ReportWire

Tag: Malware

  • US Bans Kaspersky Software

    US Bans Kaspersky Software

    [ad_1]

    The Russian cybersecurity software firm Kaspersky’s days of operating in the United States are now officially numbered.

    The Biden administration on Thursday said it’s banning the company from selling its products to new US-based customers starting on July 20, with the company only allowed to provide software updates to existing customers through September 29. The ban—the first such action under authorities given to the Commerce Department in 2019—follows years of warnings from the US intelligence community about Kaspersky being a national security threat because Moscow could allegedly commandeer its all-seeing antivirus software to spy on its customers.

    “When you think about national security, you may think about guns and tanks and missiles,” Commerce secretary Gina Raimondo told reporters during a briefing Thursday. “But the truth is, increasingly, it’s about technology, and it’s about dual-use technology, and it’s about data.”

    The US conducted an “extremely thorough” investigation of Kaspersky and explored “every option” to mitigate its risks, Raimondo said, but officials settled on a full ban “given the Russian government’s continued offensive cyber capabilities and capacity to influence Kasersky’s operations.”

    The Kaspersky ban represents the latest rift in relations between the US and Russia as the latter country remains locked in a brutal war with Ukraine and takes other steps to threaten Western democracies, including testing a nuclear-powered anti-satellite weapon and forming a strategic alliance with North Korea. But the ban could also immediately complicate business operations for American companies using Kaspersky software, which will lose up-to-date antivirus definitions critical for blocking malware in only three months.

    The Biden administration knows roughly how many customers Kaspersky has in the US, but government lawyers have determined that this information is proprietary business data and cannot be published, according to a Commerce Department official, who briefed reporters on the condition of anonymity to discuss a sensitive matter. The official did say the “significant number” of US customers includes state and local governments and organizations that supply critical infrastructure such as telecommunications, power, and health care.

    Raimondo had a message for Kaspersky’s US customers on Thursday: “You have done nothing wrong, and you are not subject to any criminal or civil penalties. However, I would encourage you, in as strong as possible terms, to immediately stop using that software and switch to an alternative in order to protect yourself and your data and your family.”

    Commerce will work with the departments of Homeland Security and Justice to “get this message out” and “ensure a smooth transition,” including through a website explaining the ban, Raimondo said. “We certainly don’t want to disrupt the business or families of any Americans.”

    DHS’s Cybersecurity and Infrastructure Security Agency will contact critical infrastructure organizations that use Kaspersky to brief them on the alleged national security risks and “help them identify alternatives,” the Commerce Department official said.

    Kaspersky has consistently denied being a national security risk or an agent of the Kremlin. In a statement to WIRED, the company accused the government of having “made its decision based on the present geopolitical climate and theoretical concerns, rather than on a comprehensive evaluation of the integrity of Kaspersky’s products and services.”

    [ad_2]

    Eric Geller

    Source link

  • Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

    Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

    [ad_1]

    It’s possible the ShinyHunter hackers did not directly hack the EPAM worker, and simply gained access to the Snowflake accounts using usernames and passwords they obtained from old repositories of credentials stolen by info stealers. But, as Reddington points out, this means that anyone else can sift through those repositories for these and other credentials stolen from EPAM accounts. Reddington says they found data online that was used by nine different infostealers to harvest data from the machines of EPAM workers. This raises potential concerns about the security of data belonging to other EPAM customers.

    EPAM has customers across various critical industries, including banks and other financial services, health care, broadcast networks, pharmaceutical, energy and other utilities, insurance, and software and hi-tech—the latter customers include Microsoft, Google, Adobe, and Amazon Web Services. It’s not clear, however, if any of these companies have Snowflake accounts to which EPAM workers have access. WIRED also wasn’t able to confirm whether Ticketmaster, Santander, Lending Tree, or Advance AutoParts are EPAM customers.

    The Snowflake campaign also highlights the growing security risks from third-party companies in general and from infostealers. In its blog post this week, Mandiant suggested that multiple contractors were breached to gain access to Snowflake accounts, noting that contractors—often known as business process outsourcing (BPO) companies—are a potential gold mine for hackers, because compromising the machine of a contractor that has access to the accounts of multiple customers can give them direct access to many customer accounts.

    “Contractors that customers engage to assist with their use of Snowflake may utilize personal and/or non-monitored laptops that exacerbate this initial entry vector,” wrote Mandiant in its blog post. “These devices, often used to access the systems of multiple organizations, present a significant risk. If compromised by infostealer malware, a single contractor’s laptop can facilitate threat actor access across multiple organizations, often with IT and administrator-level privileges.”

    The company also highlighted the growing risk from infostealers, noting that the majority of the credentials the hackers used in the Snowflake campaign came from repositories of data previously stolen by various infostealer campaigns, some of which dated as far back as 2020. “Mandiant identified hundreds of customer Snowflake credentials exposed via infostealers since 2020,” the company noted.

    This, accompanied by the fact that the targeted Snowflake accounts didn’t use MFA to further protect them, made the breaches in this campaign possible, Mandiant notes.

    Snowflake’s CISO, Brad Jones, acknowledged last week that the lack of multifactor authentication enabled the breaches. In a phone call this week, Jones told WIRED that Snowflake is working on giving its customers the ability to mandate that users of their accounts employ multifactor authentication going forward, “and then we’ll be looking in the future to [make the] default MFA,” he says.

    [ad_2]

    Kim Zetter

    Source link

  • TikTok Hack Targets ‘High-Profile’ Users via DMs

    TikTok Hack Targets ‘High-Profile’ Users via DMs

    [ad_1]

    TikTok says it’s currently taking steps to mitigate a cyberattack that’s targeting a number of high-profile users through direct messages, in an attempt to hijack their accounts.

    “We have taken measures to stop this attack and prevent it from happening in the future. We’re working directly with affected account owners to restore access, if needed,” says Jason Grosse, a spokesperson for TikTok’s privacy and security team.

    Grosse says TikTok is still investigating the attack and could not comment at this time about its scale or sophistication, describing the threat as merely a “potential exploit.”

    TikTok’s acknowledgment followed a report on Tuesday claiming CNN’s account had been temporarily breached last week. Citing an anonymous source at the news organization, Semifor reports that the breach did “not appear to be the result of someone gaining access from CNN’s end.” CNN did not immediately respond to WIRED’s request to comment.

    Concerns over hacking attempts targeting news organizations in the US are particularly high given the impending presidential election this fall.

    Forbes reported earlier in the day that the account of hotel heiress Paris Hilton was similarly affected, citing sources within the company. A source at TikTok tells WIRED that Hilton’s account was targeted but had not been compromised.

