Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Windows Defender Byp ...

 Cybersecurity News

A GitHub project that disables Windows Defender and firewall is generating buzz among cybersecurity researchers. Will Dormann, a senior vulnerability analyst at CERT, posted about the GitHub project on a Mastodon cybersecurity instance. “Somebody figured out the secret technique that 3rd-party AV uses to disable   show more ...  

Microsoft Defender so that they themselves can run without interference,” Dormann wrote. “This tool uses this technique to install a null AV product, thus having the effect of simply disabling Microsoft Defender.” Dormann included a screen recording of the tool in action, and it appears to work effectively (screenshot below). [caption id="attachment_72709" align="alignnone" width="1057"] 'No Defender' Windows Defender bypass[/caption] The GitHub project, simply called “No Defender,” is billed as “A fun way to disable windows defender + firewall.” In a note on the project, repository owner “es3n1n” said they essentially reverse-engineered the API that antivirus vendors use to disable Windows Defender. “There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender,” the note states. “This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation, so I decided to take an interesting approach for such a thing and used an already existing antivirus called Avast. This AV engine includes a so-called wsc_proxy.exe service, which essentially sets up the WSC API for Avast. With a little bit of reverse engineering, I turned this service into a service that could add my own stuff there.” One limitation noted by es3n1n is that “to keep this WSC stuff even after reboot, no-defender adds itself (not really itself but rather Avast's module) to the autorun. Thus, you would need to keep the no-defender binaries on your disk.” Windows Defender Bypass Requires Admin Privileges EDR (endpoint detection and response) and antivirus software bypasses aren’t uncommon, as hackers and researchers alike have found ways to disable security defenses. Security researchers and testers often turn off security defenses in the course of research and testing, so such tools have legitimate uses too. As one commenter noted on the ycombinator Hacker News feed, "Defender is a real irritant when doing security research and is near impossible to turn off completely and permanently. Even using the Group Policy Editor or regedits is not reliable. If you do get it to stop, it will randomly reenable itself weeks later...For the vast majority of people this is a good thing!" Dormann noted that elevated admin privileges are all that’s required to run the No Defender tool, so Windows users have yet another reason not to run Windows as an admin. “If you don't log in to Windows as an admin, as we security-conscious people do, then you won't have as much to worry about,” Dormann wrote. One Mastodon commenter saw the GitHub tool as an Avast flaw rather than Microsoft’s, noting that “it requires an executable signed with AuthentiCode SigningLevel 7 ("Signed by an Antimalware vendor whose product is using AMPPL"). “I see this more as a vulnerability of the Avast wsc_proxy.exe component misused here that allows untrusted/unsigned code to interact with it,” said the commenter, who goes by the handle “faebudo.” The Cyber Express reached out to Microsoft and Avast for comment and will update this article with any response. But Dormann told The Cyber Express the issue is "more of a novelty than a vulnerability per se. Admin-privileged users can do admin things. Which includes reconfiguring the system they're on. Including kernel-level access."

image for Strauss Borrelli PLL ...

 Firewall Daily

Strauss Borrelli PLLC, a leading law firm known for handling data breach litigation, has launched an investigation into the recent WD & Associates data breach. WDA, based in Rhode Island, is an employee benefits brokerage firm specializing in healthcare consulting. The company assists clients in making   show more ...  

well-informed decisions about financial planning and employee benefits. The incident may have exposed sensitive personally identifiable information and protected health information for an undetermined number of patients and other affected individuals. WD & Associates Data Breach WD & Associates provide a wide range of services including Employee Benefits, Safe Money Management, HR Consulting, Retirement Planning, IRA Rollovers, Actuarial Consulting, Risk Management, Business Consulting, Organizational Development. However, information from these services may be potentially compromised after a recent data breach. The security incident occurred between February 1 and February 9, 2023, when an unauthorized actor accessed sensitive information stored on WDA systems. WD stated that it had taken immediate action to secure its network and launched an investigation to determine the nature and scope of the breach. WDA began notifying potentially impacted individuals of the incident on May 24, 2024. The potentially exposed information includes: Name Social Security number Date of birth Driver’s license number Passport number Financial account information Medical information Health insurance information WD is offering 24 months of complimentary credit monitoring services through Experian to enrolled individuals. The company also stated that it would implement additional cybersecurity tools and review existing policies and procedures to prevent similar incidents from occurring in the future. WD also stated that it had notified details about the investigation to relevant federal law enforcement and would notify relevant regulators, as legally required. Strauss Borrelli PLLC Investigation Into Data Breach The Strauss Borrelli PPLC Law firm announced on it's site that it would be interested in discussing further rights and potential legal remedies with the individuals who received the recent data breach notification letter from WD & Associates, Inc. Individuals can contact the law firm through their number 872.263.1100 or e-mail address sam@straussborrelli.com. Individuals should also remain vigilant against identity theft and fraud by regularly reviewing account statements, explanation of benefits, and monitoring free credit reports for suspicious activity. Additionally, U.S. consumers are legally entitled to one free credit report annually from each of the three major credit reporting bureaus(Equifax, Experian, and TransUnion). To request a free credit report, visit www.annualcreditreport.com or call 1-877-322-8228. Consumers also have the option to place a fraud alert or implement credit freeze on their credit file at no cost. Suspicious activity should be reported promptly to relevant parties, including insurance companies, healthcare providers, and financial institutions. WD & Associates affirmed its commitment to protecting the privacy and security of its clients' information and that the company would continue to provide updates and further information as soon as they become available. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for TRC Staffing Data Br ...

 Firewall Daily

TRC Staffing is at the center of a concerning data breach, leaving personal information vulnerable to cybercriminals. Murphy Law Firm has taken action on behalf of the victims, investigating legal avenues for those affected by this security incident. The TRC Staffing data breach was discovered on April 12, 2024, and   show more ...  

exposed a security flaw within TRC's network.  Cybercriminals exploited this vulnerability between March 25, 2024, and April 12, 2024, gaining unauthorized access to sensitive data belonging to approximately 158,593 individuals. Names and Social Security numbers were among the compromised information, heightening concerns about potential identity theft and fraud. Explaining the lawsuit to interested parties, Murphy Law Firm, stated that they are "evaluating legal options, including a potential class action lawsuit, to recover damages for individuals who were affected by the data breach. Understanding the Full Extent of the TRC Staffing Data Breach In response to this TRC Staffing breach, Murphy Law Firm is actively engaging on behalf of those impacted. Their investigation aims to uncover the full extent of damages and explore avenues for legal recourse, including the possibility of a class action lawsuit. Individuals who have received notifications of the breach or suspect their information may have been compromised are urged to take action. By visiting the dedicated page at https://murphylegalfirm.com/cases/trc-data-breach/, affected parties can access information regarding their rights and legal options. The repercussions of this breach extend beyond mere inconvenience. With personal and highly confidential information potentially circulating on the dark web, the identity of users is at risk. Murphy Law Firm recognizes the urgency of addressing these concerns and is advocating for the rights of those affected. How Can Victims Join the TRC Staffing Lawsuit? To join the lawsuit and seek potential compensation, individuals can fill out a contact form provided by Murphy Law Firm. This form requires essential details such as name, contact information, and whether a breach notification letter was received. Additionally, users can provide any relevant information regarding fraud or suspicious activity they may have experienced. For those seeking guidance or further assistance, Murphy Law Firm can be reached directly via email at abm@murphylegalfirm.com or by phone at (405) 389-4989. Protecting the rights and interests of individuals affected by the TRC Staffing data breach is important, and Murphy Law Firm represents the victims with a legal process.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for North Korean Threat ...

 Ransomware News

Microsoft has uncovered a new “FakePenny” ransomware variant being deployed by a North Korean threat actor to target organizations in the software, information technology, education and defense industrial base sectors for both espionage and monetary gains. The threat actor, which Microsoft tracks as Moonstone   show more ...  

