# articles

feed_id: https://krebsonsecurity.com/?p=70634
title: Feds Link $150M Cyberheist to 2022 LastPass Hacks
uri: Feds-Link-150M-Cyberheist-to-2022-LastPass-Hacks
url: https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/
content:
<p>In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service <strong>LastPass</strong> in 2022. In a court filing this week, U.S. federal agents investigating a spectacular $150 million cryptocurrency heist said they had reached the same conclusion.</p>
<p><img decoding="async" class="aligncenter size-medium wp-image-31264" src="media/9a26af90.lastpass-580x132.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/06/lastpass-580x132.png" alt="" width="580" height="132" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/06/lastpass-580x132.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/06/lastpass.png 808w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>On March 6, federal prosecutors in northern California said they seized approximately $24 million worth of cryptocurrencies that were clawed back following a $150 million cyberheist on Jan. 30, 2024. The complaint refers to the person robbed only as &#8220;Victim-1,&#8221; but according to blockchain security research <strong>ZachXBT</strong> the theft was perpetrated against <strong>Chris Larsen</strong>, the co-founder of the cryptocurrency platform <strong>Ripple</strong>.</p>
<p>ZachXBT was the <a href="https://x.com/zachxbt/status/1752694489905528943" target="_blank" rel="noopener">first to report on the heist</a>, of which approximately $24 million was frozen by the feds before it could be withdrawn. This week&#8217;s action by the government merely allows investigators to officially seize the frozen funds.</p>
<p>But there is an important conclusion in this seizure document: It basically says the <strong>U.S. Secret Service</strong> and the <strong>FBI</strong> agree with the findings of <a href="https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/" target="_blank" rel="noopener">the LastPass breach story published here in September 2023</a>. That piece quoted security researchers who said they were witnessing six-figure crypto heists several times each month that they believed all appeared to be the result of crooks cracking master passwords for the password vaults stolen from LastPass in 2022.</p>
<p>&#8220;The Federal Bureau of Investigation has been investigating these data breaches, and law enforcement agents investigating the instant case have spoken with FBI agents about their investigation,&#8221; reads the seizure complaint, which was written by a U.S. Secret Service agent. &#8220;From those conversations, law enforcement agents in this case learned that the stolen data and passwords that were stored in several victims’ online password manager accounts were used to illegally, and without authorization, access the victims’ electronic accounts and steal information, cryptocurrency, and other data.&#8221;</p>
<p>The document continues:</p>
<p>&#8220;Based on this investigation, law enforcement had probable cause to believe the same attackers behind the above-described commercial online password manager attack used a stolen password held in Victim 1’s online password manager account and, without authorization, accessed his cryptocurrency wallet/account.&#8221;</p>
<p>Working with dozens of victims, security researchers <strong>Nick Bax</strong> and <strong>Taylor Monahan</strong> found that none of the six-figure cyberheist victims appeared to have suffered the sorts of attacks that typically preface a high-dollar crypto theft, such as the compromise of one’s email and/or mobile phone accounts, or SIM-swapping attacks.</p>
<p>They discovered the victims all had something else in common: Each had at one point stored their cryptocurrency seed phrase &#8212; the secret code that lets anyone gain access to your cryptocurrency holdings &#8212; in the &#8220;Secure Notes&#8221; area of their LastPass account prior to the 2022 breaches at the company.</p>
<p>Bax and Monahan found another common theme with these robberies: They all followed a similar pattern of cashing out, rapidly moving stolen funds to a dizzying number of drop accounts scattered across various cryptocurrency exchanges.</p>
<p>According to the government, a similar level of complexity was present in the $150 million heist against the Ripple co-founder last year.</p>
<p>&#8220;The scale of a theft and rapid dissipation of funds would have required the efforts of multiple malicious actors, and was consistent with the online password manager breaches and attack on other victims whose cryptocurrency was stolen,&#8221; the government wrote. &#8220;For these reasons, law enforcement agents believe the cryptocurrency stolen from Victim 1 was committed by the same attackers who conducted the attack on the online password manager, and cryptocurrency thefts from other similarly situated victims.&#8221;</p>
<p>Reached for comment, LastPass said it has seen no definitive proof &#8212; from federal investigators or others &#8212; that the cyberheists in question were linked to the LastPass breaches.</p>
<p>&#8220;Since we initially disclosed this incident back in 2022, LastPass has worked in close cooperation with multiple representatives from law enforcement,&#8221; LastPass said in a written statement. &#8220;To date, our law enforcement partners have not made us aware of any conclusive evidence that connects any crypto thefts to our incident. In the meantime, we have been investing heavily in enhancing our security measures and will continue to do so.&#8221;<span id="more-70634"></span></p>
<p>On August 25, 2022, <strong>LastPass CEO Karim Toubba</strong> told users the company had detected unusual activity in its software development environment, and that the intruders stole some source code and proprietary LastPass technical information. On Sept. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults.</p>
<p>But on Nov. 30, 2022, LastPass notified customers about another, far more serious security incident that the company said leveraged data stolen in the August breach. LastPass disclosed that criminal hackers had compromised encrypted copies of some password vaults, as well as other personal information.</p>
<p>Experts say the breach would have given thieves &#8220;offline&#8221; access to encrypted password vaults, theoretically allowing them all the time in the world to try to crack some of the weaker master passwords using powerful systems that can attempt millions of password guesses per second.</p>
<p>Researchers found that many of the cyberheist victims had chosen master passwords with relatively low complexity, and were among LastPass&#8217;s oldest customers. That&#8217;s because legacy LastPass users were more likely to have master passwords that were protected with far fewer &#8220;iterations,&#8221; which refers to the number of times your password is run through the company&#8217;s encryption routines. In general, the more iterations, the longer it takes an offline attacker to crack your master password.</p>
<p>Over the years, LastPass forced new users to pick longer and more complex master passwords, and they increased the number of iterations on multiple occasions by several orders of magnitude. But researchers found strong indications that LastPass never succeeded in upgrading many of its older customers to the newer password requirements and protections.</p>
<p>Asked about LastPass&#8217;s continuing denials, Bax said that after the initial warning in our 2023 story, he naively hoped people would migrate their funds to new cryptocurrency wallets.</p>
<p>&#8220;While some did, the continued thefts underscore how much more needs to be done,&#8221; Bax told KrebsOnSecurity. &#8220;It&#8217;s validating to see the Secret Service and FBI corroborate our findings, but I’d much rather see fewer of these hacks in the first place. ZachXBT and <a href="https://x.com/_SEAL_Org/status/1868805837311074576" target="_blank" rel="noopener">SEAL 911 reported yet another wave of thefts</a> as recently as December, showing the threat is still very real.&#8221;</p>
<p>Monahan said LastPass still hasn’t alerted their customers that their secrets—especially those stored in “Secure Notes”—may be at risk.</p>
<p>&#8220;Its been two and a half years since LastPass was first breached [and] hundreds of millions of dollars has been stolen from individuals and companies around the globe,&#8221; Monahan said. &#8220;They could have encouraged users to rotate their credentials. They could’ve prevented millions and millions of dollars from being stolen by these threat actors. But  instead they chose to deny that their customers were are risk and blame the victims instead.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=70662
title: Alleged Co-Founder of Garantex Arrested in India
uri: Alleged-Co-Founder-of-Garantex-Arrested-in-India
url: https://krebsonsecurity.com/2025/03/alleged-co-founder-of-garantex-arrested-in-india/
content:
<p>Authorities in India today arrested the alleged co-founder of <strong>Garantex</strong>, a cryptocurrency exchange sanctioned by the U.S. government in 2022 for facilitating tens of billions of dollars in money laundering by transnational criminal and cybercriminal organizations. Sources close to the investigation told KrebsOnSecurity the Lithuanian national <strong>Aleksej Besciokov</strong>, 46, was apprehended while vacationing on the coast of India with his family.</p>
<div id="attachment_70665" style="width: 472px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70665" decoding="async" class=" wp-image-70665" src="media/a7ac079e.Besciokov_Photo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/Besciokov_Photo.png" alt="" width="462" height="552" /><p id="caption-attachment-70665" class="wp-caption-text">Aleksej Bešciokov, &#8220;proforg,&#8221; &#8220;iram&#8221;. Image: U.S. Secret Service.</p></div>
<p>On March 7, the <strong>U.S. Department of Justice</strong> (DOJ) unsealed <a href="https://www.justice.gov/media/1392316/dl" target="_blank" rel="noopener">an indictment</a> against Besciokov and the other alleged co-founder of Garantex, <strong>Aleksandr Mira Serda</strong>, 40, a Russian national living in the United Arab Emirates.</p>
<p>Launched in 2019, Garantex was <a href="https://home.treasury.gov/news/press-releases/jy0701" target="_blank" rel="noopener">first sanctioned</a> by the U.S. Treasury Office of Foreign Assets Control in April 2022 for receiving hundreds of millions in criminal proceeds, including funds used to facilitate hacking, ransomware, terrorism and drug trafficking. Since those penalties were levied, Garantex has processed more than $60 billion, according to the blockchain analysis company <strong>Elliptic.</strong></p>
<p>&#8220;Garantex has been used in sanctions evasion by Russian elites, as well as to launder proceeds of crime including ransomware, darknet market trade and thefts attributed to North Korea’s Lazarus Group,&#8221; Elliptic wrote in <a href="https://www.elliptic.co/blog/elliptic-in-action-garantex" target="_blank" rel="noopener">a blog post</a>. &#8220;Garantex has also been implicated in enabling Russian oligarchs to move their wealth out of the country, following the invasion of Ukraine.&#8221;</p>
<p>The DOJ alleges Besciokov was Garantex&#8217;s primary technical administrator and responsible for obtaining and maintaining critical Garantex infrastructure, as well as reviewing and approving transactions. Mira Serda is allegedly Garantex’s co-founder and chief commercial officer.</p>
<div id="attachment_70666" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70666" decoding="async" loading="lazy" class=" wp-image-70666" src="media/d9deed55.garantex-elliptic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/garantex-elliptic.png" alt="" width="747" height="492" /><p id="caption-attachment-70666" class="wp-caption-text">Image: elliptic.co</p></div>
<p>In conjunction with the release of the indictments, German and Finnish law enforcement seized servers hosting Garantex’s operations. A <a href="https://www.secretservice.gov/investigations/mostwanted/besciokov" target="_blank" rel="noopener">&#8220;most wanted&#8221; notice</a> published by the <strong>U.S. Secret Service</strong> states that U.S. authorities separately obtained earlier copies of Garantex’s servers, including customer and accounting databases. Federal investigators say they also froze over $26 million in funds used to facilitate Garantex’s money laundering activities.</p>
<p>Besciokov was arrested within the past 24 hours while vacationing with his family in Varkala, a major coastal city in the southwest Indian state of Kerala. An officer with the local police department in Varkala confirmed Besciokov&#8217;s arrest, and said the suspect will appear in a Delhi court on March 14 to face charges.</p>
<div id="attachment_70667" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70667" decoding="async" loading="lazy" class=" wp-image-70667" src="media/f9c626ba.kerala-shutterstock.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/kerala-shutterstock.png" alt="" width="749" height="495" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/kerala-shutterstock.png 988w, https://krebsonsecurity.com/wp-content/uploads/2025/03/kerala-shutterstock-768x507.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/kerala-shutterstock-782x516.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70667" class="wp-caption-text">Varkala Beach in Kerala, India. Image: Shutterstock, Dmitry Rukhlenko.</p></div>
<p><span id="more-70662"></span>The DOJ&#8217;s indictment says Besciokov went by the hacker handle &#8220;<strong>proforg</strong>.&#8221; This nickname corresponds to the administrator of a 20-year-old Russian language forum dedicated to nudity and crudity called &#8220;<strong>udaff</strong>.&#8221;</p>
<p>Besciokov and Mira Serda are each charged with one count of conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison. Besciokov is also charged with one count of conspiracy to violate the International Economic Emergency Powers Act—which also carries a maximum sentence of 20 years in person—and with conspiracy to operate an unlicensed money transmitting business, which carries a maximum sentence of five years in prison.</p>


feed_id: https://krebsonsecurity.com/?p=70681
title: Microsoft: 6 Zero-Days in March 2025 Patch Tuesday
uri: Microsoft-6-Zero-Days-in-March-2025-Patch-Tuesday
url: https://krebsonsecurity.com/2025/03/microsoft-6-zero-days-in-march-2025-patch-tuesday/
content:
<p><strong>Microsoft</strong> today issued more than 50 security updates for its various <strong>Windows</strong> operating systems, including fixes for a whopping <em>six zero-day vulnerabilities</em> that are already seeing active exploitation.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Two of the zero-day flaws include <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24991" target="_blank" rel="noopener">CVE-2025-24991</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24993" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24993&amp;source=gmail&amp;ust=1741811978241000&amp;usg=AOvVaw08YeX5TKKSxWlXHXx6FFHl">CVE-2025-24993</a>, both vulnerabilities in <strong>NTFS</strong>, the default file system for Windows and Windows Server. Both require the attacker to trick a target into mounting a malicious virtual hard disk. CVE-2025-24993 would lead to the possibility of local code execution, while CVE-2025-24991 could cause NTFS to disclose portions of memory.</p>
<p>Microsoft credits researchers at <strong>ESET</strong> with reporting the zero-day bug labeled <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24983" target="_blank" rel="noopener">CVE-2025-24983</a>, an elevation of privilege vulnerability in older versions of Windows. ESET said the exploit was deployed via the <a href="https://www.kaspersky.com/about/press-releases/kaspersky-uncovers-pipemagic-backdoor-attacks-businesses-through-fake-chatgpt-application" target="_blank" rel="noopener">PipeMagic backdoor</a>, capable of exfiltrating data and enabling remote access to the machine.</p>
<p>ESET&#8217;s <strong>Filip</strong> <b>Jurčacko </b>said the exploit in the wild targets only older versions of Windows OS: Windows 8.1 and Server 2012 R2. Although still used by millions, security support for these products ended more than a year ago, and mainstream support ended years ago. However, ESET notes the vulnerability itself also is present in newer Windows OS versions, including <strong>Windows 10 build 1809</strong> and the still-supported <strong>Windows Server 2016</strong>.</p>
<p>Rapid7&#8217;s lead software engineer <strong>Adam Barnett</strong> said <strong>Windows 11</strong> and <strong>Server 2019</strong> onwards are not listed as receiving patches, so are presumably not vulnerable.</p>
<p>&#8220;It’s not clear why newer Windows products dodged this particular bullet,&#8221; Barnett wrote. &#8220;The Windows 32 subsystem is still presumably alive and well, since there is no apparent mention of its demise on the Windows client OS deprecated features list.&#8221;<span id="more-70681"></span></p>
<p>The zero-day flaw <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24984" target="_blank" rel="noopener">CVE-2025-24984</a> is another NTFS weakness that can be exploited by inserting a malicious USB drive into a Windows computer. Barnett said Microsoft&#8217;s advisory for this bug doesn&#8217;t quite join the dots, but successful exploitation appears to mean that portions of heap memory could be improperly dumped into a log file, which could then be combed through by an attacker hungry for privileged information.</p>
<p>&#8220;A relatively low CVSSv3 base score of 4.6 reflects the practical difficulties of real-world exploitation, but a motivated attacker can sometimes achieve extraordinary results starting from the smallest of toeholds, and Microsoft does rate this vulnerability as important on its own proprietary severity ranking scale,&#8221; Barnett said.</p>
<p>Another zero-day fixed this month &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-24985" target="_blank" rel="noopener">CVE-2025-24985</a> &#8212; could allow attackers to install malicious code. As with the NTFS bugs, this one requires that the user mount a malicious virtual hard drive.</p>
<p>The final zero-day this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-26633" target="_blank" rel="noopener">CVE-2025-26633</a>, a weakness in the <strong>Microsoft Management Console</strong>, a component of Windows that gives system administrators a way to configure and monitor the system. Exploiting this flaw requires the target to open a malicious file.</p>
<p>This month&#8217;s bundle of patch love from Redmond also addresses six other vulnerabilities Microsoft has rated &#8220;critical,&#8221; meaning that malware or malcontents could exploit them to seize control over vulnerable PCs with no help from users.</p>
<p>Barnett observed that this is now the sixth consecutive month where Microsoft has published zero-day vulnerabilities on Patch Tuesday without evaluating any of them as critical severity at time of publication.</p>
<p>The <a href="https://isc.sans.edu/forums/diary/Microsoft%20Patch%20Tuesday%3A%20March%202025/31756/" target="_blank" rel="noopener">SANS Internet Storm Center</a> has a useful list of all the Microsoft patches released today, indexed by severity. Windows enterprise administrators would do well to keep an eye on <a href="http://www.askwoody.com/" target="_blank" rel="noopener">askwoody.com</a>, which often has the scoop on any patches causing problems. Please consider backing up your data before updating, and leave a comment below if you experience any issues applying this month&#8217;s updates.</p>


feed_id: https://krebsonsecurity.com/?p=70700
title: ClickFix: How to Infect Your PC in Three Easy Steps
uri: ClickFix-How-to-Infect-Your-PC-in-Three-Easy-Steps
url: https://krebsonsecurity.com/2025/03/clickfix-how-to-infect-your-pc-in-three-easy-steps/
content:
<p>A clever malware deployment scheme <a href="https://krebsonsecurity.com/2024/09/this-windows-powershell-phish-has-scary-potential/" target="_blank" rel="noopener">first spotted in targeted attacks last year</a> has now gone mainstream. In this scam, dubbed &#8220;<strong>ClickFix</strong>,&#8221; the visitor to a hacked or malicious website is asked to distinguish themselves from bots by pressing a combination of keyboard keys that causes <strong>Microsoft Windows</strong> to download password-stealing malware.</p>
<p>ClickFix attacks mimic the &#8220;Verify You are a Human&#8221; tests that many websites use to separate real visitors from content-scraping bots. This particular scam usually starts with a website popup that looks something like this:</p>
<div id="attachment_68856" style="width: 793px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68856" decoding="async" class="size-full wp-image-68856" src="media/d7825dbd.verifyhuman.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/verifyhuman.png" alt="" width="783" height="397" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/verifyhuman.png 783w, https://krebsonsecurity.com/wp-content/uploads/2024/09/verifyhuman-768x389.png 768w" sizes="(max-width: 783px) 100vw, 783px" /><p id="caption-attachment-68856" class="wp-caption-text">This malware attack pretends to be a CAPTCHA intended to separate humans from bots.</p></div>
<p>Clicking the &#8220;I&#8217;m not a robot&#8221; button generates a pop-up message asking the user to take three sequential steps to prove their humanity.</p>
<div id="attachment_70703" style="width: 634px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70703" decoding="async" loading="lazy" class="wp-image-70703 size-full" src="media/a3d8c241.verifsteps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/verifsteps.png" alt="" width="624" height="339" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/verifsteps.png 624w, https://krebsonsecurity.com/wp-content/uploads/2025/03/verifsteps-370x200.png 370w" sizes="(max-width: 624px) 100vw, 624px" /><p id="caption-attachment-70703" class="wp-caption-text">Executing this series of keypresses prompts Windows to download password-stealing malware.</p></div>
<p>Step 1 involves simultaneously pressing the keyboard key with the Windows icon and the letter &#8220;R,&#8221; which opens a Windows &#8220;Run&#8221; prompt that will execute any specified program that is already installed on the system.</p>
<p>Step 2 asks the user to press the &#8220;CTRL&#8221; key and the letter &#8220;V&#8221; at the same time, which pastes malicious code from the site&#8217;s virtual clipboard.</p>
<p>Step 3 — pressing the “Enter” key — causes Windows to download and launch malicious code through &#8220;<strong>mshta.exe</strong>,&#8221; a Windows program designed to run Microsoft HTML application files.</p>
<p>&#8220;This campaign delivers multiple families of commodity malware, including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT,&#8221; <strong>Microsoft</strong> wrote in <a href="https://www.microsoft.com/en-us/security/blog/2025/03/13/phishing-campaign-impersonates-booking-com-delivers-a-suite-of-credential-stealing-malware/" target="_blank" rel="noopener">a blog post</a> on Thursday. &#8220;Depending on the specific payload, the specific code launched through mshta.exe varies. Some samples have downloaded PowerShell, JavaScript, and portable executable (PE) content.&#8221;</p>
<p>According to Microsoft, hospitality workers are being tricked into downloading credential-stealing malware by cybercriminals impersonating <strong>Booking.com</strong>. The company said attackers have been sending malicious emails impersonating Booking.com, often referencing negative guest reviews, requests from prospective guests, or online promotion opportunities &#8212; all in a bid to convince people to step through one of these ClickFix attacks.<span id="more-70700"></span></p>
<p>In November 2024, KrebsOnSecurity reported that hundreds of hotels that use booking.com had been subject to targeted phishing attacks. Some of those lures worked, and allowed thieves to <a href="https://krebsonsecurity.com/2024/11/booking-com-phishers-may-leave-you-with-reservations/" target="_blank" rel="noopener">gain control over booking.com accounts</a>. From there, they sent out phishing messages asking for financial information from people who&#8217;d just booked travel through the company&#8217;s app.</p>
<p>Earlier this month, the security firm <strong>Arctic Wolf</strong> <a href="https://arcticwolf.com/resources/blog/healthcare-sector-targeted-by-fake-captcha-attack-on-hep2go-to-deliver-infostealer-malware/" target="_blank" rel="noopener">warned</a> about ClickFix attacks targeting people working in the healthcare sector. The company said those attacks leveraged malicious code stitched into the widely used physical therapy video site HEP2go that redirected visitors to a ClickFix prompt.</p>
<p>An <a href="media/5dc269fd.clickfix-attacks-sector-alert-tlpclear.pdf" data-original-source="https://www.hhs.gov/sites/default/files/clickfix-attacks-sector-alert-tlpclear.pdf" target="_blank" rel="noopener">alert</a> (PDF) released in October 2024 by the <strong>U.S. Department of Health and Human Services</strong> warned that the ClickFix attack can take many forms, including fake <strong>Google Chrome</strong> error pages and popups that spoof <strong>Facebook</strong>.</p>
<div id="attachment_70706" style="width: 1182px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70706" decoding="async" loading="lazy" class="size-full wp-image-70706" src="media/c1a76f93.hhs-clickfix.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/hhs-clickfix.png" alt="" width="1172" height="745" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/hhs-clickfix.png 1172w, https://krebsonsecurity.com/wp-content/uploads/2025/03/hhs-clickfix-768x488.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/hhs-clickfix-782x497.png 782w" sizes="(max-width: 1172px) 100vw, 1172px" /><p id="caption-attachment-70706" class="wp-caption-text">ClickFix tactic used by malicious websites impersonating Google Chrome, Facebook, PDFSimpli, and reCAPTCHA. Source: Sekoia.</p></div>
<p>The ClickFix attack &#8212; and its reliance on mshta.exe &#8212; is reminiscent of phishing techniques employed for years that hid exploits inside <strong>Microsoft Office</strong> <strong>macros</strong>. Malicious macros became such a common malware threat that Microsoft was forced to start blocking macros by default in Office documents that try to download content from the web.</p>
<p>Alas, the email security vendor <strong>Proofpoint</strong> has <a href="https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape" target="_blank" rel="noopener">documented</a> plenty of ClickFix attacks via phishing emails that include HTML attachments spoofing Microsoft Office files. When opened, the attachment displays an image of Microsoft Word document with a pop-up error message directing users to click the &#8220;Solution&#8221; or &#8220;How to Fix&#8221; button.</p>
<div id="attachment_70707" style="width: 759px" class="wp-caption aligncenter"><a href="media/07dd7a52.proofpoint-clickfix.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/proofpoint-clickfix.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70707" decoding="async" loading="lazy" class="wp-image-70707" src="media/07dd7a52.proofpoint-clickfix.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/proofpoint-clickfix.png" alt="" width="749" height="278" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/proofpoint-clickfix.png 1294w, https://krebsonsecurity.com/wp-content/uploads/2025/03/proofpoint-clickfix-768x285.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/proofpoint-clickfix-782x290.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-70707" class="wp-caption-text">HTML files containing ClickFix instructions. Examples for attachments named “Report_” (on the left) and “scan_doc_” (on the right). Image: Proofpoint.</p></div>
<p>Organizations that wish to do so can take advantage of <a href="https://m.majorgeeks.com/content/page/disable_run_command.html" target="_blank" rel="noopener">Microsoft Group Policy restrictions</a> to prevent Windows from executing the &#8220;run&#8221; command when users hit the Windows key and the &#8220;R&#8221; key simultaneously.</p>


