# articles

feed_id: https://krebsonsecurity.com/?p=68067
title: Researchers: Weak Security Defaults Enabled Squarespace Domains Hijacks
uri: Researchers-Weak-Security-Defaults-Enabled-Squarespace-Domains-Hijack
url:
https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/

content:
<p>At least a dozen organizations with domain names at domain registrar <strong>Squarespace</strong> saw their websites hijacked last week. Squarespace bought all assets of <strong>Google Domains</strong> a year ago, but many customers still haven&#8217;t set up their new accounts. Experts say malicious hackers learned they could commandeer any migrated Squarespace accounts that hadn&#8217;t yet been registered, merely by supplying an email address tied to an existing domain.</p>
<div id="attachment_68075" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68075" decoding="async" class=" wp-image-68075" src="media/affb41ba.squarespacelogin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/squarespacelogin.png" alt="" width="750" height="445" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/squarespacelogin.png 1094w, https://krebsonsecurity.com/wp-content/uploads/2024/07/squarespacelogin-768x456.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/squarespacelogin-782x464.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68075" class="wp-caption-text">Until this past weekend, Squarespace&#8217;s website had an option to log in via email.</p></div>
<p>The Squarespace domain hijacks, which took place between July 9 and July 12, appear to have mostly targeted cryptocurrency businesses, including <a href="https://twitter.com/CelerNetwork/status/1811394743794114866" target="_blank" rel="noopener">Celer Network</a>, <a href="https://twitter.com/compoundfinance/status/1811624013841727702" target="_blank" rel="noopener">Compound Finance</a>, <a href="https://twitter.com/pendle_fi/status/1811683909509558562" target="_blank" rel="noopener">Pendle Finance</a>, and <a href="https://medium.com/@theporpoise/our-domain-was-hijacked-heres-how-blockchain-can-prevent-this-from-happening-to-you-9b9696d80d07" target="_blank" rel="noopener">Unstoppable Domains</a>. In some cases, the attackers were able to redirect the hijacked domains to phishing sites set up to steal visitors&#8217; cryptocurrency funds.</p>
<p>New York City-based <a href="https://www.squarespace.com" target="_blank" rel="noopener">Squarespace</a> purchased roughly 10 million domain names from Google Domains in June 2023, and it has been gradually migrating those domains to its service ever since. Squarespace has not responded to a request for comment, nor has it issued a statement about the attacks.</p>
<p>But an analysis released by security experts at <a href="https://metamask.io/" target="_blank" rel="noopener">Metamask</a> and <a href="https://x.com/samczsun/status/1811367830564307451" target="_blank" rel="noopener">Paradigm</a> finds the most likely explanation for what happened is that Squarespace assumed all users migrating from Google Domains would select the social login options &#8212; such &#8220;Continue with Google&#8221; or &#8220;Continue with Apple&#8221; &#8212; as opposed to the &#8220;Continue with email&#8221; choice.</p>
<p><strong>Taylor Monahan</strong>, lead product manager at Metamask, said Squarespace never accounted for the possibility that a threat actor might sign up for an account using an email associated with a recently-migrated domain before the legitimate email holder created the account themselves.</p>
<p>&#8220;Thus nothing actually stops them from trying to login with an email,&#8221; Monahan told KrebsOnSecurity. &#8220;And since there&#8217;s no password on the account, it just shoots them to the &#8216;create password for your new account&#8217; flow. And since the account is half-initialized on the backend, they now have access to the domain in question.&#8221;</p>
<p>Sometime in the last 24 hours, Squarespace removed the ability for people to create an account with just an email address. That option was available when KrebsOnSecurity created a test Squarespace account on Saturday (it&#8217;s unclear whether Squarespace ever sent a confirmation email from that signup, but I still haven&#8217;t received one).</p>
<p>What&#8217;s more, Monahan said, Squarespace did not require email verification for new accounts created with a password.</p>
<p>&#8220;The domains being migrated from Google to Squarespace are known,&#8221; Monahan said. &#8220;It&#8217;s either public or easily discernible info which email addresses have admin of a domain. And if that email never sets up their account on Squarespace &#8212; say because the billing admin left the company five years ago or folks just ignored the email &#8212; anyone who enters that email@domain in the squarespace form now has full access to control to the domain.&#8221;<span id="more-68067"></span></p>
<p>The researchers say some Squarespace domains that were migrated over also could be hijacked if attackers discovered the email addresses for less privileged user accounts tied to the domain, such as &#8220;domain manager,&#8221; which likewise has the ability to transfer a domain or point it to a different Internet address.</p>
<div id="attachment_68074" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68074" decoding="async" loading="lazy" class=" wp-image-68074" src="media/a85e07e2.squarespaceusers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/squarespaceusers.png" alt="" width="750" height="822" /><p id="caption-attachment-68074" class="wp-caption-text">Squarespace says domain owners and domain managers have many of the same privileges, including the ability to move a domain or manage the site&#8217;s domain name server (DNS) settings.</p></div>
<p>Monahan said the migration has left domain owners with fewer options to secure and monitor their accounts.</p>
<p>&#8220;Squarespace can&#8217;t support users who need any control or insight into the activity being performed in their account or domain,&#8221; Monahan said. &#8220;You basically have no control over the access different folks have. You don’t have any audit logs. You don’t get email notifications for some actions. The owner doesn’t get email notification for actions taken by a &#8216;domain manager.&#8217; This is absolutely insane if you&#8217;re used to and expecting the controls Google provides.&#8221;</p>
<p>The researchers have published <a href="https://securityalliance.notion.site/A-Squarespace-Retrospective-or-How-to-Coordinate-an-Industry-Wide-Incident-Response-fead693b66c14543a48283d85aec19ad" target="_blank" rel="noopener">a comprehensive guide</a> for locking down Squarespace user accounts, which urges Squarespace users to enable multi-factor authentication (disabled during the migration).</p>
<p>&#8220;Determining what emails have access to your new Squarespace account is step 1,&#8221; the help guide advises. &#8220;Most teams DO NOT REALIZE these accounts even exist, let alone theoretically have access.&#8221;</p>
<p>The guide also recommends removing unnecessary Squarespace user accounts, and disabling reseller access in Google Workspace.</p>
