From Digital Age to Nano Age. WorldWide.

Tag: hackers

Atoms Lanka Solutions > hackers
Robotic Automations

US says Russian hackers stole federal government emails during Microsoft cyberattack | TechCrunch

April 22, 2024 11:38 AM0


U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that Russian government-backed hackers stole emails from several U.S. federal agencies as a result of an ongoing cyberattack at Microsoft.

In a statement published Thursday, the U.S. cyber agency said the cyberattack, which Microsoft initially disclosed in January, allowed the hackers to steal federal government emails “through a successful compromise of Microsoft corporate email accounts.”

The hackers, which Microsoft calls “Midnight Blizzard,” also known as APT29, are widely believed to work for Russia’s Foreign Intelligence Service, or SVR.

“Midnight Blizzard’s successful compromise of Microsoft corporate email accounts and the exfiltration of correspondence between agencies and Microsoft presents a grave and unacceptable risk to agencies,” said CISA.

The federal cyber agency said it issued a new emergency directive on April 2 ordering civilian government agencies to take action to secure their email accounts, based on new information that the Russian hackers were ramping up their intrusions. CISA made details of the emergency directive public on Thursday after giving affected federal agencies a week to reset passwords and secure affected systems.

CISA did not name the affected federal agencies that had emails stolen, and a spokesperson for CISA did not immediately comment when reached by TechCrunch.

News of the emergency directive was first reported by Cyberscoop last week.

The emergency directive comes as Microsoft faces increasing scrutiny of its security practices after a spate of intrusions by hackers of adversarial nations. The U.S. government is heavily reliant on the software giant for hosting government emails accounts.

Microsoft went public in January after identifying that the Russian hacking group broke into some corporate email systems, including the email accounts of “senior leadership team and employees in our cybersecurity, legal, and other functions.” Microsoft said the Russian hackers were searching for information about what Microsoft and its security teams knew about the hackers themselves. Later, the technology giant said the hackers also targeted other organizations outside of Microsoft.

Now it is known that some of those affected organizations included U.S. government agencies.

By March, Microsoft said it was continuing its efforts to expel the Russian hackers from its systems in what the company described as an “ongoing attack.” In a blog post, the company said the hackers were attempting to use “secrets” they had initially stolen in order to access other internal Microsoft systems and exfiltrate more data, such as source code.

Microsoft did not immediately comment when asked by TechCrunch on Thursday what progress the company is making in remediating the attack since March.

Earlier this month, the U.S. Cyber Safety Review Board (CSRB) concluded its investigation of an earlier 2023 breach of U.S. government emails attributed to China government-backed hackers. The CSRB, an independent body that includes representatives from government and cyber experts in the private sector, blamed a “cascade of security failures at Microsoft.” Those allowed the China-backed hackers to steal a sensitive email key that permitted broad access to both consumer and government emails.

In February, the U.S. Department of Defense notified 20,000 individuals that their personal information was exposed to the internet after a Microsoft-hosted cloud email server was left without a password for several weeks in 2023.

Russian spies keep hacking into Microsoft in ‘ongoing attack,’ company says


Software Development in Sri Lanka

Robotic Automations

Hackers are threatening to publish a huge stolen sanctions and financial crimes watchlist | TechCrunch

April 18, 2024 10:57 PM0


A financially motivated criminal hacking group says it has stolen a confidential database containing millions of records that companies use for screening potential customers for links to sanctions and financial crime.

The hackers, which call themselves GhostR, said they stole 5.3 million records from the World-Check screening database in March and are threatening to publish the data online.

World-Check is a screening database used for “know your customer” checks (or KYC), allowing companies to determine if prospective customers are high risk or potential criminals, such as people with links to money laundering or who are under government sanctions.The hackers told TechCrunch that they stole the data from a Singapore-based firm with access to the World-Check database, but did not name the firm.

A portion of the stolen data, which the hackers shared with TechCrunch, includes individuals who were sanctioned as recently as this year.

Simon Henrick, a spokesperson for the London Stock Exchange Group, which maintains the database, told TechCrunch: “This was not a security breach of LSEG/our systems. The incident involves a third party’s data set, which includes a copy of the World-Check data file. This was illegally obtained from the third party’s system. We are liaising with the affected third party, to ensure our data is protected and ensuring that any appropriate authorities are notified.”

LSEG did not name the third-party company, but did not dispute the amount of data stolen.

