlier this week, according to insiders.

Addressing the incident, city authorities issued a statement acknowledging that a handful of email accounts had fallen victim to a phishing scam, impacting multiple government entities. They assured that steps had been taken to regain control of the compromised accounts.

The city affirmed that neither the network nor the data had been affected by the breach, which was confined to email accounts. Investigations into the security breach were ongoing. The SAO also released a statement detailing a "highly sophisticated phishing attempt" aimed at their computer information system, which was detected and neutralized on February 13th.

The perpetrator employed "exceptional electronic reproductions of genuine SAO materials" in the email, designed to entice users into opening what appeared to be authentic documents from SAO personnel, as stated in the SAO's statement.

The incident serves as a stark reminder of the importance of vigilance in cybersecurity. Despite appearances, malicious emails can be highly deceptive, emphasizing the need for users to scrutinize links and documents for authenticity before clicking on them.
Read more »
XRP cryptocurrency
$112 million blockchain breach cryptocurrency security cyber theft Hackers Ripple Technology XRP cryptocurrency

Cybercriminals Steal $112 Million Worth of Ripple's XRP Cryptocurrency

 

On Tuesday, approximately $112 million worth of the XRP cryptocurrency, which is centered around Ripple, was pilfered by hackers from a crypto wallet, as revealed by Ripple's co-founder and executive chairman, Chris Larsen.

Larsen disclosed on Wednesday that the stolen cryptocurrency belonged to him. In a post on X (formerly Twitter), Larsen mentioned that unauthorized access occurred in some of his personal XRP accounts, distinct from Ripple. He assured that the problem was swiftly identified, and exchanges were notified to freeze the affected addresses. Law enforcement has also been engaged in the matter.

The announcement came less than an hour after crypto security researcher ZachXBT reported the hack on X. According to ZachXBT, the pilfered XRP funds had already been laundered through various crypto exchanges like Binance and Kraken. Binance acknowledged the incident, stating that they are actively supporting the investigation, and Kraken emphasized their proactive review to prevent their platform from being misused.

However, there is ambiguity regarding the ownership of the hacked wallet, whether it is linked to Ripple or not. XRPScan's on-chain data revealed that the compromised wallet was labeled "Ripple (50)" and was activated by another wallet called "~FundingWallet1" on November 5, 2018. Larsen's account activated ~FundingWallet1 on February 6, 2013, shortly after his own account, ~chrislarsen, was created.

When approached for comment, Ripple's spokesperson referred to Larsen's post and clarified that Ripple itself was not impacted. Ripple, established in 2012, aspires to be a payments and enterprise infrastructure provider, consisting of a network, protocol, and decentralized public ledger known as XRP Ledger. The value of XRP, the network's token, dropped by approximately 4% on the day of the hack.

In response to the incident, some XRP holders are urging the co-founders to disclose their crypto wallets and XRP holdings to enhance transparency. Meanwhile, others, including Thinking Crypto podcast host Tony Edward, are urging Larsen to distance himself from Ripple.

This cyber attack stands out as the most significant cryptocurrency theft in 2024 and ranks as the twentieth largest in recorded history, based on data compiled by Rekt, a website monitoring web3 and crypto breaches. In the previous year, hackers targeted approximately $2 billion in cryptocurrency, as reported by crypto security firms specializing in tracking such incidents.
Read more »
masOS Apps
Command and Control(C2) DNS attacks Hackers Kaspersky macOS malware masOS Apps

Hackers Drain Wallets via Cracked macOS Apps using Scripts Accessed From DNS Records


Hackers have found another clever way to transfer information-stealing malware to macOS users, apparently through DNS records that could hide malicious scripts.

The attack is being targeted to macOS Ventura and later, depending on the vulnerable applications repackaged as PKG files that include a trojan. 

Attack details

The attack was discovered by researchers at Kaspersky, following which they analyzed the stages of the infection chain. 

While downloading an Application/folder, victims tend to follow installation instructions, unaware that they are actually executing the malware. Following this, they open the bogus Activator window that asks for the administrator password. 

The malware uses the 'AuthorizationExecuteWithPrivileges' method to execute a 'tool' executable (Mach-O) after acquiring permission. If Python 3 is not already installed on the system, it installs it and appears to be "app patching."