feed_id: https://krebsonsecurity.com/?p=70729
title: DOGE to Fired CISA Staff: Email Us Your Personal Data
uri: DOGE-to-Fired-CISA-Staff-Email-Us-Your-Personal-Data
url: https://krebsonsecurity.com/2025/03/doge-to-fired-cisa-staff-email-us-your-personal-data/
content:
<p>A message posted on Monday to the homepage of the <strong>U.S. Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA) is the latest exhibit in the Trump administration&#8217;s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then immediately placed on leave, asking employees to send their Social Security number or date of birth in a password-protected email attachment &#8212; presumably with the password needed to view the file included in the body of the email.</p>
<div id="attachment_70732" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70732" decoding="async" class=" wp-image-70732" src="media/b94922ef.cisa-resinstatement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/cisa-resinstatement.png" alt="" width="747" height="371" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/cisa-resinstatement.png 1370w, https://krebsonsecurity.com/wp-content/uploads/2025/03/cisa-resinstatement-768x381.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/cisa-resinstatement-782x388.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-70732" class="wp-caption-text">The homepage of cisa.gov as it appeared on Monday and Tuesday afternoon.</p></div>
<p>On March 13, a Maryland district court judge <a href="https://www.cbsnews.com/news/fired-cisa-probationary-employees-reinstated/" target="_blank" rel="noopener">ordered</a> the Trump administration to reinstate more than 130 probationary CISA employees who were fired last month. On Monday, the administration announced that those dismissed employees would be reinstated but placed on paid administrative leave. They are among nearly 25,000 fired federal workers who are in the process of being rehired.</p>
<p>A notice covering the CISA homepage said the administration is making every effort to contact those who were unlawfully fired in mid-February.</p>
<p>&#8220;Please provide a password protected attachment that provides your full name, your dates of employment (including date of termination), and one other identifying factor such as date of birth or social security number,&#8221; the message reads. &#8220;Please, to the extent that it is available, attach any termination notice.&#8221;</p>
<p>The message didn&#8217;t specify how affected CISA employees should share the password for any attached files, so the implicit expectation is that employees should just include the plaintext password in their message.</p>
<p>Email is about as secure as a postcard sent through the mail, because anyone who manages to intercept the missive anywhere along its path of delivery can likely read it. In security terms, that&#8217;s the equivalent of encrypting sensitive data while also attaching the secret key needed to view the information.</p>
<p>What&#8217;s more, a great many antivirus and security scanners have trouble inspecting password-protected files, meaning the administration&#8217;s instructions are likely to increase the risk that malware submitted by cybercriminals could be accepted and opened by U.S. government employees.</p>
<p>The message in the screenshot above was removed from the CISA homepage Tuesday evening and replaced with a much shorter notice directing former CISA employees to contact a specific email address. But a slightly different version of the same message originally posted to CISA&#8217;s website <a href="https://www.uscis.gov/newsroom/alerts/uscis-probationary-reinstatements" target="_blank" rel="noopener">still exists</a> at the website for the <strong>U.S. Citizenship and Immigration Services</strong>, which likewise instructs those fired employees who wish to be rehired and put on leave to send a password-protected email attachment with sensitive personal data.</p>
<div id="attachment_70736" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70736" decoding="async" loading="lazy" class=" wp-image-70736" src="media/7b9b41d6.uscis-probation.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/uscis-probation.png" alt="" width="750" height="490" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/uscis-probation.png 1094w, https://krebsonsecurity.com/wp-content/uploads/2025/03/uscis-probation-768x502.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/uscis-probation-782x511.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70736" class="wp-caption-text">A message from the White House to fired federal employees at the U.S. Citizenship and Immigration Services instructs recipients to email personal information in a password-protected attachment.</p></div>
<p>This is hardly the first example of the administration discarding Security 101 practices in the name of expediency. Last month, the <strong>Central Intelligence Agency</strong> (CIA) sent an unencrypted email to the White House with the first names and first letter of the last names of recently hired CIA officers who might be easy to fire.</p>
<p>As cybersecurity journalist <strong>Shane Harris</strong> <a href="https://www.theatlantic.com/international/archive/2025/02/doge-intelligence-agencies-harm/681667/" target="_blank" rel="noopener">noted</a> in <em>The Atlantic</em>, even those fragments of information could be useful to foreign spies.</p>
<p>&#8220;Over the weekend, a former senior CIA official showed me the steps by which a foreign adversary who knew only his first name and last initial could have managed to identify him from the single line of the congressional record where his full name was published more than 20 years ago, when he became a member of the Foreign Service,&#8221; Harris wrote. &#8220;The former official was undercover at the time as a State Department employee. If a foreign government had known even part of his name from a list of confirmed CIA officers, his cover would have been blown.&#8221;</p>
<p>The White House has also fired at least 100 intelligence staffers from the <strong>National Security Agency </strong>(NSA), reportedly for using an internal NSA chat tool <a href="https://www.nytimes.com/2025/02/25/us/politics/gabbard-nsa-firing-explicit-chat.html" target="_blank" rel="noopener">to discuss their personal lives and politics</a>. Testifying before the House Select Committee on the Communist Party earlier this month, the NSA&#8217;s former top cybersecurity official said the Trump administration&#8217;s attempts to mass fire probationary federal employees will be &#8220;devastating&#8221; to U.S. cybersecurity operations.&#8221;</p>
<p><strong>Rob Joyce</strong>, who spent 34 years at the NSA, told Congress how important those employees are in sustaining an aggressive stance against China in cyberspace.</p>
<p>&#8220;At my former agency, remarkable technical talent was recruited into developmental programs that provided intensive unique training and hands-on experience to cultivate vital skills,” Joyce <a href="https://cyberscoop.com/joyce-china-probationary-firings-devastating-congress/?utm_campaign=CyberScoop%20-%20Editorial&amp;utm_content=326616240&amp;utm_medium=social&amp;utm_source=linkedin&amp;hss_channel=lcp-11061843" target="_blank" rel="noopener">told the panel</a>. &#8220;Eliminating probationary employees will destroy a pipeline of top talent responsible for hunting and eradicating [Chinese] threats.&#8221;</p>
<p>Both the email to fired CISA workers and DOGE&#8217;s ongoing efforts to bypass vetted government networks for a faster Wi-Fi signal are emblematic of this administration&#8217;s overall approach to even basic security measures: To go around them, or just pretend they don&#8217;t exist <a href="https://fs.blog/chestertons-fence/" target="_blank" rel="noopener">for a good reason</a>.</p>
<p>On Monday, <em>The New York Times</em> <a href="https://www.nytimes.com/2025/03/17/us/politics/elon-musk-starlink-white-house.html" target="_blank" rel="noopener">reported</a> that U.S. Secret Service agents at the White House were briefly on alert last month when a trusted captain of Elon Musk&#8217;s &#8220;Department of Government Efficiency&#8221; (DOGE) visited the roof of the Eisenhower building inside the White House compound &#8212; to see about setting up a dish to receive satellite Internet access directly from Musk&#8217;s <strong>Starlink</strong> service.</p>
<p>The White House press secretary told The Times that Starlink had &#8220;donated&#8221; the service and that the gift had been vetted by the lawyer overseeing ethics issues in the White House Counsel’s Office. The White House claims the service is necessary because its wireless network is too slow.</p>
<p><strong>Jake Williams</strong>, vice president for research and development at the cybersecurity consulting firm <strong>Hunter Strategy</strong>, told The Times &#8220;it&#8217;s super rare” to install Starlink or another internet provider as a replacement for existing government infrastructure that has been vetted and secured.</p>
<p>&#8220;I can’t think of a time that I have heard of that,&#8221; Williams said. &#8220;It introduces another attack point,” Williams said. &#8220;But why introduce that risk?&#8221;</p>
<p>Meanwhile, <strong>NBC News</strong> <a href="https://www.nbcnews.com/tech/elon-musk/elon-musk-starlink-growing-footprint-federal-government-rcna195400" target="_blank" rel="noopener">reported on March 7</a> that Starlink is expanding its footprint across the federal government.</p>
<p>&#8220;Multiple federal agencies are exploring the idea of adopting SpaceX’s Starlink for internet access — and at least one agency, the General Services Administration (GSA), has done so at the request of Musk’s staff, according to someone who worked at the GSA last month and is familiar with its network operations — despite a vow by Musk and Trump to slash the overall federal budget,&#8221; NBC wrote.<span id="more-70729"></span></p>
<p>The longtime Musk employee who encountered the Secret Service on the roof in the White House complex was <strong>Christopher Stanley</strong>, the 33-year-old senior director for security engineering at <strong>X</strong> and principal security engineer at SpaceX.</p>
<p>On Monday, Bloomberg broke the news that Stanley had been tapped for a seat on the board of directors at the mortgage giant <strong>Fannie Mae</strong>. Stanley was added to the board alongside newly confirmed Federal Housing Finance Agency director <a href="https://en.wikipedia.org/wiki/Bill_Pulte" target="_blank" rel="noopener">Bill Pulte</a>, the grandson of the late housing businessman and founder of PulteGroup &#8212; William J. Pulte.</p>
<p>In a nod to his new board role atop an agency that helps drive the nation&#8217;s $12 trillion mortgage market, Stanley retweeted a Bloomberg story about the hire with a smiley emoji and the comment &#8220;Tech Support.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-70750" src="media/4f474b33.stanley-fannie.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/stanley-fannie.png" alt="" width="750" height="676" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/stanley-fannie.png 905w, https://krebsonsecurity.com/wp-content/uploads/2025/03/stanley-fannie-768x692.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/stanley-fannie-782x705.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>But earlier today, Bloomberg <a href="https://www.bloomberg.com/news/articles/2025-03-19/musk-ally-stanley-abruptly-resigns-from-fannie-mae-board" target="_blank" rel="noopener">reported</a> that Stanley had abruptly resigned from the Fannie board, and that details about the reason for his quick departure weren&#8217;t immediately clear. As <a href="https://krebsonsecurity.com/2025/02/trump-2-0-brings-cuts-to-cyber-consumer-protections/" target="_blank" rel="noopener">first reported here</a> last month, Stanley had a brush with celebrity on Twitter in 2015 when he leaked the user database for the DDoS-for-hire service <strong>LizardStresser</strong>, and soon faced threats of physical violence against his family.</p>
<p>My <a href="https://krebsonsecurity.com/2015/01/another-lizard-arrested-lizard-lair-hacked/" target="_blank" rel="noopener">2015 story on that leak</a> did not name Stanley, but he exposed himself as the source by posting a video about it on his Youtube channel. A review of domain names registered by Stanley shows he went by the nickname “enKrypt,” and was the former owner of a pirated software and hacking forum called <strong>error33[.]net</strong>, as well as <strong>theC0re</strong>, a video game cheating community.</p>
<p>Stanley is one of more than 50 DOGE workers, mostly young men and women who have worked with one or more of Musk&#8217;s companies. The Trump administration remains <a href="https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/" target="_blank" rel="noopener">dogged by questions</a> about how many &#8212; if any &#8212; of the DOGE workers were put through the gauntlet of a thorough security background investigation before being given access to such sensitive government databases.</p>
<p>That&#8217;s largely because in one of his first executive actions after being sworn in for a second term on Jan. 20, President Trump <a href="https://www.whitehouse.gov/presidential-actions/2025/01/memorandum-to-resolve-the-backlog-of-security-clearances-for-executive-office-of-the-president-personnel/" target="_blank" rel="noopener">declared</a> that the security clearance process was simply too onerous and time-consuming, and that anyone so designated by the White House counsel would have full top secret/sensitive compartmented information (TS/SCI) clearances for up to six months. Translation: We <a href="https://www.youtube.com/watch?v=9IG3zqvUqJY" target="_blank" rel="noopener">accepted the risk</a>, so TAH-DAH! No risk!</p>
<p>Presumably, this is the same counsel who saw no ethical concerns with Musk &#8220;donating&#8221; Starlink to the White House, or with President Trump summoning the media to film him hawking Cybertrucks and Teslas (a.k.a. &#8220;Teslers&#8221;) on the White House lawn last week.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/uUntzU4Toy4?si=76K-2CkYWGNN0kYh" width="660" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Mr. Musk&#8217;s unelected role as head of an ad hoc executive entity that is gleefully firing federal workers and feeding federal agencies into &#8220;the wood chipper&#8221; has seen his Tesla stock price plunge in recent weeks, while firebombings and other vandalism attacks on property carrying the Tesla logo are cropping up across the U.S. and overseas and driving down Tesla sales.</p>
<p>President Trump and his attorney general Pam Bondi have dubiously asserted that those responsible for attacks on Tesla dealerships are committing &#8220;domestic terrorism,&#8221; and that vandals will be prosecuted accordingly. But it&#8217;s not clear this administration would recognize a real domestic security threat if it was ensconced squarely behind the Resolute Desk.</p>
<p>Or at the pinnacle of the <strong>Federal Bureau of Investigation</strong> (FBI). <em>The Washington Post</em> <a href="https://www.washingtonpost.com/national-security/2025/02/07/patel-fbi-russia-lopatonok/" target="_blank" rel="noopener">reported</a> last month that Trump&#8217;s new FBI director <strong>Kash Patel</strong> was paid $25,000 last year by a film company owned by a dual U.S. Russian citizen that has made programs promoting &#8220;deep state&#8221; conspiracy theories pushed by the Kremlin.</p>
<p>&#8220;The resulting six-part documentary appeared on Tucker Carlson’s online network, itself a reliable conduit for Kremlin propaganda,&#8221; The Post reported. &#8220;In the film, Patel made his now infamous pledge to shut down the FBI’s headquarters in Washington and &#8216;open it up as a museum to the deep state.'&#8221;</p>
<p>When the head of the FBI is promising to turn his own agency headquarters into a mocking public exhibit on the U.S. National Mall, it may seem silly to fuss over the White House&#8217;s clumsy and insulting instructions to former employees they unlawfully fired.</p>
<p>Indeed, one consistent feedback I&#8217;ve heard from a subset of readers here is something to this effect: &#8220;I used to like reading your stuff more when you weren&#8217;t writing about politics all the time.&#8221;</p>
<p>My response to that is: &#8220;Yeah, me too.&#8221; It&#8217;s not that I&#8217;m suddenly interested in writing about political matters; it&#8217;s that various actions by this administration keep intruding on my areas of coverage.</p>
<p>A less charitable interpretation of that reader comment is that anyone still giving such feedback is either dangerously uninformed, being disingenuous, or just doesn’t want to keep being reminded that they’re on the side of the villains, despite all the evidence showing it.</p>
<p>Article II of the U.S. Constitution unambiguously states that the president shall take care that the laws be faithfully executed. But almost from Day One of his second term, Mr. Trump has been acting in violation of his sworn duty as president by choosing not to enforce laws passed by Congress (TikTok ban, anyone?), by freezing funds already allocated by Congress, and most recently by flouting a federal court order while simultaneously <a href="https://www.nytimes.com/2025/03/19/us/politics/trump-deportations-constitutional-crisis-impeachment.html" target="_blank" rel="noopener">calling for the impeachment of the judge who issued it</a>. Sworn to uphold, protect and defend The Constitution, President Trump appears to be creating new constitutional challenges with almost each passing day.</p>
<p>When Mr. Trump was voted out of office in November 2020, he turned to baseless claims of widespread &#8220;election fraud&#8221; to explain his loss &#8212; with deadly and long-lasting consequences. This time around, the rallying cry of DOGE and White House is &#8220;government fraud,&#8221; which gives the administration a certain amount of cover for its actions among a base of voters that has long sought to shrink the size and cost of government.</p>
<p>In reality, &#8220;government fraud&#8221; has become a term of derision and public scorn applied to anything or anyone the current administration doesn&#8217;t like. If DOGE and the White House were truly interested in trimming government waste, fraud and abuse, they could scarcely do better than consult the inspectors general fighting it at various federal agencies.</p>
<p>After all, the inspectors general likely know exactly where a great deal of the federal government&#8217;s fiscal skeletons are buried. Instead, Mr. Trump <a href="https://www.cbsnews.com/news/trump-firings-watchdogs-inspectors-general-60-minutes/" target="_blank" rel="noopener">fired at least 17 inspectors general</a>, leaving the government without critical oversight of agency activities. That action is unlikely to stem government fraud; if anything, it will only encourage such activity.</p>
<p>As <em>Techdirt</em> founder <strong>Mike Masnick</strong> noted in a recent column &#8220;<a href="https://www.techdirt.com/2025/03/04/why-techdirt-is-now-a-democracy-blog-whether-we-like-it-or-not/" target="_blank" rel="noopener">Why Techdirt is Now a Democracy Blog (Whether We Like it or Not)</a>,&#8221; when the very institutions that made American innovation possible are being systematically dismantled, it’s not a &#8220;political&#8221; story anymore: It’s a story about whether the environment that enabled all the other stories we cover will continue to exist.</p>
<p>&#8220;This is why tech journalism’s perspective is so crucial right now,&#8221; Masnick wrote. &#8220;We’ve spent decades documenting how technology and entrepreneurship can either strengthen or undermine democratic institutions. We understand the dangers of concentrated power in the digital age. And we’ve watched in real-time as tech leaders who once championed innovation and openness now actively work to consolidate control and dismantle the very systems that enabled their success.&#8221;</p>
<p>&#8220;But right now, the story that matters most is how the dismantling of American institutions threatens everything else we cover,&#8221; Masnick continued. &#8220;When the fundamental structures that enable innovation, protect civil liberties, and foster open dialogue are under attack, every other tech policy story becomes secondary.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=70697
title: Arrests in Tap-to-Pay Scheme Powered by Phishing
uri: Arrests-in-Tap-to-Pay-Scheme-Powered-by-Phishing
url: https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/
content:
<p>Authorities in at least two U.S. states last week independently announced arrests of Chinese nationals accused of perpetrating a novel form of tap-to-pay fraud using mobile devices. Details released by authorities so far indicate the mobile wallets being used by the scammers were created through online phishing scams, and that the accused were relying on a custom Android app to relay tap-to-pay transactions from mobile devices located in China.</p>
<div id="attachment_70773" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70773" decoding="async" class=" wp-image-70773" src="media/ce101da7.kcso-taptopay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/kcso-taptopay.png" alt="" width="748" height="413" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/kcso-taptopay.png 903w, https://krebsonsecurity.com/wp-content/uploads/2025/03/kcso-taptopay-768x424.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/kcso-taptopay-782x431.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-70773" class="wp-caption-text">Image: WLVT-8.</p></div>
<p>Authorities in Knoxville, Tennessee last week <a href="https://knoxsheriff.org/tap-2-pay-fraud-scheme-bust/" target="_blank" rel="noopener">said</a> they arrested 11 Chinese nationals accused of buying tens of thousands of dollars worth of gift cards at local retailers with mobile wallets created through online phishing scams. The Knox County Sheriff&#8217;s office said the arrests are considered the first in the nation for a new type of tap-to-pay fraud.</p>
<p>Responding to questions about what makes this scheme so remarkable, Knox County said that while it appears the fraudsters are simply buying gift cards, in fact they are using multiple transactions to purchase various gift cards and are plying their scam from state to state.</p>
<p>&#8220;These offenders have been traveling nationwide, using stolen credit card information to purchase gift cards and launder funds,&#8221; Knox County Chief Deputy <strong>Bernie Lyon</strong> wrote. &#8220;During Monday’s operation, we recovered gift cards valued at over $23,000, all bought with unsuspecting victims’ information.&#8221;</p>
<p>Asked for specifics about the mobile devices seized from the suspects, Lyon said &#8220;tap-to-pay fraud involves a group <em>utilizing Android phones to conduct Apple Pay transactions</em> utilizing stolen or compromised credit/debit card information,&#8221; [emphasis added].</p>
<p>Lyon declined to offer additional specifics about the mechanics of the scam, citing an ongoing investigation.</p>
<p><strong>Ford Merrill</strong> works in security research at <a href="https://www.secalliance.com/" target="_blank" rel="noopener">SecAlliance</a>, a <a href="https://www.csis.com/" target="_blank" rel="noopener">CSIS Security Group</a> company. Merrill said there aren&#8217;t many valid use cases for Android phones to transmit Apple Pay transactions. That is, he said, unless they are running a custom Android app that KrebsOnSecurity wrote about last month as a part of <a href="https://krebsonsecurity.com/2025/02/how-phished-data-turns-into-apple-google-wallets/" target="_blank" rel="noopener">a deep dive into the sprawling operations of China-based phishing cartels</a> that are breathing new life into the payment card fraud industry (a.k.a. &#8220;carding&#8221;).</p>
<p>How are these China-based phishing groups obtaining stolen payment card data and then loading it onto Google and Apple phones? It all starts with phishing.</p>
<p>If you own a mobile phone, the chances are excellent that at some point in the past two years it has received at least one phishing message that spoofs the <strong>U.S. Postal Service</strong> to supposedly collect some outstanding delivery fee, or an SMS that pretends to be a local toll road operator warning of a delinquent toll fee.</p>
<p>These messages are being sent through sophisticated phishing kits sold by several cybercriminals based in mainland China. And they are not traditional SMS phishing or “<strong>smishing</strong>” messages, as they bypass the mobile networks entirely. Rather, the missives are sent through the <strong>Apple iMessage</strong> service and through <a href="https://en.wikipedia.org/wiki/Rich_Communication_Services" target="_blank" rel="noopener">RCS</a>, the functionally equivalent technology on <strong>Google</strong> phones.</p>
<p>People who enter their payment card data at one of these sites will be told their financial institution needs to verify the small transaction by sending a one-time passcode to the customer’s mobile device. In reality, that code will be sent by the victim’s financial institution in response to a request by the fraudsters to link the phished card data to a mobile wallet.</p>
<p>If the victim then provides that one-time code, the phishers will link the card data to a new mobile wallet from Apple or Google, loading the wallet onto a mobile phone that the scammers control. These phones are then loaded with multiple stolen wallets (often between 5-10 per device) and sold in bulk to scammers on Telegram.</p>
<div id="attachment_70436" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70436" decoding="async" loading="lazy" class=" wp-image-70436" src="media/4b420841.phishingphones.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones.png" alt="" width="750" height="567" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones.png 1160w, https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones-768x581.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones-782x591.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70436" class="wp-caption-text">An image from the Telegram channel for a popular Chinese smishing kit vendor shows 10 mobile phones for sale, each loaded with 5-7 digital wallets from different financial institutions.</p></div>
<p>Merrill found that at least one of the Chinese phishing groups sells an Android app called “<strong>Z-NFC</strong>” that can relay a valid NFC transaction to anywhere in the world. The user simply waves their phone at a local payment terminal that accepts Apple or Google pay, and the app relays an NFC transaction over the Internet from a phone in China.</p>
<p>&#8220;I would be shocked if this wasn&#8217;t the NFC relay app,&#8221; Merrill said, concerning the arrested suspects in Tennessee.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/ekqZjPAxB4c?si=hYLqGPIBrNthAg9_" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Merrill said the Z-NFC software can work from anywhere in the world, and that one phishing gang offers the software for $500 a month.</p>
<p>&#8220;It can relay both NFC enabled tap-to-pay as well as any digital wallet,&#8221; Merrill said. &#8220;They even have 24-hour support.&#8221;</p>
<p>On March 16, the ABC affiliate in Sacramento (<strong>ABC10</strong>), Calif. <a href="https://www.youtube.com/watch?v=dUjaj0d1T6A" target="_blank" rel="noopener">aired a segment</a> about two Chinese nationals who were arrested after using an app to run stolen credit cards at a local Target store. The news story quoted investigators saying the men were trying to buy gift cards using a mobile app that cycled through more than 80 stolen payment cards.</p>
<p>ABC10 reported that while most of those transactions were declined, the suspects still made off with $1,400 worth of gift cards. After their arrests, both men reportedly admitted that they were being paid $250 a day to conduct the fraudulent transactions.</p>
<p>Merrill said it&#8217;s not unusual for fraud groups to advertise this kind of work on social media networks, including TikTok.</p>
<p>A <strong>CBS News</strong> <a href="https://www.cbsnews.com/sacramento/news/sacramento-county-credit-card-scheme-arrest-chinese-nationals/" target="_blank" rel="noopener">story</a> on the Sacramento arrests said one of the suspects tried to use 42 separate bank cards, but that 32 were declined. Even so, the man still was reportedly able to spend $855 in the transactions.</p>
<p>Likewise, the suspect&#8217;s alleged accomplice tried 48 transactions on separate cards, finding success 11 times and spending $633, CBS reported.</p>
<p>&#8220;It&#8217;s interesting that so many of the cards were declined,&#8221; Merrill said. &#8220;One reason this might be is that banks are getting better at detecting this type of fraud. The other could be that the cards were already used and so they were already flagged for fraud even before these guys had a chance to use them. So there could be some element of just sending these guys out to stores to see if it works, and if not they&#8217;re on their own.&#8221;</p>
<p>Merrill&#8217;s investigation into the Telegram sales channels for these China-based phishing gangs shows their phishing sites are actively manned by fraudsters who sit in front of giant racks of Apple and Google phones that are used to send the spam and respond to replies in real time.</p>
<p>In other words, the phishing websites are powered by real human operators as long as new messages are being sent. Merrill said the criminals appear to send only a few dozen messages at a time, likely because completing the scam takes manual work by the human operators in China. After all, most one-time codes used for mobile wallet provisioning are generally only good for a few minutes before they expire.</p>
<p>For more on how these China-based mobile phishing groups operate, check out <a href="https://krebsonsecurity.com/2025/02/how-phished-data-turns-into-apple-google-wallets/" target="_blank" rel="noopener">How Phished Data Turns Into Apple and Google Wallets</a>.</p>
<div id="attachment_70435" style="width: 528px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70435" decoding="async" loading="lazy" class="size-full wp-image-70435" src="media/5d328b62.phonesashtray.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/phonesashtray.png" alt="" width="518" height="688" /><p id="caption-attachment-70435" class="wp-caption-text">The ashtray says: You&#8217;ve been phishing all night.</p></div>


feed_id: https://krebsonsecurity.com/?p=70785
title: When Getting Phished Puts You in Mortal Danger
uri: When-Getting-Phished-Puts-You-in-Mortal-Danger
url: https://krebsonsecurity.com/2025/03/when-getting-phished-puts-you-in-mortal-danger/
content:
<p>Many successful phishing attacks result in a financial loss or malware infection. But falling for some phishing scams, like those currently targeting Russians searching online for organizations that are fighting the Kremlin war machine, can cost you your freedom or your life.</p>
<div id="attachment_70811" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70811" decoding="async" class=" wp-image-70811" src="media/6ff85d45.legionlibertyarmy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/legionlibertyarmy.png" alt="" width="750" height="420" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/legionlibertyarmy.png 1430w, https://krebsonsecurity.com/wp-content/uploads/2025/03/legionlibertyarmy-768x430.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/legionlibertyarmy-782x437.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70811" class="wp-caption-text">The real website of the Ukrainian paramilitary group &#8220;Freedom of Russia&#8221; legion. The text has been machine-translated from Russian.</p></div>
<p>Researchers at the security firm <strong>Silent Push</strong> mapped a network of several dozen phishing domains that spoof the recruitment websites of Ukrainian paramilitary groups, as well as Ukrainian government intelligence sites.</p>
<p>The website <strong>legiohliberty[.]army</strong> features a carbon copy of the homepage for the <a href="https://en.wikipedia.org/wiki/Freedom_of_Russia_Legion" target="_blank" rel="noopener">Freedom of Russia Legion</a> (a.k.a. &#8220;Free Russia Legion&#8221;), a three-year-old Ukraine-based paramilitary unit made up of Russian citizens who oppose Vladimir Putin and his invasion of Ukraine.</p>
<p>The phony version of that website copies the legitimate site &#8212; <strong>legionliberty[.]army &#8212; </strong>providing an interactive <strong>Google Form</strong> where interested applicants can share their contact and personal details. The form asks visitors to provide their name, gender, age, email address and/or Telegram handle, country, citizenship, experience in the armed forces; political views; motivations for joining; and any bad habits.</p>
<p>&#8220;Participation in such anti-war actions is considered illegal in the Russian Federation, and participating citizens are regularly charged and arrested,&#8221; Silent Push wrote in a report released today. &#8220;All observed campaigns had similar traits and shared a common objective: collecting personal information from site-visiting victims. Our team believes it is likely that this campaign is the work of either Russian Intelligence Services or a threat actor with similarly aligned motives.&#8221;</p>
<p>Silent Push&#8217;s <strong>Zach Edwards</strong> said the fake Legion Liberty site shared multiple connections with <strong>rusvolcorps[.]net</strong>. That domain mimics the recruitment page for a Ukrainian far-right paramilitary group called the <a href="https://en.wikipedia.org/wiki/Russian_Volunteer_Corps" target="_blank" rel="noopener">Russian Volunteer Corps</a> (rusvolcorps[.]com), and uses a similar Google Forms page to collect information from would-be members.</p>
<p>Other domains Silent Push connected to the phishing scheme include: <strong>ciagov[.]icu</strong>, which mirrors the content on the official website of the <strong>U.S. Central Intelligence Agency</strong>; and <strong>hochuzhitlife[.]com</strong>, which spoofs the <strong>Ministry of Defense of Ukraine &amp; General Directorate of Intelligence</strong> (whose actual domain is <strong>hochuzhit[.]com</strong>).</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-70814" src="media/3a6d9fd4.recruit-form.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/recruit-form.png" alt="" width="749" height="775" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/recruit-form.png 790w, https://krebsonsecurity.com/wp-content/uploads/2025/03/recruit-form-768x794.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/recruit-form-782x809.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>According to Edwards, there are no signs that these phishing sites are being advertised via email. Rather, it appears those responsible are promoting them by manipulating the search engine results shown when someone searches for one of these anti-Putin organizations.</p>
<p>In August 2024, security researcher <strong>Artem Tamoian</strong> posted <a href="https://x.com/artemtam" target="_blank" rel="noopener">on Twitter/X</a> about how he received startlingly different results when he searched for &#8220;Freedom of Russia legion&#8221; in Russia&#8217;s largest domestic search engine <strong>Yandex</strong> versus Google.com. The top result returned by Google was the legion&#8217;s actual website, while the first result on Yandex was a phishing page targeting the group.</p>
<p>&#8220;I think at least some of them are surely promoted via search,&#8221; Tamoian said of the phishing domains. &#8220;My first thread on that accuses Yandex, but apart from Yandex those websites are consistently ranked above legitimate in DuckDuckGo and Bing. Initially, I didn&#8217;t realize the scale of it. They keep appearing to this day.&#8221;<span id="more-70785"></span></p>
<p>Tamoian, a native Russian who left the country in 2019, is the founder of the cyber investigation platform <a href="https://malfors.com" target="_blank" rel="noopener">malfors.com</a>. He recently discovered two other sites impersonating the Ukrainian paramilitary groups &#8212; <strong>legionliberty[.]world</strong> and <strong>rusvolcorps[.]ru</strong> &#8212; and reported both to Cloudflare. When Cloudflare responded by blocking the sites with a phishing warning, the real Internet address of these sites <a href="media/4df0de9e.rusvolcorps-stark.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/rusvolcorps-stark.png" target="_blank" rel="noopener">was exposed</a> as belonging to a known &#8220;bulletproof hosting&#8221; network called <strong>Stark Industries Solutions Ltd</strong>.</p>
<p>Stark Industries Solutions appeared two weeks before Russia invaded Ukraine in February 2022, materializing out of nowhere with hundreds of thousands of Internet addresses in its stable &#8212; many of them originally assigned to Russian government organizations. In May 2024, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">published a deep dive on Stark</a>, which has repeatedly been used to host infrastructure for distributed denial-of-service (DDoS) attacks, phishing, malware and disinformation campaigns from Russian intelligence agencies and pro-Kremlin hacker groups.</p>
<p>In March 2023, Russia’s Supreme Court designated the Freedom of Russia legion as a terrorist organization, meaning that Russians caught communicating with the group could face between 10 and 20 years in prison.</p>
<p>Tamoian said those searching online for information about these paramilitary groups have become easy prey for Russian security services.</p>
<p>&#8220;I started looking into those phishing websites, because I kept stumbling upon news that someone gets arrested for trying to join [the] Ukrainian Army or for trying to help them,&#8221; Tamoian told KrebsOnSecurity. &#8220;I have also seen reports [of] FSB contacting people impersonating Ukrainian officers, as well as using fake Telegram bots, so I thought fake websites might be an option as well.&#8221;</p>
<div id="attachment_70810" style="width: 622px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70810" decoding="async" loading="lazy" class="size-full wp-image-70810" src="media/bc252f22.legion-arrests.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/legion-arrests.png" alt="" width="612" height="802" /><p id="caption-attachment-70810" class="wp-caption-text">Search results showing news articles about people in Russia being sentenced to lengthy prison terms for attempting to aid Ukrainian paramilitary groups.</p></div>
<p>Tamoian said <a href="https://en.zona.media/article/2024/10/15/phish-trl" target="_blank" rel="noopener">reports surface regularly in Russia</a> about people being arrested for trying carry out an action requested by a &#8220;Ukrainian recruiter,&#8221; with the courts unfailingly imposing harsh sentences regardless of the defendant’s age.</p>
<p>&#8220;This keeps happening regularly, but usually there are no details about how exactly the person gets caught,&#8221; he said. &#8220;All cases related to state treason [and] terrorism are classified, so there are barely any details.&#8221;</p>
<p>Tamoian said while he has no direct evidence linking any of the reported arrests and convictions to these phishing sites, he is certain the sites are part of a larger campaign by the Russian government.</p>
<p>&#8220;Considering that they keep them alive and keep spawning more, I assume it might be an efficient thing,&#8221; he said. &#8220;They are on top of DuckDuckGo and Yandex, so it unfortunately works.&#8221;</p>
<p>Further reading: Silent Push report, <a href="https://www.silentpush.com/blog/russian-intelligence-phishing" target="_blank" rel="noopener">Russian Intelligence Targeting its Citizens and Informants</a>.</p>