    Security and privacy concerns around TikTok expand beyond cyberattacks by malicious actors. The company itself is fighting to remain available in the United States after US president Joe Biden signed a law in April that forces its parent company, China-based ByteDance, to sell TikTok or face a ban. TikTok and several users have sued the US government, claiming the law is unconstitutional on First Amendment grounds.

    This is a developing story. Check back for updates.

    [ad_2]

    Dell Cameron

    Source link

  • ‘Largest Botnet Ever’ Tied to Billions in Stolen Covid-19 Relief Funds

    ‘Largest Botnet Ever’ Tied to Billions in Stolen Covid-19 Relief Funds

    [ad_1]

    The United States Department of Justice on Wednesday announced charges against a 35-year-old Chinese national, Yunhe Wang, accused of operating a massive botnet allegedly linked to billions of dollars in fraud, child exploitation, and bomb threats, among other crimes.

    Wang, identified by numerous pseudonyms—Tom Long and Jack Wan, among others—was arrested on May 24 and is accused of distributing malware through various pop-up VPN services, such as “ProxyGate” and “MaskVPN,” and by embedding viruses in internet files distributed via peer-to-peer networks known as torrents.

    The malware is said to have compromised computers located in nearly every country in the world, turning them into proxies through which criminals were able to hide their identities while committing countless crimes. According to prosecutors in the US, this included the theft of billions of dollars slated for Covid-19 pandemic relief—funds allegedly stolen by foreign actors posing as unemployed US citizens.

    According to an indictment, the infected computers allegedly provided Wang’s customers with a persistent backdoor, allowing them to disguise themselves as any one of the victims of Wang’s malware. This illicit proxy service, known as “911 S5,” launched as early as 2014, the US government says.

    “The 911 S5 Botnet infected computers in nearly 200 countries and facilitated a whole host of computer-enabled crimes, including financial frauds, identity theft, and child exploitation,” says FBI director Christopher Wray, who described the illicit service as “likely the world’s largest botnet ever.”

    The US Treasury Department has also sanctioned Wang and two other individuals allegedly tied to 911 S5.

    Wang is said to have amassed access to nearly 614,000 IP addresses in the US and more than 18 million others worldwide—collectively forming the botnet. 911 S5’s customers were able to filter the IPs geographically to choose where they’d like to appear to be located, down to a specific US zip code, the DOJ claims.

    The indictment states that of the 150 dedicated servers used to manage the botnet, as many as 76 were leased by US-based service providers, including the one hosting 911 S5’s client interface, which allowed criminals overseas to purchase goods using stolen credit cards, in many cases for the alleged purpose of circumventing US export laws.

    More than half a million fraudulent claims lodged with pandemic relief programs in the United States are allegedly tied to 911 S5. According to the indictment, nearly $6 billion in losses have been linked to IP addresses captured by 911 S5. Many of the IP addresses have been reportedly tied to more insidious crimes, including bomb threats and the trafficking of child sexual abuse material, or CSAM.

    “Proxy services like 911 S5 are pervasive threats that shield criminals behind the compromised IP addresses of residential computers worldwide,” says Damien Diggs, the US attorney for the Eastern District of Texas, where the charges against Wang were brought by a grand jury earlier this month.

    Adds Nicole Argentieri, head of the Justice Department’s Criminal Division: “These criminals used the hijacked computers to conceal their identities and commit a host of crimes, from fraud to cyberstalking.”

    At the time of writing, it is unclear whether these virtual impersonations resulted in any criminal investigations or charges against US-based victims whose IP addresses were hijacked as part of the 911 S5 botnet. WIRED is awaiting a response from the Department of Justice regarding this concern.

    According to the Justice Department, law enforcement agencies in Singapore, Thailand, and Germany collaborated with US authorities to effect Wang’s arrest.

    Wang faces charges of conspiracy, computer fraud, conspiracy to commit wire fraud, and conspiracy to money laundering, with a maximum penalty of 65 years in prison. The US is also seeking to seize a mountain of luxury cars and goods allegedly owned by Wang, including a 2022 Ferrari Spider valued at roughly half a million dollars as well as a Patek Philippe watch worth potentially several times that amount.

    [ad_2]

    Dell Cameron

    Source link

  • Germany arrests EU Parliament staff member on China espionage charges

    Germany arrests EU Parliament staff member on China espionage charges

    [ad_1]

    Surveillance cameras are mounted above the German and Chinese flags in front of Tongji University. Scholz is on a three-day trip to China.

    Michael Kappeler/dpa | Picture Alliance | Getty Images

    Germany has arrested a national on charges of spying for the Chinese secret service and leaking information from the European Parliament, Germany’s federal prosecutor’s office said on Tuesday.

    The man was also accused of spying on members of the Chinese opposition in Germany, according to a CNBC translation.

    The alleged spy was named as Jian G. and identified as an employee of a German member of the European Parliament since 2019.

    Local media has reported that the MEP in question is Maximilian Krah of the far-right AfD. Their offices are reportedly next to each other in the parliament in Brussels, but the alleged spy has not been seen there, local media was told.

    CNBC could not independently verify this information.

    A spokesperson for the AfD told CNBC that reports of the arrest of Krah’s employee are “deeply concerning,” according to a CNBC translation, without directly confirming whether such a detainment had taken place. The party would do everything to support the investigation, the spokesperson added.

    “In January 2024 the accused repeatedly shared information about negotiations and decisions in the European Parliament with his intelligence service employer,” the German federal prosecutors office said in a statement, according to a CNBC translation.

    G. was arrested on Monday, according to the prosecutor’s office, and a judge is set to decide about an arrest warrant and custody arrangements on Tuesday. The allegations follow an investigation by German domestic intelligence services.

    “If it is confirmed that there was espionage for Chinese intelligence services from within the European Parliament, then that would be an attack on European democracy from within. Whoever employs such a person carries responsibility,” Nancy Faeser, German interior minister, said in a CNBC-translated post on social media platform X.

    Separately on Monday, three other German nationals were arrested on charges of sharing information pertaining to German research about new technologies that have a military use with China’s secret service, the federal prosecutor said.

    The Chinese embassy in Germany did not immediately respond to a CNBC request for comment.

    The Chinese foreign ministry on Tuesday rejected claims of espionage in Germany, saying the “hype” surrounding such accusations is aimed to discredit and suppress China, Reuters reported. The ministry also said it hoped that Germany would stop using the so-called spy threat to manipulate political narratives, according to Reuters.

    Elsewhere, two U.K. citizens were also arrested for allegedly spying for China on Monday.

