Search This Blog

Showing posts with label Russia. Show all posts

Security Experts say number of network nodes in the Russian Federation accessible via RDP


Positive Technologies experts said that the number of network nodes in the Russian Federation accessible via the Remote Desktop Protocol (RDP) for three weeks (since the end of February 2020) increased by 9% and reached over 112,000.

It is enough for hackers to send a special RDP request to vulnerable Remote Desktop Services (RDS) to attack. Authentication is not required. If successful, an attacker can install and delete programs on a compromised system, create accounts with the highest level of access, and read and edit confidential information. The vulnerabilities affect Windows 7, Windows Server 2008, and Windows Server 2008 R2 operating systems.

According to Alexey Novikov, director of Positive Technologies security expert center, attacks on the network perimeter of domestic companies have begun to grow. Hackers are trying to get access over servers and get into the local network. This boom is caused by the transfer of employees to remote work.

For a secure remote connection, employees need to use a special gateway. For RDP connections needs a RDG, for VPN requires a VPN Gateway. Experts do not recommend connecting directly to the workplace.

Experts warn that opening access to individual subnets to all VPN users at once significantly reduces the security of the organization and not only gives broad opportunities to an external attacker but also increases the risk of an insider attack. Therefore, IT professionals need to maintain network segmentation and allocate the required number of VPN pools.

Positive Technologies experts emphasize the threat of remote access channels to business-critical networks and systems, for example, production and energy technology networks, ATM management networks or card processing in banks.

In addition, Positive Technologies recommends paying attention to a critical vulnerability (CVE-2019-19781) in Citrix software that is used in corporate networks. The vulnerability in PHP 7 (CVE-2019-11043), which, according to Positive Technologies, was included in the list of the most dangerous by the end of 2019, should be eliminated.

Russian Defence Minister says Pro-Western Activists Trying to Infiltrate Military Facilities using Media Laws as a cover


Defense Minister Sergei Shoigu, speaking in the Federation Council, announced opposition attempts to penetrate Russian military facilities.

The head of the military Department recalled that Western countries regularly make high-profile accusations against Moscow, such as interference in American elections, hacking attacks, and concealment of military losses.

"In our country, they are supported by a Pro-Western opposition division regularly trained abroad. Using media laws as a cover, its activists are trying to infiltrate military facilities and are monitoring relatives and witnesses. They go to hospitals where our wounded are lying, to cemeteries, to commemorations, to the families of our dead children. They take photos of the entrances and exits from our secret objects and put them on the Internet. You can imagine what responsibility they would be brought to in Western countries," said the head of the military Department.

In this regard, Shoigu called on senators to regulate Russian legislation in this area.
The head of the defense department also told the Federation Council about the increase in the number of cyberattacks against the Russian army.

"The information space today has become another theater of war. Over the past three years, the information infrastructure of the Armed Forces has been attacked by more than 25 thousand high-tech computer attacks from abroad. At the same time, their number increases annually by an average of 12%. We are ready for this fight. Of course, I wanted the hackers to have a little less domestic helpers,” said Shoigu.

According to him, the Ministry of Defense has a reliable system for protecting information resources, and all attacks are neutralized.

A number of countries have previously accused Russia of hacking attacks. Thus, Georgia accused the Russian military of planning and conducting a cyberattack, as a result of which sites and servers of several government bodies, courts, the media, and private companies were damaged. Also, the head of the Ministry of Defense of Ukraine Andrei Zagorodniuk said that the country is daily faced with cyberattacks that come from Russia.

At the same time, since 2016, the United States has been discussing the topic of possible Russian interference in the presidential election, as a result of which Donald Trump became the head of state.

The Federal security service of Russia stopped the activities of the largest group of hackers


More than 30 members of an interregional criminal group engaged in cloning and selling credit and payment cards of Russian and foreign banks were detained by the Federal security service (FSB). Hackers gained access to data by hacking user accounts and payment systems. The detentions took place immediately in 11 regions of Russia.

The group created more than 90 online stores where it was possible to buy data from other people's bank cards. The cards of both Russian and foreign banks, including credit cards, were compromised.
According to the FSB, the criminal group has been operating for at least the past three years. Criminals obtained the necessary data of real cardholders by accessing user accounts on the Internet and payment systems.