Sleet, was first observed delivering a new custom ransomware variant in April, to an undisclosed company whose networks it compromised a couple of months earlier. The ransomware is straightforward and contains a loader and an encryptor module. North Korean threat actor groups have previously developed such custom ransomware, but “this is the first time we have observed this threat actor deploying ransomware,” the tech giant said. “Microsoft assesses that Moonstone Sleet’s objective in deploying the ransomware is financial gain, suggesting the actor conducts cyber operations for both intelligence collection and revenue generation.” FakePenny ransomware demands exorbitant ransoms, with recent demands reaching $6.6 million in Bitcoin. “This is in stark contrast to the lower ransom demands of previous North Korea ransomware attacks, like WannaCry 2.0 and H0lyGh0st,” Microsoft said. Notably, the ransom note used by FakePenny ransomware closely resembles the one employed in the infamous NotPetya ransomware attack, which is attributed to the North Korean group Seashell Blizzard. This continuity in tactics highlights the interconnected nature of North Korean cyber operations. Moonstone Sleet’s Strategy and Tradecraft Moonstone Sleet has a diverse set of operations supporting its financial and espionage objectives. This group has been observed creating fake companies, employing trojanized versions of legitimate tools, and even developing malicious games to infiltrate targets. Their ability to conduct concurrent operations and quickly evolve and adapt their techniques is notable. The threat actor, as noted earlier, has several different tradecrafts under its belt. In early August 2023, Moonstone Sleet delivered a compromised version of PuTTY, an open-source terminal emulator, through platforms like LinkedIn, Telegram, and freelancing websites. The trojanized software decrypted and executed the embedded malware when the user provided an IP and password mentioned in a text document contained in the malicious Zip file that the threat actor sent. The same technique was used by another North Korean actor Diamond Sleet. Moonstone Sleet has also targeted victims using malicious “npm” packages distributed through freelancing sites and social media. These packages often masqueraded as technical assessments, lead to additional malware downloads when executed. Since February 2024, Moonstone Sleet has also taken a different approach by using a malicious game called DeTankWar to infect devices. The group approached targets posing as a game developer or fake company, presenting the game as a blockchain project. Upon launching the game, additional malicious DLLs were loaded, executing a custom malware loader known as “YouieLoad.” This loader performs network and user discovery and browser data collection. Fake Companies and Work-for-Hire Schemes Since January 2024, Moonstone Sleet has created several fake companies, including StarGlow Ventures and C.C. Waterfall, to deceive targets. These companies posed as software development and IT service firms, often related to blockchain and AI, to establish trust and gain access to organizations. Moonstone Sleet has also pursued employment opportunities in legitimate companies, which is consistent with reports of North Korea using remote IT workers to generate revenue. Recently, U.S. charged North Korean job fraud nexus that was amassing funds to support its nuclear program. The nexus scammed more than 300 U.S. companies and accumulated at least $6.8 million. This employment tactic could also provide another avenue for gaining unauthorized access to organizations. Moonstone Sleet’s notable attacks include compromising a defense technology company to steal credentials and intellectual property and deploying ransomware against a drone technology firm. “Despite being new, Moonstone Sleet has demonstrated that it will continue to mature, develop, and evolve, and has positioned itself to be a preeminent threat actor conducting sophisticated attacks on behalf of the North Korean regime.” Defending Against Moonstone Sleet To defend against Moonstone Sleet, Microsoft recommends endpoint detection and response (EDR), implementing attack surface reduction rules to block executable content from email clients and webmail, preventing executable files from running unless they meet specific criteria, use advanced protection against ransomware, and block credential stealing from LSASS. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Shell Data Breach: H ...

 Firewall Daily

The notorious hacker group 888 has claimed responsibility for a Shell data breach targeting the British multinational oil and gas company. According to their claims, approximately 80,000 individuals could be affected by this breach across several countries, including the United States, United Kingdom, Australia,   show more ...  

France, India, Singapore, the Philippines, the Netherlands, Malaysia, and Canada. The compromised data, shared by the threat actor on a hacking forum, includes a range of sensitive information related to Australian users. The sample data contained information about shopper codes, first and last names, email addresses, contact mobile numbers, postcodes, Nectar information, site addresses, and transaction details. Notably, these transactions appear to be associated with Reddy Express (Formerly Coles Express) locations in Australia. An Alleged Claim of Shell Data Breach Surfaces [caption id="attachment_72512" align="alignnone" width="1080"] Source: Dark Web[/caption] The claims of this Shell data leak were shared on a popular hacking forum by the user Kingpin and shared glimpses into sample data allegedly related to the organization. The Cyber Express has reached out to the oil and gas company to learn more about this Shell data breach and the authenticity of the hackers over the claimed data.  However, at the time of writing this, no official statement or response has been received. This lack of confirmation leaves the claims regarding the Shell data breach unverified, although the potential implications are threatening for the customers and stakeholders associated with the organization.  Talking about the cyberattack on Shell, the hacker Kingpin states that the organization suffered a data breach in May 2024 and this data breach allegedly contained "Shopper Code, First Name, Last Name, Status, Shopper Email, Contact Mobile, Postcode, Nectar, Suburb, State, Site Address, Suburb 1, Country, Site Name, Last Login, Pay and Association Number". A Similar Incident from the Past This purported breach is not the first time Shell has been targeted by cyberattacks. In the past, the company has faced similar security incidents, including a ransomware attack and a data security incident involving Accellion’s File Transfer Appliance. These incidents highlight the persistent threat posed by cybercriminals to organizations, particularly those in the energy sector. In response to previous incidents, Shell had emphasized its commitment to cybersecurity and data privacy. The company has initiated investigations into the recent breaches and is working to address any potential risks to affected individuals and stakeholders. Additionally, Shell had previously contacted relevant regulators and authorities to ensure compliance with data protection regulations and to mitigate the impact of the previous breach. The current Shell data leak is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on this alleged Shell data breach or any official confirmation from the organization. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for RansomHub Cyberattac ...

 Firewall Daily

The RansomHub group has claimed a cyberattack on PSG BANATSKI DVOR D.O.O., a gas storage services provider based in Serbia. The claims for this RansomHub cyberattack were posted on May 28, 2024, and revealed sensitive data about the organization, targeting the security of critical infrastructure and the integrity of   show more ...  

sensitive data. According to the threat actor post, the RansomHub exfiltrated a substantial amount of data totaling 80 GB. Among the stolen information are critical files encompassing IT, Accounting, Finance, Projects, Client database (in SQL format), Budgets, Taxes, Logistics and supply chain management, Production data, HR, Legal data, KPI, and R&D documents.  Additionally, the threat actors has allegedly disabled the SCADA (Supervisory Control and Data Acquisition) systems, further exacerbating the operational impact of the attack. RansomHub Cyberattack Allegedly Targets PSG BANATSKI DVOR [caption id="attachment_72377" align="alignnone" width="612"] Source: Dark Web[/caption] The cybercriminals have set a deadline of 5 days for the potential leak of the stolen data, adding urgency to the situation. The implications of such a breach extend beyond PSG BANATSKI DVOR, affecting not only the company but also its clients and stakeholders. The Cyber Express has reached out to the Serbian gas service provider to learn more about the authenticity of this alleged PSG BANATSKI DVOR cyberattack. However, at the time of writing this, no official statement or response has been received, leaving the claims for this RansomHub cyberattack stand unconfirmed. Moreover, the PSG BANATSKI DVOR website is currently nonfunctional and is displaying a "took too long to respond" error. This error, often associated with cyberattacks, suggests disruptions in the normal functioning of the website, possibly due to overwhelming server loads or exploitation of vulnerabilities in the site's infrastructure. Threat Actor Blames Employee for the PSG BANATSKI DVOR Cyberattack Apart from allegedly claiming a cyberattack on PSG BANATSKI DVOR, the threat actor is demanding cooperation, or else they'll expose it.  “We have all the important files, such as: IT, Accounting, Finance, Projects, Client database (in SQL format) Budgets, Taxes, Logistics and supply chain management, Production data, HR, Legal data, KPI, R&D. Over 80 GB of sensational information has been downloaded”, says the hacker.  Additionally, the group blames an employee named Dejan Belić for the breach. The threat actors have previously targeted similar victims and share similarities with traditional Russian ransomware groups while refraining from targeting certain countries and non-profits. Their victims span various countries, including the US and Brazil, with healthcare institutions being particularly targeted. While major corporations haven't been hit yet, the breadth of targeted sectors is concerning.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for A Quest Gone Awry: H ...