<p>&#8220;If you bought Google Workspace via Google Domains, Squarespace is now your authorized reseller,&#8221; the help document explains. &#8220;This means that anyone with access to your Squarespace account also has a backdoor into your Google Workspace unless you explicitly disable it by following the instructions here, which you should do. It’s easier to secure one account than two.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=68111
title: Global Microsoft Meltdown Tied to Bad Crowdstrike Update
uri: Global-Microsoft-Meltdown-Tied-to-Bad-Crowdstrike-Update
url: https://krebsonsecurity.com/2024/07/global-microsoft-meltdown-tied-to-bad-crowstrike-update/
content:
<p>A faulty software update from cybersecurity vendor <strong>Crowdstrike</strong> crippled countless <strong>Microsoft Windows</strong> computers across the globe today, disrupting everything from airline travel and financial institutions to hospitals and businesses online. Crowdstrike said a fix has been deployed, but experts say the recovery from this outage could take some time, as Crowdstrike&#8217;s solution needs to be applied manually on a per-machine basis.</p>
<div id="attachment_68113" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68113" decoding="async" class=" wp-image-68113" src="media/1ad39830.crowdstrike-bsod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/crowdstrike-bsod.png" alt="" width="750" height="418" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/crowdstrike-bsod.png 1427w, https://krebsonsecurity.com/wp-content/uploads/2024/07/crowdstrike-bsod-768x428.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/crowdstrike-bsod-782x436.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68113" class="wp-caption-text">A photo taken at San Jose International Airport today shows the dreaded Microsoft &#8220;Blue Screen of Death&#8221; across the board. Credit: Twitter.com/adamdubya1990</p></div>
<p>Earlier today, an errant update shipped by Crowdstrike began causing Windows machines running the software to display the dreaded &#8220;Blue Screen of Death,&#8221; rendering those systems temporarily unusable. Like most security software, Crowdstrike requires deep hooks into the Windows operating system to fend off digital intruders, and in that environment a tiny coding error can quickly lead to catastrophic outcomes.</p>
<p>In a post on Twitter/X, Crowdstrike CEO <strong>George Kurtz</strong> said an update to correct the coding mistake has been shipped, and that Mac and Linux systems are not affected.</p>
<p>&#8220;This is not a security incident or cyberattack,&#8221; Kurtz said on Twitter, echoing <a href="https://www.crowdstrike.com/blog/statement-on-windows-sensor-update/" target="_blank" rel="noopener">a written statement by Crowdstrike</a>. &#8220;The issue has been identified, isolated and a fix has been deployed.&#8221;</p>
<p>Posting to Twitter/X, the director of Crowdstrike&#8217;s threat hunting operations <a href="https://x.com/brody_n77/status/1814185935476863321" target="_blank" rel="noopener">said</a> the fix involves booting Windows into Safe Mode or the Windows Recovery Environment (Windows RE), deleting the file &#8220;C-00000291*.sys&#8221; and then restarting the machine.</p>
<p>The software snafu may have been compounded by a recent series of outages involving Microsoft&#8217;s <strong>Azure</strong> cloud services, <em>The New York Times</em> <a href="https://www.nytimes.com/2024/07/19/business/microsoft-outage-cause-azure-crowdstrike.html" target="_blank" rel="noopener">reports</a>, although it remains unclear whether those Azure problems are at all related to the bad Crowdstrike update. <strong>Update, 4:03 p.m. ET:</strong> Microsoft <a href="https://azure.status.microsoft/en-us/status" target="_blank" rel="noopener">reports</a> the Azure problems today were unrelated to the bad Crowdstrike update.</p>
<div id="attachment_68115" style="width: 614px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68115" decoding="async" loading="lazy" class="size-full wp-image-68115" src="media/374fd61f.den-msbsod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/den-msbsod.png" alt="" width="604" height="745" /><p id="caption-attachment-68115" class="wp-caption-text">A reader shared this photo taken earlier today at Denver International Airport. Credit: Twitter.com/jterryy07</p></div>
<p><span id="more-68111"></span></p>
<p><strong>Matt Burgess </strong>at <em>Wired</em> <a href="https://www.wired.com/story/microsoft-windows-outage-crowdstrike-global-it-probems/" target="_blank" rel="noopener">writes</a> that within health care and emergency services, various medical providers around the world have reported issues with their Windows-linked systems, sharing news on social media or their own websites.</p>
<p>&#8220;The US Emergency Alert System, which issues hurricane warnings, said that there had been various 911 outages in a number of states,&#8221; Burgess wrote. &#8220;Germany’s University Hospital Schleswig-Holstein said it was canceling some nonurgent surgeries at two locations. In Israel, more than a dozen hospitals have been impacted, as well as pharmacies, with reports saying ambulances have been rerouted to nonimpacted medical organizations.&#8221;</p>
<p>In the United Kingdom, NHS England has confirmed that appointment and patient record systems have been impacted by the outages.</p>
<p>&#8220;One hospital has declared a &#8216;critical&#8217; incident after a third-party IT system it used was impacted,&#8221; Wired reports. &#8220;Also in the country, train operators have said there are delays across the network, with multiple companies being impacted.&#8221;</p>
<p>Reactions to today&#8217;s outage were swift and brutal on social media, which was flooded with images of people at airports surrounded by computer screens displaying the Microsoft blue screen error. Many Twitter/X users chided the Crowdstrike CEO for failing to apologize for the massively disruptive event, while others noted that doing so could expose the company to lawsuits.</p>
<p>Meanwhile, the international Windows outage quickly became the most talked-about subject on Twitter/X, whose artificial intelligence bots collated a series of parody posts from cybersecurity professionals pretending to be on their first week of work at Crowdstrike. Incredibly,Twitter/X&#8217;s AI summarized these sarcastic posts into a sunny, can-do story about Crowdstrike that was promoted as the top discussion on Twitter this morning.</p>
<p>&#8220;Several individuals have recently started working at the cybersecurity firm Crowdstrike and have expressed their excitement and pride in their new roles,&#8221; the AI summary read. &#8220;They have shared their experiences of pushing code to production on their first day and are looking forward to positive outcomes in their work.&#8221;</p>
<div id="attachment_68114" style="width: 717px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68114" decoding="async" loading="lazy" class="wp-image-68114" src="media/802b78f0.x-react-csms.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/x-react-csms.png" alt="" width="707" height="1020" /><p id="caption-attachment-68114" class="wp-caption-text">The top story today on Twitter/X, as brilliantly summarized by X&#8217;s AI bots.</p></div>
