ReportWire

Tag: Hacking

  • LEO Access to Binance Data Allegedly Compromised By Hacker

    LEO Access to Binance Data Allegedly Compromised By Hacker

    [ad_1]

    Earlier this week, a BreachForums user by the name of Miembro announced the sale of access to a Binance data request portal, built and maintained to accommodate police officers and government officials worldwide in their attempts to track down cybercriminals.

    The sale has since been paused, owing to a blunder involving a crypto mixer being used by a buyer to send funds to the seller turned out to be an invalid address.

    Access to De-Anonymized Data

    However, the sale will allegedly resume in about a week, once the mixer returns the funds.

    Until then, the amount of data made available to bad actors is unclear. If the seller is to be believed – and his past ratings indicate he is a reputable one, as far as that term applies here – the emails, phone numbers, wallet IDs, and transaction IDs of users can be inspected by using the access provided by the perpetrator.

    The above information goes for an asking price of only $10k.

    How Was Access Acquired?

    At the moment, no details are available regarding the exact source of the data breach. Security researchers at Hudson Rock, however, have provided a plausible hypothesis.

    Allegedly, Binance allows law enforcement officers to access its database via Kodex Global. According to Hudson Rock, the points of entry appear to be three computers infected by malware that allowed a bad actor to steal Kodex login credentials.

    “The three logins shown in the image with access to Binance’s login panel appear to belong to compromised law enforcement officers in the Criminal Investigation Bureau (CIB) in Taiwan, the Uganda Police Force (UPF), and the Anti-Cybercrime Group (ACG) of the Philippine National Police (PNP).”

    The cybersecurity researchers have since contacted Binance about their theory. So far, no public response has been provided by the exchange.

    Although the access provided probably does not enable direct manipulation of Binance accounts, the leak still allows for sensitive accounts to be probed for information, de-anonymizing users and exposing them to targeted harassment, phishing attempts, and more.

    A similar incident took place in 2020 when Ledger client data was stolen. Users of the hardware wallet were later bombarded with threats attempting to goad them into sending hackers their crypto to be left alone. It is unclear if any of those threats were carried out.

    For now, the team at Hudson Rock recommends all users enable 2FA, update their passwords, and remain alert.

    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    [ad_2]

    Cristian Lipciuc

    Source link

  • Prince Harry's phone hacking victory is a landmark in the long saga of British tabloid misconduct

    Prince Harry's phone hacking victory is a landmark in the long saga of British tabloid misconduct

    [ad_1]

    LONDON — LONDON (AP) — Prince Harry’s victory against Mirror Group Newspapers on Friday over what a British judge called “habitual” illegal activity is a landmark moment in the long and twisting saga of lawbreaking by Britain’s tabloid press.

    Judge Timothy Fancourt ruled that Mirror newspapers had hired private investigators to snoop for personal information and engaged in illegal phone hacking for well over a decade.

    It’s the latest chapter in a tale of tabloid power and attempts to tame it stretching back years — but it’s unlikely to be the end of the story.

    In the pre-digital era, Britain’s fiercely competitive tabloid newspapers sold millions of copies a day and would go to great lengths to get scoops, including by using underhanded techniques.

    One method was phone hacking — calling someone’s number and punching in 0000 or another default PIN number in hope that would give access to their voice messages. Often, it did.

    Targets included members of the royal family, politicians, athletes, celebrities, friends and family of famous people and ordinary citizens who found themselves caught in the public eye.

    Fancourt said in his ruling that phone hacking was “habitual” at Mirror newspapers as far back as 1998, and went on until at least 2011.

    The first most people knew about phone hacking was when the royal editor of the News of the World and a private investigator for the paper were jailed in 2007 for eavesdropping on messages left by Prince William and others on the phones of royal aides.

    The paper’s owner, Rupert Murdoch, dismissed the wrongdoing as the work of two rogue employees. Then, in 2011, it emerged that the News of the World had hacked the phone of Milly Dowler, a 13-year-old girl who was abducted and later found murdered.

    The outcry opened the floodgates on a scandal that forced Murdoch to shut down the 168-year-old tabloid, Britain’s best-selling newspaper.

    The government set up a judge-led public inquiry into media ethics, which examined the complex web of ties — close and, some said, too cozy — binding Britain’s political, media and police elite. Justice Brian Leveson recommended the creation of a strong press watchdog, backed by government regulation. His findings have been partially implemented but have been resisted by large segments of the press, wary of state interference.

    Judge Fancourt said it was clear that Leveson had not been told the full truth. He said the Mirror’s wrongdoing “was concealed from the board, from Parliament … from the Leveson Inquiry, from shareholders, and from the public for years.”

    After the 2011 revelations, several editors and executives at the News of the World were charged with illegal phone hacking. After an eight-month trial at London’s Central Criminal Court, former editor Andy Coulson was sentenced to 18 months in prison in 2014 for conspiring to hack phones. Five other defendants were acquitted, while several others entered guilty pleas.

    Since then, there have been no more criminal cases, but Murdoch’s News Group and the Mirror Group have paid hundreds of millions to settle claims from dozens of alleged victims of hacking and other illegal activity. The publisher of the Daily Mail, Associated Newspapers, faces hacking lawsuits from Prince Harry, Elton John and others.

    While many tabloid targets have accepted out-of-court settlements, Prince Harry was determined to go before a judge. The Mirror Group case is one of three lawsuits he has launched against newspaper publishers — and the first to reach a full trial.

    Harry has made it his mission to tame the tabloid press, which he blames for the death of his mother Princess Diana, for hounding him throughout his youth and for helping drive him and his wife Meghan out of the United Kingdom.

    He said in a statement read by his lawyer David Sherborne outside the High Court in London on Friday: “Today is a great day for truth, as well as accountability.”

    The judge awarded Harry a modest 140,000 pounds ($180,000) in damages, but the case is likely to cost the Mirror Group much more than that, since the findings could strengthen the claims of others who have filed suits against the company. The publisher has already paid more than 100 million pounds ($126 million) to settle claims of unlawful information-gathering.

    In a partial win for the company, the judge ruled against two of Harry’s co-claimants on the grounds that they had waited too long to take legal action.

    Mirror Group’s parent company, Reach PLC, said Friday that the judgment was expected to “reduce the number of live claims, and substantially limit and bar all or most future claims” for historical wrongdoing.

    The ruling could have severe ramifications for Sly Bailey, former chief executive of the Mirror Group’s parent company, and the firm’s ex-legal director, Paul Vickers. The judge said they both knew about the hacking and covered it up.

    It also piles pressure on broadcaster Piers Morgan, a former Daily Mirror editor who has always denied that he knew about phone hacking at the paper. The judge said there was “compelling evidence” that editors of all the Mirror newspapers knew phone hacking “was being used extensively and habitually.”

    “I’ve never hacked a phone or told anybody else to hack a phone,” Morgan reiterated after Friday’s verdict.

    Prince Harry said people involved in the lawbreaking should face criminal charges.

    “I respectfully call upon the authorities, the financial regulator, the stock market who were deliberately deceived by Mirror Group, and indeed the Metropolitan Police and prosecuting authorities to do their duty for the British public and to investigate bringing charges against the company and those who have broken the law,” he said in a statement.

    [ad_2]

    Source link

  • Ukraine faces heavy attack from air and cyberspace while Zelenskyy in US presses for more funding

    Ukraine faces heavy attack from air and cyberspace while Zelenskyy in US presses for more funding

    [ad_1]

    KYIV, Ukraine — Ukraine came under heavy attack from the air and from cyberspace on Tuesday, local officials said, as nearly 600 Russian shells, rockets and other projectiles rained down on a southern region and unidentified hackers knocked out phone and internet services of the country’s biggest telecom provider.

