Search This Blog

Bitcoin fraud worth $ 359M caught by the Brazil Police


The Brazilian police have found what is said to be an alleged Bitcoins fraud that stole $ 359M from the sufferers. "The Brazillian state police have been able to counter the anonymous operation and have caught 9 criminals," says the Parana state government in a statement. "Growing concern in crypto-currency businesses has been followed by an increase of scams,” the report states. “The absence of supervision and attention along with large levels of distraction, unfamiliarity, cross-perimeter activities, and other characteristics crucial to the cryptocurrency business reveals possible dangers to the users," says Brazilian Congressman Aureo Ribeiro.


The 4 months inquiry exposed five hundred personalities from over 6 states that have fallen prey to the Bitcoin grant fraud. However, the figures could go up to 5000 persons. “It was obvious that the plan was a fraud when the victims got a notification from the organization, informing the users that the investors would not be able to debit their money for 6 months,” says the Parana state government's statement.

The company responded to the situation by saying it too had suffered a scam estimating $5 million. But the investors' withdrawal money was delayed even after 6 months passed, and that's how the company was caught red-handed.' According to one of the victims, a fraud had promised everyday returns up to 4% on investments. The people arrested for the theft are accused of money laundering, scam, counterfeit and unlawful connection. 

Cryptocurrency Frauds happened recently-

Sadly, it is not the first instance when people have fallen prey to the cryptocurrency scam. "In May, a cryptocurrency fraud gang had was locked down for theft of $200M from over 50,000 victims," reports Hard Fork. Criminals pretended to give crypto-currency grants assuring people 15% of profits for their money. "During the time, the firm had collected about $215M through February 2019, however, police concluded the figure could be around $250M," says Federal Revenue Service.

The police in April caught an individual on doubt that he was running drugs racket gang and stealing money through Bitcoins. In the region Porto Alegre, Southern Brazil, the police officials have discovered a secret drug lab having Bitcoin digging facilities.

A cyber- security provider discovers Microsoft, LinkedIn and many others becoming the most preferred targets for phishing


Akamai Technologies, Inc. an American content delivery network as of late discovered various issues, like the DDoS attacks, credential stuffing, and phishing and in its State of the internet/security (SOTI) report, it featured the research done by the organization over the last 12 months.

According to Akamai's discoveries over 50% of every unique organization that was 'impersonated' by tracked phishing domains was from the financial services and among the favored targets for phishing, companies like Microsoft, PayPal, DHL, DocuSign, and LinkedIn were among the top targets.

As per Akamai the attack aimed at gathering the personal information of users and duping them by later claiming to be a 'trustworthy' source, just like an organization or a bank, it assumes a vital job in 32% all breaches and 78% of all cyber-attacks.

In its report it has featured that among the phishing kits observed by it for almost 262 days, 60% of kits were active for 20 days or less, more than 2 billion unique domains that seemed malignant and 89% of the domains utilized for phishing had a 'life expectancy' of under 24 hours while 94% had a life expectancy of under three days.

While the measures embraced against such phishing attacks have been developing throughout the years, the shifty and cautious strategies utilized by phishing kits have been transforming too.

Akamai’s report basically highlights some of the content-based evasion techniques used by phishing kits. The crucial evasion techniques incorporate the CSS font evasion, arbitrarily generated URLs, sub-domain and HTTP user-agent filtering.

Here are some of the steps to be taken by users to better protect themselves from such attacks:

  1. Check the email or message for spelling mistakes, unusual phrases, and discrepancies in the domain name.                                                                                                                                        
  2. If the email contains unnecessary attachments or links, avoid clicking on them.                                 
  3. Do not click on shortened links, especially on social media.                                                                    
  4. At all costs avoid emails from suspicious senders that contain urgent deadlines and ask you to click on a link or visit a website urgently.                                                                                                   
  5. Do not enter personal information in pop-up screens as companies generally do not use pop-up screens to ask for user information.


Romanian cybercriminals sentenced to 20 years in prison for developing malware


Two Romanian citizens were sentenced to imprisonment for the development and operation of the Bayrob malware, which infected more than 400 thousand computers, and theft of confidential information.

Back in 2016, three members of the hacking group Bayrob were extradited to the US. Law enforcement officers told that citizens of Romania Bogdan Nicolesku aka Masterfraud, aka mf, Danet Tiberiu aka Amightysa, aka amy and dRadu Miclaus aka Minolta, aka min since 2007 engaged in fraud and development of malware, and then their business became a large botnet, which was also involved in cryptocurrency mining.

According to authorities, during the years of activity, the group stole more than four million dollars from its victims, but Symantec analysts, who helped law enforcement agencies to stop the group's activities, reported that in fact, the damage from the actions of Bayrob could be more than $35,000,000.

