Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Miners in 2022: figu ...

 Threats

Weve talked a lot lately about cryptocurrencies, as well as various scams and other crypto-targeting malicious activity. Our researchers recently checked out the situation with malicious miners — programs that secretly generate cryptocurrency for their owners using the resources of others folks computers. Although   show more ...  

malicious miners dont directly steal data or money, they can make the victims life a misery. A device with a miner slows down, heats up, and becomes unusable long before it would normally. Whats more, a miner consumes lots of electricity — which the affected user of course has to pay for. This post lays out our experts main findings, and gives tips on how to protect your devices from miners. See our Securelist blog for a more detailed report. Malicious mining on the rise Having skyrocketed last year, cryptocurrency prices this year have collapsed just as dramatically. One would expect a corresponding drop in malicious mining, but in fact the exact opposite has occurred: in the first three quarters of 2022, compared to the same period in 2021, the number of new miner modifications increased, as did the number of affected users. Cybercriminals were especially active in the third quarter, during which our solutions detected more than 150,000 new variants of malicious miners. For comparison, in the same period in 2021, fewer than 50,000 appeared. Our researchers also studied what kinds of malware attackers tried to plant on victims devices after exploiting known software vulnerabilities. In the first three quarters of 2022, about one in seven cases turned out to be a malicious miner. And throughout the year, as cryptocurrency prices steadily fell, the share of miners among infections showed stable growth. In the third quarter of 2022, this figure already stood at 17 percent (that is, every sixth case), making cryptocurrency miners the second most common malware after ransomware. Pirated software — with miner included Malicious miners, like other malware, spread in a variety of ways. In addition to vulnerabilities, cybercriminals often use pirated content (free movies/music, hacked software, cracks, cheats, etc.) to deliver such malware. So if, after torrenting a hacked game, your computer suddenly begins to slow down terribly, you may have picked up a miner along the way. And it might not be alone. Not so long ago, for example, our researchers discovered a malicious combo: a miner distributed along with a stealer (a program that appropriates credentials) under the guise of game cheats and cracks. What attackers mine The world is already overflowing with cryptocurrencies. Estimates as to their number vary: Cointelegraph, for instance, claims that there are almost 21,000 of them. Besides Bitcoin and Ethereum, which probably everyone has heard of today, there are cryptocurrencies dedicated to public figures and memes (such as Dogecoin), cryptocurrencies of large companies (such as Binance Coin), government cryptocurrencies (such as the Venezuelan Petro), metaverse cryptocurrencies and so the list goes on. By studying samples of malicious miners discovered in September 2022, our researchers established what cryptojackers like to mine most of all. Monero (a cryptocurrency focused on anonymity of transactions, making it very difficult, if not impossible, to track them) proved to be the most popular. Bitcoin places second, and Ethereum third. In addition, some of the analyzed samples generated: The above-mentioned meme coin Dogecoin; Litecoin, a lightweight Bitcoin for cheaper and faster confirmed transactions; Dash, another Bitcoin spin-off; Neo, a Chinese cryptocurrency; Bit Hotel, the currency of the eponymous gaming metaverse. How not to fall victim To avoid unwittingly sharing your computing resources with strangers, be security-conscious: Download programs, music, and movies only from official sources. Pirated content may come with a hidden miner, or worse. Remember to promptly update all programs, and never postpone any OS updates. Vulnerabilities in outdated software are often exploited by cybercriminals. Use a reliable security solution that detects and blocks miners and other malicious programs.

image for Top Zeus Botnet Susp ...

 Ne'er-Do-Well News

Vyacheslav “Tank” Penchukov, the accused 40-year-old Ukrainian leader of a prolific cybercriminal group that stole tens of millions of dollars from small to mid-sized businesses in the United States and Europe, has been arrested in Switzerland, according to multiple sources. Wanted Ukrainian cybercrime   show more ...  

