Ne'er-Do-Well News Archives - s0x • Austin Managed IT Services

15 Mar, 2022

Lawmakers Probe Early Release of Top RU Cybercrook

Cybersecurity Aleksei Burkov, DirectConnection, Jake Sullivan, K0pa, Mazafaka, Naama Issachar, Ne'er-Do-Well News, Vladimir Putin

Aleksei Burkov, a cybercriminal who long operated two of Russia’s most exclusive underground hacking forums, was arrested in 2015 by Israeli authorities. The Russian government fought Burkov’s extradition to the U.S. for four years — even arresting and jailing an Israeli woman to force a prisoner swap. That effort failed: Burkov was sent to America, pleaded guilty, and was sentenced to nine years in prison. But a little more than a year later, he was quietly released and deported back to Russia. Now some Republican lawmakers are asking why a Russian hacker once described as “an asset of supreme importance” was allowed to shorten his stay. …

8 Mar, 2022

Conti Ransomware Group Diaries, Part IV: Cryptocrime

Cybersecurity Athens University School of Information Sciences and Technolog, Begemot, Bloodrush, Chainalysis, Conti ransomware, DDoS, Demon, Ghost, Gizmodo, Jeffrey Ladish, Mango, Matt Novak, Ne'er-Do-Well News, pump-and-dump, Ransomware, Russia's War on Ukraine, SQUID, Stern, Van

Three stories here last week pored over several years’ worth of internal chat records stolen from the Conti ransomware group, the most profitable ransomware gang in operation today. The candid messages revealed how Conti evaded law enforcement and intelligence agencies, what it was like on a typical day at the Conti office, and how Conti secured the digital weaponry used in their attacks. This final post on the Conti conversations explores different schemes that Conti pursued to invest in and steal cryptocurrencies. …

4 Mar, 2022

Conti Ransomware Group Diaries, Part III: Weaponry

Cybersecurity A Little Sunshine, alarm, Bentley, Bio, Bloodrush, Chainalysis, Cobalt Strike, Conti, Grant, Kaktus, LeMans Corporation, Ne'er-Do-Well News, PIN, Ransomware, Reshaev, Revers, Salamandra, Skippy, The Spaniard, Tramp, Trickbotleaks, trump

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what it’s like to be an employee of Conti’s sprawling organization. Today’s Part III looks at how Conti abused a panoply of popular commercial security services to undermine the security of their targets, as well as how the team’s leaders strategized for the upper hand in ransom negotiations with victims. …

2 Mar, 2022

Conti Ransomware Group Diaries, Part II: The Office

Cybersecurity A Little Sunshine, Bentley, Bleeping Computer, Conti, Emotet, Hof, Lawrence Abrams, Mango, Ne'er-Do-Well News, Palo Alto Networks, Ransomware, Reverse, Ryuk, Stern, The Coming Storm, trickbot

Earlier this week, a Ukrainian security researcher leaked almost two years’ worth of internal chat logs from Conti, one of the more rapacious and ruthless ransomware gangs in operation today. Tuesday’s story examined how Conti dealt with its own internal breaches and attacks from private security firms and governments. In Part II of this series we’ll explore what it’s like to work for Conti, as described by the Conti employees themselves. …

1 Mar, 2022

Conti Ransomware Group Diaries, Part I: Evasion

Cybersecurity alex holden, Alla Witte, Conti, Conti breach, Conti ransomware, Contileaks, Emercoin, EmerDNS, Hof, Hold Security, Ne'er-Do-Well News, Ransomware, REvil ransomware, Stern, The Coming Storm, trickbot, Ukraine

A Ukrainian security researcher this week leaked several years of internal chat logs and other sensitive data tied to Conti, an aggressive and ruthless Russian cybercrime group that focuses on deploying its ransomware to companies with more than $100 million in annual revenue. The chat logs offer a fascinating glimpse into the challenges of running a sprawling criminal enterprise with more than 100 salaried employees. The records also provide insight into how Conti has dealt with its own internal breaches and attacks from private security firms and foreign governments. …

16 Feb, 2022

Red Cross Hack Linked to Iranian Influence Operation?

