ReportWire

Tag: Hackers

  • How to Protect Your Company From Deepfake Fraud | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    In 2024, a scammer used deepfake audio and video to impersonate Ferrari CEO Benedetto Vigna and attempted to authorize a wire transfer, reportedly tied to an acquisition. Ferrari never confirmed the amount, which rumors placed in the millions of euros.

    The scheme failed when an executive assistant stopped it by asking a security question only the real CEO could answer.

    This isn’t sci-fi. Deepfakes have jumped from political misinformation to corporate fraud. Ferrari foiled this one — but other companies haven’t been so lucky.

    Executive deepfake attacks are no longer rare outliers. They’re strategic, scalable and surging. If your company hasn’t faced one yet, odds are it’s only a matter of time.

    Related: Hackers Targeted a $12 Billion Cybersecurity Company With a Deepfake of Its CEO. Here’s Why Small Details Made It Unsuccessful.

    How AI empowers imposters

    You need less than three minutes of a CEO’s public video — and under $15 worth of software — to make a convincing deepfake.

    With just a short YouTube clip, AI software can recreate a person’s face and voice in real time. No studio. No Hollywood budget. Just a laptop and someone ready to use it.

    In Q1  2025, deepfake fraud cost an estimated $200 million globally, according to Resemble AI’s Q1 2025 Deepfake Incident Report. These are not pranks — they’re targeted heists hitting C‑suite wallets.

    The biggest liability isn’t technical infrastructure; it’s trust.

    Why the C‑suite is a prime target

    Executives make easy targets because:

    • They share earnings calls, webinars and LinkedIn videos that feed training data

    • Their words carry weight — teams obey with little pushback

    • They approve big payments fast, often without red flags

    In a Deloitte poll from May 2024, 26% of execs said someone had tried a deepfake scam on their financial data in the past year.

    Behind the scenes, these attacks often begin with stolen credentials harvested from malware infections. One criminal group develops the malware, another scours leaks for promising targets — company names, exec titles and email patterns.

    Multivector engagement follows: text, email, social media chats — building familiarity and trust before a live video or voice deepfake seals the deal. The final stage? A faked order from the top and a wire transfer to nowhere.

    Common attack tactics

    Voice cloning:

    In 2024, the U.S. saw over 845,000 imposter scams, according to data from the Federal Trade Commission. This shows that seconds of audio can make a convincing clone.

    Attackers hide by using encrypted chats — WhatsApp or personal phones — to skirt IT controls.

    One notable case: In 2021, a UAE bank manager got a call mimicking the regional director’s voice. He wired $35 million to a fraudster.

    Live video deepfakes:

    AI now enables real-time video impersonation, as nearly happened in the Ferrari case. The attacker created a synthetic video call of CEO Benedetto Vigna that nearly fooled staff.

    Staged, multi-channel social engineering:

    Attackers often build pretexts over time — fake recruiter emails, LinkedIn chats, calendar invites — before a call.

    These tactics echo other scams like counterfeit ads: Criminals duplicate legitimate brand campaigns, then trick users onto fake landing pages to steal data or sell knockoffs. Users blame the real brand, compounding reputational damage.

    Multivector trust-building works the same way in executive impersonation: Familiarity opens the door, and AI walks right through it.

    Related: The Deepfake Threat is Real. Here Are 3 Ways to Protect Your Business

    What if someone deepfakes the C‑suite

    Ferrari came close to wiring funds after a live deepfake of their CEO. Only an assistant’s quick challenge about a personal security question stopped it. While no money was lost in this case, the incident raised concerns about how AI-enabled fraud might exploit executive workflows.

    Other companies weren’t so lucky. In the UAE case above, a deepfaked phone call and forged documents led to a $35 million loss. Only $400,000 was later traced to U.S. accounts — the rest vanished. Law enforcement never identified the perpetrators.

    A 2023 case involved a Beazley-insured company, where a finance director received a deepfaked WhatsApp video of the CEO. Over two weeks, they transferred $6 million to a bogus account in Hong Kong. While insurance helped recover the financial loss, the incident still disrupted operations and exposed critical vulnerabilities.

    The shift from passive misinformation to active manipulation changes the game entirely. Deepfake attacks aren’t just threats to reputation or financial survival anymore — they directly undermine trust and operational integrity.

    How to protect the C‑suite

    • Audit public executive content.

    • Limit unnecessary executive exposure in video/audio formats.

    • Ask: Does the CFO need to be in every public webinar?

    • Enforce multi-factor verification.

    • Always verify high-risk requests through secondary channels — not just email or video. Avoid putting full trust in any one medium.

    • Adopt AI-powered detection tools.

    • Use tools that fight fire with fire by leveraging AI features for AI-generated fake content detection:

      • Photo analysis: Detects AI-generated images by spotting facial irregularities, lighting issues or visual inconsistencies

      • Video analysis: Flags deepfakes by examining unnatural movements, frame glitches and facial syncing errors

      • Voice analysis: Identifies synthetic speech by analyzing tone, cadence and voice pattern mismatches

      • Ad monitoring: Detects deepfake ads featuring AI-generated executive likenesses, fake endorsements or manipulated video/audio clips

      • Impersonation detection: Spots deepfakes by identifying mismatched voice, face or behavior patterns used to mimic real people

      • Fake support line detection: Identifies fraudulent customer service channels — including cloned phone numbers, spoofed websites or AI-run chatbots designed to impersonate real brands

    But beware: Criminals use AI too and often move faster. At the moment, criminals are using more advanced AI in their attacks than we are using in our defense systems.

    Strategies that are all about preventative technology are likely to fail — attackers will always find ways in. Thorough personnel training is just as crucial as technology is to catch deepfakes and social engineering and to thwart attacks.

    Train with realistic simulations:

    Use simulated phishing and deepfake drills to test your team. For example, some security platforms now simulate deepfake-based attacks to train employees and flag vulnerabilities to AI-generated content.

    Just as we train AI using the best data, the same applies to humans: Gather realistic samples, simulate real deepfake attacks and measure responses.

    Develop an incident response playbook:

    Create an incident response plan with clear roles and escalation steps. Test it regularly — don’t wait until you need it. Data leaks and AI-powered attacks can’t be fully prevented. But with the right tools and training, you can stop impersonation before it becomes infiltration.

    Related: Jack Dorsey Says It Will Soon Be ‘Impossible to Tell’ if Deepfakes Are Real: ‘Like You’re in a Simulation’

    Trust is the new attack vector

    Deepfake fraud isn’t just clever code; it hits where it hurts — your trust.

    When an attacker mimics the CEO’s face or voice, they don’t just wear a mask. They seize the very authority that keeps your company running. In an age where voice and video can be forged in seconds, trust must be earned — and verified — every time.

    Don’t just upgrade your firewalls and test your systems. Train your people. Review your public-facing content. A trusted voice can still be a threat — pause and confirm.

    [ad_2]

    Ivan Shkvarun

    Source link

  • Hackers found a way to turn off Windows Defender remotely

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Most modern Windows PCs rely on Microsoft Defender as their first line of defense against malware. Over the years, it has evolved into a capable and often underrated antivirus that blocks a wide range of threats. But a hacker group has found a way to abuse a legitimate Intel CPU tuning driver in a “Bring Your Own Vulnerable Driver” (BYOVD) attack to completely disable Microsoft Defender.

    The technique has been observed since mid-July 2025 and is already being used in active ransomware campaigns. The method doesn’t rely on exploiting a software bug or delivering an obviously malicious file. Instead, it takes advantage of how the Windows driver system is designed to allow deep hardware access.

    Let’s discuss all you need to know about the attack and how you can stay safe.

    HOW SCAMMERS TARGET YOU EVEN WITHOUT SOCIAL MEDIA

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    The Akira ransomware group exploits a legitimate Intel CPU tuning driver in cyberattacks to completely disable Microsoft Defender on Windows systems. (Kurt “CyberGuy” Knutsson)

    How Akira ransomware disables Microsoft Defender

    The Akira ransomware group has developed a new way to bypass security tools by using a legitimate Intel CPU tuning driver called rwdrv.sys from the performance-tweaking tool ThrottleStop. Security firm GuidePoint Security says attackers load this driver to gain kernel-level access to Windows systems, then install a second malicious driver, hlpdrv.sys, which changes the DisableAntiSpyware registry setting via regedit.exe to shut down Microsoft Defender.

    Once Defender is disabled, attackers can run other malicious programs undetected. GuidePoint says this method has been consistently spotted in Akira campaigns since mid-July.

    A Windows PC

    The Akira ransomware group has been infiltrating Windows operating systems by exploiting a legitimate driver to gain access. (Kurt “CyberGuy” Knutsson)

    Akira ransomware targets Microsoft Defender and SonicWall VPNs

    The same group has also been linked to attacks targeting SonicWall VPN devices. SonicWall has stated that these incidents likely involve a known vulnerability, CVE-2024-40766, rather than a brand-new zero-day. The company recommends restricting VPN access, enabling multi-factor authentication, and disabling unused accounts as immediate defenses.

    Akira attacks often involve stealing data, setting up hidden remote access, and deploying ransomware to encrypt files across an organization. Security experts warn that fake or lookalike websites are increasingly being used to distribute these malicious tools.

    FBI WARNS SENIORS ABOUT BILLION-DOLLAR SCAM DRAINING RETIREMENT FUNDS, EXPERT SAYS AI DRIVING IT

    Researchers at GuidePoint have published a YARA detection rule, along with file names, service names, SHA-256 hashes, and file paths to help identify this activity. They recommend administrators actively monitor for these indicators, apply filtering and blocking rules as new IoCs emerge, and only download software from official or verified sources.