suspect Vyacheslav “Tank” Penchukov (right) was arrested in Geneva, Switzerland. Tank was the day-to-day manager of a cybercriminal group that stole tens of millions of dollars from small to mid-sized businesses. Penchukov was named in a 2014 indictment by the U.S. Department of Justice as a top figure in the JabberZeus Crew, a small but potent cybercriminal collective from Ukraine and Russia that attacked victim companies with a powerful, custom-made version of the Zeus banking trojan. The U.S. Federal Bureau of Investigation (FBI) declined to comment for this story. But according to multiple sources, Penchukov was arrested in Geneva, Switzerland roughly three weeks ago as he was traveling to meet up with his wife there. Penchukov is from Donetsk, a traditionally Russia-leaning region in Eastern Ukraine that was recently annexed by Russia. In his hometown, Penchukov was a well-known deejay (“DJ Slava Rich“) who enjoyed being seen riding around in his high-end BMWs and Porsches. More recently, Penchukov has been investing quite a bit in local businesses. The JabberZeus crew’s name is derived from the malware they used, which was configured to send them a Jabber instant message each time a new victim entered a one-time password code into a phishing page mimicking their bank. The JabberZeus gang targeted mostly small to mid-sized businesses, and they were an early pioneer of so-called “man-in-the-browser” attacks, malware that can silently siphon any data that victims submit via a web-based form. Once inside a victim company’s bank accounts, the crooks would modify the firm’s payroll to add dozens of “money mules,” people recruited through work-at-home schemes to handle bank transfers. The mules in turn would forward any stolen payroll deposits — minus their commissions — via wire transfer overseas. Tank, a.k.a. “DJ Slava Rich,” seen here performing as a DJ in Ukraine in an undated photo from social media. The JabberZeus malware was custom-made for the crime group by the alleged author of the Zeus trojan — Evgeniy Mikhailovich Bogachev, a top Russian cybercriminal with a $3 million bounty on his head from the FBI. Bogachev is accused of running the Gameover Zeus botnet, a massive crime machine of 500,000 to 1 million infected PCs that was used for large DDoS attacks and for spreading Cryptolocker — a peer-to-peer ransomware threat that was years ahead of its time. Investigators knew Bogachev and JabberZeus were linked because for many years they were reading the private Jabber chats between and among members of the JabberZeus crew, and Bogachev’s monitored aliases were in semi-regular contact with the group about updates to the malware. Gary Warner, director of research in computer forensics at the University of Alabama at Birmingham, noted in his blog from 2014 that Tank told co-conspirators in a JabberZeus chat on July 22, 2009 that his daughter, Miloslava, had been born and gave her birth weight. “A search of Ukrainian birth records only showed one girl named Miloslava with that birth weight born on that day,” Warner wrote. This was enough to positively identify Tank as Penchukov, Warner said. Ultimately, Penchukov’s political connections helped him evade prosecution by Ukrainian cybercrime investigators for many years. The late son of former Ukrainian President Victor Yanukovych (Victor Yanukovych Jr.) would serve as godfather to Tank’s daughter Miloslava. Through his connections to the Yanukovych family, Tank was able to establish contact with key insiders in top tiers of the Ukrainian government, including law enforcement. Sources briefed on the investigation into Penchukov said that in 2010 — at a time when the Security Service of Ukraine (SBU) was preparing to serve search warrants on Tank and his crew — Tank received a tip that the SBU was coming to raid his home. That warning gave Tank ample time to destroy important evidence against the group, and to avoid being home when the raids happened. Those sources also said Tank used his contacts to have the investigation into his crew moved to a different unit that was headed by his corrupt SBU contact. Writing for Technology Review, Patrick Howell O’Neil recounted how SBU agents in 2010 were trailing Tank around the city, watching closely as he moved between nightclubs and his apartment. “In early October, the Ukrainian surveillance team said they’d lost him,” he wrote. “The Americans were unhappy, and a little surprised. But they were also resigned to what they saw as the realities of working in Ukraine. The country had a notorious corruption problem. The running joke was that it was easy to find the SBU’s anticorruption unit—just look for the parking lot full of BMWs.” AUTHOR’S NOTE/BACKGROUND I first encountered Tank and the JabberZeus crew roughly 14 years ago as a reporter for The Washington Post, after a trusted source confided that he’d secretly gained access to the group’s private Jabber conversations. From reading those discussions each day, it became clear Tank was nominally in charge of the Ukrainian crew, and that he spent much of his time overseeing the activities of the money mule recruiters — which