1010.TEAM 🇺🇦

CYBERSECURITY / DEFENSE / INTELLIGENCE

  • INC Ransom Group Exfiltrates Data Before Encrypting & Threatens Public Exposure

    ·

    Hackers exfiltrate data first before encrypting it to increase their bargaining power during ransom negotiations. 

    Threats of public exposure of private information accelerate up the urgency for victims to pay a ransom immediately.

    Secureworks Counter Threat Unit researchers are tracking the INC Ransom group known as GOLD IONIC. 

    INC Ransom Group Exfiltrate Data

    Emerging in August 2023, this threat group employs double extortion tactics – exfiltrating data before encryption, then threatening public exposure to pressure victims into paying ransoms.

    Between August 2023 and March 2024, the Tor leak site of GOLD IONIC published the names of 72 victims, adding 7 in April 2024. It has spread globally despite focusing on American victims from the industrial, healthcare, and education sectors.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    SecureWorks said that GOLD IONIC seems to be a solo group that encrypts files for ransom rather than having affiliates.

    There appears to be a consistent pattern in monthly numbers, with possible exceptions posted as batched releases.

    Number of victims posted to GOLD IONIC’s leak site from August 2023 through March 2024 (Source – Secureworks)

    Like many financially motivated groups, GOLD IONIC conducts indiscriminate, opportunistic attacks across geographies and sectors.

    However, most victims are U.S.-based organizations, with a significant gap to the second-most impacted country, the UK. 

    Geographic locations of victims posted to GOLD IONIC’s leak site (Source – Secureworks)

    The prevalence of Western victims and lack of those from Commonwealth of Independent States countries suggests the group likely operates out of Russia or a CIS nation. 

    No sector stands out, though industrial, healthcare, and education organizations are the most common targets, with educational establishments over-represented compared to other ransomware groups from August 2023 to March 2024.

    Breakdown of sectors for victims posted to the GOLD IONIC leak site (Source – Secureworks)

    In Secureworks’ incident response engagements, GOLD IONIC consistently deploys INC ransomware. One case potentially involved initial access via the “Citrix Bleed” vulnerability (CVE-2023-4966), an initial vector favored by LockBit affiliates. 

    Post-intrusion, the attacker dropped a Meterpreter shell, enumerated Active Directory, archived and exfiltrated over 70GB of data using WinRAR and Megasync, then copied the victim-named INC ransomware binary to over 500 systems and executed it remotely via PsExec to encrypt files. 

    The INC ransom note instructs contacting the threat actor within 72 hours via a “.onion” address to avoid data leaks.

    While the leak site resembles LockBit’s, there are no other known connections between the groups.

    Comparison of the LockBit (top) and INC Ransom (bottom) leak sites (Source – Secureworks)

    The INC Ransom leak site lists some victims of other ransomware groups. One case involved files and a ransom note format matching ALPHV ransomware by GOLD BLAZER.

    Donut Leaks warning about affiliates posting stolen data to other leak sites (Source – Secureworks)

    Financially motivated affiliates may act in self-interest, even stealing data to post elsewhere with modified ransom contacts. 

    Some affiliates have deployed up to seven ransomware families. While the dynamic affiliate-operator relationship could explain cross-posting on leak sites.

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

    The post INC Ransom Group Exfiltrates Data Before Encrypting & Threatens Public Exposure appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Iran Launched A Major Cyberattack Against Critical Infrastructure In Israel

    ·

    Over the weekend, Iran launched missile and drone attacks on Israel, retaliating for a suspected Israeli strike on its Damascus consulate that killed 13 people last week.

    This escalation arises from the ongoing Israel-Iran rivalry and Israel-Palestine conflict. 

    Cyber activities predated the attacks by nearly a year, starting in late March when hacktivist groups announced digital offensives against both sides following Hamas’ large-scale offensive from Gaza towards Israel in October 2023 amid intensified Israeli-Palestinian tensions. 

    The tit-for-tat violence between Israel and Iranian proxies like Hamas shows no signs of decreasing.

    SOCRadar observed cyber activities preceding and paralleling the physical Israel-Hamas conflict that began last year. 