    We reached out to Microsoft for a comment, but did not hear back before our deadline.

    A split image shows a hacker and a Windows laptop.

    Antivirus software, two-factor authentication and data removal services are just a few ways Windows users can protect themselves from hackers. (Cyberguy.com)

    6 ways to protect yourself against Akira ransomware and similar threats

    The Microsoft Defender attack is smart and dangerous, but you’re not without defenses. Here are a few tips to help you stay safe:

    1) Use strong antivirus software

    Even with regular updates, Windows systems can be left exposed if built-in defenses are disabled. A strong antivirus software with real-time protection, kernel-level monitoring, and frequent updates can provide backup security. The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at CyberGuy.com.

    2) Limit exposure

    Many exploits rely on user interaction, such as clicking a shady link, downloading a compromised file, or mounting an untrusted virtual disk. Stick to reputable websites, avoid opening unsolicited email attachments, and use a browser with built-in security features (like Microsoft Edge or Chrome with Safe Browsing enabled).

    3) Avoid running unexpected commands

    Never paste or run commands (like PowerShell scripts) you don’t understand or that were copied from random websites. Attackers often trick users into unknowingly running malware this way.

    GOOGLE CONFIRMS DATA STOLEN IN BREACH BY KNOWN HACKER GROUP

    4) Keep your software updated

    Regularly update your operating system, browsers, and all software applications. Updates often include patches for security vulnerabilities that malware can exploit.

    5) Use two-factor authentication (2FA)

    Enable 2FA on all your accounts. This adds an extra layer of security by requiring a second form of verification, making it harder for attackers to gain access even if they have your password.

    6) Invest in personal data removal services

    Even with strong device security, your personal information may still be exposed online through data brokers and people-finder sites.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice.  They aren’t cheap – and neither is your privacy.  These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites.  It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet.  By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    Akira’s trick shows a bigger flaw in how Windows trusts certain tools. A driver meant for harmless CPU tuning ends up being the key to turning security off. Since it’s from a legitimate source, Windows just lets it through without asking questions. We tend to think hackers always break in from the outside. Here, they’re already inside the circle of trust, using the system’s own rules.

    Should Microsoft be doing more to stop ransomware groups from disabling Defender? Let us know by writing to us at Cyberguy.com.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM newsletter.

    Copyright 2025 CyberGuy.com.  All rights reserved.

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Over 2B users face phishing risks after Google data leak

    [ad_1]

    NEWYou can now listen to Fox News articles!

    A tech leader like Google often seems invincible when it comes to cybersecurity attacks, but that is not the case. Earlier this month, the search giant confirmed that attackers had accessed one of its corporate Salesforce instances. According to a Google spokesperson, this system stored basic, and largely publicly available business information, such as contact details and notes from small and medium-sized companies. It did not store customer data from Google Cloud or consumer products like Gmail, Drive or Calendar.

    Google says it terminated the malicious activity, completed an impact analysis, and provided mitigations. Therefore, no further action is required by users.

    NEW GOOGLE AI MAKES ROBOTS SMARTER WITHOUT THE CLOUD

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER 

    Cybercriminals are exploiting Google’s recent Salesforce data breach to launch vishing calls and phishing attacks against Gmail users worldwide. (Kurt “CyberGuy” Knutsson)

    Vishing calls target Gmail users

    Hackers have reportedly accessed Google’s Salesforce database systems, exposing customer and company names. Google confirmed the incident and clarified that the information was mostly public business contact data and did not include passwords or payment information. The company stressed that the breach affected only a corporate Salesforce system, not consumer Gmail or Google Cloud accounts.

    Still, attackers are exploiting the news of the breach to fuel phishing and vishing scams, tricking people into giving up sensitive information. According to PC World, some users have already reported an increase in phishing attempts that reference Google services.

    STOP GOOGLE FROM FOLLOWING YOUR EVERY MOVE

    One of the main tactics involves scam phone calls, also known as vishing. A Reddit post highlighted a wave of calls coming from the 650 area code, which is linked to Google’s headquarters. In these calls, scammers pose as Google employees and warn victims of a supposed security breach. They then instruct users to reset their Gmail password and share it with them. This locks the rightful owner out of the account and gives the attacker complete control.

    Gmail loading screen.

    A user launches Gmail. (Kurt “CyberGuy” Knutsson)

    Old infrastructure exploited with “dangling buckets”

    Separately from the Salesforce incident, Google Cloud customers are also facing another type of attack. Hackers are trying to exploit outdated access addresses using a method called the dangling bucket. This can allow them to inject malware or steal data. Both businesses and individuals are vulnerable to losing control over sensitive information if targeted in this way.

    Gmail and Google Cloud serve nearly 2.5 billion people, which makes the scale of the risk significant. Although the initial breach did not expose passwords, attackers are using the news of the incident to trick people into revealing their login details.

    Google homepage

    A Google search window is on a laptop. (Kurt “CyberGuy” Knutsson)

    6 ways you can stay safe from scammers targeting Google accounts

    Google accounts are often a prime target for scammers. The good news is that protecting yourself doesn’t require advanced technical skills. A few practical steps can drastically reduce your chances of becoming a victim.

    1) Avoid clicking on phishing links

    Phishing remains the most common way scammers steal Google account credentials. A fake email or text may claim your account has been locked or that you need to verify suspicious activity. Clicking the link usually takes you to a counterfeit login page that looks almost identical to the real Google sign-in screen.

    To avoid falling for these tricks, check the sender’s email address carefully, hover over links before clicking, and avoid entering your Google password on any page that doesn’t start with accounts.google.com.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com/LockUpYourTech 

    2) Save passwords securely

    Reusing weak passwords across multiple sites is an open invitation for scammers. If one site is breached, your Google account becomes vulnerable. A strong, unique password is your first line of defense.

    The easiest way to manage this is with a password manager. It can generate complex passwords, store them securely, and fill them in automatically when you need them. This way, you never have to remember dozens of different logins, and attackers can’t guess their way in.

    Next, see if your email has been exposed in past breaches. Our #1 password manager pick (see Cyberguy.com/Passwords) includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords

    WHAT TO DO IF YOU GET A PASSWORD RESET EMAIL YOU DIDN’T ASK FOR

    3) Delete personal data that puts you at risk

    Scammers often use information they find online to craft convincing attacks. If your email address, phone number, or even past passwords are floating around on data broker sites, criminals have more tools to impersonate you or trick you into revealing more.

    Using a data removal service helps clean up your digital footprint. By reducing the amount of exposed information about you, it becomes much harder for scammers to target you directly.

    While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    4) Turn on two-factor authentication

    Even the strongest password can be stolen, but two-factor authentication (2FA) adds an extra barrier. When enabled, Google will ask for a one-time code or prompt on your phone before granting access. That means even if a scammer manages to get your password, they can’t log in without also having your device.

    Google offers several 2FA methods, from SMS codes to app-based prompts and even hardware security keys. For the best protection, choose app-based or hardware verification rather than text messages.

    5) Keep your devices updated

    Many scams rely on exploiting outdated software. If your phone, browser, or operating system isn’t up to date, attackers may use known vulnerabilities to install malware or hijack your session.

    Set your devices to update automatically whenever possible. This ensures you’re always running the latest security patches, reducing the number of openings a scammer can use.

    6) Regularly check Google account security settings

    Google provides built-in tools to help users spot suspicious activity. By visiting your Google Account’s security page, you can see devices that have signed in, recent account activity, and whether recovery options like your phone number and backup email are up to date.

    Running a Google Security Checkup only takes a few minutes and gives you a clear overview of any weaknesses. Think of it as a health check for your digital life.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    The incident is a reminder that even tech giants with vast resources are not immune to security lapses. While Google insists that no passwords were exposed, the wave of phishing and vishing scams shows how quickly criminals can weaponize even partial leaks. What began as a breach of business data has spiraled into a threat facing millions of everyday users, raising questions about how secure Google’s ecosystem really is.

    Do you believe regulators should step in with stricter rules for how cloud providers handle security lapses? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide – free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com.  All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • The truth behind those mysterious shipment emails in your inbox

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Over the past year, more people have reported receiving order shipment emails for purchases they never made. These messages usually come from legitimate retailers, often sportswear brands or electronics stores, and contain real tracking numbers and delivery details. The products are being shipped to different names at different addresses, but for some reason, the buyer’s contact email is yours.

    It might seem like a harmless clerical error or someone accidentally typing the wrong email address. But when it happens repeatedly, and across multiple unrelated orders, it starts to look less like a coincidence and more like a tactic.

    Arthur from Cape Coral, Florida, recently reached out with an experience that mirrors what others have been describing:

    “My wife’s e-mail address is showing up in emails from various sports entities to notify her of shipping dates, etc. So far, three separate individuals have ordered products, shipped to a different name at a different address, but used her email as the contact. They didn’t use our credit card to place the order. What could be going on? I don’t believe it’s a coincidence.”

    HOW TO DETECT FAKE AMAZON EMAILS AND AVOID IMPERSONATION SCAMS

    Arthur is right to question what’s happening. Scammers are deliberately using real email addresses to push fraudulent purchases through retailer systems with fewer checks. They rely on your email to carry out the scam, even if they have not stolen your payment details.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER 

    Some scammers use valid, active email addresses to bypass retailer fraud filters. (Kurt “CyberGuy” Knutsson)

    What’s likely happening with those shipment emails in your inbox

    It is unlikely that someone is accidentally typing your email address every single time. Rather, scammers are deliberately using valid, active email addresses like yours to bypass retailer fraud filters. Numerous sources confirm that fake order and shipping confirmation emails are a common tactic in fraud operations, with criminals exploiting the trust systems placed in legitimate email addresses.