    [ad_2]

    Source link

  • Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak

    Change Healthcare Finally Admits It Paid Ransomware Hackers—and Still Faces a Patient Data Leak

    [ad_1]

    For Change Healthcare and the beleaguered medical practices, hospitals, and patients that depend on it, the confirmation of its extortion payment to the hackers adds a bitter coda to an already dystopian story. AlphV’s digital paralysis of Change Healthcare, a subsidiary of UnitedHealth Group, snarled the insurance approval of prescriptions and medical procedures for hundreds of medical practices and hospitals across the country, making it by some measures the most widespread medical ransomware disruption ever. A survey of American Medical Association members, conducted between March 26 and April 3, found that four out of five clinicians had lost revenue as a result of the crisis. Many said they were using their own personal finances to cover a practice’s expenses. Change Healthcare, meanwhile, says that it has lost $872 million to the incident and projects that number to rise well over a billion in the longer term.

    Change Healthcare’s confirmation of its ransom payment now appears to show that much of that catastrophic fallout for the US healthcare system unfolded after it had already paid the hackers an exorbitant sum—a payment in exchange for a decryption key for the systems the hackers had encrypted and a promise not to leak the company’s stolen data. As is often the case in ransomware attacks, AlphV’s disruption of its systems appears to have been so widespread that Change Healthcare’s recovery process has extended long after it obtained the decryption key designed to unlock its systems.

    As ransomware payments go, $22 million wouldn’t be the most that a victim has forked over. But it’s close, says Brett Callow, a ransomware-focused security researcher who spoke to WIRED about the suspected payment in March. Only a few rare payments, such as the $40 million paid to hackers by CNA Financial in 2021, top that number. “It’s not without precedent, but it’s certainly very unusual,” Callow said of the $22 million figure.

    That $22 million injection of funds into the ransomware ecosystem further fuels a vicious cycle that has reached epidemic proportions. Cryptocurrency tracing firm Chainalysis found that in 2023, ransomware victims paid the hackers targeting them fully $1.1 billion, a new record. Change Healthcare’s payment may represent only a small drop in that bucket. But it both rewards AlphV for its highly damaging attacks and may suggest to other ransomware groups that healthcare companies are particularly profitable targets, given those companies are especially sensitive to both the high cost of those cyberattacks financially and the risks they pose to patients’ health.

    Compounding Change Healthcare’s mess is an apparent double-cross within the ransomware underground: AlphV by all appearances faked its own law enforcement takedown after receiving Change Healthcare’s payment in an attempt to avoid sharing it with its so-called affiliates, the hackers who partner with the group to penetrate victims on its behalf. The second ransomware group threatening ChangeHealthcare, RansomHub, now claims to WIRED that they obtained the stolen data from those affiliates, who still want to be paid for their work.

    That’s created a situation where Change Healthcare’s payment provides little assurance that its compromised data won’t still be exploited by disgruntled hackers. “These affiliates work for multiple groups. They’re concerned with getting paid themselves, and there’s no trust among thieves,” Analyst1’s DiMaggio told WIRED in March. “If someone screws someone else, you don’t know what they’re going to do with the data.”

    All of that means Change Healthcare still has little assurance that it’s avoided an even worse scenario than it’s yet faced: paying what may be one of the biggest ransoms in history and still seeing its data spilled onto the dark web. “If it gets leaked after they paid $22 million, it’s pretty much like setting that money on fire,” DiMaggio warned in March. “They’d have burned that money for nothing.”

    [ad_2]

    Andy Greenberg

    Source link

  • The XZ Backdoor: Everything You Need to Know

    The XZ Backdoor: Everything You Need to Know

    [ad_1]

    On Friday, a lone Microsoft developer rocked the world when he revealed a backdoor had been intentionally planted in XZ Utils, an open source data compression utility available on almost all installations of Linux and other Unix-like operating systems. The person or people behind this project likely spent years on it. They were likely very close to seeing the backdoor update merged into Debian and Red Hat, the two biggest distributions of Linux, when an eagle-eyed software developer spotted something fishy.

    “This might be the best-executed supply chain attack we’ve seen described in the open, and it’s a nightmare scenario: malicious, competent, authorized upstream in a widely used library,” software and cryptography engineer Filippo Valsorda said of the effort, which came frightfully close to succeeding.

    Researchers have spent the weekend gathering clues. Here’s what we know so far.

    What Is XZ Utils?

    XZ Utils is nearly ubiquitous in Linux. It provides lossless data compression on virtually all Unix-like operating systems, including Linux. XZ Utils provides critical functions for compressing and decompressing data during all kinds of operations. XZ Utils also supports the legacy .lzma format, making this component even more crucial.

    What Happened?

    Andres Freund, a developer and engineer working on Microsoft’s PostgreSQL offerings, was recently troubleshooting performance problems a Debian system was experiencing with SSH, the most widely used protocol for remotely logging in to devices over the Internet. Specifically, SSH logins were consuming too many CPU cycles and were generating errors with valgrind, a utility for monitoring computer memory.

    Through sheer luck and Freund’s careful eye, he eventually discovered the problems were the result of updates that had been made to XZ Utils. On Friday, Freund took to the Open Source Security List to disclose the updates were the result of someone intentionally planting a backdoor in the compression software.

    What Does the Backdoor Do?

    Malicious code added to XZ Utils versions 5.6.0 and 5.6.1 modified the way the software functions when performing operations related to .lzma compression or decompression. When these functions involved SSH, they allowed for malicious code to be executed with root privileges. This code allowed someone in possession of a predetermined encryption key to log in to the backdoored system over SSH. From then on, that person would have the same level of control as any authorized administrator.

    How Did This Backdoor Come to Be?

    It would appear that this backdoor was years in the making. In 2021, someone with the username JiaT75 made their first known commit to an open source project. In retrospect, the change to the libarchive project is suspicious, because it replaced the safe_fprint funcion with a variant that has long been recognized as less secure. No one noticed at the time.

    The following year, JiaT75 submitted a patch over the XZ Utils mailing list, and, almost immediately, a never-before-seen participant named Jigar Kumar joined the discussion and argued that Lasse Collin, the longtime maintainer of XZ Utils, hadn’t been updating the software often or fast enough. Kumar, with the support of Dennis Ens and several other people who had never had a presence on the list, pressured Collin to bring on an additional developer to maintain the project.

    In January 2023, JiaT75 made their first commit to XZ Utils. In the months following, JiaT75, who used the name Jia Tan, became increasingly involved in XZ Utils affairs. For instance, Tan replaced Collins’ contact information with their own on oss-fuzz, a project that scans open source software for vulnerabilities that can be exploited. Tan also requested that oss-fuzz disable the ifunc function during testing, a change that prevented it from detecting the malicious changes Tan would soon make to XZ Utils.

