Oktacron - Cyber Security RSS Feeds History

Phishing for mailing lists | Kaspersky official blog

kaspersky Feb 02, 2021 Business

As dangerous as it is when consumers think they’re too boring to be of interest to cybercriminals, it’s worse to hear the same from SMB owners. When they neglect basic protection, that suits cybercriminals just fine — their targets aren’t always what you might expect. One example comes from a show more ...

message that fell into our mail trap recently: phishing aimed at hijacking an e-mail service provider (ESP) account — for mailing lists. How mail service phishing works The scam begins with a company employee receiving a message confirming payment for a subscription to an ESP. The link in the message is supposed to give the recipient access to proof of purchase. If the recipient is indeed a client of the ESP (and the phishing does target actual clients), they are likely to click through, hoping to figure out the anomalous payment. Although the hyperlink seems to lead to an ESP page, it really points somewhere else entirely. Clicking it takes victims to a fake site that looks very much like a legitimate login page. Two login screens. Fake page is on the left. At this point, readers won’t be surprised to learn that any data entered on the fake login page goes straight to the cybercriminals behind the scam. Note, however, that in addition to the misdirection, the fake site transmits the data it harvests over an unprotected channel. The attackers didn’t even bother to replicate the CAPTCHA, although they did insert an example in the e-mail field. We should see a flag in the lower right corner as well. But most users are unlikely to spot those discrepancies. Why losing access to an ESP account is dangerous In the best-case scenario, having gained control over an ESP account, the attackers will use the list of client e-mail addresses to send spam. Industry-specific mailing lists fetch a higher price on the black market than simple collections of random e-mail addresses, however; knowing a company’s line of work helps cybercriminals tailor their spam. Given the cybercriminals’ phishing specialty, it is likely that everyone on the stolen lists will receive a phishing e-mail that appears to come from the company. At that point, whether the recipient subscribed to a newsletter or is actually a client, they are likely to open a message, read it, and even click on a link in it. The sender doesn’t seem suspicious. Masking methods Studying the phishing e-mail in detail, we found it had been sent through a mailing service, but a different one (a competitor of the ESP from which it purported to come). For the logic behind that decision, see our post “Phishing through e-mail marketing services.” Interestingly, to prolong the life of the campaign, the cybercriminals even made a landing page for their “marketing firm.” (The page title, “Simple House Template,” isn’t particularly convincing, though.) A landing page for the fake “marketing firm”. The foregoing suggests the attackers might have detailed knowledge of the mechanisms of various mailing services, and they might attack other ESPs’ clients as well. How to guard against phishing To avoid getting hooked, follow the standard tips: Avoid clicking links in unexpected messages, in particular any asking you to log in to a service. Even if the message looks legitimate, just open a browser and manually type in the name of the site. Check site security. If your browser does not recognize a site as secure, then someone can intercept your username and password. Learn how to spot standard signs of phishing, and then teach your entire staff how to do the same. You don’t need to create your own classes; online training platforms are available for that purpose. Use specialized solutions to filter out spam and phishing from corporate mail. Install and update security solutions on all work devices, so that even if someone clicks a phishing link, the danger will be averted.

‘ValidCC,’ a Major Payment Card Bazaar and Looter of E-Commerce Sites, Shuttered

krebsonsecurity Feb 02, 2021 Ne'er-Do-Well News

ValidCC, a dark web bazaar run by a cybercrime group that for more than six years hacked online merchants and sold stolen payment card data, abruptly closed up shop last week. The proprietors of the popular store said their servers were seized as part of a coordinated law enforcement operation designed to disconnect show more ...