    When a stolen credit card is used, pairing it with a real email that has not triggered spam alerts increases the chance the transaction will go unnoticed by anti-fraud systems. Retailers often check whether an email address is active or bounces. If the system sees a functioning address, it may be less suspicious than an obviously fake one.

    Once the order is placed, products are frequently sent to drop addresses or freight-forwarding services, as confirmed by official investigations into brushing scams. These services act as intermediaries, making the scam harder to trace. In that context, your email is simply a means to an end, a validated contact point that helps the operation move forward smoothly.

    A laptop with the Google search screen on it

    Scammers can obtain email addresses when reputable companies experience data breaches. (Kurt “CyberGuy” Knutsson)

    How bad actors are able to get your email

    Your email address may have ended up in the hands of scammers through several common methods. The most likely cause is a data breach. Many well-known companies have experienced leaks in which customer emails and other information were exposed. 

    Once your email is part of a leaked database, it often circulates on the dark web or in underground forums, where it is freely traded and reused. Even if you were not part of a breach, scammers often use a technique called credential stuffing. This involves testing stolen login details across different websites to confirm which email addresses are active.

    REMOVE YOUR DATA TO PROTECT YOUR RETIREMENT FROM SCAMMERS

    Remove yourself from the web

    The best thing you can do to prevent this from happening is to invest in a data removal service. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. 

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan

    A person types on their laptop.

    If you are receiving order confirmations for things you never bought, your email address could be a tool used by scammers in a larger fraud operation. (Kurt “CyberGuy” Knutsson)

    7 ways to secure your email from scammers

    These simple but powerful steps can help you protect your inbox, safeguard your identity and stay one step ahead of scammers misusing your email.

    1. Protect and monitor your email

    Start by locking down your email account with a strong, unique password that you don’t reuse anywhere else. Enable two-factor authentication (2FA) so hackers can’t get in even if they’ve stolen your password. A password manager makes this much easier by generating and securely storing complex passwords, helping you avoid the risks of reuse. 

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords.

    Next, see if your email has been exposed in past breaches. Our No. 1 password manager (see Cyberguy.com/Passwords) pick includes a built-in breach scanner that checks whether your email address or passwords have appeared in known leaks. If you discover a match, immediately change any reused passwords and secure those accounts with new, unique credentials. 

    2. Watch for suspicious messages

    Scan your inbox regularly for order confirmations, shipping notices or account sign-ups you don’t recognize. If something looks off, report it directly to the retailer or platform; it could be part of a larger scam using your email address. Never click on suspicious links, even if the message looks legitimate, and protect your devices with strong antivirus software to catch threats before they spread.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at Cyberguy.com/LockUpYourTech 

    3. Be picky about where you share your email

    Avoid entering your email on shady giveaway sites or sketchy online forms. When in doubt, skip the sign-up or use a throwaway email. The fewer places your email lives, the harder it is for scammers to get hold of it.

    4. Create a second email address for shopping

    Set up a dedicated email for online purchases, newsletters and subscriptions. This helps keep your main inbox clean and makes it easier to spot strange activity. Sometimes, it’s best to create various email aliases so that you don’t have to worry about all your info getting taken in a data breach.  An email alias address is a great way for you to stop receiving constant spam mail by simply deleting the email alias address. These aliases forward messages to your primary address, making it easier to manage incoming communications and avoid data breaches.

    For recommendations on private and secure email providers that offer alias addresses, visit Cyberguy.com/Mail

    HOW TO TELL IF A LOGIN ALERT IS REAL OR A SCAM

    5. Monitor your credit and identity regularly

    Even if no purchases appear under your name, scams involving your email can be a red flag for future identity misuse. Set up alerts with your bank and consider a credit monitoring service to catch unauthorized activity early.

    See my tips and best picks on how to protect yourself from identity theft at  Cyberguy.com/IdentityTheft

    6. Review connected accounts and revoke access

    In your email settings (e.g., Gmail, Outlook), check for any connected apps, services or delegated access you don’t recognize and remove them. This ensures no third party is piggybacking off your account.

    7. File an identity theft report if the problem escalates

    If this email misuse leads to fraudulent financial activity, users should file a report with the FTC at IdentityTheft.gov or their local authorities. 

    Kurt’s key takeaway

    If you are receiving order confirmations for things you never bought, do not shrug it off. Your email is likely being misused as part of a larger fraud operation, not by accident but intentionally. Scammers are taking advantage of active, trustworthy email addresses to slip past retailer defenses and carry out unauthorized purchases. The repeated use of your email shows that fraud networks are already circulating it, even if your financial information remains untouched.

    Are you comfortable with how much of your personal information is floating around online? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com.  All rights reserved. 

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Nearly a million patients hit by DaVita dialysis ransomware attack

    [ad_1]

    NEWYou can now listen to Fox News articles!

    Healthcare institutions have become a favorite target for bad actors, largely because of how easy they make it for attackers. In June, researchers discovered a healthcare data breach that exposed the personal information of around 8 million patients. All of this information was publicly accessible online without any passwords or authentication protocols.

    The latest healthcare organization to fall victim to a breach is DaVita, which has put nearly a million people at risk. Headquartered in Denver, Colorado, DaVita provides dialysis treatment to about 200,000 patients across the U.S. and 13 other countries.

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    DIOR DATA BREACH EXPOSES US CUSTOMERS’ PERSONAL INFORMATION

    A healthcare professional working on her laptop  (Kurt “CyberGuy” Knutsson)

    What you need to know DaVita ransomware attack

    Kidney dialysis giant DaVita says nearly 916,000 people had personal and medical information exposed in an April ransomware attack (via Comparitech). The breach, which the company disclosed in state filings, compromised names, Social Security numbers, dates of birth, health insurance details, medical records, tax ID numbers, addresses and even images of checks made out to the company.

    DaVita says the incident disrupted internal operations and primarily affected its laboratories. In its latest notice to victims, the company says the cyberattack began March 24, 2025, and continued until April 12. It has not confirmed whether a ransom was paid.

    Ransomware gang Interlock claimed responsibility on April 25, posting screenshots of alleged stolen documents and saying it took 1.5TB of DaVita’s data. The group lists the company on its public leak site, where it pressures victims by threatening to sell or release stolen files.

    DaVita is offering eligible breach victims free identity restoration services through Experian, with a Nov. 28 enrollment deadline. The company has not confirmed how attackers gained access to its network or the size of the ransom demand.

    CyberGuy reached out to DaVita for comment but did not receive a response before publication.

    person typing on tablet

    A healthcare professional working on a tablet   (Kurt “CyberGuy” Knutsson)

    Who’s behind the DaVita breach

    Interlock, which first appeared in October 2024, has claimed responsibility for the DaVita attack and at least 23 other ransomware attacks, plus dozens more that remain unverified. Healthcare targets have included Texas Digestive Specialists, Kettering Health and Naper Grove Vision Care, all of which reported data breaches in 2025.

    WHAT IS ARTIFICIAL INTELLIGENCE (AI)?

    The DaVita incident is the second-largest U.S. healthcare ransomware attack by number of records this year, behind Frederick Health’s January breach. According to Comparitech, there have been 53 confirmed ransomware attacks on American healthcare providers in 2025 alone, compromising more than 3.2 million patient records.

    patient vitals

    A screen showing a patient’s vitals  (Kurt “CyberGuy” Knutsson)

    6 ways to protect yourself from DaVita ransomware attack

    The DaVita data breach exposed sensitive patient information. If you are affected or just want to stay one step ahead, these actions can help minimize your risk.

    1. Don’t click on suspicious links or attachments and use strong antivirus software

    The DaVita data breach likely gives attackers access to your contact details, which they can misuse. Avoid clicking on unexpected emails or messages, even if they look legitimate.

    The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe.

    Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com/LockUpYourTech

    2. Use a personal data removal service

    Since your personal details were exposed in the DaVita breach, you’re more vulnerable to targeted fraud. Consider using a personal data removal service to scrub your personal details from data broker websites that sell your information.

    While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time.

    Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

    Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan 

    GET FOX BUSINESS ON THE GO BY CLICKING HERE

    3. Use strong, unique passwords for every account

    Reusing passwords increases your risk. A single leaked password can unlock multiple accounts. Use a password manager to generate and store secure passwords.

    Check out the best expert-reviewed password managers of 2025 at Cyberguy.com/Passwords

    4. Sign up for an identity theft protection service

    DaVita is offering free identity theft and credit monitoring services to those affected by the breach. But even if you weren’t a victim of this specific breach, it’s still smart to protect yourself.

    Identity theft protection services can alert you to suspicious activity, help you recover if your identity is stolen and often provide tools to freeze or lock your credit. That prevents fraudsters from opening new accounts in your name, and you can lift the freeze temporarily when needed.

    See my tips and best picks on how to protect yourself from identity theft at  Cyberguy.com/IdentityTheft

    5. Enable two-factor authentication (2FA)

    Adding a second layer of login protection, like a text message or app-based code via 2FA, can make it much harder for DaVita attackers to access your accounts, even if your password is exposed.

    6. Monitor your credit and financial accounts

    Keep an eye out for strange charges or unfamiliar accounts. Set up alerts through your bank and review your credit report regularly to catch fraud early.

    CLICK HERE TO GET THE FOX NEWS APP

    Kurt’s key takeaway

    The investigation into the DaVita breach is ongoing, and the company has not disclosed how the hackers got in. Nearly a million people now face the possibility of their personal information being used for malicious purposes. Ransomware attacks on hospitals and clinics can lock critical systems, delay care and push providers back to paper records. In severe cases, they can force appointment cancellations and patient diversions and potentially endanger lives.