    In February of this year, Tan issued commits for versions 5.6.0 and 5.6.1 of XZ Utils. The updates implemented the backdoor. In the following weeks, Tan or others appealed to developers of Ubuntu, Red Hat, and Debian to merge the updates into their OSes. Eventually, one of the two updates made its way into several releases, according to security firm Tenable. There’s more about Tan and the timeline here.

    Can You Say More About What This Backdoor Does?

    In a nutshell, it allows someone with the right private key to hijack sshd, the executable file responsible for making SSH connections, and from there to execute malicious commands. The backdoor is implemented through a five-stage loader that uses a series of simple but clever techniques to hide itself. It also provides the means for new payloads to be delivered without major changes being required.

    Multiple people who have reverse-engineered the updates have much more to say about the backdoor. Developer Sam James provided an overview here.

    [ad_2]

    Dan Goodin, Ars Technica

    Source link

  • Colorado public defender ransomware attack may have exposed Social Security numbers, personal data

    Colorado public defender ransomware attack may have exposed Social Security numbers, personal data

    [ad_1]

    The Office of the Colorado State Public Defender has acknowledged personal data may have been stolen during a ransomware attack that crippled the statewide agency in early February — but won’t say much else about the ongoing effort to restore its systems after the hack.

    Files “were copied without permission” during the cyberattack, which was discovered on Feb. 9, and those files may have included names, Social Security numbers, driver’s license numbers, medical information and health insurance information, the agency said in a statement Friday.

    Officials from the public defender’s office are still investigating whose personal data may have been stolen, and whether the personal data of attorneys or their clients was compromised, they said. A statement on the agency’s website urges “individuals” to remain vigilant against identity theft and fraud.

    It’s been more than a month since public defenders across the state were locked out of their computers and files in the ransomware attack and hundreds of court hearings were delayed over the next week because public defenders couldn’t do their jobs.

    Officials this week refused to answer questions from The Denver Post about what particular parts of the agency’s systems remain inoperable. In a ransomware attack, hackers use malware to hold an organization’s data hostage then demand a payment in cryptocurrency in order for organizations to regain access to that data.

    The public defender’s office also would not disclose the amount of ransom demanded or whether a ransom was paid. A statement on the agency’s website says the office has “made progress in returning to full operations.”

    Heavily redacted emails and text messages released to The Post by the Governor’s Office of Information Technology this week in response to an open records request mention the cyberattack recovery law firm Mullen Coughlin. Chief Deputy Public Defender Zak Brown would not confirm whether the public defender’s office is working with the firm.

    “We have provided all the information we are able to at this time,” he said in an email.

    A message left with the Pennsylvania-based law firm was not returned Wednesday.

    [ad_2]

    Shelly Bradbury

    Source link

  • Brussels spyware bombshell: Surveillance software found on officials’ phones

    Brussels spyware bombshell: Surveillance software found on officials’ phones

    [ad_1]

    The European Parliament is on high alert for cyberattacks and foreign interference in the run-up to the EU election in June.

    POLITICO reported in December that an internal review showed that the institution’s cybersecurity “has not yet met industry standards” and is “not fully in-line with the threat level” posed by state-sponsored hackers and other threat groups.

    One member of the security and defense subcommittee went in for a routine check on Tuesday, which resulted in a discovery of traces of spyware on their phone. The member told POLITICO it wasn’t immediately clear why they were targeted with hacking software.

    Parliament’s Deputy Spokesperson Delphine Colard said in a statement that “traces found in two devices” prompted the email calling on members to have their phones checked.

    “In the given geopolitical context and given the nature of the files followed by the subcommittee on security and defence, a special attention is dedicated to the devices of the members of this subcommittee and the staff supporting its work,” the statement said.

    The new revelations follow previous incidents with other European Parliament members targeted with spyware. Researchers revealed in 2022 that the phones of members of the Catalan independence movement, including EU politicians, were infected with Pegasus and Candiru, two types of hacking tools. That same year, Greek member of the EU Parliament and opposition leader Nikos Androulakis was among a list of Greek political and public figures found to have been targeted with Predator, another spyware tool. Parliament’s President Roberta Metsola previously also faced an attempted hacking using spyware.

    European Parliament members in 2022 set up a special inquiry committee to investigate the issue. It investigated a series of scandals in countries including Spain, Greece, Hungary and Poland and said at least four governments in the EU had abused the hacking tools for political gain.

    Parliament’s IT service launched a system to check members’ phones for spyware in April last year. It had run “hundreds of operations” since the program started, the statement said.

    [ad_2]

    Antoaneta Roussi

    Source link

  • Notorious ransomware provider LockBit taken over by law enforcement

    Notorious ransomware provider LockBit taken over by law enforcement

    [ad_1]

    Washington — A ransomware service provider that has targeted over 2,000 systems across the globe, including hospitals in the U.S., with demands for hundreds of millions of dollars was taken down Monday, and Russian nationals were charged as part of an international plot to deploy the malicious software, the Justice Department announced Tuesday. 

    Known as LockBit, the network of cybercriminals targets critical components of manufacturing, healthcare and logistics across the globe, offering its services to hackers who deploy its malware into vulnerable systems and hold them hostage until a ransom is paid. The attackers have so far extorted more than $120 million from their victims, officials said, and their program has evolved into one of the most notorious and active.

    As part of this week’s operation, the FBI and its law enforcement partners in the United Kingdom seized numerous public-facing platforms where cybercriminals could initiate contact with and join LockBit. Investigators also seized two servers in the U.S. that were used to transfer stolen victim data. 

    The front page of LockBit’s site has been replaced with the words “this site is now under control of law enforcement,” alongside the flags of the U.K., the U.S. and several other nations, the Associated Press noted.

    Take down notice issued by a group of global intelligence to Lockbit
    A screenshot from Feb. 19, 2024 shows a take down notice that a group of global intelligence agencies issued to a dark web site called Lockbit.

    Handout via Reuters


    According to Attorney General Merrick Garland, the U.S. and its allies went “a step further” by obtaining the “keys” that can unlock attacked computer systems to help victims “regain access to their data,” releasing them from having to pay a ransom. The move could help hundreds of victims worldwide. 

    Two Russian nationals who allegedly used LockBit’s ransomware against companies across the U.S. — in Oregon, New York, Florida and Puerto Rico — were also indicted in New Jersey as part of the Justice Department’s latest play against the group. 

