Search This Blog

Showing posts with label cybercriminals. Show all posts

Hacker Attacked a Water Plant in Florida

 

A hacker penetrated computer networks at Oldsmar, Florida, water treatment plant, remotely delivering a 100-fold boost in a chemical that is exceptionally perilous in concentrated sums. In an assault with the possibility to harm public health, the hacker on February 5 accessed a city computer and changed the level of sodium hydroxide which is utilized to eliminate metals and control acidity, from 100 parts for each million to 11,100 parts for every million, as per Bob Gualtieri, who serves as the sheriff of Pinellas County. 

This is a “significant and potentially dangerous increase,” Gualtieri said at a Monday press conference. The attacker momentarily entered the computer system at 8 a.m. on Feb. 5, before leaving and returning at about 1:30 p.m. for roughly three to five minutes, Gualtieri said. In that window, the operator of the water plant could see the attacker on screen, “with the mouse being moved about to open various software functions that control the water being treated in the system,” Gualtieri said. 

When the hacker left the computer system, the operator whose computer was remotely taken over promptly brought down the level of the chemical, otherwise called lye. This move forestalled any harm to people in general and the drinking water, Gualtieri said. He said there were extra counteraction measures inside the water system that would have kept polluted water from reaching the public. It isn't yet known whether the break originated from the U.S., or outside of the country, Gualtieri said. Oldsmar, with a population of almost 15,000, is situated around 15 miles northwest of Tampa.

“Many of the victims appear to have been selected arbitrarily, such as small critical infrastructure asset owners and operators who serve a limited population set,” said Daniel Kapellmann Zafra, manager of analysis at Mandiant Threat Intelligence. Through “remote interaction with these systems,” the hackers have engaged in “limited-impact operations.” None of those examples brought about any damage to individuals or infrastructure, Zafra said. “We believe that the increasing interest of low sophisticated actors in industrial control systems is the result of the increased availability of tools and resources that allow malicious actors to learn about interactions with these systems,” he added.

CHwapi Hospital Suffers a Ransomware Attack

 

On Sunday night, the CHwapi hospital in Belgium witnessed a cyberattack that incited the facility to divert emergency patients to different emergency hospitals and defer surgeries. 

As per the attackers, they utilized Windows BitLocker to encrypt 40 workers and 100TB of information. In the wake of encrypting devices, the attackers state they left ransom notes named ransom.txt on the domain controllers and backup servers. 

"We attack chwapi hospital in Belgium 2 days ago. and set up a ransom note on servers. but the IT management team not give this information to hospital management. hospital management makes a press release and said there is no ransom note, but this is a lie. something is going on," the attackers wrote in an email. Rather than utilizing conventional ransomware, this group utilizes off-the-shelf software, for example, Windows BitLocker and DiskCryptor to encrypt documents and lock admittance to the disk partitions with a password. The attackers revealed that they don't encrypt each gadget on the network and only target servers holding a lot of records, for example, file servers and backup servers.

As reported by local media group L'Avenir, 80 of the hospital centers' 300 servers were affected by the attack, constraining staff and nurses to surrender computerized entries and turn to pen and paper for patient assessments. Patient information was not compromised, as per CHwapi. 

To communicate with the victims, this hacking group makes ransom notes containing a Bitmessage ID that can be utilized to negotiate a ransom. This group states that they are not part of a Ransomware-as-a-Service (RaaS) and do not steal or leak information. Some ransomware groups have expressed that they will try not to encrypt hospitals and give a free decryptor in the event that they are encrypted. 

As a precautionary measure, the hospital has totally cut off any communications with the rest of the world. “We do not communicate with the outside and we do not receive anything either before having made an even more precise diagnosis of what is happening internally,” Didier Delval, general director of CHwapi, said in a statement. Authorities said any patients affected by hospital service interruptions will be told by phone, where conceivable. 

While the hospital's services are gradually recuperating and surgical operations have resumed, CHwapi continues to cancel some services and divert dire cases to different hospitals.

Maze Ransomware: Exfiltration and Extortion

 

New research by New Zealand organization Emsisoft has discovered that a cyber-blackmail tactic initially debuted by ransomware gang MAZE has been adopted by over a dozen other criminal cyber gangs. Initially observed in May of 2019, the maze was a prominent part of consistent, yet unremarkable, extortion campaigns. However, as of late a sizable uptick have been seen in Maze campaigns, including numerous prominent, high-profile attacks. The attackers behind Maze have previously claimed credit for assaults on both Allied Financial just as well as the City of Pensacola Florida. 