    Ukraine also claimed a successful hacker attack against Russia’s national tax system.

    Ukrainian President Volodymyr Zelenskyy arrived on Capitol Hill to press U.S. Congress for additional military help, as further U.S. funding is uncertain because of a domestic political dispute.

    One person was killed and four others were wounded during 24 hours of Russian bombardment of Ukraine’s southern Kherson region, according to Oleksandr Prokudin, head of the regional military administration. The number of projectiles fired at Kherson was the highest in at least two weeks.

    As winter sets in and hampers troop movements, allowing little change along the front line, air bombardment plays a growing role in the war.

    Cyberattacks are also a busy battleground. Ukrainian telecom provider Kyivstar said it came under a “powerful” attack by hackers. The company serves more than 24 million mobile customers across the country.

    “The war with Russia has many dimensions, and one of them is in cyberspace,” Kyivstar Director-General Oleksandr Komarov said in a statement.

    The company didn’testimate when services might be restored. It said its specialists were working with law enforcement agencies and special state services on solving the problem.

    Kyivstar’s traffic began dropping at 9 a.m. local time and was nearly at zero by noon, Doug Madory, an analyst at the network integrity firm Kentic Inc., said in a tweet.

    “Traffic was slow decline instead of being abruptly cut all at once,” Madory told The Associated Press. He said that was similar to what happened in a March 2022 cyberattack on Ukrtelecom, the country’s legacy telecom, which was then seventh among Ukrainian providers in internet traffic volume.

    Kyivstar is Ukraine’s largest destination for internet traffic, Madory said.

    But the attack had more far-reaching consequences. It disrupted the air raid warning system in part of the Kyiv region, according to the head of the Kyiv regional administration, Ruslan Kravchenko. Similar disruptions were also reported in the Sumy region of northeastern Ukraine, while some ATMs of state-owned Oschadbank stopped working as a result of the Kyivstar attack, the bank’s press office told local news outlet Suspilne.

    Also, a Ukrainian online bank said it fought off a massive distributed denial-of-service attack on Tuesday. A DDoS attack employs a network of distributed computers to direct junk traffic at the target site in an effort to render it unusable.

    At the same time, Ukraine’s Main Directorate of Intelligence claimed to have conducted a successful hacker operation infesting Russia’s Federal Taxation Service servers with malware.

    According to an intelligence agency statement, the operation infiltrated several central servers and more than 2,300 regional servers, resulting in disrupted communication within Russia’s taxation system and destroying its database and backups.

    Moscow made no immediate comment about any attack, and the claim couldn’t be independently verified.

    In other developments, Ukraine claimed to have captured a tactically important hill in the Donetsk region, where the front line has barely budged since 2014.

    Zelenskyy announced on social media that his troops had taken the foothold, which provides a vantage point over the front line near Pivdenne, a mining town to the northwest of the Donetsk city of Horlivka.

    ___

    Hanna Arhirova in Kyiv, and Frank Bajak in Boston, contributed to this report.

    ___

    Follow AP’s coverage of the war in Ukraine at https://apnews.com/hub/russia-ukraine

    [ad_2]

    Source link

  • Ukraine faces heavy attack from air and cyberspace while Zelenskyy in US presses for more funding

    Ukraine faces heavy attack from air and cyberspace while Zelenskyy in US presses for more funding

    [ad_1]

    KYIV, Ukraine — KYIV, Ukraine (AP) — Ukraine came under heavy attack from the air and from cyberspace Tuesday, local officials said, as nearly 600 Russian shells, rockets and other projectiles rained down on a southern region and unidentified hackers knocked out phone and internet services of the country’s biggest telecom provider.

    Ukraine also claimed a successful hacker attack against Russia’s national tax system.

    Ukrainian President Volodymyr Zelenskyy arrived on Capitol Hill to press Congress for additional military help, as further U.S. funding is uncertain due to a domestic political dispute.

    One person was killed and four injured during 24 hours of Russian bombardment of Ukraine’s southern Kherson region, according to Oleksandr Prokudin, head of the regional military administration. The number of projectiles fired at Kherson was the highest in at least two weeks.

    As winter sets in and hampers troop movements, air bombardment plays a growing role.

    Cyberattacks are also a busy battleground. Ukrainian telecom provider Kyivstar said it came under a “powerful” attack by hackers. The company serves more than 24 million mobile customers across the country.

    “The war with Russia has many dimensions, and one of them is in cyberspace,” Kyivstar Director-General Oleksandr Komarov said in a statement.

    The company did not estimate when services might be restored. It said its specialists were working with law enforcement agencies and special state services on solving the problem.

    Also, a Ukrainian online bank said it fought off a massive distributed denial-of-service attack on Tuesday. A DDoS attack employs a network of distributed computers to direct junk traffic at the target site in an effort to render it unusable.

    At the same time, Ukraine’s Main Directorate of Intelligence claimed to have conducted a successful hacker operation infesting Russia’s Federal Taxation Service servers with malware.

    According to an intelligence agency statement, the operation infiltrated several central servers and more than 2,300 regional servers, resulting in disrupted communication within Russia’s taxation system and destroying its database and backups.

    Moscow made no immediate comment about any attack, and the claim could not be independently verified.

    In other developments, Ukraine claimed to have captured a tactically important hill in the Donetsk region, where the front line has barely budged since 2014.

    Zelenskyy announced on social media that his troops had taken the foothold, which provides a vantage point over the front line near Pivdenne, a mining town to the northwest of the Donetsk city of Horlivka.

    ___

    Follow AP’s coverage of the war in Ukraine at https://apnews.com/hub/russia-ukraine

    [ad_2]

    Source link

  • Top White House cyber aide says recent Iran hack on water system is call to tighten cybersecurity

    Top White House cyber aide says recent Iran hack on water system is call to tighten cybersecurity

    [ad_1]

    WASHINGTON — A top White House national security official said recent cyber attacks by Iranian hackers on U.S. water authorities — as well as a separate spate of ransomware attacks on the health care industry — should be seen as a call to action by utilities and industry to tighten cybersecurity.

    Deputy national security adviser Anne Neuberger said in an interview on Friday that recent attacks on multiple American organizations by the Iranian hacker group “Cyber Av3ngers” were “unsophisticated” and had “minimal impact” on operations. But the attacks, Neuberger said, offered a fresh warning that American companies and operators of critical infrastructure “are facing persistent and capable cyber attacks from hostile countries and criminals” that are not going away.

    “Some pretty basic practices would have made a big difference there,” said Neuberger, who serves as a top adviser to President Joe Biden on cyber and emerging technology issues. “We need to be locking our digital doors. There are significant criminal threats, as well as capable countries — but particularly criminal threats — that are costing our economy a lot.”

    The hackers, who U.S. and Israeli officials said are tied to Tehran’s Islamic Revolutionary Guard Corps, breached multiple organizations in several states including a small municipal water authority in the western Pennsylvania town of Aliquippa. The hackers said they were specifically targeting organizations that used programmable logic controllers made by the Israeli company Unitronics, commonly used by water and water treatment utilities.

    Matthew Mottes, the chairman of the Municipal Water Authority of Aliquippa, which discovered it had been hacked on Nov. 25, said that federal officials had told him the same group also breached four other utilities and an aquarium.

    The Aliquippa hack prompted workers to temporarily halt pumping in a remote station that regulates water pressure for two nearby towns, leading crews to switch to manual operation.