    Should U.S. law require healthcare organizations to meet stricter cybersecurity standards? Let us know by writing to us at Cyberguy.com/Contact

    Sign up for my FREE CyberGuy Report
    Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

    Copyright 2025 CyberGuy.com.  All rights reserved.  

    Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

    [ad_2]

    Source link

  • Iranian Hackers Tried to Give Hacked Trump Campaign Emails to Dems

    Iranian Hackers Tried to Give Hacked Trump Campaign Emails to Dems

    [ad_1]

    The week was dominated by news that thousands of pagers, walkie-talkies and other devices were exploding across Lebanon on Tuesday and Wednesday in an attack targeting the militant group Hezbollah. At least 32 people were killed, including at least four children, and more than 3,200 people were injured. The covert campaign has widely been attributed to Israel, though none of the country’s government agencies have commented.

    In addition to the carnage, the attacks have—seemingly by design—had the effect of sowing paranoia and fear, not just among members of Hezbollah but also in the general Lebanese public. Hardware and warfare experts say that the incident is unlikely to establish a global precedent that people’s most trusted communication devices and electronics, like smartphones, are rigged with explosives left and right. But it does create the potential to inspire copycats and puts defenders on notice that such attacks are possible.

    Researchers say that China’s 2023 Zhujian Cup, a hacking competition with ties to the country’s military, took the unusual step of requiring participants to keep the content of the exercise secret—and they may have been targeting a real victim as part of the event. Apple’s new stand-alone app Passwords that launched with iOS 18 may help solve your login problems. And a now-deleted post from billionaire Elon Musk that questioned why no one has attempted to assassinate Joe Biden and Kamala Harris renewed concerns this week that Musk is willing to inspire extremist violence and is a national security threat in the United States.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    Last month, media outlets, Microsoft, and Google warned that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump political campaigns, and that it had successfully stolen emails from the Trump campaign that were later shared with reporters. Now the FBI has chimed in with the added revelation that the same hackers also sent those stolen Trump communications to the Democrats, too—though for now there’s no sign that the Democrats solicited those emails from the Iranians or necessarily even received the Iranians’ message.

    Republicans were nonetheless quick to compare the news to accusations that the Trump campaign “colluded” with the Russian hackers, part of the Kremlin’s GRU military intelligence agency, who breached the Democratic National Committee and the Clinton Campaign in 2016 to carry out a hack-and-leak operation. In a statement, the Trump campaign demanded that the Democrats “must come clean on whether they used the hacked material.” The Harris campaign told CNN that it has cooperated with law enforcement and that it was “not aware of any material being sent directly to the campaign,” believing the emails to be spam or phishing attempts. “We condemn in the strongest terms any effort by foreign actors to interfere in US elections, including this unwelcome and unacceptable malicious activity,” Morgan Finkelstein, the national security spokesperson for the Harris campaign, told CNN.

    The FBI announced this week that it had taken down a network of hacked machines being secretly controlled by a Chinese state-sponsored hacking group known as Flax Typhoon. The botnet, made up of 260,000 routers and internet-of-things devices, was allegedly being run by a Chinese contractor known as the Beijing Integrity Technology Group, a rare instance of a known, publicly traded company operating essentially a massive collection of hacked devices on behalf of the Chinese state. The botnet, according to the FBI and security firm Black Lotus Labs, had been used to hack government agencies, defense contractors, telecoms, and other US and Taiwanese targets. At the time of its takedown, the botnet still encompassed 60,000 machines, making it the largest Chinese state-sponsored botnet ever, according to Black Lotus Labs.

    On Wednesday night, two young men were arrested after they allegedly stole hundreds of millions of dollars of cryptocurrency and spent the earnings on luxury cars, watches, jewelry, and designer handbags. In an unsealed indictment, the US Department of Justice charged Malone Lam, 20, known online as “Anne Hathaway” and Jeandiel Serrano, 21, aka “VersaceGod,” with stealing $243 million in cryptocurrency and laundering the proceeds through mixing services to conceal the origin.

    CoinDesk reported that the men allegedly tricked the heist’s victim, a creditor of the now-defunct trading firm Genesis, using a social engineering scam that led them to reset their Gemini two-factor authentication and transfer 4,100 bitcoin to a compromised wallet. An analysis of the transaction by blockchain investigator ZachXBT revealed that the $243 million was divided among multiple wallets and then distributed to over 15 exchanges.

    On Thursday, TechCrunch reported that Apple’s latest desktop operating system update, macOS 15 (Sequoia), breaks some functionality of major security tools made by CrowdStrike, SentinelOne, and Microsoft. It’s unclear what specifically in the update is causing the issues, but social media posts and internal Slack messages reviewed by the tech outlet show that the update has frustrated engineers working on macOS-focused security tools.

    A CrowdStrike sales engineer informed colleagues via Slack, as seen by TechCrunch, that the company would not be able to support Sequoia on day one, despite its usual practice of quickly supporting new OS releases. While they hope for a quick patch, they will likely need to scramble to resolve the issue with an update in their own code, assuming no immediate fix is available from Apple, which has not yet commented on the issue.

    Cryptocurrency theft has become practically a common-garden form of cybercrime. But one brutal gang took that form of thievery to a new level of cruelty and violence, breaking into a series of victims’ homes to threaten and extort them into handing over their crypto holdings, sometimes even resorting to kidnapping and torture. This week, that disturbing story came to a close with the sentencing of the group’s ring leader, a Florida man named Remy St. Felix, to 47 years in prison. St. Felix is one of 12 members of the gang to have now been charged, convicted, and sentenced. Prior to the home invasions that St. Felix led, another member of the group named Jarod Seemungal allegedly stole millions with more traditional crypto hacking techniques. But St. Felix’s more violent, offline extortion attempts netted his gang only around $150,000 in cryptocurrency before they were caught and sentenced to years behind bars. The lesson: Crime doesn’t pay—or at least, not the physical kind.

    [ad_2]

    Andy Greenberg, Lily Hay Newman, Dhruv Mehrotra

    Source link

  • Russian duo confess to cyber heist that forced $500 million in ransom payments

    Russian duo confess to cyber heist that forced $500 million in ransom payments

    [ad_1]

    Two Russian nationals pleaded guilty to their roles in ransomware attacks in the U.S., Asia, Europe and Africa for a notorious hacking gang known as LockBit.

    Ruslan Magomedovich Astamirov and Mikhail Vasiliev admitted they helped to deploy the ransomware variant, which first appeared in 2020. It soon became one of the most destructive in the world, leading to attacks against more than 2,500 victims and ransom payments of at least $500 million, according to the Justice Department. 

    The men pleaded guilty Thursday in federal court in Newark, New Jersey, where six people have been charged over LockBit attacks, including Dimitry Yuryevich Khoroshev, described by the US as the creator, developer and administrator of the group. US authorities are offering a reward of up to $10 million for his arrest. 

    Astamirov, 21, of the Chechen Republic, and Vasiliev, 34, of Bradford, Ontario, pleaded guilty to charges including conspiracy to commit computer fraud and abuse. 

    LockBit is the name of a ransomware variant, a type of malicious code that locks up computers before hackers demand a ransom to unlock them. Hacking gangs are often known by the name of their ransomware variant. LockBit successfully deployed a ransomware-as-a-service model, in which “affiliates” lease the malicious code and do the actual hacking, in exchange for paying the the gang’s leaders a cut of their illegal proceeds. Astamirov and Vasiliev were affiliates, according to the Justice Department.

    In recent years, the US and its allies have aggressively tried to curb ransomware attacks by sanctioning hackers or entities associated with them or disrupting the online infrastructure of cybercriminal gangs. But many hackers are located in places such as Russia, which provide them safe haven, making it difficult for Western law enforcement to arrest them.

    In February, US and UK authorities announced they disrupted LockBit operations, arresting alleged members, seizing servers and cryptocurrency accounts, and recovering decryption keys to unlock hijacked data. 

    “We’ve dealt significant blows to destructive ransomware groups like LockBit, as we did earlier this year, seizing control of LockBit infrastructure and distributing decryption keys to their victims,” said Deputy Attorney General Lisa Monaco, in a statement.

    Vasiliev deployed LockBit against at least 12 victims, including an educational facility in the UK and a school in Switzerland, the US said. He was arrested by Canadian authorities in November 2022 and extradited to the US in June. 

    Astamirov was arrested by the FBI last year. In May 2023, he agreed to an interview with FBI agents in Arizona, where they seized his electronic devices. He initially denied having anything to do with an email account through a Russian-based provider, but agents later found records related to it on his devices, according to the arrest complaint. Records showed that Astamirov used the email to “create multiple online accounts under names either fully or nearly identical to his own name,” the complaint said. 

    After August 2020, Astamirov executed cyberattacks on at least five victims, according to the FBI complaint. They included: businesses in France and West Palm Beach, Florida; a Tokyo firm, which refused to pay a ransom, leading the group to post stolen data on a “leak site” of extortion victims; a Virginia company that stopped an attack after 24,000 documents were stolen; and a Kenyan business that agreed to pay ransom after some of its stolen data was posted to the LockBit website. 

    Both are scheduled to be sentenced on Jan. 8, 2025. 

    Recommended Newsletter:

    CEO Daily provides key context for the news leaders need to know from across the world of business. Every weekday morning, more than 125,000 readers trust CEO Daily for insights about–and from inside–the C-suite. Subscribe Now.