<p>This is an evolving story. Stay tuned for updates.</p>


feed_id: https://krebsonsecurity.com/?p=68137
title: Phish-Friendly Domain Registry “.top” Put on Notice
uri: Phish-Friendly-Domain-Registry-top-Put-on-Notice
url: https://krebsonsecurity.com/2024/07/phish-friendly-domain-registry-top-put-on-notice/
content:
<p>The Chinese company in charge of handing out domain names ending in &#8220;<strong>.top</strong>&#8221; has been given until mid-August 2024 to show that it has put in place systems for managing phishing reports and suspending abusive domains, or else forfeit its license to sell domains. The warning comes amid the release of new findings that .top was the most common suffix in phishing websites over the past year, second only to domains ending in &#8220;.com.&#8221;</p>
<div id="attachment_68142" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68142" decoding="async" class=" wp-image-68142" src="media/e3077117.phishtrap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishtrap.png" alt="" width="750" height="458" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishtrap.png 776w, https://krebsonsecurity.com/wp-content/uploads/2024/07/phishtrap-768x469.png 768w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68142" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>On July 16, the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN) sent a letter to the owners of the .top domain registry. ICANN has filed hundreds of enforcement actions against domain registrars over the years, but this is thought to be the first in which ICANN has singled out a domain registry responsible for maintaining an entire top-level domain (TLD).</p>
<p>Among other reasons, the missive chided the registry for failing to respond to reports about phishing attacks involving .top domains.</p>
<p>&#8220;Based on the information and records gathered through several weeks, it was determined that .TOP Registry does not have a process in place to promptly, comprehensively, and reasonably investigate and act on reports of DNS Abuse,&#8221; the <a href="media/95a13cd7.hedlund-to-wenxia-16jul24.pdf" data-original-source="https://www.icann.org/uploads/compliance_notice/attachment/1225/hedlund-to-wenxia-16jul24.pdf" target="_blank" rel="noopener">ICANN letter reads</a> (PDF).</p>
<p>ICANN&#8217;s warning redacted the name of the recipient, but records show the .top registry is operated by a Chinese entity called <strong>Jiangsu Bangning Science &amp; Technology Co. Ltd</strong>. Representatives for the company have not responded to requests for comment.</p>
<p>Domains ending in .top were represented prominently in <a href="https://interisle.net/insights/phishing-landscape-2024-an-annual-study-of-the-scope-and-distribution-of-phishing" target="_blank" rel="noopener">a new phishing report</a> released today by the <strong>Interisle Consulting Group</strong>, which sources phishing data from several places, including the <strong>Anti-Phishing Working Group</strong> (APWG), <strong>OpenPhish</strong>, <strong>PhishTank</strong>, and <strong>Spamhaus</strong>.</p>
<p>Interisle&#8217;s newest study examined nearly two million phishing attacks in the last year, and found that phishing sites accounted for more than four percent of all new .top domains between May 2023 and April 2024. Interisle said .top has roughly 2.76 million domains in its stable, and that more than 117,000 of those were phishing sites in the past year.</p>
<div id="attachment_68140" style="width: 794px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68140" decoding="async" loading="lazy" class="size-full wp-image-68140" src="media/714c7307.interisle2023-2024phishingstats.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/interisle2023-2024phishingstats.png" alt="" width="784" height="764" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/interisle2023-2024phishingstats.png 784w, https://krebsonsecurity.com/wp-content/uploads/2024/07/interisle2023-2024phishingstats-768x748.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/interisle2023-2024phishingstats-782x762.png 782w" sizes="(max-width: 784px) 100vw, 784px" /><p id="caption-attachment-68140" class="wp-caption-text">Source: Interisle Consulting Group.</p></div>
<p>ICANN said its review was based on information collected and studied about .top domains over the past few weeks. But the fact that high volumes of phishing sites are being registered through Jiangsu Bangning Science &amp; Technology Co Ltd. is hardly a new trend.</p>
<p>For example, more than 10 years ago the same Chinese registrar was the fourth most common source of phishing websites, as tracked by the APWG. Bear in mind that the APWG report excerpted below was published <em>more than a year before Jiangsu Bangning received ICANN approval to introduce and administer the new .top registry. </em></p>
<div id="attachment_68141" style="width: 794px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68141" decoding="async" loading="lazy" class="size-full wp-image-68141" src="media/614e6e37.apwg-2013.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/apwg-2013.png" alt="" width="784" height="512" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/apwg-2013.png 784w, https://krebsonsecurity.com/wp-content/uploads/2024/07/apwg-2013-768x502.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/apwg-2013-782x511.png 782w" sizes="(max-width: 784px) 100vw, 784px" /><p id="caption-attachment-68141" class="wp-caption-text">Source: APWG phishing report from 2013, two years before .top came into being.</p></div>
<p>A fascinating new wrinkle in the phishing landscape is the growth in scam pages hosted via the <a href="https://en.wikipedia.org/wiki/InterPlanetary_File_System" target="_blank" rel="noopener">InterPlanetary File System</a> (IPFS), a decentralized data storage and delivery network that is based on peer-to-peer networking. According to Interisle, the use of IPFS to host and launch phishing attacks &#8212; which can make phishing sites more difficult to take down &#8212; increased a staggering 1,300 percent, to roughly 19,000 phishing sites reported in the last year.<span id="more-68137"></span></p>
<p>Last year&#8217;s report from Interisle found that domain names ending in &#8220;.us&#8221; &#8212; the top-level domain for the United States &#8212; <a href="https://krebsonsecurity.com/2023/09/why-is-us-being-used-to-phish-so-many-of-us/" target="_blank" rel="noopener">were among the most prevalent in phishing scams</a>. While .us domains are not even on the Top 20 list of this year&#8217;s study, &#8220;.com&#8221; maintained its perennial #1 spot as the largest source of phishing domains overall.</p>
<p>A year ago, the phishiest domain registrar by far was <strong>Freenom</strong>, a now-defunct registrar that handed out free domains in several country-code TLDs, including .tk, .ml, .ga and .cf. Freenom went out of business after <a href="https://krebsonsecurity.com/2023/03/sued-by-meta-freenom-halts-domain-registrations/" target="_blank" rel="noopener">being sued by Meta</a>, which alleged Freenom ignored abuse complaints while monetizing traffic to abusive domains.</p>