    The hacks, which authorities said began on Nov. 22, come as already fraught tensions between the U.S. and Iran have been heightened by the two-month-old Israel-Hamas war. The White House said that Tehran has supported Houthi rebels in Yemen who have carried out attacks on commercial vessels and have threatened U.S. warships in the Red Sea.

    Iran is the chief sponsor of both Hamas, the militant group which controls Gaza, as well as the Houthi rebels in Yemen.

    The U.S. has said they have uncovered no information that Iran was directly involved in Hamas’ Oct. 7 attack on Israel that triggered the massive retaliatory operation by Israeli Defense Forces in Gaza. But the Biden administration is increasingly voicing concern about Iran attempting to broaden the Israeli-Hamas conflict through proxy groups and publicly warned Tehran about the Houthi rebels’ attacks.

    “They’re the ones with their finger on the trigger,” White House national security adviser Jake Sullivan told reporters earlier this week. “But that gun — the weapons here are being supplied by Iran. And Iran, we believe, is the ultimate party responsible for this.”

    Neuberger declined to comment on whether the recent cyber attack by the Iranian hacker group could portend more hacks by Tehran on U.S. infrastructure and companies. Still, she said the moment underscored the need to step up cybersecurity efforts.

    The Iranian “Cyber Av3ngers” attack came after a federal appeals court decision in October prompted the EPA to rescind a rule that would have obliged U.S public water systems to include cybersecurity testing in their regular federally mandated audits. The rollback was triggered by a federal appeals court decision in a case brought by Missouri, Arkansas and Iowa, and joined by a water utility trade group.

    Neuberger said that measures spelled out in the scrapped rule to beef up cybersecurity for water systems could have “identified vulnerabilities that were targeted in recent weeks.”

    The administration, earlier this year, unveiled a wide-ranging cybersecurity plan that called for bolstering protections on critical sectors and making software companies legally liable when their products don’t meet basic standards.

    Neuberger also noted recent criminal ransomware attacks that have devastated health care systems, arguing those attacks spotlight the need for government and industry to take steps to tighten cyber security.

    A recent attack targeting Ardent Health Services prompted the health care chain that operates 30 hospitals in six states to divert patients from some of its emergency rooms to other hospitals while postponing certain elective procedures. Ardent said it was forced to take its network offline after the Nov. 23 cyberattack.

    A recent global study by the cybersecurity firm Sophos found nearly two-thirds of health care organizations were hit by ransomware attacks in the year ending in March, double the rate from two years earlier but dipping slightly from 2022.

    “The president’s made it a priority. We’re pushing out actionable information. We’re pushing out advice,” Neuberger said. “And we really need the partnership of state and local governments and of companies who are operating critical services to take and implement that advice quickly.”

    Associated Press writers Frank Bajak in Boston and Marc Levy in Harrisburg, Pa., contributed reporting.

    [ad_2]

    Source link

  • Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say

    Breaches by Iran-affiliated hackers spanned multiple U.S. states, federal agencies say

    [ad_1]

    HARRISBURG, Pa. — A small western Pennsylvania water authority was just one of multiple organizations breached in the United States by Iran-affiliated hackers who targeted a specific industrial control device because it is Israeli-made, U.S. and Israeli authorities say.

    “The victims span multiple U.S. states,” the FBI, the Environmental Protection Agency, the Cybersecurity and Infrastructure Security Agency, known as CISA, as well as Israel’s National Cyber Directorate said in an advisory emailed to The Associated Press late Friday.

    They did not say how many organizations were hacked or otherwise describe them.

    Matthew Mottes, the chairman of the Municipal Water Authority of Aliquippa, which discovered it had been hacked on Nov. 25, said Thursday that federal officials had told him the same group also breached four other utilities and an aquarium.

    Cybersecurity experts say that while there is no evidence of Iranian involvement in the Oct. 7 attack into Israel by Hamas that triggered the war in Gaza they expected state-backed Iranian hackers and pro-Palestinian hacktivists to step up cyberattacks on Israeli and its allies in its aftermath. And indeed that has happened.

    The multiagency advisory explained what CISA had not when it confirmed the Pennsylvania hack on Wednesday — that other industries outside water and water-treatment facilities use the same equipment — Vision Series programmable logic controllers made by Unitronics — and were also potentially vulnerable.

    Those industries include “energy, food and beverage manufacturing and healthcare,” the advisory says. The devices regulate processes including pressure, temperature and fluid flow.

    The Aliquippa hack promoted workers to temporarily halt pumping in a remote station that regulates water pressure for two nearby towns, leading crews to switch to manual operation. The hackers left a digital calling card on the compromised device saying all Israeli-made equipment is “a legal target.”

    The multiagency advisory said it was not known if the hackers had tried to penetrate deeper into breached networks. The access they did get enabled “more profound cyber physical effects on processes and equipment,” it said.

    The advisory says the hackers, who call themselves “Cyber Av3ngers,” are affiliated with Iran’s Islamic Revolutionary Guards Corps, which the U.S. designated as a foreign terrorist organization in 2019. The group targeted the Unitronics devices at least since Nov. 22, it said.

    An online search Saturday with the Shodan service identified more than 200 such internet-connected devices in the U.S. and more than 1,700 globally.

    The advisory notes that Unitronics devices ship with a default password, a practice experts discourage as it makes them more vulnerable to hacking. Best practices call for devices to require a unique password to be created out of the box. It says the hackers likely accessed affected devices by “exploiting cybersecurity weaknesses, including poor password security and exposure to the internet.”

    Experts say many water utilities have paid insufficient attention to cybersecurity.

    In response to the Aliquippa hack, three Pennsylvania congressmen asked the U.S. Justice Department in a letter to investigate. Americans must know their drinking water and other basic infrastructure is safe from “nation-state adversaries and terrorist organizations,” U.S. Sens. John Fetterman and Bob Casey and U.S. Rep. Chris Deluzio said. Cyber Av3ngers claimed in an Oct. 30 social media post to have hacked 10 water treatment stations in Israel, though it is not clear if they shut down any equipment.

    Since the beginning of the Israel-Hamas war, the group has expanded and accelerated targeting Israeli critical infrastructure, said Check Point’s Sergey Shykevich. Iran and Israel were engaged in low-level cyberconflict prior to the Oct. 7. Unitronics has not responded to the AP queries about the hacks.

    The attack came less than a month after a federal appeals court decision prompted the EPA to rescind a rule that would have obliged U.S public water systems to include cybersecurity testing in their regular federally mandated audits. The rollback was triggered by a federal appeals court decision in a case brought by Missouri, Arkansas and Iowa, and joined by a water utility trade group.

    The Biden administration has been trying to shore up cybersecurity of critical infrastructure — more than 80% of which is privately owned — and has imposed regulations on sectors including electric utilities, gas pipelines and nuclear facilities. But many experts complain that too many vital industries are permitted to self-regulate.

    [ad_2]

    Source link

  • 23andMe says hackers accessed 'significant number' of files about users' ancestry | TechCrunch

    23andMe says hackers accessed 'significant number' of files about users' ancestry | TechCrunch

    [ad_1]

    Genetic testing company 23andMe announced on Friday that hackers accessed around 14,000 customer accounts in the company’s recent data breach.

    In a new filing with the U.S. Securities and Exchange Commission published Friday, the company said that, based on its investigation into the incident, it had determined that hackers had accessed 0.1% of its customer base. According to the company’s most recent annual earnings report, 23andMe has “more than 14 million customers worldwide,” which means 0.1% is around 14,000.

    But the company also said that by accessing those accounts, the hackers were also able to access “a significant number of files containing profile information about other users’ ancestry that such users chose to share when opting in to 23andMe’s DNA Relatives feature.”