The portion of stolen data seen by TechCrunch contains records on thousands of people, including current and former government officials, diplomats, and private companies whose leaders are considered “politically exposed people,” who are at a higher risk of involvement in corruption or bribery. The list also contains individuals accused of involvement in organized crime, suspected terrorists, intelligence operatives, and a European spyware vendor.

The data varies by record. The database contains names, passport numbers, Social Security numbers, online crypto account identifiers and bank account numbers, and more.

World-Check is currently owned by the London Stock Exchange Group following a $27 billion deal to buy financial data provider Refinitiv in 2021. LSEG collects information from public sources, including sanctions lists, government sources, and news outlets, then provides the database as a subscription to companies for conducting customer due diligence.

But privately run databases, like World-Check, are known to contain errors that can affect entirely innocent people with no nexus or connection to crime but whose information is stored in these databases.

In 2016, an older copy of the World-Check database leaked online following a security lapse at a third-party company with access to the data, including a former advisor to the U.K. government that World-Check had applied a “terrorism” label to his name. Banking giant HSBC shut down bank accounts belonging to several prominent British Muslims after the World-Check database branded them with “terrorism” tags.

A spokesperson for the U.K.’s data protection authority, the Information Commissioner’s Office, did not immediately comment on the breach.

To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.


Software Development in Sri Lanka

Robotic Automations

Apex Legends hacker says game developers patched exploit used on streamers | TechCrunch

April 18, 2024 7:41 PM0


Last month, a hacker wreaked havoc during an esports tournament of the popular shooter game Apex Legends, hacking two well-known streamers mid-game to make it look like they were using cheats.

A month later, it seems like the hacking saga may have come to a close with the game developers patching the bug exploited by the hacker.

Because of the hack, the organizers had to suspend the tournament on March 17. Two days later, Apex Legends developer Respawn said on its official X account that it had “deployed the first of a layered series of updates to protect the Apex Legends player community.” Then a week later, the company wrote that it had “added another update that is intended to further protect our players and ensure the competitive integrity of Apex Legends.”

Respawn’s posts don’t clearly say that the updates patched the bugs exploited during the tournament. But the hacker behind the cheating scandal told TechCrunch this week that Respawn’s patches fixed the vulnerability that he had exploited to hack the two streamers.

“The exploit I’ve used in [Apex Legends Global Series] is fully patched,” the hacker who goes by Destroyer2009 said in an online chat.

Destroyer2009, who previously told TechCrunch that he had hacked the two streamers “for fun,” said he didn’t want to reveal any technical details of the bug he exploited, even if it is now patched.

“No one likes when severe vulnerabilities in your product are exposed publicly. I asked my friend and we both agreed that we don’t really want to publicly expose what happened from a technical perspective yet,” the hacker said, referring to a friend he worked with to develop the hack.

Contact Us

Do you know more about this hack? Or other video game hacking incidents? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

Referring to an unrelated botched in-game update by Respawn this week, Destroyer2009 said: “[I] don’t think embarrassing them even more is fair.”

Destroyer2009 said he tested his exploit after Respawn’s announcement of the second update on March 26, although he said it’s possible it was patched sooner because he didn’t have a chance to test it before.

Destroyer2009’s hacks were high-profile, disruptive, and caused a big stir in the Apex Legends community. The two streamers targeted, ImperialHal and Geburten, collectively have 2.5 million followers on the game streaming platform Twitch, and several other Apex Legends players and streamers commented on the news of the hacks on their channels.

Yet, Respawn isn’t being forthcoming about the patches it released. TechCrunch asked Respawn and Electronic Arts, the owners of the development studio, to confirm whether the exploit used by Destroyer2009 is indeed patched, and if so, when it was patched.

But neither Respawn nor Electronic Arts responded to TechCrunch’s multiple requests for comment. The two companies did not respond to requests for comment in the last few weeks either.

Meanwhile, Destroyer2009 said he won’t do any more public hacks for now, because “anything more severe than the [Apex tournament hack] accident will be already considered as a real hacking with all the consequences so [probably] will just play the game until it gets boring as usual.”




Software Development in Sri Lanka

Robotic Automations

Ransomware gang's new extortion trick? Calling the front desk | TechCrunch

April 17, 2024 9:34 PM0


When a hacker called the company that his gang claimed to breach, he felt the same way that most of us feel when calling the front desk: frustrated.

