1010.TEAM 🇺🇦

CYBERSECURITY / DEFENSE / INTELLIGENCE

  • REvil Ransomware Affiliate Sentenced for 13 Years in Prison

    ·

    A Ukrainian national, Yaroslav Vasinskyi, has been sentenced to 13 years and seven months in prison.

    Vasinskyi, known in the cyber underworld as Rabotnik, was also ordered to pay over $16 million in restitution for his role in orchestrating more than 2,500 ransomware attacks worldwide, demanding over $700 million in ransom payments.

    A Global Threat Neutralized

    Yaroslav Vasinskyi’s criminal activities spanned across the globe, targeting thousands of computers with the notorious Sodinokibi/REvil ransomware variant.

    This malicious software encrypted data on victim computers, enabling Vasinskyi and his co-conspirators to demand ransom payments in cryptocurrency.

    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    In a bid to force victims into paying, they threatened to disclose sensitive data publicly.

    The Justice Department’s swift action underscores a significant victory against international cybercrime, demonstrating the effectiveness of global cooperation in the digital age.

    Attorney General Merrick B. Garland emphasized the department’s commitment to using all available tools to identify, prosecute, and dismantle the networks of cybercriminals.

    “As this sentencing shows, the Justice Department is working with our international partners and using all tools at our disposal to identify cybercriminals, capture their illicit profits, and hold them accountable for their crimes,” Garland stated.

    International Collaboration and Justice

    The case against Vasinskyi showcases the extensive international collaboration between the U.S. Justice Department, the FBI, and foreign law enforcement agencies.

    Vasinskyi’s extradition from Poland to the United States marked a pivotal moment in the case, facilitated by the Justice Department’s Office of International Affairs and Polish authorities.FBI Director Christopher Wray highlighted the relentless pursuit of cybercriminals, regardless of their location.

    On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.

    “Today, the FBI’s close collaboration with our worldwide partners has again ensured that a cybercriminal who thought he was beyond our reach faces the consequences of his actions,” Wray remarked.

    This case is a stern warning to cybercriminals targeting U.S. victims that law enforcement agencies are equipped and determined to bring them to justice.

    In addition to the prison sentence and restitution, the Department of Justice has successfully obtained the final forfeiture of millions of dollars worth of ransom payments, including 39.89138522 Bitcoin and $6.1 million in U.S. dollar funds.

    These funds were traceable to ransom payments received by members of the conspiracy, further crippling the financial infrastructure supporting international cybercrime.

    The sentencing of Yaroslav Vasinskyi is a testament to the global commitment to combating cyber threats and protecting citizens and businesses from the devastating impacts of ransomware attacks.

    It sends a clear message to cybercriminals everywhere: the international law enforcement community stands united and resolute in its mission to dismantle criminal enterprises and ensure justice is served.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    The post REvil Ransomware Affiliate Sentenced for 13 Years in Prison appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • USB Malware Attacks Targeting Industrial Systems Adapts LOL Tactics

    ·

    Honeywell’s 2024 GARD USB Threat Report analyzes malware discovered on USB devices used in industrial settings, highlighting a significant increase in malware prevalence, with a 33% rise in detections compared to the prior year. 

    The malware poses a serious threat to operational technology (OT) systems, with 26% capable of causing major disruptions like loss of control or data visibility, and also identifies a growing trend of targeted attacks specifically designed to exploit industrial control systems (ICS) and Internet of Things (IoT) devices. 

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    The findings underscore the critical need for robust USB security measures to protect critical infrastructure from cyberattacks, while an industrial cybersecurity report analyzing data from various OT facilities worldwide reveals a concerning rise in USB-based threats. 

    Attackers are exploiting USB devices to circumvent network defenses, infiltrate systems undetected, steal sensitive information, maintain long-term access, and ultimately disrupt or sabotage industrial operations, which underscores the critical need for robust USB security measures within OT environments. 

    It analyzes a six-year trend of increasing sophistication in USB-borne malware targeting industrial control systems by identifying a rise in the prevalence and impact of these attacks, including malware designed to exploit process control vulnerabilities. 

    The most common malware types used in USB attacks, along with their technical tactics for infecting systems, executing malicious code, and spreading across networks via removable media, have been reported. 

    Adversaries are increasingly turning to “living off the land” (LOL) tactics in cyber-physical attacks, which involve exploiting legitimate tools and functionalities within a system to achieve malicious goals, posing a significant challenge as they bypass traditional security measures. 

    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    For USB-borne threats, operators should prioritize implementing application whitelisting to restrict unauthorized software execution, and security incident and event management (SIEM) systems can aid in anomaly detection that might indicate LOL techniques. 

    Operators can improve their cyber-physical security posture against these ever-evolving threats by combining preventative measures with robust monitoring. 

    The report by Honeywell highlights a significant rise in USB-borne cyberattacks, emphasizing the increased susceptibility of systems due to this prevalent attack vector, as the surge in USB drive usage coupled with a disregard for security measures creates a prime target for malware distribution.  

    The attacks are not limited to traditional storage drives but can also be delivered through seemingly innocuous devices like phone chargers, which underlines the alarming trend of attackers leveraging USBs to bypass security perimeters and establish persistence within a network. 

    Combat Sophisticated Email Threats With AI-Powered Email Security Tool -> Try Free Demo 

    The post USB Malware Attacks Targeting Industrial Systems Adapts LOL Tactics appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

    ·

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw impacting GitLab to its Known Exploited Vulnerabilities (KEV) catalog, owing to active exploitation in the wild. Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

    ·

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical flaw impacting GitLab to its Known Exploited Vulnerabilities (KEV) catalog, owing to active exploitation in the wild. Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Attention all Windows Users! The Microsoft April Security Update Could Break Your VPN

    ·

    In a recent development that has caught the attention of IT administrators and users alike, Microsoft has acknowledged a significant issue affecting VPN connections on Windows devices.