<p>Following <a href="https://krebsonsecurity.com/2023/05/phishing-domains-tanked-after-meta-sued-freenom/" target="_blank" rel="noopener">Freenom&#8217;s demise</a>, phishers quickly migrated to other new low-cost TLDs and to services that allow anonymous, free domain registrations &#8212; particularly subdomain services. For example, Interisle found phishing attacks involving websites created on Google&#8217;s <strong>blogspot.com</strong> skyrocketed last year more than 230 percent. Other subdomain services that saw a substantial growth in domains registered by phishers include <strong>weebly.com</strong>, <strong>github.io</strong>, <strong>wix.com</strong>, and <strong>ChangeIP</strong>, the report notes.</p>
<div id="attachment_68156" style="width: 759px" class="wp-caption aligncenter"><a href="media/add0322c.phishingpostfreenom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishingpostfreenom.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-68156" decoding="async" loading="lazy" class="wp-image-68156" src="media/add0322c.phishingpostfreenom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishingpostfreenom.png" alt="" width="749" height="369" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/phishingpostfreenom.png 891w, https://krebsonsecurity.com/wp-content/uploads/2024/07/phishingpostfreenom-768x378.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/phishingpostfreenom-782x385.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-68156" class="wp-caption-text">Source: Interisle Consulting.</p></div>
<p>Interisle Consulting partner <strong>Dave Piscitello </strong>said ICANN could easily send similar warning letters to at least a half-dozen other top-level domain registries, noting that spammers and phishers tend to cycle through the same TLDs periodically &#8212; including <strong>.xyz</strong>, <strong>.info</strong>, <strong>.support</strong> and <strong>.lol</strong>, all of which saw considerably more business from phishers after Freenom&#8217;s implosion.</p>
<p>Piscitello said domain registrars and registries could significantly reduce the number of phishing sites registered through their services just by flagging customers who try to register huge volumes of domains at once. Their study found that at least 27% of the domains used for phishing were registered in bulk &#8212; i.e. the same registrant paid for hundreds or thousands of domains in quick succession.</p>
<p>The report includes a case study in which a phisher this year registered 17,562 domains over the course of an eight-hour period &#8212; roughly 38 domains per minute &#8212; using .lol domains that were all composed of random letters.</p>
<p>ICANN tries to resolve contract disputes privately with the registry and registrar community, and experts say the nonprofit organization usually only publishes enforcement letters when the recipient is ignoring its private notices. Indeed, ICANN&#8217;s letter notes Jiangsu Bangning didn&#8217;t even open its emailed notifications. It also cited the registry for falling behind in its ICANN membership fees.</p>
<p>With that in mind, a review of <a href="https://www.icann.org/compliance/notices" target="_blank" rel="noopener">ICANN&#8217;s public enforcement activity</a> suggests two trends: One is that there have been far fewer public compliance and enforcement actions in recent years &#8212; even as the number of new TLDs has expanded dramatically.</p>
<p>The second is that in a majority of cases, the failure of a registry or registrar to pay its annual ICANN membership fees was cited as a reason for a warning letter. A review of nearly two dozen enforcement letters ICANN has sent to domain registrars since 2022 shows that failure to pay dues was cited as a reason (or <em>the</em> reason) for the violation at least 75 percent of the time.</p>
<p style="font-weight: 400;">Piscitello, a former ICANN board member, said nearly all breach notices sent out while he was at ICANN were because the registrar owed money.</p>
<p style="font-weight: 400;">&#8220;I think the rest is just lipstick to suggest that ICANN’s on top of DNS Abuse,&#8221; Piscitello said.</p>
<p>KrebsOnSecurity has sought comment from ICANN and will update this story if they respond.</p>


feed_id: https://krebsonsecurity.com/?p=68184
title: Crooks Bypassed Google’s Email Verification to Create Workspace Accounts, Access 3rd-Party Services
uri: Crooks-Bypassed-Google-s-Email-Verification-to-Create-Workspace-Acco
url:
https://krebsonsecurity.com/2024/07/crooks-bypassed-googles-email-verification-to-create-workspace-accounts-access-3rd-party-services/

content:
<p><strong>Google</strong> says it recently fixed an authentication weakness that allowed crooks to circumvent the email verification required to create a <strong>Google Workspace</strong> account, and leverage that to impersonate a domain holder at third-party services that allow logins through Google&#8217;s &#8220;Sign in with Google&#8221; feature.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-68194" src="media/1e1440a9.signinwithgoogle.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/signinwithgoogle.png" alt="" width="418" height="367" /></p>
<p>Last week, KrebsOnSecurity heard from a reader who said they received a notice that their email address had been used to create a potentially malicious Workspace account that Google had blocked.</p>
<p>&#8220;In the last few weeks, we identified a small-scale abuse campaign whereby bad actors circumvented the email verification step in our account creation flow for Email Verified (EV) Google Workspace accounts using a specially constructed request,&#8221; the notice from Google read. &#8220;These EV users could then be used to gain access to third-party applications using &#8216;Sign In with Google&#8217;.&#8221;</p>
<p>In response to questions, Google said it fixed the problem within 72 hours of discovering it, and that the company has added additional detection to protect against these types of authentication bypasses going forward.</p>
<p><strong>Anu Yamunan</strong>, director of abuse and safety protections at Google Workspace, told KrebsOnSecurity the malicious activity began in late June, and involved &#8220;a few thousand&#8221; Workspace accounts that were created without being domain-verified.</p>
<p>Google Workspace offers a free trial that people can use to access services like Google Docs, but other services such as Gmail are only available to Workspace users who can validate control over the domain name associated with their email address. The weakness Google fixed allowed attackers to bypass this validation process. Google emphasized that none of the affected domains had previously been associated with Workspace accounts or services.</p>
<p>&#8220;The tactic here was to create a specifically-constructed request by a bad actor to circumvent email verification during the signup process,&#8221; Yamunan said. &#8220;The vector here is they would use one email address to try to sign in, and a completely different email address to verify a token. Once they were email verified, in some cases we have seen them access third party services using Google single sign-on.&#8221;</p>