 Cybersecurity News

Fans of Bring Me The Horizon have been fervently searching for secrets and clues hidden within an 'M8 Artificial Reality game' subtly teased in a recent music video by the band. Near the video's conclusion, a character emerges, briefly greets viewers, and then abruptly instructs them to search for a   show more ...  

specific code. Although the discovery of the hidden game thrilled many, excitement was momentarily dampened when the game's website was swapped out for a warning urging visitors not to hack into the system. Bring Me The Horizon Hidden M8 Artificial Reality Game Bring Me the Horizon, a British rock band formed in Sheffield in 2004, is celebrated for embedding hidden meanings, easter eggs, and clues in their music. With the release of their latest album, 'POST HUMAN: NeX GEn,' the band has notably deepened this practice, incorporating even more intricate layers of secrets into their songs. In one of the music videos from this album, a character named 'M8' appears and begins to greet the viewer but is abruptly stopped by a 'fatal-error'. M8 then directs the viewer to find the 'serial number' located on the side of its head. A curious listener appeared to have further analyzed the video segment in the video and discovered a hidden spectrogram containing a QR Code, sharing an image file on the rock band's subreddit. Fans further discovered that the QR code led to the URL domain of a hidden clandestine hacking-themed website, containing the M8 Artificial Reality Game. [caption id="attachment_72429" align="alignnone" width="233"] Source: /r/BringMeTheHorizon subreddit[/caption] The M8 Artificial Reality domain then instructed users to enter a hidden serial code, which fans discovered through the use of several other clues. The site contained unreleased tracks, password-protected files, and various mysteries for fans to uncover. [caption id="attachment_72432" align="alignnone" width="2800"] Source: multidimensionalnavigator8.help[/caption] As news of the hidden website spread, fans swiftly set up a dedicated Discord server and collaborated using a Google Doc to unearth all the site’s secrets. However, their excitement was brief. Hackers soon tried to extract further secrets from the website using unconventional methods, leading developers to temporarily shut down the site and issue a warning to fans. Warnings Over Hacking Attempts After the hacking attempts, cautionary messages from M8, the album's virtual guide, expressed dismay at the intrusion, stressing on how such actions undermined the spirit of collective exploration. These messages were delivered through both the website which was temporarily replaced with the warning for 2 hours as well as through email. [caption id="attachment_72445" align="alignnone" width="2800"] Source: archive.org[/caption] [caption id="attachment_72448" align="alignnone" width="276"] Source: BringMeTheHorizon ARG Discord[/caption] The developers appeared to indirectly condemn these attempts through the creative  use of the M8 character, without specifying the nature of the intrusion or identifying the perpetrators. Some fans however, upon receiving the email after their explorations, found the message warnings unexpected for what they believed were legitimate interactions. The community believed that these selective few hackers ruined the experience for others, with it's discord server noting the downtime in it's FAQ. 0 Bring Me The Horizon's foray into alternate reality gaming showcases the creative potential of digital media in music and album promotion. As fans continue to work together to unravel the remaining mysteries and solve the puzzles within the ARG, it remains to be seen what other surprises await them on the hidden website. The hacking attempts and the subsequent warnings serves as a reminder that while ARGs can be an engaging and immersive experience, it is essential to respect the developers' intentions and play fair to ensure everyone can enjoy the journey together. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Double Trouble: Foll ...

 Firewall Daily

Within a mere two-day period, two major companies have allegedly fallen victim to cyberattacks. The first incident came to light on May 27, 2024, when an individual known by the alias "SpidermanData" claimed to have infiltrated Ticketmaster Entertainment, LLC, potentially exposing sensitive data of   show more ...  

approximately 560 million users, including their card details. Hot on the heels of this breach, another hacker group, Shiny Hunters, disclosed on May 29 that they had targeted Live Nation Entertainment, Inc., the parent company of Ticketmaster. In their recent announcement, Shiny Hunters claimed to have obtained a substantial cache of data, which includes comprehensive customer profiles, details of ticket sales, and partial credit card information. They reportedly have 1.3 terabytes of this stolen data, which they are offering for sale at a price of $500,000. Notably, their disclosure also mentioned a massive database breach involving "560M Users + Card Details." This figure matches an earlier claim by "SpidermanData," who reported a similar breach at Ticketmaster Entertainment, LLC. The claims by Shiny Hunters and SpidermanData concerning the breach affecting 560 million users highlight significant security issues at Ticketmaster and Live Nation. The fact that both reports involve identical data figures raises the possibility that this could either stem from a common vulnerability in the companies’ cybersecurity frameworks or represent the same incident claimed by two different hackers.. [caption id="attachment_72309" align="aligncenter" width="1024"] Source: X[/caption] Despite these troubling claims, a review of Live Nation's official website revealed no apparent signs of disruption. The Cyber Express team contacted Live Nation for confirmation, but has not received an official response at the time of this report. Until the company confirms, the accuracy of these breach claims remains uncertain. Alleged Live Nation Entertainment Data Breach Details Customer Information: Full details including names, addresses, emails, and phone numbers. Ticket Sales and Event Data: Information about ticket purchases and event specifics. Credit Card Information: Last four digits, expiration dates, and associated customer details. Customer Fraud Details: Comprehensive data points including fraud-related information. The timing of this alleged Live Nation Entertainment data breach is particularly troubling for Ticketmaster, coinciding with a series of major music festivals scheduled between May 2024 and January 2025. Among the most anticipated events is the FOREIGNER concert tour, starting on June 11, 2024, in the United States and concluding on November 9, 2024. Other notable acts include HEART, Allison Russell, Hozier, Ian Munsick, Prateek Kuhad, and Kathleen Hanna, each set to perform across North America during the same period. The supposed breach not only threatens the security of millions of users but also casts a shadow over the festive atmosphere of these upcoming events. The cybercriminals have allegedly divided the compromised data into 15 parts, offering samples from two segments. One dataset reportedly from the ‘PATRON’ database includes extensive personal information, while the other encompasses customer sales data, detailing event IDs and payment methods. Unconfirmed Live Nation Data Breach Adds to Worry Adding to the turmoil, Ticketmaster is currently embroiled in a lawsuit filed by the U.S. Department of Justice. The lawsuit accuses the company of anti-competitive practices, including limiting venue options and threatening financial repercussions. This legal battle follows public outrage over ticketing issues during Taylor Swift’s tour, where high prices and post-pandemic demand intensified scrutiny. Live Nation denies monopolistic behavior, but the lawsuit contends their dominance drives up prices. The alleged Ticketmaster data breach poses another threat to the organization, as databases of this caliber are highly sought after on the dark web. The recent string of alleged breaches raises questions about the motives behind these cyberattacks. Whether they are tactics to gain attention or have other underlying motives, the truth will only be known once official statements are released. For now, Ticketmaster customers are advised to remain vigilant. Regular monitoring of financial accounts and immediate reporting of suspicious activities are crucial steps in mitigating potential damage. Furthermore, customers should be wary of phishing attempts and other forms of cyber fraud that often follow such breaches. As the situation unfolds, the focus remains on ensuring the security and trust of Ticketmaster’s extensive user base. The company’s response to these allegations and their ongoing legal challenges will be critical in determining its future standing in the highly competitive entertainment industry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Massive Google Leak ...

