ReportWire

Tag: dark web

  • A shadowy L.A. crime ring is hijacking the IDs of foreign scholars, fraud expert says

    [ad_1]

    Using apartments in the San Fernando Valley and Glendale area, a shadowy group of identity thieves has been quietly exploiting a new kind of victim — foreign scholars who left the U.S. years ago but whose Social Security numbers still linger in American databases, according to a cybercrime expert.

    Criminals are resurrecting these dormant identities and submitting hundreds of applications for bank accounts and credit cards, says David Maimon, head of fraud insights at SentiLink and a criminology professor at Georgia State University. The Southern California-based fraudsters can then max out lines of credit while unknowing victims live halfway across the world, he says.

    Sgt. Frank Diana, with the L.A. County Sheriff’s Department Fraud and Cyber Crimes Bureau, said organized crime rings in the county are highly skilled at stealing identities, concealing their IP addresses and laundering their loot to make it hard to detect.

    Local identity crime rings “are doing it to make millions of dollars, live in nice houses, all at the expense of taxpayers,” Diana said. “It’s not their money, but they’re living like kings.”

    Maimon and his colleague Karl Lubenow said they uncovered this tactic of stealing foreign scholars’ IDs through their work at SentiLink, a company that works with financial institutions to verify identities and detect fraud.

    At first they were asked to examine applications where foreign movie stars and athletes were probably being impersonated.

    In the process, they said, their investigation unearthed something much larger: hundreds of applications submitted to major credit issuers from a set of similar California street addresses and IP addresses in September.

    As they sifted through the files, they saw that, in addition to targeting a handful of foreign celebrities, the fraudsters were impersonating scores of former foreign scholars who had come to the U.S. as long ago as 1977 and left as recently as 2024.

    These scholars were required to obtain Social Security numbers to work on campus in roles such as research or teaching assistants, postdoctoral fellows or visiting lecturers. They are no longer living in the U.S., but their personal information remains scattered across school databases and credit bureaus, which according to Maimon makes them prime prey for opportunistic hackers and fraudsters.

    Should victimized scholars seek to return to the U.S., they would encounter a massive pile of debt and a crippling credit score that could prevent them from gaining work or housing, Maimon said. Meanwhile, financial institutions are liable for the debt, which can ultimately increase the cost of their services to all customers, he added.

    Most of the applications that Maimon identified as fraudulent originated at apartments at six key addresses in Van Nuys, North Hollywood, Toluca Lake, Glendale and Thai Town. It’s likely that crime ring members use addresses they have access to so that they can pick up credit cards, checks and other sensitive documents sent in the mail, Maimon said.

    The nexus of these addresses falls in the Burbank and Glendale area, which Maimon points out is the home of Armenian Power, an organized crime group known for conducting sophisticated financial crimes.

    He also noted that scholars from Turkey, Armenia’s historical rival, accounted for about half of all fraudulent applications. The remainder were impersonating scholars from a variety of countries such as Japan, India, the Netherlands, Portugal and Greece.

    “They [Armenian Power] have been involved in identity theft and white-collar crime for the last 15 years or so,” Maimon said. “It leads us to believe that these guys are essentially stealing all these identities and using them in order to create all those bank accounts and credit lines.”

    Sgt. Diana said that the tactics used by the alleged identity theft ring that Maimon discovered align with those often used by Armenian crime groups, which tend to be based in the Burbank and Glendale areas.

    Although Diana does not know whether Armenian groups are behind fraud attempts targeting foreign scholars, he said these groups are responsible for a significant portion of organized financial crime in L.A. County.

    “We run into a lot of sophisticated Armenian crime groups that are experts on identity theft,” he said. “That’s what they do for a living and [they] make a lot of money.”

    The Sheriff’s Department is not currently investigating any identity theft cases involving foreign scholars, he said. A spokesperson for the Los Angeles Police Department said the department did not currently have any investigations related to this topic. The Burbank Police Department declined to comment.

    Maimon has not reported his findings to authorities, in part due to fear of retaliation from the criminals involved, he said. His previous efforts to shine a light on fraudsters led to his Social Security number and personal information being released on the dark web, resulting in years of identity theft attempts, he said.

    He has reported his findings to the affected financial institutions through his role as a fraud investigator.

    One of the financial institutions, which did not wish to be named due to security concerns, said in a statement that it first realized something was awry after seeing a series of suspicious high-dollar transactions in L.A. and Kern counties coming from accounts in the Glendale area. The majority of the account holders only had addresses dating back to 2023 and very limited credit history.