One of the most common ways to get them was to create websites selling various products at below-market prices. Customers interested in these cheap offers paid for the purchase directly on the site with a bank card. At the same time, using a special program, hackers gained access not only to its number but also to the pin code, as well as the CVC code of the cardholder. The seller immediately canceled the transaction itself, referring to the fact that the product is out of stock and the customer will be notified of its appearance by SMS.

After that, cloned Bank cards with a balance, usually, not less than several hundred thousand rubles or several thousand dollars or euros went on sale in one of the 90 online stores organized by members of the group in the Darknet. For example, a copy of the card with a balance of $3 thousand to $25 thousand fraudsters offered to buy for 30% of the face value. They even gave a 30-day guarantee for their product, promising to exchange the card in case of blocking. At the same time, courier delivery of cards with the entire package of documents was offered to any city in the world. Withdraw money was recommended as soon as possible so that its real owner did not have time to suspect anything.
25 detainees were charged under the article on illegal turnover of payment funds. Among the detainees are citizens of Ukraine and Lithuania.

Law enforcement officers seized more than $1 million and 3 million rubles during their detention, as well as weapons, drugs, gold bars and servers hosting fraudulent websites. According to the statement, the site hosting equipment was "liquidated". The FSB added that the seized property included fake documents, including fictitious Russian passports and law enforcement documents.

Rostelecom detected more than a hundred thousand cyberattacks in the North-Western Federal district of Russia


In 2019, the Rostelecom Solar JSOC Monitoring and Response Center for Cyberthreats detected and repelled over 1.1 million external attacks on organizations' information resources. At the same time, as always, more than 430 thousand cyberattacks were detected in Moscow. More than 128 thousand cyberattacks were recorded over the year in the North-Western Federal district.

The most common tool of hackers was the use of vulnerabilities in web applications (web portals, email, Internet banks, personal accounts). At the same time, according to Solar JSOC experts, it's easy to hack every third application and gain access to the organization’s server. The number of such attacks increased by 13% in 2019.

"Such dynamics can be associated with the active development of corporate Internet resources, not only in traditional industries (banks, retail), but also in the fuel and energy sector, and the public sector. At the same time, most of these resources have critical vulnerabilities that allow hackers to get privileged access to the organization's resources," explained Vladimir Dryukov, director of the

Rostelecom Solar JSOC Monitoring and Response Center.
Also, in 28% of cases, cybercriminals used the introduction of malware (viruses, Trojans, spyware, etc.) into the information infrastructure of organizations in the region. Across the country, the number of such attacks increased by 11% in 2019. At the same time, hackers are constantly improving their tools, making malware less visible to security tools.

The method of selecting and compromising credentials (logins and passwords) from the Internet resources of organizations was in third place.

According to experts, among other types of cyberattacks, there are attempts to compromise logins and passwords of system administrators, DDoS, and exploitation of known vulnerabilities that were not timely eliminated by information security services of organizations.

Russian payment systems will switch to using domestic cryptographic information security tools by 2031


Russian payment systems will switch to using domestic cryptographic information security tools by 2031

Existing payment systems in Russia will have to switch to the use of cryptographic information protection tools of domestic production. This was announced by Ivan Kosyakin, chief engineer of the information security Department of the Bank of Russia, during his speech at the scientific and practical conference "Ruscrypto 2020" held in the Moscow region.

Thus, according to him, Russia's sovereignty in the field of information security for the needs of the banking sector will be increased. So, to achieve this goal, functional technical requirements for payment systems with a terminal core, hardware security modules, payment cards were approved in 2019.

In turn, as noted by Elena Mareeva, Deputy Director for scientific and technical development of Practical Security Systems, in January of this year, requirements for cryptographic information protection tools were approved, according to which automatic security modules used in payment systems must comply with the requirements of Federal Executive authorities and the Bank of Russia, as well as the provisions of international standards.

Moreover, on June 25, 2019, it became known that the technical Committee for standardization "Cryptographic information protection" (TC 26), which is managed by the FSB, has prepared draft recommendations on the use of domestic cryptographic algorithms in key protocols used to protect information on the Internet.

One of the documents contains a set of recommendations on the use of Russian cryptographic algorithms "Magma" and "Grasshopper", developed by the FSB.