were an integral part of their victim cashout scheme. It was soon discovered that the phony corporate websites the money mule recruiters used to manage new hires had a security weakness that allowed anyone who signed up at the portal to view messages for every other user. A scraping tool was built to harvest these money mule recruitment messages, and at the height of the JabberZeus gang’s activity in 2010 that scraper was monitoring messages on close to a dozen different money mule recruitment sites, each managing hundreds of “employees.” Each mule was given busy work or menial tasks for a few days or weeks prior to being asked to handle money transfers. I believe this was an effort to weed out unreliable money mules. After all, those who showed up late for work tended to cost the crooks a lot of money, as the victim’s bank would usually try to reverse any transfers that hadn’t already been withdrawn by the mules. When it came time to transfer stolen funds, the recruiters would send a message through the fake company website saying something like: “Good morning [mule name here]. Our client — XYZ Corp. — is sending you some money today. Please visit your bank now and withdraw this payment in cash, and then wire the funds in equal payments — minus your commission — to these three individuals in Eastern Europe.” Only, in every case the company mentioned as the “client” was in fact a small business whose payroll accounts they’d already hacked into. So, each day for several years my morning routine went as follows: Make a pot of coffee; shuffle over to the computer and view the messages Tank and his co-conspirators had sent to their money mules over the previous 12-24 hours; look up the victim company names in Google; pick up the phone to warn each that they were in the process of being robbed by the Russian Cyber Mob. My spiel on all of these calls was more or less the same: “You probably have no idea who I am, but here’s all my contact info and what I do. Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately and have them put a hold on any pending transfers before it’s too late. Feel free to call me back afterwards if you want more information about how I know all this, but for now please just call or visit your bank.” In many instances, my call would come in just minutes or hours before an unauthorized payroll batch was processed by the victim company’s bank, and some of those notifications prevented what otherwise would have been enormous losses — often several times the amount of the organization’s normal weekly payroll. At some point I stopped counting how many tens of thousands of dollars those calls saved victims, but over several years it was probably in the millions. Just as often, the victim company would suspect that I was somehow involved in the robbery, and soon after alerting them I would receive a call from an FBI agent or from a police officer in the victim’s hometown. Those were always interesting conversations. Collectively, these notifications to victims led to dozens of stories over several years about small businesses battling their financial institutions to recover their losses. I never wrote about a single victim that wasn’t okay with my calling attention to their plight and to the sophistication of the threat facing other companies. This incessant meddling on my part very much aggravated Tank, who on more than one occasion expressed mystification as to how I knew so much about their operations and victims. Here’s a snippet from one of their Jabber chats in 2009, after I’d written a story for The Washington Post about their efforts to steal $415,000 from the coffers of Bullitt County, Kentucky. In the chat below, “lucky12345” is the Zeus author Bogachev: tank: Are you there? tank: This is what they damn wrote about me. tank: http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html#more tank: I’ll take a quick look at history tank: Originator: BULLITT COUNTY FISCAL Company: Bullitt County Fiscal Court tank: Well, you got [it] from that cash-in. lucky12345: From 200K? tank: Well, they are not the right amounts and the cash out from that account was shitty. tank: Levak was written there. tank: Because now the entire USA knows about Zeus. tank:  lucky12345: It’s fucked. On Dec. 13, 2009, one of Tank’s top money mule recruiters — a crook who used the pseudonym “Jim Rogers” — told his boss something I hadn’t shared beyond a few trusted confidants at that point: That The Washington Post had eliminated my job in the process of merging the newspaper’s Web site (where I worked at the time) with the dead tree edition. jim_rogers: There is a rumor that our favorite (Brian) didn’t get his contract extension at Washington Post. We are giddily awaiting confirmation  Good news expected exactly by the New Year! Besides us no one reads his column  tank: Mr. Fucking Brian Fucking Kerbs! Another member of the JabberZeus crew — Ukrainian-born Maksim “Aqua” Yakubets — also is currently wanted by the FBI, which is offering a $5 million reward for information leading to his arrest and conviction. Alleged “Evil Corp” bigwig Maksim “Aqua” Yakubets. Image: FBI