    Once again this week, cyber offensives foreshadowed the missile and drone attacks exchanged between Israel and Iran, demonstrating how cyber warfare often preludes and accompanies kinetic military operations.

    Iran’s Attack On Israel

    The cyber defense chief Gaby Portnoy of Israel indicated that the cyberattacks targeting Israel tripled since the conflict with Hamas began on October 7, driven by increased involvement from Iran, Hezbollah, and allied hackers.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    While attack volumes were highest in the conflict’s initial months before tapering, certain days and events saw major spikes in activity. 

    Recent weeks have witnessed an uptick in hacktivism by groups like OpIsrael and FreePalestine, reflecting the ebbs and flows of cyber offensives paralleling kinetic clashes.

    Self-claiming Hezbollah-affiliated hacker groups on Telegram carry out various cyber attacks (Source – SOCRadar)

    A threat on Telegram urged hackers to target Israel during Jewish holidays, citing symbolism in Israeli actions.

    Various groups seized on holidays and conflict dates as opportunities for coordinated cyber attacks, SOCRadar said.

    While many hacktivists merely signal impending events, wittingly or not, some groups like IRGC-linked, Hezbollah-backed, Iranian APTs, and Houthi hackers had more substantive cyber impacts during the Israel-Hamas conflict. 

    The allegedly state-sponsored Cyber Toufan/Cyber Toufan Al-Aqsa conducted major operations and coordinated other groups to hit similar targets simultaneously. 

    After a long break, their activity resurged in early April, potentially foreshadowing the latest Israel-Iran cyber/kinetic escalation.

    Wake up call of Cyber Toufan Al-Aqsa (Source – SOCRadar)

    During the Israel-Hamas conflict, a group called Cyber Toufan Al-Aqsa, allegedly sponsored by the state carried out major operations in which it mobilized other groups to hit the same targets simultaneously.

    In the start of April this year, they came back after going silent for some time.

    In late March, however, IRGC-linked Cyber attackers, popular for attacking OT systems and exposed before they were sanctioned again, reappeared, telling people about an upcoming “big” thing.

    They consequently took credit for a huge cyber-attack as payback for Iran’s strikes on Israel.

    Handala’s alleged hack of Israeli radar systems (Source – SOCRadar)

    Cyber Av3ngers claimed responsibility for cutting electricity across “occupied territories” from south to north in retaliation for Israeli actions in Gaza. 

    However, besides this, the widening scope to strike overflow targets like Saudi Arabia demonstrates how easily hacktivism can expand cyber confrontations.

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

    The post Iran Launched A Major Cyberattack Against Critical Infrastructure In Israel appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / / / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Android Malware Mimic Google Chrome to Steal Banking Details

    ·

    Security researchers have uncovered a new strain of Android malware that masquerades as the popular Google Chrome browser to steal sensitive banking information from unsuspecting users.

    The malware, dubbed “Mamont Spy Banker,” has been found to target Android devices highly sophisticatedly.

    Mimicking Google Chrome

    The malware’s primary tactic is impersonating the Google Chrome app, tricking users into believing they are interacting with a legitimate and trusted application.

    This deception is achieved through a nearly identical user interface and branding, making it challenging for even intelligent users to distinguish the malicious app from the real Chrome browser.

    According to a recent blog post by GData, a new strain of Android malware has been discovered that impersonates Google Chrome to steal banking credentials.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    Stealing Banking Details

    Once installed, the Mamont Spy Banker malware is designed to intercept and steal sensitive banking information, including login credentials, account numbers, and other financial data.

    This information is then siphoned off to the malware’s command-and-control servers, putting victims at risk of financial fraud and identity theft.

    The user will see a text that supposedly informs them that they won a cash prize; they are expected to enter their phone number and credit card number.
    The user will see a text supposedly informing them that they won a cash prize; they are expected to enter their phone and credit card numbers.

    The researchers at G DATA have noted that the Mamont Spy Banker malware employs sophisticated evasion tactics to avoid detection by traditional security measures.

    These include using advanced obfuscation techniques, dynamic code loading, and adapting its behavior based on the device’s environment.

    To safeguard against this threat, security experts recommend that Android users exercise caution when downloading and installing apps, even from trusted sources.