and confiscate its infrastructure. ValidCC, circa 2017. There are dozens of online shops that sell so-called “card not present” (CNP) payment card data stolen from e-commerce stores, but most source the data from other criminals. In contrast, researchers say ValidCC was actively involved in hacking and pillaging hundreds of online merchants — seeding the sites with hidden card-skimming code that siphoned personal and financial information as customers went through the checkout process. Russian cybersecurity firm Group-IB published a report last year detailing the activities of ValidCC, noting the gang behind the crime shop was responsible for plundering nearly 700 e-commerce sites. Group-IB dubbed the gang “UltraRank,” which it said had additionally compromised at least 13 third-party suppliers whose software components are used by countless online stores across Europe, Asia, North and Latin America. Group-IB believes UltraRank is responsible for a slew of hacks that other security firms previously attributed to at least three distinct cybercrime groups. “Over five years….UltraRank changed its infrastructure and malicious code on numerous occasions, as a result of which cybersecurity experts would wrongly attribute its attacks to other threat actors,” Group-IB wrote. “UltraRank combined attacks on single targets with supply chain attacks.” ValidCC’s front man on multiple forums — a cybercriminal who uses the hacker handle “SPR” — told customers on Jan. 28 that the shop would close for good following what appeared to be a law enforcement takedown of its operations. SPR claims his site lost access to a significant inventory — more than 600,000 unsold stolen payment card accounts. “As a result, we lost the proxy and destination backup servers,” SPR explained. “Besides, now it’s impossible to open and decrypt the backend. The database is in the hands of the police, but it’s encrypted.” ValidCC had thousands of users, some of whom held significant balances of bitcoin stored in the shop when it ceased operations. SPR claims the site took in approximately $100,000 worth of virtual currency deposits each day from customers. Many of those customers took to the various crime forums where the shop has a presence to voice suspicions that the proprietors had simply decided to walk away with their money at a time when Bitcoin was near record-high price levels. SPR countered that ValidCC couldn’t return balances because it no longer had access to its own ledgers. “We don’t know anything!,” SPR pleaded. “We don’t know users’ balances, or your account logins or passwords, or the [credit cards] you purchased, or anything else! You are free to think what you want, but our team has never conned or let anyone down since the beginning of our operations! Nobody would abandon a dairy cow and let it die in the field! We did not take this decision lightly!” Group-IB said ValidCC was one of many cybercrime shops that stored some or all of its operational components at Media Land LLC, a major “bulletproof hosting” provider that supports a vast array of phishing sites, cybercrime forums and malware download servers. Assuming SPR’s claims are truthful, it could be that law enforcement agencies targeted portions of Media Land’s digital infrastructure in some sort of coordinated action. However, so far there are no signs of any major uproar in the cybercrime underground directed at Yalishanda, the nickname used by the longtime proprietor of Media Land. ValidCC’s demise comes close on the heels of the shuttering of Joker’s Stash, by some accounts the largest underground shop for selling stolen credit card and identity data. On Dec. 16, 2020, several of Joker’s long-held domains began displaying notices that the sites had been seized by the U.S. Department of Justice and Interpol. Less than a month later, Joker announced he was closing the shop permanently. And last week, authorities across Europe seized control over dozens of servers used to operate Emotet, a prolific malware strain and cybercrime-as-service operation. While there are no indications that action targeted any criminal groups apart from the Emotet gang, it is often the case that multiple cybercrime groups will share the same dodgy digital infrastructure providers, knowingly or unwittingly. Gemini Advisory, a New York-based firm that closely monitors cybercriminal stores, said ValidCC’s administrators recently began recruiting stolen card data resellers who previously had sold their wares to Joker’s Stash. Stas Alforov, Gemini’s director of research and development, said other card shops will quickly move in to capture the customers and suppliers who frequented ValidCC. “There are still a bunch of other shops out there,” Alforov said. “There’s enough tier one shops out there that sell card-not-present data that haven’t dropped a beat and have even picked up volumes.”

After Joker’s Stash Closes, What Comes Next?

cyware Feb 02, 2021 Trends, Reports, Analysis

Since 2014, the Joker's Stash carding bazaar had developed a reputation for offering for sale millions of stolen payment card numbers and making splashy announcements of new offerings.

U.K. Arrest in ‘SMS Bandits’ Phishing Service — Krebs on Security

cyware Feb 02, 2021 Threat Actors

Authorities in the United Kingdom have arrested a 20-year-old man for allegedly operating an online service for sending high-volume phishing campaigns via mobile text messages.

The first step in protecting ourselves is realizing that there’s a lot we can do to stay safe online

cyware Feb 02, 2021 Expert Blogs and Opinion

Consumers’ buying habits indicate how they are going about their digital-first lives, with 70% saying they’ve purchased at least one connected device in 2020, while 1 in 3 bought three devices.

New Trickbot module uses Masscan for local network reconnaissance

cyware Feb 02, 2021 Malware and Vulnerabilities

Named masrv, the component incorporates a copy of the Masscan open-source utility in order to scan local networks for other systems with open ports that can be attacked at a later stage.

Threat intel is a game changer, if only firms can figure out how to bake it into cyber programs

cyware Feb 02, 2021 Expert Blogs and Opinion

In the 2020 version of the annual SANS Cyber Threat Intelligence Survey, about half of respondents reported having a dedicated team of employees focused on cyber threat intelligence.

Cybersecurity risks and how to manage them

cyware Feb 02, 2021 Expert Blogs and Opinion

The rapidly evolving nature of the risk due to new threat actors and attack types makes it difficult to assess, and all organizations are currently struggling with how to manage cybersecurity risk.

Sprite Spider emerging as one of the most destructive ransomware threat actors

cyware Feb 02, 2021 Threat Actors

Today Sprite Spider is poised to become one of the biggest ransomware threat actors of 2021 and has a threat profile on par with what advanced persistent threat actors were five or ten years ago.