    Artur Sungatov and Ivan Kondratyev joined a growing number of defendants accused by federal prosecutors of attacking American institutions as part of the LockBit scheme. A total of five have now been charged, including an individual who allegedly targeted Washington, D.C.’s police force. 

    LockBit was the most commonly used version of ransomware in 2022, according to a joint cybersecurity advisory published by the FBI and the Cybersecurity and Infrastructure Security Agency last year, and targeted an “array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation.” 

    The LockBit network was first seen on Russian-speaking cybercrime platforms in 2020 and continued to evolve and grow, targeting computer platforms and various operating systems. By 2022, 16% of ransomware attacks in the U.S. were deployed by the LockBit group, according to the advisory. 

    Criminals conventionally gain access to vulnerable systems through phishing emails or when users visit an infected site while browsing the internet. And U.S. officials consistently warn users to avoid paying ransoms and instead contact law enforcement.

    Federal investigators have recently developed a new approach to combat ransomware attacks that can be both costly to victims and damaging to the normal functioning of society: arming victims with the tools necessary to counter a malware attack. 

    Similar to the LockBit operation, in July 2022, the FBI toppled an international ransomware group called Hive and collected decryption keys for its penetrated computer networks it had breached to conduct what officials called a “21st-century high-tech cyber stakeout.” FBI agents then distributed the keys to the victims whose networks were being ransomed. 

    And in August, investigators took down a criminal network known as the Qakbot botnet — a grouping of computers infected by a malware program that was used to carry out cyberattacks. Law enforcement gained access to the QakBot infrastructure and “redirected” the cyber activity to servers controlled by U.S. investigators, who were then able to inject the malware with a program that released the victim computer from the botnet, freeing it of the malicious host. 

    Victims of LockBit attacks are encouraged to contact the FBI for further assistance. 

    Robert Legare

    Robert Legare is a CBS News multiplatform reporter and producer covering the Justice Department, federal courts and investigations. He was previously an associate producer for the “CBS Evening News with Norah O’Donnell.”

    [ad_2]

    Source link

  • Cyberattack shuts down Colorado public defender’s office

    Cyberattack shuts down Colorado public defender’s office

    [ad_1]

    A cyberattack on the Office of Colorado State Public Defender has forced the office to shut down its computer network, locking public defenders across the state out of critical work systems.

    Colorado public defenders do not have access to their work computers, are unable to access court dockets or court filings and can’t do any significant work for clients in court, according to internal emails reviewed by The Denver Post.

    Office spokesman James Karbach confirmed the breach in a statement Monday, saying officials “recently became aware that some data within our computer system was encrypted by malware.”

    Karbach did not say how long the public defender’s office expects to be shut down or when the attack happened, but emails sent to public defenders indicate the statewide office is effectively “non-operational” and the outage could last as long as a week.

    [ad_2]

    Shelly Bradbury

    Source link

  • How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

    How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

    [ad_1]

    It was a trading day unlike any other for traders in the $25 trillion Treasury market, with a 30-year bond auction seen as having been partially undermined by a cyberattack on the U.S. unit of a Chinese bank.

    In recapping Treasury’s poorly received $24 billion bond auction on Thursday, traders said the weaker-than-expected results likely had at least something to do with this week’s ransomware hit on the American arm of Industrial & Commercial Bank of China, known as ICBC. That attack reportedly caused disruptions across the market and had some impact on liquidity, with the Financial Times citing unnamed sources as saying hedge funds and asset managers were forced to reroute trades.

    Traders were grappling on Friday to answer the question of what created the sudden lack of interest at the auction, which went so badly that it also shook up U.S. stock investors. Thursday’s sale was the worst since November 2021, based on the extent to which primary dealers were forced to step in and pick up the slack in demand, one trader said. And it reinforced a recent pattern of weak auctions for the 30-year bond that may not bode well for future sales of that long-dated maturity.

    It’s possible that bonds simply “look much less attractive” following a recent “explosive rally” since late October, according to Charlie McElligott, a cross-asset macro strategist at Nomura Securities in New York. However, “this might be the case of ‘more than meets the eye’ to this ‘ugly auction evidencing low demand for duration’ story,” he wrote in a note.

    “One dynamic that makes yesterday’s ugly auction results murky was the ICBC cyberattack described across various financial media, which gunked-up anybody who clears UST trades through them, and made it so that many dealers were then likely unable to trade with those clients until resolved, on account of unsettled trades which weren’t able to be matched,” McElligott said.

    Adding to Thursday’s uncertainty was another random event. Federal Reserve Chairman Jerome Powell appeared on stage in an International Monetary Fund panel, was interrupted by a climate protester, and then uttered a seven-letter expletive that could be heard on the event’s livestream.

    Powell’s policy-related remarks, which indicated the central bank might take further action to control inflation, “didn’t help things and kind of spooked people again,” said John Farawell, head of municipal trading at New York bond underwriter Roosevelt & Cross.

    Read: Fed’s Powell Made Cryptic Comments. How He’s Guiding the Market.

    On Friday, the Treasury market found stabilization as buyers returned to segments of government debt in a sign that calm was being restored. A rush of buying was seen on the 30-year bond
    BX:TMUBMUSD30Y,
    sending its yield down to 4.733% and to a third straight weekly decline.

    Meanwhile, Bloomberg News reported that the repercussions of the ICBC cyberattack included an inability to deliver U.S. debt that was being pledged as collateral. ICBC’s U.S. unit was forced to rely on a messenger carrying a USB stick across Manhattan to complete disrupted trades, according to the news service, which also described Thursday’s $24 billion 30-year bond auction as one of the worst in a decade.

    The ICBC attack “might have had a dramatic impact on the auction. I don’t know how much, but I also can’t imagine it didn’t,” said Tom di Galoma, co-head of global rates trading for BTIG in New York. “When people see that there are trade-settlement issues, there’s a willingness to back off and that’s exactly what happened yesterday. Institutional accounts were saying, ‘We don’t know who is settling this trade.’ If the cyberattack hadn’t happened, I think the auction would have gone a lot better.”

    Ben Emons, a senior portfolio manager and head of fixed income for NewEdge Wealth in New York, said that once the Treasury market got upended by the ICBC cyberattack, the bad auction, and the interruption during Powell’s appearance, liquidity on U.S. government debt “was, for a moment, a dark matter.”

    [ad_2]

    Source link

  • StripedFly malware targets more than a million PCs, disguising as a crypto miner

    StripedFly malware targets more than a million PCs, disguising as a crypto miner

    [ad_1]

    Kaspersky unveils StripedFly, a stealthy malware posing as a crypto miner, compromising over a million Windows and Linux systems globally since 2016.