 Vulnerabilities

For over two decades, Google search rankings have functioned as the internet's invisible puppeteer, dictating which websites rise to the top of search results and influencing the online landscape in profound ways. SEO professionals have tirelessly analyzed Google's every move, piecing together cryptic clues to   show more ...  

optimize websites for coveted top rankings. But the inner workings of this algorithmic behemoth have largely remained a mystery – until now. A recent massive leak of internal Google documents has sent shockwaves through the SEO community and beyond. The trove, titled "Google API Content Warehouse" and exceeding 2,500 pages with 14,014 attributes, offers an unprecedented look at Google's search API and the intricate web of factors that influence search results. [caption id="attachment_72485" align="aligncenter" width="406"] Source: X[/caption] Google has now pulled down its documentation, which specified the parameters that the company has been using for generating and ranking Search results, after accidentally publishing it on GitHub. The American technology giant published the “Google API Content Warehouse” documentation on the GitHub platform on March 27, 2024, and pulled it back on May 7. An anonymous source, who has now revealed himself as Erfan Azimi, CEO and director of SEO for digital marketing agency EA Eagle Digital, had shared the leak with SEO veteran Rand Fishkin. It promises to be a potential goldmine of information. However, Fishkin cautioned that it's not a straightforward recipe for guaranteed SEO success. “The sheer volume of information, with some components potentially outdated, presents a complex puzzle for SEO professionals to decipher,” he cautioned. While the documents’ leak shed light on what Google might consider, they don't reveal the specific ranking hierarchy. This missing piece makes it difficult to prioritize optimization efforts and leaves room for interpretation. The leak has also ignited debate regarding Google's past pronouncements on SEO.  Fishkin suggests discrepancies between the leaked documents and previous statements from Google employees, particularly concerning "domain authority" – a website's overall ranking power. The documents seem to suggest that domain authority carries more weight than Google has publicly acknowledged. Google, as of yet, has maintained a stony silence regarding the leak's authenticity. This lack of response has fueled speculation within the SEO community. However, it's important to consider the leak within the context of Google's recent algorithmic update prioritizing "helpful content." This update reflects Google's ongoing battle against manipulative SEO tactics and its commitment to elevating content that genuinely serves user needs. Potential Implications of the Google Search Ranking Leak The ramifications of the leak extend far beyond the realm of SEO. Here are some key areas potentially impacted: Transparency and Trust: The leak raises questions about Google's transparency regarding its search algorithms. Inconsistent messaging between leaked documents and public statements can erode trust with website owners and content creators. Evolving Search Landscape: The leaked documents offer valuable insights into Google's current approach to search ranking. However, search algorithms are constantly evolving, and the information may not hold true for extended periods. The Future of SEO: While the leak provides a valuable snapshot, it shouldn't be misconstrued as a definitive SEO guide. SEO professionals still need to adapt to Google's ongoing algorithmic changes and prioritize creating high-quality content that resonates with users. Industry Buzzing with Reactions on Social Media over Google Search Algorithm There have been multiple reactions from stakeholders on social media over the leak. Rand Fishkin declared the leak the biggest ever on the mysteries of Google ranking algorithms: “In the last quarter century, no leak of this magnitude or detail has ever been reported from Google’s search division. If you're in SEO, you should probably see this.” [caption id="attachment_72507" align="aligncenter" width="723"] Source: X[/caption] iPullRank founder and CEO Mic King has acknowledged the leak as a newsworthy event but advises caution. He suggested that the leaked documents might be incomplete or outdated and may not reveal the entire picture of Google's ranking factors. He also suggested that website owners shouldn't drastically alter their SEO strategies based solely on this leak. “This leak is another indication that you should be taking in the inputs and experimenting with them to see what will work for your website. It’s not enough to look at anecdotal reviews of things and assume that’s how Google works. If your organization does not have an experimentation plan for SEO, now is a good time to start one,” he said. [caption id="attachment_72525" align="alignnone" width="741"] Source: X[/caption] SEO Consultant Aleyda Solis has raised concerns about the leak's potential to erode trust between Google and website owners. She said that transparency was a major concern in SEO, and if there were discrepancies between what Google said and what the leaked documents revealed, it could damage trust.   [caption id="attachment_72531" align="alignnone" width="678"] Source: X[/caption] Google Yet to React to Document Leak Even though this leaked data reveals the factors that Google Search might consider when ranking search results, it doesn't reveal how important each factor is or how much "weight" it carries in the final ranking decision. The data could be helpful for SEO professionals who constantly adapt their strategies to keep pace with Google Search's ranking changes and strive for higher rankings. Upon reviewing these documents, many stakeholders claimed to have found discrepancies between what Google has publicly stated about how Search works and what the leaked information suggests. Google has not yet issued a public statement regarding the leak. The company announced its most recent major Search update in March, focusing on surfacing more authentic content that is demonstrably "helpful." This update involved modifications to Google's core ranking systems to identify pages that were "created for search engines instead of people." Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for First American Data ...

 Firewall Daily

The First American Financial Corporation, one of the largest title insurance companies in the United States, revealed that a cyberattack in December 2023 exposed the personal information of around 44,000 people. The First American data breach disclosure was made in a filing with the U.S. Securities and Exchange   show more ...  

Commission (SEC) on May 28, 2024, raising serious concerns about data security at the company. The filing disclosed that attackers had breached some of First American's systems and accessed sensitive data without authorization. "As of the date of this filing, the Company’s investigation of the incident has concluded. Based upon our investigation and findings, the Company has determined that personal information pertaining to approximately 44,000 individuals may have been accessed without authorization as a result of the incident," the company stated. In response to the First American data breach, the company committed to notifying the affected individuals and providing them with credit monitoring and identity protection services at no cost. This proactive measure aims to mitigate the potential fallout for those whose data was compromised. "The Company will provide appropriate notifications to potentially affected individuals and offer those individuals credit monitoring and identity protection services at no cost to them," the company stated in filing. [caption id="attachment_72061" align="aligncenter" width="1603"] Source: SEC[/caption] First American Cyberattack: A Troubled History The December 2023 data breach occurred just a month after First American settled a significant cybersecurity incident from 2019. On November 29, 2023, the company agreed to pay a $1 million penalty to New York State for violating cybersecurity regulations. This penalty stemmed from a May 2019 breach where the company's proprietary EaglePro application exposed personal and financial data. The breach allowed unauthorized access to documents without proper authentication, exposing sensitive information from hundreds of thousands of individuals. The New York Department of Financial Services (DFS) criticized First American's security practices, noting that the company's senior management had been aware of the vulnerability in EaglePro. The DFS's findings underscored the importance of robust cybersecurity measures, especially for companies handling large volumes of personal and financial data. Industry-Wide Challenges First American is not alone in facing cybersecurity threats. In November 2023, Fidelity National Financial, another major American title insurance provider, experienced a cybersecurity incident. The cyberattack forced Fidelity to take down some of its systems to contain the breach, causing disruptions to its business operations. In January 2024, Fidelity confirmed in an SEC filing that the attackers had stolen data from approximately 1.3 million customers using non-self-propagating malware. These cybersecurity reflect a broader trend of increasing cyberattacks targeting financial institutions, emphasizing the need for enhanced cybersecurity frameworks across the industry. Title insurance companies, which handle vast amounts of sensitive information, are particularly attractive targets for cybercriminals. The Road Ahead for First American Data Breach The latest Frist American data breach marks another challenge for the company as it strives to regain trust and enhance its cybersecurity posture. The company must address both immediate and long-term security concerns to protect against future incidents. This includes investing in advanced security technologies, conducting regular security audits, and fostering a culture of cybersecurity awareness among employees. Moreover, regulatory scrutiny is likely to intensify. Financial institutions are expected to adhere to stringent cybersecurity standards, and any lapses can result in substantial penalties and reputational damage. First American's recent history indicates a pressing need for the company to strengthen its defenses and ensure compliance with all regulatory requirements. Customer Impact and Response For the 44,000 individuals affected by the December 2023 Frist American data breach, offer of free credit monitoring and identity protection services is a critical step. These services can help detect and prevent potential misuse of their personal information. However, the emotional and psychological impact of knowing their data has been compromised cannot be understated. Customers should remain vigilant, monitoring their financial accounts for any suspicious activity and taking advantage of the protection services offered by First American. Additionally, they should be aware of phishing attempts and other forms of cyber fraud that often follow such breaches. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Suspected Cyberattac ...

