Oktacron - Cyber Security RSS Feeds History

Mobile viruses in 2021: main trends | Kaspersky official blog

kaspersky Mar 25, 2022 Threats

We continuously monitor the mobile threat landscape to keep you informed of the most important trends. Not long back, we published a report about the threats facing smartphone and tablet owners in 2021. First the good news: a major takeaway is that last year we saw a significant decrease in mobile threat activity show more ...

compared to 2020. However, with that said — its too early to relax. For one thing, the number of attacks on smartphones and tablets fell only relative to the record high of 2020, and remained at around the same level as in 2019. For another, cybercriminals are becoming increasingly inventive. Adware attacks One of the trends in 2021 was the introduction of malicious code in third-party ads modules, which developers of various useful apps often plug in to monetize their work. For example, last spring cybercriminals used a malicious advertisement SDK to infect APKPure, a popular alternative Android app store. Fortunately, its developers took security seriously, and released a clean version a day after we got in touch with them. A similar story happened with the popular WhatsApp mod FMWhatsApp: one of the versions of the app harbored the Triada Trojan inside an advertisement SDK. This Trojan is infamous for being very difficult to remove from an infected device. Moreover, Triada rarely comes alone and tends to download a bunch of other malicious apps onto the victims device. Malware on Google Play Weve already written more than once that malware can sneak into official app stores. To pass all checks and get to through to users, cybercriminals employ all sorts of tricks, such as loading malicious code into an approved program in the guise of an update. In 2021, loaders for various Trojans were found in apps on Google Play, which included the Joker and Facestealer malware. Joker stealthily takes out paid subscriptions for the user, while Facestealer, as the name suggests, specializes in stealing Facebook credentials. In most cases, to spread their creations via Google Play, cybercriminals add tiny injections of malicious code to an otherwise harmless apps that have been already approved by the store. For example, the authors of the Joker Trojan took advantage of the popularity of the Korean TV series Squid Game to hide the malware in an app that offered themed wallpapers. When Joker was discovered, there were more than 200 apps dedicated to the series on Google Play, and many of them borrowed features from each other. Unsurprisingly, when scanning such programs, the store moderators let a malicious upgrade sneak past. Small injections of malicious code are hard to detect during moderation, which cybercriminals constantly try to exploit. One of the apps in Google Play that contained Joker Trojan Bankers — creative theft For several years now, banking Trojans have been hunting, not just for bank accounts but also for accounts in online stores and other digital services. In 2021, their area of interest widened even further: our experts discovered the Gamethief malware, which steals login data for the mobile version of the game PlayerUnknowns Battlegrounds (PUBG). This is the first mobile Trojan that specializes in stealing gaming accounts — just a few years ago, this type of malware was exclusive to desktop computers. Cybercriminals also improved the functionality of their creations. For example, the Fakecalls banking Trojan is capable of dropping the call if the user tries to contact their bank, and replacing it with a pre-recorded response of a fake bank representative. That way, the malware lulls the victim into thinking that a bank employee answered the call. How to protect your smartphone from malware Cybercriminals are resourceful and take every opportunity to prey on mobile device users. So, regardless of their activity level, it pays to be alert. Download apps only from official sources. True, this is not a 100% security guarantee, but there are far less malicious programs in official stores, and even when malware slips through moderation it usually gets removed from the store relatively quickly. Whenever possible, use apps from trusted developers with a good reputation to minimize the chances of encountering malware. Ignore apps that promise payouts youve never heard of or overly generous prizes. Its almost bound to be a scam. Dont give apps permissions they dont need to work. Most malware will not be able to deploy fully without potentially dangerous permissions, for example, access to Accessibility, access to text messages and installation of unknown apps. Use a reliable mobile antivirus that will detect and block malware that tries to get inside your phone.