The phone call between the hacker, who claims to represent the ransomware gang DragonForce, and the victim company employee was posted by the ransomware gang on its dark web site in an apparent attempt to put pressure on the company to pay a ransom demand. In reality, the call recording just shows a somewhat hilarious and failed attempt to extort and intimidate a company’s rank-and-file employees.

The recording also shows how ransomware gangs are always looking for different ways to intimidate the companies they hack.

“It’s increasingly common for threat actors to make contact via telephone, and this should be factored into organizations’ response plans. Do we engage or not? Who should engage? You don’t want to be making these decisions while the threat actor is listening to your hold music,” said Brett Callow, a threat analyst at Emsisoft.

In the call, the hacker asks to speak with the “management team.” Instead, two different employees put him on hold until Beth, from HR, answers the call.

“Hi, Beth, how are you doing?” the hacker said.

After a minute in which the two have trouble hearing each other, Beth tells the hacker that she is not familiar with the data breach that the hacker claimed. When the hacker attempts to explain what’s going on, Beth interrupts him and asks: “Now, why would you attack us?”

“Is there a reason why you chose us?” Beth insists.

“No need to interrupt me, OK? I’m just trying to help you,” the hacker responds, growing increasingly frustrated.

The hacker then proceeds to explain to Beth that the company she works for only has eight hours to negotiate before the ransomware gang will release the company’s stolen data.

“It will be published for public access, and it will be used for fraudulent activities and for terrorism by criminals,” the hacker says.

“Oh, OK,” says Beth, apparently nonplussed, and not understanding where the data is going to be.

“So it will be on X?” Beth asks. “So is that Dragonforce.com?”

The hacker then threatens Beth, saying they will start calling the company’s clients, employees and partners. The hacker adds that they have already contacted the media and provided a recording of a previous call with one of her colleagues, which is also on the gang’s dark web site.

“So that includes a conversation with Patricia? Because you know, that’s illegal in Ohio,” Beth says.

“Excuse me?” the hacker responds.

“You can’t do that in Ohio. Did you record Patricia?” Beth continues.

“Ma’am, I am a hacker. I don’t care about the law,” responds the hacker, growing even more frustrated.

Then the hacker tries one more time to convince Beth to negotiate, to no avail.

“I would never negotiate with a terrorist or a hacker as you call yourself,” Beth responds, asking the hacker to confirm a good phone number to call them back.

When the hacker says they “got no phone number,” Beth has had enough.

“Alright, well then I’m just gonna go ahead and end this phone call now,” she says. “I think we spent enough time and energy on this.”

“Well, good luck,” Beth says.

“Thank you, take care,” the hacker says.

The company that was allegedly hacked in this incident, which TechCrunch is not naming as to not help the hackers extort the company, did not respond to a request for comment.

Read more on TechCrunch:


Software Development in Sri Lanka

Robotic Automations

Hackers stole 340,000 Social Security numbers from government consulting firm | TechCrunch

April 17, 2024 12:13 AM0


U.S. consulting firm Greylock McKinnon Associates (GMA) disclosed a data breach in which hackers stole as many as 341,650 Social Security numbers.

The data breach was disclosed on Friday on Maine’s government website, where the state posts data breach notifications.

In its data breach notice sent by mail to affected victims, GMA said it was hit by an unspecified cyberattack in May 2023 and “promptly took steps to mitigate the incident.”

GMA provides economic and litigation support to companies and U.S. government agencies, including the U.S. Department of Justice, bringing civil litigation. According to its data breach notice, GMA told affected individuals that their personal information “was obtained by the U.S. Department of Justice (“DOJ”) as part of a civil litigation matter” supported by GMA.

The reasons and target of the DOJ’s civil litigation are not known. A spokesperson for the Justice Department did not respond to a request for comment.

GMA said that individuals notified of the data breach are “not the subject of this investigation or the associated litigation matters,” and that the cyberattack “does not impact your current Medicare benefits or coverage.”

“We consulted with third-party cybersecurity specialists to assist with our response to the incident, and we notified law enforcement and the DOJ. We received confirmation of which individuals’ information was affected and obtained their contact addresses on February 7, 2024,” the firm wrote.

GMA told victims that “your personal and Medicare information was likely affected in this incident,” which includes names, dates of birth, home address, some medical information and health insurance information, and Medicare claim numbers, which included Social Security numbers.