The globally renowned security software organization, Emsisoft declared a ransomware crisis in the last month of 2019. Their most recent ransomware report shows that this specific sort of malware has hugely affected the United States in 2020. Emsisoft threat analyst Brett Callow described the numbers in "The State of Ransomware in the US: Report and Statistics 2020" as "pretty grim." 

At least 2,354 US governments, medical services offices, and schools were affected by ransomware last year, including 113 federal, state, and municipal governments and agencies, 560 healthcare facilities, and 1,681 schools, universities, and colleges. Researchers noticed that the assaults caused huge, and in some cases perilous, disturbance: ambulances carrying emergency patients had to be redirected, cancer treatments were deferred, lab test results were difficult to reach, clinic workers were furloughed and 911 services were interfered with. 

In 2020, MAZE turned into the first ransomware group to be observed exfiltrating information from its victims and utilizing the threat of publication as extra leverage to coerce payment. As per a November report by Coveware, some ransomware gangs that exfiltrate information don't erase it, even in the wake of accepting a ransom from their victims. Coveware noticed REvil (Sodinokibi) requesting a second ransom payment for stolen information it had just been paid to delete.

Maze ransomware doesn't simply demand payment for a decryptor however exfiltrates victim information and threatens to leak it publicly if the target doesn’t pay up. This “double whammy” heaps on yet more strain to persuade the victim to cave into the cybercriminals' demand. The onus presently is on organizations to ensure they have a trusted security arrangement demonstrated to forestall ransomware from executing in the first place, as restoration of data from a backup won't save them.

Rogue: An Android Malware That Gives Hackers Full Control Over a Phone

 

Another sort of Android malware that provides hackers with nearly-full access to a client's Android cell phone is doing rounds on underground forums. Colloquially known as 'Rogue' Remote Administration Tool (RAT), the malware infects victims with a keylogger – permitting attackers to effectively monitor the utilization of sites and applications to take usernames and passwords, just as more delicate data like a client's financial data. The malware, as per reports, is accessible on underground forums for as low as $29.99 (generally Rs 2,200).

This low-cost malware undermines a full-scale takeover of a victim's cell phone, observing the GPS area on the target, taking screenshots, utilizing the camera to take pictures, secretly recording sound from calls, and more. The virus does this while being hidden from the owner of the cell phone. All an attacker requires is their own cell phone to give commands on an infected device. This malware has been detailed by cybersecurity researchers at Checkpoint Research as a mix of two past groups of Android RATs - Cosmos and Hawkshaw - and exhibits the advancement of malware improvement on the dark web. 

Rogue is crafted by Triangulum and HeXaGoN Dev, known Android malware creators that have been selling their vindictive products on underground markets for quite a long while. For the development of Rogue, the malware creator evidently joined forces with HexaGoN Dev, which specializes in the building of Android RATs. Beforehand, Triangulum bought projects from NexaGoN Dev. "The mix of HeXaGon Dev's programming skills and Triangulum's social marketing abilities clearly posed a legitimate threat," Check Point's security researchers note.

While there is no single manner by which hackers introduce Rogue, it is normally pushed on a victim's cell phone either by phishing, malevolent applications, or other such techniques. In the wake of being downloaded on a cell phone, Rogue asks for permissions that it needs for the hacker to remotely get to a cell phone. When the permissions are in all actuality, Rogue registers itself as the device administrator and conceals its icon from the home screen. 

The best way to try not to succumb to this is to not click on suspicious links or download applications from outside sources other than Google Play and Apple App Store. Further, it is additionally imperative to ensure all security updates are installed on the device.

PayPal Phishing Scam 2021, Here's How to Stay Guarded

 


Another PayPal phishing campaign attempts to take account logins and other personal data. Noxious individuals are sending clients instant messages warning them that their accounts are permanently "limited" and urging them to sign in and verify their identity and account via a given link. Just as it is run of the mill with PayPal phishing messages, this trick likewise incorporates all the vital parts to deceive clients – a short claim that threatens with the outcome and a phony link that diverts clients to a caricaturing site. 

Cybercriminals abuse clients' inexperience and lack of experience by employing infamous social engineering techniques. They create emails or messages that resemble those from real organizations, which persuades victims to give away their details readily. 