According to Russian legislation, domestic crypto-algorithms must be used in information security media certified by the FSB and mandatory for use by state agencies in their electronic document management, and from 2024, according to the requirements of the Central Bank of the Russian Federation, they will become mandatory for use in payment systems.

Members of TC 26 claimed that the use of Russian algorithms will improve the security of data transfer. According to Smyshlyaev, director of information security at Crypto-PRO (part of TC 26), the Russian crypto sets of the TLS1.2 protocol, approved in 2018, unlike foreign ones, guarantee control of the amount of data encrypted on one key.

The issue and circulation of cryptocurrencies will be banned in Russia


On March 16, a Representative of the Bank of Russia, Alexey Guznov, announced a possible ban on the issue and organization of cryptocurrency circulation in the territory of the Russian Federation. As noted in the bill on digital financial assets, the issue and circulation of cryptocurrencies in Russia carry an unjustified risk. The bill prohibits the issue and circulation of cryptocurrency in Russia and introduces responsibility for violating the ban.

Mister Guznov noted: "The position of the Bank of Russia remains unchanged. We believe that there are great risks when legalizing the circulation of cryptocurrencies." Risks arise for financial stability and the anti-money laundering system, and consumer protection will also suffer.
The Central Bank objected to legalizing cryptocurrency as a "tool" and an object of circulation, said mister Guznov.

Some experts suggested that cryptocurrency should be treated as a foreign currency and its issuance and circulation should be regulated in the same way.

The authorities replied that they did not intend to ban the ownership of the digital currency. The bill only prohibits the issuance and circulation of cryptocurrencies and introduces liability for violation of this ban.

It is absolutely impossible to ban cryptocurrencies and mining, said Yuri Brisov, a member of the Commission for the Legal Support of the Digital Economy. He is sure that such measures will become an obstacle to the development of the blockchain industry in the Russian Federation.

"The ban on mining and cryptocurrencies will lead to the complete decline of the blockchain industry. For this reason, all developed countries, although they understand the risks associated with money laundering, tax evasion, do not ban cryptocurrencies and mining; to ban today means to limit the potential for economic growth and technological development of their country," said Brisov.

It is important that legal regulation in Russia does not hinder the development of new technologies.
Earlier EhackingNews reported that Russian law enforcement agencies, together with the Ministry of Internal Affairs, to prepare proposals for the arrest of cryptocurrencies by 2021.

Recall that in 2018, President Vladimir Putin said that Russia should "carefully and cautiously" monitor the sphere of cryptocurrencies. At the same time, the position of the Central Bank of Russia was that electronic money can not be a means of payment.

The prosecutor's office identified a leak of the full database export and import operations in Russia for eight years


Yekaterina Korotkova, the representative of the Moscow Interregional Transport Prosecutor's Office reported that the Northern Transport Prosecutor’s Office revealed a leak on the Internet of a full database of export-import operations of Russian companies at customs posts over eight years.
“It was established that one of the Darknet sites has on sale a complete, regularly-updated customs database for all export-import operations of Russian companies for 2012-2019 (data for all customs posts of the Russian Federation),” said Korotkova.

According to her, the site contains full declarations of all participants in foreign economic activity of Russia, TIN of recipients, senders, information about the processed goods, indicating the Declaration numbers, the country of origin of the goods, surnames, first names, patronymics of their representatives, vehicle numbers, contact numbers, as well as information about risks.

"The customs authorities' databases on the website for acquiring contain information of limited access and personal data," added the representative of the Ministry of Transport and Trade of Ukraine.

The Prosecutor's office through the court demanded to recognize this information prohibited on the territory of Russia.

The court granted the claim. After entering into force, the court's decision will be sent to Roskomnadzor to include the resource in the Unified register of information, the distribution of which is prohibited on the territory of the Russian Federation.

In December 2019, the Investigative Committee reported that during operational activities it was possible to establish a hacker who was to blame for the leak of personal data of several hundred thousand employees of the Russian Railways company on the Internet. A 27-year-old hacker from Krasnodar was charged with illegally obtaining and disclosing trade secrets and illegally accessing protected information.