It’s unclear why it took GMA nine months to determine the extent of the breach and notify victims.

GMA, and the firm’s outside legal counsel, Linn Freedman of Robinson & Cole LLP, did not immediately respond to a request for comment.


Software Development in Sri Lanka

Robotic Automations

Price of zero-day exploits rises as companies harden products against hackers | TechCrunch

April 16, 2024 4:11 PM0


Tools that allow government hackers to break into iPhones and Android phones, popular software like the Chrome and Safari browsers, and chat apps like WhatsApp and iMessage, are now worth millions of dollars — and their price has multiplied in the last few years as these products get harder to hack.

On Monday, startup Crowdfense published its updated price list for these hacking tools, which are commonly known as “zero-days” because they rely on unpatched vulnerabilities in software that are unknown to the makers of that software. Companies like Crowdfense and one of its competitors, Zerodium, claim to acquire these zero-days with the goal of reselling them to other organizations, usually government agencies or government contractors, which claim they need the hacking tools to track or spy on criminals.

Crowdfense is now offering between $5 million and $7 million for zero-days to break into iPhones; up to $5 million for zero-days to break into Android phones; up to $3 million and $3.5 million for Chrome and Safari zero-days, respectively; and $3 million to $5 million for WhatsApp and iMessage zero-days.

In its previous price list, published in 2019, the highest payouts that Crowdfense was offering were $3 million for Android and iOS zero-days.

The increase in prices comes as companies like Apple, Google, and Microsoft are making it harder to hack their devices and apps, which means their users are better protected.

“It should be harder year over year to exploit whatever software we’re using, whatever devices we’re using,” said Dustin Childs, who is the head of threat awareness at Trend Micro ZDI. Unlike Crowdfense and Zerodium, ZDI pays researchers to acquire zero-days, then reports them to the companies affected with the goal of getting the vulnerabilities fixed.

“As more zero-day vulnerabilities are discovered by threat intelligence teams like Google’s, and platform protections continue to improve, the time and effort required from attackers increases, resulting in an increase in cost for their findings,” said Shane Huntley, the head of Google’s Threat Analysis Group, which tracks hackers and the use of zero-days.

In a report last month, Google said it saw hackers use 97 zero-day vulnerabilities in the wild in 2023. Spyware vendors, which often work with zero-day brokers, were responsible for 75% of zero-days targeting Google products and Android, according to the company.

People in and around the zero-day industry agree that the job of exploiting vulnerabilities is getting harder.

David Manouchehri, a security analyst with knowledge of the zero-day market, said that “hard targets like Google’s Pixel and the iPhone have been becoming harder to hack every year. I expect the cost to continue to increase significantly over time.”

“The mitigations that vendors are implementing are working, and it’s leading the whole trade to become much more complicated, much more time-consuming, and so clearly this is then reflected in the price,” Paolo Stagno, the director of research at Crowdfense, told TechCrunch.

Contact Us

Do you know more zero-day brokers? Or about spyware providers? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

Stagno explained that in 2015 or 2016, it was possible for only one researcher to find one or more zero-days and develop them into a full-fledged exploit targeting iPhones or Androids. Now, he said, “this thing is almost impossible,” as it requires a team of several researchers, which also causes prices to go up.

Crowdfense currently offers the highest publicly known prices to date outside of Russia, where a company called Operation Zero announced last year that it was willing to pay up to $20 million for tools to hack iPhones and Android devices. The prices in Russia, however, may be inflated because of the war in Ukraine and the subsequent sanctions, which could discourage or outright prevent people from dealing with a Russian company.

Outside of the public view, it’s possible that governments and companies are paying even higher prices.

“The prices Crowdfense is offering researchers for individual Chrome [Remote Code Execution] and [Sandbox Escape] exploits are below market rate from what I have seen in the zero-day industry,” said Manouchehri, who previously worked at Linchpin Labs, a startup that focused on developing and selling zero-days. Linchpin Labs was acquired by U.S. defense contractor L3 Technologies (now known as L3Harris) in 2018.

Alfonso de Gregorio, the founder of Zeronomicon, an Italy-based startup that acquires zero-days, agreed, telling TechCrunch that prices could “certainly” be higher.