The given hyperlink in the new PayPal phishing campaign diverts telephone clients to a spoofing webpage that appears to be indistinguishable from that of PayPal, however, the web address is observably different. Also, prospective victims are quickly approached to sign in to their accounts. Along these lines, they are diverted to a page where a couple of clarifications on why their accounts have been limited are shown, and they are encouraged to secure their accounts. At that point, PayPal clients see another page where they are approached to give their data, such as complete name, date of birth, and billing address. When clients fill in these details, every one of them is then shipped off to the operators behind the scam. They could utilize them to abuse users' PayPal account, open new bank accounts, or utilize the individual's data for future phishing campaigns. 

On the off chance that you've been fooled into filling these fields, at that point the following steps should be taken to avoid becoming a cyber victim: 

 • Sign in to your PayPal account and change the password right away. 

 • On the off chance that a similar password is utilized for signing in to some other accounts, visit them and change it also. 

 • Inform PayPal regarding such a scam and that you might have got influenced. 

 • To ensure no false accounts are made in your name – issue a temporary freeze on your credit report.

To ensure safe, stay wary of such malicious links and stick to the terms and conditions of the organization. Additionally, please note that PayPal could never send its clients any instant messages or force them to visit and sign in to their system immediately, only cybercriminals operate that way. The organization just sends emails that incorporate such data, and it generally contains a clarification for the constraint.

Manchester United Hit By a Cyber Attack on their Systems

 

Manchester United affirmed the hacking on the club and revealed systems required for the match remained secure.

Have been hit by a cyber-attack on their systems however state they are not “currently aware of any breach of personal data associated with our fans and customers”. 

In a statement, United stated: “Manchester United can confirm that the club has experienced a cyber-attack on our systems. The club has taken swift action to contain the attack and is currently working with expert advisers to investigate the incident and minimize the ongoing it disruption.

Paul Pogba 'significant for us' says Solskjær after Deschamps comments, “Although this is a sophisticated operation by organized cybercriminals, the club has extensive protocols and procedures in place for such an event and had rehearsed for this eventuality.

Our cyber defenses identified the attack and shut down affected systems to contain the damage and protect data. Club media channels, including our website and app, are unaffected and we are not currently aware of any breach of personal data associated with our fans and customers. 

We are confident that all critical systems required for matches to take place at Old Trafford remain secure and operational and that tomorrow’s game against West Bromwich Albion will go ahead.”




The club told the British authorities about the incident, including the information commissioner's office. 

The united likewise dispatched a forensic investigation into the incident. 

A spokesperson for the club added: “These types of attacks are becoming more and more common and are something you have to rehearse for.” 

United have informed the information commissioner's office and added that forensic tracing is being completed by carrying out an attempt to set up additional insight regarding the attack.


Federal Agencies Warned the US Healthcare System on Facing An “Increased and Imminent” Threat of Cybercrime

 

A couple of days back the FBI and two federal agencies, the Department of Homeland Security and the Department of Health and Human Services issued a caution that they had “credible information of an increased and imminent cybercrime threat to US hospitals and healthcare providers”. 

This news comes after federal agencies cautioned that the US healthcare systems are confronting an “increased and imminent” danger of cybercrime, and that cybercriminals are releasing an influx of coercion endeavors intended to lock up hospital information systems, which could hurt patient care similarly to cases of Coronavirus are on a steady rise. 

The cyberattacks include ransomware, which scrambles information into the hogwash that must be opened with software keys given once targets pay up. Independent security specialists state it has 'already hobbled at least five US hospitals' this week, and might affect hundreds more. 

Charles Carmakal, chief technical officer of the cybersecurity firm Mandiant, said in a statement, “we are experiencing the most significant cybersecurity threat we’ve ever seen in the United States." 

The US has seen a plague of ransomware in the course of the recent 18 months with significant urban cities from Baltimore to Atlanta hit and local governments and schools hit especially hard.

In September, a ransomware attack shook all 250 US facilities of the hospital chain Universal Health Services, constraining doctors and nurses to 'depend on paper and pencil for record-keeping and slowing lab work'. 

Employees described disorderly conditions blocking patient care, including mounting trauma centers wait and the failure of wireless vital signs monitoring hardware. 

Alex Holden, CEO of Hold Security, which has been intently following the ransomware being referred to for over a year, said he informed the federal law enforcement after monitoring infection endeavors at various hospitals. 

Furthermore, added that the group was demanding ransoms above $10 million for each target and that criminals involved on the dull web were talking about plans to attempt to infect at least 400 or more hospitals, clinics, and other medical facilities.