    The company did not specify what that “significant number” of files is, nor how many of these “other users” were impacted.

    23andMe did not immediately respond to a request for comment, which included questions on those numbers.

    In early October, 23andMe disclosed an incident in which hackers had stolen some users’ data using a common technique known as “credential stuffing,” whereby cybercriminals hack into a victim’s account by using a known password, perhaps leaked due to a data breach on another service.

    The damage, however, did not stop with the customers who had their accounts accessed. 23andMe allows users to opt into a feature called DNA Relatives. If a user opts-in to that feature, 23andMe shares some of that user’s information with others. That means that by accessing one victim’s account, hackers were also able to see the personal data of people connected to that initial victim.

    23andMe said in the filing that for the initial 14,000 users, the stolen data “generally included ancestry information, and, for a subset of those accounts, health-related information based upon the user’s genetics.” For the other subset of users, 23andMe only said that the hackers stole “profile information” and then posted unspecified “certain information” online.

    TechCrunch analyzed the published sets of stolen data by comparing it to known public genealogy records, including websites published by hobbyists and genealogists. Although the sets of data were formatted differently, they contained some of the same unique user and genetic information that matched genealogy records published online years earlier.

    The owner of one genealogy website, for which some of their relatives’ information was exposed in 23andMe’s data breach, told TechCrunch that they have about 5,000 relatives discovered through 23andMe, and said our “correlations might take that into account.”

    News of the data breach surfaced online in October when hackers advertised the alleged data of one million users of Jewish Ashkenazi descent and 100,000 Chinese users on a well-known hacking forum. Roughly two weeks later, the same hacker who advertised the initial stolen user data advertised the alleged records of four million more people. The hacker was trying to sell the data of individual victims for $1 to $10.

    TechCrunch found that another hacker on a different hacking forum had advertised even more allegedly stolen user data two months before the advertisement that was initially reported by news outlets in October. In that first advertisement, the hacker claimed to have 300 terabytes of stolen 23andMe user data, and asked for $50 million to sell the whole database, or between $1,000 and $10,000 for a subset of the data.

    In response to the data breach, on October 10, 23andMe forced users to reset and change their passwords and encouraged them to turn on multi-factor authentication. And on November 6, the company required all users to use two-step verification, according to the new filing.

    After the 23andMe breach, other DNA testing companies Ancestry and MyHeritage started mandating two-factor authentication.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • North Korean Hackers Pose as South Korean Government Officials to Steal Crypto

    North Korean Hackers Pose as South Korean Government Officials to Steal Crypto

    [ad_1]

    South Korean law enforcement revealed that hackers from the Democratic People’s Republic of Korea (DPRK), also known as North Korea, impersonated government agencies and journalists in South Korea to steal crypto.

    The hackers were said to employ email phishing techniques to carry out the dubious act on unsuspecting victims.

    DPRK Hackers Reportedly Focused on Stealing Crypto

    The South Korean National Police Agency said that North Korean hackers seemed to target people’s crypto assets, stating that the rogue actors stole information from nearly 1,500 victims between March and October 2023, the majority of whom came from the private sector, while about 57 of them were either retired or incumbent government officials.

    According to authorities, the attackers posed as officials from the National Health Insurance, the National Pension Service, the South Korean National Police Agency, and the National Tax Service to send phishing emails with clickbait to recipients.

    The victim’s computer will be infected with malware if they open the scam email or click on an attached file, which enables the hackers to steal personal data and information.

    Furthermore, the police noted that the attackers seized user IDs and profiles belonging to 19 people to gain access to their cryptocurrency trading accounts. While there was no mention of the exact assets that were stolen or their value, South Korean law enforcement said it would double down efforts to combat the illegal cyber activity.

    “The police will work closely with relevant institutions and agencies to continuously track down North Korea’s cyber attacks and breaches to prevent losses.”

    Lazarus Group’s Crypto Stash Valued at Almost $60 Million

    As previously reported by CryptoPotato, North Korean hackers linked to the infamous Lazarus Group were targeting blockchain engineers with a new macOS malware. The hackers used a Python program pretending to be a crypto arbitrage bot to infiltrate their systems.

    Lazarus Group is responsible for some of the biggest hacks in the crypto industry, including the attack on CoinEx resulting in the loss of about $55 million.

    The DPRK-backed hacking group currently holds nearly $60 million worth of cryptocurrencies, with bitcoin (BTC) making up the majority of the stash valued at $56.15 million. Other crypto holdings include ETH, BNB, BUSD, and AAVE.

    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    [ad_2]

    Anthonia Isichei

    Source link

  • Crypto Exchange Poloniex Nears Full Restoration After $125M Exploit

    Crypto Exchange Poloniex Nears Full Restoration After $125M Exploit

    [ad_1]

    Poloniex is gearing up to resume deposit and withdrawal services on its platform less than a week after a massive security breach. In the latest update, Poloniex stated that the majority of the restoration work has been finished, and the cryptocurrency exchange is currently functioning without issues.

    The platform disclosed its collaboration with a leading security auditing firm in the industry and is currently in the final phases of the security audit and verification process.

    • Once the audit is successfully concluded, Poloniex said that it will promptly reinstate deposit and withdrawal services.
    • The evaluation process is currently underway and is expected to last several more days, according to the official blog post.

    “In response to your concerns about Poloniex deposit and withdrawal services, we are pleased to announce that the restoration efforts have mostly been completed, and the platform is now operating smoothly.”

    • Poloniex was hacked on November 10th by unknown attackers who specifically targeted the platform’s hot wallets, draining $125 million in 175 different cryptocurrencies.
    • Tron founder Justin Sun, who acquired Poloniex in 2019, acknowledged the security breach in a public statement and announced a 5% white hat bounty, encouraging the attacker to return the stolen funds.
    • The exec had also revealed that the perpetrators targeted various wallets across multiple blockchains, demonstrating a sophisticated strategy.
    • According to blockchain analytics company Nansen, Poloniex’s wallet now holds only 175 tokens, equivalent to a mere $10,000.
    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    [ad_2]

    Chayanika Deka

    Source link

  • How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

    How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

    [ad_1]

    It was a trading day unlike any other for traders in the $25 trillion Treasury market, with a 30-year bond auction seen as having been partially undermined by a cyberattack on the U.S. unit of a Chinese bank.

    In recapping Treasury’s poorly received $24 billion bond auction on Thursday, traders said the weaker-than-expected results likely had at least something to do with this week’s ransomware hit on the American arm of Industrial & Commercial Bank of China, known as ICBC. That attack reportedly caused disruptions across the market and had some impact on liquidity, with the Financial Times citing unnamed sources as saying hedge funds and asset managers were forced to reroute trades.

    Traders were grappling on Friday to answer the question of what created the sudden lack of interest at the auction, which went so badly that it also shook up U.S. stock investors. Thursday’s sale was the worst since November 2021, based on the extent to which primary dealers were forced to step in and pick up the slack in demand, one trader said. And it reinforced a recent pattern of weak auctions for the 30-year bond that may not bode well for future sales of that long-dated maturity.

    It’s possible that bonds simply “look much less attractive” following a recent “explosive rally” since late October, according to Charlie McElligott, a cross-asset macro strategist at Nomura Securities in New York. However, “this might be the case of ‘more than meets the eye’ to this ‘ugly auction evidencing low demand for duration’ story,” he wrote in a note.