Zero-days have been used in court-approved law enforcement operations. In 2016, the FBI used a zero-day provided by a startup called Azimuth to break into the iPhone of one of the shooters who killed 14 people in San Bernardino, according to The Washington Post. In 2020, Motherboard revealed that the FBI — with the help of Facebook and an unnamed third-party company — used a zero-day to track down a man who was later convicted for harassing and extorting young girls online.

There have also been several cases where zero-days and spyware have allegedly been used to target human rights dissidents and journalists in Ethiopia, Morocco, Saudi Arabia, and the United Arab Emirates, among other countries with poor human rights records. There have also been similar cases of alleged abuse in democratic countries like Greece, Mexico, Poland, and Spain. (Neither Crowdfense, Zerodium, or Zeronomicon, have ever been accused of being involved in similar cases.)

Zero-day brokers, as well as spyware companies like NSO Group and Hacking Team have often been criticized for selling its products to unsavory governments. In response, some of them now pledge to respect export controls in an effort to limit potential abuses from their customers.

Stagno said that Crowdfense follows the embargoes and sanctions imposed by the United States — even if the company is based in the United Arab Emirates. For example, Stagno said that the company wouldn’t sell to Afghanistan, Belarus, Cuba, Iran, Iraq, North Korea, Russia, South Sudan, Sudan, and Syria — all on U.S. sanctions lists.

“Everything the U.S. does, we are on the ball,” Stagno said, adding that if an existing customer gets on the U.S. sanctions list, Crowdfense would abandon it. “All the companies and governments directly sanctioned by the USA are excluded.”

At least one company, spyware consortium Intellexa, is on Crowdfense’s particular blocklist.

“I can’t tell you whether it has been a customer of ours and whether it has stopped being one,” Stagno said. “However, as far as I am concerned now at this moment Intellexa could not be a customer of ours.”

In March, the U.S. government announced sanctions against Intellexa’s founder Tal Dilian as well as a business associate of his, the first time the government imposed sanctions on individuals involved in the spyware industry. Intellexa and its partner company Cytrox was also sanctioned by the U.S., making it harder for the companies, as well as the people running it, to continue doing business.

These sanctions have caused concern in the spyware industry, as TechCrunch reported.

Intellexa’s spyware has been reported to have been used against U.S. congressman Michael McCaul, U.S. senator John Hoeven, and the president of the European Parliament Roberta Metsola, among others.

De Gregorio, the founder of Zeronomicon, declined to say who the company sells to. On its site, the company has published a code of business ethics, which includes vetting customers with the goal of avoiding doing business “with entities known for abusing human rights,” and respecting export controls.

Investors’ pledge to fight spyware undercut by past investments in US malware maker


Software Development in Sri Lanka

Robotic Automations

How Ukraine’s cyber police fights back against Russia's hackers | TechCrunch

April 13, 2024 10:37 AM0


On February 24, 2022, Russian forces invaded Ukraine. Since then, life in the country has changed for everyone.

For the Ukrainian forces who had to defend their country, for the regular citizens who had to withstand invading forces and constant shelling, and for the Cyberpolice of Ukraine, which had to shift its focus and priorities.

“Our responsibility changed after the full scale war started,” said Yevhenii Panchenko, the chief of division of the Cyberpolice Department of the National Police of Ukraine, during a talk on Tuesday in New York City. “New directives were put under our responsibility.”

During the talk at the Chainalysis LINKS conference, Panchenko said that the Cyberpolice is comprised of around a thousand employees, of which about forty track crypto-related crimes. The Cyberpolice’s responsibility is to combat “all manifestations of cyber crime in cyberspace,” said Panchenko. And after the war started, he said, “we were also responsible for the active struggle against the aggression in cyberspace.”

Panchenko sat down for a wide-ranging interview with TechCrunch on Wednesday, where he spoke about the Cyberpolice’s new responsibilities in wartime Ukraine. That includes tracking what war crimes Russian soldiers are committing in the country, which they sometimes post on social media; monitoring the flow of cryptocurrency funding the war; exposing disinformation campaigns; investigating ransomware attacks; and training citizens on good cybersecurity practices.

The following transcript has been edited for brevity and clarity.

TechCrunch: How did your job and that of the police change after the invasion?

It almost totally changed. Because we still have some regular tasks that we always do, we’re responsible for all the spheres of cyber investigation.

We needed to relocate some of our units in different places, of course, to some difficult organizations because now we need to work separately. And also we added some new tasks and new areas for us of responsibilities when the war started.