Estonian Tied to 13 Ransomware Attacks Gets 66 Months in Prison

krebsonsecurity Mar 25, 2022 Ne'er-Do-Well News

An Estonian man was sentenced today to more than five years in a U.S. prison for his role in at least 13 ransomware attacks that caused losses of approximately $53 million. Prosecutors say the accused also enjoyed a lengthy career of “cashing out” access to hacked bank accounts worldwide. Maksim Berezan, show more ...

37, is an Estonian national who was arrested nearly two years ago in Latvia. U.S. authorities alleged Berezan was a longtime member of DirectConnection, a closely-guarded Russian cybercriminal forum that existed until 2015. Berezan’s indictment (PDF) says he used his status at DirectConnection to secure cashout jobs from other vetted crooks on the exclusive crime forum. Berezan specialized in cashouts and “drops.” Cashouts refer to using stolen payment card data to make fraudulent purchases or to withdraw money from bank accounts without authorization. A drop is a location or individual able to securely receive and forward funds or goods obtained through cashouts or other types of fraud. Drops typically are used to make it harder for law enforcement to trace fraudulent transactions and to circumvent fraud detection measures used by banks and credit card companies. Acting on information from U.S. authorities, in November 2020 Latvian police searched Berezan’s residence there and found a red Porsche Carrera 911, a black Porsche Cayenne, a Ducati motorcycle, and an assortment of jewelry. They also seized $200,000 in currency, and $1.7 million in bitcoin. After Berezan was extradited to the United States in December 2020, investigators searching his electronic devices said they found “significant evidence of his involvement in ransomware activity.” “The post-extradition investigation determined that Berezan had participated in at least 13 ransomware attacks, 7 of which were against U.S. victims, and that approximately $11 million in ransom payments flowed into cryptocurrency wallets that he controlled,” reads a statement from the U.S. Department of Justice. Berezan pleaded guilty in April 2021 to conspiracy to commit wire fraud. The DirectConnection cybercrime forum, circa 2011. For many years on DirectConnection and other crime forums, Berezan went by the hacker alias “Albanec.” Investigators close to the case told KrebsOnSecurity that Albanec was involved in multiple so-called “unlimited” cashouts, a highly choreographed, global fraud scheme in which crooks hack a bank or payment card processor and used cloned payment cards at cash machines around the world to fraudulently withdraw millions of dollars in just a few hours. Berezan joins a growing list of top cybercriminals from DirectConnection who’ve been arrested and convicted of cybercrimes since the forum disappeared years ago. One of Albanec’s business partners on the forum was Sergey “Flycracker” Vovnenko, a Ukrainian man who once ran his own cybercrime forum and who in 2013 executed a plot to have heroin delivered to our home in a bid to get Yours Truly arrested for drug possession. Vovnenko was later arrested, extradited to the United States, pleaded guilty and spent more than three years in prison on botnet-related charges (Vovnenko is now back in Ukraine, trying to fight the Russian invasion with his hacking abilities). Perhaps the most famous DirectConnection member was its administrator Aleksei Burkov, a Russian hacker thought to be so connected to the Russian cybercriminal scene that he was described as an “asset of extreme importance to Moscow.” Burkov was arrested in Israel in 2015, and the Kremlin arrested an Israeli woman on trumped-up drug charges to force a prisoner swap. That effort failed. Burkov was extradited to the U.S. in 2019, soon pleaded guilty, and was sentenced to nine years. However, he was recently deported back to Russia prior to serving his full sentence, which has prompted Republican leaders in the House to question why. Other notable cybercrooks from DirectConnection who’ve been arrested, extradited to the U.S. and sentenced to prison include convicted credit card fraudsters Vladislav “Badb” Horohorin and Sergey “zo0mer” Kozerev, as well as the infamous spammer and botnet master Peter “Severa” Levashov. At his sentencing today, Berezan was sentenced to 66 months in prison and ordered to pay $36 million in restitution to his victims.