    The institution said it was continuing to receive fraudulent applications using the identities of former foreign scholars. Once applications are flagged, the institution asks for additional verification information, which it very rarely receives.

    Major data hacks have exposed millions of Americans’ personal information, which is now readily available for purchase on the dark web, Diana said.

    In 2024, the Federal Trade Commission received more than 1.1 million identity theft complaints and about 2.6 million complaints of related fraud resulting in total financial losses of more than $12.7 billion, according to a report by consumer credit reporting company Experian.

    Maimon said that artificial intelligence has increased the ease with which criminals can carry out identity theft.

    Once fraudsters have obtained a victim’s name, date of birth and Social Security number, they can easily use AI tools to generate a picture of a driver’s license or passport. They can even create a realistic-looking video of an AI person holding the photo ID and turning their head side to side, which is an additional security requirement at some institutions.

    Both the ID and the person are fake in this video, an example of how AI can be used to try to evade security measures at financial institutions.

    Identity fraud cases are also notoriously difficult to prosecute as criminals hide behind a web of shadowy IP addresses. In addition, there is typically a significant delay between when fraud is committed and when the victim finds out — often by receiving a letter from a collection agency months later, at which point the evidence trail may have gone cold, Diana said.

    “We’re often a day late and a dollar short,” Diana said.

    In the case of the foreign scholars’ stolen identities, the victims may never find out, providing even more protection for the Southern California perpetrators.

    Diana warns all Angelenos to remain vigilant for signs of identity theft by frequently checking their credit score.

    He recommends people lock their credit at the three major credit bureaus, Experian, Equifax and TransUnion. That way, if someone tries to open a fraudulent line of credit, the financial institution will be unable to access their credit report and probably will deny the application.

    Lastly, if anyone is a victim of identity theft, they should report it to a credit bureau, the FTC and local law enforcement, he said.

    [ad_2]

    Clara Harter

    Source link

  • Sensitive data stolen from Maryland Department of Transportation reportedly up for auction – WTOP News

    [ad_1]

    A ransomware group claims it hacked the Maryland Department of Transportation and is now selling sensitive, personal data on the dark web.

    A ransomware group claims it hacked the Maryland Department of Transportation and is now selling sensitive, personal data on the dark web.

    The website Daily Dark Web first reported the auction. The Rhysida ransomware group claims it has the full names, birth dates and home addresses of transportation agency employees. It shared images of a Maryland driver’s license, passport, Social Security card and other sensitive documents.

    Part of the text reads, “Open your wallets and be ready to buy exclusive data.”

    The auction for the data ends in less than a week and the starting price is 30 Bitcoin, which is worth more than $3 million.

    In a statement to WTOP, Maryland Transit Administration spokesperson Veronica Battisti said, “The Maryland Transit Administration can confirm incident-related data loss at this point in our investigation.”

    “At this time we are unable to disclose specific or additional details regarding what data has been lost because of the sensitivity of the ongoing investigation. If it is found that personal information has been taken, the affected individuals will be notified by the State in accordance with State law and we will take appropriate actions and provide guidance on recommended actions,” Battisti said in a statement to WTOP.

    The state’s information technology department is working with third-party cyber experts to investigate the breach.

    According to the Cybersecurity and Infrastructure Security Agency, Rhysida has been targeting the education, health care, manufacturing, information technology and government sectors since 2023.

    Editor’s Note: The article has been updated to clarify that the investigation is ongoing as to whether personal information has been taken. 

    Get breaking news and daily headlines delivered to your email inbox by signing up here.

    © 2025 WTOP. All Rights Reserved. This website is not intended for users located within the European Economic Area.

    [ad_2]

    Linh Bui

    Source link

  • The Ticketmaster Data Breach May Be Just the Beginning

    The Ticketmaster Data Breach May Be Just the Beginning

    [ad_1]

    One of the biggest hacks of the year may have started to unfold. Late on Friday, embattled events business Live Nation, which owns Ticketmaster, confirmed it suffered a data breach after criminal hackers claimed to be selling half a billion customer records online. Banking firm Santander also confirmed it had suffered a data breach impacting millions of customers and staff after its data was advertised by the same group of hackers.

    While the specific circumstances of the breaches—including exactly what information was stolen and how it was accessed—remain unclear, the incidents may be linked to attacks against company accounts with cloud hosting provider Snowflake. The US-based cloud firm has thousands of customers, including Adobe, Canva, and Mastercard, which can store and analyze vast amounts of data in its systems.

    Security experts say that as more details become clear about hackers’ attempts to access and take data from Snowflake’s systems, it is possible that other companies will reveal they had data stolen. At present, though, the developing situation is messy and complicated.