From the list of the new tasks that we have, we crave information about Russian soldiers. We never did that. We don’t have any experience before February 2022. And now we try to collect all the evidence that we have because they also adapted and started to hide, like their social media pages that we used for recognizing people who were taking part in the larger invading forces that Russians used to get our cities and kill our people.

Also, we are responsible for identifying and investigating the cases where Russian hackers do attacks against Ukraine. They attack our infrastructure, sometimes DDoS [distributed denial-of-service attacks], sometimes they make defacements, and also try to disrupt our information in general. So, it’s quite a different sphere.

Because we don’t have any cooperation with Russian law enforcement, that’s why it’s not easy to sometimes identify or search information about IP addresses or other things. We need to find new ways to cooperate on how to exchange data with our intelligence services.

Some units are also responsible for defending the critical infrastructure in the cyber sphere. It’s also an important task. And today, many attacks also target critical infrastructure. Not only missiles, but hackers also try to get the data and destroy some resources like electricity, and other things.

When we think about soldiers, we think about real world actions. But are there any crimes that Russian soldiers are committing online?

[Russia] uses social media to sometimes take pictures and publish them on the internet, as it was usual in the first stage of the war. When the war first started, probably for three or four months [Russian soldiers] published everything: videos and photos from the cities that were occupied temporarily. That was evidence that we collected.

And sometimes they also make videos when they shoot in a city, or use tanks or other vehicles with really big guns. There’s some evidence that they don’t choose the target, they just randomly shoot around. It’s the video that we also collected and included in investigations that our office is doing against the Russians.

In other words, looking for evidence of war crimes?

Yes.

How has the ransomware landscape in Ukraine changed after the invasion?

It’s changed because Russia is now not only focused on the money side; their main target is to show citizens and probably some public sector that [Russia] is really effective and strong. If they have any access on a first level, they don’t deep dive, they just destroy the resources and try to deface just to show that they are really strong. They have really effective hackers and groups who are responsible for that. Now, we don’t have so many cases related to ransom, we have many cases related to disruption attacks. It has changed in that way.

Has it been more difficult to distinguish between pro-Russian criminals and Russian government hackers?

Really difficult, because they don’t like to look like a government structure or some units in the military. They always find a really fancy name like, I don’t know, ‘Fancy Bear’ again. They try to hide their real nature.

Contact Us

Do you have information about cyberattacks in Ukraine? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

But we see that after the war started, their militaries and intelligence services started to organize groups — maybe they’re not so effective and not so professional as some groups that worked before the war started. But they organize the groups in a massive [scale]. They start from growing new partners, they give them some small tasks, then see if they are effective and truly succeed in a small portion of IT knowledge. Then they move forward and do some new tasks. Now we can see many of the applications they also publish on the internet about the results. Some are not related to what governments or intelligence groups did, but they publish that intelligence. They also use their own media resources to raise the impact of the attack.

What are pro-Russian hacking groups doing these days? What activities are they focused on? You mentioned critical infrastructure defacements; is there anything else that you’re tracking?

It starts from basic attacks like DDoS to destroy communications and try to destroy the channels that we use to communicate. Then, of course, defacements. Also, they collect data. Sometimes they publish that in open sources. And sometimes they probably collect but not use it in disruption, or in a way to show that they already have the access.

Sometimes we know about the situation when we prevent a crime, but also attacks. We have some signs of compromise that were probably used on one government, and then we share with others.

[Russia] also creates many psyops channels. Sometimes the attack did not succeed. And even if they don’t have any evidence, they’ll say “we have access to the system of military structures of Ukraine.”

How are you going after these hackers? Some are not inside the country, and some are inside the country.

That’s the worst thing that we have now, but it’s a situation that could change. We just need to collect all the evidence and also provide investigation as we can. And also, we inform other law enforcement agencies in countries who cooperate with us about the actors who we identify as part of the groups that committed attacks on Ukrainian territory or to our critical infrastructure.

Why is it important? Because if you talk about some regular soldier from the Russian army, he will probably never come to the European Union and other countries. But if we talk about some smart guys who already have a lot of knowledge in offensive hacking, he prefers to move to warmer places and not work from Russia. Because he could be recruited to the army, other things could happen. That’s why it’s so important to collect all evidence and all information about the person, then also prove that he was involved in some attacks and share that with our partners.