    “One dynamic that makes yesterday’s ugly auction results murky was the ICBC cyberattack described across various financial media, which gunked-up anybody who clears UST trades through them, and made it so that many dealers were then likely unable to trade with those clients until resolved, on account of unsettled trades which weren’t able to be matched,” McElligott said.

    Adding to Thursday’s uncertainty was another random event. Federal Reserve Chairman Jerome Powell appeared on stage in an International Monetary Fund panel, was interrupted by a climate protester, and then uttered a seven-letter expletive that could be heard on the event’s livestream.

    Powell’s policy-related remarks, which indicated the central bank might take further action to control inflation, “didn’t help things and kind of spooked people again,” said John Farawell, head of municipal trading at New York bond underwriter Roosevelt & Cross.

    Read: Fed’s Powell Made Cryptic Comments. How He’s Guiding the Market.

    On Friday, the Treasury market found stabilization as buyers returned to segments of government debt in a sign that calm was being restored. A rush of buying was seen on the 30-year bond
    BX:TMUBMUSD30Y,
    sending its yield down to 4.733% and to a third straight weekly decline.

    Meanwhile, Bloomberg News reported that the repercussions of the ICBC cyberattack included an inability to deliver U.S. debt that was being pledged as collateral. ICBC’s U.S. unit was forced to rely on a messenger carrying a USB stick across Manhattan to complete disrupted trades, according to the news service, which also described Thursday’s $24 billion 30-year bond auction as one of the worst in a decade.

    The ICBC attack “might have had a dramatic impact on the auction. I don’t know how much, but I also can’t imagine it didn’t,” said Tom di Galoma, co-head of global rates trading for BTIG in New York. “When people see that there are trade-settlement issues, there’s a willingness to back off and that’s exactly what happened yesterday. Institutional accounts were saying, ‘We don’t know who is settling this trade.’ If the cyberattack hadn’t happened, I think the auction would have gone a lot better.”

    Ben Emons, a senior portfolio manager and head of fixed income for NewEdge Wealth in New York, said that once the Treasury market got upended by the ICBC cyberattack, the bad auction, and the interruption during Powell’s appearance, liquidity on U.S. government debt “was, for a moment, a dark matter.”

    [ad_2]

    Source link

  • China’s ICBC, the world’s biggest bank, hit by cyberattack that reportedly disrupted Treasury markets

    China’s ICBC, the world’s biggest bank, hit by cyberattack that reportedly disrupted Treasury markets

    [ad_1]

    A pedestrian walks pass a branch of Industrial & Commercial Bank of China (ICBC) in Fuzhou, Fujian province of China.

    VCG | Getty Images

    The U.S. financial services division of Chinese bank ICBC was hit with a cyberattack that reportedly disrupted the trading of Treasurys.

    Industrial and Commercial Bank of China, the world’s largest lender by assets, said Thursday that its financial services arm, called ICBC Financial Services, experienced a ransomware attack “that resulted in disruption to certain” systems.

    Immediately after discovering the hack, ICBC “isolated impacted systems to contain the incident,” the state-owned bank said.

    Ransomware is a type of cyberattack. It involves hackers taking control of systems or information and only letting them go once the victim has paid a ransom. It’s a type of attack that has seen an explosion in popularity among bad actors in recent years.

    ICBC did not reveal who was behind the attack but said it has been “conducting a thorough investigation and is progressing its recovery efforts with the support of its professional team of information security experts.”

    The Chinese bank also said it is working with law enforcement.

    ICBC said it “successfully cleared” U.S. Treasury trades executed Wednesday and repo financing trades done on Thursday. A repo is a repurchase agreement, a type of short-term borrowing for dealers in government bonds.

    However, multiple news outlets reported there was disruption to U.S. Treasury trades. The Financial Times, citing traders and banks, said Friday that the ransomware attack prevented the ICBC division from settling Treasury trades on behalf of other market participants.

    The U.S. Treasury Department told CNBC: “We are aware of the cybersecurity issue and are in regular contact with key financial sector participants, in addition to federal regulators. We continue to monitor the situation.”

    ICBC said the email and business systems of its U.S. financial services arm operate independently of ICBC’s China operations. The systems of its head office, the ICBC New York branch, and other domestic and overseas affiliated institutions were not affected by the cyberattack, ICBC said.

    What did the Chinese government say?

    Wang Wenbin, spokesperson for China’s Ministry of Foreign Affairs, said Friday that ICBC is striving to minimize the impact and losses after the attack, according to a Reuters report.

    Speaking at a regular news conference, Wang said ICBC has paid close attention to the matter and has handled the emergency response and supervision well, according to Reuters.

    What do we know about the ransomware attack?

    This kind of ransomware can make its way into an organization in many ways. For example, by someone clicking on a malicious link in an email. Once in, its aim is to extract sensitive information about a company.

    VMWare cybersecurity team said in a blog last year that LockBit 3.0 is a “challenge for security researchers because each instance of the malware requires a unique password to run without which analysis is extremely difficult or impossible.” The researchers added that the ransomware is “heavily protected” against analysis.

    The U.S. government’s Cybersecurity and Infrastructure Security Agency calls LockBit 3.0 “more modular and evasive,” making it harder to detect.

    LockBit is the most popular strain of ransomware, accounting for around 28% of all known ransomware attacks from July 2022 to June 2023, according to data from cybersecurity firm Flashpoint.

    What is LockBit?

    The LockBit is the group behind the software. Its business model is known as “ransomware-as-a-service.” It effectively sells its malicious software to other hackers, known as affiliates, who then go on to carry out the cyberattacks.

    The leader of the group goes by the online name of “LockBitSup” on dark web hacking forums.

    “The group primarily posts in Russian and English, but according to its website, the group claims to be located in the Netherlands and to not be politically motivated,” Flashpoint said in a blogpost.

    The group’s malware is known to target small and medium-sized businesses.

    LockBit has previously claimed responsibility for ransomware attacks on Boeing and the U.K’s. Royal Mail.

    In June, the U.S. Department of Justice charged a Russian national for his involvement in “deploying numerous LockBit ransomware and other cyberattacks” against computers in the U.S., Asia, Europe and Africa.

    “LockBit actors have executed over 1,400 attacks against victims in the United States and around the world, issuing over $100 million in ransom demands and receiving at least as much as tens of millions of dollars in actual ransom payments made in the form of bitcoin,” the DOJ said in a press release in June.

    — CNBC’s Steve Kopack contributed to this article.

    [ad_2]

    Source link

  • BNB Chain, Ethereum Blockchains Suffer 20 Attacks in October, Taking the Hardest Hits: Report

    BNB Chain, Ethereum Blockchains Suffer 20 Attacks in October, Taking the Hardest Hits: Report

    [ad_1]

    According to the latest report from Immunefi, from January to October 2023, over $1.41 billion has been lost to hacking and fraudulent activities in 292 specific incidents.

    In October 2023 alone, losses amounted to approximately $22.2 million, primarily attributed to hacking and fraud. The most frequently targeted blockchain networks during the period were BNB Chain and Ethereum, accounting for 83.3% of the total losses among targeted chains.

    • Immunefi disclosed that BNB Chain experienced the highest number of individual attacks, with 11 incidents, accounting for 45.8% of the overall losses among the targeted chains.
    • Ethereum, on the other hand, experienced 9 incidents, representing 37.5% of the total losses.
    • Layer 1 blockchain, Avalanche trails behind with 2 incidents, representing 8.3% in October.
    • Polygon and Fantom witnessed 1 incident each, representing 4.2% respectively.
    • Hacking incidents continued to be the primary cause of financial losses, surpassing fraudulent activities which resulted in a total loss of over $16.35 million for the month.