 Firewall Daily

A cybersecurity threat has surfaced targeting DU Emirates Integrated Telecommunications Corporation, a major telecom provider in the UAE. On the XSS Forum, a cybercriminal known as "Ddarknotevil" has claimed to have stolen over 360 GB of data from DU. The alleged DU Emirates data breach reportedly includes   show more ...  

sensitive information such as employee email addresses, network logs, details of 371,000 customers' devices, IP addresses, and proprietary telecommunication software. To substantiate these claims, Ddarknotevil shared sample records, including customers' device details and excerpts from email content purportedly obtained from an employee's mailbox. The threat actor is offering this entire database as a one-time purchase for USD 3,200. This development follows previous activity on May 19, 2024, where Ddarknotevil was seen privately offering unauthorized FTP access to DU's systems. Despite the claims of DU Emirates data breach, a visit to DU's official website revealed no signs of disruption; the website was fully operational. The Cyber Express team has reached out to DU officials for verification, but as of this report, no official response has been received, leaving the DU Emirates data breach claim unverified. Context of Recent Cyber Threats in the Telecom Sector The alleged data breach of DU Emirates comes on the heels of several high-profile cyberattacks within the telecommunications sector. In February 2024, ETISALAT, the state-owned Emirates Telecommunications Group Company PJSC in the UAE, reportedly suffered a ransomware attack attributed to the infamous LockBit ransomware faction. LockBit claimed to have successfully breached ETISALAT's systems and demanded $100,000 for the return of the stolen data, setting a deadline of April 17th. This claim, too, remains unverified. Adding to the urgency of these developments, Spain-based mobile telephony company Llamaya, a subsidiary of the MASMOVIL Group, reported a significant data breach just days before the purported ETISALAT attack. A threat actor known as “DNI” claimed to have accessed sensitive customer information, including phone numbers, passwords, and personal details, affecting approximately 16,825 customers. These incidents highlight a disturbing trend of cyber threats targeting the telecommunications sector globally. Mobile operators are increasingly vulnerable to sophisticated cyberattacks, as evidenced by recent incidents involving Monobank in Ukraine and a popular mobile banking app with over 10 million users. These alleged cyberattacks highlight the critical need for robust cybersecurity measures to protect digital infrastructure. Implications of the Alleged DU Emirates Data Breach If the claims by Ddarknotevil are confirmed, the implications for DU Emirates Integrated Telecommunications Corporation and its customers could be severe. The compromised data includes not only customer information but also critical network logs and proprietary software, potentially exposing the company to various risks: Customer Data Exposure: The breach of 371,000 customers' device details, including IP addresses, could lead to significant privacy violations. Customers may face increased risks of identity theft, phishing attacks, and other forms of cyber fraud. Operational Disruptions: Access to network logs and proprietary software could allow cybercriminals to exploit vulnerabilities within DU’s systems, potentially disrupting services and causing widespread operational issues. Reputation Damage: A confirmed breach of this magnitude would severely damage DU’s reputation, leading to a loss of customer trust and potentially impacting the company’s market position. Financial Losses: Beyond the immediate costs of responding to the breach, DU could face significant financial losses from potential lawsuits, regulatory fines, and a decline in customer base. National Security Concerns: Given DU's prominence in the UAE’s telecommunications landscape, a breach could have broader national security implications, especially if critical communication infrastructure is affected. Broader Industry Implications The surge in cyberattacks on telecom operators signals a pressing need for the industry to enhance its cybersecurity defenses. The trend underlines the vulnerabilities inherent in the digital infrastructure that supports critical communication services. Telecommunications companies must invest in advanced security technologies, conduct regular security audits, and foster a culture of cybersecurity awareness among employees to mitigate these threats. Moreover, collaboration with government agencies and international cybersecurity organizations can help telecom operators stay ahead of emerging threats. Sharing intelligence and best practices can enhance the overall resilience of the telecommunications sector. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for BSNL Database on Sal ...

 Firewall Daily

Bharat Sanchar Nigam Limited (BSNL), a prominent Indian telecommunications company, has once again found itself at the center of a massive data security breach. The BSNL data breach, orchestrated by a threat actor known as kiberphant0m, shares sensitive data about the organization, highlighting the vulnerability of   show more ...  

sensitive information. The claim for the BSNL data leak emerged on May 27, 2024, revealing that kiberphant0m was offering unauthorized access to databases stolen from BSNL, along with data from undisclosed Asian telecom organizations. Among the compromised data are IMSI records, SIM details, home location register (HLR) data, DP security key data, and a snapshot of the Oracle Solaris server.  Additionally, the threat actor claimed to possess login credentials for various digital infrastructures and applications of BSNL. A Massive BSNL Data Breach Surfaces on Dark Web The BSNL data leak poses a severe threat to the privacy and security of BSNL customers and highlights the potential risks associated with cyberattacks on telecom infrastructure. The stolen data, advertised for sale on underground forums like XSS and Telegram, could fetch significant sums on the black market, highlighting the lucrative nature of cybercrime. [caption id="attachment_72569" align="alignnone" width="1080"] Source: Dark Web[/caption] The major concern for this BSNL data leak is the inclusion of sensitive customer information, which, if exploited, could lead to identity theft, financial fraud, and other malicious activities. The urgency of the situation is further emphasized by kiberphant0m's warning to potential buyers and Indian authorities, suggesting that the data could be sold to other parties if not addressed promptly. “India if you want to secure your data and do not want it to be sold you must buy it first, contact me BEFORE someone purchases this data. It could be 3 hours to 24 hours, who knows”, says the hacker.  Big Threats, Yet No Response  Despite the gravity of the situation, BSNL has yet to issue an official statement or response regarding the breach, leaving the claims unverified. This lack of transparency further compounds the uncertainty surrounding the extent of the breach and the measures being taken to mitigate its impact. Talking about the BSNL data breach, the threat actor says, “This is not the same data as the previous telecom post! we have breached over 15 Asian telecoms! Information is worth several million dollars but I'm selling for pretty cheap. Negotiate a deal on telegram. State Threat Actors are also welcome to buy this data, I will sell to anyone who wants it.” Moreover, this incident is not the first time BSNL has faced cybersecurity challenges. In 2023, the company experienced a massive data breach affecting over 2.9 million lines, with leaked data of landline users being sold on the dark web by a hacker known as 'Perell.' The recurrence of such breaches highlights the rise of cyberattacks on telecom companies, especially those located in Asia.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for BreachForums Breache ...

 Cybersecurity News

Following the seizure of the BreachForums domain and the arrest of Baphomet, its new owner ShinyHunters seems to have fully regained control over the site after a recent announcement that the forum will be open for account registration. While the domain itself appeared to have been seized back from law enforcement,   show more ...  