Also because you have a long memory, you can wait and maybe identify this hacker, where they are in Russia. You have all the information, and then when they are in Thailand or somewhere, then you can move in on them. You’re not in a rush necessarily?

They attack a lot of our civil infrastructure. That war crime has no time expiration. That’s why it’s so important. We can wait 10 years and then arrest him in Spain or other countries.

Who are the cyber volunteers doing and what is their role?

We don’t have many people today who are volunteers. But they are really smart people from around the world — the United States and the European Union. They also have some knowledge in IT, sometimes in blockchain analysis. They help us to provide analysis against the Russians, collect data about the wallets that they use for fundraising campaigns, and sometimes they also inform us about the new form or new group that the Russians create to coordinate their activities.

It’s important because we can’t cover all the things that are happening. Russia is a really big country, they have many groups, they have many people involved in the war. That type of cooperation with volunteers is really important now, especially because they also have a better knowledge of local languages.

Sometimes we have volunteers who are really close to Russian-speaking countries. That helps us understand what exactly they are doing. There is also a community of IT guys that’s also communicating with our volunteers directly. It’s important and we really like to invite other people to that activity. It’s not illegal or something like that. They just provide the information and they can tell us what they can do.

What about pro-Ukrainian hackers like the Ukraine IT Army. Do you just let them do what they want or are they also potential targets for investigation?

No, we don’t cooperate directly with them.

We have another project that also involves many subscribers. I also talked about it during my presentation: it’s called BRAMA. It’s a gateway and we coordinate and gather people. One thing that we propose is to block and destroy Russian propaganda and psyops on the internet. We have really been effective and have had really big results. We blocked more than 27,000 resources that belong to Russia. They publish their narratives, they publish many of psyops materials. And today, we also added some new functions in our community. We not only fight against propaganda, we also fight against fraud, because a lot of fraud today represented in the territory of Ukraine is also created by the Russians.

They also have a lot of impact with that, because if they launder and take money from our citizens, we could help. And that’s why we include those activities, so we proactively react to stories that we received from our citizens, from our partners about new types of fraud that could be happening on the internet.

And also we provide some training for our citizens about cyber hygiene and cybersecurity. It’s also important today because the Russians hackers not only target the critical infrastructure or government structures, they also try to get some data of our people.

For example, Telegram. Now it’s not a big problem but it’s a new challenge for us, because they first send interesting material, and ask people to communicate or interact with bots. On Telegram, you can create bots. And if you just type twice, they get access to your account, and change the number, change two-factor authentication, and you will lose your account.

Is fraud done to raise funds for the war?

Yes.

Can you tell me more about Russian fundraising? Where are they doing it, and who is giving them money? Are they using the blockchain?

There are some benefits and also disadvantages that crypto could give them. First of all, [Russians] use crypto a lot. They create almost all kinds of wallets. It starts from Bitcoin to Monero. Now they understand that some types of crypto are really dangerous for them because many of the exchanges cooperate and also confiscate the funds that they collect to help their military.

How are you going after this type of fundraising?

If they use crypto, we label the addresses, we make some attribution. It’s our main goal. That’s also the type of activities that our volunteers help us to do. We are really effective at that. But if they use some banks, we only could collect the data and understand who exactly is responsible for that campaign. Sanctions are the only good way to do that.

What is cyber resistance?

Cyber resistance is the big challenge for us. We wanted to play that cyber resistance in cyberspace for our users, for our resources. First of all, if we talk about users, we start from training and also sharing some advice and knowledge with our citizens. The idea is how you could react to the attacks that are expected in the future.

How is the Russian government using crypto after the invasion?

Russia didn’t change everything in crypto. But they adapted because they saw that there were many sanctions. They create new ways to launder money to prevent attribution of the addresses that they used for their infrastructures, and to pay or receive funds. It’s really easy in crypto to create many addresses. Previously they didn’t do that as much, but now they use it often.


Software Development in Sri Lanka

Robotic Automations

US offers $10M to help catch Change Healthcare hackers | TechCrunch

April 13, 2024 8:07 AM0


The U.S. government said it is extending its reward for information on key leadership of the ALPHV/BlackCat cybercrime gang to its affiliate members, one of which last month took credit for a massive ransomware attack on a U.S. health tech giant.

In a statement Wednesday, the U.S. Department of State said it is offering a reward of up to $10 million for information that identifies or locates any person associated with ALPHV/BlackCat, including “their affiliates, activities, or links to a foreign government.”