    “In October 2023, hacks continue to be the predominant cause of losses as compared to frauds, scams, and rug pulls. An analysis of the losses shows that fraud accounts for 26.32% of the total losses in October 2023, while hacks account for 73.68%.”

    • DeFi platforms continued to be the primary focus of exploitation in October, representing 100% of the total losses. Contrastingly, not a single major exploit was reported in CeFi platforms.
    • Zooming out, Q3 in 2023 recorded the highest losses, primarily driven by over $340 million in September and more than $320 million in July, the Web3 bug bounty platform said in its report.
    • An earlier report by blockchain security firm, CertiK revealed that nearly $332 million in various digital assets had been lost to exploits, hacks, and scams in September.
    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    [ad_2]

    Chayanika Deka

    Source link

  • macOS Users Beware: North Korean Hackers On the Prowl

    macOS Users Beware: North Korean Hackers On the Prowl

    [ad_1]

    In a recent revelation, Elastic Security Labs has uncovered a sophisticated cyber intrusion by North Korean hackers believed to be associated with the Lazarus group.

    This incident, tracked as REF7001, involved the use of a new macOS malware named Kandykorn, which has been specifically designed to target blockchain engineers involved in cryptocurrency exchange platforms.

    North Korean Hackers Target Crypto Engineers with Discord-Distributed Malware

    Elastic Security Labs has exposed a sophisticated cyber intrusion by North Korean hackers believed to be associated with the notorious Lazarus Group. This incident, which targeted blockchain engineers involved in cryptocurrency exchange platforms, utilized a deceptive Python program masquerading as a cryptocurrency arbitrage bot.

    What sets this attack apart is its distribution method: the attackers distributed the malware through a private message on a public Discord server, which is atypical of macOS intrusion tactics.

    “The victim believed they were installing an arbitrage bot, a software tool capable of profiting from cryptocurrency rate differences between platforms,” explained the researchers at Elastic Security Labs.

    After installation, the Kandykorn malware initiates communication with a command-and-control (C2) server, utilizing encrypted RC4 and implementing a distinct handshake mechanism. Instead of actively polling for commands, it patiently awaits them. This sophisticated method enables hackers to retain control over the compromised systems discreetly.

    Kandykorn Malware Tactics Reveal Ties to Lazarus Group

    Elastic Security Labs has provided valuable insights into the capabilities of Kandykorn, showcasing its proficiency in performing file upload and download, process manipulation, and execution of arbitrary system commands. Of particular concern is its utilization of reflective binary loading, a fileless execution technique associated with the notorious Lazarus Group. The Lazarus Group is renowned for its involvement in cryptocurrency theft and evasion of international sanctions.

    Furthermore, there is compelling evidence linking this attack to the Lazarus Group in North Korea. The similarity in techniques, network infrastructure, certificates used to sign malicious software, and custom methods for detecting Lazarus Group activities all point towards their involvement.

    Additionally, on-chain transactions have revealed connections between security breaches at Atomic Wallet, Alphapo, CoinsPaid, Stake.com, and CoinEx. These connections further prove the Lazarus Group’s participation in these exploits.

    In a separate recent incident, the Lazarus Group attempted to compromise Apple computers running macOS by deceiving users into downloading a crypto trading app from GitHub. Once the unsuspecting users installed the software and granted it administrative access, the attackers gained a backdoor entry into the operating system, allowing for remote access.

    By delving into these details, Elastic Security Labs has shed light on the sophisticated tactics employed by the Lazarus Group, emphasizing the importance of robust cybersecurity measures to safeguard against such threats.

    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    PrimeXBT Special Offer: Use this link to register & enter CRYPTOPOTATO50 code to receive up to $7,000 on your deposits.

    [ad_2]

    Wayne Jones

    Source link

  • Frax Finance Reports Domain Hijacking Incident

    Frax Finance Reports Domain Hijacking Incident

    [ad_1]

    Frax Finance, a prominent decentralized cross-chain protocol, has warned its users, urging them not to use the frax.finance and frax.com domains until further notice.

    The company’s founder, Sam Kazemian, has advised caution, emphasizing resolving the domain name issue before resuming normal operations.

    Frax Finance Faces Domain Hijacking

    The incident occurred early Wednesday when Frax Finance’s domain was hijacked. While the website currently points to the correct nameserver and loads the authentic Frax user interface, the exact nature of the breach remains unclear.

    “The current nameserver belongs to us, and it is the real Frax UI,” explained Frax founder Sam Kazemian. “However, since we haven’t received any information from name.com, the domain registrar, regarding the root cause of the original issue, we cannot be 100% certain that it’s safe to use frax.finance until the matter is fully resolved.”

    Please don’t use https://t.co/cADe5RLjqv and https://t.co/AcTF8hlzaS domains until further notice.

    If you know anyone at @namedotcom please reach out asap. https://t.co/v0KlM5FoLk

    — Frax Finance (¤, ¤) 🦇🔊 (@fraxfinance) October 31, 2023

    Fortunately, there have been no reports of stolen user funds in the recent Frax Finance incident. Kazemian and his team are puzzled by the events and have not identified any compromises to their email or password security.

    “It doesn’t appear that we made any mistakes on our end,” Kazemian stated. “Until we receive confirmation that our account is secure and the issue is fully resolved, we cannot confidently claim that it is safe to use the frax.finance domain.”

    In an update, Frax Finance has stated that Name.com has contacted them and assured them that the domains frax.finance and frax.com have been redirected back to their correct nameservers and settings.

    Rising Threat of DNS Hijacking in the Crypto Space

    DNS hijacking, the redirection of users to malicious sites that closely mimic the authentic ones to collect user credentials, is a growing concern in the crypto space.

    On October 6, the web3 community platform Galxe experienced a DNS attack that disrupted its website via its Dynadot account. As a precaution, Galxe advised users not to connect their wallets, perform transactions, or disconnect their wallets until the issue was resolved.

    Another incident on September 20 also saw the Balancer frontend targeted in a DNS attack, which resulted in the theft of over $238,125 from the protocol. The attacker sent the funds to an address associated with ‘Angel Drainer.’ This attack prompted users to approve a malicious contract, risking their wallet contents unknowingly.

    In 2022, the decentralized finance (DeFi) project Convex Finance faced a similar situation when its original URLs were compromised, redirecting users to malicious websites.

    Frax Finance, founded in 2019 by Sam Kazemian, Travis Moore, and Jason Huan, is a decentralized protocol. Formerly known as Decentral Bank, its mission is to provide stability and decentralization through FRAX, a fractional-algorithmic stablecoin.

    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    PrimeXBT Special Offer: Use this link to register & enter CRYPTOPOTATO50 code to receive up to $7,000 on your deposits.

    [ad_2]

    Wayne Jones

    Source link

  • Telegram Chatbot Unibot Loses $640,000 in Digital Assets to Hacker Exploit

    Telegram Chatbot Unibot Loses $640,000 in Digital Assets to Hacker Exploit

    [ad_1]

    Telegram chatbot Unibot has lost around $640,000 worth of digital assets after a hacker managed to exploit a vulnerability in the newly deployed contract. The team behind the protocol said that it is currently investigating the issue and will soon release a detailed response.

    PeckShield reported that the attacker transferred the pilfered cryptocurrency to Uniswap, after which it was subsequently routed to the controversial crypto mixer, Tornado Cash.