feed_id: https://krebsonsecurity.com/?p=70660
title: How Each Pillar of the 1st Amendment is Under Attack
uri: How-Each-Pillar-of-the-1st-Amendment-is-Under-Attack
url: https://krebsonsecurity.com/2025/03/how-each-pillar-of-the-1st-amendment-is-under-attack/
content:
<p style="text-align: center;"><em>&#8220;Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.&#8221; -U.S. Constitution, First Amendment.</em></p>
<div id="attachment_70858" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70858" decoding="async" class=" wp-image-70858" src="media/244c6f3d.1stamendment.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/1stamendment.png" alt="" width="747" height="508" /><p id="caption-attachment-70858" class="wp-caption-text">Image: Shutterstock, zimmytws.</p></div>
<p>In an address to Congress this month, <strong>President Trump</strong> claimed he had &#8220;brought free speech back to America.&#8221; But barely two months into his second term, the president has waged an unprecedented attack on the First Amendment rights of journalists, students, universities, government workers, lawyers and judges.</p>
<p>This story explores a slew of recent actions by the Trump administration that threaten to undermine all five pillars of the First Amendment to the U.S. Constitution, which guarantees freedoms concerning speech, religion, the media, the right to assembly, and the right to petition the government and seek redress for wrongs.</p>
<h2>THE RIGHT TO PETITION</h2>
<p>The right to petition allows citizens to communicate with the government, whether to complain, request action, or share viewpoints &#8212; without fear of reprisal. But that right is being assaulted by this administration on multiple levels. For starters, many GOP lawmakers are now heeding their leadership&#8217;s advice to stay away from local town hall meetings and avoid the wrath of constituents affected by the administration&#8217;s many federal budget and workforce cuts.</p>
<p>Another example: President Trump recently <a href="https://www.cnn.com/2025/02/18/politics/opm-privacy-team-fired/index.html" target="_blank" rel="noopener">fired most of the people</a> involved in processing <strong>Freedom of Information Act</strong> (FOIA) requests for government agencies. FOIA is an indispensable tool used by journalists and the public to request government records, and to hold leaders accountable.</p>
<p>The biggest story by far this week was the bombshell from The Atlantic editor <strong>Jeffrey Goldberg</strong>, who recounted how he was <a href="https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/?gift=DjgA9DZGvABas7wFCM-ptk0vpPuikYUZT9Ej3cJbK1s&amp;utm_source=copy-link&amp;utm_medium=social&amp;utm_campaign=share" target="_blank" rel="noopener">inadvertently added to a Signal group chat</a> with <strong>National Security Advisor Michael Waltz</strong> and 16 other Trump administration officials discussing plans for an upcoming attack on Yemen.</p>
<p>One overlooked aspect of Goldberg&#8217;s incredible account is that by planning and coordinating the attack on Signal &#8212; which features messages that can auto-delete after a short time &#8212; administration officials were evidently seeking a way to avoid creating a lasting (and potentially FOIA-able) record of their deliberations.</p>
<p>&#8220;Intentional or not, use of Signal in this context was an act of erasure—because without Jeffrey Goldberg being accidentally added to the list, the general public would never have any record of these communications or any way to know they even occurred,&#8221; <strong>Tony Bradley</strong> <a href="https://www.forbes.com/sites/tonybradley/2025/03/26/what-everyone-has-missed-about-the-trump-administration-signal-scandal/" target="_blank" rel="noopener">wrote this week at Forbes</a>.</p>
<p>Petitioning the government, particularly when it ignores your requests, often requires challenging federal agencies in court. But that becomes far more difficult if the most competent law firms start to shy away from cases that may involve crossing the president and his administration.</p>
<p>On March 22, the president issued <a href="https://www.whitehouse.gov/presidential-actions/2025/03/preventing-abuses-of-the-legal-system-and-the-federal-court/" target="_blank" rel="noopener">a memorandum</a> that directs heads of the Justice and Homeland Security Departments to &#8220;seek sanctions against attorneys and law firms who engage in frivolous, unreasonable and vexatious litigation against the United States,&#8221; or in matters that come before federal agencies.</p>
<p>The POTUS recently issued several executive orders railing against specific law firms with attorneys who worked legal cases against him. On Friday, the <a href="https://www.bloomberg.com/news/articles/2025-03-28/trump-says-he-s-reached-100-million-pro-bono-deal-with-skadden" target="_blank" rel="noopener">president announced</a> that the law firm of <strong>Skadden, Arps, Slate, Meager &amp; Flom</strong> had agreed to provide $100 million in pro bono work on issues that he supports.</p>
<p>Trump issued <a href="https://www.whitehouse.gov/presidential-actions/2025/03/addressing-remedial-action-by-paul-weiss/" target="_blank" rel="noopener">another order</a> naming the firm <strong>Paul, Weiss, Rifkind, Wharton &amp; Garrison</strong>, which ultimately agreed to pledge $40 million in pro bono legal services to the president&#8217;s causes.</p>
<p>Other Trump executive orders targeted law firms <strong>Jenner &amp; Block</strong> and <strong>WilmerHale</strong>, both of which have attorneys that worked with special counsel Robert Mueller on the investigation into Russian interference in the 2016 election. But this week, two federal judges in separate rulings <a href="https://www.cnn.com/2025/03/28/politics/law-firms-fighting-trump-executive-order/index.html" target="_blank" rel="noopener">froze parts of those orders</a>.</p>
<p>&#8220;There is no doubt this retaliatory action chills speech and legal advocacy, and that is qualified as a constitutional harm,&#8221; wrote <strong>Judge Richard Leon</strong>, who ruled against the executive order targeting WilmerHale.</p>
<p>President Trump recently took the extraordinary step of calling for the impeachment of federal judges who rule against the administration. Trump called <strong>U.S. District Judge James Boasberg</strong> <a class=" js-tealium-tracking " href="https://www.politico.com/news/2025/03/18/trump-impeachment-judge-deportations-00235173" target="_blank" rel="noopener" data-tracking="mpos=&amp;mid=&amp;lindex=&amp;lcol=" aria-label=" (Opens in a new window)">a “Radical Left Lunatic”</a> and urged he be removed from office for blocking deportation of Venezuelan alleged gang members under a rarely invoked wartime legal authority.</p>
<p>In a rare public rebuke to a sitting president, <strong>U.S. Supreme Court Justice John Roberts</strong> <a href="https://www.reuters.com/legal/us-chief-justice-roberts-calls-judges-impeachment-are-inappropriate-after-trump-2025-03-18/" target="_blank" rel="noopener">issued a statement on March 18</a> pointing out that &#8220;For more than two centuries, it has been established that impeachment is not an appropriate response to disagreement concerning a judicial decision.&#8221;</p>
<p>The U.S. Constitution provides that judges can be removed from office only through impeachment by the House of Representatives and conviction by the Senate. The Constitution also states that judges&#8217; salaries cannot be reduced while they are in office.</p>
<p>Undeterred, <strong>House Speaker Mike Johnson </strong>this week suggested the administration could still use the power of its purse to keep courts in line, and even <a href="https://www.nbcnews.com/now/video/speaker-mike-johnson-floats-possibility-of-congress-eliminating-federal-courts-235397189724" target="_blank" rel="noopener">floated the idea of wholesale eliminating federal courts</a>.</p>
<p>&#8220;We do have authority over the federal courts as you know,&#8221; Johnson said. &#8220;We can eliminate an entire district court. We have power of funding over the courts, and all these other things. But desperate times call for desperate measures, and Congress is going to act, so stay tuned for that.&#8221;</p>
<h2>FREEDOM OF ASSEMBLY</h2>
<p>President Trump has taken a number of actions to discourage lawful demonstrations at universities and colleges across the country, <a href="https://www.reuters.com/world/us/trump-says-federal-funding-will-stop-colleges-schools-allowing-illegal-protests-2025-03-04/" target="_blank" rel="noopener">threatening to cut federal funding</a> for any college that supports protests he deems &#8220;illegal.&#8221;</p>
<p>A Trump <a href="https://www.whitehouse.gov/presidential-actions/2025/01/additional-measures-to-combat-anti-semitism/" target="_blank" rel="noopener">executive order in January</a> outlined a broad federal crackdown on what he called &#8220;the explosion of antisemitism&#8221; on U.S. college campuses. This administration has asserted that foreign students who are lawfully in the United States on visas do not enjoy the same free speech or due process rights as citizens.</p>
<p><strong>Reuters</strong> reports that the acting civil rights director at the <strong>Department of Education</strong> (DOE) <a href="https://www.ed.gov/about/news/press-release/us-department-of-educations-office-civil-rights-sends-letters-60-universities-under-investigation-antisemitic-discrimination-and-harassment" target="_blank" rel="noopener">on March 10 sent letters to 60 educational institutions</a> warning they could lose federal funding if they don&#8217;t do more to combat anti-semitism. On March 20, Trump issued an order calling for <a href="https://www.ed.gov/about/news/press-release/statement-president-trumps-executive-order-return-power-over-education-states-and-local-communities" target="_blank" rel="noopener">the closure of the DOE</a>.</p>
<p>Meanwhile, <strong>U.S. Immigration and Customs Enforcement</strong> (ICE) agents have been <a href="https://apnews.com/article/immigration-detainees-students-ozturk-khalil-78f544fb2c8b593c88a0c1f0e0ad9c5f" target="_blank" rel="noopener">detaining and trying to deport</a> pro-Palestinian students who are legally in the United States. The administration is targeting students and academics who spoke out against Israel&#8217;s attacks on Gaza, or who were active in campus protests against U.S. support for the attacks. <strong>Secretary of State Marco Rubio</strong> <a href="https://thehill.com/homenews/education/5218410-ice-arrests-tufts-alabama-students-trump-immigration-crackdown-rumeysa-ozturk-khalil/" target="_blank" rel="noopener">told reporters Thursday</a> that at least 300 foreign students have seen their visas revoked under President Trump, a far higher number than was previously known.</p>
<p>In his first term, Trump threatened to use the national guard or the U.S. military to deal with protesters, and in campaigning for re-election he promised to revisit the idea.</p>
<p>“I think the bigger problem is the enemy from within,” Trump told <strong>Fox News</strong> in October 2024. “We have some very bad people. We have some sick people, radical left lunatics. And I think they’re the big — and it should be very easily handled by, if necessary, by National Guard, or if really necessary, by the military, because they can’t let that happen.”</p>
<p>This term, Trump acted swiftly to remove the top judicial advocates in the armed forces who would almost certainly push back on any request by the president to use U.S. soldiers in an effort to quell public protests, or to arrest and detain immigrants. In late February, the president and <strong>Defense Secretary Pete Hegseth</strong> fired the top legal officers for the military services &#8212; those responsible for ensuring the Uniform Code of Military Justice is followed by commanders.</p>
<p>Military.com <a href="https://www.military.com/daily-news/2025/02/24/people-are-very-scared-trump-administration-purge-of-jag-officers-raises-legal-ethical-fears.html" target="_blank" rel="noopener">warns</a> that the purge &#8220;sets an alarming precedent for a crucial job in the military, as President Donald Trump has mused about using the military in unorthodox and potentially illegal ways.&#8221; Hegseth told reporters the removals were necessary because he didn&#8217;t want them to pose any &#8220;roadblocks to orders that are given by a commander in chief.&#8221;<span id="more-70660"></span></p>
<h2>FREEDOM OF THE PRESS</h2>
<p>President Trump has sued a number of U.S. news outlets, including <strong>60 Minutes</strong>, <strong>CNN</strong>, <strong>The Washington Post</strong>, <strong>The New York Times</strong> and other smaller media organizations for unflattering coverage.</p>
<p>In a $10 billion lawsuit against 60 Minutes and its parent <strong>Paramount</strong>, Trump claims they selectively edited an interview with former <strong>Vice President Kamala Harris</strong> prior to the 2024 election. The TV news show last month published transcripts of the interview at the heart of the dispute, but Paramount is <a href="https://apnews.com/article/cbs-60-minutes-lawsuit-trump-pelley-58339cc1a1eb52739bb365e2e8c6d8bc" target="_blank" rel="noopener">reportedly considering a settlement</a> to avoid potentially damaging its chances of winning the administration&#8217;s approval for a pending multibillion-dollar merger.</p>
<p>The president <a href="https://www.desmoinesregister.com/story/news/crime-and-courts/2025/02/25/dismissal-sought-donald-trump-lawsuit-pollster-ann-selzer-des-moines-register-iowa-poll/79442387007/" target="_blank" rel="noopener">sued The Des Moines Register</a> and its parent company, <strong>Gannett</strong>, for publishing a poll showing Trump trailing Harris in the 2024 presidential election in Iowa (a state that went for Trump). The POTUS also is <a href="https://www.politico.com/news/2024/07/21/trump-libel-suit-pulitzer-prize-00169975" target="_blank" rel="noopener">suing the Pulitzer Prize board</a> over 2018 awards given to The New York Times and The Washington Post for their coverage of purported Russian interference in the 2016 election.</p>
<p>Whether or not any of the president&#8217;s lawsuits against news organizations have merit or succeed is almost beside the point. The strategy behind suing the media is to make reporters and newsrooms think twice about criticizing or challenging the president and his administration. The president also knows some media outlets will find it more expedient to settle.</p>
<p>Trump also sued <strong>ABC News</strong> and <strong>George Stephanopoulos</strong> for stating that the president had been found liable for &#8220;rape&#8221; in a civil case [Trump was found liable of sexually abusing and defaming E. Jean Carroll]. ABC parent <strong>Disney</strong> settled that claim by agreeing to donate $15 million to the Trump Presidential Library.</p>
<p>Following the attack on the U.S. Capitol on Jan. 6, 2021, <strong>Facebook</strong> blocked President Trump&#8217;s account. Trump sued <strong>Meta</strong>, and after the president&#8217;s victory in 2024 Meta <a class="sc-19cc8fd2-0 kspHIT" href="https://www.wsj.com/us-news/law/trump-signs-agreement-calling-for-meta-to-pay-25-million-to-settle-suit-6f734c8c?mod=article_inline" target="_blank" rel="noopener" aria-label="Go to https://www.wsj.com/us-news/law/trump-signs-agreement-calling-for-meta-to-pay-25-million-to-settle-suit-6f734c8c?mod=article_inline">settled</a> and agreed to pay Trump $25 million: $22 million would go to his presidential library, and the rest to legal fees. <strong>Meta CEO Mark Zuckerberg</strong> also announced Facebook and Instagram would <a href="https://www.cnn.com/2025/01/07/tech/meta-censorship-moderation/index.html" target="_blank" rel="noopener">get rid of fact-checkers</a> and rely instead on reader-submitted &#8220;community notes&#8221; to debunk disinformation on the social media platform.</p>
<p><strong>Brendan Carr</strong>, the president&#8217;s pick to run the <strong>Federal Communications Commission</strong> (FCC), has pledged to &#8220;dismantle the censorship cartel and restore free speech rights for everyday Americans.&#8221; But on January 22, 2025, the FCC reopened complaints against ABC, <strong>CBS</strong> and <strong>NBC</strong> over their coverage of the 2024 election. The previous FCC chair had dismissed the complaints as attacks on the First Amendment and an attempt to weaponize the agency for political purposes.</p>
<p>According to Reuters, the complaints call for an investigation into how ABC News moderated the pre-election TV debate between Trump and Biden, and appearances of then-Vice President Harris on 60 Minutes and on NBC&#8217;s &#8220;Saturday Night Live.&#8221;</p>
<p>Since then, the FCC has opened investigations into <strong>NPR</strong> and <strong>PBS</strong>, <a href="https://www.npr.org/2025/01/30/nx-s1-5281162/fcc-npr-pbs-investigation" target="_blank" rel="noopener">alleging</a> that they are breaking sponsorship rules. The <strong>Center for Democracy &amp; Technology </strong>(CDT), a think tank based in Washington, D.C., <a href="https://cdt.org/insights/when-it-comes-to-free-speech-the-trump-administration-should-follow-its-own-order/" target="_blank" rel="noopener">noted</a> that the FCC is also investigating <strong>KCBS</strong> in San Francisco for reporting on the location of federal immigration authorities.</p>
<p>&#8220;Even if these investigations are ultimately closed without action, the mere fact of opening them – and the implicit threat to the news stations’ license to operate – can have the effect of deterring the press from news coverage that the Administration dislikes,&#8221; the CDT&#8217;s <strong>Kate Ruane</strong> observed.</p>
<p>Trump has repeatedly threatened to &#8220;open up&#8221; libel laws, with the goal of making it easier to sue media organizations for unfavorable coverage. But this week, the U.S. Supreme Court <a href="https://nymag.com/intelligencer/article/supreme-court-thwarts-trump-dream-of-opening-up-libel-laws.html" target="_blank" rel="noopener">declined to hear a challenge</a> brought by Trump donor and Las Vegas casino magnate Steve Wynn to overturn the landmark 1964 decision in <em>New York Times v. Sullivan</em>, which insulates the press from libel suits over good-faith criticism of public figures.</p>
<p>The president also has insisted on picking which reporters and news outlets should be allowed to cover White House events and participate in the press pool that trails the president. He barred the <strong>Associated Press</strong> from the White House and Air Force One over their refusal to call the Gulf of Mexico by another name.</p>
<p>And the Defense Department has ordered a number of top media outlets <a href="https://www.reuters.com/world/us/pentagon-doubles-number-news-outlets-rotate-out-office-spaces-2025-02-08/" target="_blank" rel="noopener">to vacate their spots at the Pentagon</a>, including CNN, The Hill, The Washington Post, The New York Times, NBC News, Politico and National Public Radio.</p>
<p>&#8220;Incoming media outlets include the New York Post, Breitbart, the Washington Examiner, the Free Press, the Daily Caller, Newsmax, the Huffington Post and One America News Network, most of whom are seen as conservative or favoring Republican President Donald Trump,&#8221; Reuters reported.</p>
<h2>FREEDOM OF SPEECH</h2>
<p>Shortly after Trump took office again in January 2025, the administration began circulating <a href="https://www.nytimes.com/interactive/2025/03/07/us/trump-federal-agencies-websites-words-dei.html" target="_blank" rel="noopener">lists of hundreds of words</a> that government staff and agencies shall not use in their reports and communications.</p>
<p>The Brookings Institution <a href="https://www.brookings.edu/articles/the-us-government-data-purge-is-a-loss-for-policymaking-and-research/" target="_blank" rel="noopener">notes</a> that in moving to comply with this anti-speech directive, federal agencies have purged countless taxpayer-funded data sets from a swathe of government websites, including data on crime, sexual orientation, gender, education, climate, and global development.</p>
<p><strong>The New York Times</strong> reports that in the past two months, hundreds of terabytes of digital resources analyzing data have been taken off government websites.</p>
<p>&#8220;While in many cases the underlying data still exists, the tools that make it possible for the public and researchers to use that data have been removed,&#8221; The Times <a href="https://www.nytimes.com/2025/03/21/climate/government-websites-climate-environment-data.html" target="_blank" rel="noopener">wrote</a>.</p>
<p>On Jan. 27, Trump issued <a href="media/83d78a87.deb7af80-48b6-4b8a-8bfa-3d84fd7c3ec8.pdf" data-original-source="https://www.washingtonpost.com/documents/deb7af80-48b6-4b8a-8bfa-3d84fd7c3ec8.pdf" target="_blank" rel="noopener">a memo</a> (PDF) that paused all federally funded programs pending a review of those programs for alignment with the administration&#8217;s priorities. Among those was ensuring that no funding goes toward advancing &#8220;Marxist equity, transgenderism, and green new deal social engineering policies.&#8221;</p>
<p>According to the CDT, this order is a blatant attempt to force government grantees to cease engaging in speech that the current administration dislikes, including speech about the benefits of diversity, climate change, and LGBTQ issues.</p>
<p>&#8220;The First Amendment does not permit the government to discriminate against grantees because it does not like some of the viewpoints they espouse,&#8221; the CDT&#8217;s Ruane wrote. &#8220;Indeed, those groups that are challenging the constitutionality of the order argued as much in their complaint, and have won an injunction blocking its implementation.&#8221;</p>
<p>On January 20, the same day Trump issued an executive order on free speech, the president also issued an executive order titled “<a href="https://www.whitehouse.gov/presidential-actions/2025/01/reevaluating-and-realigning-united-states-foreign-aid/" target="_blank" rel="noopener">Reevaluating and Realigning United States Foreign Aid</a>,” which froze funding for programs run by the <strong>U.S. Agency for International Development</strong> (USAID). Among those were programs designed to empower civil society and human rights groups, journalists and others responding to digital repression and Internet shutdowns.</p>
<p>According to the <strong>Electronic Frontier Foundation</strong> (EFF), this includes many freedom technologies that use cryptography, fight censorship, protect freedom of speech, privacy and anonymity for millions of people around the world.</p>
<p>&#8220;While the State Department has issued some limited waivers, so far those waivers do not seem to cover the open source internet freedom technologies,&#8221; the EFF <a href="https://www.eff.org/deeplinks/2025/01/executive-order-state-department-sideswipes-freedom-tools-threatens-censorship" target="_blank" rel="noopener">wrote</a> about the USAID disruptions. &#8220;As a result, many of these projects have to stop or severely curtail their work, lay off talented workers, and stop or slow further development.&#8221;</p>
<p>On March 14, the president signed <a href="https://www.whitehouse.gov/presidential-actions/2025/03/continuing-the-reduction-of-the-federal-bureaucracy/" target="_blank" rel="noopener">another executive order</a> that effectively gutted the <strong>U.S. Agency for Global Media</strong> (USAGM), which oversees or funds media outlets including <strong>Radio Free Europe/Radio Liberty</strong> and <strong>Voice of America</strong> (VOA). The USAGM also oversees <strong>Radio Free Asia</strong>, which supporters say has been one of the most reliable tools used by the government to combat Chinese propaganda.</p>
<p>But this week, <strong>U.S. District Court Judge Royce Lamberth</strong>, a Reagan appointee, <a href="https://www.npr.org/2025/03/26/nx-s1-5341321/trump-radio-free-europe-radio-liberty-restraining-order" target="_blank" rel="noopener">temporarily blocked USAGM&#8217;s closure</a> by the administration.</p>
<p>“RFE/RL has, for decades, operated as one of the organizations that Congress has statutorily designated to carry out this policy,” Lamberth <a href="media/9ead46b6.gov.uscourts.dcd.278524.14.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.dcd.278524/gov.uscourts.dcd.278524.14.0.pdf" target="_blank" rel="noreferrer noopener">wrote in a 10-page opinion</a>. “The leadership of USAGM cannot, with one sentence of reasoning offering virtually no explanation, force RFE/RL to shut down — even if the President has told them to do so.”</p>
<h2>FREEDOM OF RELIGION</h2>
<p>The Trump administration <a href="https://www.dhs.gov/news/2025/01/21/statement-dhs-spokesperson-directives-expanding-law-enforcement-and-ending-abuse" target="_blank" rel="noopener">rescinded a decades-old policy</a> that instructed officers not to take immigration enforcement actions in or near &#8220;sensitive&#8221; or &#8220;protected&#8221; places, such as churches, schools, and hospitals.</p>
<p>That directive was immediately challenged in a case brought by a group of Quakers, Baptists and Sikhs, who argued the policy reversal was keeping people from attending services for fear of being arrested on civil immigration violations. On Feb. 24, a federal judge agreed and <a href="https://www.usatoday.com/story/news/politics/2025/02/24/judge-blocks-immigration-enforcement-churches/80043880007/" target="_blank" rel="noopener">blocked</a> ICE agents from entering churches or targeting migrants nearby.</p>
<p>The president&#8217;s executive order allegedly addressing antisemitism came with <a href="https://www.whitehouse.gov/fact-sheets/2025/01/fact-sheet-president-donald-j-trump-takes-forceful-and-unprecedented-steps-to-combat-anti-semitism/" target="_blank" rel="noopener">a fact sheet</a> that described college campuses as &#8220;infested&#8221; with &#8220;terrorists&#8221; and &#8220;jihadists.&#8221; Multiple faith groups expressed alarm over the order, saying it attempts to <a href="https://www.npr.org/2025/03/20/nx-s1-5326047/kenneth-stern-antimsietim-executive-order-free-speech" target="_blank" rel="noopener">weaponize antisemitism</a> and promote &#8220;<a href="https://www.ucc.org/faith-that-calls-for-welcome-confronts-the-harshest-anti-immigrant-policies-in-modern-u-s-history/" target="_blank" rel="noopener">dehumanizing anti-immigrant policies.</a>&#8221;</p>
<p>The president also <a href="https://apnews.com/article/trump-national-prayer-breakfast-30ff6f55a2e3c7b8643a15e7b158537d" target="_blank" rel="noopener">announced</a> the creation of a &#8220;Task Force to Eradicate Anti-Christian Bias,&#8221; to be led by Attorney General Pam Bondi. Never mind that Christianity is easily the largest faith in America and that Christians are well-represented in Congress.</p>
<p>The <strong>Rev. Paul Brandeis Raushenbush</strong>, a Baptist minister and head of the progressive <strong>Interfaith Alliance</strong>, issued a statement accusing Trump of hypocrisy in claiming to champion religion by creating the task force.</p>
<p>“From allowing immigration raids in churches, to targeting faith-based charities, to suppressing religious diversity, the Trump Administration’s aggressive government overreach is infringing on religious freedom in a way we haven’t seen for generations,” Raushenbush said.</p>
<p>A <a href="https://www.au.org/the-latest/press/task-force-anti-christian-bias-trump/" target="_blank" rel="noopener">statement</a> from <strong>Americans United for Separation of Church and State</strong> said the task force could lead to religious persecution of those with other faiths.</p>
<p>&#8220;Rather than protecting religious beliefs, this task force will misuse religious freedom to justify bigotry, discrimination, and the subversion of our civil rights laws,&#8221; said Rachel Laser, the group&#8217;s president and CEO.</p>
<p>Where is President Trump going with all these blatant attacks on the First Amendment? The president has made no secret of his affection for autocratic leaders and &#8220;strongmen&#8221; around the world, and he is particularly enamored with Hungary&#8217;s far-right <strong>Prime Minister Viktor Orbán</strong>, who has visited Trump&#8217;s Mar-a-Lago resort twice in the past year.</p>
<p>A <a href="https://www.theatlantic.com/ideas/archive/2025/03/trumps-press-freedom-hungary-orban/682060/" target="_blank" rel="noopener">March 15 essay</a> in The Atlantic by Hungarian investigative journalist <strong>András Pethő</strong> recounts how Orbán rose to power by consolidating control over the courts, and by building his own media universe while simultaneously placing a stranglehold on the independent press.</p>
<p>&#8220;As I watch from afar what’s happening to the free press in the United States during the first weeks of Trump’s second presidency — the verbal bullying, the legal harassment, the buckling by media owners in the face of threats — it all looks very familiar,&#8221; Pethő wrote. &#8220;The MAGA authorities have learned Orbán’s lessons well.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=70780
title: Cyber Forensic Expert in 2,000+ Cases Faces FBI Probe
uri: Cyber-Forensic-Expert-in-2-000-Cases-Faces-FBI-Probe
url: https://krebsonsecurity.com/2025/04/cyber-forensic-expert-in-2000-cases-faces-fbi-probe/
content:
<p>A Minnesota cybersecurity and computer forensics expert whose testimony has featured in thousands of courtroom trials over the past 30 years is facing questions about his credentials and an inquiry from the <strong>Federal Bureau of Investigation</strong> (FBI). Legal experts say the inquiry could be grounds to reopen a number of adjudicated cases in which the expert&#8217;s testimony may have been pivotal.</p>
<div id="attachment_70889" style="width: 827px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70889" decoding="async" class="size-full wp-image-70889" src="media/8d78de65.marklanterman-linkedin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/marklanterman-linkedin.png" alt="" width="817" height="597" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/marklanterman-linkedin.png 817w, https://krebsonsecurity.com/wp-content/uploads/2025/03/marklanterman-linkedin-768x561.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/marklanterman-linkedin-782x571.png 782w" sizes="(max-width: 817px) 100vw, 817px" /><p id="caption-attachment-70889" class="wp-caption-text">One might conclude from reading Mr. Lanterman&#8217;s LinkedIn profile that has a degree from Harvard University.</p></div>
<p><strong><a href="https://www.linkedin.com/in/marklanterman" target="_blank" rel="noopener">Mark Lanterman</a></strong> is a former investigator for the U.S. Secret Service Electronics Crimes Task Force who founded the Minneapolis consulting firm <strong>Computer Forensic Services</strong> (CFS). The CFS website says Lanterman&#8217;s 30-year career has seen him testify as an expert in more than 2,000 cases, with experience in cases involving sexual harassment and workplace claims, theft of intellectual property and trade secrets, white-collar crime, and class action lawsuits.</p>
<p>Or at least it did until last month, when Lanterman&#8217;s profile and work history were quietly removed from the CFS website. The removal came after <strong>Hennepin County Attorney&#8217;s Office</strong> <a href="https://www.hennepinattorney.org/news/news/2025/March/lanterman-disclosure" target="_blank" rel="noopener">said</a> it was notifying parties to ten pending cases that they were unable to verify Lanterman&#8217;s educational and employment background. The county attorney also said the FBI is now investigating the allegations.</p>
<p>Those allegations were raised by <strong>Sean Harrington</strong>, an attorney and forensics examiner based in Prescott, Wisconsin. Harrington alleged that Lanterman lied under oath in court on multiple occasions when he testified that he has a Bachelor of Science and a Master&#8217;s degree in computer science from the now-defunct <strong>Upsala College</strong>, and that he completed his postgraduate work in cybersecurity at <strong>Harvard University</strong>.</p>
<p>Harrington&#8217;s claims gained steam thanks to digging by the law firm <strong>Perkins Coie LLP</strong>, which is defending a case wherein a client&#8217;s laptop was forensically reviewed by Lanterman. On March 14, Perkins Coie attorneys <a href="media/ad4da42a.155-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/155-1.pdf" target="_blank" rel="noopener">asked the judge</a> (PDF) to strike Lanterman&#8217;s testimony because neither he nor they could substantiate claims about his educational background.</p>
<p>Upsala College, located in East Orange, N.J., operated for 102 years until it closed in 1995 after a period of declining enrollment and financial difficulties. Perkins Coie told the court that they&#8217;d visited <strong>Felician University</strong>, which holds the transcripts for Upsala College during the years Lanterman claimed to have earned undergraduate and graduate degrees. The law firm said Felician <a href="media/afabd4ab.155-21.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/155-21.pdf" target="_blank" rel="noopener">had no record of transcripts for Lanterman</a> (PDF), and that his name was absent from all of the Upsala College student yearbooks and commencement programs during that period.</p>
<p>Reached for comment, Lanterman acknowledged he had no way to prove he attended Upsala College, and that his &#8220;postgraduate work&#8221; at Harvard was in fact an eight-week online cybersecurity class called <strong>HarvardX</strong>, which cautions that its certificates should not be considered equivalent to a Harvard degree or a certificate earned through traditional, in-person programs at Harvard University.</p>
<p>Lanterman has testified that his first job after college was serving as a police officer in Springfield Township, Pennsylvania, although the Perkins Coie attorneys noted that this role was omitted from his resume. The attorneys said when they tried to verify Lanterman&#8217;s work history, &#8220;the police department responded with a story that would be almost impossible to believe if it was not corroborated by Lanterman&#8217;s own email communications.&#8221;</p>
<p>As recounted in the March 14 filing, Lanterman was deposed on Feb. 11, and the following day <a href="media/afabd4ab.155-21.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/155-21.pdf" target="_blank" rel="noopener">he emailed the Springfield Township Police Department</a> to see if he could have a peek at his old personnel file. On Feb. 14, Lanterman visited the Springfield Township PD and asked to borrow his employment record. He told the officer he spoke with on the phone that he&#8217;d recently been instructed to &#8220;get his affairs in order&#8221; after being diagnosed with a grave heart condition, and that he wanted his old file to show his family about his early career.</p>
<p>According to Perkins Coie, Lanterman left the Springfield Township PD with his personnel file, and has not returned it as promised.</p>
<p>&#8220;It is shocking that an expert from Minnesota would travel to suburban Philadelphia and abscond with his decades-old personnel file to obscure his background,&#8221; the law firm wrote. &#8220;That appears to be the worst and most egregious form of spoliation, and the deception alone is reason enough to exclude Lanterman and consider sanctions.&#8221;</p>
<p>Harrington initially contacted KrebsOnSecurity about his concerns in late 2023, fuming after sitting through <a href="https://www.dropbox.com/scl/fi/srxrxkwyf03inudrw9ymn/2023-Seminar-Recording-copy-copy-1.MP4?rlkey=th0yqylm5uvmq84skfg8qvfh3&amp;e=1&amp;dl=0" target="_blank" rel="noopener">a conference speech</a> in which Lanterman shared documents from a ransomware victim and told attendees it was because they&#8217;d refused to hire his company to perform a forensic investigation on a recent breach.</p>
<p>&#8220;He claims he was involved in the Martha Stewart investigation, the Bernie Madoff trial, Paul McCartney’s divorce, the Tom Petters investigation, the Denny Hecker investigation, and many others,&#8221; Harrington said. &#8220;He claims to have been invited to speak to the Supreme Court, claims to train the &#8216;entire federal judiciary&#8217; on cybersecurity annually, and is a faculty member of the United States Judicial Conference and the Judicial College — positions which he obtained, in part, on a house of fraudulent cards.&#8221;</p>
<p>In an interview this week, Harrington said court documents reveal that at least two of Lanterman&#8217;s previous clients complained CFS had held their data for ransom over billing disputes. In <a href="media/e6c66bca.2022-10-26_Declaration-ofKimberlyHanlon.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/2022-10-26_Declaration-ofKimberlyHanlon.pdf" target="_blank" rel="noopener">a declaration</a> (PDF) dated August 2022, the co-founder of the law firm <strong>MoreLaw Minneapolis LLC</strong> said she hired Lanterman in 2014 to examine several electronic devices after learning that one of their paralegals had a criminal fraud history.</p>
<p>But the law firm said when it pushed back on a consulting bill that was far higher than expected, Lanterman told them CFS would &#8220;escalate&#8221; its collection efforts if they didn&#8217;t pay, including &#8220;a claim and lien against the data which will result in a public auction of your data.&#8221;</p>
<p>&#8220;All of us were flabbergasted by Mr. Lanterman’s email,&#8221; wrote MoreLaw co-founder <strong>Kimberly Hanlon</strong>. &#8220;I had never heard of any legitimate forensic company threatening to &#8216;auction&#8217; off an attorney’s data, particularly knowing that the data is comprised of confidential client data, much of which is sensitive in nature.&#8221;<span id="more-70780"></span></p>
<p>In 2009, a Wisconsin-based manufacturing company that had hired Lanterman for computer forensics balked at paying an $86,000 invoice from CFS, calling it &#8220;excessive and unsubstantiated.&#8221; The company told a Hennepin County court that on April 15, 2009, CFS conducted an auction of its trade secret information in violation of their confidentiality agreement.</p>
<p>&#8220;CFS noticed and conducted a Public Sale of electronic information that was entrusted to them pursuant to the terms of the engagement agreement,&#8221; the company wrote. &#8220;CFS submitted the highest bid at the Public Sale in the amount of $10,000.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-70891" src="media/11a4a361.27-cv-12-22089-ExtrusionDiesIndustries.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/27-cv-12-22089-ExtrusionDiesIndustries.png" alt="" width="1039" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/03/27-cv-12-22089-ExtrusionDiesIndustries.png 1039w, https://krebsonsecurity.com/wp-content/uploads/2025/03/27-cv-12-22089-ExtrusionDiesIndustries-768x324.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/03/27-cv-12-22089-ExtrusionDiesIndustries-782x330.png 782w" sizes="(max-width: 1039px) 100vw, 1039px" /></p>
<p>Lanterman briefly responded to a list of questions about his background (and recent heart diagnosis) on March 24, saying he would send detailed replies the following day. Those replies never materialized. Instead, Lanterman forwarded a recent memo he wrote to the court that attacked Harrington and said his accuser was only trying to take out a competitor. He has not responded to further requests for comment.</p>
<p>&#8220;When I attended Upsala, I was a commuter student who lived with my grandparents in Morristown, New Jersey approximately 30 minutes away from Upsala College,&#8221; Lanterman <a href="media/7f78f78b.ACU-Plasmold-Lanterman-Repsonse-Letter.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/ACU-Plasmold-Lanterman-Repsonse-Letter.pdf" target="_blank" rel="noopener">explained to the judge</a> (PDF) overseeing <a href="media/32046426.2025-03-12_memo-toCourt-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/2025-03-12_memo-toCourt-1.pdf" target="_blank" rel="noopener">a separate ongoing case</a> (PDF) in which he has testified. &#8220;With limited resources, I did not participate in campus social events, nor did I attend graduation ceremonies. In 2023, I confirmed with Felician University — which maintains Upsala College’s records — that they could not locate my transcripts or diploma, a situation that they indicated was possibly due to unresolved money-related issues.&#8221;</p>
<p>Lanterman was ordered to appear in court on April 3 in the case defended by Perkins Coie, but he did not show up. Instead, he sent a message to the judge withdrawing from the case.</p>
<p>&#8220;I am 60 years old,&#8221; Lanterman <a href="media/6f2b1df1.lanterman-retire.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/lanterman-retire.png" target="_blank" rel="noopener">told the judge</a>. &#8220;I created my business from nothing. I am done dealing with the likes of individuals like Sean Harrington. And quite frankly, I have been planning at turning over my business to my children for years. That time has arrived.&#8221;</p>
<p>Lanterman&#8217;s letter leaves the impression that it was his decision to retire. But according to <a href="media/01b3e50d.affidavit-seanlanterman.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/affidavit-seanlanterman.pdf" target="_blank" rel="noopener">an affidavit</a> (PDF) filed in a Florida case on March 28, Mark Lanterman&#8217;s son Sean said he&#8217;d made the difficult decision to ask his dad to step down given all the negative media attention.</p>
<p><strong>Mark Rasch</strong>, a former federal cybercrime prosecutor who now serves as counsel to the New York cybersecurity intelligence firm <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a>, said that if an expert witness is discredited, any defendants who lost cases that were strongly influenced by that expert&#8217;s conclusions at trial could have grounds for appeal.</p>
<p>Rasch said law firms who propose an expert witness have a duty in good faith to vet that expert&#8217;s qualifications, knowing that those credentials will be subject to cross-examination.</p>
<p>&#8220;Federal rules of civil procedure and evidence both require experts to list every case they have testified in as an expert for the past few years,&#8221; Rasch said. &#8220;Part of that due diligence is pulling up the results of those cases and seeing what the nature of their testimony has been.&#8221;</p>
<p>Perhaps the most well-publicized case involving significant forensic findings from Lanterman was the 2018 conviction of <strong>Stephen Allwine</strong>, who was <a href="https://www.fox9.com/news/convicted-dark-net-killer-claims-innocence-i-couldnt-have-done-it" target="_blank" rel="noopener">found guilty of killing his wife</a> two years earlier after attempts at hiring a hitman on the dark net fell through. Allwine is serving a sentence of life in prison, and continues to maintain that he was framed, casting doubt on computer forensic evidence found on 64 electronic devices taken from his home.</p>
<p>On March 24, Allwine <a href="media/71a08d3e.78.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/03/78.pdf" target="_blank" rel="noopener">petitioned a Minnesota court</a> (PDF) to revisit his case, citing the accusations against Lanterman and his role as a key witness for the prosecution.</p>


feed_id: https://krebsonsecurity.com/?p=70933
title: Patch Tuesday, April 2025 Edition
uri: Patch-Tuesday-April-2025-Edition
url: https://krebsonsecurity.com/2025/04/patch-tuesday-april-2025-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug at least 121 security holes in its <strong>Windows</strong> operating systems and software, including one vulnerability that is already being exploited in the wild. Eleven of those flaws earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning malware or malcontents could exploit them with little to no interaction from Windows users.</p>
<p><img decoding="async" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="750" height="528" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>The zero-day flaw already seeing exploitation is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-29824" target="_blank" rel="noopener">CVE-2025-29824</a>, a local elevation of privilege bug in the Windows <strong>Common Log File System</strong> (CLFS) driver.  Microsoft rates it as &#8220;important,&#8221; but as <strong>Chris Goettl</strong> from <strong>Ivanti</strong> points out, risk-based prioritization warrants treating it as critical.</p>
<p>This CLFS component of Windows is no stranger to Patch Tuesday: According to Tenable&#8217;s <strong>Satnam Narang</strong>, since 2022 Microsoft has patched 32 CLFS vulnerabilities &#8212; averaging 10 per year &#8212; with six of them exploited in the wild. The <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-49138" target="_blank" rel="noopener">last CLFS zero-day</a> was <a href="https://krebsonsecurity.com/2024/12/patch-tuesday-december-2024-edition/" target="_blank" rel="noopener">patched in December 2024</a>.</p>
<p>Narang notes that while flaws allowing attackers to install arbitrary code are consistently top overall Patch Tuesday features, the data is reversed for zero-day exploitation.</p>
<p>&#8220;For the past two years, elevation of privilege flaws have led the pack and, so far in 2025, account for over half of all zero-days exploited,&#8221; Narang wrote.<span id="more-70933"></span></p>
<p>Rapid7&#8217;s <strong>Adam Barnett</strong> warns that any Windows defenders responsible for an <a href="https://en.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol" target="_blank" rel="noopener">LDAP server</a> — which means almost any organization with a non-trivial Microsoft footprint — should add <span class="il">patching</span> for the critical flaw <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-26663" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-26663&amp;source=gmail&amp;ust=1744231709116000&amp;usg=AOvVaw3moAqrbzoHqolAikc6dYLo">CVE-2025-26663</a> to their to-do list.</p>
<p>&#8220;With no privileges required, no need for user interaction, and code execution presumably in the context of the LDAP server itself, successful exploitation would be an attractive shortcut to any attacker,&#8221; Barnett said. &#8220;Anyone wondering if today is a re-run of December 2024 <span class="il">Patch</span> <span class="il">Tuesday</span> can take some small solace in the fact that the worst of the <a href="https://www.rapid7.com/blog/post/2024/12/10/patch-tuesday-december-2024/#ldap-critical-rce" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.rapid7.com/blog/post/2024/12/10/patch-tuesday-december-2024/%23ldap-critical-rce&amp;source=gmail&amp;ust=1744231709116000&amp;usg=AOvVaw2C4e66FL53_LrZBhrndLUw">trio of LDAP critical RCEs published at the end of last year</a> was likely easier to exploit than today’s example, since today’s CVE-2025-26663 requires that an attacker win a race condition. Despite that, Microsoft still expects that exploitation is more likely.&#8221;</p>
<p>Among the critical updates Microsoft patched this month are remote code execution flaws in <strong>Windows Remote Desktop </strong>services (RDP), including <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-26671" target="_blank" rel="noopener">CVE-2025-26671</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-27480" target="_blank" rel="noopener">CVE-2025-27480</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-27482" target="_blank" rel="noopener">CVE-2025-27482</a>; only the latter two are rated &#8220;critical,&#8221; and Microsoft marked both of them as “Exploitation More Likely.&#8221;</p>
<p>Perhaps the most widespread vulnerabilities fixed this month were in web browsers. <strong>Google Chrome</strong> <a href="https://chromereleases.googleblog.com/" target="_blank" rel="noopener">updated</a> to fix 13 flaws this week, and <strong>Mozilla Firefox </strong>fixed <a href="https://www.mozilla.org/en-US/security/advisories/mfsa2025-20/" target="_blank" rel="noopener">eight bugs</a>, with possibly more updates coming later this week for <strong>Microsoft</strong> <strong>Edge</strong>.</p>
<p>As it tends to do on Patch Tuesdays, <strong>Adobe</strong> has <a href="https://helpx.adobe.com/security/security-bulletin.html" target="_blank" rel="noopener">released 12 updates</a> resolving 54 security holes across a range of products, including <strong>ColdFusion</strong>, <strong>Adobe Commerce</strong>, <strong>Experience Manager Forms</strong>, <strong>After Effects</strong>, <strong>Media Encoder</strong>, <strong>Bridge</strong>, <strong>Premiere Pro</strong>, <strong>Photoshop</strong>, <strong>Animate</strong>, <strong>AEM Screens</strong>, and <strong>FrameMaker</strong>.</p>
<p><strong>Apple</strong> users may need to patch as well. On March 31, Apple released a huge security update (more than three gigabytes in size) to fix issues in a range of their products, including <a href="https://www.bleepingcomputer.com/news/security/apple-backports-zero-day-patches-to-older-iphones-and-macs/" target="_blank" rel="noopener">at least one zero-day flaw</a>.</p>
<p>And in case you missed it, on March 31, 2025 <strong>Apple</strong> released <a href="https://support.apple.com/en-us/100100?is=1ef7934f6635b02395adcab09a0c1b24bf0ea745b648bfe87189de8aadc7300b" target="_blank" rel="noopener">a rather large batch of security updates</a> for a wide range of their products, from <strong>macOS</strong> to the<strong> iOS</strong> operating systems on <strong>iPhones</strong> and <strong>iPads</strong>.</p>
<p>Earlier today, Microsoft included a note saying <strong>Windows 10</strong> security updates weren&#8217;t available but would be released as soon as possible. It appears from browsing <a href="https://www.askwoody.com/2025/april-2025-updates-out/" target="_blank" rel="noopener">askwoody.com</a> that this snafu has since been rectified. Either way, if you run into complications applying any of these updates please leave a note about it in the comments below, because the chances are good that someone else had the same problem.</p>
<p>As ever, please consider backing up your data and or devices prior to updating, which makes it far less complicated to undo a software update gone awry. For more granular details on today&#8217;s Patch Tuesday, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft%20April%202025%20Patch%20Tuesday/31838/">SANS Internet Storm Center&#8217;s roundup</a>. Microsoft&#8217;s update guide for April 2025 <a href="https://msrc.microsoft.com/update-guide/releaseNote/2025-Apr" target="_blank" rel="noopener">is here</a>.</p>
<p>For more details on Patch Tuesday, check out the write-ups from <a href="https://www.action1.com/patch-tuesday/patch-tuesday-april-2025/?vyj" target="_blank" rel="noopener">Action1</a> and <a href="https://www.automox.com/blog/patch-tuesday-april-2025" target="_blank" rel="noopener">Automox</a>.</p>


feed_id: https://krebsonsecurity.com/?p=70793
title: China-based SMS Phishing Triad Pivots to Banks
uri: China-based-SMS-Phishing-Triad-Pivots-to-Banks
url: https://krebsonsecurity.com/2025/04/china-based-sms-phishing-triad-pivots-to-banks/
content:
<p>China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from <strong>Apple</strong> and <strong>Google</strong>. Until recently, the so-called &#8220;<strong>Smishing Triad</strong>&#8221; mainly impersonated toll road operators and shipping companies. But experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime infrastructure and support staff.</p>
<div id="attachment_70947" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70947" decoding="async" class=" wp-image-70947" src="media/bbee156d.wall-o-phones.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/wall-o-phones.png" alt="" width="750" height="762" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/wall-o-phones.png 868w, https://krebsonsecurity.com/wp-content/uploads/2025/04/wall-o-phones-768x780.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/wall-o-phones-782x794.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70947" class="wp-caption-text">An image of an iPhone device farm shared on Telegram by one of the Smishing Triad members. Image: Prodaft.</p></div>
<p>If you own a mobile device, the chances are excellent that at some point in the past two years you&#8217;ve received at least one instant message that warns of a delinquent toll road fee, or a wayward package from the <strong>U.S. Postal Service </strong>(USPS). Those who click the promoted link are brought to a website that spoofs the USPS or a local toll road operator and asks for payment card information.</p>
<p>The site will then complain that the visitor&#8217;s bank needs to &#8220;verify&#8221; the transaction by sending a one-time code via SMS. In reality, the bank is sending that code to the mobile number on file for their customer because the fraudsters have just attempted to enroll that victim&#8217;s card details into a mobile wallet.</p>
<p>If the visitor supplies that one-time code, their payment card is then added to a new mobile wallet on an Apple or Google device that is physically controlled by the phishers. The phishing gangs typically load <a href="media/4b420841.phishingphones.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/02/phishingphones.png" target="_blank" rel="noopener">multiple stolen cards to digital wallets on a single Apple or Android device</a>, and then sell those phones in bulk to scammers who use them for fraudulent e-commerce and tap-to-pay transactions.</p>
<div id="attachment_70953" style="width: 759px" class="wp-caption aligncenter"><a href="media/4ed0cc67.mobwalletimage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/mobwalletimage.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70953" decoding="async" loading="lazy" class="wp-image-70953" src="media/4ed0cc67.mobwalletimage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/mobwalletimage.png" alt="" width="749" height="396" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/mobwalletimage.png 1322w, https://krebsonsecurity.com/wp-content/uploads/2025/04/mobwalletimage-768x405.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/mobwalletimage-782x413.png 782w, https://krebsonsecurity.com/wp-content/uploads/2025/04/mobwalletimage-267x140.png 267w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-70953" class="wp-caption-text">A screenshot of the administrative panel for a smishing kit. On the left is the (test) data entered at the phishing site. On the right we can see the phishing kit has superimposed the supplied card number onto an image of a payment card. When the phishing kit scans that created card image into Apple or Google Pay, it triggers the victim&#8217;s bank to send a one-time code. Image: Ford Merrill.</p></div>
<p>The moniker &#8220;Smishing Triad&#8221; comes from <strong>Resecurity</strong>, which was among <a href="https://www.resecurity.com/blog/article/smishing-triad-targeted-usps-and-us-citizens-for-data-theft" target="_blank" rel="noopener">the first to report in August 2023</a> on the emergence of three distinct mobile phishing groups based in China that appeared to share some infrastructure and innovative phishing techniques. But it is a bit of a misnomer because the phishing lures blasted out by these groups are not SMS or text messages in the conventional sense.</p>
<p>Rather, they are sent via <strong>iMessage</strong> to <strong>Apple</strong> device users, and via RCS on <strong>Google Android</strong> devices. Thus, the missives bypass the mobile phone networks entirely and enjoy near 100 percent delivery rate (at least until Apple and Google suspend the spammy accounts).</p>
<p>In <a href="https://catalyst.prodaft.com/public/report/lucid/overview" target="_blank" rel="noopener">a report</a> published on March 24, the Swiss threat intelligence firm <strong>Prodaft</strong> detailed the rapid pace of innovation coming from the Smishing Triad, which it characterizes as a loosely federated group of Chinese phishing-as-a-service operators with names like <strong>Darcula</strong>, <strong>Lighthouse</strong>, and the <strong>Xinxin Group</strong>.</p>
<p>Prodaft said they&#8217;re seeing a significant shift in the underground economy, particularly among Chinese-speaking threat actors who have historically operated in the shadows compared to their Russian-speaking counterparts.</p>
<p>&#8220;Chinese-speaking actors are introducing innovative and cost-effective systems, enabling them to target larger user bases with sophisticated services,&#8221; Prodaft wrote. &#8220;Their approach marks a new era in underground business practices, emphasizing scalability and efficiency in cybercriminal operations.&#8221;</p>
<p>A <a href="https://www.silentpush.com/blog/smishing-triad/" target="_blank" rel="noopener">new report</a> from researchers at the security firm <strong>SilentPush</strong> finds the Smishing Triad members have expanded into selling mobile phishing kits targeting customers of global financial institutions like <strong>CitiGroup</strong>, <strong>MasterCard</strong>, <strong>PayPal</strong>,<strong> Stripe</strong>, and <strong>Visa</strong>, as well as banks in Canada, Latin America, Australia and the broader Asia-Pacific region.</p>
<div id="attachment_70946" style="width: 733px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70946" decoding="async" loading="lazy" class="size-full wp-image-70946" src="media/fc026cd1.paypalsmish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/paypalsmish.png" alt="" width="723" height="512" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/paypalsmish.png 723w, https://krebsonsecurity.com/wp-content/uploads/2025/04/paypalsmish-100x70.png 100w" sizes="(max-width: 723px) 100vw, 723px" /><p id="caption-attachment-70946" class="wp-caption-text">Phishing lures from the Smishing Triad spoofing PayPal. Image: SilentPush.</p></div>
<p>SilentPush found the Smishing Triad now spoofs recognizable brands in a variety of industry verticals across at least 121 countries and a vast number of industries, including the postal, logistics, telecommunications, transportation, finance, retail and public sectors.</p>
<p>According to SilentPush, the domains used by the Smishing Triad are rotated frequently, with approximately 25,000 phishing domains active during any 8-day period and a majority of them sitting at two Chinese hosting companies: <strong>Tencent</strong> (AS132203) and <strong>Alibaba</strong> (AS45102).<span id="more-70793"></span></p>
<p class="p1">&#8220;With nearly two-thirds of all countries in the world targeted by [the] Smishing Triad, it’s safe to say they are essentially targeting every country with modern infrastructure outside of Iran, North Korea, and Russia,&#8221; SilentPush wrote. &#8220;Our team has observed some potential targeting in Russia (such as domains that mentioned their country codes), but nothing definitive enough to indicate Russia is a persistent target. Interestingly, even though these are Chinese threat actors, we have seen instances of targeting aimed at Macau and Hong Kong, both special administrative regions of China.&#8221;</p>
<p>SilentPush&#8217;s <strong>Zach Edwards</strong> said his team found a vulnerability that exposed data from one of the Smishing Triad&#8217;s phishing pages, which revealed the number of visits each site received each day across thousands of phishing domains that were active at the time. Based on that data, SilentPush estimates those phishing pages received well more than a million visits within a 20-day time span.</p>
<p class="p1">The report notes the Smishing Triad boasts it has “300+ front desk staff worldwide” involved in one of their more popular phishing kits &#8212; Lighthouse &#8212; staff that is mainly used to support various aspects of the group&#8217;s fraud and cash-out schemes.</p>
<p>The Smishing Triad members maintain their own Chinese-language sales channels on Telegram, which frequently offer videos and photos of their staff hard at work. Some of those images include massive walls of phones used to send phishing messages, with human operators seated directly in front of them ready to receive any time-sensitive one-time codes.</p>
<p>As noted in February&#8217;s story <a href="https://krebsonsecurity.com/2025/02/how-phished-data-turns-into-apple-google-wallets/" target="_blank" rel="noopener">How Phished Data Turns Into Apple and Google Wallets</a>, one of those cash-out schemes involves an Android app called <strong>Z-NFC</strong>, which can relay a valid NFC transaction from one of these compromised digital wallets to anywhere in the world. For a $500 month subscription, the customer can wave their phone at any payment terminal that accepts Apple or Google pay, and the app will relay an NFC transaction over the Internet from a stolen wallet on a phone in China.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/ekqZjPAxB4c?si=hYLqGPIBrNthAg9_" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Chinese nationals were recently busted trying to use these NFC apps to buy high-end electronics in Singapore. And in the United States, authorities in California and Tennessee <a href="https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/" target="_blank" rel="noopener">arrested Chinese nationals accused of using NFC apps</a> to fraudulently purchase gift cards from retailers.</p>
<p>The Prodaft researchers said they were able to find a previously undocumented backend management panel for <strong>Lucid</strong>, a smishing-as-a-service operation tied to the XinXin Group. The panel included victim figures that suggest the smishing campaigns maintain an average success rate of approximately five percent, with some domains receiving over 500 visits per week.</p>
<p>&#8220;In one observed instance, a single phishing website captured 30 credit card records from 550 victim interactions over a 7-day period,&#8221; Prodaft wrote.</p>
<p>Prodaft&#8217;s report details how the Smishing Triad has achieved such success in sending their spam messages. For example, one phishing vendor appears to send out messages using dozens of Android device emulators running in parallel on a single machine.</p>
<div id="attachment_70950" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70950" decoding="async" loading="lazy" class=" wp-image-70950" src="media/2b0c2658.virtualandroid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/virtualandroid.png" alt="" width="749" height="834" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/virtualandroid.png 1121w, https://krebsonsecurity.com/wp-content/uploads/2025/04/virtualandroid-768x855.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/virtualandroid-782x871.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-70950" class="wp-caption-text">Phishers using multiple virtualized Android devices to orchestrate and distribute RCS-based scam campaigns. Image: Prodaft.</p></div>
<p>According to Prodaft, the threat actors first acquire phone numbers through various means including data breaches, open-source intelligence, or purchased lists from underground markets. They then exploit technical gaps in sender ID validation within both messaging platforms.</p>
<p>&#8220;For iMessage, this involves creating temporary Apple IDs with impersonated display names, while RCS exploitation leverages carrier implementation inconsistencies in sender verification,&#8221; Prodaft wrote. &#8220;Message delivery occurs through automated platforms using VoIP numbers or compromised credentials, often deployed in precisely timed multi-wave campaigns to maximize effectiveness.</p>
<p>In addition, the phishing links embedded in these messages use time-limited single-use URLs that expire or redirect based on device fingerprinting to evade security analysis, they found.</p>
<p>&#8220;The economics strongly favor the attackers, as neither RCS nor iMessage messages incur per-message costs like traditional SMS, enabling high-volume campaigns at minimal operational expense,&#8221; Prodaft continued. &#8220;The overlap in templates, target pools, and tactics among these platforms underscores a unified threat landscape, with Chinese-speaking actors driving innovation in the underground economy. Their ability to scale operations globally and evasion techniques pose significant challenges to cybersecurity defenses.&#8221;</p>
<p><strong>Ford Merrill</strong> works in security research at <a href="https://www.secalliance.com/" target="_blank" rel="noopener">SecAlliance</a>, a <a href="https://www.csis.com/" target="_blank" rel="noopener">CSIS Security Group</a> company. Merrill said he&#8217;s observed at least one video of a Windows binary that wraps a Chrome executable and can be used to load in target phone numbers and blast messages via RCS, iMessage, Amazon, Instagram, Facebook, and WhatsApp.</p>
<p>&#8220;The evidence we’ve observed suggests the ability for a single device to send approximately 100 messages per second,&#8221; Merrill said. &#8220;We also believe that there is capability to source country specific SIM cards in volume that allow them to register different online accounts that require validation with specific country codes, and even make those SIM cards available to the physical devices long-term so that services that rely on checks of the validity of the phone number or SIM card presence on a mobile network are thwarted.&#8221;</p>
<p>Experts say this fast-growing wave of card fraud persists because far too many financial institutions still default to sending one-time codes via SMS for validating card enrollment in mobile wallets from Apple or Google. KrebsOnSecurity interviewed multiple security executives at non-U.S. financial institutions who spoke on condition of anonymity because they were not authorized to speak to the press. Those banks have since done away with SMS-based one-time codes and are now requiring customers to log in to the bank’s mobile app before they can link their card to a digital wallet.</p>