    [ad_2]

    David Voreacos, Bloomberg

    Source link

  • Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages

    Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages

    [ad_1]

    A group calling itself “NullBulge” published a 1.1-TB trove of data late last week that it claims is a dump of Disney’s internal Slack archive. The data allegedly includes every message and file from nearly 10,000 channels, including unreleased projects, code, images, login credentials, and links to internal websites and APIs.

    The hackers claim they got access to the data from a Disney insider and named the alleged collaborator. A person with that name who lists Disney as their current employer did not return WIRED’s request for comment. Whether the hackers actually had inside help remains unconfirmed; they could also have plausibly used info-stealing malware to compromise an employee’s account. Disney did not confirm the breach or return multiple requests for comment about the legitimacy of the stolen data. A Disney spokesperson told the Wall Street Journal that the company “is investigating this matter.”

    The data, which appears to have been first published on Thursday, was posted on BreachForums and later taken down, but it is still live on mirror sites.

    Roei Sherman, field CTO at Mitiga Security, says he isn’t surprised that a giant like Disney could have a breach of this scale and significance. “Companies are getting breached all the time, especially data theft from the cloud and software-as-a-service platforms,” he says. “It is just easier for attackers and holds bigger rewards.”

    Sherman, who reviewed the data in the leak, added that “all of it looks legit—a lot of URLs, conversations of employees, some credentials, and other content.”

    The NullBulge site says that it is a “hacktivist group protecting artists’ rights and ensuring fair compensation for their work.” The group claims it hacks only targets that violate one of three “sins.” First: “We do not condone any form of promoting crypto currencies or crypto related products/services.” Second: “We believe AI-generated artwork harms the creative industry and should be discouraged.” And third: “Any theft from Patreons, other supportive artist platforms, or artists in general.”

    The group’s “wall of knowledge,” where it lists its data dumps, summarizes the philosophy: “What better way to punish someone than getting them in trouble eh?” Previously, the group targeted the Indian content creator Chief Shifter with a “first shaming.” Then in May, NullBulge posted a “second punch” and teased the Disney breach. “Here is one I never thought I would get this quickly … Disney. Yes, that Disney,” NullBuldge wrote, suggesting that the group may be a single person. “The attack has only just started, but we have some good shit. To show we are serious, here is 2 files from inside.”

    In addition to the alleged Slack data, NullBulge posted what appears to be detailed information about the individual whom they claim provided the insider access and data. The leak includes medical records and other personally identifying information, plus the alleged contents of the alleged Disney employee’s 1Password password manager. NullBulge claims to have doxxed the individual in retaliation for cutting off communication and access, although whether the employee actually collaborated with the group in the first place remains unconfirmed.

    Security researchers have long warned about corporate Slack accounts as a treasure trove for attackers if compromised. The popular team communication platform is owned by Salesforce and is used by an array of prominent organizations, including IBM, Capital One, Uber, and Disney rival Paramount.

    “Disney will probably be targeted a lot more now by opportunistic threat actors,” Sherman warns.

    [ad_2]

    Lily Hay Newman

    Source link

  • Virtually all of AT&T’s wireless customers impacted by new hacking incident

    Virtually all of AT&T’s wireless customers impacted by new hacking incident

    [ad_1]

    AT&T is reporting it was the victim of what is likely one of the largest data breaches of the year, as hackers obtained phone call and text message records of “nearly all of AT&T’s cellular customers,” the company said Friday.

    The hack occurred in April on a third-party cloud platform, AT&T said, and impacted people who were customers from May 1, 2022 to October 31, 2022 as well as on January 2, 2023. The data shows other phone numbers that AT&T customers interacted with, but not the content of the calls and messages, nor time stamps.

    “We hold ourselves to a high standard and commit to delivering the experience that you deserve,” the company wrote. “We constantly evaluate and enhance our security to address changing cybersecurity threats and work to create a secure environment for you. We invest in our network’s security using a broad array of resources including people, capital, and innovative technology advancements.”

    AT&T, which has nearly 90 million cellphone subscribers, said the hackers also did not gain access to data such as Social Security numbers, dates of birth or other personally identifiable information, including names. However, linking a name that is associated with a phone number is a fairly easy task online.

    Affected customers, both current and former, will be contacted directly by the company, informing them of the breach.

    AT&T said it is cooperating with law enforcement and at least one person has already been apprehended in conjunction with the data breach.

    News of the most recent hack follows a separate data breach in March, which saw the passcodes of 7.6 million customers compromised. The company forced a reset for impacted individuals at the time.

    Subscribe to the Fortune Next to Lead newsletter to get weekly strategies on how to make it to the corner office. Sign up for free.

    [ad_2]

    Chris Morris

    Source link

  • Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison

    Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison

    [ad_1]

    For more than a decade, Vyacheslav Igorevich Penchukov—a Ukrainian who used the online hacker name “Tank”—managed to evade cops. When FBI and Ukrainian officials raided his Donetsk apartment in 2010, the place was deserted and Penchukov had vanished. But the criminal spree came to a juddering halt at the end of 2022, when he traveled to Switzerland, was arrested, then was extradited to the United States.

    Today, at a US federal court in Lincoln, Nebraska, a judge sentenced Penchukov to two concurrent nine-year sentences, after he pleaded guilty to two charges of conspiracy to participate in racketeering and a conspiracy to commit wire fraud. United States District Judge John M. Gerrard also ordered Penchukov to pay more than $73 million, according to court records. The court also ordered three years of supervised release for each count and said they should run concurrently.

    Both charges carried a maximum sentence of up to 20 years each. According to court documents, however, the US government and Penchukov’s lawyers both requested a less severe sentence following him signing a plea agreement in February. It is unclear what the terms of the plea deal include. At the time, documents show, Penchukov could also face having to repay up to $70 million—less than the combined amount he’s ordered to pay in restitution and forfeited funds. “I understand this, but I don’t have such amounts of money,” he said in court earlier this year.

    The US prosecution of Penchukov—who has been on the FBI’s “most wanted” cyber list for more than a decade—is a rare blow against one of the most well-connected leaders of a prolific 2010s cybercrime gang. It also highlights the ongoing challenges Western law enforcement officials face when taking action against Eastern European cybercriminals—particularly those based in Russia or Ukraine, which do not have extradition agreements with the US.

    Ahead of the sentencing, the Department of Justice refused to comment on the case, and the FBI and Penchukov’s lawyers did not respond to WIRED’s requests for comment.

    When the Ukrainian pleaded guilty in February—a number of charges were dropped following him signing the plea agreement—he admitted to being one of the leaders of the Jabber Zeus hacking group, starting in 2009, that used the Zeus malware to infect computers and steal people’s bank account information. The group used the details to log in to accounts, withdraw money, and then send it to various money mules—stealing tens of millions from small US and European businesses.

    “The defendant played a crucial role, a leadership role, in this scheme by directing and coordinating the exchange of stolen banking credentials and money mules,” prosecutors said in court earlier this year. They would steal thousands from victim companies, often draining their accounts.

    Penchukov, who was also a well-known DJ in Ukraine, also admitted to a key role organizing the IcedID (also known Bokbot) malware, which collected the victim’s financial details and allowed ransomware to be deployed on systems. He was involved from November 2018 to at least February 2021, officials say. Investigators found he kept a spreadsheet detailing the $19.9 million income IcedID made in 2021.

    [ad_2]

    Matt Burgess

    Source link

  • Julian Assange Released From Prison in Plea Deal With U.S.

    Julian Assange Released From Prison in Plea Deal With U.S.

    [ad_1]

    WikiLeaks co-founder Julian Assange has been released from prison in the UK and will be allowed to return to his home country of Australia after he pleads guilty to illegally disseminating national security material in the U.S., according to a surprising new report from NBC News.

    Will The MSI Claw Scratch Your Handheld Gaming Itch?

    Court documents filed Monday by the U.S. federal government in the Northern Mariana Islands suggest the plea deal is imminent, though the New York Times notes everything still needs to be approved by a judge. Assange previously faced 170 years in prison.

    Why have the court documents been filed in the Northern Mariana Islands, a U.S. commonwealth in the Pacific? According to the Associated Press, it’s due to Assange’s “opposition to traveling to the continental U.S. and the court’s proximity to Australia.”

    The 52-year-old has been held in London’s high-security Belmarsh Prison for the past five years, a period that follows a years-long saga that saw Assange holed up in the Ecuadorian embassy while first claiming asylum in 2012. Assange was physically dragged out of the embassy by British authorities in April 2019.

    “Julian Assange is free,” the WikiLeaks X account tweeted on Monday around 8:00 p.m. ET. “He left Belmarsh maximum security prison on the morning of 24 June, after having spent 1901 days there. He was granted bail by the High Court in London and was released at Stansted airport during the afternoon, where he boarded a plane and departed the UK.”

    WikiLeaks also published a video of Assange, embedded below, showing him reading paperwork and appearing to board a plane, presumably bound for the Northern Mariana Islands to formally enter his plea.

    The Times explains that a plea deal was deemed acceptable to top officials at the Justice Department because Assange had already served five years in the UK while awaiting extradition to the U.S.

    The original charges against Assange were brought by the U.S. Department of Justice under President Donald Trump in 2019, despite the fact that Trump would often talk about how much he loved WikiLeaks. Trump failed to pardon Assange before leaving office, something many Assange backers insisted the former president would do.

    Assange faced 18 counts of violating the Espionage Act along with charges related to criminal hacking, but the Times reports he’ll only plead guilty to one charge. Assange allegedly provided instructions to whistleblower Chelsea Manning on how to access classified computers, which is what experts claimed was the differentiating factor that made his conduct more serious than a typical journalist who simply disseminates sensitive information.

