X-Industry

Many believe that the Mafia of old has long since been active.  Not so, says Europol.  The new and improved Mafia organized crime ring thrived on violence, intimidation and $12 million in online fraud profits; all specialties of the Mafia.  International law enforcement has busted up an extensive cybercrime operation run by a gang with ties to the Italian Mafia.

The group allegedly used phishing attacks to defraud hundreds of victims. The suspects used various lures to convince victims (mostly I

Activity Summary - Week Ending 1 October 2021:

• Red Sky Alliance identified 28,292 connections from new IP addresses connecting to Sinkholes
• Analysts identified 482 new IP addresses participating in various botnets
• Amazon Data Services Canada has a compromised IP
• #1 Malware for 29 Sept, FoggyWeb
• Blackmatter Ransomware, Again
• iTerm2 App
• German Elections and Russia
• South Africa Ransomware Attack
• French Shipper hit Again
• British Giant Group hit with a ‘sophisticated’ cyber-attack
• Lithuania and Chin

Cybersecurity is always low on upper management's priorities during a merger or acquisition, but it shouldn’t be.  "Companies that are being bought and sold are often prime targets for cyberattacks," explained the CEO of cybersecurity solutions provider Industrial Defender, during a recent interview.[1] "By enacting Operational Technology (and proactive cyber intelligence) security measures, organizations can avoid an exciting company milestone from becoming an infrastructure and security nightm

The Quadrilateral Security Dialogue (Quad) has signaled its commitment to cybersecurity by announcing a dedicated new group that will promote best practices and shared standards.  The announcement came after the first-ever in-person meeting of the Quad, which comprises the US, India, Japan, and Australia in an alliance of democratic nations designed to counter Chinese aggression.

A White House briefing on the leaders’ summit detailed multiple areas of cooperation between the four nations, from C

The US Department of Commerce is currently requesting public input on a previous administration cybersecurity executive order that requires cloud providers to verify the identities of certain users.  The goal of the executive order is to identify malicious cyber actors operating abroad and leveraging US technologies. 

Executive Order (EO) 13984 was signed on 19 January 2021 by President Trump, along with other mandates focused on national security.  While incumbent President Joe Biden has revers

Outer space and cyberspace have something in common, they are both new frontiers for national security.  This confuses what has been traditional ideas of defense strategy, borders, and sovereignty.  These two areas are national critical infrastructure and are essential for any country to be secure and able to defend itself.  This ‘use’ means cyber and space can both be utilized for civilian and military purposes.

As a political and legal concept, sovereignty defines as a country’s authority to c

A Russian-linked group known as Turla has been deploying a secondary backdoor against numerous targets to maintain persistence within compromised devices even after the primary malware has been discovered and removed from the infrastructure, according to a research report released by Cisco Talos this week.

The newly discovered backdoor, which the researchers call "TinyTurla," has been deployed against targets in the U.S. and Germany over the last two years. More recently, however, Turla has used

Last week Microsoft Security issued a detailed report on a massive phishing-as-a-service operation named BulletProofLink that offered as a subscription and all the tools needed to conduct a campaign.  The phishing-as-a-service, or PHaaS, model differs from the phishing kits that many gangs have used in that it is more expansive and handles many of the small details that could befuddle a less tech-savvy attacker.

"It's worth noting that some PhaaS groups may offer the whole deal - from template c

With approximately 90% of all finished and bulk products traveling through maritime ports, it is a bit unnerving that a major US port network was breached.  The US Coast Guard recently reported that a suspected foreign government-backed hackers breached a computer network at the Port of Houston, one of the largest ports on the US Gulf Coast.  Early detection of the incident last month resulted in the cyber criminals stopping any disruption of shipping operations. 

The incident at the Port of Hou

Activity Summary - Week Ending 24 September 2021:

• Red Sky identified 28,838 connections from new unique IP addresses connecting to our Sinkholes
• Analysts identified 1,253 new IP addresses participating in various botnets
• Zeppelin Ransomware
• Russian TinyTurla
• CloudAtlas
• WSL Malware Loaders
• AT&T network hacker – Convicted
• Suex & Ransomware Laws
• Fake Vaccine Passports
• Real Estate Brokerage Firm Hit

Report link: IR-21-267-001_weekly_267_FINAL.pdf

Malwarebytes Intelligence Team is reporting the MSHTML vulnerability classified as CVE-2021-40444 has become the focus of threat actors targeting Russian government entities.  Its researchers intercepted phishing email attachments revealing that attackers were trying to target Russian organizations.

The CVE-2021-40444 vulnerability involves ActiveX and is an old flaw, but it was discovered recently, and soon enough, threat actors started sharing its PoCs, tutorials, and exploits on hacking forum

The US government is reportedly set to announce new measures, including sanctions to deter cryptocurrency businesses from getting involved in laundering and facilitating ransomware payments.  People familiar with the matter told the Wall Street Journal that the US Treasury Department could enact the new sanctions as early as the week of 20 September 2021. They will reportedly target cryptocurrency exchanges and traders who either knowingly or unwittingly enable cybercrime transactions.  Among ot

A new state-sponsored advanced persistent threat (APT), a term used to describe nation level sponsored and very sophisticated cyber-espionage groups, has been observed escalating attacks against hotels across the world.  Code-named FamousSparrow, this new APT was discovered by Slovak security firm ESET, which said it is tracking hotel focused attacks as far back as 2019.

“FamousSparrow’s victims are located in Europe (France, Lithuania, the UK), the Middle East (Israel, Saudi Arabia), the Americ

The US Securities and Exchange Commission has issued a new warning that fresh criminal schemes are continuing to target digital assets.  Security experts say with social engineering attempts on the rise, individuals and organizations must remain vigilant against crypto-related scams or other "get rich quick" schemes.

In its recent bulletin, the SEC's Office of Investor Education and Advocacy and Division of Enforcement's Retail Strategy Task Force says, "Fraudsters continue to exploit the rising

An Illinois man was found guilty on 16 September 2021 by a US federal court jury for running websites that allowed paying users to launch powerful distributed denial of service, or DDoS, attacks that flood targeted computers with information and prevent them from being able to access the Internet.

A 32 man from St. Charles, Illinois, was found guilty of three felonies: one count of conspiracy to commit unauthorized impairment of a protected computer, one count of conspiracy to commit wire fraud,

“Oh Romeo, Romeo wherefore art thou Romeo?”  The FBI is warning the public that a massive spike of online romance scams this year caused many Americans to lose more than $113 million since the start of 2021.  The scammers behind this type of online fraud trend (also known as confidence fraud) which can lead to significant financial losses and devastating emotional scars use fake online identities to gain potential victims' trust on dating or social media platforms.

After the victims are lured in

What if three disgruntled employees left your organization and took top secret information to a competing company?  What repercussions would follow and how would it impact your business?  In many cases, there would be a lawsuit. In this case, there was federal prosecution and a cybersecurity threat.

The US Department of Justice (DOJ) released a shocking statement on 16 September 2021, which explains the scenario at the federal level. Three men, who formerly worked for the US intelligence communi

Activity Summary - Week Ending 17 September 2021:

• Red Sky Alliance identified 37,866 connections from new unique IP addresses
• Analysts identified 765 new IP addresses participating in various Botnets
• Compromised IP: 107.172.100.248
• Is it REvil or is it the Feds?
• BazarLoader
• QakBot
• BlackMatter and Cameras?
• Grayfly – an Arm of APT41
• EasyJet in the Crosshairs
• Just Who’s Winning the Cyber War?
• Tiananmen Square Memorials

Link to full report: IR-21-260-001_weekly_260.pdf