The malware then contacts its C2 server, at a site named ‘apple-health[.]org,’ in order to obtain a base64- encoded Python script that is designed to run arbitrary commands on the targeted device. 

Researchers discovered that the attacker employed a clever technique to reach the C2 server at the right URL: a third-level domain name consisting of a random string of five letters and words from two hardcoded lists.

This way, the hacker was able to conceal its activity in traffic and download the Python script payload disguised as TXT records from the DNS server, which seem like common requests. 

Three TXT entries, each a base64-encoded portion of an AES-encrypted message containing the Python script, were included in the DNS server's response.

This first Python script served as a downloader for a second Python script that captures and sends information about the compromised system, including the CPU type, installed apps, directory listings, operating system version, and external IP address.

Kaspersky notes that during their analysis, the C2 provided upgraded copies of the backdoor script, indicating continuing development, but didn't see command execution, thus this might not have been deployed yet.

Additionally, two functions in the downloaded script search the compromised system for Bitcoin Core and Exodus wallets; if they are detected, they replace the original wallets with backdoored versions obtained from 'apple-analyzer[.]com.'

The code in the compromised wallets transmits to the attacker's C2 server the seed phrase, password, name, and balance.

Users usually do not get suspicious when their wallet app suddenly asks them to re-enter their wallet details, making them vulnerable to getting their wallets emptied. 

As indicators of compromise, the cracked software used in this campaign is made public in the Kaspersky study. According to the researchers, these applications "are one of the easiest ways for malicious actors to get to users’ computers."

While using cracked programs to trick users into downloading malware is a popular attack vector, the campaign that Kaspersky examined demonstrates that threat actors are sufficiently crafty to devise novel ways of delivering the payload, such as concealing it in a DNS server's domain TXT record.  

Read more »
security service
Cyber Security Cyberattacks CyberCrime Hackers Kyivstar security service

SBU Cybersecurity Chief Exposes Persistent Hacker Presence in Kyivstar

 


An attack on Kyivstar, a telco company that has some 24 million users in Ukraine, appears to have been carried out by Russia's Sandworm crew last month. It appears they shut down mobile and internet services to these users. 

According to the head of the Security Service of Ukraine (SBU)'s cyber department, Illia Vitiuk, the incident should serve as a "big warning" to the West concerning the security of Ukraine. Vitiuk, who worked for the Russian Ministry of Defense, has revealed exclusive details about a cyberattack published last Thursday (Jan 4), according to which the hack caused "disastrous" destruction and was one of the goals of the campaign to gain intelligence about the enemy.  

Approximately 24 million users' services were disrupted for a period of several days beginning on December 12, after an attack that took place from at least May of the previous year. The attack was widely viewed as being one of the most significant cyberattacks since nearly two years ago when Russia invaded Ukraine. 

As revealed in an interview published on Thursday, the spy chief confirmed that Kyivstar's services were blacked out long before the company's servers went down on December 12, in what he described as a "disastrous" intrusion. 

The intrusion destroyed thousands of virtual servers and PCs.  It is also reported that the attack disrupted some banking services in Kyiv and the air raid alert system in the region. In the same week as the attack on the Ukrainian capital, two separate missiles struck, injuring at least 53 people and causing significant damage to homes, a children's hospital, and a medical centre. 

According to Vitiuk, the Kyivstar hackers entered the network sometime between May and November 2023, if not earlier. They gained full access to the system by the end of November. The attackers would have had access to customer information, phone location information, SMS messages, and possibly Telegram account credentials if they had been successful in carrying out this attack. 

As Vitiuk points out, the attacker is believed to have been Sandworm, which is it the state-controlled hacker group that attacked earlier this month. In a statement, Sandworm claimed responsibility for the breach earlier this month, but Solntsepek has previously been considered to be Sandworm. 

Several virtual servers and personal computers were wiped out by the hackers, according to Vitiuk, including thousands of servers and personal computers. Earlier this week, Kyivstar's CEO Oleksandr Komarov claimed that the attackers had managed to destroy some functions in the company's core network, which serves as the main structure of the company's communication network.

It has been suggested by the SBU, which is investigating the incident, that hackers may have had the ability to steal personal information, understand the locations of phones, intercept SMS messages, or even perhaps steal Telegram accounts based on the level of access they gained. Earlier this month, Kyivstar said that no personal or subscriber data had been stolen. 