    Some of the documents were published by WikiLeaks in 2011 under the name “Collateral Murder,” including a video from 2007 that showed U.S. forces in Iraq killing several civilians, including two journalists from Reuters.

    The plea deal would put an end to the incredibly long saga that has engulfed Assange for over a decade now, though it’s not clear whether the WikiLeaks founder would immediately get back to work. Assange started as a celebrity among lefty and libertarian circles in the early 2010s before becoming celebrated more by the political right-wing after furthering conspiracy theories that supported Donald Trump in 2016.

    Stella Assange, Julian’s wife, released a video statement along with WikiLeaks editor-in-chief Kristinn Hrafnsson which appears to have been shot shortly before Julian was actually released.

    “I just came out of Belmarsh prison and what I hope is my last visit to see Julian here in this prison where he spent five years, two months and two weeks. And if you’re seeing this, it means he is out,” Hrafnsson says in the video.

    Stella Assange says that a crowdfunding campaign would be launched to support Julian’s “recovery” and health care costs.

    SA KH statement 260624

    The Australian government and Prime Minister Anthony Albanese made repeated pleas to the White House for Assange’s release, though it was never clear whether President Joe Biden was going to intervene in the case. Assange has reportedly suffered various health issues in prison, though the short video clip released by WikiLeaks appears to show Assange is visibly healthy.

    [ad_2]

    Matt Novak

    Source link

  • Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

    Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

    [ad_1]

    It’s possible the ShinyHunter hackers did not directly hack the EPAM worker, and simply gained access to the Snowflake accounts using usernames and passwords they obtained from old repositories of credentials stolen by info stealers. But, as Reddington points out, this means that anyone else can sift through those repositories for these and other credentials stolen from EPAM accounts. Reddington says they found data online that was used by nine different infostealers to harvest data from the machines of EPAM workers. This raises potential concerns about the security of data belonging to other EPAM customers.

    EPAM has customers across various critical industries, including banks and other financial services, health care, broadcast networks, pharmaceutical, energy and other utilities, insurance, and software and hi-tech—the latter customers include Microsoft, Google, Adobe, and Amazon Web Services. It’s not clear, however, if any of these companies have Snowflake accounts to which EPAM workers have access. WIRED also wasn’t able to confirm whether Ticketmaster, Santander, Lending Tree, or Advance AutoParts are EPAM customers.

    The Snowflake campaign also highlights the growing security risks from third-party companies in general and from infostealers. In its blog post this week, Mandiant suggested that multiple contractors were breached to gain access to Snowflake accounts, noting that contractors—often known as business process outsourcing (BPO) companies—are a potential gold mine for hackers, because compromising the machine of a contractor that has access to the accounts of multiple customers can give them direct access to many customer accounts.

    “Contractors that customers engage to assist with their use of Snowflake may utilize personal and/or non-monitored laptops that exacerbate this initial entry vector,” wrote Mandiant in its blog post. “These devices, often used to access the systems of multiple organizations, present a significant risk. If compromised by infostealer malware, a single contractor’s laptop can facilitate threat actor access across multiple organizations, often with IT and administrator-level privileges.”

    The company also highlighted the growing risk from infostealers, noting that the majority of the credentials the hackers used in the Snowflake campaign came from repositories of data previously stolen by various infostealer campaigns, some of which dated as far back as 2020. “Mandiant identified hundreds of customer Snowflake credentials exposed via infostealers since 2020,” the company noted.

    This, accompanied by the fact that the targeted Snowflake accounts didn’t use MFA to further protect them, made the breaches in this campaign possible, Mandiant notes.

    Snowflake’s CISO, Brad Jones, acknowledged last week that the lack of multifactor authentication enabled the breaches. In a phone call this week, Jones told WIRED that Snowflake is working on giving its customers the ability to mandate that users of their accounts employ multifactor authentication going forward, “and then we’ll be looking in the future to [make the] default MFA,” he says.

    [ad_2]

    Kim Zetter

    Source link

  • Live Nation reveals ‘a criminal threat actor’ offered to sell Ticketmaster data on the dark web, while reports say hackers seek $500,000 for customer info

    Live Nation reveals ‘a criminal threat actor’ offered to sell Ticketmaster data on the dark web, while reports say hackers seek $500,000 for customer info

    [ad_1]

    Live Nation is investigating a data breach at its Ticketmaster subsidiary,which dominates ticketing for live events in the United States.

    Live Nation, based in Beverly Hills, California, said in a regulatory filing Friday that on May 27 “a criminal threat actor” offered to sell Ticketmaster data on the dark web.

    Other media reports say a hacking group named ShinyHunters claimed responsibility for the breach in an online forum and was seeking $500,000 for the data, which reportedly includes names, addresses, phone numbers and some credit card details of millions of Ticketmaster customers.

    Live Nation and Ticketmaster did not immediately respond to requests for comment.

    In a filing with the U.S. Securities and Exchange Commission, Live Nation said it was “working to mitigate risk to our users” and was cooperating with law enforcement officials. It said the breach was unlikely to have “a material impact on our overall business operations.”

    On May 23, the U.S. Justice Department sued Live Nation and Ticketmaster,accusing them of running an illegal monopoly over live events in America. The department asked a court to break up the system that it said limits competition and drives up prices for fans.

    Subscribe to the CFO Daily newsletter to keep up with the trends, issues, and executives shaping corporate finance. Sign up for free.

    [ad_2]

    The Associated Press

    Source link

  • U.S. Pinky Swears Not to Kill Julian Assange If He’s Extradited

    U.S. Pinky Swears Not to Kill Julian Assange If He’s Extradited

    [ad_1]

    U.S. officials pledged not to pursue the death penalty against Julian Assange if he’s extradited from the UK to face charges related to his publication of documents highly embarrassing to the U.S. government, according to a report from Australia’s ABC News Tuesday. But that will be cold comfort to some in the British legal system who have argued U.S. prisons are so inherently cruel that sending Assange to America, even with such a guarantee, would still amount to an inhumane act.

    Why Was Now the Right Time to Come Back and Do 28 Years Later?

    American officials at the U.S. embassy in London reportedly sent a note to British officials on Tuesday in a bid to address several concerns about what may happen to Assange if he’s ultimately extradited to the U.S., according to several news outlets. The 52-year-old WikiLeaks co-founder faces computer hacking and espionage charges first brought by President Donald Trump’s Justice Department that have been continued into the Biden era.

    President Biden signaled last week he’d be open to dropping the case against Assange, saying “We’re considering it” when asked about a request from the Australian government. Assange is an Australian citizen, though he hasn’t lived in the country for some time and one of the questions addressed in the diplomatic note is whether the First Amendment applies to people outside the U.S.—an issue the U.S. insists Assange’s lawyers can “raise,” without elaborating too much.

    Megan Specia, a reporter for the New York Times in London, tweeted the three-page note on Tuesday including two carefully-worded assurances, quoted below:

    1. ASSANGE will not be prejudiced by reason of his nationality with respect to which defenses he may seek to raise at trial and at sentencing. Specifically, if extradited, ASSANGE will have the ability to raise and seek to rely upon at trial (which includes any sentencing hearing) the rights and protections given under the First Amendment of the Constitution of the United States. A decision as to the applicability of the First Amendment is exclusively within the purview of the U.S. Courts.

    2. A sentence of death will neither be sought nor imposed on ASSANGE. The United States is able to provide such assurance as ASSANGE is not charged with a death-penalty eligible offense, and the United States assures that he will not be tried for a death-eligible offense.

    Assange has been held in Belmarsh Prison in London since 2019 and a British judge ruled in 2021 that he shouldn’t be extradited due to America’s extremely brutal prison system. The UK’s Judge Vanessa Baraitser cited Assange’s depressive state and risk of suicide in the conditions he would face in the U.S. when she first argued Assange shouldn’t be extradited in a surprise ruling.

    “Mr. Assange faces the bleak prospect of severely restrictive detention conditions designed to remove physical contact and reduce social interaction and contact with the outside world to a bare minimum. He faces these prospects as someone with a diagnosis of clinical depression and persistent thoughts of suicide,” Judge Baraitser wrote back in 2021.

    The judge’s ruling also noted that Assange could be stuck in solitary confinement for 23 hours per day while awaiting trial in the U.S., a punishment widely considered by other wealthy countries to be torture.

    Julian Assange’s wife, Stella Assange, released a statement on Tuesday in response to news of the diplomatic note sent by the U.S. to the UK, calling them “blatant weasel words” that don’t actually guarantee Julian can claim protections under the First Amendment as a foreign citizen.

    “The diplomatic note does nothing to relieve our family’s extreme distress about his future—his grim expectation of spending the rest of his life in isolation in U.S. prison for publishing award-winning journalism,” Stella Assange said, according to the AFP.

    Lawyers for the U.S. and Assange are scheduled to reconvene in a British court on May 20, though it’s still unclear how many chances the WikiLeaks co-founder may have to appeal any decision that could see him finally shipped to the U.S.

    [ad_2]

    Matt Novak

    Source link

  • Change Healthcare’s New Ransomware Nightmare Goes From Bad to Worse

    Change Healthcare’s New Ransomware Nightmare Goes From Bad to Worse

    [ad_1]

    Change Healthcare is facing a new cybersecurity nightmare after a ransomware group began selling what it claims is Americans’ sensitive medical and financial records stolen from the health care giant.

    “For most US individuals out there doubting us, we probably have your personal data,” the RansomHub gang said in an announcement seen by WIRED.

