OSINTer logo Article Overview

CyberScoop

U.K. election admin agency breach exposed personal information of tens of millions voters

The voter registries were accessed over a period of more than a year, the agency said.

OSINTer logo Article Overview

CyberScoop

The 2024 race promises to be 'very, very active' in terms of foreign and domestic meddling, says former CISA chief

Chris Krebs said he expects to see Russia, China and Iran — and even domestic groups — attempt to influence and disrupt the presidential election.

OSINTer logo Article Overview

CyberScoop

Russian hackers attempted to breach petroleum refining company in NATO country, researchers say

The Russian hacking group Trident Ursa is mostly known for phishing campaigns targeting organizations in NATO states.

OSINTer logo Article Overview

CyberScoop

Cyberspace Solarium Commission members push to advance remaining recommendations

Solarium members hopie to advance ideas such as a National Cybersecurity Certification and Labeling Authority and a Bureau of Cyber Statistics.

OSINTer logo Article Overview

CyberScoop

Treasury Department sanctions cryptocurrency 'mixer' Tornado Cash

Treasury accused the mixer of failing to stop laundering from malicious cyber actors including North Korea's Lazarus Group.

OSINTer logo Article Overview

CyberScoop

Implementing effective OT security posture

New guide details key components of operational technology (OT) cybersecurity program.

OSINTer logo Article Overview

CyberScoop

SolarWinds hackers set up phony media outlets to trick targets

New infrastructure, old tricks.

OSINTer logo Article Overview

CyberScoop

Against backdrop of Russian-Ukraine war, researchers witness flurry of nation-aligned hacking - CyberScoop

Hackers believed to be associated with the governments of Russia, Belarus and China are targeting Ukraine, Poland and European governments, researchers say, ranging from espionage attempts to phishing campaigns and coinciding with the intensification of the Russian assault on Ukraine. Shane Huntley, the director of Google’s Threat Analysis Group (TAG), said in a blog post Monday that the group has observed well-known Russian military hacking group Fancy Bear (also known as APT28) conducting several large credential phishing campaigns targeting UkrNet, a Ukrainian media company. Two recent campaigns, he said, involved newly created Blogspot domains as initial landing pages, which then redirected targets to credential phishing pages. TAG also observed a hacking operation known as Ghostwriter, or UNC1151, running credential phishing campaigns over the past week against Polish and Ukrainian government and military organizations. Ghostwriter refers to activity believed to be operating out of Belarus, researchers with cybersecurity firm Mandiant reported […]

OSINTer logo Article Overview

CyberScoop

Ransomware gang Conti has already bounced back from damage caused by chat leaks, experts say - CyberScoop

A Twitter account known as ContiLeaks debuted to much fanfare in late February, with people around the globe watching as tens of thousands of leaked chats between members of the Russia-based ransomware gang Conti hit the web. In the days after the leaks, many celebrated what they thought would be a devastating blow to Conti, which a Ukrainian security researcher had apparently punished by leaking the internal chats because the gang threatened to “strike back” at any entities that organized “any war activities against Russia.” But ten days after the leaks began, Conti appears to be thriving. Experts say the notorious ransomware gang has pivoted all too easily, replacing much of the infrastructure that was exposed in the leaks while moving quickly to hit new targets with ransom demands. According to Vitali Kremez, CEO of the cybersecurity firm AdvIntel, by Monday morning Conti had successfully completed two new data breaches at […]

OSINTer logo Article Overview

CyberScoop

Global news app PressReader says it's back up after cyberattack - CyberScoop

Digital media company PressReader was hit with a cyberattack late last week, the company confirmed Monday on Twitter, but its operations are now fully up and running — though some content published during the delay in operations is still being uploaded. The company said it did not see any evidence that customer data was compromised in the Thursday attack. The attack came just days after the site pulled Russian publications. There is no evidence the two events are related. PressReader is a subscription app that works with hotels, airlines and public institutions like libraries to automatically grant guests access to a library of more than 7,000 publications as soon as they connect to the company’s network. The platform has more than 12 million monthly active users, according to its website. It bills itself as “the world’s largest digital newsstand.” The outage affected at least a half-dozen U.S.-based publications that use […]