    • Lookonchain advised Unibot to move funds to other wallets or revoke approvals of the contract as soon as possible.
    • Unibot confirmed the token approval exploit from its new router and revealed pausing it to contain the issue.
    • The protocol also assured its users that any funds lost due to the bug on its new router will be compensated while adding that user keys and wallets remain safe.
    • Nearly $332 million in various digital assets were lost to exploits, hacks, and scams in September, according to blockchain security firm CertiK.
    • The latest exploit comes days after a similar incident hit Maestrobots, a group of cryptocurrency bots on the Telegram messenger app, on October 24th.
    • The attackers targeted MaestroRouter on the ETH mainnet and drained 280 ETH worth around $485,000 at the time of the hack.
    • The team quickly identified the attack and removed the exploit. Subsequently, the users were reimbursed a day later.
    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    PrimeXBT Special Offer: Use this link to register & enter CRYPTOPOTATO50 code to receive up to $7,000 on your deposits.

    [ad_2]

    Chayanika Deka

    Source link

  • The CEO of Avalanche-based Web3 Social Platform Stars Arena Steps Down

    The CEO of Avalanche-based Web3 Social Platform Stars Arena Steps Down

    [ad_1]

    Stars Arena said that the platform’s CEO Chill Pill, resigned from their position, a move that comes nearly a month after the decentralized social finance (SocialFi) application suffered a major smart contract exploit.

    Meanwhile, the protocol’s total value locked (TVL) currently stands at a little above $300,000, a significant decrease from a TVL of nearly $3 million before the hacking incident.

    Unknown Stars Arena CEO Leaves Position

    Stars Arena announced the news of its CEO stepping down on X, adding that the team was working on rebuilding the trust of community members. Chill Pill also tweeted the news of his resignation, with neither Stars Arena nor Chill Pill giving reasons for the development.

    Following the news, most members of the crypto community on X were surprised that Stars Arena had a CEO as the social app has not been open about the team behind the project, while others noted that the resignation was one of the fastest in the space.

    The SocialFi app launched late in September and is an imitation of the Ethereum-based Friend.tech. Stars Arena allows users to link their X accounts to the platform while using Avalanche’s native coin AVAX to buy shares known as “tickets” from creators.

    Stars Arena witnessed surging interest after it went live, causing an uptick in transactions on the Avalanche network. However, the protocol has suffered a couple of hacks.

    New TVL Nearly 90% Lower Post Hack

    Stars Arena’s first exploit cost the platform $2000, with the team assuring users that they fixed the vulnerability. However, two days after the first incident, the protocol was hit with a second hack, this time resulting in a bigger theft.

    As previously reported by CryptoPotato, the attackers drained the project’s TVL, stealing nearly $3 million, leaving just $0.5. At the time of the second attack, Avalanche CEO Gün Sirer seemed confident that the social app would quickly bounce back from the incident. Stars Arena later claimed that the platform received funding to cover the losses incurred.

    In another update, the project revealed that the perpetrator behind the hack reached out to the team and returned 90% of the stolen funds in exchange for a 10% bounty and an additional 1,000 AVAX lost in a bridge.

    At the time of writing, Stars Arena’s TVL stands at $310,468, according to DefiLlama, an almost 90% drop from $2.78 million before the second exploit.

    SPECIAL OFFER (Sponsored)

    Binance Free $100 (Exclusive): Use this link to register and receive $100 free and 10% off fees on Binance Futures first month (terms).

    PrimeXBT Special Offer: Use this link to register & enter CRYPTOPOTATO50 code to receive up to $7,000 on your deposits.

    [ad_2]

    Anthonia Isichei

    Source link

  • Major Exploit Sees $6 Million In XRP Lost

    Major Exploit Sees $6 Million In XRP Lost

    [ad_1]

    Philippines-based crypto exchange Coins.ph is rumored to be the latest victim of an exploit that has potentially led to the loss of 12.2 million XRP ($6 million) for the firm. However, a part of these funds seem to have already been recovered. 

    Evidence Of The Alleged Exploit

    According to a report by The Block, the hack on the crypto exchange occurred on October 17, with the media outlet citing a source familiar with the matter. Coins is yet to release an official statement as to whether or not the incident truly occurred.

    However, on-chain data suggests that this exploit might have indeed occurred, as The Block noted. According to data on the blockchain explorer XRP scan, the crypto exchange experienced 13 outflows, with 999,999.999 XRP sent out from the exchange in each transaction to the same wallet, although the last batch seems not to have been processed.

    Following that, a further 200,000.999999 XRP was sent out of the exchange. It is worth mentioning that all these transactions occurred in the space of 32 minutes as they all occurred simultaneously. The total of these transactions (the ones processed) sums up to over 12.2 million XRP. 

    XRP market cap currently at $6.8 billion. Chart: TradingView.com

    Upon receipt of these funds, the alleged hacker then proceeded to send them to various destinations, including crypto exchanges OKX, Simple Swap, ChangeNOW, and WhiteBIT. The Block reported that a WhiteBIT spokesperson also seemed to confirm the exploit. 

    The representative stated that they blocked 445,000 as soon as they received a request from the Phillipines-based exchange Coins to flag down the address linked to the stolen tokens. WhiteBIT is also said to have reached out to blockchain analytics platforms Cristal and Chainalysis with a request to flag addresses related to the stolen XRP.  

    Increased Hacks On Crypto Entities 

    The attack on firms in the crypto industry has continued to increase from last year when the industry was reported to have lost over $2 billion from crypto hacks. In September, another crypto exchange, Huobi, was the victim of these exploiters as it lost almost $8 million

    Notably, a recent report reveals that South Korea’s Upbit cryptocurrency exchange faced a staggering 159,000 hacking attempts during the first half of 2023. What’s particularly striking is that this number was twice the amount of hacking attempts encountered by the exchange in the same period of 2022.

    The DeFi landscape has also not been left out, as several DeFi exchanges and platforms have also been victims of hacks and exploits this year. As of June, over $665 million had been reported to have been lost due to such occurrences.

    Featured image from InfoWorld

    [ad_2]

    Scott Matherson

    Source link

  • Data breach at MGM Resorts expected to cost casino giant $100 million

    Data breach at MGM Resorts expected to cost casino giant $100 million

    [ad_1]

    NEW YORK — The data breach last month that MGM Resorts is calling a cyberattack is expected to cost the casino giant more than $100 million, the Las Vegas-based company said.

    The incident, which was detected on Sept. 10, led to MGM shutting down some casino and hotel computer systems at properties across the U.S. in efforts to protect data.

    MGM said that reservations and casino floors in Las Vegas and other states were affected as customers shared stories on social media about not being able to make credit card transactions, obtain money from cash machines or enter hotel rooms. The company announced the end its 10-day computer shutdown on Sept. 20.

    The incident bore all the hallmarks of an extortionary ransomware attack, which MGM has not confirmed. If so, it could be the costliest ransomware attack on record, said Brett Callow of the cybersecurity firm Emsisoft. In 2019, the Norwegian aluminum manufacturer Norsk Hydro suffered $70 million in losses after refusing to pay ransomware criminals.

    “While we experienced disruptions at some of our properties, operations at our affected properties have returned to normal, and the vast majority of our systems have been restored,” MGM CEO Bill Hornbuckle said in a Thursday letter to customers. “We also believe that this attack is contained.”

    Hornbuckle added that no customer bank account numbers or payment card information was compromised in the incident. But hackers stole other personal information, including names, contact information, driver’s license numbers, Social Security numbers and passport numbers belonging to some customers who did business with MGM prior to March of 2019, he said.

    MGM has no evidence that the hackers and criminals have used the data to commit account fraud or identity theft, Hornbuckel said, noting the company will also reach out to impacted consumers via email and offer free identity protection and credit monitoring services.

    “We regret this outcome and sincerely apologize to those impacted,” he added.