“One of the comments from the bad guys is that they are expecting to cause panic and, no, they are not hitting election systems,” Holden said. “They are hitting where it hurts even more and they know it.”

The cybercriminals launching the attacks are said to have been utilizing a strain of ransomware known as Ryuk, and while nobody has proved the speculated ties between the Russian government and groups that utilization the Trickbot platform, Holden said he has “no doubt that the Russian government is aware of this operation – of terrorism”.

BEC Scams Increase Year over Year; Reach Monthly Average of More Than $300 Million



Business email compromise (BEC) scams have been on a steady rise year over year and as per the suspicious activity reports (SARs) received month since 2016, the count has now reached at a monthly average of more than $300 million.

The  Financial Crimes Enforcement Network  (FinCEN) in the wake of assembling the statistics about BEC episodes happening in the course of recent years recognized the most common types of targets alongside the destination planned for the stolen assets and the procedures utilized by the scammers.

Companies have said to have lost around $1.2 billion to this kind of cybercriminal movement, who's aim is to acquire assets by acting like a customer or upper management personnel in a company so as to fool the key individuals within the organization into wiring funds to an 'attacker-control bank account'.

Commercial entities offering proficient services  like landscaping, retail, restaurants, and lodging turned out to be increasingly alluring targets, with 18% of the attacks being aimed at them.

FinCEN's analysis describes the broader picture of BEC scams

In contrast to financial organizations, which fell in the rankings from 16% to 9%, real estate firms ended up being all the more enticing, representing 16% of the BEC scam victim pie.

The attackers however don't stay adhered to only one way; they have various strategies to accomplish their goal. From impersonating company CEOs to impersonating customers and vendors all the while using fake invoices they have done it all.

Therefore users are recommended to pay special mind to any Malwares or Spywares as the attackers rely heavily on malware intended to steal the necessary information for executing the attack just as Spyware for stealing the information important to break into email accounts.

Yet Another Phishing Campaign by Hackers That Abuses QR Codes To Redirect Targets to Phishing Landing Pages



 Attackers come up with yet another phishing campaign that misuses QR codes to divert the targets to phishing landing pages. Researchers responsible for discovering this crusade distinguished that it quite effectively evades security solutions and controls intended to stop such attacks in their tracks.

The attackers previously utilized a URL encoded in a QR code target on the French Cofense customers to dodge the security software which dissects and accordingly blocks  suspicious or 'blacklisted areas' .

They even included a GIF image containing the QR code which would redirect them to the hxxps://digitizeyourart.whitmers[.]com/wp-content/plugins/wp-school/Sharepoint/sharepoint/index.php domain intended to act like a SharePoint-related site.

The phishing mails were disguised as a SharePoint email with a "Review Important Document" headline and a message body which would welcome potential victims to  "Scan Bar Code to View Document."
Phishing Email

Removing the victims from the overall safety of their computers thusly enables the cybercriminals to adequately sidestep any link protection services ,secure email portals, sandboxes, or web content filters set up by the targets' corporate information security department.

To make the attack considerably progressively fruitful against mobile users, the attackers have likewise upgraded their landing pages for smartphones with the phishing page and thus providing a custom view on the mobile devices.

Phishing landing page
Researchers from Cofense, the leading provider of human-driven phishing defense solutions world-wide, state that QRishing is a fairly notable technique utilized by cybercriminals to abstain from phishing filters and security solutions build especially to block such attacks before the pernicious emails reach the targets' inboxes.

Phishing landing page on a mobile

Along these lines , a conceivable protection against them named QRCS (Quick Response Code Secure), which would be "a universal efficient and effective solution focusing exclusively on the authenticity of the originator and consequently the integrity of QR code by using digital signatures, “was proposed in a paper from the Carnegie Mellon University's CyLab Study , which could perhaps prove to be valuable later on in the future.

Javascript-Based Trojan Disguised As Game Cheats By Attackers




Researchers have made a recent discovery on a modular downloader Trojan based on a new Javascript, disguised and circulated to target as game cheats by means of websites and owned by its designers.

They found that the Trojan dubbed as MonsterInstall — utilizes Node.js to execute itself especially on the victim's machines.

Found by Yandex, the malware was sent over to Doctor Web's research team for further investigation together with a little extra data on how the Trojan sample was distributed.

The MonsterInstall downloader Trojan after launch is known to 'gain persistence' by adding itself to the already infected computer's autorun to naturally be launched after the machine is rebooted.

It begins by gathering the system information and sends it to its command and-control (C&C) server, "In response, it receives links to the Trojan’s worker and updater modules, unpacks them and installs them into the system."