Investigators found that in June 2019, the accused was able to access internal resources of the Russian Railways computer network. He copied the personal data of several hundred thousand employees, including managers, of Russian Railways and posted it on the Internet. The young man pleaded guilty to committing this cyberattack.

In Kiev, a hacker group who used the vulnerability of banks to steal their clients' money was caught


The Security Service of Ukraine (SBU) announced the termination of the acclivities of hackers who stole an average of 1.2 million dollars a year from the accounts of banking institutions.

According to the investigation, the attackers found vulnerabilities in the electronic payment document management system of banks, illegally transferred money of clients to the accounts of fictitious persons or transferred it to cryptocurrency. Hackers created a bot network of infected computers to conduct illegal operations on the Internet. "Thus, the members of the group stole from the accounts of banking institutions on average 30 million hryvnias ($1.2 million) a year," reported the press service of the SBU on Tuesday.

During 10 searches in Kiev and the region, as well as in Lviv, law enforcement officers seized computer equipment and mobile devices that were used by members of the group during illegal activities. Now the seized equipment is sent for examination.

A criminal case has been opened. If the attackers are found guilty, they face up to six years in prison.
It is worth noting that the Security Service of Ukraine recently exposed a large group of hackers associated with the Darknet.

Members of the group and third parties used server hosting equipment to conduct cyberattacks on the authorities and administration of Ukraine, critical infrastructure of Ukraine, as well as Ukrainian and world banks.

During the investigation, operatives detained the organizer of the group, who since 2011 provided its own server equipment for hosting, administering and distributing malware, bot networks and conducting cyberattacks.

In particular, DDoS attacks were carried out on strategic facilities in Ukraine and banking institutions of other states. The specified hosting was known on the Darknet network under the name "ProHoster" and "Bulletproof.space".

250,000+ Login/Passwords Leaked in The Trident Crypto Fund Data Breach


More than 260,000 customers’ data was compromised online in a gigantic data breach that went down pretty recently.

Trident Crypto Fund, per reports, experienced this data breach which gave rise to the leakage of thousands of customer records including usernames and passwords, online.

Per sources, Trident is a crypto-investment index fund that functions as an arm of the “Dragonara Business Center”, Italy. It also is reportedly the “first coin-based index fund”.

And like scattered sugar for ants, the leaked records were immediately devoured by the cyber-cons right after they were compromised.

Per sources, personal data of over 260,000 registered users of the Trident Crypto Fund was left bare for people to exploit as per they wished to.

Reports mention that the leaked data comprised of phone numbers, encrypted passwords, email addresses, and IP addresses.

The aforementioned data was discovered to be published on several “file-sharing” websites in the past month.

According to researchers, the hackers had evidently de-crypted the stolen files and published an array of over 120,000 passwords at the beginning of March. It was also found out that the password and login ID pairs were matchless with the ones previously leaked.

The details or even the mention of the data breach haven’t appeared on the website or on other communication platforms. But reportedly, a victim of the breach was contacted who confirmed the connection between the fund and the leaked data.

As mentioned on the fund’s website, the company “works hard” to protect its customers’ data and secure accounts. They allegedly are also investigating the “suspected breach”.

The Russians were the ones to get heavily affected by the above-mentioned data leak as the compromised data was a direct key to their accounts. Word has it that more than 10,000 Russian users were impacted by the Trident Crypto Fund data breach.

Even though it’s possible that Russian residents might have had their records leaked previously as well, there are no records of that happening.

Nevertheless, this data breach structured the history of data leakages for Russia as this happens to be one of the first major ‘Personal’ data breaches the country’s citizens have faced that has had such a major impact.

Group-IB informed about the distribution of fake news about 20 thousand coronaviruses infected in Moscow


A fake audio recording appeared on the Internet, where the girl reports about 20 thousand cases of coronavirus COVID-19 in Moscow and asks to spread this information as much as possible. This was announced on March 2 by the Chairman of the Commission of the Public Chamber of the Russian Federation for the development of the information community, Alexander Malkevich.

Group-IB's cyberattack prevention team urge not to trust information from unconfirmed sources.
This information is distributed in the social networks Vkontakte and Facebook from different users but in identical formulations. The audience that took this news seriously became mainly female groups in messengers at kindergartens and schools. Group-IB specialists recorded more than 9500 publications with this news and started searching for performers and customers of this information attack.