    “Snowflake recently observed and is investigating an increase in cyber threat activity targeting some of our customers’ accounts,” Brad Jones, Snowflake’s chief information security officer wrote in a blog post acknowledging the cybersecurity incident on Friday. Snowflake has found a “limited number” of customer accounts that have been targeted by hackers who obtained their login credentials to the company’s systems, Jones wrote. Snowflake also found one former staff member’s “demo” account that had been accessed.

    However, Snowflake doesn’t “believe” it was the source of any leaked customer credentials, the post says. “We have no evidence suggesting this activity was caused by any vulnerability, misconfiguration, or breach of Snowflake’s product,” Jones writes in the blog post.

    While the number of Snowflake accounts accessed and what data may have been taken have not been released, government officials are warning about the impact of the attack. Australia’s Cyber Security Center issued a “high” alert on Saturday saying it is “aware of successful compromises of several companies utilizing Snowflake environments” and companies using Snowflake should reset their account credentials, turn on multi-factor authentication, and review user activity.

    “It looks like Snowflake has had some rather egregiously bad security compromise,” security researcher Troy Hunt, who runs data breach notification website Have I Been Pwned, tells WIRED. “It being a provider to many other different parties, it has sort of bubbled up to different data breaches in different locations.”

    Details of the data breaches started to emerge on May 27. A newly registered account on cybercrime forum Exploit posted an advertisement where they claimed to be selling 1.3 TB of Ticketmaster data, including more than 560 million people’s information. The hacker claimed to have names, addresses, email addresses, phone numbers, some credit card details, ticket sales, order details, and more. They asked for $500,000 for the database.

    One day later, the established hacking group ShinyHunters—which first emerged in 2020 with a data-stealing rampage, before selling 70 million AT&T records in 2021—posted the exact same Ticketmaster ad on rival marketplace BreachForums. At the time, Ticketmaster and its parent company Live Nation had not confirmed any data theft and it was unclear if either post selling the data was legitimate.

    [ad_2]

    Matt Burgess

    Source link

  • He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market

    He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market

    [ad_1]

    The message explained that Incognito was now essentially blackmailing its former users: It had stored their messages and transaction records, it said, and added that it would be creating a “whitelist portal” where users could pay a fee—which for some dealers would later be set as high as $20,000—to remove their data before all the incriminating information was leaked online at the end of this month. “YES THIS IS AN EXTORTION!!!” the message added.

    In retrospect, Ormsby says that the site’s apparent user-friendliness and its security features were perhaps a multiyear con laying the groundwork for its endgame, a kind of user extortion never seen before in dark-web drug markets. “Maybe the whole thing was set up to create a false sense of security,” Ormsby says. “The extorting thing is completely new to me. But if you’ve lulled people into a sense of security, I guess it’s easier to extort them.”

    In total, Incognito Market promised to leak more than half a million drug transaction records if buyers and sellers didn’t pay to remove them from the data dump. It’s still not clear whether the market’s administrator—Lin, according to prosecutors, whom they accuse of personally carrying out the extortion campaign—planned to follow through on the threat: He appears to have been arrested before the deadline set for the victims of the Incognito blackmail.

    An Expert in ‘Anti Anti-Money Laundering’

    At the same time the FBI says Lin was laying the groundwork for this double-cross, he also appears to have briefly tried engineering an entirely different scheme. In the summer of 2021, during Incognito Market’s relatively quiet first year, Lin’s alleged alter ego, Pharoah, launched a service called Antinalysis, a website designed to analyze blockchains and let users check—for a fee—whether their cryptocurrency could be connected to criminal transactions.

    In a post to the dark-web market forum Dread, Pharoah made clear that Antinalysis was designed not to help anti-money-laundering investigators, but rather those who sought to evade them—presumably including his own dark-web market’s users. “Our goals do not lie in aiding the surveillance autocracy of state-sponsored agencies,” Pharoah’s post read. “This service is dedicated to individuals that have the need to possess complete privacy on the blockchain, offering a perspective from the opponent’s point of view in order for the user to comprehend the possibility of his/her funds getting flagged down under autocratic illegal charges.”

    After independent cybersecurity reporter Brian Krebs wrote about the Antinalysis service in August 2021, describing it as an “anti anti-money laundering service for crooks,” Pharoah posted another message complaining that Antinalysis had lost access to its blockchain data source, which Krebs had identified as the anti-money-laundering tool AMLBot, and that it would be going offline. “Stay posted and fuck LE,” Pharoah wrote, using the abbreviation LE to mean “law enforcement.” Antinalysis eventually returned, however, and pivoted last year to acting instead as a service for swapping bitcoin for monero and vice versa.