Bad Actors Trying to Capitalize on Current Events via Shameless Email Scams

cyware Mar 25, 2022 Identity Theft, Fraud, Scams

This attack starts with an IRS impersonation email that contains a ZIP attachment called “W-9 form.zip”. The email is sent to the target, and a password is provided within the body of the email for convenient extraction.

Heap overflow vulnerability in Sound Exchange libsox library

cyware Mar 25, 2022 Malware and Vulnerabilities

The vulnerability specifically exists in the way the Sound Exchange libsox library handles NIST Speech Header Resources (SPHERE) files, which are used for speech recognition.

Western Digital My Cloud OS update fixes critical vulnerability

cyware Mar 25, 2022 Malware and Vulnerabilities

The flaw, tracked as CVE-2022-23121, was exploited by the NCC Group’s EDG team members and relied on the open-source service named “Netatalk Service” that was included in My Cloud OS.

Morgan Stanley Client Accounts Breached in Social Engineering Attacks

cyware Mar 25, 2022 Breaches and Incidents

Morgan Stanley Wealth Management, the wealth and asset management division of Morgan Stanley, says some of its customers had their accounts compromised in social engineering attacks.

Australia: WA government allocates $19.2m to expand cybersecurity services

cyware Mar 25, 2022 Govt., Critical Infrastructure

The funding will put be towards ensuring the state's cyber capabilities can facilitate secure data exchanges between agencies, and prevent, detect, and responds to cyber threats.

Recruitment System of UK Ministry of Defence Taken Offline Following Cyberattack

cyware Mar 25, 2022 Breaches and Incidents

The army was informed of the break-in on March 14, and "that a group of hackers was going to release Army Application Data on the dark web," a source familiar with the matter told The Register.

Scotland's Heriot-Watt University in second week of outage

cyware Mar 25, 2022 Breaches and Incidents

Edinburgh's Heriot-Watt University has entered the second week of woe following a security incident. The institution's spokesperson confirmed to The Register that it was a cyber attack.

Hackers are targeting European refugee charities -Ukrainian official

cyware Mar 25, 2022 Trends, Reports, Analysis

Hackers are targeting European charity groups working to help Ukrainian refugees fleeing the country following Russia's invasion, a senior Ukrainian cybersecurity official said on Wednesday.

Elden Ring exploit traps players in infinite death loop

cyware Mar 25, 2022 Malware and Vulnerabilities

A little over a week ago, players of Elden Ring complained that their sessions were being invaded by “hackers”. Invading people’s games is a normal feature of the title, but being put into an endless death loop, not so much.

Lawsuit claims Kronos breach exposed data for 'millions'

cyware Mar 25, 2022 Incident Response, Learnings

A class-action lawsuit was filed against Ultimate Kronos Group for alleged negligence leading to the exposure of millions of workers' info during a ransomware attack and private cloud breach in December.

Honda Bug Lets Hackers Unlock and Start Vulnerable Car via Replay Attacks

cyware Mar 25, 2022 Malware and Vulnerabilities

This week, multiple researchers disclosed a vulnerability that can be used by a nearby attacker to unlock some Honda and Acura car models, and start their engines wirelessly.

US charges 4 Russian govt employees with critical infrastructure hacks

cyware Mar 25, 2022 Incident Response, Learnings

The U.S. has indicted four Russian government employees for their involvement in hacking campaigns targeting hundreds of companies and organizations from the global energy sector between 2012 and 2018.

Trojanized Android and iOS Apps Pose as 40 Popular Cryptocurrency Wallets

cyware Mar 25, 2022 Malware and Vulnerabilities

The main goal of these malicious apps is to steal users’ funds and until now we have seen this scheme mainly targeting Chinese users. Researchers expect these techniques to spread into other markets.

Avast acquires SecureKey Technologies in authentication, identity management push

cyware Mar 25, 2022 Companies to Watch

Avast has acquired SecureKey Technologies to bolster the firm's digital authentication and identity management portfolio. The deal was announced on Thursday. Financial details have not been disclosed.