Bayrob malware was conceived as a tool to steal email addresses from the target computer and then send infected messages to users. Cybercriminals managed to infect and hack more than 400 thousand computers. The attackers registered more than 100 thousand email accounts to send 10 million letters to the collected addresses. The defendants also intercepted requests to Facebook, PayPal, eBay and other websites and redirected victims to similar domains in order to steal their data.

So, if in 2007 about 1000 cars were infected with Bayrob, by 2014 their number increased to 50,000, and by 2016 it exceeded 300,000 altogether.

All three suspects were charged in 2016, but the case came to court much later. At the end of last week, the website of the US Department of Justice reported that Nicolesku and Tiberiu were sentenced to 20 and 18 years in prison.

Maze Ransomware Exfiltrated Data of Southwire Firm, Threatens to Publish if Ransom Not Paid


Maze ransomware, a variant of Chacha Ransomware that has been leading the charge of various ransomware attacks lately, now claimed responsibility for yet another cyber attack, this time on North America's most prominent wire and cable manufacturer, Southwire that generates household and industrial cables, utility products, portable and electronic cord products, OEM wire products, engineered products, and metal-clab cables for more than 50% of Northern America. It's a leading wire producing company with over 7,500 employees and has been around for seven decades now.

The attackers surreptitiously infiltrated company data and demanded a ransom of approximately $6 million (859 BTC) for a safe release of the data which reportedly is all set to be published in case the company fails to pay the demanded amount.

Maze Ransomware was originally discovered by Jérôme Segura, a security researcher at Malwarebytes in the month of May, earlier this year. Since then, the malware strain has gained massive popularity and is continuously becoming more and more active. While organizing various malspam campaigns, it has been discovered that its affiliates are essentially more dangerous.

On Monday, around the time when the company's website suffered the ransomware attack, admins located a message posted in Imgur demanding a ransom of 850 BTC from the company. In the wake of which, a topic was started on Reddit where Snooze16, seemingly an employee of the company, while putting the situation in perspective, said, “I went into the offices yesterday afternoon. Everyone was headed home – no computers. It looks like their site is still down. The IT guy that was there told me that the plant called him at 5 am asking how to shut the servers down. Bad time of year not to be shipping.”

In a conversation with the Chronicle, Jason Pollard, vice president of Talent Acquisition and Communications for the wire manufacturer, told, "We immediately self-quarantined by shutting down the entire network,"

"The incident did cause some disruption in our ability to make and ship our products."

"The safety of our employees, the quality of our products and our commitment to our customers are critically important to us. Today, we’re bringing critical systems back online, prioritizing manufacturing and shipping functions that enable us to create and send the product to our customers. We are dedicated to restoring all systems and bringing all of our employees back to work as safely and as quickly as possible." He further added.

Cases of Net Banking and ATM Frauds Increase by 50% in New Delhi


Cases of illegal matters like Net Banking, ATM hackings, and fraud banking cards rose over 50% to pass more than 52,000 cases in the year 2018, with New Delhi being the banking scams metropolis estimating for approximately 27% of the recorded instances of "theft of money." The Indian Government, however, replies by saying the situation is not that bad as the amount of money stolen in such instances have dropped. Cases of theft related to Netanking, ATMs, and transactions have risen by 50%. But the amount of fraud money involved in these cases has fallen by 12%.


The capital New Delhi amounts for 3,164 complaints registered, top in the list of ATM frauds cities. However, the figures in the public sector ATM frauds are quite staggering. State Bank of India, which has more than 58,000 ATMs throughout the country, has been the victim of 1 out of 5 frauds happening to its ATM. SBI amounts to 25% of the ATM frauds that happened in 2018-19. Following SBI is IDBI Bank, which is second in the list of ATM frauds. According to IDBI's website, the bank has over 3700 ATMs in the country, and it reports 1800 cases of scam. IDBI amounts for 15 % of the ATM heists cases between 2017 and 19.

As of now, the Indian government has not revealed the causes that led to the fraud. The bankers, on the other hand, say that India has been falling prey to banking frauds day by day, at the time when the country is working to develop its infrastructure to protect itself. "The country is observing a large entrance of frauds from alien nations as the support system in Europe has been enhanced, causing more trouble for the fraudsters," says a banker.

Whereas, another banker says that hidden cameras are being planted over the ATM keyboards for spying the pin codes, and different hacking methods like viruses are being deployed by the hackers in the ATMs to steal all the money. The RBI has announced specific measures to control the situation but the banks are very slow in responding to the measures suggested.

Data Privacy on Alert; Facebook, Whatsapp and Others Fear The Personal Data Protection Bill?