OSINTer logo Article Overview

CyberScoop

Ukraine, looking to fortify itself against Russian attacks, admitted to NATO cyber center - CyberScoop

NATO nations voted unanimously on Friday to admit Ukraine to their Cooperative Cyber Defence Centre of Excellence (CCDCOE), a development which experts said will help Ukraine fight off mounting cyberthreats from Russia. The CCDCOE is a NATO-accredited cyber knowledge hub, research institution and training and exercise facility. “They’re one of the leading if not the leading institution for thinking about cyber warfare,” said James Lewis, director of the strategic technologies program at the Center for Strategic and International Studies, a Washington think tank. Lewis said the decision to include Ukraine in the CCDCOE will have an immediate impact on its ability to fend off Russian cyberattacks. The center is based in Tallinn, Estonia and is a legacy of the Estonian government’s experience as the target of devastating cyberattacks in 2007. Russia denied being the culprit in those attacks — which disabled everything from cash machines to media outlets — but […]

OSINTer logo Article Overview

CyberScoop

Treasury Department sanctions alleged Russian cyber-espionage, disinformation sources - CyberScoop

The Biden administration on Thursday sanctioned Russian oligarchs and organizations for their role in spreading disinformation and supporting Russian President Vladimir Putin’s war in Ukraine, among them a news agency the Treasury Department says has ties to a Russian cyber-espionage and offensive unit. The sanctions targeted nine employees of InfoRos, a nominal news agency primarily run by the GRU, which controls the Russian military intelligence service and operates its own special forces units. According to the Treasury Department, the GRU’s 72nd Main Intelligence Information Center, a unit within Russia’s Information Operations Troops, functions as Russia’s “military force for conducting cyber espionage, influence, and offensive cyber operations” and is InfoRos’ operator. In a news release, the Treasury Department said InfoRos is a network of more than 1,000 websites which “spread false conspiracy narratives and disinformation promoted by GRU officials.” For example, in early December, 2021, Treasury officials said one Ukraine-based InfoRos […]

OSINTer logo Article Overview

CyberScoop

Belarusian hackers launch another attack, adding to chaotic hacktivist activity around Ukraine - CyberScoop

A group of Belarusian hackers and IT specialists claimed Sunday that they’d attacked the Belarusian Railways in an attempt to “slow down the transfer of occupying forces and give the Ukrainians more time to repel the attack,” according to a Google translation of the message posted to the group’s Telegram channel. The hackers — who call themselves the Cyber Partisans and have targeted Belarus’ autocratic government and its leader, Alexander Lukashenko, dating back to September 2020 — said Sunday their hack “paralyzed” some railway operations in the Belarusian capital of Minsk and in Orsha, an eastern Belarusian city between Moscow and Misk. Some railway operations were switched to manual mode, the group said, “which will significantly slow down the movement of trains, but will NOT create accidents.” “The internal network will be disconnected until the Russian troops leave the territory of Belarus and the participation of the Belarusian military forces […]

OSINTer logo Article Overview

CyberScoop

TrickBot malware suddenly got quiet, researchers say, but it's hardly the end for its operators - CyberScoop

The operators of TrickBot have essentially shut down the notorious malware, multiple reports say, but evidence suggests the gang has begun using other platforms or folded operations into another cybercrime group altogether. Researchers at Intel471 and AdvIntel noted a sharp dip in recent TrickBot activity in separate reports Thursday, even though the command-and-control infrastructure for the malware remains operational. Intel471 said “it’s likely that the Trickbot operators have phased Trickbot malware out of their operations in favor of other platforms,” probably Emotet — a development researchers have been tracking for months. AdvIntel’s Yelisey Boguslavskiy, meanwhile, said in his report that TrickBot’s operators had been subsumed into Conti, a Russia-linked cybercrime group known for offering “ransomware as a service” packages to its affiliates. Researchers previously had noted TrickBot connections with Conti. “In name, at least, this means that TrickBot’s four-year saga is now coming to a close — the liaison that […]

OSINTer logo Article Overview

CyberScoop

Conti ransomware group announces support of Russia, threatens retaliatory attacks - CyberScoop