feed_id: https://krebsonsecurity.com/?p=70970
title: Trump Revenge Tour Targets Cyber Leaders, Elections
uri: Trump-Revenge-Tour-Targets-Cyber-Leaders-Elections
url: https://krebsonsecurity.com/2025/04/trump-revenge-tour-targets-cyber-leaders-elections/
content:
<p><strong>President Trump</strong> last week revoked security clearances for <strong>Chris Krebs</strong>, the former director of the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA) who was fired by Trump after declaring the 2020 election the most secure in U.S. history. The White House memo, which also suspended clearances for other security professionals at Krebs&#8217;s employer <strong>SentinelOne</strong>, comes as CISA is facing huge funding and staffing cuts.</p>
<div id="attachment_70987" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70987" decoding="async" class=" wp-image-70987" src="media/f7e3d64c.chriskrebs-gi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/chriskrebs-gi.png" alt="" width="750" height="330" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/chriskrebs-gi.png 883w, https://krebsonsecurity.com/wp-content/uploads/2025/04/chriskrebs-gi-768x337.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/chriskrebs-gi-782x344.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70987" class="wp-caption-text">Chris Krebs. Image: Getty Images.</p></div>
<p>The extraordinary <a href="https://www.whitehouse.gov/fact-sheets/2025/04/fact-sheet-president-donald-j-trump-addresses-risks-from-chris-krebs-and-government-censorship/" target="_blank" rel="noopener">April 9 memo</a> directs the attorney general to investigate Chris Krebs (no relation), calling him &#8220;a significant bad-faith actor who weaponized and abused his government authority.&#8221;</p>
<p>The memo said the inquiry will include &#8220;a comprehensive evaluation of all of CISA&#8217;s activities over the last 6 years and will identify any instances where Krebs&#8217; or CISA&#8217;s conduct appears to be contrary to the administration’s commitment to free speech and ending federal censorship, including whether Krebs’ conduct was contrary to suitability standards for federal employees or involved the unauthorized dissemination of classified information.&#8221;</p>
<p>CISA was created in 2018 during Trump&#8217;s first term, with Krebs installed as its first director. In 2020, CISA launched Rumor Control, a website that sought to rebut disinformation swirling around the 2020 election.</p>
<p>That effort ran directly counter to Trump&#8217;s claims that he lost the election because it was somehow hacked and stolen. The Trump campaign and its supporters filed at least 62 lawsuits contesting the election, vote counting, and vote certification in nine states, and nearly all of those cases were dismissed or dropped for lack of evidence or standing.</p>
<p>When the Justice Department began prosecuting people who violently attacked the U.S. Capitol on January 6, 2021, President Trump and Republican leaders shifted the narrative, claiming that Trump lost the election because the previous administration had censored conservative voices on social media.</p>
<p>Incredibly, the president&#8217;s memo seeking to ostracize Krebs stands reality on its head, accusing Krebs of promoting the censorship of election information, &#8220;including known risks associated with certain voting practices.&#8221; Trump also alleged that Krebs &#8220;<em>falsely and baselessly denied that the 2020 election was rigged and stolen</em>, including by inappropriately and categorically dismissing widespread election malfeasance and serious vulnerabilities with voting machines&#8221; [emphasis added].</p>
<p>Krebs did not respond to a request for comment. SentinelOne issued <a href="https://www.sentinelone.com/blog/an-official-statement-in-response-to-the-april-9-2025-executive-order/" target="_blank" rel="noopener">a statement</a> saying it would cooperate in any review of security clearances held by its personnel, which is currently fewer than 10 employees.</p>
<p>Krebs&#8217;s former agency is now facing steep budget and staff reductions. <strong>The Record</strong> <a href="https://therecord.media/trump-administration-planning-workforce-cuts-at-cisa/" target="_blank" rel="noopener">reports</a> that CISA is looking to remove some 1,300 people by cutting about half its full-time staff and another 40% of its contractors.</p>
<p>&#8220;The agency’s National Risk Management Center, which serves as a hub analyzing risks to cyber and critical infrastructure, is expected to see significant cuts, said two sources familiar with the plans,&#8221; The Record&#8217;s <strong>Suzanne Smalley</strong> wrote. &#8220;Some of the office’s systematic risk responsibilities will potentially be moved to the agency’s Cybersecurity Division, according to one of the sources.&#8221;</p>
<p>CNN <a href="https://archive.ph/InCFx#selection-2323.226-2323.412" target="_blank" rel="noopener">reports</a> the Trump administration is also advancing plans to strip civil service protections from 80% of the remaining CISA employees, potentially allowing them to be fired for political reasons.</p>
<p>The <strong>Electronic Frontier Foundation</strong> (EFF) urged professionals in the cybersecurity community to defend Krebs and SentinelOne, noting that other security companies and professionals could be the next victims of Trump&#8217;s efforts to politicize cybersecurity.</p>
<p>&#8220;The White House must not be given free reign to turn cybersecurity professionals into political scapegoats,&#8221; the EFF <a href="https://www.eff.org/deeplinks/2025/04/cybersecurity-community-must-not-remain-silent-executive-order-attacking-former" target="_blank" rel="noopener">wrote</a>. &#8220;It is critical that the cybersecurity community now join together to denounce this chilling attack on free speech and rally behind Krebs and SentinelOne rather than cowering because they fear they will be next.&#8221;</p>
<p>However, <strong>Reuters</strong> <a href="https://www.reuters.com/world/us/cybersecurity-industry-falls-silent-trump-turns-ire-sentinelone-2025-04-10/" target="_blank" rel="noopener">said</a> it found little sign of industry support for Krebs or SentinelOne, and that many security professionals are concerned about potentially being targeted if they speak out.</p>
<p>&#8220;Reuters contacted 33 of the largest U.S. cybersecurity companies, including tech companies and professional services firms with large cybersecurity practices, and three industry groups, for comment on Trump&#8217;s action against SentinelOne,&#8221; wrote <strong>Raphael Satter</strong> and <strong>A.J. Vicens</strong>. &#8220;Only one offered comment on Trump&#8217;s action. The rest declined, did not respond or did not answer questions.&#8221;</p>
<h2>CYBERCOM-PLICATIONS</h2>
<p>On April 3, President Trump fired <strong>Gen. Timothy Haugh</strong>, the head of the <strong>National Security Agency </strong>(NSA) and the <strong>U.S. Cyber Command</strong>, as well as Haugh&#8217;s deputy, <strong>Wendy Noble</strong>. The president did so immediately after meeting in the Oval Office with far-right conspiracy theorist <a href="https://en.wikipedia.org/wiki/Laura_Loomer" target="_blank" rel="noopener">Laura Loomer</a>, who reportedly urged their dismissal. Speaking to reporters on Air Force One after news of the firings broke, Trump questioned Haugh&#8217;s loyalty.</p>
<div id="attachment_70998" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70998" decoding="async" loading="lazy" class=" wp-image-70998" src="media/e54bbac5.genhaugh-cspan.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/genhaugh-cspan.png" alt="" width="749" height="377" /><p id="caption-attachment-70998" class="wp-caption-text">Gen. Timothy Haugh. Image: C-SPAN.</p></div>
<p>Virginia <strong>Senator Mark Warner</strong>, the top Democrat on the Senate Intelligence Committee, called it inexplicable that the administration would remove the senior leaders of NSA-CYBERCOM without cause or warning, and risk disrupting critical ongoing intelligence operations.</p>
<p>“It is astonishing, too, that President Trump would fire the nonpartisan, experienced leader of the National Security Agency while still failing to hold any member of his team accountable for leaking classified information on a commercial messaging app – even as he apparently takes staffing direction on national security from a discredited conspiracy theorist in the Oval Office,&#8221; Warner said in a statement.</p>
<p>On Feb. 28, The Record&#8217;s <strong>Martin Matishak</strong> <a href="https://therecord.media/hegseth-orders-cyber-command-stand-down-russia-planning" target="_blank" rel="noopener">cited</a> three sources saying Defense Secretary <strong>Pete Hegseth</strong> ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions. The following day, <strong>The Guardian</strong> <a href="https://www.theguardian.com/us-news/2025/feb/28/trump-russia-hacking-cyber-security?ref=zetter-zeroday.com" target="_blank" rel="noopener">reported</a> that analysts at CISA were verbally informed that they were not to follow or report on Russian threats, even though this had previously been a main focus for the agency.</p>
<p>A <a href="https://www.washingtonpost.com/national-security/2025/03/01/trump-putin-russia-cyber-offense-cisa" target="_blank" rel="noopener">follow-up story</a> from <strong>The Washington Post</strong> cited officials saying Cyber Command had received an order to halt active operations against Russia, but that the pause was intended to last only as long as negotiations with Russia continue.</p>
<p>The Department of Defense responded on Twitter/X that Hegseth had &#8220;neither canceled nor delayed any cyber operations directed against malicious Russian targets and there has been no stand-down order whatsoever from that priority.&#8221;</p>
<p>But on March 19, Reuters <a href="https://www.yahoo.com/news/exclusive-us-suspends-efforts-counter-060549726.html" target="_blank" rel="noopener">reported</a> several U.S. national security agencies have halted work on a coordinated effort to counter Russian sabotage, disinformation and cyberattacks.</p>
<p>&#8220;Regular meetings between the National Security Council and European national security officials have gone unscheduled, and the NSC has also stopped formally coordinating efforts across U.S. agencies, including with the FBI, the Department of Homeland Security and the State Department,&#8221; Reuters reported, citing current and former officials.<span id="more-70970"></span></p>
<h2>TARIFFS VS TYPHOONS</h2>
<p>President&#8217;s Trump&#8217;s institution of 125% tariffs on goods from China has seen Beijing strike back with 84 percent tariffs on U.S. imports. Now, some security experts are warning that the trade war <a href="https://www.theregister.com/2025/04/10/trade_war_reaches_cyberspace/" target="_blank" rel="noopener">could spill over into a cyber conflict</a>, given China&#8217;s successful efforts to burrow into America&#8217;s critical infrastructure networks.</p>
<p>Over the past year, a number of Chinese government-backed digital intrusions have come into focus, including a sprawling espionage campaign involving the compromise of <a href="https://www.cybersecuritydive.com/news/salt-typhoon-telecom-attacks-lax-security/736233/" target="_blank" rel="noopener">at least nine U.S. telecommunications providers</a>. Dubbed &#8220;<a href="https://www.nytimes.com/2024/10/26/us/politics/salt-typhoon-hack-what-we-know.html" target="_blank" rel="noopener">Salt Typhoon</a>&#8221; by Microsoft, these telecom intrusions were pervasive enough that CISA and the FBI in December 2024 <a href="https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure" target="_blank" rel="noopener">warned Americans</a> against communicating sensitive information over phone networks, urging people instead to use encrypted messaging apps (like Signal).</p>
<p>The other broad ranging China-backed campaign is known as &#8220;<a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a" target="_blank" rel="noopener">Volt Typhoon</a>,&#8221; which CISA described as &#8220;state-sponsored cyber actors seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States.&#8221;</p>
<p>Responsibility for determining the root causes of the Salt Typhoon security debacle fell to the <a href="https://en.wikipedia.org/wiki/Cyber_Safety_Review_Board" target="_blank" rel="noopener">Cyber Safety Review Board</a> (CSRB), a nonpartisan government entity established in February 2022 with a mandate to investigate the security failures behind major cybersecurity events. But on his first full day back in the White House, President Trump dismissed all 15 CSRB advisory committee members &#8212; likely because those advisers included Chris Krebs.</p>
<p>Last week, <strong>Sen. Ron Wyden</strong> (D-Ore.) placed a hold on Trump&#8217;s nominee to lead CISA, saying the hold would continue unless the agency published a report on the telecom industry hacks, as promised.</p>
<div class="text__text__1FZLe text__dark-grey__3Ml43 text__regular__2N1Xr text__small__1kGq2 body__full_width__ekUdw body__small_body__2vQyf article-body__paragraph__2-BtD" data-testid="paragraph-6">
<p>&#8220;CISA&#8217;s multi-year cover up of the phone companies&#8217; negligent cybersecurity has real consequences,&#8221; Wyden said in <a href="https://www.wyden.senate.gov/news/press-releases/wyden-places-hold-on-top-cybersecurity-nominee-to-force-release-of-important-details-on-security-threats-to-us-phone-networks" target="_blank" rel="noopener">a statement</a>. &#8220;Congress and the American people have a right to read this report.&#8221;</p>
<p><strong>The Wall Street Journal</strong> reported last week Chinese officials acknowledged in a secret December meeting that Beijing was behind the widespread telecom industry compromises.</p>
<p>&#8220;The Chinese official&#8217;s remarks at the December meeting were indirect and somewhat ambiguous, but most of the American delegation in the room interpreted it as a tacit admission and a warning to the U.S. about Taiwan,&#8221; The Journal&#8217;s <strong>Dustin Volz</strong> <a href="https://www.wsj.com/politics/national-security/in-secret-meeting-china-acknowledged-role-in-u-s-infrastructure-hacks-c5ab37cb" target="_blank" rel="noopener">wrote</a>, citing a former U.S. official familiar with the meeting.</p>
<p>Meanwhile, China continues to take advantage of the mass firings of federal workers. On April 9, the <strong>National Counterintelligence and Security Center</strong> <a href="media/7d218cbc.2025-04-08-NCSC-FBI-DCSA-OnlineTargetingUSGEmployees.pdf" data-original-source="https://www.dni.gov/files/NCSC/documents/products/2025-04-08-NCSC-FBI-DCSA-OnlineTargetingUSGEmployees.pdf" target="_blank" rel="noopener">warned</a> (PDF) that Chinese intelligence entities are pursuing an online effort to recruit recently laid-off U.S. employees.</p>
<p>&#8220;Foreign intelligence entities, particularly those in China, are targeting current and former U.S. government (USG) employees for recruitment by posing as consulting firms, corporate headhunters, think tanks, and other entities on social and professional networking sites,&#8221; the alert warns. &#8220;Their deceptive online job offers, and other virtual approaches, have become more sophisticated in targeting unwitting individuals with USG backgrounds seeking new employment.&#8221;</p>
<div id="attachment_70985" style="width: 759px" class="wp-caption aligncenter"><a href="media/a02e0ab9.dni-china-hiring.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/dni-china-hiring.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-70985" decoding="async" loading="lazy" class="wp-image-70985" src="media/a02e0ab9.dni-china-hiring.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/dni-china-hiring.png" alt="" width="749" height="416" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/dni-china-hiring.png 1406w, https://krebsonsecurity.com/wp-content/uploads/2025/04/dni-china-hiring-768x426.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/dni-china-hiring-782x434.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-70985" class="wp-caption-text">Image: Dni.gov</p></div>
<h2>ELECTION THREATS</h2>
<p>As Reuters <a href="https://www.reuters.com/world/us-suspends-some-efforts-counter-russian-sabotage-trump-moves-closer-putin-2025-03-19/" target="_blank" rel="noopener">notes</a>, the FBI last month ended an effort to counter interference in U.S. elections by foreign adversaries including Russia, and put on leave staff working on the issue at the Department of Homeland Security.</p>
<p>Meanwhile, the U.S. Senate is now considering a <a href="https://www.nytimes.com/2025/04/10/us/politics/house-citizenship-elections-save-act.html" target="_blank" rel="noopener">House-passed bill</a> dubbed the &#8220;<strong>Safeguard American Voter Eligibility (SAVE) Act</strong>,&#8221; which would order states to obtain proof of citizenship, such as a passport or a birth certificate, <a href="https://www.nytimes.com/2025/04/10/us/politics/house-citizenship-elections-save-act.html" target="_blank" rel="noopener">in person from those seeking to register to vote</a>.</p>
<p>Critics say the SAVE Act could disenfranchise millions of voters and discourage eligible voters from registering to vote. What&#8217;s more, documented cases of voter fraud are few and far between, as is voting by non-citizens. Even the conservative <strong>Heritage Foundation</strong> acknowledges as much: An interactive &#8220;<a href="https://electionfraud.heritage.org/search" target="_blank" rel="noopener">election fraud map</a>&#8221; published by Heritage lists just 1,576 convictions or findings of voter fraud between 1982 and the present day.</p>
<p>Nevertheless, the GOP-led House passed the SAVE Act with the help of four Democrats. Its passage in the Senate will require support from at least seven Democrats, Newsweek <a href="https://www.newsweek.com/democrats-who-could-cross-aisle-save-act-2058792" target="_blank" rel="noopener">writes</a>.</p>
<p>In February, CISA cut roughly 130 employees, including its election security advisors. The agency also was forced to freeze all election security activities pending an internal review. The review was <a href="https://www.brennancenter.org/our-work/research-reports/how-federal-government-undermining-election-security" target="_blank" rel="noopener">reportedly</a> completed in March, but the Trump administration has said the findings would not be made public, and there is no indication of whether any cybersecurity support has been restored.</p>
<p>Many state leaders have voiced anxiety over the administration&#8217;s cuts to CISA programs that provide assistance and threat intelligence to election security efforts. <strong>Iowa Secretary of State Paul Pate</strong> last week <a href="https://www.thegazette.com/campaigns-elections/iowas-top-elections-official-concerned-over-cybersecurity-funding-pause/" target="_blank" rel="noopener">told</a> the <strong>PBS</strong> show I<strong>owa Press</strong> he would not want to see those programs dissolve.</p>
<p>&#8220;If those (systems) were to go away, it would be pretty serious,&#8221; Pate said. &#8220;We do count on a lot those cyber protections.&#8221;</p>
<p>Pennsylvania&#8217;s <strong>Secretary of the Commonwealth Al Schmidt</strong> recently warned the CISA election security cuts would make elections less secure, and said no state on its own can replace federal election cybersecurity resources.</p>
<p>The <strong>Pennsylvania Capital-Star</strong> <a href="https://penncapital-star.com/election-2025/no-state-on-its-own-can-replace-federal-election-cybersecurity-resources-pa-voting-official-says/" target="_blank" rel="noopener">reports</a> that several local election offices received bomb threats around the time polls closed on Nov. 5, and that in the week before the election a fake video showing mail-in ballots cast for Trump and Sen. Dave McCormick (R-Pa.) being destroyed and thrown away was linked to a Russian disinformation campaign.</p>
<p>&#8220;CISA was able to quickly identify not only that it was fraudulent, but also the source of it, so that we could share with our counties and we could share with the public so confidence in the election wasn’t undermined,&#8221; Schmidt said.</p>
<p>According to <a href="https://archive.ph/InCFx#selection-2339.13-2339.483" target="_blank" rel="noopener">CNN</a>, the administration&#8217;s actions have deeply alarmed state officials, who warn the next round of national elections will be seriously imperiled by the cuts. A bipartisan association representing 46 secretaries of state, and several individual top state election officials, have pressed the White House about how critical functions of protecting election security will perform going forward. However, CNN reports they have yet to receive clear answers.</p>
<p>Nevada and 18 other states are suing Trump over <a href="https://www.whitehouse.gov/presidential-actions/2025/03/preserving-and-protecting-the-integrity-of-american-elections/" target="_blank" rel="noopener">an executive order he issued on March 25</a> that asserts the executive branch has broad authority over state election procedures.</p>
<p>&#8220;None of the president’s powers allow him to change the rules of elections,&#8221; Nevada Secretary of State <strong>Cisco Aguilar</strong> wrote in <a href="https://www.msnbc.com/opinion/msnbc-opinion/nevada-18-states-are-suing-trump-election-executive-order-rcna200427" target="_blank" rel="noopener">an April 11 op-ed</a>. &#8220;That is an intentional feature of our Constitution, which the Framers built in to ensure election integrity. Despite that, Trump is seeking to upend the voter registration process; impose arbitrary deadlines on vote counting; allow an unelected and unaccountable billionaire to invade state voter rolls; and withhold congressionally approved funding for election security.&#8221;</p>
<p>The order instructs the <strong>U.S. Election Assistance Commission</strong> to abruptly amend the voluntary federal guidelines for voting machines without going through the processes mandated by federal law. And it calls for allowing the administrator of the so-called <strong>Department of Government Efficiency</strong> (DOGE), along with DHS, to review state voter registration lists and other records to identify non-citizens.</p>
<p>The Atlantic&#8217;s <strong>Paul Rosenzweig</strong> notes that the chief executive of the country &#8212; whose unilateral authority the Founding Fathers most feared &#8212; has literally no role in the federal election system.</p>
<p>&#8220;Trump&#8217;s executive order on elections ignores that design entirely,&#8221; Rosenzweig <a href="https://www.theatlantic.com/ideas/archive/2025/04/trump-election-rules-changes/682394/" target="_blank" rel="noopener">wrote</a>. &#8220;He is asserting an executive-branch role in governing the mechanics of a federal election that has never before been claimed by a president. The legal theory undergirding this assertion &#8212; that the president&#8217;s authority to enforce federal law enables him to control state election activity &#8212; is as capacious as it is frightening.&#8221;</p>
</div>


feed_id: https://krebsonsecurity.com/?p=71010
title: Funding Expires for Key Cyber Vulnerability Database
uri: Funding-Expires-for-Key-Cyber-Vulnerability-Database
url: https://krebsonsecurity.com/2025/04/funding-expires-for-key-cyber-vulnerability-database/
content:
<p>A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization <strong>MITRE</strong> warned today that its contract to maintain the <strong>Common Vulnerabilities and Exposures</strong> (CVE) program &#8212; which is traditionally funded each year by the Department of Homeland Security &#8212; expires on April 16.</p>
<div id="attachment_71016" style="width: 752px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71016" decoding="async" class=" wp-image-71016" src="media/5cf1ab65.mitreletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/mitreletter.png" alt="" width="742" height="942" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/mitreletter.png 788w, https://krebsonsecurity.com/wp-content/uploads/2025/04/mitreletter-768x975.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/mitreletter-782x992.png 782w" sizes="(max-width: 742px) 100vw, 742px" /><p id="caption-attachment-71016" class="wp-caption-text">A letter from MITRE vice president Yosry Barsoum, warning that the funding for the CVE program will expire on April 16, 2025.</p></div>
<p>Tens of thousands of security flaws in software are found and reported every year, and these vulnerabilities are eventually assigned their own unique CVE tracking number (e.g. <a href="https://www.cve.org/CVERecord?id=CVE-2024-43573" target="_blank" rel="noopener">CVE-2024-43573</a>, which is a <strong>Microsoft Windows</strong> bug that Redmond patched last year).</p>
<p>There are hundreds of organizations &#8212; known as <strong>CVE Numbering Authorities</strong> (CNAs) &#8212; that are authorized by MITRE to bestow these CVE numbers on newly reported flaws. Many of these CNAs are country and government-specific, or tied to individual software vendors or vulnerability disclosure platforms (a.k.a. bug bounty programs).</p>
<p>Put simply, MITRE is a critical, widely-used resource for centralizing and standardizing information on software vulnerabilities. That means the pipeline of information it supplies is plugged into an array of cybersecurity tools and services that help organizations identify and patch security holes &#8212; ideally before malware or malcontents can wriggle through them.</p>
<p>&#8220;What the CVE lists really provide is a standardized way to describe the severity of that defect, and a centralized repository listing which versions of which products are defective and need to be updated,&#8221; said <a href="https://www.lawfaremedia.org/contributors/mtait" target="_blank" rel="noopener">Matt Tait</a>, chief operating officer of <strong>Corellium</strong>, a cybersecurity firm that sells phone-virtualization software for finding security flaws.</p>
<p>In a letter sent today to the CVE board, MITRE Vice President <strong>Yosry Barsoum </strong>warned that on April 16, 2025, &#8220;the current contracting pathway for MITRE to develop, operate and modernize CVE and several other related programs will expire.&#8221;</p>
<p>&#8220;If a break in service were to occur, we anticipate multiple impacts to CVE, including deterioration of national vulnerability databases and advisories, tool vendors, incident response operations, and all manner of critical infrastructure,&#8221; Barsoum wrote.</p>
<p>MITRE told KrebsOnSecurity the CVE website listing vulnerabilities will remain up after the funding expires, but that new CVEs won&#8217;t be added after April 16.</p>
<div id="attachment_71017" style="width: 760px" class="wp-caption aligncenter"><a href="media/0bea7c21.CVE-Lifecycle.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/CVE-Lifecycle.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71017" decoding="async" loading="lazy" class="wp-image-71017" src="media/0bea7c21.CVE-Lifecycle.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/CVE-Lifecycle.png" alt="" width="750" height="335" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/CVE-Lifecycle.png 1926w, https://krebsonsecurity.com/wp-content/uploads/2025/04/CVE-Lifecycle-768x343.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/CVE-Lifecycle-1536x686.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/04/CVE-Lifecycle-782x349.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-71017" class="wp-caption-text">A representation of how a vulnerability becomes a CVE, and how that information is consumed. Image: James Berthoty, Latio Tech, via LinkedIn.</p></div>
<p>DHS officials did not immediately respond to a request for comment. The program is funded through DHS&#8217;s <strong>Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA), which is currently facing <a href="https://krebsonsecurity.com/2025/04/trump-revenge-tour-targets-cyber-leaders-elections/" target="_blank" rel="noopener">deep budget and staffing cuts by the Trump administration</a>.<span id="more-71010"></span></p>
<p>Former CISA Director<strong> Jen Easterly</strong> said the CVE program is a bit like the Dewey Decimal System, but for cybersecurity.</p>
<p>&#8220;It’s the global catalog that helps everyone—security teams, software vendors, researchers, governments—organize and talk about vulnerabilities using the same reference system,&#8221; Easterly said in <a href="https://www.linkedin.com/feed/update/urn:li:activity:7318021583191617538/" target="_blank" rel="noopener">a post on LinkedIn</a>. &#8220;Without it, everyone is using a different catalog or no catalog at all, no one knows if they’re talking about the same problem, defenders waste precious time figuring out what’s wrong, and worst of all, threat actors take advantage of the confusion.&#8221;</p>
<p><strong>John Hammond</strong>, principal security researcher at the managed security firm <strong>Huntress</strong>, <a href="https://www.reuters.com/technology/us-funding-running-out-critical-cyber-vulnerability-database-manager-says-2025-04-15/" target="_blank" rel="noopener">told Reuters</a> he swore out loud when he heard the news that CVE&#8217;s funding was in jeopardy, and that losing the CVE program would be like losing &#8220;the language and lingo we used to address problems in cybersecurity.&#8221;</p>
<p>&#8220;I really can&#8217;t help but think this is just going to hurt,&#8221; said Hammond, who posted <a href="https://www.youtube.com/watch?v=itbsfeqrRY4" target="_blank" rel="noopener">a Youtube video</a> to vent about the situation and alert others.</p>
<p>Several people close to the matter told KrebsOnSecurity this is not the first time the CVE program&#8217;s budget has been left in funding limbo until the last minute. Barsoum&#8217;s letter, which was apparently leaked, sounded a hopeful note, saying the government is making &#8220;considerable efforts to continue MITRE&#8217;s role in support of the program.&#8221;</p>
<p>Tait said that without the CVE program, risk managers inside companies would need to continuously monitor many other places for information about new vulnerabilities that may jeopardize the security of their IT networks. Meaning, it may become more common that software updates get mis-prioritized, with companies having hackable software deployed for longer than they otherwise would, he said.</p>
<p>&#8220;Hopefully they will resolve this, but otherwise the list will rapidly fall out of date and stop being useful,&#8221; he said.</p>