The Russia-based ALPHV/BlackCat is a ransomware-as-a-service operation, which recruits affiliates — effectively contractors who earn a commission for launching ransomware attacks — and takes a cut of whatever ransom demand the victim pays. Although security researchers have not yet drawn a connection between ALPHV/BlackCat and a foreign government, the State Department implied in its statement that the gang may be “acting at the direction or under the control of a foreign government,” such as Russia.

The State Department blamed the prolific ransomware group for targeting U.S. critical infrastructure, including healthcare services.

Last month, an affiliate group of the ALPHV/BlackCat gang took credit for a cyberattack and weekslong outage at U.S. health tech giant Change Healthcare, which processes around one in three U.S. patient medical records. The cyberattack knocked out much of the U.S. healthcare system’s access to patient records and billing information, causing massive outages and delays in fulfilling medications and prescriptions and surgical authorizations for weeks.

The affiliate group went public after accusing the main ALPHV/BlackCat gang of swindling the contract hackers out of $22 million in ransom that Change Healthcare allegedly paid to prevent the mass leak of patient records.

The group said ALPHV/BlackCat carried out an “exit scam,” where the hackers run off with their fortune to avoid paying their affiliates and keep the stolen funds for themselves.

Despite having lost their cut of the ransom demand, the affiliate group claimed to still have access to a huge amount of stolen sensitive patient data.

Change Healthcare has since said that it ejected the hackers from its network and restored much of its systems. U.S. health insurance giant UnitedHealth Group, the parent company of Change Healthcare, has not yet confirmed if any patient data was stolen.

As the Change Healthcare outage drags on, fears grow that patient data could spill online


Software Development in Sri Lanka

Robotic Automations

Activision investigating password-stealing malware targeting game players | TechCrunch

April 12, 2024 11:17 PM0


Video game giant Activision is investigating a hacking campaign that’s targeting players with the goal of stealing their credentials, TechCrunch has learned.

At this point, the hackers’ specific goals — apart from stealing passwords for various types of accounts — are unclear. Somehow, the hackers are getting malware on the victims’ computers and then stealing passwords for their gaming accounts and crypto wallets, among others, according to sources.

A person with knowledge of the incidents, who asked to remain anonymous because they weren’t authorized to speak to the press, said that people at Activision Blizzard are investigating, trying to “help remove the malware,” and “working on identifying and remediating player accounts for anyone affected.”

“There is not enough data yet on how [the malware] is spreading,” the person said. “It could be only affecting folks who have third-party tools installed.”

Contact Us

Do you know more about this hack? Or other video game hacking incidents? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email. You also can contact TechCrunch via SecureDrop.

Activision spokesperson Delaney Simmons told TechCrunch that the company is aware of “claims that some player credentials across the broader industry could be compromised from malware from downloading or using unauthorized software,” and that the company servers “remain secure and uncompromised.”

Activision denied that the company is helping to remove the malware. A spokesperson said the issue is with third-party software vendors and not with Activision software or platforms.

The malware campaign appears to have been uncovered first by Zebleer, a person who develops and sells cheating software for the popular first-person shooter Call of Duty. On Wednesday, in the official channel for the PhantomOverlay cheat provider, Zebleer said that hackers were targeting gamers — some who use cheats — to steal their usernames and passwords.

Zebleer described the effort as an “infostealer malware campaign,” where malware designed as legitimate-looking software unknowingly installed by the victim surreptitiously steals their usernames and passwords.

Zebleer told TechCrunch that he found out about the hacking campaign when a PhantomOverlay customer had their account for the cheat software stolen. At that point, Zebleer added, he started investigating and was able to find the database of stolen credentials that the hackers were amassing.

After that, Zebleer said he contacted Activision Blizzard as well as other cheat makers, whose users appear to be affected.

TechCrunch obtained a sample of the allegedly stolen logins, and verified that a portion of the data are genuine credentials. It’s not clear how old or recent the data is.

At this point, there are no reasons to believe regular players of Activision games are at risk, just those who use third-party apps such as cheats.

In any case, as Activision’s Simmons told TechCrunch, users who suspect they may have been compromised can change their password and activate two-factor authentication.

Added additional details from Activision in the sixth paragraph.


Software Development in Sri Lanka

Back
WhatsApp
Messenger
Viber