An infamous ransomware group with potential ties to Russian intelligence and known for attacking health care providers and hundreds of other targets posted a warning Friday saying it was “officially announcing a full support of Russian government.” The gang said that it would use “all possible resources to strike back at the critical infrastructures” of any entity that organizes a cyberattack “or any war activities against Russia.” The message appeared Friday on the dark-web site used by ransomware group Conti to post threats and its victims’ data. Security researchers believe the gang to be Russia-based. Conti ransomware was part of more than 400 attacks against mostly U.S. targets between spring 2020 and spring 2021, the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) and the FBI reported in September. After the initial post got some attention, the message posted to the site was modified to exclude the threat […]

OSINTer logo Article Overview

CyberScoop

Ukrainian cyber officials warn of new wave of phishing attacks - CyberScoop

Ukrainian officials warned Friday that Belarusian hackers are sending a wave of phishing emails targeting Ukrainian soldiers and civilians. “Mass phishing emails have recently been observed targeting private ‘i.ua’ and ‘meta.ua’ accounts of Ukrainian military personnel and related individuals,” Ukraine’s Computer Emergency Response Team wrote in a Facebook post Friday. Both URLs belong to Ukraine-based email services. Once an account is compromised, hackers gain access to the target’s messages and their contact details, allowing them to send additional phishing emails to their contacts, the CERT said. Ukraine’s State Service of Special Communications and Information Protection issued a separate warning Friday about a phishing attack against civilian emails containing potentially malicious attached files. Warning ⚠️ A phishing #attack has started against Ukrainians! Citizens' e-mail addresses receive letters with attached files of uncertain nature. The mass distribution of such messages to messengers may happen. #cyberattacks #Ukraine pic.twitter.com/YPvFH2oNk0 — SSSCIP Ukraine (@dsszzi) February 25, 2022 The […]

OSINTer logo Article Overview

CyberScoop

In studying tech supply chain, feds cite open source products, device firmware - CyberScoop

Open-source software and device firmware are two of the biggest areas of vulnerability in the supply chains for information and communications technology, according to a federal report Thursday that called for better risk management practices and improved monitoring efforts by government and industry. Another area that potentially affects U.S. cybersecurity is a shrinking manufacturing base for hardware, including a “significant reduction” in the related workforce, the report said. The Biden administration asked the departments of Commerce and Homeland Security for the review under an executive order signed in February 2021 as the White House worked to address challenges in the supply chains for goods and services overall. At the time, the breach of SolarWinds’ software supply chain by Russia-linked hackers had riled Washington, and Thursday’s report comes as the government and cybersecurity industry are still responding to the Log4shell bug found in December 2021 in a widely used piece of […]

OSINTer logo Article Overview

CyberScoop

FBI, CISA, Cyber Command take aim at cyber-espionage by Iran's MuddyWater group - CyberScoop

U.S. and U.K. government agencies called out Iranian government-affiliated hackers Thursday, accusing them of being behind cyber-espionage targeting the defense, local government, oil and natural gas and telecommunications sectors across the globe. The joint alert points a finger at MuddyWater, which the U.S. government for the first time last month attributed directly to Tehran. In the latest warning, the government agencies said that they have observed MuddyWater on the move in Africa, Asia, Europe and North America since 2018. “MuddyWater actors are positioned both to provide stolen data and accesses to the Iranian government and to share these with other malicious cyber actors,” reads the alert. The bulletin is the joint work of the the FBI, Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, the U.S. Cyber Command Cyber National Mission Force and the U.K.’s National Cyber Security Centre. MuddyWater has a long history of allegedly spying on primarily […]

OSINTer logo Article Overview

CyberScoop

Putin's government warns Russian critical infrastructure of potential cyberattacks - CyberScoop

The Russian government warned its domestic critical infrastructure operators Thursday of the “threat of an increase in the intensity of computer attacks,” and said that any failure in the operation of critical infrastructure that doesn’t have a “reliably established” cause should be considered “the result of a computer attack.” The warning, issued through Russia’s National Computer Incident Response & Coordination Center, comes as the Russian military carries out a widespread attack on Ukraine, and after the Ukrainian government accused the Russians of launching a series of distributed denial-of-service attacks and the deployment of wiper malware on Ukrainian government systems ahead of the invasion. “Attacks can be aimed at disrupting the functioning of information resources and services, causing reputational damage, including for political purposes,” the warning read, according to a Google translation. “In addition, in the future, it is possible to carry out harmful influences from the Russian information space to […]