    For over half a decade, a dangerous malware dubbed “StripedFly” has been lurking in the shadows, posing as a crypto mining software. Leading antivirus developers, Kaspersky reported that this duplicitous malware has compromised over a million Windows and Linux systems worldwide since 2016.

    Kaspersky’s cybersecurity team initiated their investigation into StripedFly last year. They were tipped off by anomalies within their antivirus software, which changed certain functions in the Windows OS. 

    Kaspersky’s investigation 

    A striking discovery during the investigation was StripedFly’s use of an EternalBlue variant. This exploit, originally developed by the United States National Security Agency (NSA), became infamous after it was illegally disclosed and subsequently employed in the 2017 WannaCry ransomware attacks that affected numerous Windows systems globally.

    StripedFly leverages its unique variant of EternalBlue to worm its way into unpatched Windows systems, from where it can traverse across a network to include Linux machines. Once in the system, it’s capable of collecting a wide range of sensitive information, including login details and personal data.

    The origins of StripedFly remain a mystery. Though it uses the same techniques as EternalBlue, that particular code was only made publicly available in April 2017 by a group called the “Shadow Brokers.” However, Kaspersky disclosed that the earliest detection of StripedFly dates back to April of 2016. Also, a version of this mysterious malware has appeared in a ransomware attack named ThunderCrypt.

    Microsoft released a patch for EternalBlue back in early 2017, which also works against StripedFly. Unfortunately, using outdated windows has been a rather common user behavior over the years, which is why over a million devices have been breached by StripedFly so far. 


    Follow Us on Google News

    [ad_2]

    Mohammad Shahidullah

    Source link

  • 5 Things Successful Businesses Do to Fight Cybercrime | Entrepreneur

    5 Things Successful Businesses Do to Fight Cybercrime | Entrepreneur

    [ad_1]

    In this digital age, cyberattacks aim to exploit a business’s every vulnerability—namely it’s people, devices, and systems. With attacks potentially coming from every direction, what is a business leader supposed to do? Where do you start?

    If you’re ready to stop worrying and start preparing, then you won’t want to miss this free webinar, 5 Things Successful Businesses Do to Fight Cybercrime, sponsored by Comcast Business and presented by Entrepreneur.

    Join us for an illuminating conversation during which we’ll break down the essential strategies to help safeguard your business against cybercrime. With our panel of cybersecurity experts, we’ll deliver actionable insights that can help you understand the risks of cyberattacks and develop a cybersecurity strategy.

    The conversation will be led by business consultant and moderator Terry Rice. He will be joined by Shena Seneca Tharnish, VP of Secure Networking & Cybersecurity Solutions at Comcast Business, and Mani Sundaram, EVP and GM of Akamai’s Security Technology Group.

    Attendees of this webinar will gain a deeper understanding of the following takeaways:

    • Awareness of different types of threats: Gain an understanding of the cyber threats that are out there, from ransomware to phishing scams. Be in the know to stay a step ahead.
    • Educating leaders and employees: Learn how to foster a culture of cybersecurity awareness within your organization. Get your team equipped and aligned to fight off cyber threats.
    • Have a plan in place: Get a framework for developing a cybersecurity plan that covers proactive and reactive measures. A plan isn’t a luxury; it’s a necessity.
    • Invest in the right technology: Discover the types of cybersecurity technology that new and growing businesses should consider. Think of technology as in investment in an effort to protect your business assets.
    • Make cybersecurity part of your business planning: Understand how to integrate cybersecurity measures into your business model and planning phases. Make security a routine aspect, not an afterthought.

    The 5 Things Successful Businesses Do to Fight Cybercrime webinar will take place live on Wednesday, October 25 at 12 p.m. ET | 9 a.m. PT.

    Webinar subject to change or cancellation.

    [ad_2]

    Entrepreneur Events

    Source link

  • Cyberattack forces hospitals to divert ambulances in Connecticut and Pennsylvania | CNN Politics

    Cyberattack forces hospitals to divert ambulances in Connecticut and Pennsylvania | CNN Politics

    [ad_1]



    CNN
     — 

    A cyberattack on Thursday knocked computer systems offline at hospitals in Connecticut and Pennsylvania, forcing them to send ambulances to other hospitals, hospital spokespeople told CNN.

    As of late Friday morning, Crozer Health, a network of three hospitals and a medical center in the Philadelphia suburbs, was still diverting ambulances for stroke and trauma patients to other hospitals because of a “ransomware attack,” Crozer Health spokesperson Lori Bookbinder told CNN.

    The hack hit Prospect Medical Holdings and affected all of their health care facilities, according to a statement from PMH affiliate Eastern Connecticut Health Network. PMH owns 16 hospitals in California, Connecticut, Pennsylvania and Rhode Island, according to its website.

    At Eastern Connecticut Health Network, which includes two hospitals, the urgent care center is closed and elective surgeries were canceled until further noticed because of the hack, according to the network’s website.

    Other Prospect Medical Holdings affiliates reported disruptions from the hack.

    “We are working closely with federal law enforcement to respond to this incident,” Prospective Medical Holdings said in a statement to CNN.

    National Security Council spokeswoman Adrienne Watson told CNN that the White House is “closely monitoring the ongoing incident,” adding that “the Department of Health and Human Services has been in contact with the company to offer federal assistance, and we are ready to provide support as needed to prevent any disruption to patient care as a result of this incident.”

    The company has so far declined offers of federal assistance, according to a US official.

    But Prospective Medical Holdings said later Friday that they “believe there may have been a miscommunication or a misunderstanding” and that they “welcome any assistance from the federal government.”

    CharterCARE Health Partners, which includes two hospitals in Rhode Island, said Thursday that the incident was affecting “inpatient and outpatient operations” and that “some patient procedures may be affected.”

    Patient care continues at the affected hospitals, but they’re operating with limited capacity in what is now a well-rehearsed routine. Throughout the coronavirus pandemic, ransomware and other cyberattacks hampered patient care at American hospitals that are often ill-equipped to deal with them.

    Eastern Connecticut Health Network ended ambulance diversion at 10 a.m. local time Friday, spokesperson Nina Kruse told CNN. The emergency rooms at ECHN’s two hospitals have been open throughout the incident, Kruse said.

    This isn’t Crozer Health’s first bout with ransomware. A June 2020 attack orchestrated by a prolific ransomware gang forced the hospital network to take its computer systems offline.

    This story has been updated with additional reporting.