the site remained dysfunctional for a while as staff redirected visitors to a new Telegram channel. The site slowly resumed operations while initially disabling account registration. However, the arrests and law enforcement activity connected to the operation of the domain, as well as its quick return to operations, have led cybercriminals to fear possible compromise of the forum infrastructure by law enforcement. BreachForums Seizure and Return BreachForums, widely recognized as the successor to RaidForums, has faced several downtimes, seizures and disruptions in its eventful history. The original owner, Conor Brian Fitzpatrick AKA "Pompompurin," was arrested last year on cybercrime and device fraud charges. BreachForums administrator "Baphomet" announced that he would step in as successor and opened a new domain to resume forum activity. However, Baphomet himself feared site compromise by law enforcement and temporarily shut down the forums, expressing that "nothing is safe anymore." [caption id="attachment_72568" align="alignnone" width="1536"] Source: Cyble[/caption] However, Baphomet later announced that he would be working on a new domain and resuming forum operations. The forum soon returned with regular facilitation of data leak sharing and discussion. A year later, Baphomet himself faced arrest after a joint operation from law enforcement, which also seized the BreachForums domain and official Telegram channel. The administrator ShinyHunters emerged as the successor, confirming Baphomet's arrest. However, the domain seizure was short-lived, and was soon redirecting users to a new Telegram channel. An allegedly leaked conversation from an FBI operative to BreachForum's previous domain name registrar and hosting provider NiceNic also appeared to indicate that ShinyHunters had regained control over domain ownership despite its court-ordered seizure. [caption id="attachment_72579" align="alignnone" width="326"] Source: Telegram[/caption] After a period of dysfunction, BreachForums has now resumed operations, with threat actors already claiming new victims on its forum postings. Emerging Alternatives and Criminal Suspicion Over BreachForums In the wake of the recent seizure, several other individuals expressed their doubts over BreachForums and its possible usage as a "honeypot" by law enforcement to entrap cybercriminals and disrupt operations. The owner of Secretforums and former owner of Blackforums expressed his belief over Telegram that Baphomet was possibly an informant to law enforcement, citing the latter's interest in maintaining the infrastructure of Blackforums. Prominent threat actor USDoD also cast doubt over the succession of BreachForums to the administrator Shiny Hunters, citing his low stats on the previous domain. These concerns were followed by the self-promotion of SecretForum's and USDoD's announced project "Breach Nation" as possible alternatives. More recently, the CyberNi***rs threat actor group also announced its intention to start a new site to coordinate its operations. Despite these activities and the surrounding suspicion, new owner Shiny Hunters seems eager to return to earlier activities and operations, as judged by their claim of responsibility for an attack impacting Live Nation Entertainment Inc., the parent company of Ticketmaster. The results of these events, their effect on the cybercriminal ecosystem, as well as the viability of emerging forums as alternatives to the relaunched BreachForums led by ShinyHunters, remain unclear. But given how vocal the participants are, the picture will almost certainly get clearer with time. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for 911 S5 Botnet — Li ...

 Firewall Daily

The FBI, in collaboration with international partners, has successfully dismantled the 911 S5 botnet's massive network that infected over 19 million IP addresses across 200 countries and facilitated several cybercriminal activities, including cyberattacks, financial frauds, identity theft, and child exploitation.   show more ...  

In addition to the infrastructural takedown of the 911 S5 botnet, Chinese national YunHe Wang, the alleged administrator of the botnet, was also arrested on May 24, U.S. Attorney General Merrick Garland said in a Wednesday press briefing. “Working with our international partners, the FBI conducted a joint, sequenced cyber operation to dismantle the 911 S5 Botnet—likely the world’s largest botnet ever,” said FBI Director Christopher Wray. “We arrested its administrator, Yunhe Wang, seized infrastructure and assets, and levied sanctions against Wang and his co-conspirators,” Wray added. Wang and two of his associates, along with three Thailand-based businesses linked to the botnet, were sanctioned by the U.S. Treasury Department on Tuesday. Wang faces up to 65 years in prison on charges that include computer fraud, wire fraud, and money laundering. 911 S5 Botnet Operations Beginning in 2014, Wang allegedly developed and distributed malware that compromised millions of Windows operating systems worldwide, including over 600,000 IP addresses in the U.S. Wang allegedly spread malware through malicious VPN programs like MaskVPN and DewVPN, as well as through pirated software bundled with malware. Wang managed and controlled approximately 150 dedicated servers worldwide. “Using the dedicated servers, Wang was able to deploy and manage applications, command and control the infected devices, operate his 911 S5 service and provide to paying customers access to the proxied IP addresses associated with the infected devices,” Wang's indictment said. The residential proxy service that Wang developed and operated allowed subscribers to access the more than 19 million compromised IP addresses, which helped them mask their online activities. This service generated approximately $99 million for Wang. The 911 S5 botnet facilitated a range of cybercrimes, including cyberattacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations, Garland said. One such example is that of customers using the botnet's services for fraudulently filing 560,000 unemployment insurance claims that resulted in a confirmed loss of $5.9 billion from federal pandemic relief programs. In another instance, the 911 S5 botnet customers used the service to file more than 47,000 Economic Injury Disaster Loan applications, which again resulted in the loss of millions of dollars. Infrastructure and Assets Seized Authorities seized 23 internet domains and more than 70 servers, which formed the core of the 911 S5 botnet and its successor services. This action effectively shut down the botnet and prevented Wang from reconstituting the service under a new name, Clourouter.io. The U.S. Department of Justice emphasized that this seizure closed existing malicious backdoors used by the botnet. Wang allegedly used the proceeds from the botnet to purchase properties across the globe, including the U.S., China, Singapore, Thailand, the United Arab Emirates, and St. Kitts and Nevis, where he also holds a citizenship. Authorities have moved to forfeit his assets, which include 21 properties and a collection of luxury cars such as a Ferrari F8, several BMWs, and a Rolls Royce. Investigation Triggered by Ecommerce Incident The investigation into the 911 S5 botnet was initiated following a probe into more than 2,000 fraudulent orders placed with stolen credit cards on ShopMyExchange, an e-commerce platform linked to the Army and Air Force Exchange Service. The perpetrators in Ghana and the U.S. were found to be using IP addresses acquired from 911 S5. “Although approximately 2,525 fraudulent orders valued at $5.5 million were submitted, credit card fraud detection systems and federal investigators were able to thwart the bulk of the attempted purchases, reducing the actual loss to approximately $254,000,“ the Justice Department said. The latest takedown is part of a broader effort of the Justice Department to combat nation-state hacking and international cybercrime. At the beginning of the year, the Justice Department dismantled botnets linked to the China-affiliated hacking group Volt Typhoon, followed by the disruption of botnet controlled by the Russian APT28 group associated with the Russian military intelligence, the GRU. Google-owned cybersecurity firm Mandiant also warned last week that Chinese state hackers are increasingly using vast proxy server networks, built from compromised online devices and virtual private servers, to evade detection during their cyberespionage campaigns. Garland highlighted the global collaboration in this operation, underscoring the Justice Department's commitment to disrupting cybercrime networks that pose a significant threat to individuals and national security. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for U.S. Treasury Sancti ...

 Cybersecurity News

The U.S. Treasury Department sanctioned three Chinese nationals on Tuesday for their alleged involvement in operating the 911 S5 proxy botnet widely used for fraudulent activities, including credit card theft and Coronavirus Aid, Relief, and Economic Security program frauds. The sanctions are aimed at curbing the   show more ...  

operations linked to the botnet, which caused major financial losses amounting to "billions" of dollars to the U.S. government. The Rise and Demise of 911 S5 Botnet The botnet in question played a critical role in executing numerous fraudulent schemes through stolen residential IP addresses. "The 911 S5 botnet compromised approximately 19 million IP addresses and facilitated the submission of tens of thousands of fraudulent applications related to the Coronavirus Aid, Relief, and Economic Security Act programs by its users, resulting in the loss of billions of dollars to the U.S. government." 911 S5 is a residential proxy botnet that allows its paying users, often cybercriminals, to select the IP addresses they can use to connect to the internet using intermediary, internet-connected computers that have been compromised without the computer owners’ knowledge. 911 S5 essentially enables cybercriminals to conceal their originating location, effectively defeating fraud detection systems, the U.S. Treasury explained. The 911 S5 botnet was also implicated in a series of bomb threats made in July 2022, according to the Treasury. Investigators found links of IP addresses within the proxy botnet network being used in this incident. The network was connected to 911 S5, a residential proxy service that allowed users to mask their IP addresses by routing their web activity through compromised devices. The 911 S5 service went offline in July 2022, following a purported hacking incident that damaged essential data. The disruption was reported by independent journalist Brian Krebs. Despite its shutdown, the impacts of its previous operations continued to reverberate, leading to the current sanctions. The Individuals and Businesses Sanctioned The sanctioned individuals include Yunhe Wang, allegedly the administrator of the botnet; Jingping Liu, accused of laundering proceeds for Wang; and Yanni Zheng, who reportedly acted as power of attorney for Wang and facilitated business transactions on his behalf through the company Spicy Code Company Limited. The men are believed to reside in Singapore and Thailand, countries that were acknowledged as partners in the sanctions announcement. Three businesses registered in Thailand were also sanctioned for their connections to Wang. These sanctions require that any property and interests owned by the three men within the U.S. be reported to the Treasury, and prohibit U.S. citizens or residents from engaging in business with them. Only these three individuals and the businesses implicated in their fraudulent schemes were sanctioned by the Treasury, but no indictments or legal actions were revealed by the U.S. Department of Justice (DOJ), as is the case in many other instances. Broader Ongoing Cybersecurity Concerns The sanctions against these individuals are part of a broader effort by the U.S. government to address cybersecurity threats linked to state-sponsored hacking groups. Google-owned cybersecurity firm Mandiant warned last week that Chinese state hackers are increasingly using vast proxy server networks, built from compromised online devices and virtual private servers, to evade detection during their cyberespionage campaigns. In January, the DOJ announced the takedown of a botnet associated with Volt Typhoon, a hacking group with ties to the Chinese government. This group was known for infecting home and office routers with malware to obscure its hacking activities. The concerted actions by U.S. authorities and private defenders highlight the ongoing challenges and complexities in combating cybercrime and protecting critical financial and infrastructural systems from sophisticated malicious actors. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for The most dangerous C ...