UK police arrest seven individuals suspected of being hacking group members

cyware Mar 25, 2022 Incident Response, Learnings

Detective Inspector Michael O'Sullivan, from the City of London Police, said in a statement that the law enforcement agencies and its partners have been conducting an investigation into a cybercriminal outfit, leading to seven arrests.

Hotel WiFi Across 40 Countries in Middle East and North Africa Found Exposing Private Data

cyware Mar 25, 2022 Breaches and Incidents

From his hotel room, cybersecurity researcher Etizaz Mohsin was able to obtain network configurations of 629 major hotels across 40 countries and the personal information of millions of guests.

What are phishing kits (phishkits)?

cyware Mar 25, 2022 Expert Blogs and Opinion

They consist of ready-made templates and scripts which can be used to create phishing pages quickly and at scale. Phishing kits are easy to use, which is why even inexperienced attackers can get their heads around them.

North Korean Hackers Used Chrome Zero-Day to Target Fintech, IT, and Media Firms

cyware Mar 25, 2022 Malware and Vulnerabilities

The Chrome vulnerability in question – CVE-2022-0609 – was patched by Google last month with the company issuing a barebones advisory to warn of the zero-day in-the-wild exploitation.

Storm Cloud Attempting To GIMMICK macOS Users

cyware Mar 25, 2022 Threat Actors

Volexity discovered a newly discovered macOS variant of Gimmick, a malware implant developed by a Chinese group tracked as Storm Cloud. It is targeting organizations across Asia. The samples of the GIMMICK malware are large and complex, which suggests the threat actor behind it seems to be well resourced. Moreover, there is the possibility that Storm Cloud bought this malware from a third-party developer.

QNAP NAS Device Makers Warn of DeadBolt Attacks and Risks Due to a Linux Bug

cyware Mar 25, 2022 Malware and Vulnerabilities

Taiwanese hardware manufacturer QNAP is facing twin threats. While Deadbolt ransomware actors are targeting users, the vendor has also urged customers to stay vigilant of Dirty Pipe. Around 5,000 exposed QNAP NAS devices—out of 130,000 exposed—were targeted by ransomware. Whereas, the flaw exists in all major distros, leading to root access with local access.

Over 100 Building Controllers in Russia Vulnerable to Remote Hacker Attacks

cyware Mar 25, 2022 Malware and Vulnerabilities

The security flaws were discovered by researcher Jose Bertin in a controller made by Russian company Tekon Avtomatika, which specializes in equipment and software for elevators and other building systems.

HTTP request smuggling bug patched in mitmproxy

cyware Mar 25, 2022 Malware and Vulnerabilities

Mitmproxy, an open source, interactive HTTPS proxy service, has patched a dangerous bug that potentially allowed attackers to stage HTTP request smuggling attacks against backend servers.

North Korean Hackers Unleashed Chrome 0-Day Exploit On Hundreds Of US Targets

packetstormsecurity Mar 25, 2022 headline,hacker,government,flaw,cyberwar

Grimes Said She Orchestrated Cyber Attack That Shut Down Hipster Runoff

packetstormsecurity Mar 25, 2022 headline,hacker,denial of service,data l

US Charges 4 Russian Hackers Over Attacks On Energy Sector

packetstormsecurity Mar 25, 2022 headline,hacker,government,usa,russia,cy

Russia Hacked Ukrainian Satellite Comms, Officials Believe

packetstormsecurity Mar 25, 2022 headline,government,russia,cyberwar,spyw

Frosties NFT Operators Arrested Over $1.1 Million Rug Pull Scam

packetstormsecurity Mar 25, 2022 headline,cybercrime,fraud,cryptography

UK Cops Collar 7 Suspected Lapsus$ Gang Members

packetstormsecurity Mar 25, 2022 headline,government,malware,britain,cybe