"When users attempt to download a cheat they download a password-protected 7zip archive to their computers , inside which there is an executable file; which upon launch, downloads the requested cheats alongside other Trojan’s components," says Doctor Web.

The Trojan at that point grabs every one of the segments it needs, to play out its pernicious undertakings with the crypto mining module being downloaded as xmrig.dll that will end xmr, xmr64, and windows-update processes it discovers running on the compromised system.

"Developers of this malware own several websites with game cheats, which they use to spread the malware, but they also infect other similar websites with the same Trojan. According to SimilarWeb’s statistics, users browse these websites at least 127,400 times per month," also note the Doctor Web researchers.

The gamers however have been quite recently being focused upon by the attackers yet this isn't the first time and it beyond any doubt isn't the last as well. For instance, the cybercriminals have used the pernicious game servers to endeavor to infect CS 1.6 players utilizing game client vulnerabilities just as to advance different servers for money.

Despite the fact that Doctor Web had the option to bring down the domains utilized by the Trojan to send gamers to the fake servers with the assistance of the REG.ru domain name registrar, safety measures are at any rate prescribed to the present and active users.


Confluence servers hacked to install malware

Cybercriminals are now exploiting a vulnerability in Confluence servers to install cryptojacking malware. According to a report by Trend Micro, the vulnerability has been well documented in the past. However, at the time, it was being used to target victims with DDoS attacks.

Confluence is a widely popular planning and collaboration software developed by the Australian software giant, Atlassian. Trend Micro reported that it had noticed one of the vulnerabilities, CVE-2019-3396, in April, a month after Atlassian published an advisory covering the same. CVE-2019-3396 is a template injection in the Widget Connector that allows cybercriminals to execute code remotely on their victims’ machines.

The vulnerability was first used for a DDoS attack in Romania. However, the cybersecurity and analytics company revealed that hackers are now using it to install a Monero crypto miner that comes with a rootkit. The rootkit serves to hide the malware’s network activity. It also shows false CPU usage on the affected machine, misleading the user and further concealing the mining process. The report further revealed that the rootkit re-installs the malware should the victim manage to remove it.

The attack begins by sending a command to download a shell script hosted on Pastebin, an online content hosting service where users store plain text for a set period of time. The malware then kills off some of the processes running on the host machine before downloading other resources, also from Pastebin.

The vulnerability mainly targets older versions of Confluence, with Atlassian urging its users to download patched versions of Confluence Server and Data Center to protect themselves.

In recent times, cryptojacking has become increasingly popular with cybercriminals. The tactics are also advancing, with the criminals seeking to stay ahead of the security experts. As we reported recently, a new malware that targets Linux servers has been modified to shut down other crypto miners in the host’s system. Known as Shellbot, the malware uses the SSH brute force technique to infect servers that are connected to the internet and that have a weak password.

Espionage Group Aka Apt33 Targeting Various Organization in Saudi Arabia and US by Deploying A Variety of Malware In Their Network




An unceasing surveillance group otherwise known as APT33 group (Elfin) known for explicitly targeting on corporate networks has now set its sights by focusing on various organizations in Saudi Arabia and US by sending an assortment of malware in their system.

The hacker group which has reportedly compromised around 50 organizations in various countries since 2015, so far its attackers have bargained a wide range of targets including, governments alongside associations in the research, chemical, engineering, manufacturing, consulting, finance, telecoms, and several other sectors.

The cybercriminals scan the defenseless sites of a particular target and later use it for either command and control server or malware attacks if the site will be undermined effectively.

In spite of the fact that the gathering fundamentally focused on Saudi Arabia, with the 42% of attacks since 2016 and it’s compromised 18 organizations in the U.S alone in the course of recent years.

 In any case, for this situation, Elfin focused on organization including engineering, chemical, research, energy consultancy, finance, IT, and healthcare sectors in the U.S alone.





Amid the attack, Elfin is said to have used an assortment of open source hacking instruments, custom malware, and commodity malware to compromise the diverse targets.