    The stolen data allegedly includes medical and dental records, payment claims, insurance details, and personal information like Social Security numbers and email addresses, according to screenshots. RansomHub claimed it had health care data on active-duty US military personnel.

    The sprawling theft and sale of sensitive health care data represents a dramatic new form of fallout from the February cyberattack on Change Healthcare that crippled the company’s claims-payment operations and sent the US health care system into crisis as hospitals struggled to stay open without regular funding.

    Change Healthcare, a subsidiary of UnitedHealth Group, previously acknowledged that a ransomware gang known as BlackCat or AlphV breached its systems, and told WIRED last week that it is investigating RansomHub’s claims about possessing the company’s stolen data. Change Healthcare did not immediately respond to a request for comment about the group’s alleged sale of its data.

    The wide variety of patient data that RansomHub claims to be selling is a testament to Change Healthcare’s role as a critical intermediary between insurers and health care providers, facilitating payments between both parties and collecting reams of sensitive information about patients and their medical procedures in the process.

    Among the sample records that RansomHub posted are a list of open claims handled by the company’s EquiClaim subsidiary that includes patient and provider names; a hospital record for a 74-year-old woman in Tampa, Florida; and part of a database record related to US military service members’ health care.

    RansomHub said it would allow individual insurance companies that worked with Change Healthcare and had their data compromised to pay ransoms to prevent the sale of their records. It specified that it was selling data belonging to MetLife, CVS Caremark, Davis Vision, Health Net, and Teachers Health Trust.

    Change Healthcare’s “processing of sensitive data for all of these companies is just something unbelievable,” RansomHub said in its announcement.

    Most firms whose data RansomHub claims to possess did not immediately respond to WIRED’s request for comment.

    Mike DeAngelis, the executive director of corporate communications for CVS Health says the company is “aware of unsubstantiated claims from threat actors that confidential data, including personal information of patients and members belonging to multiple organizations, was accessed as part of Change Healthcare’s cyber security incident.”

    “We are closely monitoring Change Healthcare’s response to this issue and will provide updates with more information as appropriate,” DeAngelis adds, noting that Change Healthcare has not yet confirmed that patient data “was impacted by this incident.”

    Brett Callow, a threat analyst at the security firm Emsisoft who closely tracks ransomware gangs, says the new sale of stolen data was probably “less about actually selling the data” and more about putting Change Healthcare—and the partner companies whose records it failed to protect—“under additional pressure to pay.”

    Change Healthcare appears to have paid a $22 million ransom to AlphV to stop it from leaking terabytes of stolen data.

    Two months into the crisis spawned by the ransomware attack, Change Healthcare has faced mounting losses. The company recently reported spending $872 million responding to the incident as of March 31.

    At the same time, Change is under increasing pressure from lawmakers and regulators to explain its cybersecurity lapse and the steps it’s taking to prevent another hack.

    A subcommittee of the House Energy and Commerce Committee held a hearing on the health sector’s cyber posture on Tuesday, with key lawmakers saying they were disappointed that UnitedHealth Group declined to make an executive available to testify. And the Department of Health and Human Services is investigating whether Change Healthcare’s failure to prevent hackers from accessing and stealing its data violated federal data-security rules.

    Updated 4/16/2024, 5:38 pm ET: Added additional details about the firms whose data RansomHub claims to possess.

    [ad_2]

    Eric Geller

    Source link

  • Multiverse, the apprenticeship unicorn, acquires Searchlight to put a focus on AI | TechCrunch

    Multiverse, the apprenticeship unicorn, acquires Searchlight to put a focus on AI | TechCrunch

    [ad_1]

    Multiverse, the U.K. unicorn that builds apprenticeship programs for people to learn technology skills while on the job, has made an acquisition as it aims to skill up itself. The company has bought Searchlight, a startup and recruitment platform that uses artificial intelligence-based technology to source talent. The plan will be to use Searchlight’s tech to build new AI products for Multiverse to expand its professional training services.

    “Searchlight’s AI, platform, and exceptional talent will allow us to better diagnose the skills needed within companies and deliver impactful solutions,” said Multiverse’s founder and CEO Euan Blair in a statement. “Combining our scale and world-class learning with Searchlight’s technology and team will ensure even more companies and individuals benefit.”

    Searchlight was co-founded by twin sisters Kerry and Anna Wang (respectively CEO and CTO). Its existing customers (which include Udemy, Zapier, Talkdesk and other tech companies) will continue to be served until the ends of their contracts. After that, the plan will be to wind down Searchlight’s recruitment services as they focus on Multiverse’s business.

    The deal underscores the increasing role that AI is playing in the worlds of work and education. Some people will use AI to speed up what they do; others will claim that AI is taking over certain jobs altogether. This acquisition addresses a third area where AI is appearing: to help build more efficient professional training services to fill recruitment gaps.

    AI and recruitment have at times been strange bedfellows. Amazon famously once had to scrap an AI recruitment tool after it was found to be inherently biased against women for technical roles, due to being trained on typical recruitment data, which more commonly came from men. But technology — and more pointedly awareness around how models are being built and trained — have come a long way since then, Searchlight’s CEO told TechCrunch.

    “Our AI model is able to identify a good match for a role four times greater than a traditional interview,” Wang said. “We’re solving for the exact same problem, which is increased equitable access to economic opportunity for everyone. Multiverse had a great business but they’re looking to expand into an all in one workforce development platform.” Kerry will become director of product at Multiverse, while Anna will become head of AI.

    Founded and led by Blair (the son of former U.K. Prime Minister Tony Blair and high-profile barrister Cherie Booth Blair), Multiverse currently has around 1,000 customers, with its list of past and present clients including Cisco, government organizations, financial services and industrial companies.

    While Multiverse first made its name with a focus on apprenticeships as a viable alternative for people looking to build careers in fast-moving fields like technology, it has since expanded to cover professional training for people already employed. Multiverse has some AI-based services live now, said Ujjwal Singh, the company’s CTO and CPO: it already offers a personalized AI assistant coach for users. Now it clearly wants to keep layering in more technology to improve the overall platform, and its credibility with a set of customers intent on buying and using what appear to be the most modern services they can.

    Financial terms of the deal are not being disclosed, but for some context, the Wang sisters — both impressive and accomplished Stanford grads — took their startup through Y Combinator in 2018. Altogether Searchlight raised nearly $20 million, but that was primarily via a fundraise dating several years back, a $17 million Series A in 2021. Its long list of investors included a number of prominent names such as Accel, Founders Fund, Emerson Collective, and Shasta Ventures. Pitchbook estimated its valuation in 2021 at $64 million.

    Multiverse, meanwhile, was last valued at $1.7 billion in 2022 and has been on a fundraising tear over the years, raising several hundred million dollars from investors that include General Catalyst and Lightspeed. This is the company’s second acquisition after it acquired another YC company, Eduflow, last year.

    From what we understand, investors are “happy” with the outcome. “From the start, Anna and Kerry have been thoughtful about building Searchlight’s AI models to complement their vision,” Keith Rabois, who led the Series A, said in a statement provided to TechCrunch. “Searchlight’s differentiated technology is a magnet for innovative companies like Multiverse. I am excited by the upside of this acquisition for Searchlight and Multiverse.”

    [ad_2]

    Ingrid Lunden

    Source link

  • A Vigilante Hacker Took Down North Korea’s Internet. Now He’s Taking Off His Mask

    A Vigilante Hacker Took Down North Korea’s Internet. Now He’s Taking Off His Mask

    [ad_1]

    “That’s not nice, and it’s not a good norm,” says Schneider. She says that much of the US government’s slow approach to cyberattacks stems from its care to ensure it avoids unintentionally hitting civilians as well as breaking international law or triggering dangerous blowback.

    Still, Schneider concedes that Caceres and Angus have a point: The US could be using its cyber forces more, and some of the explanations for why it doesn’t amount to bureaucracy. “There are good reasons, and then there are bad reasons,” says Schneider. “Like, we have complicated organizational politics, we don’t know how to do things differently, we’re bad at using this type of talent, we’ve been doing it this way for 50 years, and it worked well for dropping bombs.”

    America’s offensive hacking has, by all appearances, gotten less aggressive and less nimble over the past half decade, Schneider points out. Starting in 2018, for instance, General Paul Nakasone, then the head of Cyber Command, advocated a “defend forward” strategy aimed at taking cyber conflict to the enemy’s network rather than waiting for it to occur on America’s turf. In those years, Cyber Command launched disruptive hacking operations designed to cripple Russia’s disinformation-spouting Internet Research Agency troll farm and take down the infrastructure of the Trickbot ransomware group, which some feared at the time might be used to interfere in the 2020 election. Since then, however, Cyber Command and other US military hackers appear to have gone relatively quiet, often leaving the response to foreign hackers to law enforcement agencies like the FBI, which face far more legal constraints.

    Caceres isn’t entirely wrong to criticize that more conservative stance, says Jason Healey, who until February served as a senior cybersecurity strategist at the US Cybersecurity and Infrastructure Security Agency. He responds to Caceres’ cyberhawk arguments by citing the Subversive Trilemma, an idea laid out in a 2021 paper by the researcher Lennart Maschmeyer: Hacking operations have to choose among intensity, speed, and control. Even in earlier, more aggressive years, US Cyber Command has tended to turn up the dial for control, Healey says, prioritizing it over those other variables. But he notes there may in fact be certain targets—such as ransomware gangs or hackers working for Russia’s no-holds-barred GRU military intelligence agency—who might warrant resetting those dials. “For those targets,” says Healey, “you really can release the hounds.”

    P4x Is Dead, Viva P4x

    As for Caceres himself, he says he’s not opposed to American hacking agencies taking a conservative approach to limiting their damage or protecting civilians—as long as they take action. “There’s being conservative,” he says, “and then there’s doing fuck all.”