    This problem has emerged following the installation of the April 2024 security update, impacting a broad range of Windows operating systems across both client and server platforms.

    The root cause appears to be related to the updates, which inadvertently introduced a bug that disrupts the ability to successfully establish or maintain VPN connections.

    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    Microsoft has marked this issue as critical due to its widespread impact on enterprises and individual users who rely on VPNs for secure remote access.

    Affected Windows Versions

    The issue has been identified in several versions of the Windows operating system, including:

    • Windows 11, versions 23H2, 22H2, and 21H2
    • Windows 10, version 22H2
    • Windows Server 2022

    Windows Servers, Including:

    • Windows Server 2022
    • Windows Server 2019
    • Windows Server 2016
    • Windows Server 2012 R2
    • Windows Server 2012
    • Windows Server 2008 R2
    • Windows Server 2008

    Users of these versions may experience failures or disruptions in their VPN connections, a critical tool for secure and remote access to networks.

    On-Demand Webinar to Secure the Top 3 SME Attack Vectors: Watch for Free.

    Microsoft’s Response and Workarounds

    Microsoft is actively working on a resolution to address the VPN connectivity issues. In the interim, IT administrators are directed to a specific workaround documented in the Windows release health section within the Microsoft 365 admin centre.

    This temporary solution aims to mitigate the impact on affected clients and servers while a permanent fix is in development.

    Since no workaround is available until the next update, you can downgrade the update. If you want to remove the LCU, follow the steps below.

    To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.

    Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.

    Additionally, Microsoft encourages those needing immediate assistance to reach out through business support, ensuring that affected organizations can maintain their operations with minimal disruption.

    As the tech giant scrambles to resolve this unexpected complication, the tech community and businesses reliant on VPN connections for their daily operations are keenly awaiting a permanent fix.

    Microsoft has committed to providing updates as they work towards a resolution, ensuring transparency and support for their user base during this challenging time.

    “We are working on a resolution and will provide an update in an upcoming release,” Microsoft said.

    This incident highlights the intricate balance between enhancing security through updates and maintaining the stability of essential services like VPN connections.

    Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide

    The post Attention all Windows Users! The Microsoft April Security Update Could Break Your VPN appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • New Cuttlefish Malware Hijacks Router Connections, Sniffs for Cloud Credentials

    ·

    A new malware called Cuttlefish is targeting small office and home office (SOHO) routers with the goal of stealthily monitoring all traffic through the devices and gather authentication data from HTTP GET and POST requests. “This malware is modular, designed primarily to steal authentication material found in web requests that transit the router from the adjacent

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Panda Restaurant Corporate Systems Hacked: Customer Data Exposed

    ·

    Panda Restaurant Group, Inc., a leading name in the fast-food industry, has confirmed a significant breach in its corporate data systems.

    The incident, which came to light on March 10, 2024, has potentially compromised the personal information of an undisclosed number of customers, sparking concerns over privacy and data security.

    The Breach Unveiled

    Panda Restaurant Group, headquartered in Rosemead, California, detected the data security incident in March, affecting certain corporate systems.

    However, the company has assured that in-store systems, operations, or guest experiences were not impacted by this breach.

    In a detailed notice sent to affected individuals, Panda expressed its commitment to protecting personal information and outlined the steps taken in response to the incident.

    Document

    Integrate ANY.RUN in Your Company for Effective Malware Analysis

    Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

    • Real-time Detection
    • Interactive Malware Analysis
    • Easy to Learn by New Security Team members
    • Get detailed reports with maximum data
    • Set Up Virtual Machine in Linux & all Windows OS Versions
    • Interact with Malware Safely

    If you want to test all these features now with completely free access to the sandbox:

    The breach did not go unnoticed, as immediate action was taken to secure the compromised systems, with the assistance of cybersecurity experts and law enforcement agencies who are currently investigating the matter.

    The exact nature of the personal information involved has not been fully disclosed, but the breach’s potential to misuse customer data has raised alarms.

    In response, Panda Restaurant Group is offering affected customers a complimentary 12 or 24-month membership to CyEx’s Identity Defense Total.

    This service includes credit monitoring, identity protection support, and assistance with identity theft resolution, aiming to mitigate the risks associated with the data breach.

    Customers are urged to enroll in the identity protection service and take additional steps to secure their personal information, such as placing fraud alerts and security freezes on their credit reports.

    The notification reads that Panda Restaurant Group has taken significant measures to address the breach and prevent future incidents.

    These include implementing additional technical safeguards and enhancing security protocols to protect the information in their possession.

    “We are deeply sorry for any inconvenience this incident may cause,” said a spokesperson for Panda Restaurant Group. “The security of our customers’ information is a top priority, and we are committed to maintaining the trust of those who dine with us.”

    As the investigation continues, Panda Restaurant Group is focused on cooperating with law enforcement and reinforcing its data security measures to safeguard against future threats.

    Combat Email Threats with Easy-to-Launch Phishing Simulations: Email Security Awareness Training -> Try Free Demo 

    The post Panda Restaurant Corporate Systems Hacked: Customer Data Exposed appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ¶¶¶¶¶

    / /

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Australia aims to double its naval fleet. Can its plan work?

    ·

    Questions remain about financial commitment, manpower, schedule, and ability to avoid acquisition missteps.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Russian space nuke could render low-Earth orbit unusable for a year, US official says

    ·

    Pentagon’s space-policy leader noted with concern Moscow’s recent veto of a UN resolution against putting nuclear weapons in space.

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • Giant military manta ray drone passes first ocean test

    ·

    Manta Ray prototype demonstrates propulsion, steering in step toward “real-world operations.”

    Go to source

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