Many hackers are still trying to damage Kyivstar after the major cyberattack on the operator, Vitiuk said, and there have been several new attempts made by hackers to damage the operator since then. In the early stages, Komarov said he suspected an internal intrusion into Kyivstar's network but did not specify what he meant by that. 

It is not clear how hackers penetrated the network and what kind of malware they used. As he added, there had to be movement within the network to cause such severe damage to the network. As a result of the attack, the goal was to cause "disastrous" destruction, to deliver a psychological blow, and to gather intelligence. 

As he put it, Kyivstar is a Ukrainian subsidiary of the Netherlands-based VEON, which is considered to be a big warning for the Western world. Vitiuk said that it would be one of Ukraine's biggest and wealthiest private companies in the future, with 3,500 employees and $815 million in revenues in the year 2022. No one is untouchable in the company, he added.

The Ukrainian telecom company reported that it suffered billions in losses in Ukraine's national currency (1 billion hryvnia is about $26.2 million) as a result of the cyberattack, according to Komarov in an interview he gave in December. 

While this is the case, Kyivstar has decided not to bill its subscribers for January and apologized for any inconvenience this may have caused. It is a telecom provider that has nearly 24 million subscribers across Ukraine. 

There were several technical difficulties with the company's service in Ukraine and abroad before the company was able to restore all of its services on December 20. Apart from cutting off Ukrainians from the mobile internet and cellular network, the attack also disrupted air raid sirens, some banks, ATMs and point-of-sale terminals. 

In Vitiuk's view, the hack did not impact the communications systems of the Ukrainian armed forces, which he describes as not relying on telecom operators and utilizing what he involves as "different algorithms and protocols" employed by the Ukrainian armed forces. According to Vitiuk, Russian hackers continue to target telecom operators as a potential targets.

However, he added that it had been stopped by the Russians following a serious attempt to penetrate one of Ukraine's telecom operators, which resulted in the removal of the software. Additionally, Mandiant has alleged that Sandworm was the cause of the blackouts that occurred in Ukraine in October 2022, which were previously attributed to missile strikes. 

Strikes against Ukraine's electrical grid were one of the causes of some of the blackouts that occurred. Despite that, threat hunters think that a seemingly coordinated cyberattack on an electrical generation plant in the country could also have played a factor, according to the report.  

According to Hultquist, Sandworm has been responsible for several electronic blackouts in Ukraine, but they reach across the entire globe. Several targets have been targeted in the US and France, including elections and opening ceremonies at the Olympics. A number of their attackers have also been tied to the global NotPetya attack - one of the most expensive cyberattacks in history.
Read more »
TechCrunch
Crypto Hack cryptocurrency Cyber Security DeFi Hackers TechCrunch

Hackers Stole Cryptocurrency Worth $2 Billion in Year 2023


For another year, crypto-stealing cases made headlines. However, as per crypto security firms, this was the first time since 2020, that the trend has been declining. 

Based on dozens of cyberattacks and thefts this year, hackers stole over $2 billion in cryptocurrency, according to De.FI, the web3 security company that manages the REKT database. 

The site ranks the worst-ever crypto hacks, ranging from the Ronin network breach in 2022—the largest event in history—where hackers took over $600 million in cryptocurrency—to this year's hack against Mixin Network, which brought in almost $200 million for the criminals.

DeFi, in its report, wrote, “This amount, though dispersed across various incidents, underscores the persistent vulnerabilities and challenges within the DeFi ecosystem[…]2023 stood as a testament to both the ongoing vulnerabilities and the strides made in addressing them, even as interest in the space was relatively muted by the ongoing bear market in the first half of the year.”

In an estimate, published by blockchain intelligence firm TRM, the total amount of cryptocurrency that hackers have stolen this year was also made public earlier in December. As of mid-December, the business reported that the total amounted to around $1.7 billion.

Among the other crypto thefts conducted this year, one of the worst ones was a hack against Euler Fianance, where threat actors stole $200 million. Other notable hacks include those against Multichain ($126 million), BonqDAO ($120 million), Poloniex ($114 million), and Atomic Wallet ($100 million), among hundreds of other targets.

Last year, blockchain monitoring firm Chainalysis reported that cybercriminals purloined a record-breaking $3.8 billion in cryptocurrency. Of those, the Lazarus Group, a group of North Korean government hackers who are among the most active in the cryptocurrency space, took $1.7 billion in an attempt to finance the regime's authorized nuclear weapons program.