 Business

The number of software vulnerabilities discovered annually continues to grow, with total vulnerabilities discovered in a year fast approaching the 30,000 mark. But its important for cybersecurity teams to identify precisely which vulnerabilities attackers are actually exploiting. Changes in the list of criminals   show more ...  

favorite vulnerabilities greatly influence which updates or countermeasures should be prioritized. Thats why we regularly monitor these changes. Thus, here are the conclusions that can be drawn from our Exploit and Vulnerability Report for Q1 2024. Vulnerabilities are becoming increasingly critical; exploits — easily available Thanks to bug bounty programs and automation, vulnerability hunting has increased significantly in scale. This means vulnerabilities are discovered more frequently, and when researchers find an interesting attack vector, the first identified vulnerability is often followed by a whole series of others — as we recently saw with Ivanti solutions. 2023 set a five-year record for the number of critical vulnerabilities found. At the same time, vulnerabilities are becoming increasingly accessible to an ever-wider range of attackers and defenders — for more than 12% of discovered vulnerabilities proofs of concept (PoC) became publicly available shortly after. Exponential growth of Linux threats Although the myth that no one attacks Linux has already been dispelled, many specialists still underestimate the scale of Linux threats. Over the last year, the number of exploited CVEs in Linux and popular Linux applications increased more than threefold. The lions share of exploitation attempts target servers, as well as various devices based on *nix systems. A striking example of the interest of attackers in Linux was the multi-year operation to compromise the XZ library and utilities in order to create an SSH backdoor in popular Linux distributions. OSs contain more critical flaws, but other applications are exploited more often Operating systems were found to contain the most critical vulnerabilities with available exploits; however,  critical defects in OSs are rarely useful for initially penetrating an organizations information infrastructure. Therefore, if you look at the top vulnerabilities actually exploited in APT cyberattacks, the picture changes significantly. In 2023, the top spot in the exploited vulnerabilities list changed: after many years of its being MS Office, WinRAR took its place with CVE-2023-38831 — used by many espionage and criminal groups to deliver malware. However, the second, third, and fifth places in 2023 were still occupied by Office flaws, with the infamous Log4shell joining them in fourth place. Two vulnerabilities in MS Exchange were also among the most frequently exploited. In first quarter of 2024, the situation has changed completely: very convenient security holes in internet-accessible services have opened up for attackers, allowing mass exploitation — namely in the MSP application ConnectWise, and also Ivantis Connect Secure and Policy Secure. In the popularity ranking, WinRAR has dropped to third place, and Office has disappeared from the top altogether. Organizations are too slow in patching Only three vulnerabilities from the top 10 last year were discovered in 2023. The rest of the actively exploited CVEs date back to 2022, 2020, and even 2017. This means that a significant number of companies either selectively update their IT systems or leave some issues unaddressed for several years without applying countermeasures at all. IT departments can rarely allocate enough resources to patch everything on time, so a smart medium-term solution is to invest in products for automatic detection of vulnerable objects in IT infrastructure and software updating. The first weeks after a vulnerability is publicly disclosed are the most critical Attackers try to take full advantage of newly published vulnerabilities, so the first weeks after an exploit appears see the most activity. This should be considered when planning update cycles. Its essential to have a response plan in case a critical vulnerability appears that directly affects your IT infrastructure and requires immediate patching. Of course, the automation tools mentioned above greatly assist in this. New attack vectors You cant focus only on office applications and peripheral services. Depending on an organizations IT infrastructure, significant risks can arise from the exploitation of other vectors — less popular but very effective for achieving specific malicious goals. Besides the already mentioned CVE-2024-3094 in XZ Utils, other vulnerabilities of interest to attackers include CVE-2024-21626 in runc — allowing escape from a container, and CVE-2024-27198 in the CI/CD tool TeamCity — providing access to software developer systems. Protection recommendations Maintain an up-to-date and in-depth understanding of the companys IT assets, keeping detailed records of existing servers, services, accounts, and applications. Implement an update management system that ensures the prompt identification of vulnerable software and patching. The Kaspersky Vulnerability Assessment and Patch Management solution combined with the Kaspersky Vulnerability Data Feed is ideal for this. Use security solutions capable of both preventing the launch of malware and detecting and stopping attempts to exploit known vulnerabilities on all computers and servers in your organization. Implement a comprehensive multi-level protection system that can detect anomalies in the infrastructure and targeted attacks on your organization, including attempts to exploit vulnerabilities and the use of legitimate software by attackers. For this, the Kaspersky Symphony solution, which can be adapted to the needs of companies of varying size, is perfectly suited.

image for Is Your Computer Par ...

 Other

The U.S. Department of Justice (DOJ) today said they arrested the alleged operator of 911 S5, a ten-year-old online anonymity service that was powered by what the director of the FBI called “likely the world’s largest botnet ever.” The arrest coincided with the seizure of the 911 S5 website and   show more ...  

supporting infrastructure, which the government says turned computers running various “free VPN” products into Internet traffic relays that facilitated billions of dollars in online fraud and cybercrime. The Cloud Router homepage, which was seized by the FBI this past weekend. Cloud Router was previously called 911 S5. On May 24, authorities in Singapore arrested the alleged creator and operator of 911 S5, a 35-year-old Chinese national named YunHe Wang. In a statement on his arrest today, the DOJ said 911 S5 enabled cybercriminals to bypass financial fraud detection systems and steal billions of dollars from financial institutions, credit card issuers, and federal lending programs. For example, the government estimates that 560,000 fraudulent unemployment insurance claims originated from compromised Internet addresses, resulting in a confirmed fraudulent loss exceeding $5.9 billion. “Additionally, in evaluating suspected fraud loss to the Economic Injury Disaster Loan (EIDL) program, the United States estimates that more than 47,000 EIDL applications originated from IP addresses compromised by 911 S5,” the DOJ wrote. “Millions of dollars more were similarly identified by financial institutions in the United States as loss originating from IP addresses compromised by 911 S5.” From 2015 to July 2022, 911 S5 sold access to hundreds of thousands of Microsoft Windows computers daily, as “proxies” that allowed customers to route their Internet traffic through PCs in virtually any country or city around the globe — but predominantly in the United States. 911 S5 built its proxy network mainly by offering “free” virtual private networking (VPN) services. 911’s VPN performed largely as advertised for the user — allowing them to surf the web anonymously — but it also quietly turned the user’s computer into a traffic relay for paying 911 S5 customers. 911 S5’s reliability and extremely low prices quickly made it one of the most popular services among denizens of the cybercrime underground, and the service became almost shorthand for connecting to that “last mile” of cybercrime. Namely, the ability to route one’s malicious traffic through a computer that is geographically close to the consumer whose stolen credit card is about to be used, or whose bank account is about to be emptied. The prices page for 911 S5, circa July 2022. $28 would let users cycle through 150 proxies on this popular service. KrebsOnSecurity first identified Mr. Wang as the proprietor of the popular service in a deep dive on 911 S5 published in July 2022. That story showed that 911 S5 had a history of paying people to install its software by secretly bundling it with other software — including fake security updates for common programs like Flash Player, and “cracked” or pirated commercial software distributed on file-sharing networks. Ten days later, 911 S5 closed up shop, claiming it had been hacked. But experts soon tracked the reemergence of the proxy network by another name: Cloud Router. The announcement of Wang’s arrest came less than 24 hours after the U.S. Department of the Treasury sanctioned Wang and two associates, as well as several companies the men allegedly used to launder the nearly $100 million in proceeds from 911 S5 and Cloud Router customers. Cloud Router’s homepage now features a notice saying the domain has been seized by the U.S. government. In addition, the DOJ says it worked with authorities in Singapore, Thailand and Germany to search residences tied to the defendant, and seized approximately $30 million in assets. The Cloud Router homepage now features a seizure notice from the FBI in multiple languages. Those assets included a 2022 Ferrari F8 Spider S-A, a BMW i8, a BMW X7 M50d, a Rolls Royce, more than a dozen domestic and international bank accounts, over two dozen cryptocurrency wallets, several luxury wristwatches, and 21 residential or investment properties. The government says Wang is charged with conspiracy to commit computer fraud, substantive computer fraud, conspiracy to commit wire fraud, and conspiracy to commit money laundering. If convicted on all counts, he faces a maximum penalty of 65 years in prison. Brett Leatherman, deputy assistant director of the FBI’s Cyber Division, said the DOJ is working with the Singaporean government on extraditing Wang to face charges in the United States. Leatherman encouraged Internet users to visit a new FBI webpage that can help people determine whether their computers may be part of the 911 S5 botnet, which the government says spanned more than 19 million individual computers in at least 190 countries. Leatherman said 911 S5 and Cloud Router used several “free VPN” brands to lure consumers into installing the proxy service, including MaskVPN, DewVPN, PaladinVPN, Proxygate, Shield VPN, and ShineVPN. “American citizens who didn’t know that their IP space was being utilized to attack US businesses or defraud the U.S. government, they were unaware,” Leatherman said. “But these kind of operations breed that awareness.”