The latest amendments in the “personal data protection bill” of India could make Facebook and other data consuming platforms lose sleep over enhanced government powers.

On Tuesday, the Personal Data Protection Bill was passed around in the parliament which could have strong consequences on the way the organizations store, process and use public data.

The newest addition to the bill is the stipulation that endows the Indian government to demand from a company the “anonymized” personal and non-personal data for better government services.

Per the bill, any information that could aid in identifying a person and possesses characteristics, traits or any attributes of a person’s identity could be defined as “personal data” and the rest as non-personal.

For the leading tech-organizations, personal or non-personal, the data is valuable. And these new provisions brought out by the bill are issues of major concern.

Reportedly, an official strongly taking the government’s stand mentioned that the “personal data” is as valuable to the society as it is to the tech-companies.

They also mentioned something along the lines of making use of data from cab organizations like “Uber” to comprehend the limitations of Indian public transport and what could be done for its betterment.


There is no specific mention as to what the data shall come in exchange for or any other ensuing rules as to the processes regarding it.

Per the bill, personal data such as biometric details and financial data could be transferred beyond the boundaries of India for processing purposes but must be stored locally.

Allegedly, the media platforms in question could also need to provide a structured procedure for users to “prove their identities” and “display a verification sign publicly”. This could cause major companies to face major technical issues.

Dreading the possibility of furthered compliance costs, the countries across the globe have been pushing their agencies to go against such rules.

Per reports, these fresh exceptions that the bill makes available for the government could be alarming for India’s privacy situation which isn’t as strong as all that.

The bill that shall soon be presented in the parliament will definitely not be passed in this session and only after further voting and discussion should any results be declared.

Anti-Virus Maker Discovers A Bug within Ryuk Ransomware


An antivirus maker discovered a bug in the decrypter application of the Ryuk Ransomware, the application "the Ryuk gang" basically provides to victims to recoup their files after they paid the ransom.

While the bug causes a deficient recuperation of certain types of documents, prompting data loss, regardless of whether the victim paid the ransom demand, the primary issue, as elaborated by the antivirus maker Emsisoft in a blog post, is that the decrypter shortens one byte from the end of each file it decodes.

The secondary issue is that the Ryuk gang's decryptor additionally erases the original encoded files, which means that the victims can't re-run the 'decryption operation' again with a "fixed" decryptor. 

While the last byte in many records is there for cushioning and is generally unused, for some file extensions those bytes contain essential data that when expelled will permanently degenerate that information and thusly prevent the document from being opened.

"A lot of virtual disk type files like VHD/VHDX as well as a lot of database files like Oracle database files will store important information in that last byte and files damaged this way will fail to load properly after they are decrypted," Emsisoft says.

"We're hoping to get the word out about this as quickly and widely as possible so that affected organizations can avoid data loss,"
 - Emsisoft representative Brett Immature told ZDNet. 

Emsisoft advised the victims to connect by means of ryukhelp@emsisoft.com to have its analysts fix the decrypter they got from the Ryuk gang.

 In any case, while Emsisoft is the organization who discharged the most "free ransomware decrypters" in the past, this is a 'paid service', as it infers its experts attempting to address each decrypter partially, a very tedious undertaking.

Infections attributed to Ryuk include - manage service provider T-Systems, financial service provider ASD Audit, insulating technology manufacturer TECNOL, automation tool manufacturer Pliz, city of New Bedford (US), Tribune Publishing, managed service provider PerCSoft, healthcare provider CorVel, IT service provider CloudJumper, the city of Lake City (US), and many other more.

Hackers steal money from cards through the Uber and VTB applications


A resident of Russia Anna Kozlova, resting in Spain, lost 14 thousand rubles ($220). The money was stolen from her VTB Bank card through the Bank's mobile app and Uber.

At first, the woman was charged 2 rubles from the card, it looked like a standard check of the solvency of Uber customer, especially since the money immediately returned to the account.

However, immediately after this, 2829 rubles were debited from the card. The app’s notification said it was Uber service fee that Anna hadn’t actually used since she was sleeping.
Then notifications, according to the tourist, began to come one after another. After 22 minutes, when she woke up, the girl blocked her card, but by that time the cost of four more trips that she had not made was debited from the card.

Unknown stole from Kozlova 14 118 rubles and did not stop trying to withdraw money from her account even after blocking the card. It is curious that all write-offs were allegedly made by the international service Uber, which in Russia was merged with Yandex.Taxi.

When Anna contacted the support team of this company, the staff could not give her information about the write-offs. The VTB support service clarified that the last write-offs were made from Moscow, and then Anna appealed to Uber Russia.