 Malware and Vulnerabilities

Lookout researchers discovered two surveillance campaigns targeting Uyghurs in China and abroad. The threat actors are using BadBazaar and MOONSHINE Android surveillance tools. An analysis of both campaigns suggested these are part of China’s long-running attacks against Uyghur population.

 Govt., Critical Infrastructure

The European Union on Thursday unveiled new proposals to help its armies move faster in times of conflict and to boost cyber security, saying that Russia’s war on Ukraine is a wake-up call to bolster Europe’s defenses.

 Incident Response, Learnings

Oregon Attorney General Ellen Rosenblum announced the historic settlement alongside 39 other AGs, after Rosenblum and Nebraska AG Doug Peterson led negotiations for what they said was the largest consumer privacy settlement ever led by AGs.

 Threat Actors

The Worok threat actor was found hiding information-stealing malware within PNG images to compromise targets’ devices without raising any suspicions. Actors use a new info-stealer, dubbed DropBoxControl for C2 communications and has already been used against organizations and government institutions in Mexico, Vietnam, and Cambodia.

 Trends, Reports, Analysis

The Ransomware Harms and the Victim Experience project, by the Royal United Service Institute and University of Kent, explores and draws attention to the psychological harms and other effects that ransomware can have on its victims and wider society.

 Malware and Vulnerabilities

Akamai uncovered an evasive malware, KmsdBot, being used to target companies ranging from gaming to luxury car brands to security firms. It uses the SSH cryptographic protocol to enter systems with the goal of mining and launching DDoS attacks. The malware is equipped to control the mining process and update the malware if required.

 Trends, Reports, Analysis

Cyble researchers observed a rise in cybercrime against the nuclear industry worldwide with various actors demonstrating more and more sophistication every passing day. Although nuclear entities are supposed to be air-gapped, vulnerable IT/OT devices, misconfigured networks, and exposed assets are critical components during a cyberattack.

 Malware and Vulnerabilities

Crypto miner/stealer for hire, Typhon Stealer, received a new update in the form of Typhon Reborn, disclosed Palo Alto Networks. The new variant boasts enhanced anti-analysis techniques and other stealing and file-grabber features. Researchers found that it leverages Telegram’s API and infrastructure to exfiltrate all stolen data.

 Incident Response, Learnings

At least five complaints filed in the U.S. District for Southern New York allege that Somnia Inc. was negligent in failing to safeguard personally identifiable information and protected health information.

 Companies to Watch

The continuous attack surface management solution provider raised another $46 million in growth funding led by WestCap. In addition to WestCap, NextEquity Partners and Rockpool Capital joined the latest funding.

 Feed

Payara Platform suffers from a path traversal vulnerability. Enterprise versions prior to 5.45.0 and Community versions prior to 6.2022.1, 5.2022.4, and 4.1.2.191.38 are affected.

 Feed

Cisco Secure Email Gateways, formerly known as Cisco Ironport Email Security Appliances, that are configured to detect malicious email attachments, can easily be circumvented. A remote attacker can leverage error tolerance and different MIME decoding capabilities of email clients, compared with the gateway, to evade   show more ...  

detection of malicious payloads by anti-virus components on the gateway. This exploit was successfully tested with a zip file containing the Eicar test virus and Cisco Secure Email Gateways with AsyncOS 14.2.0-620, 14.0.0-698, and others. An affected Email Client was Mozilla Thunderbird 91.11.0 (64-bit).

 Feed

VMware Cloud Foundation (NSX-V) contains a remote code execution vulnerability via XStream open source library. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. Due to an unauthenticated endpoint that leverages XStream for input serialization   show more ...  

in VMware Cloud Foundation (NSX-V), a malicious actor can get remote code execution in the context of root on the appliance. VMware Cloud Foundation 3.x and more specific NSX Manager Data Center for vSphere up to and including version 6.4.13 are vulnerable to remote command injection. This Metasploit module exploits the vulnerability to upload and execute payloads gaining root privileges.

 Feed

Red Hat Security Advisory 2022-8400-01 - The libtirpc packages contain SunLib's implementation of transport-independent remote procedure call documentation, which includes a library required by programs in the nfs-utils and rpcbind packages. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2022-8208-01 - Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. Issues addressed include a privilege escalation vulnerability.

 Feed

Red Hat Security Advisory 2022-7959-01 - guestfs-tools is a set of tools that can be used to make batch configuration changes to guests, get disk used/free statistics, perform backups and guest clones, change registry/UUID/hostname info, build guests from scratch, and much more. Issues addressed include buffer overflow and denial of service vulnerabilities.