OSINTer logo Article Overview

CyberScoop

DOJ drops Trump-era 'China Initiative' but remains focused on nation-state threats - CyberScoop

The U.S. Department of Justice is closing down its controversial “China Initiative,” instead launching a broader strategy toward countering multiple threats from several countries, a senior department official said Wednesday. The new “Strategy for Countering Nation-State Threats” will focus the department’s resources on multiple concurrent threats from China, Russia, Iran and North Korea, such as transnational repression, foreign malign influence and cyberthreats, said Assistant Attorney General Matthew Olsen in remarks at George Mason University. “We see nations such as China, Russia, Iran and North Korea becoming more aggressive and more capable in their activity than ever before,” Olsen said, adding that the new strategy “is threat driven,” and an attempt to counter malign activity from multiple countries, not just China. The China Initiative — launched during the Trump administration to group espionage, intellectual property theft and cybecrime cases involving Chinese suspects under one effort — was criticized for alleged racial […]

OSINTer logo Article Overview

CyberScoop

Another round of 'wiper' malware appears in Ukrainian networks - CyberScoop

Security researchers detected new destructive malware spreading in Ukraine on Wednesday, following evidence of distributed denial-of-service disruptions for government agencies — both of which overlapped with the beginnings of a Russian invasion. ESET said the data-wiping malware it has dubbed “HermeticWiper” was “installed on hundreds of machines in the country,” and there were signs that the attackers had been preparing for almost two months. Silas Cutler, principle reverse engineer and resident hacker at Stairwell, said that the wiper damages a system’s master boot record, which tells a machine how to start up. That’s similar to malware known as WhisperGate that was used in an attack in January in Ukraine. Broadcom Software’s Symantec, too, observed the wiper in action, and Vikram Thakur, technical director at Symantec Threat Intelligence, confirmed to CyberScoop that it has seen it in Latvia and Lithuania as well. Thakur said Symantec had seen targets among the finance […]

OSINTer logo Article Overview

CyberScoop

Chinese researchers accuse NSA of being behind a powerful exploit - CyberScoop

A Chinese cybersecurity firm released a report Wednesday that revealed a decade-old exploit allegedly created by a covert hacking group associated with the U.S. National Security Agency. The report is the first time that a Chinese cybersecurity firm has both attributed a cyberattack to a U.S. hacking group and included technical indicators of compromise. “It’s a completely different type of report here that that seems to mimic Western name-and-shame,” said Winnona DeSombre, fellow at the Atlantic Council and Harvard’s Belfer Center. Pangu Lab researchers said they first discovered the backdoor in 2013 during an “in-depth forensic investigation of a host in a key domestic department.” The researchers were later able to tie it to the “The Equation Group,” a group of hackers said to be affiliated with the NSA, after NSA documents leaked by a group known as the “The Shadow Brokers” published hacking files that allegedly belonged to the […]

OSINTer logo Article Overview

CyberScoop

Russia-linked Sandworm reportedly has retooled with 'Cyclops Blink' - CyberScoop

A long-running hacking group associated with Russian intelligence has developed a new set of tools to replace malware that was disrupted in 2018, according to an alert Wednesday from the U.S. and U.K. cybersecurity and law enforcement agencies. The advanced persistent threat group, known primarily as Sandworm, is now using a “large-scale modular malware framework” that the agencies call Cyclops Blink. Western governments have blamed Sandworm for major incidents such as the disruption of Ukraine’s electricity grid in 2015, the the NotPetya attacks in 2017 and breaches of the Winter Olympics in 2018. Cyclops Blink has largely replaced the VPNFilter malware in Sandworm’s activities since at least June 2019, said the joint alert from the U.K.’s National Cyber Security Centre (NCSC), and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, National Security Agency and FBI in the U.S. The NCSC also issued a separate analysis paper on Cyclops Blink. […]