Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label cybersecurity attacks. Show all posts

Armenian Suspect Extradited to US Over Role in RedLine Malware Operation

 

A man from Armenia now faces trial in the U.S., accused of helping run a major cybercriminal network recently uncovered. On March 23, authorities took Hambardzum Minasyan into custody; later that week, he stood before judges in Austin. Officials there detailed how he supposedly aided the RedLine scheme behind the scenes.  

Minasyan faces accusations tied to overseeing parts of a malicious software network, say U.S. justice officials. Hosting setups involving virtual servers - central to directing attacks - are part of what he allegedly handled. Domain registrations connected to RedLine operations were reportedly arranged by him. File-sharing platforms built under his direction may have helped spread the program to users. Control mechanisms behind these actions remain outlined in official claims. 

After deployment, RedLine grabs private details like banking records and passwords from compromised devices. This stolen data often ends up traded or misused by online criminals. One key figure, Minasyan, allegedly helped manage core infrastructure alongside others involved. Control dashboards used by partners in the scheme were reportedly maintained through their efforts.  

Besides handling infrastructure tasks, Minasyan faces claims he helped run money flows for the network. A digital currency wallet tied to him supposedly managed transactions among members and moved profits from compromised information. Officials report that the team continuously assisted people deploying the malicious software, guiding attack methods while boosting earnings.  

Facing several accusations today, Minasyan is charged with using unauthorized access devices, breaking rules under the Computer Fraud and Abuse Act, along with plotting ways to launder money. A guilty verdict might lead to a maximum penalty of three decades behind bars.  

A wave of global actions has tightened pressure on RedLine operations. Early in 2024, teams from several countries joined forces - among them officers from the Dutch National Police - to strike key systems powering the malware network. This push formed what officials later called Operation Magnus, a synchronized disruption targeting how the service operated. 

Instead of selling outright, its creators let hackers lease access; investigators focused sharply on this rental setup during their work. A federal indictment names Maxim Alexandrovich Rudometov, a citizen of Russia, as central to creating the malicious software. Should he be found guilty, extended penalties may apply due to further allegations tied to his role. 

A closer look reveals persistent attempts worldwide to weaken structured hacking groups while targeting central figures for responsibility. Despite challenges, momentum builds as actions cross borders to undermine digital criminal systems.

APIsec Secures Exposed Customer Data After Unprotected Database Found Online

 

API security firm APIsec has confirmed it secured an exposed internal database that was left accessible on the internet without a password for several days, potentially exposing sensitive customer information. The database, which was discovered by cybersecurity research firm UpGuard on March 5, reportedly contained data stretching back to 2018, including names and email addresses of users and employees from APIsec’s corporate clients. 

UpGuard said the unsecured database held detailed insights into the security posture of various APIsec customers—data the company collects while monitoring its clients’ APIs for vulnerabilities. This included sensitive information such as whether multi-factor authentication was enabled for particular accounts. 

UpGuard noted that such details could be valuable to threat actors looking for weaknesses in corporate systems. Initially, APIsec founder Faizel Lakhani downplayed the incident, claiming the database contained only test and debugging data and insisting it was not a production system. 

However, after being presented with evidence by TechCrunch showing the inclusion of real-world customer information and API scan results, Lakhani acknowledged the severity of the issue. He confirmed the database had been exposed due to human error and said it was quickly secured once the company was notified. 

Although Lakhani claimed affected customers were notified, he declined to share a copy of the breach notification and did not clarify whether regulatory authorities, such as state attorneys general, had been informed as required by law.  
UpGuard’s investigation also revealed the presence of private credentials in the exposed dataset, including keys for Amazon Web Services (AWS), as well as login details for Slack and GitHub. While researchers could not verify whether the credentials were active, APIsec later stated they belonged to a former employee and were deactivated two years prior. 

It remains unclear why outdated keys were stored in the database at all. The incident raises concerns about how companies specializing in cybersecurity manage their own internal systems and handle sensitive client data, especially as APIsec advertises services to Fortune 500 companies