    Meanwhile, Lin appears to have maintained his obsession with cryptocurrency tracing and blockchain analysis: His final LinkedIn post last week before his arrest in New York announced that he had become a certified user of Reactor, the crypto tracing tool sold by blockchain analysis firm Chainalysis. “I’m excited to share that I’ve completed Chainalysis’s new qualification: Chainalysis Reactor Certification (CRC)!” Lin wrote in Mandarin. His last X post shows a Chainalysis diagram of money flows between dark-web markets and cryptocurrency exchanges.

    [ad_2]

    Andy Greenberg

    Source link

  • Change Healthcare’s New Ransomware Nightmare Goes From Bad to Worse

    Change Healthcare’s New Ransomware Nightmare Goes From Bad to Worse

    [ad_1]

    Change Healthcare is facing a new cybersecurity nightmare after a ransomware group began selling what it claims is Americans’ sensitive medical and financial records stolen from the health care giant.

    “For most US individuals out there doubting us, we probably have your personal data,” the RansomHub gang said in an announcement seen by WIRED.

    The stolen data allegedly includes medical and dental records, payment claims, insurance details, and personal information like Social Security numbers and email addresses, according to screenshots. RansomHub claimed it had health care data on active-duty US military personnel.

    The sprawling theft and sale of sensitive health care data represents a dramatic new form of fallout from the February cyberattack on Change Healthcare that crippled the company’s claims-payment operations and sent the US health care system into crisis as hospitals struggled to stay open without regular funding.

    Change Healthcare, a subsidiary of UnitedHealth Group, previously acknowledged that a ransomware gang known as BlackCat or AlphV breached its systems, and told WIRED last week that it is investigating RansomHub’s claims about possessing the company’s stolen data. Change Healthcare did not immediately respond to a request for comment about the group’s alleged sale of its data.

    The wide variety of patient data that RansomHub claims to be selling is a testament to Change Healthcare’s role as a critical intermediary between insurers and health care providers, facilitating payments between both parties and collecting reams of sensitive information about patients and their medical procedures in the process.

    Among the sample records that RansomHub posted are a list of open claims handled by the company’s EquiClaim subsidiary that includes patient and provider names; a hospital record for a 74-year-old woman in Tampa, Florida; and part of a database record related to US military service members’ health care.

    RansomHub said it would allow individual insurance companies that worked with Change Healthcare and had their data compromised to pay ransoms to prevent the sale of their records. It specified that it was selling data belonging to MetLife, CVS Caremark, Davis Vision, Health Net, and Teachers Health Trust.

    Change Healthcare’s “processing of sensitive data for all of these companies is just something unbelievable,” RansomHub said in its announcement.

    Most firms whose data RansomHub claims to possess did not immediately respond to WIRED’s request for comment.

    Mike DeAngelis, the executive director of corporate communications for CVS Health says the company is “aware of unsubstantiated claims from threat actors that confidential data, including personal information of patients and members belonging to multiple organizations, was accessed as part of Change Healthcare’s cyber security incident.”

    “We are closely monitoring Change Healthcare’s response to this issue and will provide updates with more information as appropriate,” DeAngelis adds, noting that Change Healthcare has not yet confirmed that patient data “was impacted by this incident.”

    Brett Callow, a threat analyst at the security firm Emsisoft who closely tracks ransomware gangs, says the new sale of stolen data was probably “less about actually selling the data” and more about putting Change Healthcare—and the partner companies whose records it failed to protect—“under additional pressure to pay.”

    Change Healthcare appears to have paid a $22 million ransom to AlphV to stop it from leaking terabytes of stolen data.

    Two months into the crisis spawned by the ransomware attack, Change Healthcare has faced mounting losses. The company recently reported spending $872 million responding to the incident as of March 31.

    At the same time, Change is under increasing pressure from lawmakers and regulators to explain its cybersecurity lapse and the steps it’s taking to prevent another hack.

    A subcommittee of the House Energy and Commerce Committee held a hearing on the health sector’s cyber posture on Tuesday, with key lawmakers saying they were disappointed that UnitedHealth Group declined to make an executive available to testify. And the Department of Health and Human Services is investigating whether Change Healthcare’s failure to prevent hackers from accessing and stealing its data violated federal data-security rules.

    Updated 4/16/2024, 5:38 pm ET: Added additional details about the firms whose data RansomHub claims to possess.