feed_id: https://krebsonsecurity.com/?p=71035
title: Whistleblower: DOGE Siphoned NLRB Case Data
uri: Whistleblower-DOGE-Siphoned-NLRB-Case-Data
url: https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/
content:
<p>A security architect with the <strong>National Labor Relations Board</strong> (NLRB) alleges that employees from <strong>Elon Musk</strong>&#8216;s <strong>Department of Government Efficiency</strong> (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB whistleblower said the unusual large data outflows coincided with multiple blocked login attempts from an Internet address in Russia that tried to use valid credentials for a newly-created DOGE user account.</p>
<div id="attachment_71048" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71048" decoding="async" class=" wp-image-71048" src="media/2d43249d.beruliscomplaint.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/beruliscomplaint.png" alt="" width="749" height="823" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/beruliscomplaint.png 786w, https://krebsonsecurity.com/wp-content/uploads/2025/04/beruliscomplaint-768x844.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/beruliscomplaint-782x860.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71048" class="wp-caption-text">The cover letter from Berulis&#8217;s whistleblower statement, sent to the leaders of the Senate Select Committee on Intelligence.</p></div>
<p>The allegations came in an April 14 letter to the Senate Select Committee on Intelligence, signed by <strong>Daniel J. Berulis</strong>, a 38-year-old security architect at the NLRB.</p>
<p><strong>NPR</strong>, which was the <a href="https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security" target="_blank" rel="noopener">first to report</a> on Berulis&#8217;s whistleblower complaint, says NLRB is a small, independent federal agency that investigates and adjudicates complaints about unfair labor practices, and stores &#8220;reams of potentially sensitive data, from confidential information about employees who want to form unions to proprietary business information.&#8221;</p>
<p>The complaint documents a one-month period beginning March 3, during which DOGE officials reportedly demanded the creation of all-powerful &#8220;tenant admin&#8221; accounts in NLRB systems that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts.</p>
<p>Berulis said the new DOGE accounts had unrestricted permission to read, copy, and alter information contained in NLRB databases. The new accounts also could restrict log visibility, delay retention, route logs elsewhere, or even remove them entirely &#8212; top-tier user privileges that neither Berulis nor his boss possessed.</p>
<p>Berulis writes that on March 3, a black SUV accompanied by a police escort arrived at his building &#8212; the NLRB headquarters in Southeast Washington, D.C. The DOGE staffers did not speak with Berulis or anyone else in NLRB&#8217;s IT staff, but instead met with the agency leadership.</p>
<p>&#8220;Our acting chief information officer told us not to adhere to standard operating procedure with the DOGE account creation, and there was to be no logs or records made of the accounts created for DOGE employees, who required the highest level of access,&#8221; Berulis wrote of their instructions after that meeting.</p>
<p>&#8220;We have built in roles that auditors can use and have used extensively in the past but would not give the ability to make changes or access subsystems without approval,&#8221; he continued. &#8220;The suggestion that they use these accounts was not open to discussion.&#8221;</p>
<p>Berulis found that on March 3 one of the DOGE accounts created an opaque, virtual environment known as a &#8220;container,&#8221; which can be used to build and run programs or scripts without revealing its activities to the rest of the world. Berulis said the container caught his attention because he polled his colleagues and found none of them had ever used containers within the NLRB network.</p>
<p>Berulis said he also noticed that early the next morning &#8212; between approximately 3 a.m. and 4 a.m. EST on Tuesday, March 4  &#8212; there was a large increase in outgoing traffic from the agency. He said it took several days of investigating with his colleagues to determine that one of the new accounts had transferred approximately 10 gigabytes worth of data from the NLRB&#8217;s <strong>NxGen</strong> case management system.</p>
<p>Berulis said neither he nor his co-workers had the necessary network access rights to review which files were touched or transferred &#8212; or even where they went. But his complaint notes the NxGen database contains sensitive information on unions, ongoing legal cases, and corporate secrets.</p>
<p>&#8220;I also don’t know if the data was only 10gb in total or whether or not they were consolidated and compressed prior,&#8221; Berulis told the senators. &#8220;This opens up the possibility that even more data was exfiltrated. Regardless, that kind of spike is extremely unusual because data almost never directly leaves NLRB’s databases.&#8221;</p>
<p>Berulis said he and his colleagues grew even more alarmed when they noticed nearly two dozen login attempts from a Russian Internet address (83.149.30,186) that presented valid login credentials for a DOGE employee account &#8212; one that had been created just minutes earlier. Berulis said those attempts were all blocked thanks to rules in place that prohibit logins from non-U.S. locations.</p>
<p>&#8220;Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating,&#8221; Berulis wrote. &#8220;There were more than 20 such attempts, and what is particularly concerning is that many of these login attempts occurred within 15 minutes of the accounts being created by DOGE engineers.&#8221;</p>
<p>According to Berulis, the naming structure of one Microsoft user account connected to the suspicious activity suggested it had been created and later deleted for DOGE use in the NLRB&#8217;s cloud systems: &#8220;<strong>DogeSA_2d5c3e0446f9@nlrb.microsoft.com</strong>.&#8221; He also found other new Microsoft cloud administrator accounts with nonstandard usernames, including &#8220;<strong>Whitesox, Chicago M.</strong>&#8221; and &#8220;<strong>Dancehall, Jamaica R</strong>.&#8221;</p>
<div id="attachment_71042" style="width: 759px" class="wp-caption aligncenter"><a href="media/da783e83.whitesoxchicago.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/whitesoxchicago.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71042" decoding="async" loading="lazy" class="wp-image-71042" src="media/da783e83.whitesoxchicago.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/whitesoxchicago.png" alt="" width="749" height="556" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/whitesoxchicago.png 1072w, https://krebsonsecurity.com/wp-content/uploads/2025/04/whitesoxchicago-768x570.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/whitesoxchicago-782x581.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-71042" class="wp-caption-text">A screenshot shared by Berulis showing the suspicious user accounts.</p></div>
<p>On March 5, Berulis documented that a large section of logs for recently created network resources were missing, and a network watcher in <strong>Microsoft Azure</strong> was set to the &#8220;off&#8221; state, meaning it was no longer collecting and recording data like it should have.</p>
<p>Berulis said he discovered someone had downloaded three external code libraries from <strong>GitHub</strong> that neither NLRB nor its contractors ever use. A &#8220;readme&#8221; file in one of the code bundles explained it was created to rotate connections through a large pool of cloud Internet addresses that serve &#8220;as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.&#8221; Brute force attacks involve automated login attempts that try many credential combinations in rapid sequence.</p>
<p>The complaint alleges that by March 17 it became clear the NLRB no longer had the resources or network access needed to fully investigate the odd activity from the DOGE accounts, and that on March 24, the agency&#8217;s associate chief information officer had agreed the matter should be reported to <strong>US-CERT</strong>. Operated by the Department of Homeland Security&#8217;s <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA), US-CERT provides on-site cyber incident response capabilities to federal and state agencies.</p>
<p>But Berulis said that between April 3 and 4, he and the associate CIO were informed that &#8220;instructions had come down to drop the US-CERT reporting and investigation and we were directed not to move forward or create an official report.&#8221; Berulis said it was at this point he decided to go public with his findings.<span id="more-71035"></span></p>
<div id="attachment_71050" style="width: 695px" class="wp-caption aligncenter"><a href="media/9bda8329.berulis-mar4-spike.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/berulis-mar4-spike.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71050" decoding="async" loading="lazy" class="wp-image-71050 size-full" src="media/9bda8329.berulis-mar4-spike.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/berulis-mar4-spike.png" alt="" width="685" height="908" /></a><p id="caption-attachment-71050" class="wp-caption-text">An email from Daniel Berulis to his colleagues dated March 28, referencing the unexplained traffic spike earlier in the month and the unauthorized changing of security controls for user accounts.</p></div>
<p><strong>Tim Bearese</strong>, the NLRB&#8217;s acting press secretary, told NPR that DOGE neither requested nor received access to its systems, and that &#8220;the agency conducted an investigation after Berulis raised his concerns but &#8216;determined that no breach of agency systems occurred.'&#8221; The NLRB did not respond to questions from KrebsOnSecurity.</p>
<p>Nevertheless, Berulis has shared a number of supporting screenshots showing agency email discussions about the unexplained account activity attributed to the DOGE accounts, as well as NLRB security alerts from Microsoft about network anomalies observed during the timeframes described.</p>
<p>As <strong>CNN</strong> <a href="https://www.cnn.com/2025/02/15/business/nlrb-trump-musk-workers/index.html#:~:text=Musk's%20SpaceX%20brought%20a%20case,it%20for%20firing%20some%20employees." target="_blank" rel="noopener">reported</a> last month, the NLRB has been effectively hobbled since <strong>President Trump</strong> fired three board members, leaving the agency without the quorum it needs to function.</p>
<p>&#8220;Despite its limitations, the agency had become a thorn in the side of some of the richest and most powerful people in the nation — notably Elon Musk, Trump’s key supporter both financially and arguably politically,&#8221; CNN wrote.</p>
<p>Both <strong>Amazon</strong> and Musk&#8217;s <strong>SpaceX</strong> have <a href="https://apnews.com/article/amazon-nlrb-unconstitutional-spacex-elon-musk-ab42977117d883e97110a7bf8e8b257f" target="_blank" rel="noopener">been suing</a> the NLRB over complaints the agency filed in disputes about workers&#8217; rights and union organizing, arguing that the NLRB&#8217;s very existence is unconstitutional. On March 5, a U.S. appeals court <a href="https://www.reuters.com/legal/government/musks-spacex-loses-early-legal-challenge-us-labor-boards-powers-2025-03-05/" target="_blank" rel="noopener">unanimously rejected</a> Musk&#8217;s claim that the NLRB&#8217;s structure somehow violates the Constitution.</p>
<p>Berulis shared screenshots with KrebsOnSecurity showing that on the day the NPR published its story about his claims (April 14), the deputy CIO at NLRB sent an email stating that administrative control had been removed from all employee accounts. Meaning, suddenly none of the IT employees at the agency could do their jobs properly anymore, Berulis said.</p>
<div id="attachment_71043" style="width: 760px" class="wp-caption aligncenter"><a href="media/498c00e7.noadmin-nlrb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/noadmin-nlrb.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71043" decoding="async" loading="lazy" class="wp-image-71043" src="media/498c00e7.noadmin-nlrb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/noadmin-nlrb.png" alt="" width="750" height="377" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/noadmin-nlrb.png 1046w, https://krebsonsecurity.com/wp-content/uploads/2025/04/noadmin-nlrb-768x386.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/noadmin-nlrb-782x393.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-71043" class="wp-caption-text">An email from the NLRB&#8217;s associate chief information officer Eric Marks, notifying employees they will lose security administrator privileges.</p></div>
<p>Berulis shared a screenshot of an agency-wide email dated April 16 from NLRB director <strong>Lasharn Hamilton</strong> saying DOGE officials had requested a meeting, and reiterating claims that the agency had no prior &#8220;official&#8221; contact with any DOGE personnel. The message informed NLRB employees that two DOGE representatives would be detailed to the agency part-time for several months.</p>
<div id="attachment_71041" style="width: 561px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71041" decoding="async" loading="lazy" class="size-full wp-image-71041" src="media/49dd78f6.nlrb-dir-emailapril14.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/nlrb-dir-emailapril14.png" alt="" width="551" height="568" /><p id="caption-attachment-71041" class="wp-caption-text">An email from the NLRB Director Lasharn Hamilton on April 16, stating that the agency previously had no contact with DOGE personnel.</p></div>
<p>Berulis told KrebsOnSecurity he was in the process of filing a support ticket with Microsoft to request more information about the DOGE accounts when his network administrator access was restricted. Now, he&#8217;s hoping lawmakers will ask Microsoft to provide more information about what really happened with the accounts.</p>
<p>&#8220;That would give us way more insight,&#8221; he said. &#8220;Microsoft has to be able to see the picture better than we can. That&#8217;s my goal, anyway.&#8221;</p>
<p>Berulis&#8217;s attorney told lawmakers that on April 7, while his client and legal team were preparing the whistleblower complaint, someone physically taped a threatening note to Mr. Berulis&#8217;s home door with photographs &#8212; taken via drone &#8212; of him walking in his neighborhood.</p>
<p>&#8220;The threatening note made clear reference to this very disclosure he was preparing for you, as the proper oversight authority,&#8221; reads a preface by Berulis&#8217;s attorney <strong>Andrew P. Bakaj</strong>. &#8220;While we do not know specifically who did this, we can only speculate that it involved someone with the ability to access NLRB systems.&#8221;</p>
<p>Berulis said the response from friends, colleagues and even the public has been largely supportive, and that he doesn&#8217;t regret his decision to come forward.</p>
<p>&#8220;I didn&#8217;t expect the letter on my door or the pushback from [agency] leaders,&#8221; he said. &#8220;If I had to do it over, would I do it again? Yes, because it wasn&#8217;t really even a choice the first time.&#8221;</p>
<p>For now, Mr. Berulis is taking some paid family leave from the NLRB. Which is just as well, he said, considering he was stripped of the tools needed to do his job at the agency.</p>
<p>&#8220;They came in and took full administrative control and locked everyone out, and said limited permission will be assigned on a need basis going forward&#8221; Berulis said of the DOGE employees. &#8220;We can&#8217;t really do anything, so we&#8217;re literally getting paid to count ceiling tiles.&#8221;</p>
<p>Further reading: <a href="media/5d2d1657.2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf" data-original-source="https://whistlebloweraid.org/wp-content/uploads/2025/04/2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf" target="_blank" rel="noopener">Berulis&#8217;s complaint</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=71075
title: DOGE Worker’s Code Supports NLRB Whistleblower
uri: DOGE-Worker-s-Code-Supports-NLRB-Whistleblower
url: https://krebsonsecurity.com/2025/04/doge-workers-code-supports-nlrb-whistleblower/
content:
<p>A whistleblower at the <strong>National Labor Relations Board</strong> (NLRB) alleged last week that denizens of Elon Musk&#8217;s <strong>Department of Government Efficiency</strong> (DOGE) siphoned gigabytes of data from the agency&#8217;s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code repositories from <strong>GitHub</strong>. Further investigation into one of those code bundles shows it is remarkably similar to a program published in January 2025 by <strong>Marko Elez</strong>, a 25-year-old DOGE employee who has worked at a number of Musk&#8217;s companies.</p>
<div id="attachment_71090" style="width: 758px" class="wp-caption aligncenter"><a href="media/b6ddd0c7.db-powershellcmds.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/db-powershellcmds.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71090" decoding="async" class="wp-image-71090" src="media/b6ddd0c7.db-powershellcmds.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/db-powershellcmds.png" alt="" width="748" height="323" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/db-powershellcmds.png 1287w, https://krebsonsecurity.com/wp-content/uploads/2025/04/db-powershellcmds-768x331.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/db-powershellcmds-782x337.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-71090" class="wp-caption-text">A screenshot shared by NLRB whistleblower Daniel Berulis shows three downloads from GitHub.</p></div>
<p>According to <a href="https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/" target="_blank" rel="noopener">a whistleblower complaint</a> filed last week by <strong>Daniel J. Berulis</strong>, a 38-year-old security architect at the NLRB, officials from DOGE met with NLRB leaders on March 3 and demanded the creation of several all-powerful “tenant admin” accounts that were to be exempted from network logging activity that would otherwise keep a detailed record of all actions taken by those accounts.</p>
<p>Berulis said the new DOGE accounts had unrestricted permission to read, copy, and alter information contained in NLRB databases. The new accounts also could restrict log visibility, delay retention, route logs elsewhere, or even remove them entirely — top-tier user privileges that neither Berulis nor his boss possessed.</p>
<p>Berulis said he discovered one of the DOGE accounts had downloaded three external code libraries from <strong>GitHub</strong> that neither NLRB nor its contractors ever used. A “readme” file in one of the code bundles explained it was created to rotate connections through a large pool of cloud Internet addresses that serve “<em>as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing</em>.” Brute force attacks involve automated login attempts that try many credential combinations in rapid sequence.</p>
<p>A search on that description in Google brings up a code repository at GitHub for a user with the account name &#8220;<strong>Ge0rg3</strong>&#8221; who published a program roughly four years ago called &#8220;<a href="https://github.com/Ge0rg3/requests-ip-rotator" target="_blank" rel="noopener">requests-ip-rotator</a>,&#8221; described as a library that will allow the user &#8220;to bypass IP-based rate-limits for sites and services.&#8221;</p>
<div id="attachment_71091" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71091" decoding="async" loading="lazy" class=" wp-image-71091" src="media/abad16ef.ge0rge-gh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/ge0rge-gh.png" alt="" width="749" height="543" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/ge0rge-gh.png 1171w, https://krebsonsecurity.com/wp-content/uploads/2025/04/ge0rge-gh-768x557.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/ge0rge-gh-782x568.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71091" class="wp-caption-text">The README file from the GitHub user Ge0rg3&#8217;s page for requests-ip-rotator includes the exact wording of a program the whistleblower said was downloaded by one of the DOGE users. Marko Elez created an offshoot of this program in January 2025.</p></div>
<p>&#8220;A Python library to utilize AWS API Gateway&#8217;s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing,&#8221; the description reads.</p>
<p>Ge0rg3&#8217;s code is &#8220;open source,&#8221; in that anyone can copy it and reuse it non-commercially. As it happens, there is a newer version of this project that was derived or &#8220;forked&#8221; from Ge0rg3&#8217;s code &#8212; called &#8220;<a href="https://github.com/markoelez/async-ip-rotator/blob/master/README.md" target="_blank" rel="noopener">async-ip-rotator</a>&#8221; &#8212; and it was committed to GitHub in January 2025 by DOGE captain <a href="https://github.com/markoelez" target="_blank" rel="noopener">Marko Elez</a>.</p>
<div id="attachment_71085" style="width: 760px" class="wp-caption aligncenter"><a href="media/ed38037f.melez-gh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/melez-gh.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71085" decoding="async" loading="lazy" class="wp-image-71085" src="media/ed38037f.melez-gh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/melez-gh.png" alt="" width="750" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/melez-gh.png 1150w, https://krebsonsecurity.com/wp-content/uploads/2025/04/melez-gh-768x504.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/melez-gh-782x513.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-71085" class="wp-caption-text">The whistleblower stated that one of the GitHub files downloaded by the DOGE employees who transferred sensitive files from an NLRB case database was an archive whose README file read: &#8220;Python library to utilize AWS API Gateway&#8217;s large IP pool as a proxy to generate pseudo-infinite IPs for web scraping and brute forcing.&#8221; Elez&#8217;s code pictured here was forked in January 2025 from a code library that shares the same description.</p></div>
<p>A key DOGE staff member who gained access to the Treasury Department&#8217;s central payments system, Elez has worked for a number of Musk companies, including <strong>X</strong>, <strong>SpaceX</strong>, and <strong>xAI</strong>. Elez was among the first DOGE employees to face public scrutiny, after <strong>The Wall Street Journal</strong> <a href="https://www.wsj.com/tech/doge-staffer-resigns-over-racist-posts-d9f11a93" target="_blank" rel="noopener">linked him to social media posts</a> that advocated racism and eugenics.</p>
<p>Elez resigned after that brief scandal, but was rehired after President Donald Trump and Vice President JD Vance expressed support for him. <strong>Politico</strong> <a href="https://www.politico.com/news/2025/03/29/doge-marco-elez-software-engineer-us-payroll-00259303" target="_blank" rel="noopener">reports</a> Elez is now a <strong>Labor Department</strong> aide detailed to multiple agencies, including the <strong>Department of Health and Human Services</strong>.</p>
<p>&#8220;During Elez’s initial stint at Treasury, he violated the agency’s information security policies by sending a spreadsheet containing names and payments information to officials at the General Services Administration,&#8221; Politico wrote, citing court filings.</p>
<p>KrebsOnSecurity sought comment from both the NLRB and DOGE, and will update this story if either responds.<span id="more-71075"></span></p>
<p>The NLRB has been effectively hobbled since <strong>President Trump</strong> fired three board members, leaving the agency without the quorum it needs to function. Both <strong>Amazon</strong> and Musk’s <strong>SpaceX</strong> have <a href="https://apnews.com/article/amazon-nlrb-unconstitutional-spacex-elon-musk-ab42977117d883e97110a7bf8e8b257f" target="_blank" rel="noopener">been suing</a> the NLRB over complaints the agency filed in disputes about workers’ rights and union organizing, arguing that the NLRB’s very existence is unconstitutional. On March 5, a U.S. appeals court <a href="https://www.reuters.com/legal/government/musks-spacex-loses-early-legal-challenge-us-labor-boards-powers-2025-03-05/" target="_blank" rel="noopener">unanimously rejected</a> Musk’s claim that the NLRB’s structure somehow violates the Constitution.</p>
<p>Berulis&#8217;s complaint alleges the DOGE accounts at NLRB downloaded more than 10 gigabytes of data from the agency&#8217;s case files, a database that includes reams of sensitive records including information about employees who want to form unions and proprietary business documents. Berulis said he went public after higher-ups at the agency told him not to report the matter to the US-CERT, as they&#8217;d previously agreed.</p>
<p>Berulis told KrebsOnSecurity he worried the unauthorized data transfer by DOGE could unfairly advantage defendants in a number of ongoing labor disputes before the agency.</p>
<p>&#8220;If any company got the case data that would be an unfair advantage,&#8221; Berulis said. &#8220;They could identify and fire employees and union organizers without saying why.&#8221;</p>
<div id="attachment_71106" style="width: 454px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71106" decoding="async" loading="lazy" class="size-full wp-image-71106" src="media/ad26ea8b.markoelez.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/markoelez.png" alt="" width="444" height="515" /><p id="caption-attachment-71106" class="wp-caption-text">Marko Elez, in a photo from a social media profile.</p></div>
<p>Berulis said the other two GitHub archives that DOGE employees downloaded to NLRB systems included <strong>Integuru</strong>, a software framework designed to reverse engineer application programming interfaces (APIs) that websites use to fetch data; and a &#8220;headless&#8221; browser called <strong>Browserless</strong>, which is made for automating web-based tasks that require a pool of browsers, such as web scraping and automated testing.</p>
<p>On February 6, someone <a href="https://github.com/markoelez/async-ip-rotator/issues/1" target="_blank" rel="noopener">posted a lengthy and detailed critique</a> of Elez&#8217;s code on the GitHub &#8220;issues&#8221; page for async-ip-rotator, calling it &#8220;insecure, unscalable and a fundamental engineering failure.&#8221;</p>
<p>&#8220;If this were a side project, it would just be bad code,&#8221; the reviewer wrote. &#8220;But if this is representative of how you build production systems, then there are much larger concerns. This implementation is fundamentally broken, and if anything similar to this is deployed in an environment handling sensitive data, it should be audited immediately.&#8221;</p>
<p>Further reading: <a href="media/5d2d1657.2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf" data-original-source="https://whistlebloweraid.org/wp-content/uploads/2025/04/2025_0414_Berulis-Disclosure-with-Exhibits.s.pdf" target="_blank" rel="noopener">Berulis’s complaint</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=71147
title: Alleged ‘Scattered Spider’ Member Extradited to U.S.
uri: Alleged-Scattered-Spider-Member-Extradited-to-U-S
url: https://krebsonsecurity.com/2025/04/alleged-scattered-spider-member-extradited-to-u-s/
content:
<p>A 23-year-old Scottish man thought to be a member of the prolific <strong>Scattered Spider</strong> cybercrime group was extradited last week from Spain to the United States, where he is facing charges of wire fraud, conspiracy and identity theft. U.S. prosecutors allege <strong>Tyler Robert Buchanan</strong> and co-conspirators hacked into dozens of companies in the United States and abroad, and that he personally controlled more than $26 million stolen from victims.</p>
<p>Scattered Spider is a loosely affiliated criminal hacking group whose members have broken into and stolen data from some of the world&#8217;s largest technology companies. Buchanan was arrested in Spain last year on a warrant from the FBI, which wanted him in connection with a series of SMS-based phishing attacks in the summer of 2022 that led to intrusions at Twilio, LastPass, DoorDash, Mailchimp, and many other tech firms.</p>
<div id="attachment_67783" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67783" decoding="async" class=" wp-image-67783" src="media/49a7c375.tylerb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/06/tylerb.png" alt="" width="748" height="308" /><p id="caption-attachment-67783" class="wp-caption-text">Tyler Buchanan, being escorted by Spanish police at the airport in Palma de Mallorca in June 2024.</p></div>
<p>As <a href="https://krebsonsecurity.com/2024/06/alleged-boss-of-scattered-spider-hacking-group-arrested/" target="_blank" rel="noopener">first reported</a> by KrebsOnSecurity, Buchanan (a.k.a. &#8220;tylerb&#8221;) fled the United Kingdom in February 2023, after a rival cybercrime gang hired thugs to invade his home, assault his mother, and threaten to burn him with a blowtorch unless he gave up the keys to his cryptocurrency wallet. Buchanan was arrested in June 2024 at the airport in Palma de Mallorca while trying to board a flight to Italy. His extradition to the United States was <a href="https://www.bloomberg.com/news/articles/2025-04-24/scattered-spider-hacking-suspect-extradited-to-us-from-spain" target="_blank" rel="noopener">first reported</a> last week by <strong>Bloomberg</strong>.</p>
<p>Members of Scattered Spider have been <a href="https://cyberscoop.com/youth-hacking-ring-at-the-center-of-cybercrime-spree/" target="_blank" rel="noopener">tied</a> to the 2023 ransomware attacks against <strong>MGM</strong> and <strong>Caesars</strong> casinos in Las Vegas, but it remains unclear whether Buchanan was implicated in that incident. The Justice Department&#8217;s complaint against Buchanan makes no mention of the 2023 ransomware attack.</p>
<p>Rather, the investigation into Buchanan appears to center on the SMS phishing campaigns from 2022, and on <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">SIM-swapping attacks</a> that siphoned funds from individual cryptocurrency investors. In a SIM-swapping attack, crooks transfer the target’s phone number to a device they control and intercept any text messages or phone calls to the victim&#8217;s device — including one-time passcodes for authentication and password reset links sent via SMS.</p>
<p>In August 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/08/how-1-time-passcodes-became-a-corporate-liability/" target="_blank" rel="noopener">reviewed data harvested in a months-long cybercrime campaign by Scattered Spider</a> involving countless SMS-based phishing attacks against employees at major corporations. The security firm <strong>Group-IB</strong> called them by a different name — <strong>0ktapus</strong>, because the group typically spoofed the identity provider <strong>Okta</strong> in their phishing messages to employees at targeted firms.</p>
<div id="attachment_61078" style="width: 654px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61078" decoding="async" loading="lazy" class="wp-image-61078 size-full" src="media/70fc6af9.twiliophish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/twiliophish.png" alt="" width="644" height="471" /><p id="caption-attachment-61078" class="wp-caption-text">A Scattered Spider/0Ktapus SMS phishing lure sent to Twilio employees in 2022.</p></div>
<p>The <a href="media/2f8ce28d.tylerb-complaint.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/tylerb-complaint.pdf" target="_blank" rel="noopener">complaint against Buchanan</a> (PDF) says the FBI tied him to the 2022 SMS phishing attacks after discovering the same username and email address was used to register numerous Okta-themed phishing domains seen in the campaign. The domain registrar <strong>NameCheap</strong> found that less than a month before the phishing spree, the account that registered those domains logged in from an Internet address in the U.K. FBI investigators said the Scottish police told them the address was leased to Buchanan from January 26, 2022 to November 7, 2022.</p>
<p>Authorities seized at least 20 digital devices when they raided Buchanan&#8217;s residence, and on one of those devices they found usernames and passwords for employees of three different companies targeted in the phishing campaign.</p>
<p>&#8220;The FBI’s investigation to date has gathered evidence showing that Buchanan and his co-conspirators targeted at least 45 companies in the United States and abroad, including Canada, India, and the United Kingdom,&#8221; the FBI complaint reads. &#8220;One of Buchanan&#8217;s devices contained a screenshot of Telegram messages between an account known to be used by Buchanan and other unidentified co-conspirators discussing dividing up the proceeds of SIM swapping.&#8221;<span id="more-71147"></span></p>
<p>U.S. prosecutors allege that records obtained from Discord showed the same U.K. Internet address was used to operate a Discord account that specified a cryptocurrency wallet when asking another user to send funds. The complaint says the publicly available transaction history for that payment address shows approximately 391 bitcoin was transferred in and out of this address between October 2022 and<br />
February 2023; 391 bitcoin is presently worth more than $26 million.</p>
<p>In November 2024, federal prosecutors in Los Angeles <a href="https://krebsonsecurity.com/2024/11/feds-charge-five-men-in-scattered-spider-roundup/" target="_blank" rel="noopener">unsealed criminal charges against Buchanan</a> and four other alleged Scattered Spider members, including <strong>Ahmed Elbadawy</strong>, 23, of College Station, Texas; <strong>Joel Evans</strong>, 25, of Jacksonville, North Carolina; <strong>Evans Osiebo</strong>, 20, of Dallas; and <a href="https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/" target="_blank" rel="noopener"><strong>Noah Urban</strong></a>, 20, of Palm Coast, Florida. KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/" target="_blank" rel="noopener">reported last year</a> that another suspected Scattered Spider member &#8212; a 17-year-old from the United Kingdom &#8212; was arrested as part of a joint investigation with the FBI into the MGM hack.</p>
<p>Mr. Buchanan&#8217;s court-appointed attorney did not respond to a request for comment. The accused faces charges of wire fraud conspiracy, conspiracy to obtain information by computer for private financial gain, and aggravated identity theft. Convictions on the latter charge carry a minimum sentence of two years in prison.</p>
<p>Documents from the U.S. District Court for the Central District of California indicate Buchanan is being held without bail pending trial. A preliminary hearing in the case is slated for May 6.</p>


