Oktacron - Cyber Security RSS Feeds History

Former Polish Deputy Minister Charged with Misuse of Funds to Buy Pegasus Spyware

cyberexpress Aug 31, 2024 Cybersecurity News

From refusing to cooperate with spyware abuse investigations to cracking down on its blatant misuse, Poland has come a full circle. The Polish prosecutor's office has charged Michał Woś, a former Deputy Minister of Justice, with exceeding his powers and failing to fulfill his obligations. The charges stem from show more ...

the unauthorized transfer of PLN 25 million [approximately US$6.45 million] from the Justice Fund to purchase the controversial Pegasus spyware for the Central Anticorruption Bureau (CBA). The Polish parliament in June voted to lift Woś’s legal immunity in order to prosecute him for the part he allegedly played in buying the commercial spyware when in power. Five-Year Surveillance History of Pegasus Spyware The prosecutor's office in April revealed that the government led by the conservative Law and Justice Party targeted nearly 600 people for Pegasus surveillance between 2017 and 2022. The investigation was first opened based on a Citizen Lab investigation from 2021 that determined Pegasus had infected the phone of Krzysztof Brejza, a member of the European Parliament for Poland. Brejza was an opposition figure at the time of infection in 2019. Text messages from his phone were doctored and then leaked. The prosecutor's investigation into irregularities within the Justice Fund uncovered evidence implicating Woś in the illicit transfer. The Sejm, Poland's lower house of parliament, voted unanimously to allow criminal proceedings against him following a request from the Prosecutor General. Woś is accused of abusing his authority by ordering the Justice Fund to pay the CBA the hefty sum for the Pegasus spyware, despite knowing that the agency did not meet the necessary criteria for receiving such funding. The Justice Fund is typically reserved for supporting other entities, and its resources cannot be used to directly finance the CBA's activities, which are primarily funded through the state budget. Possible 10-Year Sentence for Polish Official The prosecutor argues that Woś's actions caused significant financial damage to the Polish Treasury and undermined the public interest. The crime he is charged with carries a potential prison sentence of up to 10 years. The prosecutor's office has gathered substantial evidence to support the charges, including documents from the Ministry of Justice and the CBA, as well as findings from the Supreme Audit Office and the Chief Advocate for Public Finance Discipline. These materials clearly demonstrate that the Justice Fund could not legally transfer funds to the CBA for the purchase of Pegasus, the prosecutor's office said. After being charged, Woś appeared before the prosecutor and provided explanations for his actions. However, he did not admit to the crime he is accused of. To ensure that the legal proceedings move smoothly, the prosecutor has imposed a preventive measure on Woś, requiring him to report to the police twice a month and prohibiting him from contacting certain individuals involved in the case. Woś has the right to appeal this decision. The new administration in Poland has also recently signed a Biden administration pledge to counter the proliferation and misuse of spyware.

Researchers Track ManticoraLoader Malware to Ares Malware Developer

cyberexpress Aug 31, 2024 Cybersecurity News

ManticoraLoader, a new malware-as-a-service (MaaS), was observed on the cybercriminal XSS forum being distributed by 'DarkBLUP,' an alias that was previously used to distribute malware from the DeadXInject group such as the still-active AresLoader malware and the AiDLocker ransomware. The new malware variant show more ...

has been offered by DeadXInject on its Telegram channel since around August 8, 2024. ManticoraLoader Employs Stealth and Obfuscation ManticoraLoader boasts an impressive array of features that make it a versatile and potent tool for cybercriminal operations. Researchers from CRIL (Cyble Research and Intelligence Labs) indicated that the malware is compatible with Windows 7 and later versions, including Windows Server, allowing it to target a wide range of systems still in use today. [caption id="attachment_88691" align="alignnone" width="940"] Source: Cyble Blog[/caption] One of its key features is a module designed to gather extensive information from infected devices, including IP address, username, system language, installed antivirus software, UUID, and date-time stamps. This detailed reconnaissance data is then transmitted back to a centralized control panel, enabling the threat actors to profile victims and tailor their attacks accordingly. [caption id="attachment_88692" align="alignnone" width="940"] Source: Cyble Blog[/caption] The loader's modular design allows for easy extension of functionalities upon request, making it adaptable to various malicious objectives. ManticoraLoader also employs sophisticated obfuscation techniques to evade detection, with a reported detection rate of 0/39 on Kleenscan. To further demonstrate its evasive capabilities, the actors posted a video showcasing the loader's ability to bypass the 360 Total Security sandboxing solution. The threat actors have also designed ManticoraLoader with persistence in mind, as it can reportedly place files into auto-start locations, ensuring its continued presence on compromised systems. This modular design also allows for easy expansion of functionalities, making the loader adaptable to various malicious objectives. The threat actors behind ManticoraLoader have implemented a strict transaction process, limiting the number of clients to 10 and offering the service through the forum's escrow service or direct contact via Telegram or TOX. This exclusivity may be a strategic move to maintain control and reduce exposure. The service is offered for a monthly rental fee of $500, indicating the threat actors' intention to monetize their creation. This pricing model suggests that ManticoraLoader is not merely a one-off tool, but rather a carefully crafted MaaS designed to generate a steady stream of revenue for the cybercriminals. AresLoader Persists The researchers, however, are unclear why the threat actor DarkBLUP remained inactive for more than a year after their success with the AiDLocker ransomware and AresLoader. As AresLoader remains still widely in use among cybercriminals, the researchers suggest that the group is not abandoning its previous project but rather expanding their arsenal to diversify their malicious offerings and expand monetization.