The Russian company Kozlova explained that if she did not use a taxi, it means that someone received the data of her Bankcard, including CCV code, and used it for payment.
Kaspersky Lab experts explained that fraud schemes through taxi services are no longer uncommon.

According to them, there are channels in the messengers where you can order a taxi at a great discount. The scheme looks something like this: the passenger sends a message to such a channel indicating the details of the trip, and the attacker calls a taxi using the stolen account.

After completing the trip, the driver receives money from the owner of the stolen account, and the passenger transfers the money directly to the attacker. In order to remain unnoticed for as long as possible, attackers can track the owner of a hacked account on social networks and organize such trips at night when it is likely that a person is sleeping, or during the victim’s travel abroad.

The Ministry of Communications of Russia has developed a new service for the sale of cars


According to Deputy head of the Ministry of Communications Maxim Parshin, the Ministry of Communications and the Ministry of Internal Affairs are preparing a new free service that will allow users of the public services portal to form an electronic contract for the sale of cars.

It is assumed that with the help of the new service, a potential car buyer will be able to find out the history of the car and then form an electronic sales contract, which can be verified with a simple electronic signature. Moreover, the new service will avoid errors that often occur when filling out paper contracts.

According to Parshin, "on the basis of the contract, drafts of applications for registration of the vehicle by the new owner and for termination of registration by the previous one are automatically formed". Information about the contract will be displayed in the personal account on the portal of public services.

"The electronic contract will make registration of car sale and purchase transactions faster and safer", explained the Deputy head of Department. According to the data, at the first stage, the new service will be available only to individuals, and its approximate launch date is attributed to 2020.

Electronic contracts will replace paper contracts, notarization of which is optional. According to the newspaper, traffic police officers are regularly faced with incorrectly filled(for example, errors in passport data) and fake (for example, the owner of the car did not give consent to the sale) agreements. Therefore, after numerous appeals from citizens, the State Traffic Inspectorate proposed to the Ministry of Communications to develop a new electronic service. After the entry into force of the government decree, which allows performing on the portal of public services "legally significant actions, including transactions, by creating electronic documents", the project became possible.

The electronic format of the purchase and sale registration process is “convenient and timely, but in 2020, the service is unlikely to work,” said CarPrice CEO Denis Dolmatov.

"It is unclear how the system will be protected from hacking and fake registrations by hackers. In my opinion, the launch next year will be incomplete, improvements will be needed, the launch will be rescheduled", said Dolmatov.

Pensacola City Hit by a Cyberattack After Deadly Shooting at Naval Air Station


The city of Pensacola, Florida was hit by a cyberattack that came in the wake of a deadly shooting at the naval air station wherein a Saudi flight student killed three sailors and wounded eight others.

As the trainee who pulled the shooting had ties to a foreign nation, the incident was labeled as a potential terrorist attack and has consequently incited international controversy. Officials suspect a link between both the incidents, however, no confirmatory lead has been gained onto the subject of the connection between the two events.

The city has been struggling with the cyberattack that began around 1:45 a.m on Saturday and took down the city's computer systems while keeping various city services at halt. Reportedly, the incident has incapacitated the city's online payment services, email services, phone lines, and 311 customer service. However, emergency support services such as fire and police remain unaffected during the incident, as per the officials.

Commenting on the matter, the city's spokeswoman, Kaycee Lagarde said, "I can confirm the city of Pensacola has experienced a cyberattack and we've disconnected much of our city's network until the issue can be resolved."

"As a precaution, we have reported the incident to the federal government," Lagarde added.

Officials have been investigating to determine the nature of the attack, whether it was a ransomware attack or not along with the details of any valuable information lost during the incident.

"The city of Pensacola is experiencing a cyber attack that began this weekend that is impacting our city network, including phones and email at City Hall and some of our other buildings," said Mayor Grover, C. Robinson.

"We're still trying to figure out what's happened, what's there and what there may be potential for."

"We don't know if they're connected or not,"

"We have discussed and we have talked with the FBI. It's my understanding that we sent stuff to them, and we're continuing to work. Our computer people worked through the weekend to see what was happening." He further told at his weekly press briefing.

This year witnessed an unusual rise in the number of cyberattacks on governments– local and state; US cities and towns have been particular targets for ransomware attacks in recent times. Reports state that most of these were co-ordinated chains of attacks aimed at breaching computer networks.

The latest statements on the issue suggest that the city is actively involved with the FBI in order to resolve the matter.

State of the Art Cyber-Security and Network Security a Top Priority for The Business Market



Reportedly, accepting the growing need for better cyber-security tactics and embracing a further developed regime for securing the businesses on the cyber front, European organizations are up for upgrading their network security.