Elfin Adept utilizes various openly accessible hacking instruments, including:
  • LaZagne (SecurityRisk.LaZagne): A login/password retrieval tool
  • Mimikatz (Hacktool.Mimikatz): Tool designed to steal credentials
  • Gpppassword: Tool used to obtain and decrypt Group Policy Preferences (GPP) passwords
  • SniffPass (SniffPass): Tool designed to steal passwords by sniffing network traffic


Additionally, numerous commodity malware tools were utilized for these attacks and the malware accessible for purchase on the digital underground including:
  • DarkComet (Backdoor.Breut)
  • Quasar RAT (Trojan.Quasar)
  • NanoCore (Trojan.Nancrat)
  • Pupy RAT (Backdoor.Patpoopy)
  • NetWeird (Trojan.Netweird.B)

Other than these, the custom malware family incorporates Notestuk (Backdoor.Notestuk), a malware in order to access the backdoor and assembling the data, Stonedrill (Trojan.Stonedrill), a custom malware equipped for opening a secondary passage on an infected PC and downloading the additional records.

London hackers may be behind ransomware attack on Lucknow hotel

In a first-of-its-kind ransomware attack in Lucknow, cybercriminals breached and blocked the computer system of The Piccadily, a five-star hotel in the capital of Uttar Pradesh, and demanded a ransom to allow data access. Ransomware is a malware unleashed into the system by a hacker that blocks access to owners till ransom is paid.

The hotel management lodged an FIR with the cyber cell of police and also roped in private cyber detectives to probe the crime and suggest a remedy.

The hotel’s finance controller in Alambagh, Jitendra Kumar Singh, lodged an FIR on March 9, stating the staff at the hotel was unable to access the computer system on February 27 around 11:45 pm when they were updating monthly business data. This was followed by screen pop-ups which read — Oops, your important files are encrypted. The staff initially ignored the pop-ups and rebooted the system following which it crashed. Later, the hotel management engaged a software engineer to track down the malfunction after which it came to light the system has been hit by ransomware.

Nodal officer of the cyber cell deputy superintendent of police (DySP) Abhay Mishra said the case happens to be first of its kind of ransomware attack in the city. The demand for ransom in such cases are also made through ‘Bitcoin’, he said. “They are investigating into the matter, but are yet to make any breakthrough,” Singh told TOI. The staff initially ignored the pop-ups and rebooted the system following which it crashed.

The cyber cell of Lucknow police believes the ransomware attack could have been made from London. Sleuths of the cyber cell made these claims after authorities of the Piccadily said they had been getting frequent phone calls from London-based number after the attack.

Singh said, “We received for calls from the same number a day after the attack. The callers inquired about the ransomware attack and asked about the progress in the case. Later, they also agreed to offer assistance.”

Anubis Malware Re-Emerges Yet Again; Hackers Distributing It via Google Play Store





The Anubis banking malware arises once more with the threat actors allocating the malware on Google Play store applications keeping in mind the end goal to steal login credentials to banking apps, e-wallets, and payment cards.

Hackers are constantly known for finding better approaches to sidestep the Google play store security as well as ways to distribute the malware through Android applications that will additionally go about as the initial phase in an "infection routine" schedule that gets the BankBot Anubis mobile banking Trojans by means of C&C server.

Users as often as possible get tainted once they download and install the malevolent applications via the Google play store, despite the fact that the play store security investigates , all the applications that are transferred into Google Play, cybercriminals dependably execute the most complex and obscure strategies to evade the detection.

Researchers as of late discovered anew downloader’s in-app store that connected with Anubis banking malware. This campaign is known to contain no less than 10 malevolent downloaders masked as different applications. All the Downloader disseminated through Android applications is known to get in excess of 1,000 samples from the criminal's command-and-control (C&C) servers.

“In most Android banking Trojans, the malware launches a fake overlay screen when the user accesses a target app. The user then taps his or her account credentials into the fake overlay, which allows the malware to steal the data. BankBot Anubis streamlines this process.”

Cyber criminals transferring applications into Google play store influence it to resemble a live authentic one; they compromise the clients by controlling them to trust that they are giving an "expertise" as a service.

The researchers likewise found that these malignant play store applications that acted like the authentic ones, for the most part focus on the Turkish-speaking clients and the downloader applications in this specific crusade were intended to address Turkish clients just with a couple of various botnets and configurations.

All these applications are transferred to various categories, for example, online shopping to money related services and even an automotive app.

As indicated by an analysis by the X-Force, the adjustments in the downloader application propose that it is being kept up on a progressing premise, another sign that it is a ware offered to cybercriminals or a particular gathering that is centered on swindling particularly the Turkish mobile banking users.

Once the noxious downloader is effectively installed into the victims Android then the app brings BankBot Anubis from one of its C&C servers. The BankBot Anubis malware forces clients to concede the consent by acting like an application called "Google Protect." 