<p>Yamunan said none of the potentially malicious workspace accounts were used to abuse Google services, but rather the attackers sought to impersonate the domain holder to other services online.</p>
<p>In the case of the reader who shared the breach notice from Google, the imposters used the authentication bypass to associate his domain with a Workspace account. And that domain was tied to his login at several third-party services online. Indeed, the alert this reader received from Google said the unauthorized Workspace account appears to have been used to sign in to his account at <strong>Dropbox</strong>.</p>
<p>Google said the now-fixed authentication bypass is unrelated to a recent issue involving cryptocurrency-based domain names that were <a href="https://krebsonsecurity.com/2024/07/researchers-weak-security-defaults-enabled-squarespace-domains-hijacks/" target="_blank" rel="noopener">apparently compromised in their transition to Squarespace</a>, which last year acquired more than 10 million domains that were registered via Google Domains.</p>
<p>On July 12, a number of domains tied to cryptocurrency businesses were hijacked from Squarespace users who hadn&#8217;t yet set up their Squarespace accounts. Squarespace has since published <a href="https://status.squarespace.com/incidents/cw2wf55bps15" target="_blank" rel="noopener">a statement</a> blaming the domain hijacks on “a weakness related to OAuth logins”, which Squarespace said it fixed within hours.</p>


feed_id: https://krebsonsecurity.com/?p=68214
title: Don’t Let Your Domain Name Become a “Sitting Duck”
uri: Don-t-Let-Your-Domain-Name-Become-a-Sitting-Duck
url: https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-become-a-sitting-duck/
content:
<p>More than a million domain names &#8212; including many registered by Fortune 100 firms and brand protection companies &#8212; are vulnerable to takeover by cybercriminals thanks to authentication weaknesses at a number of large web hosting providers and domain registrars, new research finds.</p>
<div id="attachment_68225" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68225" decoding="async" class=" wp-image-68225" src="media/cac4253a.duckstarget.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/duckstarget.png" alt="" width="750" height="433" /><p id="caption-attachment-68225" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>Your Web browser knows how to find a site like example.com thanks to the global <a href="https://en.wikipedia.org/wiki/Domain_Name_System" target="_blank" rel="noopener">Domain Name System</a> (DNS), which serves as a kind of phone book for the Internet by translating human-friendly website names (example.com) into numeric Internet addresses.</p>
<p>When someone registers a domain name, the registrar will typically provide two sets of DNS records that the customer then needs to assign to their domain. Those records are crucial because they allow Web browsers to find the Internet address of the hosting provider that is serving that domain.</p>
<p>But potential problems can arise when a domain&#8217;s DNS records are &#8220;lame,&#8221; meaning the authoritative name server does not have enough information about the domain and can&#8217;t resolve queries to find it. A domain can become lame in a variety of ways, such as when it is not assigned an Internet address, or because the name servers in the domain&#8217;s authoritative record are misconfigured or missing.</p>
<p>The reason lame domains are problematic is that a number of Web hosting and DNS providers allow users to claim control over a domain <em>without accessing the true owner&#8217;s account at their DNS provider or registrar</em>.</p>
<p>If this threat sounds familiar, that&#8217;s because it is hardly new. Back in 2019, KrebsOnSecurity wrote about thieves employing this method to seize control over thousands of domains registered at GoDaddy, and using those <a href="https://krebsonsecurity.com/2019/01/bomb-threat-sextortion-spammers-abused-weakness-at-godaddy-com/" target="_blank" rel="noopener">to send bomb threats and sextortion emails</a> (GoDaddy says they fixed that weakness in their systems not long after that 2019 story).</p>
<p>In the 2019 campaign, the spammers created accounts on GoDaddy and were able to take over vulnerable domains simply by registering a free account at GoDaddy and being assigned the same DNS servers as the hijacked domain.</p>
<p>Three years before that, the same pervasive weakness was described in a blog post by security researcher <strong>Matthew Bryant</strong>, who showed how one could <a href="https://thehackerblog.com/the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-and-digital-ocean/" target="_blank" rel="noopener">commandeer at least 120,000 domains</a> via DNS weaknesses at some of the world&#8217;s largest hosting providers.</p>
<p>Incredibly, new research jointly released today by security experts at <strong>Infoblox</strong> and <strong>Eclypsium</strong> finds this same authentication weakness is still present at a number of large hosting and DNS providers.</p>
<p>&#8220;It&#8217;s easy to exploit, very hard to detect, and it&#8217;s entirely preventable,&#8221; said <strong>Dave Mitchell</strong>, principal threat researcher at Infoblox. &#8220;Free services make it easier [to exploit] at scale. And the bulk of these are at a handful of DNS providers.&#8221;</p>
<h2>SITTING DUCKS</h2>
<p><a href="https://blogs.infoblox.com/threat-intelligence/who-knew-domain-hijacking-is-so-easy/" target="_blank" rel="noopener">Infoblox&#8217;s report</a> found there are multiple cybercriminal groups abusing these stolen domains as a globally dispersed &#8220;traffic distribution system,&#8221; which can be used to mask the true source or destination of web traffic and to funnel Web users to malicious or phishous websites.</p>
<p>Commandeering domains this way also can allow thieves to impersonate trusted brands and abuse their positive or at least neutral reputation when sending email from those domains, as we saw in 2019 with the GoDaddy attacks.</p>
<p>&#8220;Hijacked domains have been used directly in phishing attacks and scams, as well as large spam systems,&#8221; reads the Infoblox report, which refers to lame domains as &#8220;<strong>Sitting Ducks</strong>.&#8221; &#8220;There is evidence that some domains were used for Cobalt Strike and other malware command and control (C2). Other attacks have used hijacked domains in targeted phishing attacks by creating lookalike subdomains. A few actors have stockpiled hijacked domains for an unknown purpose.&#8221;</p>
<p>Eclypsium researchers <a href="https://eclypsium.com/blog/ducks-now-sitting-dns-internet-infrastructure-insecurity/" target="_blank" rel="noopener">estimate</a> there are currently about one million Sitting Duck domains, and that at least 30,000 of them have been hijacked for malicious use since 2019.</p>
<p>&#8220;As of the time of writing, numerous DNS providers enable this through weak or nonexistent verification of domain ownership for a given account,&#8221; Eclypsium wrote.</p>