feed_id: https://krebsonsecurity.com/?p=71165
title: xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs
uri: xAI-Dev-Leaks-API-Key-for-Private-SpaceX-Tesla-LLMs
url: https://krebsonsecurity.com/2025/05/xai-dev-leaks-api-key-for-private-spacex-tesla-llms/
content:
<p>An employee at Elon Musk&#8217;s artificial intelligence company <strong>xAI</strong> leaked a private key on <strong>GitHub</strong> that for the past two months could have allowed anyone to query private xAI large language models (LLMs) which appear to have been custom made for working with internal data from Musk&#8217;s companies, including <strong>SpaceX</strong>, <strong>Tesla</strong> and <strong>Twitter/X, </strong>KrebsOnSecurity has learned.</p>
<div id="attachment_71170" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71170" decoding="async" class=" wp-image-71170" src="media/a9e48d93.x-ai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/x-ai.png" alt="" width="748" height="497" /><p id="caption-attachment-71170" class="wp-caption-text">Image: Shutterstock, @sdx15.</p></div>
<p><strong>Philippe Caturegli</strong>, &#8220;chief hacking officer&#8221; at the security consultancy <strong>Seralys</strong>, was <a href="https://www.linkedin.com/posts/caturegli_yo-xai-your-devs-are-leaking-api-keys-on-activity-7321566948020953088-6KXj?utm_source=share&amp;utm_medium=member_desktop&amp;rcm=ACoAAAAliaMB3BQO-WOS-eUh-XU4HAd5h8pTzkI" target="_blank" rel="noopener">the first to publicize the leak</a> of credentials for an x.ai application programming interface (API) exposed in the GitHub code repository of a technical staff member at xAI.</p>
<p>Caturegli&#8217;s post on LinkedIn caught the attention of researchers at <strong>GitGuardian</strong>, a company that specializes in detecting and remediating exposed secrets in public and proprietary environments. GitGuardian&#8217;s systems constantly scan GitHub and other code repositories for exposed API keys, and fire off automated alerts to affected users.</p>
<p>GitGuardian&#8217;s <strong>Eric Fourrier</strong> told KrebsOnSecurity the exposed API key had access to several unreleased models of <strong>Grok</strong>, the AI chatbot developed by xAI. In total, GitGuardian found the key had access to at least 60 distinct data sets.</p>
<p>&#8220;The credentials can be used to access the X.ai API with the identity of the user,&#8221; GitGuardian wrote in an email explaining their findings to xAI. &#8220;The associated account not only has access to public Grok models (grok-2-1212, etc) but also to what appears to be unreleased (grok-2.5V), development (research-grok-2p5v-1018), and private models (tweet-rejector, grok-spacex-2024-11-04).&#8221;</p>
<p>Fourrier found GitGuardian had alerted the xAI employee about the exposed API key nearly two months ago &#8212; on March 2. But as of April 30, when GitGuardian directly alerted xAI&#8217;s security team to the exposure, the key was still valid and usable. xAI told GitGuardian to report the matter through its bug bounty program at <strong>HackerOne</strong>, but just a few hours later the repository containing the API key was removed from GitHub.</p>
<p>&#8220;It looks like some of these internal LLMs were fine-tuned on SpaceX data, and some were fine-tuned with Tesla data,&#8221; Fourrier said. &#8220;I definitely don&#8217;t think a Grok model that&#8217;s fine-tuned on SpaceX data is intended to be exposed publicly.&#8221;</p>
<p>xAI did not respond to a request for comment. Nor did the 28-year-old xAI technical staff member whose key was exposed.<span id="more-71165"></span></p>
<p><strong>Carole Winqwist</strong> heads the research team at GitGuardian. Winquist said giving potentially hostile users free access to private LLMs is a recipe for disaster.</p>
<p>&#8220;If you&#8217;re an attacker and you have direct access to the model and the back end interface for things like Grok, it&#8217;s definitely something you can use for further attacking,&#8221; she said. &#8220;An attacker could it use for prompt injection, to tweak the (LLM) model to serve their purposes, or try to implant code into the supply chain.&#8221;</p>
<p>The inadvertent exposure of internal LLMs for xAI comes as Musk&#8217;s so-called <strong>Department of Government Efficiency</strong> (DOGE) has been feeding sensitive government records into artificial intelligence tools. In February, <strong>The Washington Post</strong> <a href="https://www.washingtonpost.com/nation/2025/02/06/elon-musk-doge-ai-department-education/" target="_blank" rel="noopener">reported</a> DOGE officials were feeding data from across the Education Department into AI tools to probe the agency&#8217;s programs and spending.</p>
<p>The Post said DOGE plans to replicate this process across many departments and agencies, accessing the back-end software at different parts of the government and then using AI technology to extract and sift through information about spending on employees and programs.</p>
<p>&#8220;Feeding sensitive data into AI software puts it into the possession of a system&#8217;s operator, increasing the chances it will be leaked or swept up in cyberattacks,&#8221; Post reporters wrote.</p>
<p>Wired reported in March that DOGE has <a href="https://www.wired.com/story/gsai-chatbot-1500-federal-workers/" target="_blank" rel="noopener">deployed a proprietary chatbot called GSAi</a> to 1,500 federal workers at the <strong>General Services Administration</strong>, part of an effort to automate tasks previously done by humans as DOGE continues its purge of the federal workforce.</p>
<p>A <strong>Reuters</strong> <a href="https://www.reuters.com/technology/artificial-intelligence/musks-doge-using-ai-snoop-us-federal-workers-sources-say-2025-04-08/" target="_blank" rel="noopener">report</a> last month said Trump administration officials told some U.S. government employees that DOGE is using AI to surveil at least one federal agency&#8217;s communications for hostility to President Trump and his agenda. Reuters wrote that the DOGE team has heavily deployed Musk’s Grok AI chatbot as part of their work slashing the federal government, although Reuters said it could not establish exactly how Grok was being used.</p>
<p>Caturegli said while there is no indication that federal government or user data could be accessed through the exposed x.ai API key, these private models are likely trained on proprietary data and may unintentionally expose details related to internal development efforts at xAI, Twitter, or SpaceX.</p>
<p>&#8220;The fact that this key was publicly exposed for two months and granted access to internal models is concerning,&#8221; Caturegli said. &#8220;This kind of long-lived credential exposure highlights weak key management and insufficient internal monitoring, raising questions about safeguards around developer access and broader operational security.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=70782
title: Pakistani Firm Shipped Fentanyl Analogs, Scams to US
uri: Pakistani-Firm-Shipped-Fentanyl-Analogs-Scams-to-US
url: https://krebsonsecurity.com/2025/05/pakistani-firm-shipped-fentanyl-analogs-scams-to-us/
content:
<p>A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo designs, a new investigation reveals.</p>
<p>In <a href="media/f6bdeb65.e_Azneem_Bilwani_Abtach_drugs_merged_usa_vs_eworldtradellc-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/motion_to_seal_eWorldTrade_Azneem_Bilwani_Abtach_drugs_merged_usa_vs_eworldtradellc-1.pdf" target="_blank" rel="noopener">an indictment</a> (PDF) unsealed last month, the <strong>U.S. Department of Justice</strong> said Dallas-based <strong>eWorldTrade</strong> &#8220;operated an online business-to-business marketplace that facilitated the distribution of synthetic opioids such as isotonitazene and carfentanyl, both significantly more potent than fentanyl.&#8221;</p>
<p>Launched in 2017, eWorldTrade[.]com now features <a href="https://www.justice.gov/opa/pr/us-online-marketplace-operator-charged-trafficking-deadly-synthetic-opioids-stronger" target="_blank" rel="noopener">a seizure notice</a> from the DOJ. eWorldTrade operated as a wholesale seller of consumer goods, including clothes, machinery, chemicals, automobiles and appliances. The DOJ&#8217;s indictment includes no additional details about eWorldTrade&#8217;s business, origins or other activity, and at first glance the website might appear to be a legitimate e-commerce platform that also just happened to sell some restricted chemicals</p>
<div id="attachment_71137" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71137" decoding="async" class=" wp-image-71137" src="media/107daff8.eworldtrade.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/eworldtrade.png" alt="" width="750" height="310" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/04/eworldtrade.png 1901w, https://krebsonsecurity.com/wp-content/uploads/2025/04/eworldtrade-768x318.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/04/eworldtrade-1536x636.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/04/eworldtrade-782x324.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-71137" class="wp-caption-text">A screenshot of the eWorldTrade homepage on March 25, 2025. Image: archive.org.</p></div>
<p>However, an investigation into the company&#8217;s founders reveals they are connected to a sprawling network of websites that have a history of extortionate scams involving trademark registration, book publishing, exam preparation, and the design of logos, mobile applications and websites.</p>
<p><a href="https://uspto.report/TM/98283759/ELR20240903134921/" target="_blank" rel="noopener">Records</a> from the <strong>U.S. Patent and Trademark Office </strong>(USPTO) show the eWorldTrade mark is owned by an <a href="https://www.linkedin.com/in/azneem-bilwani-1630291a/" target="_blank" rel="noopener"><b>Azneem Bilwani </b></a>in Karachi (this name also is in the registration records for the now-seized eWorldTrade domain). Mr. Bilwani is perhaps better known as the director of the Pakistan-based IT provider <strong>Abtach Ltd.</strong>, which has been <a href="media/da6d259a.TM-Show-Cause-Order-Abtach-et-al.pdf" data-original-source="https://www.uspto.gov/sites/default/files/documents/TM-Show-Cause-Order-Abtach-et-al.pdf" target="_blank" rel="noopener">singled out</a> by the USPTO <a href="https://www.worldtrademarkreview.com/data/wtr-investigation-exclusives/wtr-investigation-exclusives/article/google-blocks-ads-trademark-terminal-operator-abtach-following-uspto-action" target="_blank" rel="noopener">and Google</a> for operating trademark registration scams (the main offices for <span style="font-weight: 400;">eWorldtrade and Abtach share the same address in Pakistan).</span></p>
<p>In November 2021, the USPTO <a href="https://www.worldtrademarkreview.com/data/wtr-investigation-exclusives/wtr-investigation-exclusives/article/the-dangerous-legacy-of-axact-how-diploma-mill-in-pakistan-led-trademark-scam-epidemic" target="_blank" rel="noopener">accused Abtach</a> of perpetrating &#8220;an egregious scheme to deceive and defraud applicants for federal trademark registrations by improperly altering official USPTO correspondence, overcharging application filing fees, misappropriating the USPTO’s trademarks, and impersonating the USPTO.&#8221;</p>
<p>Abtach offered trademark registration at suspiciously low prices compared to legitimate costs of over USD $1,500, and claimed they could register a trademark in 24 hours. Abtach reportedly <a href="https://www.worldtrademarkreview.com/data/wtr-investigation-exclusives/wtr-investigation-exclusives/article/abtach-rebrands-intersys-after-being-banned-uspto" target="_blank" rel="noopener">rebranded </a>to <strong>Intersys Limited</strong> after the USPTO banned Abtach from filing any more trademark applications.</p>
<div id="attachment_71191" style="width: 646px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71191" decoding="async" loading="lazy" class=" wp-image-71191" src="media/07d87037.intersysabtach.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/intersysabtach.png" alt="" width="636" height="870" /><p id="caption-attachment-71191" class="wp-caption-text">In a note published to its LinkedIn profile, Intersys Ltd. asserted last year that certain scam firms in Karachi were impersonating the company.</p></div>
<h2>FROM AXACT TO ABTACH</h2>
<p>Many of Abtach&#8217;s employees are former associates of a similar company in Pakistan called <strong>Axact</strong> that was targeted by Pakistani authorities in a 2015 fraud investigation. Axact came under law enforcement scrutiny after <strong>The New York Times</strong> ran <a href="https://www.nytimes.com/2015/05/18/world/asia/fake-diplomas-real-cash-pakistani-company-axact-reaps-millions-columbiana-barkley.html" target="_blank" rel="noopener">a front-page story</a> about the company&#8217;s most lucrative scam business: Hundreds of sites peddling fake college degrees and diplomas.</p>
<p><span style="font-weight: 400;">People who purchased fake certifications were subsequently <a href="https://www.nytimes.com/2016/04/11/world/asia/pakistan-axact-degree-scam.html" target="_blank" rel="noopener">blackmailed by Axact employees posing as government officials</a>, who would demand additional payments under threats of prosecution or imprisonment for having bought fraudulent “unauthorized” academic degrees. This practice created a continuous cycle of extortion, internally referred to as &#8220;upselling.&#8221; </span></p>
<p>&#8220;Axact took money from at least 215,000 people in 197 countries — one-third of them from the United States,&#8221; The Times reported. &#8220;Sales agents wielded threats and false promises and impersonated government officials, earning the company at least $89 million in its final year of operation.&#8221;</p>
<p>Dozens of top Axact employees were arrested, jailed, held for months, tried and sentenced to seven years for various fraud violations. But a 2019 research brief on Axact&#8217;s diploma mills found none of those convicted had started their prison sentence, and that several had fled Pakistan and never returned.</p>
<p>&#8220;In October 2016, a Pakistan district judge acquitted 24 Axact officials at trial due to &#8216;not enough evidence&#8217; and then later admitted he had accepted a bribe (of $35,209) from Axact,&#8221; reads <a href="https://www.aacrao.org/docs/default-source/webinar-documents/94-4-academic-fraud-and-the-worlds-largest-diploma-mill.pdf?sfvrsn=4b276f1f_2#:~:text=Dozens%20of%20top%20Axact%20ex,was%20caught%20at%20the%20airport." target="_blank" rel="noopener">a history</a> (PDF) published by the American Association of Collegiate Registrars and Admissions Officers.</p>
<p>In 2021, Pakistan&#8217;s <strong>Federal Investigation Agency</strong> (FIA) charged Bilwani and nearly four dozen others &#8212; many of them Abtach employees &#8212; with running an elaborate trademark scam. The authorities <a href="https://files.lbr.cloud/public/2021-02/report.pdf?nh3DUDQa7dd3jS63lsAN2dWDbHIQjplS=" target="_blank" rel="noopener">called it</a> &#8220;the biggest money laundering case in the history of Pakistan,&#8221; and named a number of businesses based in Texas that allegedly helped move the proceeds of cybercrime.</p>
<div id="attachment_71216" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71216" decoding="async" loading="lazy" class=" wp-image-71216" src="media/edf1ad43.fia-report-2021.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-report-2021.png" alt="" width="749" height="505" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-report-2021.png 785w, https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-report-2021-768x518.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-report-2021-782x527.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71216" class="wp-caption-text">A page from the March 2021 FIA report alleging that Digitonics Labs and Abtach employees conspired to extort and defraud consumers.</p></div>
<p>The FIA <a href="https://www.worldtrademarkreview.com/data/wtr-investigation-exclusives/wtr-investigation-exclusives/article/uspto-users-targeted-in-massive-fraud-and-money-laundering-case-in-pakistan" target="_blank" rel="noopener">said</a> the defendants operated a large number of websites offering low-cost trademark services to customers, before then “ignoring them after getting the funds and later demanding more funds from clients/victims in the name of up-sale (extortion).&#8221; The Pakistani law enforcement agency said that about 75 percent of customers received fake or fabricated trademarks as a result of the scams.</p>
<p><span style="font-weight: 400;">The FIA <a href="https://drive.google.com/file/d/1dFChoGQHXw7yi-JdVuow3k1XBAuPwAlv/view?usp=drive_link" target="_blank" rel="noopener">found</a> Abtach operates in conjunction with a Karachi firm called <strong>Digitonics Labs</strong>, which earned <a href="https://www.worldtrademarkreview.com/data/wtr-investigation-exclusives/wtr-investigation-exclusives/article/bribery-impersonation-abuse-shocking-details-revealed-in-pakistan-fraud-case-targeted-uspto-users" target="_blank" rel="noopener">a monthly revenue of around $2.5 million</a> through the &#8220;extortion of international clients in the name of up-selling, the sale of fake/fabricated USPTO certificates, and the maintaining of phishing websites.&#8221;</span></p>
<p>According the Pakistani authorities, the accused also ran countless scams involving ebook publication and logo creation, wherein customers are subjected to advance-fee fraud and extortion &#8212; with the scammers demanding more money for supposed &#8220;copyright release&#8221; and threatening to release the trademark.</p>
<p><span style="font-weight: 400;">Also charged by the FIA was </span><b>Junaid Mansoor</b>, <span style="font-weight: 400;">the owner of Digitonics Labs in Karachi. Mansoor&#8217;s </span><b><span style="font-weight: 400;">U.K.-registered company </span></b><a href="https://find-and-update.company-information.service.gov.uk/officers/9Xl14hjK0LtYFKRI7kI_werr3As/appointments" target="_blank" rel="noopener"><span style="font-weight: 400;">Maple Solutions Direct Limited</span></a> <b><span style="font-weight: 400;">has run at least 700 ads for logo design websites since 2015, the Google Ads Transparency page <a href="https://adstransparency.google.com/advertiser/AR16545428366065401857?region=anywhere" target="_blank" rel="noopener">reports</a>. The company has approximately <a href="https://adstransparency.google.com/advertiser/AR16545428366065401857?region=US&amp;preset-date=Today" target="_blank" rel="noopener">88 ads running on Google</a> as of today. </span></b></p>
<div id="attachment_71135" style="width: 702px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71135" decoding="async" loading="lazy" class=" wp-image-71135" src="media/dfc12b8a.junaidmansoor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/junaidmansoor.png" alt="" width="692" height="290" /><p id="caption-attachment-71135" class="wp-caption-text">Junaid Mansoor. Source: youtube/@Olevels․com School.</p></div>
<p><span style="font-weight: 400;">Mr. Mansoor is actively involved with and promoting a Quran study business called <strong>quranmasteronline[.]com</strong>, which was founded by Junaid&#8217;s brother <strong>Qasim Mansoor</strong> (Qasim is also named in the FIA criminal investigation). The Google ads promoting quranmasteronline[.]com were paid for by <a href="https://adstransparency.google.com/advertiser/AR14975696108041273345?region=US" target="_blank" rel="noopener">the same account</a> advertising a number of scam websites selling logo and web design services. </span></p>
<p>Junaid Mansoor did not respond to requests for comment. An address in Teaneck, New Jersey where Mr. Mansoor previously lived <a href="https://www.mapquest.com/us/new-jersey/exporthub-378873083" target="_blank" rel="noopener">is listed as an official address of exporthub[.]com</a>, a Pakistan-based e-commerce website that appears remarkably similar to eWorldTrade (Exporthub says its offices are in Texas). Interestingly, a search in Google for this domain shows ExportHub currently features <a href="https://www.google.com/search?q=site%3Aexporthub.com+fentanyl" target="_blank" rel="noopener">multiple listings for fentanyl citrate</a> from suppliers in China and elsewhere.</p>
<p>The CEO of Digitonics Labs is <strong>Muhammad Burhan Mirza</strong>, a former Axact official who was arrested by the FIA as part of its money laundering and trademark fraud investigation in 2021. In 2023, prosecutors in Pakistan charged Mirza, Mansoor and 14 other Digitonics employees with fraud, impersonating government officials, phishing, cheating and extortion. Mirza&#8217;s LinkedIn profile says he currently runs an educational technology/life coach enterprise called <strong>TheCoach360</strong>, which purports to help young kids &#8220;achieve financial independence.&#8221;</p>
<p>Reached via LinkedIn, Mr. Mirza denied having anything to do with eWorldTrade or any of its sister companies in Texas.</p>
<p>&#8220;Moreover, I have no knowledge as to the companies you have mentioned,&#8221; said Mr. Mirza, who did not respond to follow-up questions.</p>
<p>The current disposition of the FIA&#8217;s fraud case against the defendants is unclear. The investigation was marred early on by allegations of corruption and bribery. In 2021, Pakistani authorities alleged Bilwani paid a six-figure bribe to FIA investigators. Meanwhile, attorneys for Mr. Bilwani <a href="https://drive.google.com/file/d/194s1jG24OE2KjHtOhfGu51i6NhCFGV2X/view?usp=drive_link" target="_blank" rel="noopener">have argued</a> that although their client did pay a bribe, the payment was solicited by government officials. Mr. Bilwani did not respond to requests for comment.</p>
<h2>THE TEXAS NEXUS</h2>
<p>KrebsOnSecurity has learned that the people and entities at the center of the FIA investigations have built a significant presence in the United States, with a strong concentration in Texas. The Texas businesses promote websites that sell logo and web design, ghostwriting, and academic cheating services. Many of these entities have recently been sued for fraud and breach of contract by angry former customers, who claimed the companies relentlessly upsold them while failing to produce the work as promised.</p>
<p>For example, the FIA complaints named <strong>Retrocube LLC </strong>and <strong>360 Digital Marketing LLC</strong>, two entities that share a street address with eWorldTrade: 1910 Pacific Avenue, Suite 8025, Dallas, Texas. Also incorporated at that Pacific Avenue address is <strong>abtach[.]ae</strong>, a web design and marketing firm based in Dubai; and <strong>intersyslimited[.]com</strong>, the new name of Abtach after they were banned by the USPTO. Other businesses registered at this address market services for logo design, mobile app development, and ghostwriting.</p>
<div id="attachment_71217" style="width: 795px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71217" decoding="async" loading="lazy" class="size-full wp-image-71217" src="media/3d18d97b.fia-annexure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-annexure.png" alt="" width="785" height="785" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-annexure.png 785w, https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-annexure-768x768.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/fia-annexure-782x782.png 782w" sizes="(max-width: 785px) 100vw, 785px" /><p id="caption-attachment-71217" class="wp-caption-text">A list published in 2021 by Pakistan&#8217;s FIA of different front companies allegedly involved in scamming people who are looking for help with trademarks, ghostwriting, logos and web design.</p></div>
<p>360 Digital Marketing&#8217;s website 360digimarketing[.]com is owned by an Abtach front company called <strong>Abtech LTD</strong>. Meanwhile, <a href="https://find-and-update.company-information.service.gov.uk/company/10311269/officers" target="_blank" rel="noopener">business records show</a> <strong>360 Digi Marketing LTD</strong> is a U.K. company whose officers include former Abtach director Bilwani; <b>Muhammad Saad Iqbal</b>, formerly Abtach, now CEO of Intersys Ltd; <b>Niaz Ahmed</b>, a former Abtach associate; and<b> Muhammad Salman Yousuf</b>, formerly a vice president at Axact, Abtach, and Digitonics Labs.</p>
<p>Google&#8217;s Ads Transparency Center finds 360 Digital Marketing LLC ran at least 500 ads promoting various websites selling ghostwriting services . Another entity tied to Junaid Mansoor &#8212; a company called <strong>Octa Group Technologies AU</strong> &#8212; has run <a href="https://adstransparency.google.com/advertiser/AR08603440443079786497?region=anywhere" target="_blank" rel="noopener">approximately 300 Google ads</a> for book publishing services, promoting confusingly named websites like <span style="font-weight: 400;">amazonlistinghub[.]com and barnesnoblepublishing[.]co.</span></p>
<div id="attachment_71198" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71198" decoding="async" loading="lazy" class=" wp-image-71198" src="media/ed7969f9.360DigitalMarketingLLC-adstransparency.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/360DigitalMarketingLLC-adstransparency.png" alt="" width="749" height="653" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/360DigitalMarketingLLC-adstransparency.png 1045w, https://krebsonsecurity.com/wp-content/uploads/2025/05/360DigitalMarketingLLC-adstransparency-768x670.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/360DigitalMarketingLLC-adstransparency-782x682.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71198" class="wp-caption-text">360 Digital Marketing LLC ran approximately 500 ads for scam ghostwriting sites.</p></div>
<p><strong>Rameez Moiz </strong>is a Texas resident and former Abtach product manager who has represented 360 Digital Marketing LLC and RetroCube. Moiz told KrebsOnSecurity he stopped working for 360 Digital Marketing in the summer of 2023. Mr. Moiz did not respond to follow-up questions, but <a href="https://www.upwork.com/agencies/1494464284062437376/" target="_blank" rel="noopener">an Upwork profile for him</a> states that as of April 2025 he is employed by Dallas-based <strong>Vertical Minds LLC</strong>.</p>
<p>In April 2025, California resident <strong>Melinda Will</strong> <a href="https://drive.google.com/file/d/1qRhvQ6mdyRrFpzWBOdschOo71xIP7ikT/view?usp=drive_link" target="_blank" rel="noopener">sued</a> the Texas firm <strong>Majestic Ghostwriting </strong>&#8212; which is doing business as <strong>ghostwritingsquad[.]com</strong> &#8212;  alleging they scammed her out of $100,000 after she hired them to help write her book. Google&#8217;s ad transparency page shows Moiz&#8217;s employer <a href="https://adstransparency.google.com/advertiser/AR06416697976495800321?region=US" target="_blank" rel="noopener">Vertical Minds LLC paid to run approximately 55 ads</a> for <strong>ghostwritingsquad[.]com </strong>and related sites.</p>
<div id="attachment_71190" style="width: 760px" class="wp-caption aligncenter"><a href="media/f674e95e.verticalminds-google.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/verticalminds-google.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71190" decoding="async" loading="lazy" class="wp-image-71190" src="media/f674e95e.verticalminds-google.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/verticalminds-google.png" alt="" width="750" height="455" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/verticalminds-google.png 1437w, https://krebsonsecurity.com/wp-content/uploads/2025/05/verticalminds-google-768x466.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/verticalminds-google-782x475.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-71190" class="wp-caption-text">Google&#8217;s ad transparency listing for ghostwriting ads paid for by Vertical Minds LLC.</p></div>
<p><span id="more-70782"></span></p>
<h2>VICTIMS SPEAK OUT</h2>
<p>Ms. Will&#8217;s lawsuit is just one of more than two-dozen complaints over the past four years wherein plaintiffs sued one of this group&#8217;s web design, wiki editing or ghostwriting services. In 2021, a New Jersey man <a href="https://drive.google.com/file/d/1HOXxv4GP3-zz2tujPYHChmWBY6KUc70P/view?usp=drive_link" target="_blank" rel="noopener">sued Octagroup Technologies</a>, alleging they ripped him off when he paid a total of more than $26,000 for the design and marketing of a web-based mapping service.</p>
<p>The plaintiff in that case did not respond to requests for comment, but his complaint alleges Octagroup and a myriad other companies it contracted with produced minimal work product despite subjecting him to relentless upselling. That case was decided in favor of the plaintiff because the defendants never contested the matter in court.</p>
<p>In 2023, 360 Digital Marketing LLC and Retrocube LLC were sued by a woman who said they scammed her out of $40,000 over a book she wanted help writing. That lawsuit helpfully showed <a href="https://drive.google.com/file/d/1w_6-RqZl7GBea-WtdgFkv6xHRVWaG5DV/view?usp=drive_link" target="_blank" rel="noopener">an image of the office front door</a> at 1910 Pacific Ave Suite 8025, which featured the logos of 360 Digital Marketing, Retrocube, and eWorldTrade.</p>
<div id="attachment_71140" style="width: 621px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71140" decoding="async" loading="lazy" class="size-full wp-image-71140" src="media/c7729e78.360digitalmarketingfrontdoorintexas.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/04/360digitalmarketingfrontdoorintexas.png" alt="" width="611" height="763" /><p id="caption-attachment-71140" class="wp-caption-text">The front door at 1910 Pacific Avenue, Suite 8025, Dallas, Texas.</p></div>
<p>The lawsuit was filed pro se by <strong>Leigh Riley</strong>, a 64-year-old career IT professional who paid 360 Digital Marketing to have a company called <strong>Talented Ghostwriter</strong> co-author and promote a series of books she&#8217;d outlined on spirituality and healing.</p>
<p>&#8220;The main reason I hired them was because I didn&#8217;t understand what I call the formula for writing a book, and I know there&#8217;s a lot of marketing that goes into publishing,&#8221; Riley explained in an interview. &#8220;I know nothing about that stuff, and these guys were convincing that they could handle all aspects of it. Until I discovered they couldn&#8217;t write a damn sentence in English properly.&#8221;</p>
<p>Riley&#8217;s well-documented lawsuit (not linked here because it features a great deal of personal information) includes screenshots of conversations with the ghostwriting team, which was constantly assigning her to new writers and editors, and ghosting her on scheduled conference calls about progress on the project. Riley said she ended up writing most of the book herself because the work they produced was unusable.</p>
<p>&#8220;Finally after months of promising the books were printed and on their way, they show up at my doorstep with the wrong title on the book,&#8221; Riley said. When she demanded her money back, she said the people helping her with the website to promote the book locked her out of the site.</p>
<div id="attachment_71203" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71203" decoding="async" loading="lazy" class="size-full wp-image-71203" src="media/fe378036.rileylawsuit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/rileylawsuit.png" alt="" width="754" height="686" /><p id="caption-attachment-71203" class="wp-caption-text">A conversation snippet from Leigh Riley&#8217;s lawsuit against Talented Ghostwriter, aka 360 Digital Marketing LLC. &#8220;Other companies once they have you money they don&#8217;t even respond or do anything,&#8221; the ghostwriting team manager explained.</p></div>
<p>Riley decided to sue, naming 360 Digital Marketing LLC and Retrocube LLC, among others.  The companies offered to settle the matter for $20,000, which she accepted. &#8220;I didn&#8217;t have money to hire a lawyer, and I figured it was time to cut my losses,&#8221; she said.</p>
<p>Riley said she could have saved herself a great deal of headache by doing some basic research on Talented Ghostwriter, whose website claims the company is based in Los Angeles. According to the California Secretary of State, however, there is no registered entity by that name. Rather, the address claimed by <strong>talentedghostwriter[.]com</strong> is a vacant office building with a &#8220;space available&#8221; sign in the window.</p>
<p>California resident <strong>Walter Horsting </strong>discovered something similar when he sued 360 Digital Marketing in small claims court last year, after hiring a company called <strong>Vox Ghostwriting</strong> to help write, edit and promote a spy novel he&#8217;d been working on. Horsting said he paid Vox $3,300 to ghostwrite a 280-page book, and was upsold an Amazon marketing and publishing package for $7,500.</p>
<p>In an interview, Horsting said the prose that Vox Ghostwriting produced was &#8220;juvenile at best,&#8221; forcing him to rewrite and edit the work himself, and to partner with a graphical artist to produce illustrations. Horsting said that when it came time to begin marketing the novel, Vox Ghostwriting tried to further upsell him on marketing packages, while dodging scheduled meetings with no follow-up.</p>
<p>&#8220;They have a money back guarantee, and when they wouldn&#8217;t refund my money I said I&#8217;m taking you to court,&#8221; Horsting recounted. &#8220;I tried to serve them in Los Angeles but found no such office exists. I talked to a salon next door and they said someone else had recently shown up desperately looking for where the ghostwriting company went, and it appears there are a trail of corpses on this. I finally tracked down where they are in Texas.&#8221;</p>
<p>It was the same office that Ms. Riley served her lawsuit against. Horsting said he has a court hearing scheduled later this month, but he&#8217;s under no illusions that winning the case means he&#8217;ll be able to collect.</p>
<p>&#8220;At this point, I&#8217;m doing it out of pride more than actually expecting anything to come to good fortune for me,&#8221; he said.</p>
<p>The following mind map was helpful in piecing together key events, individuals and connections mentioned above. It&#8217;s important to note that this graphic only scratches the surface of the operations tied to this group. For example, in Case 2 we can see mention of academic cheating services, wherein people can be hired to take online proctored exams on one&#8217;s behalf. Those who hire these services soon find themselves subject to impersonation and blackmail attempts for larger and larger sums of money, with the threat of publicly exposing their unethical academic cheating activity.</p>
<div id="attachment_71218" style="width: 760px" class="wp-caption aligncenter"><a href="media/e54b4cf6.ewt-20.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/ewt-20.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71218" decoding="async" loading="lazy" class="wp-image-71218" src="media/e54b4cf6.ewt-20.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/ewt-20.png" alt="" width="750" height="376" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/ewt-20.png 1861w, https://krebsonsecurity.com/wp-content/uploads/2025/05/ewt-20-768x385.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/ewt-20-1536x771.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/05/ewt-20-782x392.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-71218" class="wp-caption-text">A &#8220;mind map&#8221; illustrating the connections between and among entities referenced in this story. Click to enlarge.</p></div>
<h2>GOOGLE RESPONDS</h2>
<p>KrebsOnSecurity reviewed the Google Ad Transparency links for nearly 500 different websites tied to this network of ghostwriting, logo, app and web development businesses. Those website names were then fed into <strong>spyfu.com</strong>, a competitive intelligence company that tracks the reach and performance of advertising keywords. Spyfu estimates that between April 2023 and April 2025, those websites <em>spent more than $10 million on Google ads</em>.</p>
<p>Reached for comment, Google said in a written statement that it is constantly policing its ad network for bad actors, pointing to <a href="media/5b3a53d2.ads_safety_report_2024.pdf" data-original-source="https://services.google.com/fh/files/misc/ads_safety_report_2024.pdf" target="_blank" rel="noopener">an ads safety report</a> (PDF) showing Google blocked or removed 5.1 billion bad ads last year &#8212; including more than 500 million ads related to trademarks.</p>
<p>&#8220;Our policy against Enabling Dishonest Behavior prohibits products or services that help users mislead others, including ads for paper-writing or exam-taking services,&#8221; the statement reads. &#8220;When we identify ads or advertisers that violate our policies, we take action, including by suspending advertiser accounts, disapproving ads, and restricting ads to specific domains when appropriate.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-71192" src="media/82d78dc9.googleadpolicyenforcement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/googleadpolicyenforcement.png" alt="" width="749" height="490" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/googleadpolicyenforcement.png 980w, https://krebsonsecurity.com/wp-content/uploads/2025/05/googleadpolicyenforcement-768x502.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/googleadpolicyenforcement-782x511.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Google did not respond to specific questions about the advertising entities mentioned in this story, saying only that &#8220;we are actively investigating this matter and addressing any policy violations, including suspending advertiser accounts when appropriate.&#8221;</p>
<p>From reviewing the ad accounts that have been promoting these scam websites, it appears Google has very recently acted to remove a large number of the offending ads. Prior to my notifying Google about the extent of this ad network on April 28, the Google Ad Transparency network listed over 500 ads for 360 Digital Marketing; as of this publication, that number had <a href="https://adstransparency.google.com/advertiser/AR11727645009044832257?region=US" target="_blank" rel="noopener">dwindled to 10</a>.</p>
<p>On April 30, Google <a href="https://support.google.com/adspolicy/answer/16189141?hl=en&amp;ref_topic=16083443" target="_blank" rel="noopener">announced</a> that starting this month its ads transparency page will display the payment profile name as the payer name for verified advertisers, if that name differs from their verified advertiser name. Searchengineland.com <a href="https://searchengineland.com/google-adds-to-its-transparency-rules-for-who-is-paying-for-ads-454899" target="_blank" rel="noopener">writes</a> the changes are aimed at increasing accountability in digital advertising.</p>
<p><a href="https://docs.google.com/spreadsheets/d/1xZ4yHTsWxnTtEVrazDbqWQY5Vju8USeBfszCGl6uxfc/edit?usp=sharing" target="_blank" rel="noopener">This spreadsheet</a> lists the domain names, advertiser names, and Google Ad Transparency links for more than 350 entities offering ghostwriting, publishing, web design and academic cheating services.</p>
<p>KrebsOnSecurity would like to thank the anonymous security researcher <a href="https://natinfosec.com" target="_blank" rel="noopener">NatInfoSec</a> for their assistance in this investigation.</p>
<p>For further reading on Abtach and its myriad companies in all of the above-mentioned verticals (ghostwriting, logo design, etc.), see <a href="https://www.wikiwand.com/en/articles/Wikipedia%3AList_of_paid_editing_companies" target="_blank" rel="noopener">this Wikiwand entry</a>.</p>


feed_id: https://krebsonsecurity.com/?p=71250
title: Patch Tuesday, May 2025 Edition
uri: Patch-Tuesday-May-2025-Edition
url: https://krebsonsecurity.com/2025/05/patch-tuesday-may-2025-edition/
content:
<p><strong>Microsoft</strong> on Tuesday released software updates to fix at least 70 vulnerabilities in <strong>Windows</strong> and related products, including <em>five zero-day flaws that are already seeing active exploitation</em>. Adding to the sense of urgency with this month&#8217;s patch batch from Redmond are fixes for two other weaknesses that now have public proof-of-concept exploits available.</p>
<p><img decoding="async" class="aligncenter  wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Microsoft and several security firms have disclosed that attackers are exploiting a pair of bugs in the <strong>Windows Common Log File System</strong> (CLFS) driver that allow attackers to elevate their privileges on a vulnerable device. The Windows CLFS is a critical Windows component responsible for logging services, and is widely used by Windows system services and third-party applications for logging. Tracked as <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-32701" target="_blank" rel="noopener">CVE-2025-32701</a> &amp; <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-32706" target="_blank" rel="noopener">CVE-2025-32706</a>, these flaws are present in all supported versions of Windows 10 and 11, as well as their server versions.</p>
<p><strong>Kev Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>, said privilege escalation bugs assume an attacker already has initial access to a compromised host, typically through a phishing attack or by using stolen credentials. But if that access already exists, Breen said, attackers can gain access to the much more powerful Windows SYSTEM account, which can disable security tooling or even gain domain administration level permissions using credential harvesting tools.</p>
<p>&#8220;The patch notes don&#8217;t provide technical details on how this is being exploited, and no Indicators of Compromise (IOCs) are shared, meaning the only mitigation security teams have is to apply these patches immediately,&#8221; he said. &#8220;The average time from public disclosure to exploitation at scale is less than five days, with threat actors, ransomware groups, and affiliates quick to leverage these vulnerabilities.&#8221;</p>
<p>Two other zero-days patched by Microsoft today also were elevation of privilege flaws: <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-32709" target="_blank" rel="noopener">CVE-2025-32709</a>, which concerns afd.sys, the <strong>Windows Ancillary Function Driver</strong> that enables Windows applications to connect to the Internet; and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-30400" target="_blank" rel="noopener">CVE-2025-30400</a>, a weakness in the <strong>Desktop Window Manager</strong> (DWM) library for Windows. As <strong>Adam Barnett</strong> at <strong>Rapid7</strong> notes, tomorrow marks the <a href="https://www.rapid7.com/blog/post/2024/05/14/patch-tuesday-may-2024/" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.rapid7.com/blog/post/2024/05/14/patch-tuesday-may-2024/&amp;source=gmail&amp;ust=1747257386891000&amp;usg=AOvVaw3VPzmtS8Na55bRRDOUkbDw">one-year anniversary</a> of <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-30051" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-30051&amp;source=gmail&amp;ust=1747257386891000&amp;usg=AOvVaw2HzZh4Tm-0eKXolluDR0FX">CVE-2024-30051</a>, a previous zero-day elevation of privilege vulnerability in this same DWM component.</p>
<p>The fifth zero-day patched today is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-30397" target="_blank" rel="noopener">CVE-2025-30397</a>, a flaw in the <strong>Microsoft Scripting Engine</strong>, a key component used by <strong>Internet Explorer</strong> and <strong>Internet Explorer mode</strong> in <strong>Microsoft Edge</strong>.<span id="more-71250"></span></p>
<p><strong>Chris Goettl</strong> at <strong>Ivanti</strong> points out that the Windows 11 and Server 2025 updates include some new AI features that carry a lot of baggage and weigh in at around 4 gigabytes. Said baggage includes new artificial intelligence (AI) capabilities, including the controversial <strong>Recall</strong> feature, which constantly takes screenshots of what users are doing on Windows CoPilot-enabled computers.</p>
<p>Microsoft went back to the drawing board on Recall after a fountain of negative feedback from security experts, who warned it would present an attractive target and a potential gold mine for attackers. Microsoft appears to have made some efforts to prevent Recall from scooping up sensitive financial information, but privacy and security concerns still linger. Former Microsoftie <strong>Kevin Beaumont</strong> has <a href="https://cyberplace.social/@GossiTheDog/114360483150635243" target="_blank" rel="noopener">a good teardown</a> on Microsoft&#8217;s updates to Recall.</p>
<p>In any case, <strong>windowslatest.com</strong> reports that <strong>Windows 11 version 24H2</strong> shows up ready for downloads, even if you don&#8217;t want it.</p>
<p>&#8220;It will now show up for &#8216;download and install&#8217; automatically if you go to Settings &gt; Windows Update and click Check for updates, but only when your device does not have a compatibility hold,&#8221; the publication <a href="https://www.windowslatest.com/2025/05/05/windows-11-24h2-now-fully-ready-downloads-even-if-you-dont-want-it/" target="_blank" rel="noopener">reported</a>. &#8220;Even if you don&#8217;t check for updates, Windows 11 24H2 will automatically download at some point.&#8221;</p>
<p>Apple users likely have their own patching to do. On May 12 Apple released security updates to fix at least 30 vulnerabilities in <strong>iOS</strong> and <strong>iPadOS</strong> (the updated version <a href="https://support.apple.com/en-us/122404" target="_blank" rel="noopener">is 18.5</a>). <strong>TechCrunch</strong> <a href="https://techcrunch.com/2025/05/12/apple-brings-emergency-satellite-features-to-iphone-13-with-ios-18-5/" target="_blank" rel="noopener">writes</a> that iOS 18.5 also expands emergency satellite capabilities to iPhone 13 owners for the first time (previously it was only available on iPhone 14 or later).</p>
<p>Apple also <a href="https://support.apple.com/en-us/100100" target="_blank" rel="noopener">released updates</a> for <strong>macOS Sequoia</strong>, <strong>macOS Sonoma</strong>, <strong>macOS Ventura</strong>, <strong>WatchOS</strong>, <strong>tvOS</strong> and <strong>visionOS</strong>. Apple said there is no indication of active exploitation for any of the vulnerabilities fixed this month.</p>
<p>As always, please back up your device and/or important data before attempting any updates. And please feel free to sound off in the comments if you run into any problems applying any of these fixes.</p>