This accessibility will go about as a keylogger getting the infected user's credentials from infected users mobile.

BankBot Anubis is known to target users in numerous nations also for example, Australia, Austria, Azerbaijan, Belarus, Brazil, Canada, China, Czech Republic, France, Georgia, Germany, Hong Kong, India, Ireland, Israel, Japan Kazakhstan, Spain, Taiwan, Turkey, U.K. as well as U.S.

Hackers Target Travel Firm to Plunder Hundreds of Thousands from Clients




The Cyber criminals have now targeted a travel firm Booking.com in an offer to plunder hundreds and thousands of pounds from clients.

The clients were sent WhatsApp and text messages asserting a security break that implied that they needed to change their password.

Be that as it may, the link gave the attackers access to the bookings and they at that point, sent follow-up messages requesting full installment for holidays ahead of time with false bank details provided.

David Watts, the Marketing manager of Newcastle, got a WhatsApp message but realized it as a trick. He stated: "It looked exceptionally reasonable and I can now believe how people fell for it."

These seemed bona fide as they incorporated personal information of individuals  including their names, addresses, telephone numbers, dates and booking prices as well as reference numbers.




Code signing Certificates created on demand for Cybercriminals

Many organizations have as of late begun adopting certain strategies of using code-signing certificates to authenticate their software and protect it against tampering. Indeed, even Malware authors have for quite some time been utilizing such certificates for their malicious payloads so as to sneak past enterprise anti-malware tools.

A New research done by the Recorded Future shows that a growing number of code-signing certificates in the cyber underground are actually being created on demand for specific buyers by Dark Web vendors utilizing stolen corporate identities. Each certificate is unique to the buyer and is usually delivered within two- to four days.

The certificates are notwithstanding being issued by reputable companies for example Symantec, Comodo, and Thawte, and are accessible at costs ranging from $299 to $1,599.

This usage of code-signing certificates to distribute malware is not new but recently more malware authors have started depending on the strategy as a way to distribute malware.

"We do not have information on what percentage of all certificates circulating in the Dark Web were obtained using compromised corporate credentials," says Andrei Barysevich, director of advance collection at Recorded Future. "However, considering the malicious intent of hackers when utilizing such certificates, it is safe to assume that a high proportion of them were obtained fraudulently."

The certificates issued give users an approach to confirm the identity of the publisher and the integrity of the code. The Malware however is difficult to spot since it has been digitally signed with a valid code-signing certificate as it also happens that a majority of the anti-malware tools and browsers remain under the impression that the payload can be trusted because it is from a trusted publisher.

A recent incident that sparked wide spread interest was reported last October, by a security vendor Venafi that followed a six-month investigation conducted to show a thriving market for code signing certificates on the Dark Web.

 The research, conducted by the Cyber Security Research Institute, showed that such certificates are more expensive than even the stolen US passports, credit cards, and handguns. Venafi found that stolen code-signing certificates are being utilized as a part of a wide range of malicious activity including man-in-the-middle attacks, malware obfuscation, website spoofing, and data exfiltration and can get up to $1,200 in underground markets.

Recorded Future researchers say that their investigation shows that the cybercriminals are currently offering new code-signing certificates and domain-name registration services with SSL certificates.
They first observed a Dark Web vendor selling such certificates in 2015. From that point onward, they have seen no less than three new actors selling code-signing certificates obtained from major CAs using stolen corporate credentials. One of the vendors has even proceeded on to other activities while the remaining two are as of now continuing to sell counterfeit certificates primarily to Russian threat actors.

The cost associated with these certificates implies to the fact that they are likely to be of most interest to hackers with specific motives in mind, Barysevich says.

"Attackers who are engaged in targeted campaigns, such as corporate espionage or bank infiltration, are the most likely buyers of counterfeit code-signing certificates," he added further.
"That being said, there are many applications of compromised SSL EV {Extended Validation Assurance} certificates, and they could be used in a more widespread malware campaign."


The essential certificates without EV assurance are in any case available for $600 from the vendors, or twice the amount of $295 that an organization would normally pay for a code-signing certificate for legitimate use.

Cyber criminals convicted of stealing more than £1 million using Fake job ads

Organized criminal network of five men and one woman have been convicted for stealing more than £1million from job hunters using fake job advertisements.

The members of the criminal are Adjibola Akinlabi (aged 26), Damilare Oduwole (26), Michael Awosile (27), Nadine Windley (26) and Temitope Araoye (29) and a malware writer "Tyrone Ellis (27)".

