Iran-Friendly Hackers Carried Out Disruptive Attacks on Albanian Government Websites
Nomad says attackers who return 90% of stolen funds will be considered 'white hat,' Russian national who profited from cybercrime extradited to U.S., Bitter APT has spied on thousands, much more
Mandiant researchers say that hackers working to further the Iranian government’s goals who are angry over the Iranian opposition group Mojahedin-e Khalq’s (MEK) upcoming conference in Albania carried out disruptive cyberattacks on Albanian government sites last month.
The attacks, which forced the government of Albania to shut down online access to multiple government services, may have included a previously unknown backdoor called ChimneySweep and a newly discovered ransomware tool known as RoadSweep to attack the government systems.
In addition, the day after the initial attacks, malware known as ZeroClear, previously linked to Iranian hackers, was uploaded to a public malware registry. It’s unclear whether that sample was used as part of the July 17 attack, but a video uploaded to a website claiming responsibility for the hacks purports to show Albanian government files being deleted. (AJ Vicens / Cyberscoop)
Related: Mandiant, Associated Press, Security Week, DataBreachToday.com, WIRED, Security Week, Iran International
Cryptocurrency company Nomad is offering a bounty to recoup funds stolen in a $190 million hack and will consider anyone returning at least 90% of stolen tokens to be a so-called white-hat hacker that seeks to spotlight vulnerabilities rather than make malicious gains.
“We will not prosecute white hats,” Pranay Mohan, chief executive officer of Nomad, said in the statement. “But we will continue to work with our partners, intelligence firms, and law enforcement to pursue all other malicious actors to the fullest extent under the law.”
Nomad said it is working with crypto forensics specialist TRM Labs and law enforcement to identify hackers. Nomad has partnered with crypto platform Anchorage Digital to accept and safeguard retrievable funds. (Joanna Ossinger / Bloomberg)
Related: The Register - Security, Cointelegraph.com, CNBC Technology
In a significant win for U.S. law enforcement, a Russian national, Alexander Vinnik, accused of running a multibillion-dollar cryptocurrency exchange that allegedly profited from various hacking and extortion schemes, has been extradited from Greece and is on his way to the U.S.
Vinnik is accused of operating a cryptocurrency exchange known as BTC-e that allegedly did business with ransomware gangs, drug dealers, and identity thieves, according to the Justice Department. He faces charges in the Northern District Court of California of money laundering and operating an unlicensed money service business in the U.S., among other charges. (Sean Lyngaas / CNN)
Related: ParisGuardian, CoinDesk, Cointelegraph, The Moscow Times, GreekReporter
Meta’s quarterly adversarial threat report says that Cyber Front Z, a pro-Russian troll operation exposed in the days after the Russian invasion of Ukraine, “was clumsy and largely ineffective — definitely not ‘A team’ work.”
The group is a “poorly executed attempt, publicly coordinated via a Telegram channel, to create a perception of grassroots online support for Russia’s invasion by using fake accounts to post pro-Russia comments on content by influencers and media.” Cyber Front Z remains active on Telegram, with 110,692 subscribers as of August 4. (AJ Vicens / Cyberscoop)
Related: CBS News, Protocol, Rolling Stone
According to Meta’s quarterly adversarial threat report, a cyber espionage group believed to be operating out of India and Pakistan, known as Bitter APT, has been spying on thousands of people by using malware that masquerades as popular secure-messaging apps, according to a new report from Facebook.
The group has been installing malware dubbed Dracarys on Android devices via fake versions of encrypted messaging apps WhatsApp, Signal, and Telegram, which has surged in popularity among Ukrainians as a tool for communicating information about the Russian invasion.
The malware, which has been propagated on Meta’s social media sites, Facebook and Instagram, by hackers posing as attractive young women, journalists, or activists, can siphon off information from an Android device, including call logs, contacts, files, text messages, and geolocation data. It can also access a device’s camera and microphone. (Thomas Brewster / Forbes)
Related: Facebook, Cyberscoop, Technology | The Hill, Punjab News Express
Cybersecurity researcher Ken Pyle provided the Federal Emergency Management Agency with "compelling evidence to suggest certain unpatched and unsecured EAS [Emergency Alert System] devices are indeed vulnerable.”
The agency this week urged operators of the devices to update their software to address the issue, saying that the false alerts could, in theory, be issued over TV, radio, and cable networks. However, there is no evidence that malicious hackers have exploited the vulnerabilities.