feed_id: https://krebsonsecurity.com/?p=71263
title: Breachforums Boss to Pay $700k in Healthcare Breach
uri: Breachforums-Boss-to-Pay-700k-in-Healthcare-Breach
url: https://krebsonsecurity.com/2025/05/breachforums-boss-to-pay-700k-in-healthcare-breach/
content:
<p>In what experts are calling a novel legal outcome, the 22-year-old former administrator of the cybercrime community <strong>Breachforums </strong>will forfeit nearly $700,000 to settle a civil lawsuit from a health insurance company whose customer data was posted for sale on the forum in 2023. <strong>Conor Brian Fitzpatrick</strong>, a.k.a. &#8220;<strong>Pompompurin</strong>,&#8221; is slated for resentencing next month after pleading guilty to access device fraud and possession of child sexual abuse material (CSAM).</p>
<div id="attachment_71274" style="width: 985px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71274" decoding="async" class="size-full wp-image-71274" src="media/6157bc72.breached-nonstop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/breached-nonstop.png" alt="" width="975" height="364" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/breached-nonstop.png 975w, https://krebsonsecurity.com/wp-content/uploads/2025/05/breached-nonstop-768x287.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/breached-nonstop-782x292.png 782w" sizes="(max-width: 975px) 100vw, 975px" /><p id="caption-attachment-71274" class="wp-caption-text">A redacted screenshot of the Breachforums sales thread. Image: Ke-la.com.</p></div>
<p>On January 18, 2023, denizens of Breachforums posted for sale tens of thousands of records &#8212; including Social Security numbers, dates of birth, addresses, and phone numbers  &#8212; stolen from <strong>Nonstop Health</strong>, an insurance provider based in Concord, Calif.</p>
<p>Class-action attorneys sued Nonstop Health, which added Fitzpatrick as a third-party defendant to the civil litigation in November 2023, several months after he was <a href="https://krebsonsecurity.com/2023/03/feds-charge-ny-man-as-breachforums-boss-pompompurin/" target="_blank" rel="noopener">arrested by the FBI</a> and criminally charged with access device fraud and CSAM possession. In January 2025, Nonstop <a href="https://topclassactions.com/lawsuit-settlements/closed-settlements/1-6m-nonstop-administration-and-insurance-services-data-breach-class-action-settlement/" target="_blank" rel="noopener">agreed to pay $1.5 million</a> to settle the class action.</p>
<p><strong>Jill Fertel</strong> is a former federal prosecutor who runs the cyber litigation practice at <strong>Cipriani &amp; Werner</strong>, the law firm that represented Nonstop Health. Fertel told KrebsOnSecurity this is the first and only case where a cybercriminal or anyone related to the security incident was actually named in civil litigation.</p>
<p>&#8220;Civil plaintiffs are not at all likely to see money seized from threat actors involved in the incident to be made available to people impacted by the breach,&#8221; Fertel said. &#8220;The best we could do was make this money available to the class, but it&#8217;s still incumbent on the members of the class who are impacted to make that claim.&#8221;</p>
<p><strong>Mark Rasch</strong> is a former federal prosecutor who now represents <strong>Unit 221B</strong>, a cybersecurity firm based in New York City. Rasch said he doesn&#8217;t doubt that the civil settlement involving Fitzpatrick&#8217;s criminal activity is a novel legal development.</p>
<p>&#8220;It is rare in these civil cases that you know the threat actor involved in the breach, and it&#8217;s also rare that you catch them with sufficient resources to be able to pay a claim,&#8221; Rasch said.</p>
<p>Despite admitting to possessing more than 600 CSAM images and personally operating Breachforums, Fitzpatrick was <a href="https://cyberscoop.com/jailed-breachforums-creator-admin-sentenced-to-20-years-of-supervised-release/" target="_blank" rel="noopener">sentenced in January 2024 to time served</a> and 20 years of supervised release. Federal prosecutors objected, arguing that his punishment failed to adequately reflect the seriousness of his crimes or serve as a deterrent.</p>
<div id="attachment_71269" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71269" decoding="async" loading="lazy" class=" wp-image-71269" src="media/8b46c926.pom-csam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/pom-csam.png" alt="" width="749" height="299" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/pom-csam.png 789w, https://krebsonsecurity.com/wp-content/uploads/2025/05/pom-csam-768x307.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/pom-csam-782x312.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71269" class="wp-caption-text">An excerpt from a pre-sentencing report for Fitzpatrick indicates he had more than 600 CSAM images on his devices.</p></div>
<p>Indeed, the same month he was sentenced Fitzpatrick <a href="media/4184efd1.sdny-24mj003-waiver-jan22024.pdf" data-original-source="https://dd80b675424c132b90b3-e48385e382d2e5d17821a5e1d8e4c86b.ssl.cf1.rackcdn.com/external/sdny-24mj003-waiver-jan22024.pdf" target="_blank" rel="noopener">was rearrested</a> (PDF) for violating the terms of his release, which forbade him from using a computer that didn&#8217;t have court-required monitoring software installed.</p>
<p>Federal prosecutors said Fitzpatrick went on Discord following his guilty plea and <a href="https://law.justia.com/cases/federal/appellate-courts/ca4/24-4102/24-4102-2025-01-21.html" target="_blank" rel="noopener">professed innocence</a> to the very crimes to which he&#8217;d pleaded guilty, stating that his plea deal was &#8220;so BS&#8221; and that he had &#8220;wanted to fight it.&#8221; The feds said Fitzpatrick also joked with his friends about selling data to foreign governments, exhorting one user to &#8220;become a foreign asset to china or russia,&#8221; and to &#8220;sell government secrets.&#8221;<span id="more-71263"></span></p>
<p>In January 2025, a federal appeals court agreed with the government&#8217;s assessment, <a href="https://cyberscoop.com/conor-fitzpatrick-resentenced-pompompurin-breachforums/" target="_blank" rel="noopener">vacating Fitzpatrick&#8217;s sentence</a> and ordering him to be resentenced on June 3, 2025.</p>
<p>Fitzpatrick launched BreachForums in March 2022 to replace <strong>RaidForums</strong>, a similarly popular crime forum that was <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">infiltrated and shut down by the FBI</a> the previous month. As administrator, his alter ego Pompompurin served as the middleman, personally reviewing all databases for sale on the forum and offering an escrow service to those interested in buying stolen data.</p>
<div id="attachment_71270" style="width: 375px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71270" decoding="async" loading="lazy" class=" wp-image-71270" src="media/daee2510.conorfitzpatrick-yearbook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/conorfitzpatrick-yearbook.png" alt="" width="365" height="560" /><p id="caption-attachment-71270" class="wp-caption-text">A yearbook photo of Fitzpatrick unearthed by the Yonkers Times.</p></div>
<p>The new site quickly attracted more than 300,000 users, and facilitated the sale of databases stolen from hundreds of hacking victims, including some of the largest consumer data breaches in recent history. In May 2024, a reincarnation of Breachforums was seized by the FBI and international partners. Still more relaunches of the forum occurred after that, with <a href="https://socradar.io/breachforums-is-offline-a-new-twist-or-just-another-cyber-sheningan/" target="_blank" rel="noopener">the most recent disruption</a> last month.</p>
<p>As KrebsOnSecurity reported last year in <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/" target="_blank" rel="noopener">The Dark Nexus Between Harm Groups and The Com</a>, it is increasingly common for federal investigators to find CSAM material when searching devices seized from cybercriminal suspects. While the mere possession of CSAM is a serious federal crime, not all of those caught with CSAM are necessarily creators or distributors of it. Fertel said some cybercriminal communities have been known to require new entrants to share CSAM material as a way of proving that they are not a federal investigator.</p>
<p>&#8220;If you&#8217;re going to the darkest corners of Internet, that&#8217;s how you prove you&#8217;re not law enforcement,&#8221; Fertel said. &#8220;Law enforcement would never share that material. It would be criminal for me as a prosecutor, if I obtained and possessed those types of images.&#8221;</p>
<p>Further reading: <a href="media/d346f22a.19420931.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/19420931.pdf" target="_blank" rel="noopener">The settlement between Fitzpatrick and Nonstop</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=71303
title: KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS
uri: KrebsOnSecurity-Hit-With-Near-Record-6-3-Tbps-DDoS
url: https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with-near-record-6-3-tbps-ddos/
content:
<p>KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching crippling digital assaults that few web destinations can withstand. Read on for more about the botnet, the attack, and the apparent creator of this global menace.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-71312" src="media/5c582ce0.ddosbomb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/ddosbomb.png" alt="" width="661" height="542" /></p>
<p>For reference, the 6.3 Tbps attack last week was ten times the size of the assault launched against this site in 2016 by the <strong>Mirai</strong> IoT botnet, which <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">held KrebsOnSecurity offline for nearly four days</a>. The 2016 assault was so large that <strong>Akamai</strong> &#8211; which was providing pro-bono DDoS protection for KrebsOnSecurity at the time &#8212; asked me to leave their service because the attack was causing problems for their paying customers.</p>
<p>Since the Mirai attack, KrebsOnSecurity.com has been behind the protection of <strong>Project Shield</strong>, a free DDoS defense service that <strong>Google </strong>subsidiary <strong>Jigsaw</strong> provides to websites offering news, human rights, and election-related content. Google Security Engineer <strong>Damian Menscher</strong> told KrebsOnSecurity the May 12 attack was the largest Google has ever handled. In terms of sheer size, it is second only to a very similar attack that <strong>Cloudflare</strong> mitigated and <a href="https://blog.cloudflare.com/ddos-threat-report-for-2025-q1/#hyper-volumetric-attacks-continue-spill-into-q2" target="_blank" rel="noopener">wrote about in April</a>.</p>
<p>After comparing notes with Cloudflare, Menscher said the botnet that launched both attacks bear the fingerprints of <strong>Aisuru</strong>, a digital siege machine that first surfaced less than a year ago. Menscher said the attack on KrebsOnSecurity lasted less than a minute, hurling <a href="https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/udp-reflection-attacks.html" target="_blank" rel="noopener">large UDP data packets</a> at random ports <em>at a rate of approximately 585 million data packets per second</em>.</p>
<p>&#8220;It was the type of attack normally designed to overwhelm network links,&#8221; Menscher said, referring to the throughput connections between and among various Internet service providers (ISPs). &#8220;For most companies, this size of attack would kill them.&#8221;</p>
<div id="attachment_71311" style="width: 759px" class="wp-caption aligncenter"><a href="media/d6dfe536.cf-6.5ddos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/cf-6.5ddos.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71311" decoding="async" loading="lazy" class="wp-image-71311" src="media/d6dfe536.cf-6.5ddos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/cf-6.5ddos.png" alt="" width="749" height="340" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/cf-6.5ddos.png 906w, https://krebsonsecurity.com/wp-content/uploads/2025/05/cf-6.5ddos-768x348.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/cf-6.5ddos-782x355.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-71311" class="wp-caption-text">A graph depicting the 6.5 Tbps attack mitigated by Cloudflare in April 2025. Image: Cloudflare.</p></div>
<p>The Aisuru botnet comprises a globally-dispersed collection of hacked IoT devices, including routers, digital video recorders and other systems that are commandeered via default passwords or software vulnerabilities. As <a href="https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/" target="_blank" rel="noopener">documented</a> by researchers at <strong>QiAnXin XLab</strong>, the botnet was first identified in an August 2024 attack on a large gaming platform.</p>
<p>Aisuru reportedly went quiet after that exposure, only to reappear in November with even more firepower and software exploits. In a <a href="https://blog.xlab.qianxin.com/large-scale-botnet-airashi-en/" target="_blank" rel="noopener">January 2025 report</a>, XLab found the new and improved Aisuru (a.k.a. &#8220;<strong>Airashi</strong>&#8220;) had incorporated a previously unknown zero-day vulnerability in Cambium Networks cnPilot routers.</p>
<h2>NOT FORKING AROUND</h2>
<p>The people behind the Aisuru botnet have been peddling access to their DDoS machine in public <strong>Telegram</strong> chat channels that are closely monitored by multiple security firms. In August 2024, the botnet was rented out in subscription tiers ranging from $150 per day to $600 per week, offering attacks of up to two terabits per second.</p>
<p>&#8220;You may not attack any measurement walls, healthcare facilities, schools or government sites,&#8221; read a notice posted on Telegram by the Aisuru botnet owners in August 2024.</p>
<p>Interested parties were told to contact the Telegram handle &#8220;<strong>@yfork</strong>&#8221; to purchase a subscription. The account @yfork previously used the nickname &#8220;<strong>Forky</strong>,&#8221; an identity that has been posting to public DDoS-focused Telegram channels since 2021.</p>
<p>According to the FBI, Forky&#8217;s DDoS-for-hire domains have been seized in multiple law enforcement operations over the years. Last year, Forky said on Telegram he was selling the domain <strong>stresser[.]best</strong>, which saw its servers seized by the FBI in 2022 as part of an ongoing international law enforcement effort aimed at diminishing the supply of and demand for DDoS-for-hire services.</p>
<p>&#8220;The operator of this service, who calls himself &#8216;Forky,&#8217; operates a Telegram channel to advertise features and communicate with current and prospective DDoS customers,&#8221; reads <a href="media/889f3598.Booter-seizure-warrant-Tucows-2.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/Booter-seizure-warrant-Tucows-2.pdf" target="_blank" rel="noopener">an FBI seizure warrant</a> (PDF) issued for stresser[.]best. The FBI warrant stated that on the same day the seizures were announced, Forky posted <a href="https://krebsonsecurity.com/2022/12/six-charged-in-mass-takedown-of-ddos-for-hire-sites/" target="_blank" rel="noopener">a link to a story on this blog</a> that detailed the domain seizure operation, adding the comment, “We are buying our new domains right now.”</p>
<div id="attachment_71315" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71315" decoding="async" loading="lazy" class=" wp-image-71315" src="media/6f5bba5d.stresserbest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/stresserbest.png" alt="" width="748" height="663" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/stresserbest.png 953w, https://krebsonsecurity.com/wp-content/uploads/2025/05/stresserbest-768x681.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/stresserbest-782x693.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-71315" class="wp-caption-text">A screenshot from the FBI&#8217;s seizure warrant for Forky&#8217;s DDoS-for-hire domains shows Forky announcing the resurrection of their service at new domains.</p></div>
<p>Approximately ten hours later, Forky posted again, including a screenshot of the stresser[.]best user dashboard, instructing customers to use their saved passwords for the old website on the new one.</p>
<p>A review of Forky&#8217;s posts to public Telegram channels &#8212; as indexed by the cyber intelligence firms <strong>Unit 221B</strong> and <strong>Flashpoint</strong> &#8212; reveals a 21-year-old individual who claims to reside in Brazil [full disclosure: Flashpoint is currently an advertiser on this blog].</p>
<p>Since late 2022, Forky&#8217;s posts have frequently promoted a DDoS mitigation company and ISP that he operates called <strong>botshield[.]io</strong>. The Botshield website is connected to a business entity registered in the United Kingdom called <a href="https://find-and-update.company-information.service.gov.uk/officers/krPZ3H9McgoRJbksmVWst3yc9G0/appointments" target="_blank" rel="noopener">Botshield LTD</a>, which lists a 21-year-old woman from Sao Paulo, Brazil as the director. Internet routing records indicate Botshield (<a href="https://ipinfo.io/AS213613" target="_blank" rel="noopener">AS213613</a>) currently controls several hundred Internet addresses that were allocated to the company earlier this year.</p>
<p><strong>Domaintools.com</strong> reports that botshield[.]io was registered in July 2022 to a <strong>Kaike Southier Leite</strong> in Sao Paulo. A <a href="https://www.linkedin.com/in/kaike-southier-5074b82b6/" target="_blank" rel="noopener">LinkedIn profile</a> by the same name says this individual is a network specialist from Brazil who works in &#8220;the planning and implementation of robust network infrastructures, with a focus on security, DDoS mitigation, colocation and cloud server services.&#8221;</p>
<h2>MEET FORKY</h2>
<div id="attachment_71314" style="width: 789px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71314" decoding="async" loading="lazy" class="wp-image-71314 size-full" src="media/d8938e57.forky.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/forky.png" alt="" width="779" height="519" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/forky.png 779w, https://krebsonsecurity.com/wp-content/uploads/2025/05/forky-768x512.png 768w" sizes="(max-width: 779px) 100vw, 779px" /><p id="caption-attachment-71314" class="wp-caption-text">Image: Jaclyn Vernace / Shutterstock.com.</p></div>
<p>In his posts to public Telegram chat channels, Forky has hardly attempted to conceal his whereabouts or identity. In countless chat conversations indexed by Unit 221B, Forky could be seen talking about everyday life in Brazil, often remarking on the extremely low or high prices in Brazil for a range of goods, from computer and networking gear to narcotics and food.</p>
<p>Reached via Telegram, Forky claimed he was &#8220;not involved in this type of illegal actions for years now,&#8221; and that the project had been taken over by other unspecified developers. Forky initially told KrebsOnSecurity he had been out of the botnet scene for years, only to concede this wasn&#8217;t true when presented with public posts on Telegram from late last year that clearly showed otherwise.</p>
<p>Forky denied being involved in the attack on KrebsOnSecurity, but acknowledged that he helped to develop and market the Aisuru botnet. Forky claims he is now merely a staff member for the Aisuru botnet team, and that he stopped running the botnet roughly two months ago after starting a family. Forky also said the woman named as director of Botshield is related to him.</p>
<p>Forky offered equivocal, evasive responses to a number of questions about the Aisuru botnet and his business endeavors. But on one point he was crystal clear:</p>
<p>&#8220;I have zero fear about you, the FBI, or Interpol,&#8221; Forky said, asserting that he is now almost entirely focused on their hosting business &#8212; Botshield.<span id="more-71303"></span></p>
<p>Forky declined to discuss the makeup of his ISP&#8217;s clientele, or to clarify whether Botshield was more of a hosting provider or a DDoS mitigation firm. However, Forky has posted on Telegram about Botshield successfully mitigating large DDoS attacks launched against other DDoS-for-hire services.</p>
<p>DomainTools finds the same Sao Paulo street address in the registration records for botshield[.]io was used to register several other domains, including <strong>cant-mitigate[.]us.</strong> The email address in the WHOIS records for that domain is forkcontato@gmail.com, which DomainTools says was used to register the domain for the now-defunct DDoS-for-hire service <strong>stresser[.]us</strong>, one of the domains seized in <a href="https://krebsonsecurity.com/2023/05/feds-take-down-13-more-ddos-for-hire-services/" target="_blank" rel="noopener">the FBI&#8217;s 2023 crackdown</a>.</p>
<p>On May 8, 2023, the <strong>U.S. Department of Justice</strong> <a href="https://www.justice.gov/usao-cdca/pr/federal-authorities-seize-13-internet-domains-associated-booter-websites-offered-ddos" target="_blank" rel="noopener">announced</a> the seizure of stresser[.]us, along with a dozen other domains offering DDoS services. The DOJ said ten of the 13 domains were reincarnations of services that were seized during a <a href="https://www.justice.gov/usao-cdca/pr/federal-prosecutors-los-angeles-and-alaska-charge-6-defendants-operating-websites" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.justice.gov/usao-cdca/pr/federal-prosecutors-los-angeles-and-alaska-charge-6-defendants-operating-websites&amp;source=gmail&amp;ust=1747842233209000&amp;usg=AOvVaw0Tl0oBqaLrBCwcoLIjUEED">prior sweep in December</a>, which targeted 48 top stresser services (also known as &#8220;booters&#8221;).</p>
<p>Forky claimed he could find out who attacked my site with Aisuru. But when pressed a day later on the question, Forky said he&#8217;d come up empty-handed.</p>
<p>&#8220;I tried to ask around, all the big guys are not retarded enough to attack you,&#8221; Forky explained in an interview on Telegram. &#8220;I didn&#8217;t have anything to do with it. But you are welcome to write the story and try to put the blame on me.&#8221;</p>
<h2>THE GHOST OF MIRAI</h2>
<p>The 6.3 Tbps attack last week caused no visible disruption to this site, in part because it was so brief &#8212; lasting approximately 45 seconds. DDoS attacks of such magnitude and brevity typically are produced when botnet operators wish to test or demonstrate their firepower for the benefit of potential buyers. Indeed, Google&#8217;s Menscher said it is likely that both the May 12 attack and the slightly larger 6.5 Tbps attack against Cloudflare last month were simply tests of the same botnet&#8217;s capabilities.</p>
<p>In many ways, the threat posed by the Aisuru/Airashi botnet is reminiscent of Mirai, an innovative IoT malware strain that emerged in the summer of 2016 and successfully out-competed virtually all other IoT malware strains in existence at the time.</p>
<p>As first revealed by KrebsOnSecurity in January 2017, the Mirai authors were <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">two U.S. men who co-ran a DDoS mitigation service</a> &#8212; even as they were selling far more lucrative DDoS-for-hire services using the most powerful botnet on the planet.</p>
<p>Less than a week after the Mirai botnet was used in a days-long DDoS against KrebsOnSecurity, the Mirai authors <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">published the source code to their botnet</a> so that they would not be the only ones in possession of it in the event of their arrest by federal investigators.</p>
<p>Ironically, the leaking of the Mirai source is precisely what led to the eventual unmasking and arrest of the Mirai authors, who went on to serve probation sentences that <a href="https://www.wired.com/story/mirai-untold-story-three-young-hackers-web-killing-monster/" target="_blank" rel="noopener">required them to consult with FBI investigators on DDoS investigations</a>. But that leak also rapidly led to the creation of dozens of Mirai botnet clones, many of which were harnessed to fuel their own powerful DDoS-for-hire services.</p>
<p>Menscher told KrebsOnSecurity that as counterintuitive as it may sound, the Internet as a whole would probably be better off if the source code for Aisuru became public knowledge. After all, he said, the people behind Aisuru are in constant competition with other IoT botnet operators who are all striving to commandeer a finite number of vulnerable IoT devices globally.</p>
<p>Such a development would almost certainly cause a proliferation of Aisuru botnet clones, he said, but at least then the overall firepower from each individual botnet would be greatly diminished &#8212; or at least within range of the mitigation capabilities of most DDoS protection providers.</p>
<p>Barring a source code leak, Menscher said, it would be nice if someone published the full list of software exploits being used by the Aisuru operators to grow their botnet so quickly.</p>
<p>&#8220;Part of the reason Mirai was so dangerous was that it effectively took out competing botnets,&#8221; he said. &#8220;This attack somehow managed to compromise all these boxes that nobody else knows about. Ideally, we&#8217;d want to see that fragmented out, so that no [individual botnet operator] controls too much.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=71351
title: Oops: DanaBot Malware Devs Infected Their Own PCs
uri: Oops-DanaBot-Malware-Devs-Infected-Their-Own-PCs
url: https://krebsonsecurity.com/2025/05/oops-danabot-malware-devs-infected-their-own-pcs/
content:
<p>The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling <strong>DanaBot</strong>, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The <strong>FBI</strong> says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after accidentally infecting their own systems with the malware.</p>
<div id="attachment_71354" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71354" decoding="async" class=" wp-image-71354" src="media/0a4e930f.danabot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/danabot.png" alt="" width="749" height="650" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/danabot.png 817w, https://krebsonsecurity.com/wp-content/uploads/2025/05/danabot-768x666.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/danabot-782x679.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71354" class="wp-caption-text">DanaBot&#8217;s features, as promoted on its support site. Image: welivesecurity.com.</p></div>
<p>Initially <a href="https://www.proofpoint.com/us/threat-insight/post/danabot-new-banking-trojan-surfaces-down-under-0" target="_blank" rel="noopener">spotted</a> in May 2018 by researchers at the email security firm <strong>Proofpoint</strong>, DanaBot is a malware-as-a-service platform that specializes in credential theft and banking fraud.</p>
<p>Today, the <strong>U.S. Department of Justice</strong> unsealed a criminal complaint and indictment from 2022, which said the FBI identified at least 40 affiliates who were paying between $3,000 and $4,000 a month for access to the information stealer platform.</p>
<p>The government says the malware infected more than 300,000 systems globally, causing estimated losses of more than $50 million. The ringleaders of the DanaBot conspiracy are named as <strong>Aleksandr Stepanov</strong>, 39, a.k.a. “<strong>JimmBee</strong>,” and <strong>Artem Aleksandrovich Kalinkin</strong>, 34, a.k.a. “<strong>Onix</strong>”, both of Novosibirsk, Russia. Kalinkin is an IT engineer for the Russian state-owned energy giant <strong>Gazprom</strong>. His Facebook profile name is &#8220;Maffiozi.&#8221;</p>
<p>According to the FBI, there were at least two major versions of DanaBot; the first was sold between 2018 and June 2020, when the malware stopped being offered on Russian cybercrime forums. The government alleges that the second version of DanaBot &#8212; emerging in January 2021 &#8212; was provided to co-conspirators for use in targeting military, diplomatic and non-governmental organization computers in several countries, including the United States, Belarus, the United Kingdom, Germany, and Russia.</p>
<p>&#8220;Unindicted co-conspirators would use the Espionage Variant to compromise computers around the world and steal sensitive diplomatic communications, credentials, and other data from these targeted victims,&#8221; reads a grand jury indictment dated Sept. 20, 2022. &#8220;This stolen data included financial transactions by diplomatic staff, correspondence concerning day-to-day diplomatic activity, as well as summaries of a particular country&#8217;s interactions with the United States.&#8221;</p>
<p>The indictment says the FBI in 2022 seized servers used by the DanaBot authors to control their malware, as well as the servers that stored stolen victim data. The government said the server data also show numerous instances in which the DanaBot defendants infected their own PCs, resulting in their credential data being uploaded to stolen data repositories that were seized by the feds.</p>
<p>&#8220;In some cases, such self-infections appeared to be deliberately done in order to test, analyze, or improve the malware,&#8221; the criminal complaint reads. &#8220;In other cases, the infections seemed to be inadvertent &#8211; one of the hazards of committing cybercrime is that criminals will sometimes infect themselves with their own malware by mistake.&#8221;<span id="more-71351"></span></p>
<div id="attachment_71359" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71359" decoding="async" loading="lazy" class=" wp-image-71359" src="media/fbaa6c8d.eset-danabotmap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/eset-danabotmap.png" alt="" width="750" height="479" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/eset-danabotmap.png 846w, https://krebsonsecurity.com/wp-content/uploads/2025/05/eset-danabotmap-768x490.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/eset-danabotmap-782x499.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-71359" class="wp-caption-text">Image: welivesecurity.com</p></div>
<p>A <a href="https://www.justice.gov/usao-cdca/pr/16-defendants-federally-charged-connection-danabot-malware-scheme-infected-computers" target="_blank" rel="noopener">statement</a> from the DOJ says that as part of today&#8217;s operation, agents with the <strong>Defense Criminal Investigative Service</strong> (DCIS) seized the Danabot control servers, including dozens of virtual servers hosted in the United States. The government says it is now working with industry partners to notify DanaBot victims and help remediate infections. The statement credits a number of security firms with providing assistance to the government, including <strong>ESET</strong>, <strong>Flashpoint</strong>, <strong>Google</strong>, <strong>Intel 471</strong>, <strong>Lumen</strong>, <strong>PayPal</strong>, <strong>Proofpoint</strong>, <strong>Team CYRMU</strong>, and <strong>ZScaler</strong>.</p>
<p>It&#8217;s not unheard of for financially-oriented malicious software to be repurposed for espionage. A variant of the <strong>ZeuS Trojan</strong>, which was used in countless online banking attacks against companies in the United States and Europe between 2007 and at least 2015, was for a time diverted to espionage tasks by its author.</p>
<p>As detailed <a href="https://krebsonsecurity.com/2015/08/inside-the-100m-business-club-crime-gang/" target="_blank" rel="noopener">in this 2015 story,</a> the author of the ZeuS trojan created a custom version of the malware to serve purely as a spying machine, which scoured infected systems in Ukraine for specific keywords in emails and documents that would likely only be found in classified documents.</p>
<p>The public charging of the 16 DanaBot defendants comes a day after <strong>Microsoft</strong> <a href="https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/" target="_blank" rel="noopener">joined</a> a slew of tech companies in <a href="https://www.justice.gov/opa/pr/justice-department-seizes-domains-behind-major-information-stealing-malware-operation" target="_blank" rel="noopener">disrupting the IT infrastructure</a> for another malware-as-a-service offering &#8212; <a href="https://www.welivesecurity.com/en/eset-research/eset-takes-part-global-operation-disrupt-lumma-stealer/" target="_blank" rel="noopener">Lumma Stealer</a>, which is likewise offered to affiliates under tiered subscription prices ranging from $250 to $1,000 per month. Separately, Microsoft filed a civil lawsuit to seize control over 2,300 domain names used by Lumma Stealer and its affiliates.</p>
<p>Further reading:</p>
<p><a href="https://www.welivesecurity.com/en/eset-research/danabot-analyzing-fallen-empire/" target="_blank" rel="noopener">Danabot: Analyzing a Fallen Empire</a></p>
<p><a href="https://www.zscaler.com/blogs/security-research/danabot-launches-ddos-attack-against-ukrainian-ministry-defense" target="_blank" rel="noopener">ZScaler blog: DanaBot Launches DDoS Attack Against the Ukrainian Ministry of Defense</a></p>
<p><a href="https://flashpoint.io/blog/operation-endgame-danabot-malware/" target="_blank" rel="noopener">Flashpoint: Operation Endgame DanaBot Malware</a></p>
<p><a href="https://www.justice.gov/usao-cdca/media/1401361/dl?inline" target="_blank" rel="noopener">March 2022 criminal complaint v. Artem Aleksandrovich Kalinkin</a></p>
<p><a href="https://www.justice.gov/usao-cdca/media/1401356/dl?inline" target="_blank" rel="noopener">September 2022 grand jury indictment naming the 16 defendants</a></p>


feed_id: https://krebsonsecurity.com/?p=71337
title: Pakistan Arrests 21 in ‘Heartsender’ Malware Service
uri: Pakistan-Arrests-21-in-Heartsender-Malware-Service
url: https://krebsonsecurity.com/2025/05/pakistan-arrests-21-in-heartsender-malware-service/
content:
<p>Authorities in Pakistan have arrested 21 individuals accused of operating &#8220;<strong>Heartsender</strong>,&#8221; a once popular spam and malware dissemination service that operated for more than a decade. The main clientele for HeartSender were organized crime groups that tried to trick victim companies into making payments to a third party, and its alleged proprietors were publicly identified by KrebsOnSecurity in 2021 after they inadvertently infected their computers with malware.</p>
<div id="attachment_56867" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56867" decoding="async" class=" wp-image-56867" src="media/b066df15.fudcoteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam.png" alt="" width="750" height="351" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam.png 1694w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam-768x359.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam-1536x718.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam-782x366.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-56867" class="wp-caption-text">Some of the core developers and sellers of Heartsender posing at a work outing in 2021. WeCodeSolutions boss Rameez Shahzad (in sunglasses) is in the center of this group photo, which was posted by employee Burhan Ul Haq, pictured just to the right of Shahzad.</p></div>
<p>A <a href="https://www.dawn.com/news/1911691" target="_blank" rel="noopener">report</a> from the Pakistani media outlet <strong>Dawn</strong> states that authorities there arrested 21 people alleged to have operated Heartsender, a spam delivery service whose homepage openly advertised phishing kits targeting users of various Internet companies, including Microsoft 365, Yahoo, AOL, Intuit, iCloud and ID.me. Pakistan&#8217;s <strong>National Cyber Crime Investigation Agency</strong> (NCCIA) reportedly conducted raids in Lahore&#8217;s Bahria Town and Multan on May 15 and 16.</p>
<p>The NCCIA told reporters the group’s tools were connected to more than $50m in losses in the United States alone, with European authorities investigating 63 additional cases.</p>
<p>“This wasn’t just a scam operation &#8211; it was essentially a cybercrime university that empowered fraudsters globally,” <strong>NCCIA Director Abdul Ghaffar</strong> said at a press briefing.</p>
<p>In January 2025, the FBI and the Dutch Police <a href="https://krebsonsecurity.com/2025/01/fbi-dutch-police-disrupt-manipulaters-phishing-gang/" target="_blank" rel="noopener">seized the technical infrastructure</a> for the cybercrime service, which was marketed under the brands Heartsender, <strong>Fudpage</strong> and <strong>Fudtools</strong> (and many other “fud” variations). The “fud” bit stands for “Fully Un-Detectable,” and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances.</p>
<p>The FBI says transnational organized crime groups that purchased these services primarily used them to run business email compromise (BEC) schemes, wherein the cybercrime actors tricked victim companies into making payments to a third party.</p>
<p>Dawn reported that those arrested included <strong>Rameez Shahzad</strong>, the alleged ringleader of the Heartsender cybercrime business, which most recently operated under the Pakistani front company <strong>WeCodeSolutions</strong>. Mr. Shahzad was named and pictured in a 2021 KrebsOnSecurity story about <a href="https://krebsonsecurity.com/2021/09/fudco-spam-empire-tied-to-pakistani-software-firm/" target="_blank" rel="noopener">a series of remarkable operational security mistakes</a> that exposed their identities and Facebook pages showing employees posing for group photos and socializing at work-related outings.<span id="more-71337"></span></p>
<p>Prior to folding their operations behind WeCodeSolutions, Shahzad and others arrested this month operated as a web hosting group calling itself <strong>The Manipulaters</strong>. KrebsOnSecurity <a href="https://krebsonsecurity.com/2015/05/phishing-gang-is-audacious-manipulator/" target="_blank" rel="noopener">first wrote about The Manipulaters in May 2015</a>, mainly because their ads at the time were blanketing a number of popular cybercrime forums, and because they were fairly open and brazen about what they were doing — even who they were in real life.</p>
<p>Sometime in 2019, The Manipulaters <a href="https://krebsonsecurity.com/2021/09/fudco-spam-empire-tied-to-pakistani-software-firm/" target="_blank" rel="noopener">failed to renew their core domain name</a> — manipulaters[.]com — the same one tied to so many of the company’s business operations. That domain was quickly scooped up by <a href="https://www.scyllaintel.com/" target="_blank" rel="noopener">Scylla Intel</a>, a cyber intelligence firm that specializes in connecting cybercriminals to their real-life identities. Soon after, Scylla started receiving large amounts of email correspondence intended for the group&#8217;s owners.</p>
<p>In 2024, <strong>DomainTools.com</strong> <a href="https://krebsonsecurity.com/2024/04/the-manipulaters-improve-phishing-still-fail-at-opsec/" target="_blank" rel="noopener">found</a> the web-hosted version of Heartsender leaked an extraordinary amount of user information to unauthenticated users, including customer credentials and email records from Heartsender employees. DomainTools says the malware infections on Manipulaters PCs exposed “vast swaths of account-related data along with an outline of the group’s membership, operations, and position in the broader underground economy.”</p>
<p>Shahzad allegedly used the alias &#8220;<strong>Saim Raza</strong>,&#8221; an identity which has contacted KrebsOnSecurity multiple times over the past decade with demands to remove stories published about the group. The Saim Raza identity most recently contacted this author in November 2024, asserting they had quit the cybercrime industry and turned over a new leaf after a brush with the Pakistani police.</p>
<p>The arrested suspects include Rameez Shahzad, Muhammad Aslam (Rameez’s father), Atif Hussain, Muhammad Umar Irshad, Yasir Ali, Syed Saim Ali Shah, Muhammad Nowsherwan, Burhanul Haq, Adnan Munawar, Abdul Moiz, Hussnain Haider, Bilal Ahmad, Dilbar Hussain, Muhammad Adeel Akram, Awais Rasool, Usama Farooq, Usama Mehmood and Hamad Nawaz.</p>


feed_id: https://krebsonsecurity.com/?p=71387
title: U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams
uri: U-S-Sanctions-Cloud-Provider-Funnull-as-Top-Source-of-Pig-Bu
url:
https://krebsonsecurity.com/2025/05/u-s-sanctions-cloud-provider-funnull-as-top-source-of-pig-butchering-scams/

content:
<div id="attachment_70230" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-70230" decoding="async" class=" wp-image-70230" src="media/6d10ad7b.funnell-ss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss.png" alt="" width="750" height="452" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss.png 1319w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss-768x463.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/01/funnell-ss-782x472.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-70230" class="wp-caption-text">Image: Shutterstock, ArtHead.</p></div>
<p>The U.S. government today imposed economic sanctions on <strong>Funnull Technology Inc.</strong>, a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “<strong>pig butchering</strong>.&#8221; In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to cybercriminals seeking to route their traffic through U.S.-based cloud providers.</p>
<p>&#8220;Americans lose billions of dollars annually to these cyber scams, with revenues generated from these crimes rising to record levels in 2024,&#8221; reads <a href="https://home.treasury.gov/news/press-releases/sb0149" target="_blank" rel="noopener">a statement</a> from the <strong>U.S. Department of the Treasury</strong>, which sanctioned Funnull and its 40-year-old Chinese administrator <strong>Liu Lizhi</strong>. &#8220;Funnull has directly facilitated several of these schemes, resulting in over $200 million in U.S. victim-reported losses.&#8221;</p>
<p>The Treasury Department said Funnull&#8217;s operations are linked to the majority of virtual currency investment scam websites reported to the FBI. The agency said Funnull directly facilitated pig butchering and other schemes that resulted in more than $200 million in financial losses by Americans.</p>
<p>Pig butchering is a rampant form of fraud wherein people are lured by flirtatious strangers online into investing in fraudulent cryptocurrency trading platforms. Victims are coached to invest more and more money into what appears to be an extremely profitable trading platform, only to find their money is gone when they wish to cash out.</p>
<p>The scammers often insist that investors pay additional &#8220;taxes&#8221; on their crypto &#8220;earnings&#8221; before they can see their invested funds again (spoiler: they never do), and a shocking number of people <a href="https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/" target="_blank" rel="noopener">have lost six figures or more through these pig butchering scams</a>.</p>
<p>KrebsOnSecurity&#8217;s <a href="https://krebsonsecurity.com/2025/01/infrastructure-laundering-blending-in-with-the-cloud/" target="_blank" rel="noopener">January story on Funnull</a> was based on research from the security firm <strong>Silent Push</strong>, which discovered in October 2024 that a vast number of domains hosted via Funnull were promoting gambling sites that bore the logo of the <strong>Suncity Group</strong>, a Chinese entity named in <a href="media/62b24cf9.Casino_Underground_Banking_Report_2024.pdf" data-original-source="https://www.unodc.org/roseap/uploads/documents/Publications/2024/Casino_Underground_Banking_Report_2024.pdf" target="_blank" rel="noopener">a 2024 UN report</a> (PDF) for laundering millions of dollars for the North Korean state-sponsored hacking group <a href="https://en.wikipedia.org/wiki/Lazarus_Group" target="_blank" rel="noopener">Lazarus</a>.</p>
<p>Silent Push found Funnull was a criminal content delivery network (CDN) that carried a great deal of traffic tied to scam websites, funneling the traffic through a dizzying chain of auto-generated domain names and U.S.-based cloud providers before redirecting to malicious or phishous websites. The FBI has released a <a href="media/22ba7730.250529.pdf" data-original-source="https://www.ic3.gov/CSA/2025/250529.pdf" target="_blank" rel="noopener">technical writeup</a> (PDF) of the infrastructure used to manage the malicious Funnull domains between October 2023 and April 2025.</p>
<div id="attachment_71392" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71392" decoding="async" loading="lazy" class=" wp-image-71392" src="media/0027ed68.funnull-network.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/05/funnull-network.png" alt="" width="749" height="464" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/05/funnull-network.png 2556w, https://krebsonsecurity.com/wp-content/uploads/2025/05/funnull-network-768x476.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/05/funnull-network-1536x952.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/05/funnull-network-2048x1269.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2025/05/funnull-network-782x485.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71392" class="wp-caption-text">A graphic from the FBI explaining how Funnull generated a slew of new domains on a regular basis and mapped them to Internet addresses on U.S. cloud providers.</p></div>
<p>Silent Push <a href="https://www.silentpush.com/blog/infrastructure-laundering/" target="_blank" rel="noopener">revisited Funnull&#8217;s infrastructure</a> in January 2025 and found Funnull was still using many of the same <strong>Amazon</strong> and <strong>Microsoft</strong> cloud Internet addresses identified as malicious in its October report. Both Amazon and Microsoft pledged to rid their networks of Funnull&#8217;s presence following that story, but according to Silent Push&#8217;s <strong>Zach Edwards</strong> only one of those companies has followed through.</p>
<p>Edwards said Silent Push no longer sees Microsoft Internet addresses showing up in Funnull&#8217;s infrastructure, while Amazon continues to struggle with removing Funnull servers, including one that appears to have first materialized in 2023.</p>
<p>&#8220;Amazon is doing a terrible job &#8212; every day since they made those claims to you and us in our public blog they have had IPs still mapped to Funnull, including some that have stayed mapped for inexplicable periods of time,&#8221; Edwards said.</p>
<p>Amazon said its Amazon Web Services (AWS) hosting platform actively counters abuse attempts.</p>
<p>&#8220;We have stopped hundreds of attempts this year related to this group and we are looking into the information you shared earlier today,&#8221; reads a statement shared by Amazon. &#8220;If anyone suspects that AWS resources are being used for abusive activity, they can report it to AWS Trust &amp; Safety using the report abuse form <a href="https://support.aws.amazon.com/#/contacts/report-abuse" target="_blank" rel="noopener">here</a>.&#8221;</p>
<p><span id="more-71387"></span></p>
<p>U.S. based cloud providers remain an attractive home base for cybercriminal organizations because many organizations will not be overly aggressive in blocking traffic from U.S.-based cloud networks, as doing so can result in blocking access to many legitimate web destinations that are also on that same shared network segment or host.</p>
<p>What&#8217;s more, funneling their bad traffic so that it appears to be coming out of U.S. cloud Internet providers allows cybercriminals to connect to websites from web addresses that are geographically close(r) to their targets and victims (to sidestep location-based security controls by your bank, for example).</p>
<p>Funnull is not the only cybercriminal infrastructure-as-a-service provider that was sanctioned this month: On May 20, 2025, the <strong>European Union</strong> <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202500966" target="_blank" rel="noopener">imposed sanctions</a> on <strong>Stark Industries Solutions</strong>, an ISP that materialized at the start of Russia’s invasion of Ukraine and has been used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia.</p>
<p>In May 2024, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">a deep dive on Stark Industries Solutions</a> that found much of the malicious traffic traversing Stark’s network (e.g. vulnerability scanning and password brute force attacks) was being bounced through U.S.-based cloud providers. My reporting showed how deeply Stark had penetrated U.S. ISPs, and that Ivan Neculiti for many years sold &#8220;bulletproof&#8221; hosting services that told Russian cybercrime forum customers they would proudly ignore any abuse complaints or police inquiries.</p>
<div id="attachment_67471" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67471" decoding="async" loading="lazy" class=" wp-image-67471" src="media/f5a3db0f.stark-industries-solutions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions.png" alt="" width="748" height="464" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions.png 1197w, https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions-768x477.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/05/stark-industries-solutions-782x485.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-67471" class="wp-caption-text">The homepage of Stark Industries Solutions.</p></div>
<p>That story examined the history of Stark&#8217;s co-founders, Moldovan brothers <strong>Ivan</strong> and <strong>Yuri Neculiti</strong>, who each denied past involvement in cybercrime or any current involvement in assisting Russian disinformation efforts or cyberattacks. Nevertheless, the EU sanctioned both brothers as well.</p>
<p>The EU said Stark and the Neculti brothers &#8220;enabled various Russian state-sponsored and state-affiliated actors to conduct destabilising activities including coordinated information manipulation and interference and cyber-attacks against the Union and third countries by providing services intended to hide these activities from European law enforcement and security agencies.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=71386
title: Proxy Services Feast on Ukraine’s IP Address Exodus
uri: Proxy-Services-Feast-on-Ukraine-s-IP-Address-Exodus
url: https://krebsonsecurity.com/2025/06/proxy-services-feast-on-ukraines-ip-address-exodus/
content:
<div id="attachment_71441" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71441" decoding="async" class=" wp-image-71441" src="media/7bd55aad.ukraine-networks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/ukraine-networks.png" alt="" width="749" height="611" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/ukraine-networks.png 823w, https://krebsonsecurity.com/wp-content/uploads/2025/06/ukraine-networks-768x626.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/ukraine-networks-782x638.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71441" class="wp-caption-text">Image: Mark Rademaker, via Shutterstock.</p></div>
<p>Ukraine has seen nearly one-fifth of its Internet space come under Russian control or sold to Internet address brokers since February 2022, a new study finds. The analysis indicates large chunks of Ukrainian Internet address space are now in the hands of shadowy proxy and anonymity services that are nested at some of America&#8217;s largest Internet service providers (ISPs).</p>
<p>The findings come in a report that examines how the Russian invasion has affected Ukraine&#8217;s domestic supply of <strong>Internet Protocol Version 4</strong> (IPv4) addresses. Researchers at <strong>Kentik</strong>, a company that measures the performance of Internet networks, found that while a majority of ISPs in Ukraine haven&#8217;t changed their infrastructure much since the war began in 2022, others have resorted to selling swathes of their valuable IPv4 address space just to keep the lights on.</p>
<p>For example, Ukraine&#8217;s incumbent ISP <strong>Ukrtelecom</strong> is now routing just 29 percent of the IPv4 address ranges that the company controlled at the start of the war, Kentik found. Although much of that former IP space remains dormant, Ukrtelecom told Kentik&#8217;s <strong>Doug Madory</strong> they were forced to sell many of their address blocks &#8220;to secure financial stability and continue delivering essential services.&#8221;</p>
<p>&#8220;Leasing out a portion of our IPv4 resources allowed us to mitigate some of the extraordinary challenges we have been facing since the full-scale invasion began,&#8221; Ukrtelecom told Madory.</p>
<p>Madory found much of the IPv4 space previously allocated to Ukrtelecom is now scattered to more than 100 providers globally, particularly at three large American ISPs &#8212; <strong>Amazon</strong> (AS16509), <strong>AT&amp;T</strong> (AS7018), and <strong>Cogent</strong> (AS174).</p>
<p>Another Ukrainian Internet provider &#8212; <strong>LVS</strong> (AS43310) &#8212; in 2022 was routing approximately 6,000 IPv4 addresses across the nation. Kentik learned that by November 2022, much of that address space had been parceled out to over a dozen different locations, with the bulk of it being announced at AT&amp;T.</p>
<div id="attachment_71448" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71448" decoding="async" loading="lazy" class=" wp-image-71448" src="media/f9c6319a.kentik-lvs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/kentik-lvs.png" alt="" width="745" height="505" /><p id="caption-attachment-71448" class="wp-caption-text">IP addresses routed over time by Ukrainian provider LVS (AS43310) shows a large chunk of it being routed by AT&amp;T (AS7018). Image: Kentik.</p></div>
<p>Ditto for the Ukrainian ISP <strong>TVCOM</strong>, which currently routes nearly 15,000 fewer IPv4 addresses than it did at the start of the war. Madory said most of those addresses have been scattered to 37 other networks outside of Eastern Europe, including Amazon, AT&amp;T, and <strong>Microsoft</strong>.</p>
<p>The Ukrainian ISP <strong>Trinity</strong> (AS43554) went offline in early March 2022 during the bloody siege of Mariupol, but its address space eventually began showing up in more than 50 different networks worldwide. Madory found more than 1,000 of Trinity&#8217;s IPv4 addresses suddenly appeared on AT&amp;T&#8217;s network.</p>
<p>Why are all these former Ukrainian IP addresses being routed by U.S.-based networks like AT&amp;T? According to <strong>spur.us</strong>, a company that tracks VPN and proxy services, nearly all of the address ranges identified by Kentik now map to commercial proxy services that allow customers to anonymously route their Internet traffic through someone else&#8217;s computer.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-31323" src="media/2591b79f.proxy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png" alt="" width="748" height="313" /></p>
<p>From a website’s perspective, the traffic from a proxy network user appears to originate from the rented IP address, not from the proxy service customer. These services can be used for several business purposes, such as price comparisons, sales intelligence, <a href="https://www.linkedin.com/feed/update/urn:li:activity:7326663504701140992/?actorCompanyId=51677041" target="_blank" rel="noopener">web crawlers and content-scraping bots</a>. However, proxy services also are <a href="https://intel471.com/blog/a-look-at-the-residential-proxy-market" target="_blank" rel="noopener">massively abused for hiding cybercrime activity</a> because they can make it difficult to trace malicious traffic to its original source.</p>
<p>IPv4 address ranges are always in high demand, which means they are also quite valuable. There are now multiple companies that will pay ISPs to lease out their unwanted or unused IPv4 address space. Madory said these IPv4 brokers will pay between $100-$500 per month to lease a block of 256 IPv4 addresses, and very often the entities most willing to pay those rental rates are proxy and VPN providers.</p>
<p>A cursory review of <a href="https://bgp.he.net/AS7018#_prefixes" target="_blank" rel="noopener">all Internet address blocks currently routed through AT&amp;T</a> &#8212; as seen in public records maintained by the Internet backbone provider <strong>Hurricane Electric</strong> &#8212; shows a preponderance of country flags other than the United States, including networks originating in Hungary, Lithuania, Moldova, Mauritius, Palestine, Seychelles, Slovenia, and Ukraine.</p>
<div id="attachment_71435" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71435" decoding="async" loading="lazy" class=" wp-image-71435" src="media/00c526b5.att-bg-he-net.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/att-bg-he-net.png" alt="" width="749" height="751" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/att-bg-he-net.png 924w, https://krebsonsecurity.com/wp-content/uploads/2025/06/att-bg-he-net-768x770.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/att-bg-he-net-782x785.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71435" class="wp-caption-text">AT&amp;T&#8217;s IPv4 address space seems to be routing a great deal of proxy traffic, including a large number of IP address ranges that were until recently routed by ISPs in Ukraine.</p></div>
<p>Asked about the apparent high incidence of proxy services routing foreign address blocks through AT&amp;T, the telecommunications giant said it recently changed its policy about originating routes for network blocks that are not owned and managed by AT&amp;T. That new policy, spelled out in <a href="http://serviceguidenew.att.com/sg_flashPlayerPage/MIS." target="_blank" rel="noopener">a February 2025 update to AT&amp;T&#8217;s terms of service</a>, gives those customers until Sept. 1, 2025 to originate their own IP space from their own autonomous system number (ASN), a unique number assigned to each ISP (AT&amp;T&#8217;s is AS7018).</p>
<p>“To ensure our customers receive the best quality of service, we changed our terms for dedicated internet in February 2025,&#8221; an AT&amp;T spokesperson said in an emailed reply. &#8220;We no longer permit static routes with IP addresses that we have not provided. We have been in the process of identifying and notifying affected customers that they have 90 days to transition to Border Gateway Protocol routing using their own autonomous system number.”<span id="more-71386"></span></p>
<p>Ironically, the co-mingling of Ukrainian IP address space with proxy providers has resulted in many of these addresses being used in cyberattacks against Ukraine and other enemies of Russia. Earlier this month, the European Union sanctioned <strong>Stark Industries Solutions Inc.</strong>, an ISP that surfaced two weeks before the Russian invasion and quickly became the source of large-scale DDoS attacks and spear-phishing attempts by Russian state-sponsored hacking groups. A deep dive into Stark&#8217;s considerable address space showed some of it was sourced from Ukrainian ISPs, and <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">most of it was connected to Russia-based proxy and anonymity services</a>.</p>
<div id="attachment_71443" style="width: 855px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71443" decoding="async" loading="lazy" class="size-full wp-image-71443" src="media/8f9a7f81.iproyal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/iproyal.png" alt="" width="845" height="462" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/iproyal.png 845w, https://krebsonsecurity.com/wp-content/uploads/2025/06/iproyal-768x420.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/iproyal-782x428.png 782w" sizes="(max-width: 845px) 100vw, 845px" /><p id="caption-attachment-71443" class="wp-caption-text">According to Spur, the proxy service IPRoyal is the current beneficiary of IP address blocks from several Ukrainian ISPs profiled in Kentik&#8217;s report. Customers can chose proxies by specifying the city and country they would to proxy their traffic through. Image: Trend Micro.</p></div>
<p>Spur&#8217;s Chief Technology Officer <strong>Riley Kilmer </strong>said AT&amp;T&#8217;s policy change will likely force many proxy services to migrate to other U.S. providers that have less stringent policies.</p>
<p>&#8220;AT&amp;T is the first one of the big ISPs that seems to be actually doing something about this,&#8221; Kilmer said. &#8220;We track several services that explicitly sell AT&amp;T IP addresses, and it will be very interesting to see what happens to those services come September.&#8221;</p>
<p>Still, Kilmer said, there are several other large U.S. ISPs that continue to make it easy for proxy services to bring their own IP addresses and host them in ranges that give the appearance of residential customers. For example, Kentik&#8217;s report identified former Ukrainian IP ranges showing up as proxy services routed by <strong>Cogent</strong> <strong>Communications </strong>(AS174), <a href="https://bgp.he.net/AS174#_prefixes" target="_blank" rel="noopener">a tier-one Internet backbone provider</a> based in Washington, D.C.</p>
<p>Kilmer said Cogent has become an attractive home base for proxy services because it is relatively easy to get Cogent to route an address block.</p>
<p>&#8220;In fairness, they transit a lot of traffic,&#8221; Kilmer said of Cogent. &#8220;But there&#8217;s a reason a lot of this proxy stuff shows up as Cogent: Because it&#8217;s super easy to get something routed there.&#8221;</p>
<p>Cogent declined a request to comment on Kentik&#8217;s findings.</p>