 Feed

Red Hat Security Advisory 2022-7933-01 - The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Issues addressed include code execution, denial of service, double free, information leakage, null pointer, out of bounds access, out of bounds write, privilege escalation, and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-8418-01 - GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.

 Feed

Red Hat Security Advisory 2022-7970-01 - The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

 Feed

Red Hat Security Advisory 2022-8340-01 - FreeType is a free, high-quality, portable font engine that can open and manage font files. FreeType loads, hints, and renders individual glyphs efficiently. Issues addressed include a buffer overflow vulnerability.

 Feed

Red Hat Security Advisory 2022-7967-01 - Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM. Issues addressed include buffer overflow, bypass, null pointer, and use-after-free vulnerabilities.

 Feed

Red Hat Security Advisory 2022-8385-01 - The Dynamic Host Configuration Protocol is a protocol that allows individual devices on an IP network to get their own network configuration information, including an IP address, a subnet mask, and a broadcast address. The dhcp packages provide a relay agent and ISC DHCP service required to enable and administer DHCP on a network.

 Feed

Red Hat Security Advisory 2022-8067-01 - The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Issues addressed include buffer overflow, denial of service, information leakage, and out of bounds read vulnerabilities.

 Feed

Red Hat Security Advisory 2022-8057-01 - Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Issues addressed include cross site request forgery, cross site scripting, denial of service, information leakage, and privilege escalation vulnerabilities.

 Feed

Red Hat Security Advisory 2022-8011-01 - FriBidi is a library to handle bidirectional scripts, so that the display is done in the proper way, while the text data itself is always written in logical order. Issues addressed include a buffer overflow vulnerability.

 Feed

Red Hat Security Advisory 2022-7978-01 - The GIMP is an image composition and editing program. GIMP provides a large image manipulation toolbox, including channel operations and layers, effects, sub-pixel imaging and anti-aliasing, and conversions, all with multi-level undo. Issues addressed include buffer overflow and denial of service vulnerabilities.

 Feed

Internet giant Google has agreed to pay a record $391.5 million to settle with 40 states in the U.S. over charges the company misled users about the collection of personal location data. "Google misled its users into thinking they had turned off location tracking in their account settings, when, in fact, Google continued to collect their location information," Oregon Attorney General Ellen

 Feed

Today, most Network Detection and Response (NDR) solutions rely on traffic mirroring and Deep Packet Inspection (DPI). Traffic mirroring is typically deployed on a single-core switch to provide a copy of the network traffic to a sensor that uses DPI to thoroughly analyze the payload. While this approach provides detailed analysis, it requires large amounts of processing power and is blind when

 Feed

A suspected Chinese state-sponsored actor breached a digital certificate authority as well as government and defense agencies located in different countries in Asia as part of an ongoing campaign since at least March 2022. Symantec, by Broadcom Software, linked the attacks to an adversarial group it tracks under the name Billbug, citing the use of tools previously attributed to this actor. The

 Feed

Spotify's Backstage has been discovered as vulnerable to a severe security flaw that could be exploited to gain remote code execution by leveraging a recently disclosed bug in a third-party module. The vulnerability (CVSS score: 9.8), at its core, takes advantage of a critical sandbox escape in vm2, a popular JavaScript sandbox library (CVE-2022-36067 aka Sandbreak), that came to light last

 Feed

Credit: Marina Minkin A novel attack method has been disclosed against a crucial piece of technology called time-triggered ethernet (TTE) that's used in safety-critical infrastructure, potentially causing the failure of systems powering spacecraft and aircraft. Dubbed PCspooF by a group of academics and researchers from the University of Michigan, the University of Pennsylvania, and the NASA

 Feed

Cybersecurity researchers have disclosed details of now-patched flaws in Zendesk Explore that could have been exploited by an attacker to gain unauthorized access to information from customer accounts that have the feature turned on. "Before it was patched, the flaw would have allowed threat actors to access conversations, email addresses, tickets, comments, and other information from Zendesk

2022-11
Aggregator history
Tuesday, November 15
TUE
WED
THU
FRI
SAT
SUN
MON
NovemberDecemberJanuary