    [ad_2]

    Source link

  • New York Times: US officials search for hidden Chinese malware that could affect military operations | CNN Politics

    New York Times: US officials search for hidden Chinese malware that could affect military operations | CNN Politics

    [ad_1]



    CNN
     — 

    US officials are searching for Chinese malware hidden in various defense systems that could disrupt military communications and resupply operations, The New York Times reported Saturday.

    The administration believes malicious computer code has been hidden inside “networks controlling power grids, communications systems and water supplies that feed military bases,” officials told the Times. The discovery has heightened concerns that hackers could “disrupt US military operations in the event of a conflict,” according to the Times. The two nations have been increasingly at odds over Taiwan as well as over China’s actions in the Indo-Pacific.

    One congressional official told the newspaper that the malware was “a ticking time bomb” that could allow China to cut off power, water and communications to military bases, slowing deployments and resupply operations. Because military bases often share the same supply infrastructure as civilian homes and businesses, many other Americans could also be affected, officials told the Times.

    The malware revelations echo a pattern of recent breaches by China-based hackers previously reported by CNN.

    Last week, the email account of US Ambassador to China Nicholas Burns was hacked, three US officials familiar with the matter told CNN.

    Earlier this month, Microsoft and the White House confirmed that China-based hackers breached email accounts at two dozen organizations, including some federal agencies. The Biden administration believes the hacking operation – which Microsoft said was launched in mid-May – gave the Chinese government insights about US thinking heading into Secretary of State Antony Blinken’s trip to Beijing in June.

    Among the agencies targeted were the State Department and the Department of Commerce, which has sanctioned Chinese telecom firms. US officials and Microsoft analysts initially had trouble identifying how the hackers got into the email accounts, which made clear that they were dealing with a sophisticated hacking team, a US official told CNN.

    US officials have consistently labeled China as the most advanced of US adversaries in cyberspace, a domain that has repeatedly been a source of bilateral tension in recent years. The FBI has said Beijing has a larger hacking program than all other governments combined.

    Blinken raised the hacking incidents in a meeting with a top Chinese diplomat in Indonesia earlier this month, a senior State Department official told CNN, but the official would not “get into the specifics” of the extent to which the hack was raised.

    “We have consistently made clear that any action that targets US government, US companies, American citizens, is a deep concern to us and that we will take appropriate action to hold those responsible accountable and the secretary made that clear again,” the official said.

    [ad_2]

    Source link

  • MEPs cling to TikTok for Gen Z votes

    MEPs cling to TikTok for Gen Z votes

    [ad_1]

    Press play to listen to this article

    Voiced by artificial intelligence.

    It may come with security risks but, for European Parliamentarians, TikTok is just too good a political tool to abandon.

    Staff at the European Parliament were ordered to delete the video-sharing application from any work devices by March 20, after an edict last month from the Parliament’s President Roberta Metsola cited cybersecurity risks about the Chinese-owned platform. The chamber also “strongly recommended” that members of the European Parliament and their political advisers give up the app.

    But with European Parliament elections scheduled for late spring 2024, the chamber’s political groups and many of its members are opting to stay on TikTok to win over the hearts and minds of the platform’s user base of young voters. TikTok says around 125 million Europeans actively use the app every month on average.

    “It’s always important in my parliamentary work to communicate beyond those who are already convinced,” said Leïla Chaibi, a French far-left lawmaker who has 3,500 TikTok followers and has previously used the tool to broadcast videos from Strasbourg explaining how the EU Parliament works.

    Malte Gallée, a 29-year-old German Greens lawmaker with over 36,000 followers on TikTok, said, “There are so many young people there but also more and more older people joining there. For me as a politician of course it’s important to be where the people that I represent are, and to know what they’re talking about.”

    Finding Gen Z 

    Parliament took its decision to ban the app from staffers’ phones in late February, in the wake of similar moves by the European Commission, Council of the EU and the bloc’s diplomatic service.

    A letter from the Parliament’s top IT official, obtained by POLITICO, said the institution took the decision after seeing similar bans by the likes of the U.S. federal government and the European Commission and to prevent “possible threats” against the Parliament and its lawmakers.

    For the chamber, it was a remarkable U-turn. Just a few months earlier its top lawmakers in the institution’s Bureau, including President Metsola and 14 vice presidents, approved the launch of an official Parliament account on TikTok, according to a “TikTok strategy” document from the Parliament’s communications directorate-general dated November 18 and seen by POLITICO. 

    “Members and political groups are increasingly opening TikTok accounts,” stated the document, pointing out that teenagers then aged 16 will be eligible to vote in 2024. “The main purpose of opening a TikTok channel for the European Parliament is to connect directly with the young generation and first time voters in the European elections in 2024, especially among Generation Z,” it said.

    Another supposed benefit of launching an official TikTok account would be countering disinformation about the war in Ukraine, the document stated.  

    Most awkwardly, the only sizeable TikTok account claiming to represent the European Parliament is actually a fake one that Parliament has asked TikTok to remove.

    Dummy phones and workarounds

    Among those who stand to lose out from the new TikTok policy are the European Parliament’s political groupings. Some of these groups have sizeable reach on the Chinese-owned app.

    All political groups with a TikTok account said they will use dedicated computers in order to skirt the TikTok ban on work devices | Khaled Desouki/AFP via Getty Images

    The largest group, the center-right European People’s Party, has 51,000 followers on TikTok. Spokesperson Pedro López previously dismissed the Parliament’s move to stop using TikTok as “absurd,” vowing the EPP’s account will stay up and active. López wrote to POLITICO that “we will use dedicated computers … only for TikTok and not connected to any EP or EPP network.”

    That’s the same strategy that all other political groups with a TikTok account — The Left, Socialists and Democrats (S&D) and Liberal Renew groups — said they will use in order to skirt the TikTok ban on work devices like phones, computers or tablets, according to spokespeople. Around 30 Renew Europe lawmakers are active on the platform, according to the group’s spokesperson.

    Beyond the groups, it’s the individual members of parliament — especially those popular on the app — that are pushing back on efforts to restrict its use.

    Clare Daly, an Irish independent member who sits with the Left group, is one of the most popular MEPs on the platform with over 370,000 subscribed to watch clips of her plenary speeches. Daly has gained some 80,000 extra followers in just the few weeks since Parliament’s ban was announced.

    Daly in an email railed against Parliament’s new policy: “This decision is not guided by a serious threat assessment. It is security theatre, more about appeasing a climate of geopolitical sinophobia in EU politics than it is about protecting sensitive information or mitigating cybersecurity threats,” she said.

    According to Moritz Körner, an MEP from the centrist Renew Europe group, cybersecurity should be a priority. “Politicians should think about cybersecurity and espionage first and before thinking about their elections to the European Parliament,” he told POLITICO, adding that he doesn’t have a TikTok account.