feed_id: https://krebsonsecurity.com/?p=71465
title: Patch Tuesday, June 2025 Edition
uri: Patch-Tuesday-June-2025-Edition
url: https://krebsonsecurity.com/2025/06/patch-tuesday-june-2025-edition/
content:
<p><strong>Microsoft</strong> today released security updates to fix at least 67 vulnerabilities in its <strong>Windows</strong> operating systems and software. Redmond warns that one of the flaws is already under active attack, and that software blueprints showing how to exploit a pervasive Windows bug patched this month are now public.</p>
<p><img decoding="async" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The sole zero-day flaw this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33053" target="_blank" rel="noopener">CVE-2025-33053</a>, a remote code execution flaw in the Windows implementation of <strong>WebDAV</strong> &#8212; an HTTP extension that lets users remotely manage files and directories on a server. While WebDAV isn&#8217;t enabled by default in Windows, its presence in legacy or specialized systems still makes it a relevant target, said <strong>Seth Hoyt</strong>, senior security engineer at <strong>Automox</strong>.</p>
<p><strong>Adam Barnett</strong>, lead software engineer at <strong>Rapid7</strong>, said Microsoft&#8217;s advisory for CVE-2025-33053 does not mention that the Windows implementation of WebDAV is listed as deprecated since November 2023, which in practical terms means that the WebClient service no longer starts by default.</p>
<p>&#8220;The advisory also has attack complexity as low, which means that exploitation does not require preparation of the target environment in any way that is beyond the attacker’s control,&#8221; Barnett said. &#8220;Exploitation relies on the user clicking a malicious link. It’s not clear how an asset would be immediately vulnerable if the service isn’t running, but all versions of Windows receive a patch, including those released since the deprecation of WebClient, like Server 2025 and Windows 11 24H2.&#8221;<span id="more-71465"></span></p>
<p>Microsoft warns that an &#8220;elevation of privilege&#8221; vulnerability in the <strong>Windows Server Message Block</strong> (SMB) client (<a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-33073" target="_blank" rel="noopener">CVE-2025-33073</a>) is likely to be exploited, given that proof-of-concept code for this bug is now public. CVE-2025-33073 has a CVSS risk score of 8.8 (out of 10), and exploitation of the flaw leads to the attacker gaining &#8220;SYSTEM&#8221; level control over a vulnerable PC.</p>
<p>&#8220;What makes this especially dangerous is that no further user interaction is required after the initial connection—something attackers can often trigger without the user realizing it,&#8221; said <strong>Alex Vovk</strong>, co-founder and CEO of <strong>Action1</strong>. &#8220;Given the high privilege level and ease of exploitation, this flaw poses a significant risk to Windows environments. The scope of affected systems is extensive, as SMB is a core Windows protocol used for file and printer sharing and inter-process communication.&#8221;</p>
<p>Beyond these highlights, 10 of the vulnerabilities fixed this month were rated &#8220;critical&#8221; by Microsoft, including eight remote code execution flaws.</p>
<p>Notably absent from this month&#8217;s patch batch is a fix for a newly discovered weakness in <strong>Windows Server 2025</strong> that allows attackers to act with the privileges of any user in Active Directory. The bug, dubbed &#8220;<strong>BadSuccessor</strong>,&#8221; was <a href="https://github.com/akamai/BadSuccessor" target="_blank" rel="noopener">publicly disclosed</a> by researchers at <strong>Akamai</strong> on May 21, and several public proof-of-concepts are now available. Tenable&#8217;s Satnam Narang said organizations that have at least one Windows Server 2025 domain controller should review permissions for principals and limit those permissions as much as possible.</p>
<p><strong>Adobe</strong> has released updates for <strong>Acrobat Reader</strong> and six other products addressing at least 259 vulnerabilities, most of them in an update for <strong>Experience Manager</strong>. <strong>Mozilla Firefox</strong> and <strong>Google Chrome</strong> both recently released security updates that require a restart of the browser to take effect. The latest Chrome update fixes two zero-day exploits in the browser (CVE-2025-5419 and CVE-2025-4664).</p>
<p>For a detailed breakdown on the individual security updates released by Microsoft today, check out the <a href="https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20June%202025/32032" target="_blank" rel="noopener">Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. Action 1 has <a href="https://www.action1.com/patch-tuesday/patch-tuesday-june-2025/?vyj" target="_blank" rel="noopener">a breakdown of patches from Microsoft</a> and a raft of other software vendors releasing fixes this month. As always, please back up your system and/or data before patching, and feel free to drop a note in the comments if you run into any problems applying these updates.</p>


feed_id: https://krebsonsecurity.com/?p=69927
title: Inside a Dark Adtech Empire Fed by Fake CAPTCHAs
uri: Inside-a-Dark-Adtech-Empire-Fed-by-Fake-CAPTCHAs
url: https://krebsonsecurity.com/2025/06/inside-a-dark-adtech-empire-fed-by-fake-captchas/
content:
<p>Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout from that investigation finds this dark ad tech industry is far more resilient and incestuous than previously known.</p>
<div id="attachment_71492" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71492" decoding="async" class=" wp-image-71492" src="media/d6def9d4.maladtech.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/maladtech.png" alt="" width="750" height="422" /><p id="caption-attachment-71492" class="wp-caption-text">Image: Infoblox.</p></div>
<p>In November 2024, researchers at the security firm <strong>Qurium</strong> published an investigation into &#8220;<a href="https://www.cybercom.mil/Media/News/Article/3895345/russian-disinformation-campaign-doppelgnger-unmasked-a-web-of-deception/" target="_blank" rel="noopener">Doppelganger</a>,&#8221; a disinformation network that promotes pro-Russian narratives and infiltrates Europe&#8217;s media landscape by pushing fake news through a network of cloned websites.</p>
<p>Doppelganger campaigns use specialized links that bounce the visitor&#8217;s browser through a long series of domains before the fake news content is served. Qurium <a href="https://www.qurium.org/forensics/when-kehr-meets-vextrio/" target="_blank" rel="noopener">found</a> Doppelganger relies on a sophisticated &#8220;domain cloaking&#8221; service, a technology that allows websites to present different content to search engines compared to what regular visitors see. The use of cloaking services helps the disinformation sites remain online longer than they otherwise would, while ensuring that only the targeted audience gets to view the intended content.</p>
<p>Qurium discovered that Doppelganger&#8217;s cloaking service also promoted online dating sites, and shared much of the same infrastructure with <strong>VexTrio</strong>, which is thought to be the oldest malicious traffic distribution system (TDS) in existence. While TDSs are commonly used by legitimate advertising networks to manage traffic from disparate sources and to track who or what is behind each click, VexTrio&#8217;s TDS largely manages web traffic from victims of phishing, malware, and social engineering scams.</p>
<h2>BREAKING BAD</h2>
<p>Digging deeper, Qurium noticed Doppelganger&#8217;s cloaking service used an Internet provider in Switzerland as the first entry point in a chain of domain redirections. They also noticed the same infrastructure hosted a pair of co-branded affiliate marketing services that were driving traffic to sketchy adult dating sites: <strong>LosPollos[.]com</strong> and <strong>TacoLoco[.]co</strong>.</p>
<p>The LosPollos ad network incorporates many elements and references from the hit series &#8220;Breaking Bad,&#8221; mirroring the fictional &#8220;Los Pollos Hermanos&#8221; restaurant chain that served as a money laundering operation for a violent methamphetamine cartel.</p>
<div id="attachment_71484" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71484" decoding="async" loading="lazy" class=" wp-image-71484" src="media/c7b41d3d.lospollos_mainpage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_mainpage.png" alt="" width="749" height="497" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_mainpage.png 2710w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_mainpage-768x510.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_mainpage-1536x1020.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_mainpage-2048x1360.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_mainpage-782x519.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-71484" class="wp-caption-text">The LosPollos advertising network invokes characters and themes from the hit show Breaking Bad. The logo for LosPollos (upper left) is the image of Gustavo Fring, the fictional chicken restaurant chain owner in the show.</p></div>
<p>Affiliates who sign up with LosPollos are given JavaScript-heavy &#8220;<strong>smartlinks</strong>&#8221; that drive traffic into the VexTrio TDS, which in turn distributes the traffic among a variety of advertising partners, including dating services, sweepstakes offers, bait-and-switch mobile apps, financial scams and malware download sites.</p>
<p>LosPollos affiliates typically stitch these smart links into <strong>WordPress</strong> websites that have been hacked via known vulnerabilities, and those affiliates will earn a small commission each time an Internet user referred by any of their hacked sites falls for one of these lures.</p>
<div id="attachment_71485" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71485" decoding="async" loading="lazy" class="wp-image-71485" src="media/d687385f.lospollos_subdomain_linkedIn_announcement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_subdomain_linkedIn_announcement.png" alt="" width="745" height="321" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_subdomain_linkedIn_announcement.png 1146w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_subdomain_linkedIn_announcement-768x331.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos_subdomain_linkedIn_announcement-782x337.png 782w" sizes="(max-width: 745px) 100vw, 745px" /><p id="caption-attachment-71485" class="wp-caption-text">The Los Pollos advertising network promoting itself on LinkedIn.</p></div>
<p>According to Qurium, TacoLoco is a traffic monetization network that uses deceptive tactics to trick Internet users into enabling &#8220;push notifications,&#8221; a <a href="https://tools.ietf.org/html/rfc8030" target="_blank" rel="noopener">cross-platform browser standard</a> that allows websites to show pop-up messages which appear outside of the browser. For example, on Microsoft Windows systems these notifications typically show up in the bottom right corner of the screen — just above the system clock.</p>
<p>In the case of VexTrio and TacoLoco, the notification approval requests themselves are deceptive — disguised as “CAPTCHA” challenges designed to distinguish automated bot traffic from real visitors. For years, VexTrio and its partners have successfully tricked countless users into enabling these site notifications, which are then used to continuously pepper the victim&#8217;s device with a variety of phony virus alerts and misleading pop-up messages.</p>
<div id="attachment_71486" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71486" decoding="async" loading="lazy" class=" wp-image-71486" src="media/b95e1919.maliciouspushcaptcha.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/maliciouspushcaptcha.png" alt="" width="749" height="643" /><p id="caption-attachment-71486" class="wp-caption-text">Examples of VexTrio landing pages that lead users to accept push notifications on their device.</p></div>
<p>According to <a href="https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report" target="_blank" rel="noopener">a December 2024 annual report</a> from <strong>GoDaddy</strong>, <em>nearly 40 percent of compromised websites in 2024 redirected visitors to VexTrio via LosPollos smartlinks</em>.<span id="more-69927"></span></p>
<h2>ADSPRO AND TEKNOLOGY</h2>
<p>On November 14, 2024, Qurium <a href="https://www.qurium.org/forensics/when-kehr-meets-vextrio/" target="_blank" rel="noopener">published research</a> to support its findings that LosPollos and TacoLoco were services operated by <strong>Adspro Group</strong>, a company registered in the Czech Republic and Russia, and that Adspro runs its infrastructure at the Swiss hosting providers <strong>C41</strong> and <strong>Teknology SA</strong>.</p>
<p>Qurium noted the LosPollos and TacoLoco sites state that their content is copyrighted by <strong>ByteCore AG</strong> and <strong>SkyForge Digital AG</strong>, both Swiss firms that are run by the owner of Teknology SA, <strong>Guilio Vitorrio Leonardo Cerutti</strong>. Further investigation revealed LosPollos and TacoLoco were apps developed by a company called <strong>Holacode</strong>, which lists Cerutti as its CEO.</p>
<p>The apps marketed by Holacode include numerous VPN services, as well as one called <strong>Spamshield</strong> that claims to stop unwanted push notifications. But in January, Infoblox said they tested the app on their own mobile devices, and found it hides the user&#8217;s notifications, and then after 24 hours stops hiding them and demands payment. Spamshield subsequently changed its developer name from Holacode to <strong>ApLabz</strong>, although Infoblox noted that the Terms of Service for several of the rebranded ApLabz apps still referenced Holacode in their terms of service.</p>
<p>Incredibly, Cerutti threatened to sue me for defamation before I&#8217;d even uttered his name or sent him a request for comment (Cerutti sent the unsolicited legal threat back in January after his company and my name were merely tagged in an Infoblox post on LinkedIn about VexTrio).</p>
<p>Asked to comment on the findings by Qurium and Infoblox, Cerutti vehemently denied being associated with VexTrio. Cerutti asserted that his companies all strictly adhere to the regulations of the countries in which they operate, and that they have been completely transparent about all of their operations.</p>
<p>&#8220;We are a group operating in the advertising and marketing space, with an affiliate network program,&#8221; Cerutti responded. &#8220;I am not [going] to say we are perfect, but I strongly declare we have no connection with VexTrio at all.&#8221;</p>
<p>&#8220;Unfortunately, as a big player in this space we also get to deal with plenty of publisher fraud, sketchy traffic, fake clicks, bots, hacked, listed and resold publisher accounts, etc, etc.,&#8221; Cerutti continued. &#8220;We bleed lots of money to such malpractices and conduct regular internal screenings and audits in a constant battle to remove bad traffic sources. It is also a highly competitive space, where some upstarts will often play dirty against more established mainstream players like us.&#8221;</p>
<p>Working with Qurium, researchers at the security firm <strong>Infoblox</strong> released details about VexTrio&#8217;s infrastructure to their industry partners. Just four days after Qurium published its findings, LosPollos announced it was suspending its push monetization service. Less than a month later, Adspro had rebranded to <strong>Aimed Global</strong>.</p>
<div id="attachment_71523" style="width: 759px" class="wp-caption aligncenter"><a href="media/562bfeb9.lospollos-mmap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos-mmap.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-71523" decoding="async" loading="lazy" class="wp-image-71523" src="media/562bfeb9.lospollos-mmap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos-mmap.png" alt="" width="749" height="455" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos-mmap.png 1549w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos-mmap-768x467.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos-mmap-1536x934.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2025/06/lospollos-mmap-782x476.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-71523" class="wp-caption-text">A mind map illustrating some of the key findings and connections in the Infoblox and Qurium investigations. Click to enlarge.</p></div>
<h2>A REVEALING PIVOT</h2>
<p>In March 2025, researchers at GoDaddy <a href="https://www.godaddy.com/resources/news/dollyway-malware-c2-tds" target="_blank" rel="noopener">chronicled</a> how <strong>DollyWay</strong> &#8212; a malware strain that has consistently redirected victims to VexTrio throughout its eight years of activity &#8212; suddenly stopped doing that on November 20, 2024. Virtually overnight, DollyWay and several other malware families that had previously used VexTrio began pushing their traffic through another TDS called <strong>Help TDS</strong>.</p>
<p>Digging further into historical DNS records and the unique code scripts used by the Help TDS, Infoblox determined it has long enjoyed an exclusive relationship with VexTrio (at least until LosPollos ended its push monetization service in November).</p>
<p>In <a href="https://blogs.infoblox.com/threat-intelligence/vexing-and-vicious-the-eerie-relationship-between-wordpress-hackers-and-an-adtech-cabal/" target="_blank" rel="noopener">a report released today</a>, Infoblox said an exhaustive analysis of the JavaScript code, website lures, smartlinks and DNS patterns used by VexTrio and Help TDS linked them with at least four other TDS operators (not counting TacoLoco). Those four entities &#8212; <strong>Partners House</strong>, <strong>BroPush</strong>, <strong>RichAds</strong> and <strong>RexPush</strong> &#8212; are all Russia-based push monetization programs that pay affiliates to drive signups for a variety of schemes, but mostly online dating services.</p>
<p>&#8220;As Los Pollos push monetization ended, we&#8217;ve seen an increase in fake CAPTCHAs that drive user acceptance of push notifications, particularly from Partners House,&#8221; the Infoblox report reads. &#8220;The relationship of these commercial entities remains a mystery; while they are certainly long-time partners redirecting traffic to one another, and they all have a Russian nexus, there is no overt common ownership.&#8221;</p>
<p><strong>Renee Burton</strong>, vice president of threat intelligence at Infoblox, said the security industry generally treats the deceptive methods used by VexTrio and other malicious TDSs as a kind of legally grey area that is mostly associated with less dangerous security threats, such as adware and scareware.</p>
<p>But Burton argues that this view is myopic, and helps perpetuate a dark adtech industry that also pushes plenty of straight-up malware, noting that hundreds of thousands of compromised websites around the world every year redirect victims to the tangled web of VexTrio and VexTrio-affiliate TDSs.</p>
<p>&#8220;These TDSs are a nefarious threat, because they&#8217;re the ones you can connect to the delivery of things like information stealers and scams that cost consumers billions of dollars a year,&#8221; Burton said. &#8220;From a larger strategic perspective, my takeaway is that Russian organized crime has control of malicious adtech, and these are just some of the many groups involved.&#8221;</p>
<h2>WHAT CAN YOU DO?</h2>
<p>As KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/11/be-very-sparing-in-allowing-site-notifications/" target="_blank" rel="noopener">warned way back in 2020</a>, it&#8217;s a good idea to be very sparing in approving notifications when browsing the Web. In many cases these notifications are benign, but as we&#8217;ve seen there are numerous dodgy firms that are paying site owners to install their notification scripts, and then reselling that communications pathway to scammers and online hucksters.</p>
<p>If you’d like to prevent sites from ever presenting notification requests, all of the major browser makers let you do this &#8212; either across the board or on a per-website basis. While it is true that blocking notifications entirely can break the functionality of some websites, doing this for any devices you manage on behalf of your less tech-savvy friends or family members might end up saving everyone a lot of headache down the road.</p>
<p>To modify site notification settings in <strong>Mozilla Firefox</strong>, navigate to Settings, Privacy &amp; Security, Permissions, and click the &#8220;Settings&#8221; tab next to &#8220;Notifications.&#8221; That page will display any notifications already permitted and allow you to edit or delete any entries. Tick the box next to &#8220;Block new requests asking to allow notifications&#8221; to stop them altogether.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-71514" src="media/c8b22883.firefox-notifications.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/firefox-notifications.png" alt="" width="750" height="542" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/firefox-notifications.png 1185w, https://krebsonsecurity.com/wp-content/uploads/2025/06/firefox-notifications-768x555.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/firefox-notifications-782x566.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>In <strong>Google Chrome</strong>, click the icon with the three dots to the right of the address bar, scroll all the way down to Settings, Privacy and Security, Site Settings, and Notifications. Select the &#8220;Don&#8217;t allow sites to send notifications&#8221; button if you want to banish notification requests forever.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-71515" src="media/03de0589.chromenotifications.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/chromenotifications.png" alt="" width="750" height="500" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/chromenotifications.png 822w, https://krebsonsecurity.com/wp-content/uploads/2025/06/chromenotifications-768x512.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/chromenotifications-782x521.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>In Apple&#8217;s <strong>Safari </strong>browser, go to Settings, Websites, and click on Notifications in the sidebar. Uncheck the option to &#8220;allow websites to ask for permission to send notifications&#8221; if you wish to turn off notification requests entirely.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-71516" src="media/e8066cea.safarinotifications.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/safarinotifications.png" alt="" width="749" height="499" srcset="https://krebsonsecurity.com/wp-content/uploads/2025/06/safarinotifications.png 822w, https://krebsonsecurity.com/wp-content/uploads/2025/06/safarinotifications-768x512.png 768w, https://krebsonsecurity.com/wp-content/uploads/2025/06/safarinotifications-782x521.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>


feed_id: https://krebsonsecurity.com/?p=71553
title: Senator Chides FBI for Weak Advice on Mobile Security
uri: Senator-Chides-FBI-for-Weak-Advice-on-Mobile-Security
url: https://krebsonsecurity.com/2025/06/senator-chides-fbi-for-weak-advice-on-mobile-security/
content:
<p>Agents with the <strong>Federal Bureau of Investigation</strong> (FBI) briefed Capitol Hill staff recently on hardening the security of their mobile devices, after a contacts list stolen from the personal phone of the White House Chief of Staff <strong>Susie Wiles</strong> was reportedly used to fuel a series of text messages and phone calls impersonating her to U.S. lawmakers. But in a letter this week to the FBI, one of the Senate&#8217;s most tech-savvy lawmakers says the feds aren&#8217;t doing enough to recommend more appropriate security protections that are already built into most consumer mobile devices.</p>
<div id="attachment_71570" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-71570" decoding="async" class=" wp-image-71570" src="media/1b2974ad.wyden-patel-letter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/wyden-patel-letter.png" alt="" width="752" height="822" /><p id="caption-attachment-71570" class="wp-caption-text">A screenshot of the first page from Sen. Wyden&#8217;s letter to FBI Director Kash Patel.</p></div>
<p>On May 29, <strong>The Wall Street Journal</strong> <a href="https://www.wsj.com/politics/policy/federal-authorities-probe-effort-to-impersonate-white-house-chief-of-staff-65da0d59" target="_blank" rel="noopener">reported</a> that federal authorities were investigating a clandestine effort to impersonate Ms. Wiles via text messages and in phone calls that may have used AI to spoof her voice. According to The Journal, Wiles told associates her cellphone contacts were hacked, giving the impersonator access to the private phone numbers of some of the country&#8217;s most influential people.</p>
<p>The execution of this phishing and impersonation campaign &#8212; whatever its goals may have been &#8212; suggested the attackers were financially motivated, and not particularly sophisticated.</p>
<p>&#8220;It became clear to some of the lawmakers that the requests were suspicious when the impersonator began asking questions about Trump that Wiles should have known the answers to—and in one case, when the impersonator asked for a cash transfer, some of the people said,&#8221; the Journal wrote. &#8220;In many cases, the impersonator’s grammar was broken and the messages were more formal than the way Wiles typically communicates, people who have received the messages said. The calls and text messages also didn’t come from Wiles’s phone number.&#8221;</p>
<p>Sophisticated or not, the impersonation campaign was soon <a href="https://www.justice.gov/opa/pr/after-two-day-manhunt-suspect-charged-shooting-two-minnesota-lawmakers-and-their-spouses" target="_blank" rel="noopener">punctuated</a> by the murder of Minnesota House of Representatives Speaker <strong>Emerita Melissa Hortman</strong> and her husband, and the shooting of Minnesota State Senator <strong>John Hoffman</strong> and his wife. So when FBI agents offered in mid-June to brief U.S. Senate staff on mobile threats, more than 140 staffers took them up on that invitation (a remarkably high number considering that no food was offered at the event).</p>
<p>But according to <strong>Sen. Ron Wyden</strong> (D-Ore.), the advice the FBI provided to Senate staffers was largely limited to remedial tips, such as not clicking on suspicious links or attachments, not using public wifi networks, turning off bluetooth, keeping phone software up to date, and rebooting regularly.</p>
<p>&#8220;This is insufficient to protect Senate employees and other high-value targets against foreign spies using advanced cyber tools,&#8221; Wyden wrote in <a href="https://www.wyden.senate.gov/download/wyden-letter-to-fbi-defensive-cyber-advice" target="_blank" rel="noopener">a letter</a> sent today to <strong>FBI Director Kash Patel</strong>. &#8220;Well-funded foreign intelligence agencies do not have to rely on phishing messages and malicious attachments to infect unsuspecting victims with spyware. Cyber mercenary companies sell their government customers advanced &#8216;zero-click&#8217; capabilities to deliver spyware that do not require any action by the victim.&#8221;</p>
<p>Wyden stressed that to help counter sophisticated attacks, the FBI should be encouraging lawmakers and their staff to enable anti-spyware defenses that are built into Apple&#8217;s iOS and Google&#8217;s Android phone software.</p>
<p>These include Apple&#8217;s <a href="https://support.apple.com/en-us/105120" target="_blank" rel="noopener">Lockdown Mode</a>, which is designed for users who are worried they may be subject to targeted attacks. Lockdown Mode restricts non-essential iOS features to reduce the device&#8217;s overall attack surface. Google Android devices carry a similar feature called <a href="https://support.google.com/accounts/answer/9764949?hl=en" target="_blank" rel="noopener">Advanced Protection Mode</a>.</p>
<p>Wyden also urged the FBI to update its training to recommend a number of other steps that people can take to make their mobile devices less trackable, including the use of ad blockers to guard against malicious advertisements, <a href="https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data/" target="_blank" rel="noopener">disabling ad tracking IDs in mobile devices</a>, and opting out of commercial data brokers (the suspect charged in the Minnesota shootings reportedly <a href="media/ab439082.minnshooting-peoplesearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2025/06/minnshooting-peoplesearch.png" target="_blank" rel="noopener">used multiple people-search services</a> to find the home addresses of his targets).<span id="more-71553"></span></p>
<p>The senator&#8217;s letter notes that while the FBI has recommended all of the above precautions in various advisories issued over the years, the advice the agency is giving now to the nation&#8217;s leaders needs to be more comprehensive, actionable and urgent.</p>
<p>&#8220;In spite of the seriousness of the threat, the FBI has yet to provide effective defensive guidance,&#8221; Wyden said.</p>
<p><strong>Nicholas Weaver </strong>is a researcher with the <strong>International Computer Science Institute</strong>, a nonprofit in Berkeley, Calif. Weaver said Lockdown Mode or Advanced Protection will mitigate many vulnerabilities, and should be the default setting for all members of Congress and their staff.</p>
<p>&#8220;Lawmakers are at exceptional risk and need to be exceptionally protected,&#8221; Weaver said. &#8220;Their computers should be locked down and well administered, etc. And the same applies to staffers.&#8221;</p>
<p>Weaver noted that Apple&#8217;s Lockdown Mode has a track record of blocking zero-day attacks on iOS applications; in September 2023, <strong>Citizen Lab</strong> <a href="https://krebsonsecurity.com/2023/09/adobe-apple-google-microsoft-patch-0-day-bugs/" target="_blank" rel="noopener">documented</a> how Lockdown Mode foiled a zero-click flaw capable of installing spyware on iOS devices without any interaction from the victim.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-61232" src="media/d8734e25.lockdownmode.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/lockdownmode.png" alt="" width="314" height="629" /></p>
<p>Earlier this month, Citizen Lab researchers <a href="https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/" target="_blank" rel="noopener">documented a zero-click attack</a> used to infect the iOS devices of two journalists with Paragon&#8217;s Graphite spyware. The vulnerability could be exploited merely by sending the target a booby-trapped media file delivered via iMessage. Apple also recently updated its advisory for the zero-click flaw (CVE-2025-43200), noting that it was mitigated as of iOS 18.3.1, which was released in February 2025.</p>
<p>Apple has not commented on whether CVE-2025-43200 could be exploited on devices with Lockdown Mode turned on. But HelpNetSecurity <a href="https://www.helpnetsecurity.com/2025/06/13/ios-zero-click-attacks-used-to-deliver-graphite-spyware-cve-2025-43200/" target="_blank" rel="noopener">observed</a> that at the same time Apple addressed CVE-2025-43200 back in February, the company fixed another vulnerability flagged by Citizen Lab researcher <strong>Bill Marczak</strong>: <a href="https://support.apple.com/en-us/122174" target="_blank" rel="noopener">CVE-2025-24200</a>, which Apple said was used in an extremely sophisticated <em>physical</em> attack against specific targeted individuals that allowed attackers to disable USB Restricted Mode on a locked device.</p>
<p>In other words, the flaw could apparently be exploited only if the attacker had physical access to the targeted vulnerable device. And as the old infosec industry adage goes, if an adversary has physical access to your device, it&#8217;s most likely not your device anymore.</p>
<p>I can&#8217;t speak to Google&#8217;s Advanced Protection Mode personally, because I don&#8217;t use Google or Android devices. But I have had Apple&#8217;s Lockdown Mode enabled on all of my Apple devices since it was first made available in September 2022. I can only think of a single occasion when one of my apps failed to work properly with Lockdown Mode turned on, and in that case I was able to add a temporary exception for that app in Lockdown Mode&#8217;s settings.</p>
<p>My main gripe with Lockdown Mode was captured in <a href="https://techcrunch.com/2025/03/13/apples-lockdown-mode-is-good-for-security-but-its-notifications-are-baffling/" target="_blank" rel="noopener">a March 2025 column</a> by TechCrunch&#8217;s <strong>Lorenzo Francheschi-Bicchierai</strong>, who wrote about its penchant for periodically sending mystifying notifications that someone has been blocked from contacting you, even though nothing then prevents you from contacting that person directly. This has happened to me at least twice, and in both cases the person in question was already an approved contact, and said they had not attempted to reach out.</p>
<p>Although it would be nice if Apple&#8217;s Lockdown Mode sent fewer, less alarming and more informative alerts, the occasional baffling warning message is hardly enough to make me turn it off.</p>