Digital Alert Systems, Inc., the New York-based firm that makes the emergency-alert software, said that Pyle first reported the vulnerabilities to the firm in 2019. At that time, the firm issued updated software to address the issue. Pyle said that subsequent versions of the Digital Alert Systems software were still susceptible to some of the security issues he discovered. (Sean Lyngaas / CNN)
Related: Bleeping Computer, Slate, Ars Technica, DHS, TechWorm, The Hacker News
The Indian government unexpectedly withdrew a proposed bill on data protection, Personal Data Protection Bill, 2019, that a panel of lawmakers had worked on for more than two years, saying it was working on a new law.
The legislation would have required internet companies like Meta and Google to get specific permission for most uses of a person’s data and would have eased the process of asking for such personal data to be erased. Privacy advocates and some lawmakers complained that the bill would have given the government expansive powers over personal data while exempting law enforcement agencies and public entities from the law’s provisions, ostensibly for national security reasons. (Sameer Yasir and Karan Deep Singh / New York Times)
Related: Teiss, The Register - Security, Tech.Co, JURIST – News, Live Mint, Tech.Co, geekinteger, Tech-Economic Times, DataBreachToday.com, Cybersecurity Insiders, Teiss
Two brothers, Ian Macalinao and Dylan Macalinao, used many pseudonymous developer profiles to inflate the TVL (total value locked) on Solana by $7.5 billion in what amounted to a Sybil attack, which is when a computer in a network uses bogus identities to gain disproportionate influence over the whole.
The two brothers have moved on to Aptos, an up-and-coming blockchain porting Saber. Many Solana developers are in tow, a venture capital source said. Three sources said they now head a VC firm anchored in Aptos. Their VC is called Protagonist. Its old name was “Ship Capital.” (Danny Nelson and Tracy Wang / CoinDesk)
Related: Cryptoslate
Leaked screenshots show the Linn-Mar School District in Iowa is dealing with a ransomware attack by a group called Vice Society that is much more severe than the “technical difficulties” the district has described to staff and parents.
The screenshots show a warning message stating, “Vice Society has encrypted all your files.” The warning threatens to upload those files to the dark web unless the user contacts them to purchase a key within seven days. The notice does not give the cost of that key. The district, however, has told parents and staff that it is suffering “technical difficulties” with its computer network that has prompted it to limit physical access to district buildings for the rest of this week. (Adam Carros and Ethan Stein / KCRG)
Related: Kwwl
The National Labor Relations Board (NLRB) filed an application to compel two McDonald’s employees who used to work on the company’s team responsible for security and intelligence gathering, known as Global Intelligence Team, to provide evidence to the agency.
The agency sued the employees to compel them to respond to a subpoena related to a case of alleged surveillance against the company’s workers involved with the labor activist campaign Fight for $15. The lawsuit stems from a Motherboard investigation that revealed McDonald’s had labeled Fight for $15 activists a security threat for years and spied on them to figure out which workers were involved in the movement and who they were working with to organize protests, strikes, and attempt to form unions. (Lorenzo Franceschi-Bicchierai / Motherboard)
Related: Law360
Senator Ron Wyden (D-OR) sent a letter to U.S. Supreme Court Chief Justice John Roberts urging him to address the federal court system’s decades-long failure to secure Americans’ most sensitive personal information in court filings.
The letter follows a recent report by the court system’s top policy-making body showing that the body has been inconsistent in enforcing existing privacy rules and enacting new ones. (Tonya Riley / Cyberscoop)
Related: Washington Examiner, U.S. Courts
Deputy Assistant Attorney General for National Security Adam Hickey said the Justice Department has filed its most sensitive court documents on paper since January 2021 to avoid any chance of a breach or vulnerability in electronic filing systems compromising its high-stakes cases.
Hickey said the department implemented the policy last year but did not connect that change to any specific breach or cybersecurity event. However, the Administrative Office of the U.S. Courts did reveal “an apparent compromise” of the court system’s electronic case files on January 6, 2021. (Suzanne Smiley / Cyberscoop)
Details and screenshots of a prototype version of the Pegasus spyware designed for Israeli police in 2014 reveal the tools and far-reaching capabilities of a system slated to be deployed in everyday police work.
In response to a story in Calcalist that said Israeli police used NSO Group’s Pegasus spyware against the country’s citizens, an investigative committee led by Deputy Attorney General Amit Merari sought to examine police use of attack spyware, particularly Pegasus. The Merari team discovered that even though there had been no eavesdropping without court orders, spyware had been used, though the police referred to it by a different name: Seifan. (Josh Breiner and Omer Benjakob /Haaretz)
DuckDuckGo announced it will now block all third-party Microsoft tracking scripts in their privacy browser after failing to block them in the past.
This change comes after the company faced massive blowback in May for not blocking some third-party Microsoft trackers in the DuckDuckGo browser due to a syndicated search content agreement between the two companies. (Lawrence Abrams / Bleeping Computer)
Related: DuckDuckGo, 9to5Mac
Cybersecurity firm Deepwatch says it is highly likely a threat actor exploited a security flaw in an outdated Atlassian Confluence server to deploy a never-before-seen backdoor against an unnamed organization in the research and technical services sector.