image for Why CVEs Are an Ince ...

 Feed

It's time to rethink the pivotal role incentives play in shaping behavior to find and disclose software vulnerabilities. More accurate guidance to reflect real-world risks and a tiered verification process to establish potential impact could slow misleading submissions.

 Feed

Ubuntu Security Notice 6797-1 - It was discovered that some 3rd and 4th Generation Intel® Xeon® Processors did not properly restrict access to certain hardware features when using Intel® SGX or Intel® TDX. This may allow a privileged local user to potentially further escalate their privileges on the system. This   show more ...  

issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS. It was discovered that some Intel® Atom® Processors did not properly clear register state when performing various operations. A local attacker could use this to obtain sensitive information via a transient execution attack. This issue only affected Ubuntu 23.10, Ubuntu 22.04 LTS, Ubuntu 20.04 LTS, Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.

 Feed

Ubuntu Security Notice 6787-1 - It was discovered that Jinja2 incorrectly handled certain HTML attributes that were accepted by the xmlattr filter. An attacker could use this issue to inject arbitrary HTML attribute keys and values to potentially execute a cross-site scripting attack.

 Feed

Ubuntu Security Notice 6779-2 - USN-6779-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these   show more ...  

to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. Jan-Ivar Bruaroey discovered that Firefox did not properly manage memory when audio input connected with multiple consumers. An attacker could potentially exploit this issue to cause a denial of service, or execute arbitrary code. Thomas Rinsma discovered that Firefox did not properly handle type check when handling fonts in PDF.js. An attacker could potentially exploit this issue to execute arbitrary javascript code in PDF.js. Irvan Kurniawan discovered that Firefox did not properly handle certain font styles when saving a page to PDF. An attacker could potentially exploit this issue to cause a denial of service.

 Feed

GRR Rapid Response is an incident response framework focused on remote live forensics. The goal of GRR is to support forensics and investigations in a fast, scalable manner to allow analysts to quickly triage attacks and perform analysis remotely. GRR consists of 2 parts: client and server. GRR client is deployed on   show more ...  

systems that one might want to investigate. On every such system, once deployed, GRR client periodically polls GRR frontend servers for work. "Work" means running a specific action: downloading file, listing a directory, etc. GRR server infrastructure consists of several components (frontends, workers, UI servers) and provides web-based graphical user interface and an API endpoint that allows analysts to schedule actions on clients and view and process collected data.

 Feed

Ubuntu Security Notice 6795-1 - Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux kernel contained a race condition during device removal, leading to a use- after-free vulnerability. A physically proximate attacker could possibly use this to cause a denial of service. It was discovered that the   show more ...  

Open vSwitch implementation in the Linux kernel could overflow its stack during recursive action operations under certain conditions. A local attacker could use this to cause a denial of service.

 Feed

jSQL Injection is a lightweight application used to find database information from a distant server. jSQL Injection is also part of the official penetration testing distribution Kali Linux and is included in various other distributions like Pentest Box, Parrot Security OS, ArchStrike and BlackArch Linux. This is the source code release.

 Feed

Ubuntu Security Notice 6794-1 - It was discovered that FRR incorrectly handled certain malformed BGP and OSPF packets. A remote attacker could use this issue to cause FRR to crash, resulting in a denial of service, or possibly execute arbitrary code.

 Feed

Red Hat Security Advisory 2024-3464-03 - An update for glibc is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support. Issues addressed include buffer overflow, code execution, null pointer, and out of bounds write vulnerabilities.

 Feed

Red Hat Security Advisory 2024-3426-03 - An update for the varnish:6 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Issues addressed include a denial of service vulnerability.

 Feed

Red Hat Security Advisory 2024-3423-03 - An update for glibc is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Issues addressed include buffer overflow, null pointer, and out of bounds write vulnerabilities.

 Feed

The online criminal bazaar BreachForums has been resurrected merely two weeks after a U.S.-led coordinated law enforcement action dismantled and seized control of its infrastructure. Cybersecurity researchers and dark web trackers Brett Callow, Dark Web Informer, and FalconFeeds revealed the site's online return at breachforums[.]st – one of the dismantled sites – by a user named ShinyHunters,

 Feed

The U.S. Department of Justice (DoJ) has sentenced a 31-year-old man to 10 years in prison for laundering more than $4.5 million through business email compromise (BEC) schemes and romance scams. Malachi Mullings, 31, of Sandy Springs, Georgia pleaded guilty to the money laundering offenses in January 2023. According to court documents, Mullings is said to have opened 20 bank accounts in the

 Feed

A recent study by Wing Security found that 63% of businesses may have former employees with access to organizational data, and that automating SaaS Security can help mitigate offboarding risks.  Employee offboarding is typically seen as a routine administrative task, but it can pose substantial security risks, if not handled correctly. Failing to quickly and thoroughly remove access for

 Feed

A never-before-seen North Korean threat actor codenamed Moonstone Sleet has been attributed as behind cyber attacks targeting individuals and organizations in the software and information technology, education, and defense industrial base sectors with ransomware and bespoke malware previously associated with the infamous Lazarus Group. "Moonstone Sleet is observed to set up fake companies and

 Feed

Cybersecurity researchers have warned of a new malicious Python package that has been discovered in the Python Package Index (PyPI) repository to facilitate cryptocurrency theft as part of a broader campaign. The package in question is pytoileur, which has been downloaded 316 times as of writing. Interestingly, the package author, who goes by the name PhilipsPY, has uploaded a new version of the

 Feed

Check Point is warning of a zero-day vulnerability in its Network Security gateway products that threat actors have exploited in the wild. Tracked as CVE-2024-24919, the issue impacts CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark appliances. "The vulnerability potentially allows an attacker to read certain information on

 Feed

Brazilian banking institutions are the target of a new campaign that distributes a custom variant of the Windows-based AllaKore remote access trojan (RAT) called AllaSenha. The malware is "specifically aimed at stealing credentials that are required to access Brazilian bank accounts, [and] leverages Azure cloud as command-and-control (C2) infrastructure," French cybersecurity company HarfangLab

2024-05
Aggregator history
Wednesday, May 29
WED
THU
FRI
SAT
SUN
MON
TUE
MayJuneJuly