With a high rise in the number of cyber-crime, mainly data breaches, and other infamous cyber-attacks it’s become the need of the hour to promote more initiatives regarding data safety.

By taking upon themselves the idea of spending more on modern security techniques and solutions, the European businesses are investing truly in lucrative methods of counteracting cyber-crime.

Along with getting into partnerships with their local governments, network security is one of the major focuses of the organizations with allegedly an expected compound annual growth rate of over 15% by 2025 in the field.

Protecting data integrity, guarding businesses against any virus or malware attacks, stabilizing the critical business networks and shielding against any unwanted intrusions are a few of the major missions.

Network management has indeed become difficult owing it to the technological advancements, multiplication in the variety of devices and intricate network structures and hence network monitoring tools have become imperative.


Long gone are the days of traditional solutions to not so traditional cyber-hazards and cyber-insecurities. Antiquated prevention systems are obviously failing at keeping cyber-crime at bay.

Reportedly, large amounts of random alerts are generated everyday but go unnoticed which leads to “classes of risky connected devices” going without proper monitoring, analyses and management.


Per sources, analysis of network security has got to be of paramount importance to any business that wishes to successfully and safely function in these imminently digital times.

Finding out what the actual threats are, reducing noise, realizing their motives and ultimately being ready for them when (if) they arrive at all is the smartest decision any organization could make.

The banking sector, per reports is one of the leading turfs to become cyber-active and cyber-ready. With all the e-commerce platforms and cyber-banking being a huge part of the digital game the investments are supposed face a gigantic hike in the coming years.

Cyber-attacks have several repercussions to them that they leave behind after wreaking the primary havoc. Financial damages, tarnished images, dissatisfaction between customers, clients and other stakeholders are at the top of the list.

With improved and upgraded cyber-awareness regimes and cyber-security solutions owing it to better analytics, all the enterprises from large to smaller ones shall definitely be more lucrative than ever.

Attacks on IoT devices and WebApps on an extreme rise for the Q3

Ransomware threats and Malware numbers have fallen but are presently more active and dangerous. More than 7.2 Billion virus attacks originated from January to September in the year 2019. Also, 151.9 million ransomware crimes were found.

Important conclusions cover:

  • IoT malware mounted to 25M, a tremendous 33% rise 
  • Encrypted attacks rose to 58% 
  • Web application threats are on the increase, revealing a 37% rise during the same time for last year Malware threats reached 7.2 Billion 
  • Ransomware threats hit 151.9 million 
  • 14% of the malware threats were received from non-standard gates


"The attacks may be dropping down for the moment but the truth is the figures of threats are still extremely high and more dangerous in history. We have reported a rise in geographical threats in America and involving the UK and Germany. The researchers at our lab are also investigating distinct and increasing threat vectors, like surface channel threats and tricks," says The SonicWall Capture Threat Network. “While observing the ransomware range, we also recognize that ransomware attacks tricks have evolved,” says SonicWall CEO and President Bill Conner.

“Earlier, the hackers aimed at the number of viruses but today we are witnessing that hackers concentrate on less more eminent victims for expanding sideways. This change in tricks also witnessed a similar increase in the payment demands through ransomware attacks, as the criminals try to steal high payment from the few, but profitable victims such as hospitals and regional districts." “The evidence reveals that cyber-criminals are becoming better at attacks, more specific and more careful. Companies should be careful and make more stringent safety laws in their institutions to overcome the menaces that our experts have found,” says Conner.

He further adds “we suggest that organizations should adopt a combined and multilayered safety program that gives solid security beyond all systems to avoid being the cover story for cyber attack news”. Phishing threats are matching series with malware and ransomware attacks. However, the attacks are also going down at a rate of 32% each year, a figure that has been the same for most of the time this year.

The Kremlin opposed cross-border persecution of Russians in the United States


Dmitry Peskov, the Press Secretary for the President of Russia, commenting on the largest award in history appointed for Russian hacker Maxim Yakubets, said that Moscow opposes cross-border persecution of Russians by the American authorities. The State Department announced awards of $5 million for information that would help detain the Russian Maxim Yakubets. American authorities consider this citizen of the Russian Federation the leader of the hacker group Evil Corp.

"The Russian side has repeatedly offered cooperation [in the fight against cybercrime], and our proposals were undesirable and misunderstood," said the Kremlin representative.

According to Peskov, Moscow considers crimes in the cybersphere very serious, the people who committed them should bear the deserved punishment.

"We traditionally advocate for cooperation in the investigation of such crimes and the capture of criminals, but in this case, we can't speak about cooperation, this is not our fault," said the representative of the Kremlin.