Columbus Judge Issues Restraining Order Against Cybersecurity Expert

cyberexpress Aug 31, 2024 Cybersecurity News

The city of Columbus has obtained a temporary restraining order against cybersecurity expert David L. Ross Jr., also known as Connor Goodwolf, in a bid to prevent him from accessing, downloading, and disseminating sensitive files stolen from the city's server farm during a ransomware attack. City Attorney Zach show more ...

Klein had requested the order, citing the need to protect police, victims, and the public from potential harm. Controversy Surrounding the Restraining Order The restraining order has sparked controversy, as Ross has been instrumental in alerting the public about the extent of the data breach. His disclosures have often contradicted statements made by city officials, including Mayor Andrew Ginther, about the severity of the hack. Ross argues that the city is trying to prevent him from exposing the full extent of the data breach, which he believes has been mishandled by the city's IT department. He stated that the city's data breach consultant tried to hire him earlier, which he suspects was an attempt to prevent him from speaking publicly about the breach. He plans to seek legal representation and has suggested the possibility of a lawsuit against the city for infringing on his First Amendment rights. The online court docket doesn't permit the public to see that document, and the file still lists Noble's name as the judge in the case. Goodwolf had been alerting the city's public that personal information on city officials and citizens, including driver's license and Social Security information, as being among the data that had been hacked and posted online after the city refused to pay ransom negotiations. The files are further stated to include data on victims of criminal acts such as domestic violence victims, and personal information about undercover Columbus police officers. Columbus Breach Stated to Include Personal Data City Attorney Zach Klein, justified and welcomed the decision from Common Pleas Judge Kim Brown, "As City Attorney, I have a duty to do whatever I can to protect police, victims, undercover officers and the public when they are threatened with harm." "This decision is a positive step to stem the dissemination of stolen confidential personnel and victim data—information that compromises active investigations and poses a threat to the lives and livelihoods of real people," he added. Daniel Maldet, from the Columbus office of CMIT Solutions, though not directly involved with the case's investigation, shed further light on the breach's extent. He stated, "They are showing that 3.1 TB (terabytes) of data is released – 258,270 files which is 45% of the stolen data. They show, 'not sold data was uploaded, data hunter, enjoy'. This might suggest that 55% of the data was sold — that’s just a guess." Earlier in January 2023, the Columbus City Council had approved a $2.5 million contract for 'Cybersecurity Products and Services' after receiving proposals from five different firms.

Check Point, Cisco Boost AI Investments With Latest Deals

darkreading Aug 31, 2024 Feed

Cisco's deal to acquire Robust Intelligence will make it possible to use red-team algorithms to assess risk in AI models and applications, while Check Point's acquisition of Cyberint will add threat intelligence to its SOC platform.

Godzilla Fileless Backdoors Targeting Atlassian Confluence

cyware Aug 31, 2024 Malware and Vulnerabilities

The Godzilla fileless backdoor relies on a complex series of actions, such as cryptographic operations, class loading, and dynamic injection, to establish unauthorized access.

Rocinante: The Trojan Horse That Wanted to Fly

cyware Aug 31, 2024 Malware and Vulnerabilities

Once installed, the Rocinante malware prompts the victim to grant Accessibility Services and displays phishing screens tailored to different banks to steal personal information.

New Snake Keylogger Variant Slithers Into Phishing Campaigns

cyware Aug 31, 2024 Malware and Vulnerabilities

The attack starts with a phishing email disguised as a fund transfer notification, with an attached Excel file named “swift copy.xls” that triggers the deployment of Snake Keylogger on the victim's computer upon opening.

FBI: RansomHub Ransomware Breached 210 Victims Since February 2024

cyware Aug 31, 2024 Threat Intel & Info Sharing

The ransomware operation focuses on data theft extortion rather than encrypting files, with victims facing the threat of stolen data being leaked or sold if negotiations fail.

Operation DevilTiger: APT-Q-12’s Shadowy Tactics and Zero-Day Exploits Unveiled

cyware Aug 31, 2024 Threat Actors

The QiAnXin Threat Intelligence Center has revealed the details of "Operation DevilTiger," a cyber espionage campaign carried out by the elusive APT-Q-12 group, also known as "Pseudo Hunter."

Suspected Espionage Campaign Delivers New Voldemort Malware

cyware Aug 31, 2024 Malware and Vulnerabilities

The campaign, which targeted organizations worldwide, involved impersonating tax authorities from various countries and utilizing Google Sheets for command and control (C2).