Data Leak at European Volleyball Confederation Impacts Hundreds of Players, Journalists

cyware Feb 02, 2021 Breaches and Incidents

A publicly exposed cloud storage bucket was found to contain images of hundreds of passports and identity documents belonging to journalists and volleyball players from around the world.

US court system ditches electronic filing, goes paper-only for sensitive documents following SolarWinds hack

cyware Feb 02, 2021 Govt., Critical Infrastructure

The US court system has banned the electronic submission of legal documents in sensitive cases out of concern that Russian hackers have compromised the electronic filing system.

Personal Data of 1.6 Million Unemployment Claimants Exposed in Hack of Washington State Auditor

cyware Feb 02, 2021 Breaches and Incidents

The compromised data had been collected as part of the auditor’s investigations into how the state Employment Security Department (ESD) lost $600 million to fraudulent unemployment claims.

Phishing campaign lures US businesses with fake PPP loans

cyware Feb 02, 2021 Identity Theft, Fraud, Scams

The attackers behind this phishing campaign are taking advantage of the ongoing financial problems some businesses are experiencing due to the pandemic to lure them into handing over sensitive info.

Agent Tesla Malware Spotted Using New Delivery & Evasion Techniques

cyware Feb 02, 2021 Malware and Vulnerabilities

Security researchers on Tuesday uncovered new delivery and evasion techniques adopted by Agent Tesla remote access trojan (RAT) to get around defense barriers and monitor its victims.

Wind River ‘Security Incident’ Affects SSNs, Passport Numbers

cyware Feb 02, 2021 Breaches and Incidents

Affected data included information maintained within the company’s personnel records – including critical data like Social-Security numbers, driver’s license numbers, and passport numbers.

Intel agency warns of threats from China collecting sensitive US health data

cyware Feb 02, 2021 Threat Intel & Info Sharing

The NCSC wrote that U.S. health data was an attractive target for the Chinese government due to the diversity of the population and because of the nation’s comparably lax safeguards for personal data.

Kids’ Health Insurer’s Website Vulnerable for 7 Years

cyware Feb 02, 2021 Breaches and Incidents

The personal information of several thousand insurance applicants was inappropriately accessed, the organization says, but it has no evidence that anyone’s personal information was removed.

US govt: Number of identity theft reports doubled last year

cyware Feb 02, 2021 Trends, Reports, Analysis

The U.S. Federal Trade Commission (FTC) said today that the number of identity theft reports has doubled during 2020 when compared to 2019, reaching a record 1.4 million reports within a single year.

Data on 3.2 Million DriveSure Clients Exposed by Cybercriminals on Hacking Forum

cyware Feb 02, 2021 Breaches and Incidents

Hackers typically only share valuable segments or trimmed down versions of user databases, the researchers wrote, but in this case, numerous backend files and folders were leaked.

Destroying the Destroyer - Malware Edition

cyware Feb 02, 2021 Trends, Reports, Analysis

Dubbed Operation LadyBird, Emotet's infrastructure was taken down by the joint collaboration between law enforcement agencies from the U.S., the U.K, Canada, along with Europol and Eurojust.

Android Gets Its New Malware for the Year

cyware Feb 02, 2021 Malware and Vulnerabilities

Dubbed Oscorp, the malware abuses accessibility services in Android devices to steal user credentials and media content. The malware gets its name from the title of the login page of its C2 server.

Netgain ransomware incident impacts local governments

cyware Feb 02, 2021 Breaches and Incidents

Data of as many as 8,700 clients has been impacted and Ramsey County is not the only local government affected by this attack. In some cases, the Social Security number may also have been exposed.

New Sophisticated Multiplatform Malware 'Kobalos' Targets Linux Supercomputers

cyware Feb 02, 2021 Malware and Vulnerabilities

Once the malware has landed on a supercomputer, the code buries itself in an OpenSSH server executable and will trigger the backdoor if a call is made through a specific TCP source port.

Ransomware gangs are abusing VMWare ESXi exploits to encrypt virtual hard disks

cyware Feb 02, 2021 Malware and Vulnerabilities

At least one major ransomware gang is abusing vulnerabilities in the VMWare ESXi product to take over virtual machines deployed in enterprise environments and encrypt their virtual hard drives.

SolarWinds Hack Prompts Congress To Put NSA In Encryption Hot Seat

packetstormsecurity Feb 02, 2021 headline,government,privacy,usa,nsa,cryp

This Linux Malware Is Hijacking Supercomputers Globally

packetstormsecurity Feb 02, 2021 headline,hacker,malware,linux,password

Identity Theft Spikes Due To COVID-19 Relief

packetstormsecurity Feb 02, 2021 headline,government,privacy,virus,fraud,

Hackers Are Exploiting A Critical Zero Day In Devices From SonicWall

packetstormsecurity Feb 02, 2021 headline,hacker,flaw,zero day