In 2021, Chainalysis reported hacks that compromised crypto worth $3.3 billion.

It is rather not possible to predict what the figures will be in 2024, but given the failures witnessed in cyber security by several crypto and web3 initiatives, as well as the significant financial potential of both sectors—discussed at TechCrunch Disrupt earlier this year—we should anticipate that hackers will continue to target this expanding market.  

Read more »
SentinelOne
C++ Chinese Hackers Cyber Security Hackers IT Environment Keypluggs Microsoft Threat PwC Sandmam APT SentinelOne

Sandman APT Gains Traction: Chinese Hackers Amplify Cybersecurity Risks

 


It has been discovered that there is a strong coincidence in the targeting and tactics of Sandman, a mysterious advanced persistent threat (APT) that has been identified to use backdoors referred to as "Keypluggs," and KEYPLUG, a China-based threat cluster. 

Following this assessment, SentinelOne, PwC, and Microsoft Threat Intelligence have been working together on this since they have determined that the adversary's Lua-based malware, LuaDream, and the KEYPLUG have both been found to cohabit in the victim network alongside each other. 

Microsoft, SentinelLabs and PwC have collectively alerted consumers and businesses to the fact that threat actors who were allegedly linked to Chinese cybercriminals have deployed an advanced persistent threat (APT) referred to as Sandman to infiltrate IT environments with malware. 

An expert at SentinelOne, Aleksandar Milenkoski, said that Sandman has now been linked to STORM-0866/Red Dev 40, a threat actor aligned with the Chinese government's national interests, meaning that STORM-0866/Red Dev 40 targets Chinese companies. 

Following a series of cyberattacks carried out on telcos across the Middle East, Western Europe, and South Asia, Sandman was first identified in August. These attacks utilized a backdoor referred to as "LuaDream," which is a programming language that is based on Lua, as well as a backdoor titled "Keyplug," which is a programming language that is based on C++. 

SentinelOne revealed the existence of Sandman for the first time in September 2023, covering attacks on telecommunications providers in Europe, the Middle East, and South Asia by using an implant codenamed LuaDream that was used in its attacks. 

In August 2023, a record of intrusions was made. On the other hand, Storm-0866/Red Dev 40 refers to a cluster of APTs primarily targeting entities located in the Middle East and South Asia, such as telecommunication providers and government agencies, that represent an emerging APT network. 

Storm-0866 has several powerful tools at his disposal, one of which is KEYPLUG. This backdoor was first exposed by Google-owned Mandiant in the context of attacks conducted by the Chinese-based APT41 (also known as Brass Typhoon or Barium) actor between May 2021 and February 2022 in which he infiltrated six state government systems. 

The Recorded Future company reported earlier this month that the use of KEYPLUG was being used by a Chinese state-sponsored threat activity group it is tracking under the name RedGolf, which they claimed was "closely aligned with the threat activity produced by APT41/Barium. As part of its report, Mandiant informed the public that they first discovered the Keyplug backdoor in March 2022, which was used by a known Chinese group, APT41. 

Additionally, Microsoft and PwC teams discovered that the Keyplug backdoor was passed around to multiple other Chinese-based threat groups, according to the report. Researchers believe that the new obfuscation tools provided by Keyplug malware give the group a new advantage compared to previous versions. 

According to the report, the STORM-0866/Red Dev 40 cluster differs from the others because of specific malware characteristics, such as the unique encryption keys used to communicate with KEYPLUG command and control servers, as well as an increased sense of operational security, which can be attributed to the use of cloud-based reverse proxy infrastructure to hide the real locations where their C2 servers are hosted," says the report. 

According to the researchers, when they analyzed both the C2 configuration and the LuaDream and Keyplug malware strains, the overlaps were overwhelming, which can be interpreted as suggesting that their operators were seeking similar functional requirements. To grow, and effectively collaborate between the increasing number of Chinese APT groups, the report concluded, cyber security community members must share similar knowledge. 

There is a great deal of certainty that the constituent threat actors will continue to cooperate and coordinate, exploring new ways to enhance the functionality, flexibility, and stealthiness of their malware to further enhance the threat actors' threat. 

An influential example of how this can be applied is the adoption by developers of the Lua development paradigm. Overcoming the threat landscape requires a constant flow of information sharing between members of the threat intelligence research community. 