<p>The security firms said they found a number of compromised Sitting Duck domains were originally registered by brand protection companies that specialize in defensive domain registrations (reserving look-alike domains for top brands before those names can be grabbed by scammers) and combating trademark infringement.</p>
<p>For example, Infoblox found cybercriminal groups using a Sitting Duck domain called <strong>clickermediacorp[.]com</strong>, which was a CBS Interactive Inc. domain initially registered in 2009 at GoDaddy. However, in 2010 the DNS was updated to DNSMadeEasy.com servers, and in 2012 the domain was transferred to <strong>MarkMonitor</strong>.</p>
<p>Another hijacked Sitting Duck domain &#8212; <strong>anti-phishing[.]org</strong> &#8212; was registered in 2003 by the <strong>Anti-Phishing Working Group</strong> (APWG), a cybersecurity not-for-profit organization that closely tracks phishing attacks.</p>
<p>In many cases, the researchers discovered Sitting Duck domains that appear to have been configured to auto-renew at the registrar, but the authoritative DNS or hosting services were not renewed.</p>
<p>The researchers say Sitting Duck domains all possess three attributes that makes them vulnerable to takeover:</p>
<p>1) the domain uses or delegates authoritative DNS services to a different provider than the domain registrar;<br />
2) the authoritative name server(s) for the domain does not have information about the Internet address the domain should point to;<br />
3) the authoritative DNS provider is &#8220;exploitable,&#8221; i.e. an attacker can claim the domain at the provider and set up DNS records without access to the valid domain owner&#8217;s account at the domain registrar.</p>
<div id="attachment_68226" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68226" decoding="async" loading="lazy" class=" wp-image-68226" src="media/a756eb63.sittingduckattack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/sittingduckattack.png" alt="" width="751" height="337" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/07/sittingduckattack.png 784w, https://krebsonsecurity.com/wp-content/uploads/2024/07/sittingduckattack-768x345.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/07/sittingduckattack-782x351.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-68226" class="wp-caption-text">Image: Infoblox.</p></div>
<p>How does one know whether a DNS provider is exploitable? There is a frequently updated list published on <strong>GitHub</strong> called &#8220;<a href="https://github.com/indianajson/can-i-take-over-dns?tab=readme-ov-file" target="_blank" rel="noopener">Can I take over DNS</a>,&#8221; which has been documenting exploitability by DNS provider over the past several years. The list includes examples for each of the named DNS providers.<span id="more-68214"></span></p>
<p>In the case of the aforementioned Sitting Duck domain clickermediacorp[.]com, the domain was originally registered by , but it appears to have been hijacked by scammers by claiming it at the web hosting firm <strong>DNSMadeEasy</strong>, which is owned by <strong>Digicert</strong>, one of the industry&#8217;s largest issuers of digital certificates (SSL/TLS certificates).</p>
<p>In an interview with KrebsOnSecurity, DNSMadeEasy founder and senior vice president <strong>Steve Job</strong> said the problem isn&#8217;t really his company&#8217;s to solve, noting that DNS providers who are also not domain registrars have no real way of validating whether a given customer legitimately owns the domain being claimed.</p>
<p>&#8220;We do shut down abusive accounts when we find them,&#8221; Job said. &#8220;But it&#8217;s my belief that the onus needs to be on the [domain registrants] themselves. If you&#8217;re going to buy something and point it somewhere you have no control over, we can&#8217;t prevent that.&#8221;</p>
<p>Infoblox, Eclypsium, and the DNS wiki listing at Github all say that web hosting giant <strong>Digital Ocean</strong> is among the vulnerable hosting firms. In response to questions, Digital Ocean said it was exploring options for mitigating such activity.</p>
<p>&#8220;The DigitalOcean DNS service is not authoritative, and we are not a domain registrar,&#8221; Digital Ocean wrote in an emailed response. &#8220;Where a domain owner has delegated authority to our DNS infrastructure with their registrar, and they have allowed their ownership of that DNS record in our infrastructure to lapse, that becomes a &#8216;lame delegation&#8217; under this hijack model. We believe the root cause, ultimately, is poor management of domain name configuration by the owner, akin to leaving your keys in your unlocked car, but we acknowledge the opportunity to adjust our non-authoritative DNS service guardrails in an effort to help minimize the impact of a lapse in hygiene at the authoritative DNS level. We’re connected with the research teams to explore additional mitigation options.&#8221;</p>
<p>In a statement provided to KrebsOnSecurity, the hosting provider and registrar <strong>Hostinger</strong> said they were working to implement a solution to prevent lame duck attacks in the &#8220;upcoming weeks.&#8221;</p>
<p>&#8220;We are working on implementing an SOA-based domain verification system,&#8221; Hostinger wrote. &#8220;Custom nameservers with a Start of Authority (SOA) record will be used to verify whether the domain truly belongs to the customer. We aim to launch this user-friendly solution by the end of August. The final step is to deprecate preview domains, a functionality sometimes used by customers with malicious intents. Preview domains will be deprecated by the end of September. Legitimate users will be able to use randomly generated temporary subdomains instead.&#8221;</p>
<p>What did DNS providers that have struggled with this issue in the past do to address these authentication challenges? The security firms said that to claim a domain name, the best practice providers gave the account holder random name servers that required a change at the registrar before the domains could go live. They also found the best practice providers used various mechanisms to ensure that the newly assigned name server hosts did not match previous name server assignments.</p>
<p>[Side note: Infoblox observed that many of the hijacked domains were being hosted at <strong>Stark Industries Solutions</strong>, a sprawling hosting provider that appeared two weeks before Russia invaded Ukraine and has become <a href="https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/" target="_blank" rel="noopener">the epicenter of countless cyberattacks against enemies of Russia</a>].</p>
<p>Both Infoblox and Eclypsium said that without more cooperation and less finger-pointing by all stakeholders in the global DNS, attacks on sitting duck domains will continue to rise, with domain registrants and regular Internet users caught in the middle.</p>
<p>&#8220;Government organizations, regulators, and standards bodies should consider long-term solutions to vulnerabilities in the DNS management attack surface,&#8221; the Infoblox report concludes.</p>


feed_id: https://krebsonsecurity.com/?p=68244
title: U.S. Trades Cybercriminals to Russia in Prisoner Swap
uri: U-S-Trades-Cybercriminals-to-Russia-in-Prisoner-Swap