    On the argument that more aggressive cyberattacks would lead to escalation and counterattacks from foreign hackers, Caceres points to the attacks those foreign hackers are already carrying out. The ransomware group AlphV’s catastrophic attack on Change Healthcare in February, for instance, crippled medical claim platforms for hundreds of providers and hospitals, effects about as disruptive for civilians as any cyberattack can be. “That escalation is already happening,” Caceres says. “We’re not doing anything, and they’re still escalating.”

    Caceres says he hasn’t entirely given up on convincing someone in the US government to adopt his more gloves-off approach. Ditching the P4x handle and revealing his real name is, in some sense, his last-ditch attempt to get the US government’s attention and restart the conversation.

    But he also says he won’t be waiting for the Pentagon’s approval before he continues that approach on his own. “If I keep going with this alone, or with just a few people that I trust, I can move a lot faster,” he says. “I can fuck shit up for the people who deserve it, and I don’t have to report to anyone.”

    The P4x handle may be dead, in other words. But the P4x doctrine of cyberwarfare lives on.

    [ad_2]

    Andy Greenberg

    Source link

  • The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

    The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

    [ad_1]

    Ultimately, Scott argues that those three years of code changes and polite emails were likely not spent sabotaging multiple software projects, but rather building up a history of credibility in preparation for the sabotage of XZ Utils specifically—and potentially other projects in the future. “He just never got to that step because we got lucky and found his stuff,” says Scott. “So that’s burned now, and he’s gonna have to go back to square one.”

    Technical Ticks and Time Zones

    Despite Jia Tan’s persona as a single individual, their yearslong preparation is a hallmark of a well-organized state-sponsored hacker group, argues Raiu, the former Kaspersky lead researcher. So too are the technical hallmarks of the XZ Utils malicious code that Jia Tan added. Raiu notes that, at a glance, the code truly looks like a compression tool. “It’s written in a very subversive manner,” he says. It’s also a “passive” backdoor, Raiu says, so it wouldn’t reach out to a command-and-control server that might help identify the backdoor’s operator. Instead, it waits for the operator to connect to the target machine via SSH and authenticate with a private key—one generated with a particularly strong cryptographic function known as ED448.

    The backdoor’s careful design could be the work of US hackers, Raiu notes, but he suggests that’s unlikely, since the US wouldn’t typically sabotage open source projects—and if it did, the National Security Agency would probably use a quantum-resistant cryptographic function, which ED448 is not. That leaves non-US groups with a history of supply chain attacks, Raiu suggests, like China’s APT41, North Korea’s Lazarus Group, and Russia’s APT29.

    At a glance, Jia Tan certainly looks East Asian—or is meant to. The time zone of Jia Tan’s commits are UTC+8: That’s China’s time zone, and only an hour off from North Korea’s. However, an analysis by two researchers, Rhea Karty and Simon Henniger, suggests that Jia Tan may have simply changed the time zone of their computer to UTC+8 before every commit. In fact, several commits were made with a computer set to an Eastern European or Middle Eastern time zone instead, perhaps when Jia Tan forgot to make the change.

    “Another indication that they are not from China is the fact that they worked on notable Chinese holidays,” say Karty and Henniger, students at Dartmouth College and the Technical University of Munich, respectively. They note that Jia Tan also didn’t submit new code on Christmas or New Year’s. Boehs, the developer, adds that much of the work starts at 9 am and ends at 5 pm for Eastern European or Middle Eastern time zones. “The time range of commits suggests this was not some project that they did outside of work,” Boehs says.

    Though that leaves countries like Iran and Israel as possibilities, the majority of clues lead back to Russia, and specifically Russia’s APT29 hacking group, argues Dave Aitel, a former NSA hacker and founder of the cybersecurity firm Immunity. Aitel points out that APT29—widely believed to work for Russia’s foreign intelligence agency, known as the SVR—has a reputation for technical care of a kind that few other hacker groups show. APT29 also carried out the Solar Winds compromise, perhaps the most deftly coordinated and effective software supply chain attack in history. That operation matches the style of the XZ Utils backdoor far more than the cruder supply chain attacks of APT41 or Lazarus, by comparison.

    “It could very well be someone else,” says Aitel. “But I mean, if you’re looking for the most sophisticated supply chain attacks on the planet, that’s going to be our dear friends at the SVR.”

    Security researchers agree, at least, that it’s unlikely that Jia Tan is a real person, or even one person working alone. Instead, it seems clear that the persona was the online embodiment of a new tactic from a new, well-organized organization—a tactic that nearly worked. That means we should expect to see Jia Tan return by other names: seemingly polite and enthusiastic contributors to open source projects, hiding a government’s secret intentions in their code commits.

    Updated 4/3/2024 at 12:30 pm ET to note the possibility of Israeli or Iranian involvement.

    [ad_2]

    Andy Greenberg, Matt Burgess

    Source link

  • Chinese Hackers Charged in Decade-Long Global Spying Rampage

    Chinese Hackers Charged in Decade-Long Global Spying Rampage

    [ad_1]

    For years, China’s state-backed hackers have stolen huge troves of company secrets, political intelligence, and the personal information of millions of people. On Monday, officials in the United States and United Kingdom expanded the long list of hacking allegations, claiming China is responsible for breaching the UK’s elections watchdog and accessing 40 million people’s data. The countries also issued a raft of criminal charges and sanctions against a separate Chinese group following a multiyear hacking rampage.

    In August last year, the UK’s Electoral Commission revealed “hostile actors” had infiltrated its systems in August 2021 and could potentially access sensitive data for 14 months until they were booted out in October 2022. The deputy prime minister, Oliver Dowden, told lawmakers on Monday that a China state-backed actor was responsible for the attack. In addition, Dowden said, the UK’s intelligence services have determined that Chinese hacking group APT31 targeted the email accounts of politicians in 2021.

    “This is the latest in a clear pattern of malicious cyber activity by Chinese state-affiliated organizations and individuals targeting democratic institutions and parliamentarians in the UK and beyond,” Dowden said in the UK’s House of Commons. The revelations were accompanied by the UK sanctioning two individuals and one company linked to APT31.

    Alongside the UK’s announcement on Monday, the US Department of Justice and Department of the Treasury’s Office of Foreign Assets Control unveiled further action against APT31, also known as Violet Typhoon, Bronze Vinewood, and Judgement Panda, including charging seven Chinese nationals with the conspiracy to commit computer intrusions and wire fraud.

    The DOJ claims the hacking group, which has been linked back to China’s Ministry of State Security (MSS) spy agency, has spent 14 years targeting thousands of critics, businesses, and political entities around the world in widespread espionage campaigns. This includes posing as journalists to send more than 10,000 malicious emails that tracked recipients, compromising email accounts, cloud storage accounts, telephone call records, home routers, and more. The spouses of one high-ranking White House official and those of multiple US senators were also targeted, the DOJ says.

    “These allegations pull back the curtain on China’s vast illegal hacking operation that targeted sensitive data from US elected and government officials, journalists and academics; valuable information from American companies; and political dissidents in America and abroad,” Breon Peace, a US attorney for the Eastern District of New York, said in a statement. “Their sinister scheme victimized thousands of people and entities across the world, and lasted for well over a decade.”

    The moves come as countries increasingly warn of an increase in China-linked espionage, during a year when more than 100 countries will host major elections. Statements from officials focus on the impact of the hacking activity on democratic processes, including the targeting of elected officials around the world and the compromising of pro-democracy activists and lawmakers in Hong Kong. However, the disclosures also coincide with continued jostling from Western politicians over pro- or anti-China stances, including the proposed sale of TikTok to a US company, which could result in a ban on the popular app if the sale fails to go through.

    [ad_2]

    Matt Burgess

    Source link

  • Researchers pose as hackers, exposing security flaw that could open your hotel-room door

    Researchers pose as hackers, exposing security flaw that could open your hotel-room door

    [ad_1]

    There is a new warning for travelers after researchers, posed as hackers, expose a security flaw that could open millions of hotel-room doors.

    The good news is, they’re helping to fix the problem after Wired Magazine reported about the security vulnerabilities within the lock’s encryption system.

    “With just two taps, they can open these doors in seconds,” said Andy Greenberg, a senior writer at Wired.

    The researchers said using a key card, they cracked the code and essentially made a “master key.”

    “These security researchers have actually exposed this and that’s a good thing because now dormakaba, the lock manufacturer, can start the process of trying to update all these locks around the world and fix this,” Greenberg said.

    They say the lock company has updated about one-third of the locks so far.

    ALSO SEE: New Jersey woman who ‘fought for her life’ during trip to Turks and Caicos hopes to warn travelers

    “Our customers and partners all take security very seriously, and we are confident all reasonable steps will be taken to address this matter,” dormakaba said in a statement.

    “We also have to consider that they may have actually done it in the past these more professional, profit-motivated, or you know, politically-motivated hackers and they may have even exploited these locks in secret to get into hotel rooms for profit, or even for kind of intelligence purposes,” Greenberg added.

    How to protect yourself

    How can hotel guests protect themselves? ABC News was told the locks in question have a round card reader with a wavy line cutting through it.

    Apps can help you determine if it’s been updated.

    If it hasn’t been, experts say the deadbolt won’t help since it’s connected to the keycard, so use your door’s key chain instead.

    The researchers have not revealed the exact method of how they made a master key, being careful as to not allow the information to get into the wrong hands.

    Copyright © 2024 ABC News Internet Ventures.

    [ad_2]

    ABCNews

    Source link