    Others are finding workarounds to have it both ways.

    “We will use a dummy phone and not our work phones anymore. That [dummy] phone will only be used for producing videos,” said an assistant to German Social-democrat member Delara Burkhardt, who has close to 2,000 followers. The assistant credited the platform with driving a friendlier, less abrasive political debate than other platforms like Twitter: “On TikTok the culture is nicer, we get more questions.”

    [ad_2]

    Eddy Wax and Clothilde Goujard

    Source link

  • Google suspends Chinese shopping app Pinduoduo over malware | CNN Business

    Google suspends Chinese shopping app Pinduoduo over malware | CNN Business

    [ad_1]


    Hong Kong
    CNN
     — 

    Google has suspended Pinduoduo, a popular Chinese budget shopping app, from its Play Store after finding malware in versions of the app.

    In a Tuesday statement, Google said versions of the app that are not in the Play Store have been found to contain malware.

    “We have suspended the Play version of the app for security concerns while we continue our investigation,” a Google spokesperson said.

    It has also enforced Google Play Protect, which scans apps installed on Android phones for harmful behavior, on the allegedly malicious apps, according to the statement.

    “Google Play Protect enforcement has been set to block installation attempts of these identified malicious apps. Users that have malicious versions of the app downloaded to their devices are warned and prompted to uninstall the app,” the spokesperson said.

    In a statement to CNN, Pinduoduo said it was informed by Google Play on Tuesday morning that its app had been “temporarily suspended” because the current version is “not compliant with Google’s Policy.” It said Google Play did not share more details.

    “We are communicating with Google for more information. We have been told that there are several other apps that have been suspended as well,” a Pinduoduo spokesperson said.

    In a later statement Pinduoduo said it strongly rejects “the speculation and accusation that Pinduoduo app is malicious just from a generic and non-conclusive response from Google.”

    It reiterated that “there are several apps that have been suspended from Google Play at the same time.”

    CNN has asked Google for information on whether other apps have also been suspended.

    Malware, short for malicious software, refers to any software developed to steal data or damage computer systems and mobile devices. When hidden in apps, it can be used to gain unauthorized access to information on a user’s phone.

    Pinduoduo is one of China’s most popular e-commerce platforms, with approximately 900 million users. It made its name with a group buying business model, allowing people to save money by enlisting friends to buy the same item in bulk.

    Riding on the domestic success of Pinduoduo, its US-listed parent company PDD last year launched Temu, an online shopping platform in the United States.

    Temu, which runs an online superstore for virtually everything — from home goods to apparel to electronics — has quickly become the most downloaded app in the US for both iOS and Android.

    Since its rollout in September, the app had been downloaded 24 million times as of last month, racking up more than 11 million monthly active users, according to Sensor Tower.

    Google did not mention Temu in its statement. The app is still available to download on the Play Store.

    [ad_2]

    Source link

  • FBI says $10 billion lost to online fraud in 2022 as crypto investment scams surged | CNN Politics

    FBI says $10 billion lost to online fraud in 2022 as crypto investment scams surged | CNN Politics

    [ad_1]



    CNN
     — 

    More than $10 billion in losses from online scams were reported to the FBI in 2022, the highest annual loss in the last five years, according to a new report from the bureau.

    The more than $3 billion jump in reports of online fraud from 2021 to 2022 was driven by a near-tripling in reports of cryptocurrency investment fraud, the FBI said in its annual Internet Crime Report.

    The report tallies a wide variety of fraud complaints – from marketing scams to ransomware – and is a metric for US policymakers in measuring how much hacking and other schemes are costing the American economy.

    While people in their 30s filed the most fraud complaints last year, the burden of many digital scams fell on the elderly. People over 60 accounted for $724 million, or more than two-thirds of the reported losses from “call center fraud,” according to the FBI. Such fraud occurs when scammers call someone impersonating tech support or government agencies.

    Ransomware, which locks computers until hackers are paid off, accounted for about $34 million in adjusted losses reported to the FBI last year. The relatively modest figure compared to other forms of fraud could be due to the fact that many victim organizations still do not report ransomware attacks to the FBI.

    A popular type of ransomware called Hive was used in 87 attacks last year, according to the FBI. The bureau seized Hive operatives’ computer infrastructure earlier this year, but not before hackers affiliated with the ransomware extorted more than $100 million from hospitals, schools and other victims around the world.

    While ransomware tends to get the headlines, a different hacking scheme known as business email compromise (BEC) leads to far more money stolen from victims in aggregate. A BEC scheme typically involves someone tricking a victim into wiring them money, often by impersonating a customer or a relative.

    One of the more high-profile examples of BEC fraud last year cost the city of Lexington, Kentucky, about $4 million in federal funding for housing assistance.

    BEC scams accounted for about $2.7 billion in adjusted losses in 2022, compared to about $2.4 billion in 2021, according to FBI data.

    [ad_2]

    Source link

  • Ransomware attack on US Marshals Service affects ‘law enforcement sensitive information’ | CNN Politics

    Ransomware attack on US Marshals Service affects ‘law enforcement sensitive information’ | CNN Politics

    [ad_1]



    CNN
     — 

    A ransomware attack on the US Marshals Service has affected a computer system containing “law enforcement sensitive information,” including personal information belonging to targets of investigations, a US Marshals Service spokesperson said Monday evening.

    “The affected system contains law enforcement sensitive information, including returns from legal process, administrative information, and personally identifiable information pertaining to subjects of USMS investigations, third parties, and certain USMS employees,” spokesperson Drew Wade said in a statement.

    The Marshals Service, which handles federal prisoners across the US and pursues fugitives, discovered the hack and theft of data from its network on February 17. The service “disconnected the affected system, and the Department of Justice initiated a forensic investigation,” Wade said in the statement.

    The Justice Department subsequently determined it “constitutes a major incident,” according to the statement. A “major incident” is a hack that is significant enough that it requires a federal agency to notify Congress.

    A senior official familiar with the matter told CNN that no data related to the witness protection program was obtained during the incident.

    The Justice Department’s investigation into the incident is ongoing.

    NBC News first reported on the incident.

    It’s at least the second significant malicious cyber incident to affect US federal law enforcement agencies in February.

    The FBI had to move to contain malicious activity on part of its computer network earlier this month, CNN first reported at the time. FBI officials believe that incident involved an FBI computer system used in investigations of images of child sexual exploitation, two sources briefed on the matter told CNN.

    There was no immediate indication that the US Marshals Service and FBI cyber incidents were related.

    [ad_2]

    Source link