    In a filing with the Securities and Exchange Commission, MGM said it believes that September’s data breach will have a negative impact on its third-quarter financial results, particularly in Las Vegas — but minimal impact in the fourth quarter and operational results for the year.

    In addition to the estimated $100 million loss on adjusted property earnings before interest, taxes, depreciation, amortization and rent for its Las Vegas Strip resorts and other regional operations, MGM expects to incur charges totaling less than $10 million covering one-time expenses like legal fees and technology consulting.

    MGM wasn’t the only casino giant to get hit by hackers last month. Caesars Entertainment disclosed a Sept. 7 cyberattack. The Reno-based company said that its casino and online operations were not disrupted.

    Caesars was widely reported to have paid $15 million of a $30 million ransom sought by a group called Scattered Spider for a promise to secure the data. According to a Thursday Wall Street Journal report, which cited a unnamed person familiar with the matter, MGM refused to pay hackers’ September ransom demand.

    An MGM spokesman would neither confirm nor deny the report.

    Both casino operators currently face a combined nine federal lawsuits over the cyberattacks, the Las Vegas Review-Journal reported this week.

    Beyond the casino world, Clorox disclosed a cyberattack recently, saying it had identified “unauthorized activity” on some of IT systems in August. The maker of bleach and other household products said the attack has caused large-scale disruption of operations, including notable product shortages and order processing delays.

    In a Wednesday announcement, Clorox said its net sales are expected to fall between 23% and 28% for the first quarter of 2024.

    ___

    Associated Press writers Frank Bajak in Boston and Ken Ritter and Rio Yamat in Las Vegas contributed to this report.

    [ad_2]

    Source link

  • Cyberattack at MGM Resorts expected to cost casino giant $100 million

    Cyberattack at MGM Resorts expected to cost casino giant $100 million

    [ad_1]

    NEW YORK — The data breach last month that MGM Resorts is calling a cyberattack is expected to cost the casino giant more than $100 million, the Las Vegas-based company said.

    The incident, which was detected on Sept. 10, led to MGM shutting down some casino and hotel computer systems at properties across the U.S. in efforts to protect data.

    MGM said that reservations and casino floors in Las Vegas and other states were affected as customers shared stories on social media about not being able to make credit card transactions, obtain money from cash machines or enter hotel rooms. The company announced the end its 10-day computer shutdown on Sept. 20.

    The incident bore all the hallmarks of an extortionary ransomware attack, which MGM has not confirmed. If so, it could be the costliest ransomware attack on record, said Brett Callow of the cybersecurity firm Emsisoft. In 2019, the Norwegian aluminum manufacturer Norsk Hydro suffered $70 million in losses after refusing to pay ransomware criminals.

    “While we experienced disruptions at some of our properties, operations at our affected properties have returned to normal, and the vast majority of our systems have been restored,” MGM CEO Bill Hornbuckle said in a Thursday letter to customers. “We also believe that this attack is contained.”

    Hornbuckle added that no customer bank account numbers or payment card information was compromised in the incident. But hackers stole other personal information, including names, contact information, driver’s license numbers, Social Security numbers and passport numbers belonging to some customers who did business with MGM prior to March of 2019, he said.

    MGM has no evidence that the hackers and criminals have used the data to commit account fraud or identity theft, Hornbuckel said, noting the company will also reach out to impacted consumers via email and offer free identity protection and credit monitoring services.

    “We regret this outcome and sincerely apologize to those impacted,” he added.

    In a filing with the Securities and Exchange Commission, MGM said it believes that September’s data breach will have a negative impact on its third-quarter financial results, particularly in Las Vegas — but minimal impact in the fourth quarter and operational results for the year.

    In addition to the estimated $100 million loss on adjusted property earnings before interest, taxes, depreciation, amortization and rent for its Las Vegas Strip resorts and other regional operations, MGM expects to incur charges totaling less than $10 million covering one-time expenses like legal fees and technology consulting.

    MGM wasn’t the only casino giant to get hit by hackers last month. Caesars Entertainment disclosed a Sept. 7 cyberattack. The Reno-based company said that its casino and online operations were not disrupted.

    Caesars was widely reported to have paid $15 million of a $30 million ransom sought by a group called Scattered Spider for a promise to secure the data. According to a Thursday Wall Street Journal report, which cited a unnamed person familiar with the matter, MGM refused to pay hackers’ September ransom demand.

    An MGM spokesman would neither confirm nor deny the report.

    Both casino operators currently face a combined nine federal lawsuits over the cyberattacks, the Las Vegas Review-Journal reported this week.

    Beyond the casino world, Clorox disclosed a cyberattack recently, saying it had identified “unauthorized activity” on some of IT systems in August. The maker of bleach and other household products said the attack has caused large-scale disruption of operations, including notable product shortages and order processing delays.

    In a Wednesday announcement, Clorox said its net sales are expected to fall between 23% and 28% for the first quarter of 2024.

    ___

    Associated Press writers Frank Bajak in Boston and Ken Ritter and Rio Yamat in Las Vegas contributed to this report.

    [ad_2]

    Source link

  • Clorox slashes forecast due to effects of cyberattack; stock falls

    Clorox slashes forecast due to effects of cyberattack; stock falls

    [ad_1]

    Clorox Co. shares fell in the extended session Wednesday after the company slashed its outlook stemming from the impact of a cybersecurity attack over the summer.

    Clorox
    CLX,
    +1.21%

    shares fell about 3% after hours, following a 1.2% gain to close the regular session at $131.83. At Wednesday’s close, Clorox shares were down 6.1% for the year, while the S&P 500 index
    SPX
    has gained 11.1%.

    The company forecast a loss of 75 cents to 35 cents a share, or a loss of 40 cents to break-even per share on an adjusted basis, for the quarter ending Sept. 30.

    Also see: A stranger in your hotel room? Kitty-litter shortages? Online attacks are causing real-world effects.

    Clorox said sales are expected to decrease by 28% to 23% from the year-ago first quarter of $1.74 billion, or in a range between $1.25 billion and $1.34 billion.

    Analysts surveyed by FactSet had forecast first-quarter earnings of $1.29 a share on revenue of $1.77 billion.

    In a statement late Wednesday, Clorox said the reduced outlook was “due to the impacts of the recent cybersecurity attack that was disclosed in August, which caused wide-scale disruption of Clorox’s operations, including order-processing delays and significant product outages.”

    The company said shipment and consumption trends prior to the cyberattack factored in its prior forecast.

    In early August, Clorox forecast sales in 2024 would be flat to 2% higher than 2023’s $7.39 billion, and adjusted earnings between $5.60 and $5.90 for the year, while analysts had expected $5.62 a share on revenue of $7.4 billion at the time.

    Analysts currently forecast, on average, adjusted earnings of $5.78 a share on revenue of $7.5 billion.

    Based on the company’s current assessment, Clorox said it expects “to experience ongoing, but lessening, operational impacts in the second quarter as it makes progress in returning to normalized operations,” and restocking retailers.

    Analysts also forecast second-quarter earnings of $1.18 a share on revenue of $1.77 billion.

    Clorox said it was “in the process of assessing the impact of the cybersecurity attack on fiscal-year 2024 and beyond,” and said it would provide an update during its first-quarter earnings call scheduled in November.

    Back in mid-September, Clorox said the cyberattack would weigh on its results, and by the end of the month shares were on their longest losing streak since 2009.

    Clorox shares have fallen nearly 18% since the company first disclosed the attack in a filing with the Securities and Exchange Commission on Aug. 14.

    [ad_2]

    Source link