This is not the first time such fake news about the coronavirus has appeared since the beginning of 2020. In some regions of Russia, rumors spread that "because of the high level of danger, the whole family had to leave the city", "official sources report hundreds of deaths". Moreover, fakes about coronavirus are spread not only in Russia but also around the world. In particular, more than 40 media reported false information that the Pope became infected with the coronavirus.

According to experts, information about 20 thousand cases in Moscow may be the result of the work of the information forces of Ukraine.

In addition, information security experts of Group-IB have already identified the fact of artificial distribution of voice messages.

Official authorities have repeatedly noted that only a few cases of coronavirus infection have been confirmed throughout Russia: two in Chinese citizens, as well as three Russians evacuated to Kazan from the Diamond Princess liner.

Group-IB spottted new fake messages about the coronavirus during the day


Group-IB, a company that specializes in preventing cyberattacks has revealed new fake messages about the spread of coronavirus over the past day.

Company Group-IB reported that information about accounts spreading fakes about the coronavirus was transmitted to law enforcement agencies.

"The data obtained by Group-IB specialists about the accounts involved in the distribution of fake audio messages about the coronavirus was transmitted to law enforcement agencies. The bots were focused on the active distribution of a specific fake, although some bots were registered a couple of years ago with the same creation date," reported press service of the company.

In addition, Group-IB experts have identified new fake messages about the coronavirus over the past day and warned that there is still a possibility of new fakes. "It is important to use information from trusted sources and be critical of rumors and possible misinformation," added the press service said.
Group-IB works closely with the administration of social networks, including Facebook and VKontakte, and with forum moderators to remove misinformation about the spread of a new type of coronavirus.

Group-IB launched an investigation into the spread of information about a large-scale infection of Moscow residents with coronavirus in early March. By March 2, the company's experts had recorded 9500 posts, reposts, and publications that broadcast fake news about allegedly 20,000 sick Russians.
On March 4, Roskomnadzor began blocking access to resources that spread fake information about the coronavirus in Russia. The Agency has already entered several messages in social networks in the register of information prohibited in Russia at the request of the Prosecutor General's office.

It is worth noting that Russian President Vladimir Putin at a meeting with the government said that false reports of coronavirus in Russia are spread from abroad. According to Putin, in fact, nothing critical in terms of the coronavirus is happening.

According to Putin, "the purpose of such fakes is clear - to spread panic among the public", and this can only be countered by timely and reliable information of the country's citizens.

Information security experts have warned Russians about bonus card fraud schemes.


Fraudsters several thousand times tried to illegally take advantage of discount bonuses of Russians in 2019.

Some attackers gained access to customers' personal accounts, and then bought the products using bonuses, said Alexey Sizov, head of the anti-fraud department of the Application Security Systems Center at Jet Infosystems.

According to him, a fraudster can register a personal account on a card that was issued to another person. The victim will accumulate points without knowing about the existence of his profile, and the attacker will write off bonuses, said Sizov.

The expert added that this is mainly done by novice scammers. According to him, loyalty programs are poorly protected, unlike banking operations. He said that they are estimated at 50 billion rubles ($760 milliard) for the 30 largest retailers.

Alexey Fedorov, Chairman of the Business Russia Trade Committee, said that in 2019, the number of bonus and discount thefts "increased significantly."

According to Fedorov, scammers often pay attention to gas stations. The expert noted that often points are stolen by employees of stores and call-cents who have access to information about loyalty programs. Especially for customers who do not use the accumulated points for a long time, said Fedorov.

The press service of the Russian trading network Magnit told that they also see a problem in fraud with bonus points. However, the damage from it is more image-based, as customers are disappointed in the loyalty program and lose confidence in it.

In addition, representatives of the largest retail chains in Russia said that they have already taken care of the problem of stealing discount points. To protect against such scams, sellers introduce two-factor identification: bonus debits must now be confirmed with a code from SMS, similar to banking operations.

The hacker explained why in Russia cards will become more often blocked


Hacker Alexander Warski told what to expect from Governing Bodies. According to him, bank cards will more often be blocked in Russia.