url: https://krebsonsecurity.com/2024/08/u-s-trades-cybercriminals-to-russia-in-prisoner-swap/
content:
<p>Twenty-four prisoners were freed today in an international prisoner swap between Russia and Western countries. Among the eight Russians repatriated were several convicted cybercriminals. In return, Russia has reportedly released 16 prisoners, including <em>Wall Street Journal</em> reporter <strong>Evan Gershkovich </strong>and ex-U.S. Marine<strong> Paul Whelan</strong>.</p>
<p>AMong those in the prisoner swap is <a href="https://krebsonsecurity.com/tag/roman-seleznev/" target="_blank" rel="noopener"><strong>Roman Seleznev</strong></a>, 40, who was sentenced in 2017 to 27 years in prison for racketeering convictions tied to a lengthy career in stealing and selling payment card data. Seleznev earned this then-record sentence by operating some of the underground&#8217;s most bustling marketplaces for stolen card data.</p>
<div id="attachment_41728" style="width: 623px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-41728" decoding="async" class="size-full wp-image-41728" src="media/5319c7d9.seleznevcash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/seleznevcash.png" alt="" width="613" height="370" /><p id="caption-attachment-41728" class="wp-caption-text">Roman Seleznev, pictured with bundles of cash. Image: US DOJ.</p></div>
<p>Once known by the hacker handles &#8220;<strong>Track2</strong>,&#8221; &#8220;<strong>Bulba</strong>&#8221; and &#8220;<strong>nCux</strong>,&#8221; Seleznev is the son of <strong>Valery Seleznev</strong>, a prominent member of the Russian parliament who is considered an ally of <strong>Vladimir Putin</strong>. U.S. prosecutors showed that for years Seleznev stayed a step ahead of the law by tapping into contacts at the Russian FSB, the successor agency to the Soviet KGB, and by periodically changing hacker handles.</p>
<p>But in 2014 Seleznev <a href="https://krebsonsecurity.com/2017/04/the-backstory-behind-carder-kingpin-roman-seleznevs-record-27-year-prison-sentence/" target="_blank" rel="noopener">was captured by U.S. Secret Service agents</a>, who had zeroed in on Seleznev&#8217;s posh vacation spot in The Maldives. At the time, the South Asian island country was a popular destination for Eastern Europe-based cybercriminals, who viewed it as beyond the reach of U.S. law enforcement.</p>
<p>In addition to receiving a record prison sentence, Seleznev was ordered to pay more than $50 million in restitution to his victims. That loss amount equaled the total losses inflicted by Seleznev&#8217;s various carding stores, and other thefts attributed to members of the hacking forum <strong>carder[.]su</strong>, a bustling cybercrime community of which Seleznev was a leading organizer.</p>
<p>Also released in the prisoner swap was <strong>Vladislav Klyushin</strong>, a 42-year-old Muscovite sentenced in September 2023 to nine years in prison for what U.S. prosecutors called a &#8220;$93 million hack-to-trade conspiracy.&#8221; Klyushin and his crew hacked into companies and used information stolen in those intrusions to make illegal stock trades.</p>
<p>Klyushin likewise was arrested while vacationing abroad: <em>The Associated Press</em> <a href="https://apnews.com/article/kremlin-russian-insider-trading-hacking-sentencing-klyushin-6754a01a0a98aacbb51bbec6cd9aa5b6" target="_blank" rel="noopener">reported</a> that Klyushin was captured in Switzerland after arriving on a private jet, and just before he and his party were about to board a helicopter to whisk them to a nearby ski resort.</p>
<div id="attachment_68246" style="width: 914px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68246" decoding="async" loading="lazy" class="size-full wp-image-68246" src="media/60f0a217.klyushin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/klyushin.png" alt="" width="904" height="400" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/klyushin.png 904w, https://krebsonsecurity.com/wp-content/uploads/2024/08/klyushin-768x340.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/klyushin-782x346.png 782w" sizes="(max-width: 904px) 100vw, 904px" /><p id="caption-attachment-68246" class="wp-caption-text">A passport photo of Klyushin. Image: USDOJ.</p></div>
<p>Klyushin is the owner of <strong>M-13</strong>, a Russian technology company that contracts with the Russian government. According to prosecutors, M-13 offered penetration testing and &#8220;advanced persistent threat (APT) emulation.&#8221; As part of his guilty plea, Klyushin was also ordered to forfeit $34 million, and to pay restitution in an amount that was to be determined.</p>
<p>The U.S. government says four of Klyushin&#8217;s alleged co-conspirators remain at large, including <strong>Ivan Ermakov</strong>, who was among 12 Russians charged in 2018 with hacking into key Democratic Party email accounts.<span id="more-68244"></span></p>
<p>Among the Americans freed by Russia were <em>Wall Street Journal</em> reporter <strong>Evan</strong> <strong>Gershkovich</strong>, 32, who has spent the last 16 months in a Russian prison on spying charges. Also released was <strong>Alsu Kurmasheva</strong>, 47, a Russian American editor for Radio Free Europe/Radio Liberty who was arrested last year; and <a href="https://en.wikipedia.org/wiki/Paul_Whelan_(security_director)" target="_blank" rel="noopener">Paul Whelan</a>, 54, a former U.S. Marine arrested in 2018 and accused of spying.</p>
<p><em>The New York Times</em> <a href="https://www.nytimes.com/live/2024/08/01/world/russia-prisoner-swap-us" target="_blank" rel="noopener">reports</a> several others freed by Russia were German nationals, including <strong>German Moyzhes</strong>, a lawyer who was helping Russians obtain residence permits in Germany and other E.U. countries. <em>The Times</em> says Slovenia, Norway and Poland released four people accused of being Russian spies.</p>
<p>Reuters <a href="https://www.reuters.com/world/lawyer-ex-us-marine-whelan-jailed-russia-says-she-cannot-confirm-his-whereabouts-2024-07-31/" target="_blank" rel="noopener">reports</a> that Germany released <strong>Vadim Krasikov</strong>, an FSB colonel serving a life sentence there for murdering an exiled Chechen-Georgian dissident in a Berlin park.</p>
<p><strong>Update, 8:47 p.m. ET:</strong>An earlier version of this story incorrectly reported that one of the Russian hackers released was the BTC-e co-founder Alexander Vinnik. KrebsOnSecurity was unable to confirm his release. The above story has been edited to reflect that change.</p>


feed_id: https://krebsonsecurity.com/?p=68265
title: Low-Drama ‘Dark Angels’ Reap Record Ransoms
uri: Low-Drama-Dark-Angels-Reap-Record-Ransoms
url: https://krebsonsecurity.com/2024/08/low-drama-dark-angels-reap-record-ransoms/
content:
<p>A ransomware group called <strong>Dark Angels</strong> made headlines this past week when it was revealed the crime group recently received a record $75 million data ransom payment from a Fortune 50 company. Security experts say the Dark Angels have been around since 2021, but the group doesn&#8217;t get much press because they work alone and maintain a low profile, picking one target at a time and favoring mass data theft over disrupting the victim&#8217;s operations.</p>