    Users should also be wary of any apps that closely resemble well-known applications and always verify an app’s legitimacy before granting it access to sensitive information.

    Additionally, keeping Android devices up-to-date with the latest security patches and using a reputable antivirus solution can help mitigate the risk of falling victim to this and other emerging Android malware threats.

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP

    The post New Android Malware Mimic Google Chrome to Steal Banking Details appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data

    ·

    Hackers target Apple device users because they are perceived to be of higher social classes. This leads to targets who are richer than others and who can possibly provide more money to the hackers in one way or another.

    Besides this, Apple’s ecosystem is interconnected, which means it has various points from which hackers can enter, leading to the compromise of accounts and devices.

    BlackBerry cybersecurity researchers recently discovered that LightSpy hackers are actively targeting Indian Apple device users to steal sensitive data.

    LightSpy Hackers & Their Targets

    LightSpy is a modular spying toolkit that can steal victims’ personal information, such as actual GPS coordinates or VOIP calls.

    This new threat is dangerous because it allows hackers to follow targets with an exceptional degree of accuracy, expanding the potential impacts of this expansive surveillance on high-profile victims in politically sensitive regions.

    LightSpy has an extensive spying capacity and can be used to monitor device data, QQ messenger content, WeChat messages, Telegram chats, and WeChat Pay history.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    This highly effective software program returned during escalated regional hostilities after its 2020 operations had focused on Hong Kong-oriented news websites for distribution. 

    The threat group, based in servers located in Russia, China, and Singapore, is very interested in monitoring victims involved in clashes of interests across South Asia.

    This again highlights how even the slightest flare-ups pose a constant danger to the people involved there.

    The motives behind this campaign and the geopolitical implications for Southern Asia that it has raised become sources of worry because of suspected links with China.

    Hyper-targeted attacks like these may impact only a tiny fraction of individuals, such as journalists, activists, or politicians, but at the same time can be seen as a worldwide threat.

    Tech companies have recently pointed out the danger of state-sponsored election tampering. According to Apple, powerful mercenary spyware is one of the most complex digital threats in existence.

    When the vulnerability is detected on news websites specifically reporting Hong Kong issues, the infection usually starts. 

    Loader’s signature (Source – BlackBerry)

    The attack advances with an initial implant, which collects device data and downloads successive stages.

    These include LightSpy, which is the core implant, and special spying plugins.

    The Loader starts by loading both the LightSpy kernel in encrypted form and decrypted form, BlackBerry said.

    The recent campaign uses “F_Warehouse” framework that has various functionalities including file exfiltration, network reconnaissance, and audio recording. 

    Besides this, executing shell commands can give full control to an attacker.

    While the LightSpy maintains communication with its server as well as with an administrative panel that helps enhance its probable origin.

    Recommendations

    Here below we have mentioned all the recommendations:-

    • Exercise heightened vigilance
    • Use of Lockdown mode
    • Use highly secure voice and messaging solutions
    • Review the latest threat intelligence
    • Create an incident response plan
    • Update your devices
    • Use a passcode
    • Enable 2FA
    • Beware of unofficial software
    • Password hygiene
    • Think before you click
    • Restart your phone often

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

    The post LightSpy Hackers Target Indian Apple Device Users To Steal Sensitive Data appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Mideast missile duels have cost US Navy nearly $1B, secretary says

    ·

    Carlos Del Toro is asking lawmakers to make it up in a supplemental.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Army recruiting on pace to hit goal—and break a years-long streak

    ·

    Service secretary says new initiatives have put the 55,000-recruit goal within reach.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • DoD doubles investment in cutting-edge geothermal energy

    ·

    DIU projects promise to ease logistics for Pacific bases and other farflung places.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients

    ·

    In today’s digital landscape, email security has become a critical concern for businesses of all sizes. As cyber threats continue to evolve, it’s essential for Managed Service Providers (MSPs) to equip their clients with the necessary tools and knowledge to safeguard their email communications. That’s where TrustiFi’s Email Security Awareness Training comes into play.

    Email has long been a prime target for cybercriminals, with phishing, malware, and other email-based attacks posing a significant risk to organizations.

    Employees, often the first line of defense, can inadvertently expose their companies to these threats through simple mistakes or lack of awareness.