    [ad_2]

    Eric Geller

    Source link

  • Why More Founders Should Think Like Hackers | Entrepreneur

    Why More Founders Should Think Like Hackers | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    Who would know better about protecting a complex system from exploitation than a gifted hacker tasked with destroying it?

    That is how the now decades-old cottage industry of white-hat hackers continues to thrive across sectors in tech development. For those unfamiliar, a “white hat” refers to an ethical security hacker, typically hired by companies or governments to identify security vulnerabilities in a system or software. These hackers operate under the owner’s consent to test out many attacks against programs or even entire infrastructures to uncover potential exploitations before someone more nefarious reaches it.

    Despite its legal ambivalence, white hats are still commonly used as a high-intensity stress test, specifically in cybersecurity. More recently, “white hat” has become a marketing term used to launch products created by individuals with a past in more unscrupulous hacking circles —repurposing their skills to create a product or program of superior, “hacker-proof” quality.

    Related: Be Afraid! 8 New Hacks From the Black Hat Conference That Should Scare You.

    But the concept of a white hat or products created by a benevolent troublemaker has fallen out of style in many mainstream fields of tech development. Now, any tech entrepreneur is a free agent to whichever tech trend happens to be in vogue, and “disruptors” is a hollow buzzword deployed by startup marketing teams.

    Just look at how many projects and funds have pivoted back to AI now that the industry is reaching new heights of innovation and adoption. Trends drive funding and growth in any industry, but it becomes increasingly apparent when leading funds and investors radically change the projects they back, and every other accelerator follows suit to ride a wave. It creates an environment where worthy projects might miss out on valuable funding or attention because their industry isn’t in a trendy tech investment listicle.

    With that in mind, do entrepreneurs and investors have the wrong mindset when exploring certain tech sectors?

    Part of the charm of white hat security comes from adopting a new perspective on a seemingly taboo or illicit part of tech culture and communities. It’s a real-life example of keeping your friends close but your enemies closer. But with so many tech entrepreneurs and VCs chasing trends, it’s harder for other parts of tech to escape being overlooked.

    Some might argue the taboo parts of tech culture have nothing that might benefit mainstream adoption. This argument is understandable, considering how underground tech fixtures are either built to be exploitative or harnessed for unsavory purposes. Reframing fringe developments for other uses may look like an endorsement or put projects in a morally grey area.

    That being said, tech entrepreneurs and investors historically don’t have a problem with being in the grey when it comes to backing projects or entire sectors. Case in point: Bitcoin and crypto, in general, were perceived as a tool for overtly criminal activity, such as buying drugs on the dark web.

    Related: Why 2023 Might Be The Year of the Crypto Underdog

    The dark web is probably one of the murkiest parts of the internet, yet many everyday users don’t actually understand what it entails. The dark web allows private computer networks to communicate and transact completely anonymously by hosting internet content through highly-guarded overlay networks that can only be accessed through specific software or authorization. This kind of technology could be highly beneficial if it wasn’t infamously associated with terrorism, child exploitation and other forms of violence.

    Polls repeatedly show Americans don’t like government and corporate surveillance. And even Westerners who aren’t as concerned about companies like Meta and Google tracking their internet activity understand the value censorship resistance offers activists and journalists seeking to share information under totalitarian regimes.

    But most entrepreneurs wouldn’t even consider repurposing the dark web’s technological underpinnings due to its reputation. A white-hat mentality, for example, could be enormously beneficial in trying to keep the good in the dark web while finding ways to mitigate or even eliminate the bad.

    tomi, an anonymous project that claims to be led by crypto-industry leaders, has taken this approach in building its own alternative internet network. The idea is to ensure the free flow of information without government or corporate surveillance and prevent violence and illicit activity via tomiDAO, its community-led governance model.

    Related: The Metaverse Might Not Be Relevant Anymore, But AR Will Still Transform Industries

    Even AI has already been utilized for disreputable purposes. AI-based facial recognition has landed companies in hot water for illegal usage, not to mention the controversy caused by deepfakes and data privacy being compromised by generative AI. Yet there are few convincing arguments to completely abandon AI for benevolent reasons because it’s being used for dubious purposes.

    Innovation can often come from the most unlikely places, but adopting a trend-focused or narrow-minded approach to tech development will cause entire sectors to be discarded or pushed further to the sidelines. If we want to see more white hat-style development that creates the most interesting and generous tech products possible, it will require entrepreneurs and investors to shift their perspective. While not every seedy sector of tech has a hidden treasure trove of use cases waiting to be discovered, it would be worthwhile to look at the perimeter to at least examine how certain technologies can be used to benefit everyone.

    [ad_2]

    Ariel Shapira

    Source link