They attribute the attack to a threat activity cluster known as TAC-040. The Atlassian vulnerability suspected to have been exploited is CVE-2022-26134, an Object-Graph Navigation Language (OGNL) injection flaw that paves the way for arbitrary code execution on a Confluence Server or Data Center instance. Little is known about TAC-040 other than the fact that the adversarial collective's goals could be espionage-related. However, the possibility that the group could have acted out of financial gain hasn't been ruled out, citing the presence of a loader for an XMRig crypto miner on the system. (Ravie Lakshmanan / The Hacker News)
Related: Teiss, Decipher, Deepwatch
Researchers at Fortinet discovered that a new botnet called RapperBot has been used in attacks since mid-June 2022, brute-forcing its way into Linux SSH servers to establish a foothold on the device.
RapperBot is based on the Mirai trojan but deviates from the original malware's normal behavior, which is uncontrolled propagation to as many devices as possible because it is more tightly controlled, has limited DDoS capabilities, and its operation appears geared towards initial server access, likely to be used as stepping stones for lateral movement within a network. (Bill Toulas / Bleeping Computer)
Related: Security Affairs, TechRadar, Fortinet
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a list of the topmost detected malware strains last year in a joint advisory with the Australian Cyber Security Centre (ACSC).
The top malware strains observed in 2021 include Agent Tesla, AZORult, Formbook, Ursnif, LokiBot, MOUSEISLAND, NanoCore, Qakbot, Remcos, TrickBot, and GootLoader. (Sergiu Gatlan / Bleeping Computer)
Related: CISA, The Record
As the era of quantum computing comes closer to reality, the tech industry is developing plans to deal with the challenges to encryption and other security problems that quantum technology poses.
Software developers have had decades to figure out how to deploy existing forms of encryption, such as RSA, properly, but now they will have to contend with the implementation of largely untested new algorithms that are based on different techniques. This foreshortened timeframe will likely create a significant source of vulnerabilities in the five years after these things are first widely deployed. (Kyle Alspach / Protocol)
Talon Cyber Security, the developer of a specialized browser designed to help enterprises reduce the risk of data breaches, announced that it had raised an additional $83 million in Series A funding on top of the $17 million reported earlier this year.
Evolution Equity Partners led the round, with participation from Ballistic Ventures, CrowdStrike’s Falcon Fund, Merlin Ventures, SYN Ventures, and previous investors CrowdStrike co-founder and CEO George Kurtz, Lightspeed Venture Partners, Sorenson Ventures and Team8. (Maria Deutscher / Silicon Angle)
Related: Calcalist, DataBreachToday.com, VentureBeat, Security Week, FinSMEs, Channel Futures
Cybersecurity risk management startup Axio Global Inc. announced today that it had raised $25 million in a Series B venture funding round.
ISTARI, a Temasek-founded global cybersecurity firm dedicated to helping clients build cyber resilience, led the round with additional participation from existing investors, including Distributed Ventures, IA Capital Group, and Bob Dudley, Axio Chairman and former CEO of BP. (Duncan Riley / Silicon Angle)
Related: VentureBeat, Startup Around, Business Wire Technology News, Security Week, FinSMEs, TechCrunch Security
Lumu, a Miami, FL-based creator of the Continuous Compromise Assessment cybersecurity model that empowers organizations to measure compromise in real-time, raised $8 million in a new venture funding round.
Panoramic Ventures led the round, with participation from KnowBe4 Ventures, Lane Bess, former Zscaler and Palo Alto Networks executive, and Tom Noonan, former CEO at Internet Security Systems and the SoftBank Group’s SB Opportunity Fund. (FinSMEs)
Related: PR Newswire
Munich-based IDnow, a startup that provides machine-learning technology for its Identity Verification-as-a-Service (IVaaS) platform, announced it had raised €60M ($61.4 million) in a new debt facility from funds and accounts managed by BlackRock.
According to IDnow, the new funds will help scale the company by introducing new identity-proofing solutions, expanding its services in new markets, and potential acquisitions. (Vishal Singh / Silicon Canals)
Related: PR Newswire, FinSMEs
Business risk intelligence startup Flashpoint has acquired open-source intelligence startup Echosec Systems Ltd. for an undisclosed price.
Flashpoint says the acquisition will expand its OSINT capabilities to drive on-the-ground situational awareness, executive protection, geopolitical risk assessments, counterterrorism, misinformation and disinformation identification, and response and crisis response. (Duncan Riley / Silicon Angle)
Related: Channel Futures, Flashpoint, Business Wire, Help Net Security