The evidence gathered by authorities including phone and online chat records shows that they made more than £300,000 from their fraud scheme. However, the officers believe it could be much higher , possibly more than £1million ($1.6m).

According to the National Crime Agency report, the fraudsters targeted innocent job hunters with fake job ads. Those who responded to the ads were sent a link via email asking them to complete an application form. Once the user clicks the link , it inadvertently install malware in victim's system.

The malware is capable of recording keystrokes and capturing victim's financial and personal data.

The compromised information is used by the fraudsters to get a new credit and debit cards, pin numbers.

The crooks will remain in custody and expected to be sentenced on Thursday 14 November.

New Trojan targeting South Korea sets Anonymous Wallpaper in infected system

After publishing details about a new DDOS attack carried out by a group called "DarkSeoul" against South Korean sites, Symantec researchers have come across a new piece of Malware designed to wipe the disks in infected systems.

The malware detected as Trojan.Korhigh, is capable of deleting files and overwrite Master Boot Record(MBR) . In addition , it is also capable of changing user passwords to " highanon2013" and deleting specific file types including asp, html,php,jsp and etc.

The Cybercriminals who are behind the malware is interestingly designed the Trojan such that it will change the wallpaper of the compromised computers to Anonymous Image.



The Trojan also attempts to gather system information including OS version, computer name, current date and sends to remote server.

Mumbai Police salary accounts hacked, Money withdrawn in Greece


Cybercriminals have reportedly targeted the Salary accounts of Mumbai Police and managed to withdraw money from their account.

According to NDTV report, cybercriminals have managed to withdraw money from Axis bank accounts of at least 14 Policemen from ATMs in Greece.

It appears hackers in Greece have done this heist by cloning ATM cards of Policemen in Mumbai.

At this time, there is no further information about how much money has been withdrawn and how many policemen have been affected by this heist.

The Mumbai police has formed a team to investigate the hack and bank has been asked to investigate.

CyberCriminals leverage CNN Open Redirect vulnerability for spreading spam

Today, I(@BreakTheSec) came across a diet spam campaign that leverages the open redirect vulnerability in one of the top News organization CNN.

"The diet porgram you told us about yesterday is soo good! hxxx://cgi.cnn.com/cgi-bin/redir?URL=hxxx://tumblrhealth.me" One of the tweets posted from the spammers' twitter account reads.

The tweet apparently shows cyber criminals managed to leverage the open redirect security flaw in the CNN to redirect twitter users to the Diet spam websites.


"I love myself even more after I started your diet porgram [link]" spam tweets read.  "Yahoo made an article about how amazing your new diet program is!! You look amazing" 

The technique provides several advantages to the cybercriminals including 
  • Getting trust of users
  • URL filtering won't block users from accessing the url because the request goes to CNN.  CNN website then redirects the user to scam website. 

 After further research, i discovered the spammers has also managed to exploit the open redirection security flaw in Yahoo.

"hxxx://us.ard.yahoo.com/SIG=15ohh3h62/M=722732.13975606.14062129.13194555/D=regst/S=150002347:R2/Y=YAHOO/EXP=1275539597/L=hnNys0Kjqbp5Cok8Sr10cAJDTPYa3UwHFG0AANhn/B=VSDoPmKJiUs-/J=1275532397077354/K=rS6pwy3MN2NPP7SBqBCOAQ/A=6097785/R=0/SIG=11o4aqdmv/*hxxx://bit.ly/HealthDiet2"
This is not the first time the CNN website is being abused by cyber criminals.  In 2010, the spammers managed to exploit the open-redirect vulnerability in "ads.cnn.com".

*Update: security researcher Janne Ahlberg ‏discovered @50Cent who has 7.6M followers fell victim to this spam campaign and retweeted the spam tweet:


The screenshot apparently shows the tweet posted on 23rd May 2013.  At the time of writing, the tweet still appears in the account.

*Update 2:
It appears cybercriminals' campaign getting success which mentions various celebrities and media organizations in their tweets - one more celebrity falls victim to the spam campaign.

"“@honshadey: @ChiefKeef So happy you released a diet program! THANKS! hxxx://cgi.cnn.com/cgi-bin/redir?URL=hxxx://tumblrhealth.me …”Bitch U Know i aint Got no Diet Program 😒"  Keith Cozart better known by his stage name Chief Keef , American rapper from Chicago, replied to the spam tweet.

Unfortunately , more than 400 followers has retweeted the post that helps the spammers to spread their campaign.