On December 5, the US State Department announced its readiness to pay $5 million for information that will help detain the alleged leader of the hacker group Evil Corp (also known as the Dridex Gang) Maxim Yakubets. This award was the largest in history of all that has ever been nominated for the head of a cybercriminal. Earlier, another Russian Evgeny Bogachev was the “leader” in this indicator, for whom in 2015 a prize of $3 million was offered.

Us and UK authorities accuse Yakubets of leading a group of hackers who stole more than $100 million. According to the US Treasury, Evil Corp is responsible for the development and distribution of the malware Dridex, used to infect the computers of 300 banks and financial companies in more than 40 countries.

According to Washington, Yakubets also provided direct assistance to the Russian government. The US Treasury Department claims that Yakubets worked for the FSB of Russia in 2017, and in April 2018 was allegedly in the process of obtaining permission from the FSB to work with Russian secret documents.

Banking Trojen rises as the Top Security Concern


According to a new research by Blueliv, banking trojans have risen as the biggest threat to the Financial sector second only to mobile malware. A twitter poll conducted by cyberthreat intelligence provider Blueliv, from 11,000 users revealed that a third of respondents were concerned about the impact banking Trojans (31 percent) and mobile malware (28 percent) will have on financial services organizations and their customers in 2020. Tracking these financial threats, Blueliv researchers observed an increase in Trickbot banking trojan (283%) and a 130% increase in Dridex botnets. These Q2 and Q3 botnets are believed to be distributing banking trojans and malware in the financial sector and their customers.


Skill shortage and lack of visibility of threats present as security challenge- According to the poll, the financial sector is suffering from a major skill shortage in building security programs and identifying security threats - the most pressing being a shortage of skills (28 percent), followed by the high volume of threats and alerts (26 percent) and a lack of visibility into cyber threats (20 percent) (by Blueliv). Realwire quotes, "This is hardly surprising: as financial services institutions (FSIs) embrace digital processes and new customer interaction channels, so their attack surface grows, making it harder to keep on top of threats ranging from Point-of-Sale (PoS) to ATM malware, mobile apps malware to card skimmers."

A recent data by (ISC)2 shows that the global skills shortage has crossed 4 million. In Europe alone, the shortage has bypassed 100 percent. Daniel Solís, CEO and founder, Blueliv says, “Organizations in the financial sector face a constantly changing threat landscape. Business priorities have shifted and digital risk management is now central. Because they are such high-value targets for cybercriminal activity, it is imperative that financial services organizations monitor what is happening both inside and outside their networks in real-time to create effective mitigation strategies before, during and after an attack.”

He further commented, “FSI (financial services institutions) security teams can be easily overwhelmed by the number of threat alerts they receive which can very quickly result in alert fatigue and desensitization to real, preventable threats. Threat intelligence can address the cyber skills gap through continuous automated monitoring combined with the human resource to provide context, helping FSIs develop highly-targeted threat detection, prevention, and investigation capabilities.”

Financial organizations are prime suspects for attacks, even after having the most sophisticated cyber defense strategies, weak spots do remain and are being exploited by trojans and malware overlooked by fraud risk assessment teams due to skills shortage and poor threat visibility.

Facebook Files a Lawsuit Against a Company for Running Malicious Ads?



Reportedly, Facebook filed a lawsuit against a “Chinese Company” that allegedly put user accounts at large only to put up suspicious ads on the platform.

The running and distribution of advertisements which were about “counterfeit goods” and “dietary pills” was the only purpose of compromising the accounts in question.

The aforementioned company, per reports, goes by the name of “ILikeAD Media International Company Ltd.” It is, according to sources represented by the authors of the malware scheme, namely, "Huang Toa" and "Chen Xiao Cong".

Purportedly, the aforementioned authors apparently employed two basic ploys to mask their actual aim.

Using images of celebrities, aka “celeb bait” to lure people into clicking on them is one of them and the other happens to be something called “Cloaking”.

Cloaking refers to the act of hiding something from the Facebook systems so that the real destination of a link and advertisement is concealed.

The ad after getting clicked on would lead the users to the genuine “landing page” whereas Facebook would be tricked into seeing a version that’s legitimate according to the policies and terms of the advertising policies.

Per Facebook, in most cases, Cloaking is foolproof as it hardly ever leaves tracks behind, making it pretty tough to realize the identity of actors. This majorly happens to be the reason why there are no specific rules about this.


Reportedly, another attack along the same lines was observed when fake PDF file editor was being pushed only to steal Amazon and Facebook session cookies. The malware at work, per reports, goes by the name of “Socelars”.

Along with session cookies, other data like access tokens, email addresses, credit card information, account IDs et cetera have allegedly constituted a part of the compromised data.

The cookies are later on used to link with several Facebook URLs where one among them accesses the “account_billing” directory.