A few instances of espionage-motivated APTs historically considered Western or Western-aligned have been associated with Lua-based modular backdoors, such as LuaDream. This has proven to be a very rare occurrence and is often associated with APTs that are espionage-motivated. In our research on Sandman, we found that a broader set of cyberespionage threat actors are utilizing the Lua development paradigm because of its modularity, portability, and simplicity.
Read more »
TrendMicro
Bitcoin Canti Conti CorvusInsurance Cyber Crime Cybersecurity Darkweb DigitalCurrency Elliptic Extortion Garantex Hackers Laundering Ransomware TrendMicro

Researchers: 'Black Basta' Group Rakes in Over $100 Million

 

A cyber extortion group believed to be an offshoot of the infamous Russian Conti hacker organization has reportedly amassed over $100 million since its emergence last year, according to a report published on Wednesday by digital currency tracking service Elliptic and Corvus Insurance.

The group, known as "Black Basta," has allegedly extorted at least $107 million in bitcoin, with a significant portion of the laundered ransom payments flowing to the sanctioned Russian cryptocurrency exchange Garantex, as revealed in the joint report. Attempts to contact Black Basta through its dark web site were unsuccessful. Garantex, which faced U.S. Treasury sanctions in April of the previous year, expressed support for global initiatives combatting cybercrime and urged information-sharing regarding the hackers' finances, pledging to block suspicious funds.

Elliptic co-founder Tom Robinson characterized Black Basta's substantial earnings as making it "one of the most profitable ransomware strains of all time." The researchers arrived at this figure by identifying known ransom payments linked to the group, tracing the laundering of digital currency, and discovering additional payments.

Robert McArdle, a cybercrime expert from security firm TrendMicro not involved in the report, deemed the reported Black Basta figure "certainly in a believable range for their operations."

The Elliptic-Corvus report also presented evidence linking Black Basta to the now-defunct Russian group "Canti." Conti, formerly a prominent ransomware gang, gained notoriety for coercing victims through data encryption, ransom demands, and threats to publish stolen information. 

The report suggests that individuals from Conti, following the dismantling of its leak site after Russia's invasion of Ukraine and the subsequent posting of U.S. bounties on its leadership, may have reorganized and rebranded, with Black Basta potentially being a manifestation of this restructuring.

"Conti was perhaps the most successful ransomware gang we've seen," remarked Robinson. The recent findings indicate that some individuals responsible for Conti's success might be replicating it with the Black Basta ransomware, he added.
Read more »
Security
attackers British Library Cyber Attacks Data Data Safety Hackers Safety Security

British Library Hit by Cyber Incident, Disrupting Services

 

The British Library in London, known for its serene study environment and vast collection of 170 million items, has been disrupted by a "cyber incident." This event has led to the shutdown of its website, impeding access to the online catalog, and the cessation of Wi-Fi services. 

Staff members are unable to use computers, creating a predigital atmosphere within the library. Ordering books now involves consulting hardback catalogs or external websites, writing down catalog numbers, and handing them to librarians for verification. The incident has affected various users, including authors and academics, who rely on the library for their work.

Despite the significance of the British Library, the institution has provided minimal information about the incident on social media. The library stated that it is facing a major technology outage due to the cyber incident, impacting both online and on-site services. 

The staff is collaborating with Britain's National Cyber Security Center to investigate the matter. Speculation about the cause of the shutdown abounds among users, with many having to adjust their work plans to accommodate the disruption.

While details remain scarce, other European libraries presume the British Library was deliberately targeted. The National Library of Scotland, for instance, has intensified its monitoring and protection in response to the attack. 

This incident underscores a shift in cybercriminals targeting libraries, which traditionally flew under the radar. Tasmina Islam, a cybersecurity education lecturer, suggests that financial motives may be driving such attacks, as libraries house valuable information, including personal data and intellectual property. She emphasizes the need for libraries and institutions to enhance their security measures.

Within the British Library, employees are puzzled by the event, describing it as a "nightmare." However, not all users are dismayed by the interruption. Eric Langley, a Shakespeare scholar, finds the blackout oddly liberating, allowing him to focus solely on the bard's work. Nevertheless, he acknowledges that an extended disruption would pose challenges.
Read more »
Subscribe to: Posts (Atom)