The information security specialist expressed the opinion of the new law on mandatory notification of blocking of finances on the accounts of Russians. Starting from March 28, according to the new law, credit institutions are obliged to notify customers about the blocking of funds on the same day, necessarily indicating the reason for their actions. According to the hacker, the new law will only contribute to a significant increase in blockages.

"The governing bodies will be more likely to use this tool," - said Warski.
At the moment, the percentage of all illegal withdrawals is 1% of all financial transactions. Scammers use fake phone numbers that are displayed as Bank numbers and disturb people on behalf of the Bank. In this regard, the hacker believes that mobile operators are to blame for allowing the sale of virtual SIM cards.

State Duma Deputy Natalia Poklonskaya believes that the introduction of the new law will make the bank-client relationship system more transparent.

"Now this side of banking will become more open, and blocking the client's account will no longer be unexpected, which means that it will not be able to be a manipulative tool," said Natalia.

Earlier, EhackingNews reported that experts from the information security company Positive Technologies came to the conclusion that hackers will need only five days on average to hack a large Russian Bank.

In addition, it became known that 89% of data leakage incidents in Russian banks were caused by ordinary employees.

Banks also noted the appearance of special Telegram bots, through which people can earn anonymously on the leak of information and personal data. Each case of information disclosure costs 50-100 thousand rubles ($750 - $1,500).

The Russian quality system (Roskachestvo) gave recommendations on protecting data in social networks

Scammers in social networks use social engineering techniques to hack a user account. In this regard, Roskachestvo experts recommend setting the most stringent privacy settings for the personal page. According to experts, cybercriminals tend to get into the friend list in social networks in order to use this opportunity for fraud in the future, so users of social networks should monitor their privacy and be vigilant.

"Set the most strict privacy settings. For example, hide your contact information, published posts, and information about relatives and friends from everyone except your friends. This will make it more difficult for attackers to get your data and use it in fraud using social engineering," said experts.

Cybercriminals use fake phone numbers, fake names, and other people's photos to get into the friend's list. In addition, there is a high risk that when you click on a postcard, petition, or unknown link, the user is redirected to a site that requests access data to social networks and passes them to the fraudster.

"Everyone knows for sure that a request for financial assistance from a hacked page is a fraudulent technique," reminded Roskachestvo.

Experts advise adding only really familiar people to friends, and also beware of those who ask or offer money, and if a friend makes such a request, ask him personally by phone.

"Do not send payment or other confidential information in social networks and messengers. If you have already sent your card data, find and delete these messages," said experts.

Roskachestvo advises not to follow suspicious links sent in messages, not to use public Wi-Fi networks, set up two-factor authentication in social networks, and use complex passwords for each service, using special software generators to compile them.

"At the same time, it is extremely important to use different passwords for accounts on different resources," said Anton Kukanov, head of the Center for Digital Expertise of Roskachestvo.

The Central Bank of Russia warned about the new scheme of fraud "taxi from the Bank"


Fraudsters have found a new way to withdraw money from Russians. Social engineering is also in progress: people are offered a new service from banks "taxi to ATM", and on the way, they are convinced to transfer money to a third-party account.

Victims of the new scheme are those who do not use online banking, in particular, the elderly. Attackers force them to transfer money through an ATM, for which they offer to use the "taxi from the Bank" service for free.

This information is confirmed not only in banks but also in the Central Bank. Several people have already become victims of such a fraud, all of them tell about the same story: criminals call from the number "8 800" and report that someone is trying to withdraw funds from the client's card. If the potential victim does not have an Internet Bank, the person was offered a special taxi to the ATM.

"Allegedly, it will be possible to transfer funds to a secure account from ATM. Attackers order a regular taxi for the victim, and when a person is at the ATM, he makes a dictation operation to transfer money to the attacker's account," said Alexey Golenishchev, Director of monitoring operations and disputes at Alfa-Bank.

The Central Bank warned that customers are never asked to make transactions through ATMs when a suspicious operation is suspected. Scammers often offer to transfer money through an ATM, and "taxi from the Bank" is one of the varieties of this scheme.

Sberbank confirms this scenario and recognizes that the scheme is becoming more popular. The victims are lonely people or elderly people who are easily to trick, and they do not have the opportunity to consult with someone. Scammers do not give time to think and convince a person to act quickly.