Cybersecurity Data Breaches, fbi, FireEye, ICRC hack, International Committee for the Red Cross, KELA, kelvinmiddelkoop@hotmail.com, Ne'er-Do-Well News, RaidForums, Ransomware, Red Cross and Red Crescent Movement, Restoring Family Links, Sheriff, threat_actor, unindicted

A network intrusion at the International Committee for the Red Cross (ICRC) in January led to the theft of personal information on more than 500,000 people receiving assistance from the group. KrebsOnSecurity has learned that the email address used by a cybercriminal actor who offered to sell the stolen ICRC data also was used to register multiple domain names the FBI says are tied to a sprawling media influence operation originating from Iran. …

14 Feb, 2022

Wazawaka Goes Waka Waka

Cybersecurity A Little Sunshine, Babuk, Babuk ransomware, Biba99, Boriselcin, Cisco Talos, CVE-2021-20028, Dmitry Smilyanets, Groove ransom, Mikhail Pavlovich Matveev, Ne'er-Do-Well News, Orange, RaidForums, RAMP, Ransomware, SonicWall VPN, teresacox19963@gmail.com, ToX, Verified, Washington Metropolitan Police Department, Wazawaka

In January, KrebsOnSecurity examined clues left behind by “Wazawaka,” the hacker handle chosen by a major ransomware criminal in the Russian-speaking cybercrime scene. Wazawaka has since “lost his mind” according to his erstwhile colleagues, creating a Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance, and publishing bizarre selfie videos taunting security researchers and journalists. In last month’s story, we explored clues that led from Wazawaka’s multitude of monikers, email addresses, and passwords to a 30-something father in Abakan, Russia named Mikhail Pavlovich Matveev. This post concerns itself with the other half of Wazawaka’s identities not mentioned in the first story, such as how Wazawaka also ran the Babuk ransomware affiliate program, and later became “Orange,” the founder of the ransomware-focused Dark Web forum known as “RAMP.” …

Russian Govt. Continues Carding Shop Crackdown

Cybersecurity Alexander Kovalev, Artem Bystrykh, Denis Pachevsky, Department K, Ferum Shop, Flashpoint, Gemini Advisory, Get-Net LLC, Infraud, Ne'er-Do-Well News, Saratovfilm Film Company LLC, Sky-Fraud, Stas Alforov, TASS, Transtekhkom LLC, Trump's-Dumps, Unicc, Vladislav Gilev, Web Fraud 2.0, Yaroslav Solovyov

29 Jan, 2022

Fake Investor John Bernard Sinks Norwegian Green Shipping Dreams

Cybersecurity A Little Sunshine, Freidig Shipping, Guy Devos, Harald Berglihn, Harald Vanvik, Inside Knowledge, John Bernard, John Clifton Davies, Ne'er-Do-Well News, Nils-Odd Tønnevold, The Weeknd, Uber, Web Fraud 2.0

Several articles here have delved into the history of John Bernard, the pseudonym used by a fake billionaire technology investor who’s tricked dozens of start-ups into giving him tens of millions of dollars. Bernard’s latest victim — a Norwegian startup hoping to build a fleet of environmentally friendly shipping vessels — is now embroiled in a lawsuit over a deal gone bad, in which Bernard falsely claimed to have secured $100 million from six other wealthy investors, including the founder of Uber and the artist Abel Makkonen Tesfaye, better known as The Weeknd. …

28 Jan, 2022

Who Wrote the ALPHV/BlackCat Ransomware Strain?

Cybersecurity @CookieDays, A Little Sunshine, ALPHV ransomware, Binrs, BlackCat ransomware, BlackMatter, Breadcrumbs, Catalin Cimpanu, DarkSide, DuckerMan, duckermanit, Flashpoint, Jason Hill, Ne'er-Do-Well News, Paul Roberts, RAMP, Recorded Future, ReversingLabs, rEvil, Sergey Duck, Sergey Kryakov, Sergey Penchikov, smiseo, The Record, ToX, Varonis, YBCat

Tag Archives: Ne’er-Do-Well News