• Search for:
    28 Jan, 2022
    Who Wrote the ALPHV/BlackCat Ransomware Strain?
    Cybersecurity , , , , , , , , , , , , , , , , , , , , , , , , , ,

    In December 2021, researchers discovered a new ransomware-as-a-service named ALPHV (a.k.a. “BlackCat”), considered to be the first professional cybercrime group to create and use a ransomware strain in the Rust programming language. In this post, we’ll explore some of the clues left behind by the developer who was reputedly hired to code the ransomware variant. …

    Read MoreWho Wrote the ALPHV/BlackCat Ransomware Strain?

    21 Jan, 2022
    Crime Shop Sells Hacked Logins to Other Crime Shops
    Cybersecurity , , , ,

    Up for the “Most Meta Cybercrime Offering” award this year is Accountz Club, a new cybercrime store that sells access to purloined accounts at services built for cybercriminals, including shops peddling stolen payment cards and identities, spamming tools, email and phone bombing services, and those selling authentication cookies for a slew of popular websites. …

    Read MoreCrime Shop Sells Hacked Logins to Other Crime Shops

    14 Jan, 2022
    At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates
    Cybersecurity , , , , , , , , , , , , , , ,

    The Russian government said today it arrested 14 people accused of working for “REvil,” a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin’s decision to station 100,000 troops along the nation’s border with Ukraine. …

    Read MoreAt Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates

    12 Jan, 2022
    Who is the Network Access Broker ‘Wazawaka?’
    Cybersecurity , , , , , , , , , , , , , , , , , , , , ,

    In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene. …

    Read MoreWho is the Network Access Broker ‘Wazawaka?’

    16 Dec, 2021
    NY Man Pleads Guilty in $20 Million SIM Swap Theft
    Cybersecurity , , , , , , , ,

    A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent “SIM swaps,” scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities. …

    Read MoreNY Man Pleads Guilty in $20 Million SIM Swap Theft

    8 Dec, 2021
    Canada Charges Its “Most Prolific Cybercriminal”
    Cybersecurity , , , , , , , , , , , ,

    A 31-year-old Canadian man has been arrested and charged with fraud in connection with numerous ransomware attacks against businesses, government agencies and private citizens throughout Canada and the United States. Canadian authorities describe him as “the most prolific cybercriminal we’ve identified in Canada,” but so far they’ve released few other details about the investigation or the defendant. Helpfully, an email address and nickname apparently connected to the accused offer some additional clues. …

    Read MoreCanada Charges Its “Most Prolific Cybercriminal”

    3 Dec, 2021
    Who Is the Network Access Broker ‘Babam’?
    Cybersecurity , , , , , , , , , ,

    Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in stealing remote access credentials — such as usernames and passwords needed to remotely connect to the target’s network. In this post we’ll look at the clues left behind by “Babam,” the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years. …

    Read MoreWho Is the Network Access Broker ‘Babam’?

    22 Nov, 2021
    Arrest in ‘Ransom Your Employer’ Email Scheme
    Cybersecurity , , , , , , , ,

    In August, KrebsOnSecurity warned that scammers were contacting people and asking them to unleash ransomware inside their employer’s network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the scheme — a young man who said he was trying to save up money to help fund a new social network. …

    Read MoreArrest in ‘Ransom Your Employer’ Email Scheme

    17 Nov, 2021
    Tech CEO Pleads to Wire Fraud in IP Address Scheme
    Cybersecurity , , , , , , , , , ,

    The CEO of a South Carolina technology firm has pleaded guilty to 20 counts of wire fraud in connection with an elaborate network of phony companies set up to obtain more than 735,000 Internet Protocol (IP) addresses from the nonprofit organization that leases the digital real estate to entities in North America. …

    Read MoreTech CEO Pleads to Wire Fraud in IP Address Scheme

    13 Nov, 2021
    Hoax Email Blast Abused Poor Coding in FBI Website
    Cybersecurity , , , , , , , , , , , , ,

    The Federal Bureau of Investigation (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing insecure code in an FBI online portal designed to share information with state and local law enforcement authorities. …

    Read MoreHoax Email Blast Abused Poor Coding in FBI Website