Usually, the damage from such fraudulent actions is about 15 thousand rubles ($220).
Previously, fraudsters began to practice another way of cheating. A man finds a forgotten card at an ATM, picks it up and then the owner of the card appears. Of course, the owner reports that money has disappeared from his card.

Russians were given ways to protect themselves from surveillance via a smartphone


Experts noted that most often smartphone owners are inattentive and infect their devices with spyware. Such programs can collect personal data and place it in the public domain, listen to conversations, and monitor the actions of the owner.

Sergey Nikitin, Deputy of the Group-IB Computer Forensics Laboratory, said that more than 90 percent of cases are not vulnerabilities, but user actions. According to him, the main source of infection is applications downloaded through the browser.

"The search engine, first, gives not an official site, but contextual advertising. Often, scammers buy it, and by clicking on the link from your phone, you download a malicious APK file," said Nikitin.
Nikitin gave an example of the GetContact app, which shows how a person is named in his friends' contact list. According to him, the user provides access to contacts that can leak to the network. He noted that such cases have already occurred. The expert advised not to download applications for remote management, for tracking the user. According to him, it is also not necessary to download the first available antivirus from the search engine, since an unknown program may be a program with a Trojan virus.

Kaspersky Lab expert Viktor Chebyshev also said that popular apps can be malicious. According to him, hackers often fake malicious programs for popular applications. "For example, we recently discovered more than a thousand malware that pretended to be a popular dating application. In General, in 2019, most often Trojans pretended to be photo-processing applications,” informed Chebyshev.

Another loophole for fraudsters is called remote control applications that allow to see the device's screen.

"An attacker can ask you to install the program and then conduct a financial transaction on your behalf. Many banks now show a one-time code in push notifications, so it is not a problem to see it on the screen," said the representative of Group-IB.
Experts also added that fake apps can be found even in official stores. You should be wary if the application requests administrative functions.

The official representative of the Russian Foreign Ministry responded to the US accusations about Russian fakes about the coronavirus


Russian Foreign Ministry spokeswoman Maria Zakharova commented on the US statement that Russia is spreading fakes about the coronavirus. The diplomat called such accusations "deliberate stuffing".

Earlier, the Straits Times reported that the US State Department suspected Russia of spreading fakes about the coronavirus. U.S. officials said that thousands of Russian-related accounts have spread false information about the disease on social networks, undermining global efforts to fight the epidemic. In addition, such users promote the idea that the US government is behind the COVID-2019 epidemic, thus damaging the country's reputation, according to the State Department.

According to media reports, the State Department intends to deal with fake accounts on Twitter, Facebook and Instagram.

The First Deputy Chairman of the State Duma Committee on International Affairs Dmitry Novikov said that there are different accounts on the network, including those that are trying to gain subscribers at any cost. Also, a politician did not rule out US involvement in the coronavirus epidemic in China. The politician noted that Washington has succeeded in creating biological weapons.

He also said that everything secret becomes clear sooner or later, and today's assumptions may be confirmed in the future.

Andrey Suzdaltsev, Deputy Dean of the faculty of World Economics and World Politics at the Higher School of Economics, explained the US accusations of disinformation against Russia as attempts to take a convenient media position.

At the same time, he called the evidence base, which is supposed to confirm Russia's guilt in disinformation, strange. He said that the statement saying that some millions of user accounts in social networks were specifically sponsored by the Kremlin for an information war against the White House, is unfounded.

At the same time, the very accusations against Russia indicate that Moscow is perceived as a threat in the West, the expert concluded.

Russia has responded to Canada's accusations of cyberattacks on Georgian websites


The international community, following Georgia, the UK and the US, continues to publish statements condemning the cyberattack allegedly committed by Russia on the websites of Georgian government agencies, non-governmental organizations and the media. The relevant statements are published in Georgian by the Georgian Foreign Ministry.

Foreign Ministry of Australia, the Ministry of Foreign Affairs of Ukraine, and the foreign ministries of Canada, the Netherlands, Romania, and Montenegro condemned the actions of the Russian GRU. And the Icelandic Foreign Minister on his behalf published a short statement on Twitter.
The Ministry of Foreign Affairs of Ukraine not only condemns Russia but also calls on the international community to "bring to justice those who deliberately organize and carry out cyberattacks".