The information allowing users to call a Facebook Graph API and extract data from the users’ Ads Manager settings is the major part of what’s inside the directory.

The malware which was being distributed via numerous websites was in actuality a new “Trojan” which had almost nothing in common with the other types.

There’s no knowing if the above-mentioned malware has anything to do with the organization that Facebook sued but it surely suits the description.

All the users who had fallen prey to the schemes pulled off by the cyber-cons were handsomely compensated for, along with getting their accounts secured and free of any unauthorized access.

Facebook is very well aware of the jeopardy its users almost got into and is all-in for taking precautionary measures to erase any chances of repetition.

British American Tobacco’s Romanian Platform Faces Data Breach; Ransomware Demands Bitcoins

British American Tobacco (BAT)’ s Romanian web platform compromised due to a ransomware attack and data breach.
BAT which is a United Kingdom-based company is one of the most gigantic manufacturers of nicotine and tobacco products.
Reportedly, the data breach was first ascertained on an Irish “unsecured Elastisearch server” with around 352 GB of data. Allegedly, the hackers had breached the data’s location.
The ransom request was waiting for the onlookers on the server in the form of a "readme" file wherein they had demanded a “Bitcoin payment” in exchange for “not deleting their data”.
Per sources, the cyber-researchers had discovered the data breach on a “server connected to the web platform YOUniverse.ro” which is part of the Romania promotional campaign for BAT, pursuing adult smokers.
The compromised data encompasses users’ “Personally Identifiable Information” (PII), like name, gender, email address, phone number, date of birth, source IP and cigarette and tobacco product preference.

Allegedly, tobacco advertising is mostly prohibited by the Romanian law, while exempting certain sorts of promotional campaigns and event sponsorship aiming at existing smokers over 18 years of age.
The platform in question aided Romanians to win tickets to events and parties studded with local and international performing stars.
Regardless of the numerous attempts made by the team to contain the breach, the database had been unprotected for the past two months and was finally contained on November 27, 2019.
According to sources, the research team has been after the company’s local branch, the global company, the server’s host, Romania’s National Authority for Consumer Protection (ANPC) and the Certification Authority (CA) for some clarification.
The CA was the only organization to revert to the team. The Romanian journalists who were contacted along with the authorities are yet to answer.   

BMW and Hyundai Networks Compromised by Vietnamese Hackers


Hackers allegedly having links to the Vietnamese government have hacked the networks of two leading automobile manufacturers, BMW and Hyundai, according to the recent reports from the German media.

At the same time, eliminating the novelty from the incident, the reports by Bayerische Rundfunk (BR) and Taggesschau (TS) are making claims that around spring this year, the networks of a BMW branch were breached by attackers.

Reports suggest, hackers installed 'Cobalt Strike', a penetration testing toolkit onto the targeted networks; it was employed as a backdoor through which the compromised networks were intruded by attackers.

Supposedly, BMW was acquainted with the attacker's operations and let them continue to penetrate further into their networks. However, the company brought it to an end by putting a restriction onto the illegal access in the last week of November.

According to the findings, the attackers who compromised BMW's networks also no infected South Korean multinational automotive manufacturer, Hyundai. However, no additional information has been provided regarding the Hyundai breach.

The group behind these attacks, Ocean Lotus (APT32) has been in the cybercrime ecosystem since 2014 and is popular for targeting the automobile sector.

Referencing from the reports, "The attack of the alleged Vietnamese hacker group began in the spring of 2019. Last weekend, the automobile company from Munich finally took the computers concerned off the grid. Previously, the group's IT security experts had been monitoring the hackers for months. This is the result of research by the Bayerischer Rundfunk. Also on the South Korean car manufacturer Hyundai, the hackers had it apart."

"The Federal Office for the Protection of the Constitution also follows the hackers of OceanLotus. "The grouping of OceanLotus has already become important, and one should keep an eye on the development, especially because of the target range automotive industry," said a spokeswoman. In the summer, the German Association of the Automotive Industry (VDA) sent an e-mail to its members. The subject was: "Warning message from the Federal Office for the Protection of the Constitution about poscyberattacksttacks (OceanLotus) on German automobile companies." In the e-mail, the BR research, the hacker's procedure is described in detail." The report reads.

One of Australia's Largest IVF Providers Warns Patients of Possible Data Breach


A malicious cyber-attack targeting on the staff email system of one of Australia's biggest IVF providers may have brought a breach in the personal information of the patients. It has been accounted for that the attackers gained access to emails; email addresses and address books belonging to a number of staff members in the attack.

A group of forensic IT experts has just started an investigation to find out how the server was broken and if patients' personal details were gotten to, according to Chief Executive of Monash IVF Group, Michael Knaap.