    Empowering MSPs to Train and Protect

    TrustiFi’s innovative solution empowers MSPs to provide their clients with comprehensive email security training and protection.

    The module offers a user-friendly platform that allows MSPs to easily deploy and manage email security awareness programs, ensuring their clients’ employees have the knowledge and skills to identify and mitigate email-based threats.

    *Gartner, “Market Guide for Email Security“, 13 February 2023, Ravisha Chugh, Peter Firstbrook, Franz Hinner. Use of Gartner, Inc. and/or its affiliates’ U.S. and international trademark and service mark is with permission. We reserve all rights. Gartner does not recommend technology users choose vendors with the highest ratings or other designations. Gartner research articles are views, not facts. Gartner disclaims all guarantees, including merchantability and fitness for a particular purpose, for this research.

    Key Features of the Trustifi Email Security Awareness Training

    1. Interactive Training: The module features engaging, interactive training modules that cover a wide range of email security topics, from recognizing phishing attempts to implementing best practices for email hygiene.
    2. Simulated Phishing Attacks: MSPs can simulate phishing attacks to test their clients’ employees’ responsiveness and identify areas for improvement, helping to strengthen their overall email security posture.
    3. Reporting and Analytics: The module provides detailed reporting and analytics, allowing MSPs to track their clients’ progress, identify areas of concern, and measure the effectiveness of their email security awareness efforts.
    4. Customization: The Email Security Awareness training can be tailored to meet the specific needs and branding requirements of each MSP and their clients, ensuring a seamless integration into their existing security solutions.

    The Benefits of Email Security Awareness Training

    Email security awareness training from Trustifi equips individuals with the knowledge and skills to identify and mitigate these threats.

    By educating employees on best practices for email usage, organizations can significantly reduce the risk of successful cyber attacks. Some of the key benefits of such training include:

    1. Improved Threat Detection: Trained employees are better equipped to recognize the signs of phishing attempts, malicious attachments, and other email-based threats, allowing them to take appropriate action to protect themselves and the organization.
    2. Reduced Vulnerability: By instilling a culture of email security awareness, organizations can minimize the likelihood of successful cyber attacks, which can have far-reaching consequences.
    3. Enhanced Compliance: Many industries have strict regulations regarding the handling of sensitive information. Email security awareness training can help organizations maintain compliance with these standards, reducing the risk of costly fines and legal penalties.
    4. Increased Productivity: When employees feel confident in their ability to navigate email securely, they can focus on their core responsibilities without the constant worry of potential cyber threats.

    Empowering MSPs, Protecting Clients

    By leveraging Trustifi’s Email Security Awareness Module, MSPs can empower their clients to take a proactive approach to email security.

    By educating employees and testing their responsiveness, MSPs can help their clients reduce the risk of successful email-based attacks, ultimately safeguarding their businesses and protecting their valuable data.

    Don’t let your clients fall victim to email-based threats. Explore how TrustiFi’s Email Security Awareness Module can help you strengthen your clients’ email security and position your MSP as a trusted partner in the fight against cyber threats.

    Implementing Effective Email Security Awareness Training

    Effective email security awareness training should be tailored to the specific needs and challenges of the organization. This may include:

    • Comprehensive Curriculum: The training should cover a wide range of topics, such as password management, identifying phishing attempts, and responding to suspicious emails.
    • Engaging Delivery: The training should be presented interactively and engagingly, using a variety of methods such as videos, simulations, and real-world case studies.
    • Ongoing Reinforcement: Email security awareness should be an ongoing process, with regular refresher training and updates to keep employees informed of the latest threats and best practices.
    • Measurable Outcomes: Organizations should track the effectiveness of their training program, using metrics such as the reduction in successful phishing attempts and the increase in employee reporting of suspicious emails.

    By investing in email security awareness training, employees are empowered to defend themselves against cyber attacks, improving business security and resilience. Request a free demo here.

    The post Trustifi’s Email Security Awareness Training – Empowering MSPs to Train & Protect Clients appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group

    ·

    In a digital age where information is the new currency, the recent global hack has once again highlighted the urgent need for enhanced cybersecurity measures.