The authors of all statements regard the report of a cyberattack on Georgian websites as a "violation by Russia of the sovereignty and territorial integrity of Georgia and disrespect for the norms and principles of international law".

However, the Russian Embassy in Canada on Twitter stated that Russia is not involved in cyberattacks on Georgian government websites.

"Another fragment of Russophobic lies and fakes," the Russian mission responded to the accusations from Canada. The diplomats called the Canadian policy towards Russia extremely deplorable and reprehensible, and stressed that it further worsens the weakened relations between the two countries.
Prior to this, the accusations of cyberattacks on Georgia were denied by the Deputy head of the

Russian Foreign Ministry, Andrey Rudenko. According to him, Russia did not intend and is not going to interfere in the internal affairs of the neighboring country.

Recall, on February 20, US Secretary of State Michael Pompeo accused Russia of attacking Georgia. They allegedly occurred in October 2019. According to him, because of this, the work of the country's government, several private websites and two major television stations was disrupted. Representatives of the Georgian government made the same statements. The cyberattack was allegedly indicated by the results of the investigation, which Tbilisi conducted "together with other partners."

Russian banks and energy companies have undergone a new wave of cyberattacks


A new wave of cyberattacks targeting banks and energy companies has been recorded in Russia. Employees of these organizations receive numerous phishing emails with infected links, clicking on which is fraught with data theft from the computer.

It is reported that the malicious message contains an office document. The victim clicks on it and gets to the text hosting Pastebin, which downloads images from the Imgur service, which in turn contains malicious code. Thanks to it, attackers can steal secret files, withdraw funds, or install spyware on a user's computer.

"Since the chain consists of four stages, the protection tools that companies use cannot detect it, they are designed for shorter activity of malware," explained Igor Zalevsky, head of the center for the investigation of cyber incidents of JSOC CERT Rostelecom-Solar.

The company said that about 60% of phishing emails were received by employees of the energy sector, but 80% of all attacks turned out to be aimed at banks.
Zalevsky added that the attack is similar to the activity of the hacker group Silence, which just specializes in credit organizations. It is possible that the group decided to expand the scope of its activities or it's completely different hackers copying the behavior of Silence.

Group-IB confirmed that the attack recorded by Rostelecom-Solar was previously carried out in the banking sector.

Information security experts said that in 2020, energy companies will become the “main targets” for cybercriminals.

Andrey Arsentyev, head of Analytics and special projects at InfoWatch group, agrees with this assessment, he called the energy sector one of the "most attacked" in recent years. According to Denis Kuvshinov, a leading specialist of the PT Expert Security Center Positive Technologies cyber threat research group, the main goal of cybercriminals targeting the energy sector is industrial espionage, as well as the impact on critical infrastructure.

Security Experts Say Hackers Can Hack Russian Banks In 5 Days


Experts from the information security company Positive Technologies came to the conclusion that hackers will need only five days on average to hack a large Russian Bank. Experts came to this conclusion on the basis of a number of tests. The attack was successful due to vulnerabilities in applications, software and password selection. In some cases, access to ATMs was obtained.

Tests in 10 banks from the top 50 banks showed that hackers need an average of 5 days to hack the Russian bank’s network. In cases where the hacker acts from the inside, he is able to get full control over the entire infrastructure of the Bank in two days.

During the audit of banks, whose names were not disclosed, experts simulated 18 cyberattacks. In eight cases, the attacks were carried out from the outside using only publicly available data, such as the Bank's website or an incorrectly configured database. In ten cases, the hacker attacked from inside the bank, that is, the hacker was in the Bank building and got access to the power outlet, Wi-Fi network, and so on, or thanks to an external attack, he gained access to user data of a bank employee. Social engineering methods were not used in the tests.

Passwords turned out to be the weakest point because most of them were selected using a combination of similar words or nearby keys. Under one very common password “qwerty123” in one of the credit organizations were more than 500 accounts.

New testing showed that hackers can penetrate from the Internet into the local network of seven out of eight banks.

However, Kaspersky Lab’s Leading Antivirus Expert Sergey Golovanov said, Due to the improvement of bank security systems, Russian-speaking hacker groups are increasingly attacking foreign credit organizations, they are switching to banks in Asia, Africa and Latin America.