While the investigation discovered that the private patient databases were immaculate, the national fertility business said in an email to the patients informing them that staff emails containing sensitive patient data, including medicinal histories, may have been hacked.

Monash IVF emphatically stressed the fact that the attackers have focused on just a bunch of the patients and were simply restricted to "an individual's email address"; however a few patients may have been directly affected.

The IVF provider said it had been in contact with the Office of the Australian Information Commissioner and the Australian Cyber Security Centre (ACSC) about the incident as well as industry regulators.

Monash IVF is attached to fertility clinics in New South Wales, Queensland, Victoria, Tasmania, South Australia, and the Northern Territory.

This, in any case, isn't the first cyber-attack exclusively centered around the patients data security there have been quite a few earlier this year also, the most popular one as revealed by "The Age" a cybercrime syndicate had hacked and 'scrambled' the medical records of around 15,000 patients from a specialist cardiology unit at Cabrini Hospital and thusly demanded a ransom.

Group-IB reported attempts to hack Telegram of Russian entrepreneurs


The company specializing in the investigation of cybercrime Group-IB reported that attackers attempted to hack correspondence of Telegram messenger, and Russian entrepreneurs became the target of cyberattacks.

As the experts explained, at the end of 2019 several Russian entrepreneurs turned to them for help, who faced the problem of unauthorized access by unknown persons to their correspondence in the Telegram messenger.

The incidents occurred on iOS and Android, regardless of the carrier used. Group-IB believes that the attackers were able to view and copy activation codes from SMS messages that Telegram sends when activated on a new device.

Technically, the cyber attack could have been carried out using a vulnerability in the SS7 Protocol. However, attacks on SS7 are rare.

“It is much more difficult to implement such an attack, it requires certain qualifications in the field of data transmission networks and their protocols,” explained Kaspersky Lab’s antivirus expert Viktor Chebyshev.

"The attack began when a message was sent to the Telegram messenger from the Telegram service channel (this is the official messenger channel with a blue verification tick) with a confirmation code that the user did not request. After that, an SMS with an activation code was sent to the victim’s smartphone, and almost immediately a notification came to the Telegram service channel that the account was logged in from a new device,” reported Group-IB.

It is known that other people's accounts were hacked through the mobile Internet, the IP address of the attackers was most often determined in the city of Samara.

It is assumed that the attackers used disposable SIM cards. They deliberately sent SMS with the code, intercepted it and authorized in Telegram. They could buy access to tools for hacking in the Darknet from 100 thousand rubles ($1,565).

The company drew attention to the fact that in all cases, SMS messages were the only authorization factor on devices affected by hacking attempts. Accordingly, such an attack can only be successful if the “Cloud Password” or “Two-step verification” options are not activated in the Telegram settings on the smartphone.

According to anti-virus expert Viktor Chebyshev, Telegram is consistently included in the list of applications targeted by cybercriminals in various spy campaigns. Such an attack can allow attackers to gain access to the correspondence of specific people.

Alert! TrickBot Trojan and Ryuk Ransomware spreads through Japan, as the holiday season approaches


The most dangerous and active banking trojan family according to IBM X-Force data, TrickBot has been modifying it's malware’s modules lately, as the threat group launches in the wild. As the infection campaign spreads around the globe - Japan has become its new growing target ahead of the holiday season. Just ahead of the holiday's TrickBot campaigns usually target European and western countries and other parts of the world but this is the first time they have focused on Japan.


And also, just in time for the holidays when they'll be shopping extensively. Thus, the Japanese consumers should be wary of these infections as they target banks, online shopping payment cards, telecommerce, a bitcoin exchange, e-wallets, and others. TrickBot has been loaded with hundreds of targeted URLs belonging to banks and other retailers. Emotet botnet is also dropping TrickBot to other devices.

The most common attack includes web injections on bank websites leading to banking frauds. On-the-fly injections, used by TrickBot lures the victim into revealing personally identifiable information (PII), payment card details and PIN codes. This is not the first time Eastern European gangs attacked the country, other trojans like URLZone and Gozi (Ursnif) have been prevalent in Japan for years now. For Japanese Businessmen - Beware! Not only TrickBot but Ryuk Ransomware is also spreading through the region TrickBot, being already a worrisome banking plague is not only limited to that.

The Japanese companies should also be wary of the growing ransomware attacks because the TrickBot can usher in Ryuk Ransomware Attacks along with it. It's a kill chain that starts with Emotet and TrickBot and leads to Ryuk attack, ransomware that locks the system demanding millions of dollars. If such Ryuk or TrickBot attack is suspected, then you should immediately launch response plans and contain the infection or contact security companies without wasting precious time as these infections spread fast and wide.