    The breach was identified as Midnight Blizzard, from the Russian state-sponsored actor known as NOBELIUM. It has affected Millions of individuals and government agencies worldwide, underscoring the far-reaching consequences of cyberattacks and the critical importance of protecting sensitive information.

    The Scope of the Breach

    The scale of the global hack is staggering. Hackers gained unauthorized access to databases containing a wealth of personal data, including financial records, social security numbers, email addresses, and passwords.

    The exposed information poses a significant risk of identity theft, financial fraud, and other forms of cybercrime.

    The breach has impacted individuals across various sectors, including government agencies, businesses, and private citizens, highlighting the pervasive nature of cyber threats.

    Implications for Individuals

    The fallout from a hack can be devastating for individuals whose data has been compromised.

    Identity theft, in particular, poses a significant threat. Hackers use stolen information to open fraudulent accounts, make unauthorized purchases, or even commit acts of impersonation.

    Moreover, the exposure of sensitive personal information can erode trust and privacy, leaving individuals vulnerable to exploitation and manipulation.

    Response and Accountability

    After the breach, affected organizations must take swift and decisive action to mitigate the damage and restore trust.

    This includes implementing robust cybersecurity measures, notifying affected individuals, and cooperating with law enforcement agencies to identify and apprehend the perpetrators.

    Additionally, those responsible for the breach must be held accountable, whether they are individuals, criminal organizations, or state-sponsored actors. Holding perpetrators accountable prevents future attacks and conveys that protecting personal data is paramount.

    Safeguarding Privacy in an Era of Cyber Threats

    While the global hack serves as a sobering reminder of the dangers posed by cyberattacks, it also underscores the importance of proactive cybersecurity practices.

    Individuals and organizations alike must remain vigilant in safeguarding sensitive information and adopting best practices for data protection.

    This includes using strong, unique passwords, encrypting sensitive data, regularly updating security software, hiring the right cybersecurity company for monitoring, and being cautious when sharing personal information online.

    Moreover, governments and regulatory bodies must enact robust data protection laws and regulations to hold organizations accountable for safeguarding personal data and provide recourse for individuals affected by breaches.

    Hack Aftermath

    The recent global hack exposed personal data, serving as a wake-up call for individuals, businesses, and governments alike. Cybersecurity must be a top priority in an interconnected world where data is increasingly valuable and vulnerable.

    That is why Axios Security Group believes that by implementing robust security measures, fostering a culture of accountability, and advocating for more robust data protection laws, can be implemented together to mitigate the risks of cyber threats and safeguard the privacy and security of personal information.

    Only through collective action can we effectively confront cybercrime and ensure a safer, more secure digital future.

    About Axios Security Group

    Axios Security Group is a trusted leader in comprehensive security solutions, offering organizations physical and digital protection.

    With a dedicated team of experts, Axios created tailored security strategies to safeguard assets, personnel, and data.

    Its physical security services range from on-site personal security to cutting-edge surveillance technologies, while our cybersecurity experts provide robust digital defenses, including threat detection and incident response.

    Axios collaborates closely with each client to ensure our solutions align with their unique needs, industry regulations, and budgetary constraints.

    Axios Security Group provides a vCSO (Virtual Security Officer) program in addition to physical and cyber security.

    A vCSO (Virtual Chief Security Officer) is a C-suite-level security expert who enhances your company’s security. They bring strategic vision, devising comprehensive security plans encompassing digital information and physical asset protection.

    By collaborating closely with your leadership team, a vCSO tailors security solutions to your unique needs, aligning them with your organizational goals and industry regulations.

    This approach ensures that your organization is well-prepared to navigate the ever-evolving landscape of security challenges, creating a robust, adaptable, and resilient security infrastructure.

    A vCSO provides all the same security expertise and protections for your organization at a 1/3 of the cost of a full-time CSO (Chief Security Officer.)

    Contact us to learn how Axios Security Group can protect one of your most considerable corporate assets.

    Contact
    Contributor
    Robin Carter
    News Break
    clientservices@axiossecuritygroup.com
    8004853983

    The post Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • In a budgetary first, Air Force will launch two programs without asking Congress in advance

    ·

    The service is using a power granted by lawmakers in the 2024 NDAA.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