<div id="attachment_68274" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68274" decoding="async" class=" wp-image-68274" src="media/9903a7d6.darkfeathers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/darkfeathers.png" alt="" width="749" height="337" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/darkfeathers.png 974w, https://krebsonsecurity.com/wp-content/uploads/2024/08/darkfeathers-768x345.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/darkfeathers-782x352.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-68274" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>Security firm <strong>Zscaler</strong> <strong>ThreatLabz</strong> this month ranked Dark Angels as the top ransomware threat for 2024, noting that in early 2024 a victim paid the ransomware group $75 million &#8212; higher than any previously recorded ransom payment. ThreatLabz found Dark Angels has conducted some of the largest ransomware attacks to date, and yet little is known about the group.</p>
<p><a href="https://krebsonsecurity.com/tag/brett-stone-gross/" target="_blank" rel="noopener"><strong>Brett Stone-Gross</strong></a>, senior director of threat intelligence at ThreatLabz, said Dark Angels operate using an entirely different playbook than most other ransomware groups. For starters, he said, Dark Angels does not employ the typical ransomware affiliate model, which relies on hackers-for-hire to install malicious software that locks up infected systems.</p>
<p>&#8220;They really don&#8217;t want to be in the headlines or cause business disruptions,&#8221; Stone-Gross said. &#8220;They&#8217;re about making money and attracting as little attention as possible.&#8221;</p>
<p>Most ransomware groups maintain flashy victim leak sites which threaten to publish the target&#8217;s stolen data unless a ransom demand is paid. But the Dark Angels didn&#8217;t even have a victim shaming site <a href="https://x.com/threatlabz/status/1645455117024641024?s=46&amp;t=N2Ox1VDbEK4tC6bNjFPKYw" target="_blank" rel="noopener">until April 2023</a>. And the leak site isn&#8217;t particularly well branded; it&#8217;s called <strong>Dunghill Leak</strong>.</p>
<div id="attachment_68271" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68271" decoding="async" loading="lazy" class=" wp-image-68271" src="media/5fe504d6.dunghill.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/dunghill.png" alt="" width="751" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/dunghill.png 817w, https://krebsonsecurity.com/wp-content/uploads/2024/08/dunghill-768x463.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/dunghill-782x472.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-68271" class="wp-caption-text">The Dark Angels victim shaming site, Dunghill Leak.</p></div>
<p>&#8220;Nothing about them is flashy,&#8221; Stone-Gross said. &#8220;For the longest time, they didn&#8217;t even want to cause a big headline, but they probably felt compelled to create that leaks site because they wanted to show they were serious and that they were going to post victim data and make it accessible.&#8221;</p>
<p>Dark Angels is thought to be a Russia-based cybercrime syndicate whose distinguishing characteristic is stealing truly staggering amounts of data from major companies across multiple sectors, including healthcare, finance, government and education. For large businesses, the group has exfiltrated between 10-100 terabytes of data, which can take days or weeks to transfer, ThreatLabz found.</p>
<p>Like most ransom gangs, Dark Angels will publish data stolen from victims who do not pay. Some of the more notable victims listed on Dunghill Leak include the global food distribution firm <strong>Sysco</strong>, which <a href="https://www.bleepingcomputer.com/news/security/food-distribution-giant-sysco-warns-of-data-breach-after-cyberattack/" target="_blank" rel="noopener">disclosed a ransomware attack in May 2023</a>; and the travel booking giant <strong>Sabre</strong>, which was <a href="https://techcrunch.com/2023/09/06/ransomware-gang-claims-credit-for-sabre-data-breach/" target="_blank" rel="noopener">hit by the Dark Angels in September 2023</a>.</p>
<p>Stone-Gross said Dark Angels is often reluctant to deploy ransomware malware because such attacks work by locking up the target&#8217;s IT infrastructure, which typically causes the victim&#8217;s business to grind to a halt for days, weeks or even months on end. And those types of breaches tend to make headlines quickly.</p>
<p>&#8220;They selectively choose whether they want to deploy ransomware or not,&#8221; he said. &#8220;If they deem they can encrypt some files that won&#8217;t cause major disruptions &#8212; but will give them a ton of data &#8212; that&#8217;s what they&#8217;ll do. But really, what separates them from the rest is the volume of data they&#8217;re stealing. It&#8217;s a whole order of magnitude greater with Dark Angels. Companies losing vast amounts of data will pay these high ransoms.&#8221;<span id="more-68265"></span></p>
<p>So who paid the record $75 million ransom? <strong>Bleeping Computer</strong> <a href="https://www.bleepingcomputer.com/news/security/dark-angels-ransomware-receives-record-breaking-75-million-ransom/" target="_blank" rel="noopener">posited on July 30</a> that the victim was the pharmaceutical giant <strong>Cencora</strong> (formerly <strong>AmeriSourceBergen Corporation</strong>), which reported a data security incident to the <strong>U.S. Securities and Exchange Commission</strong> (SEC) on February 21, 2024.</p>
<p>The SEC requires publicly-traded companies to disclose a potentially material cybersecurity event within four days of the incident. Cencora is currently #10 on the Fortune 500 list, generating more than $262 billion in revenue last year.</p>
<p>Cencora did not respond to questions about whether it had made a ransom payment in connection with the February cybersecurity incident, and referred KrebsOnSecurity to expenses listed under &#8220;Other&#8221; in the restructuring section of their <a href="media/853458d2.668abd56-26dc-4495-8c63-32e7ee623633.pdf" data-original-source="https://d18rn0p25nwr6d.cloudfront.net/CIK-0001140859/668abd56-26dc-4495-8c63-32e7ee623633.pdf" target="_blank" rel="noopener">latest quarterly financial report</a> (PDF). That report states that the majority of the $30 million cost in &#8220;Other&#8221; was associated with the breach.</p>
<p>Cencora&#8217;s quarterly statement said the incident affected a standalone legacy information technology platform in one country and the foreign business unit&#8217;s ability to operate in that country for approximately two weeks.</p>
<div id="attachment_68276" style="width: 759px" class="wp-caption aligncenter"><a href="media/47c0b268.cencora-disc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/cencora-disc.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-68276" decoding="async" loading="lazy" class="wp-image-68276" src="media/47c0b268.cencora-disc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/cencora-disc.png" alt="" width="749" height="294" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/cencora-disc.png 1157w, https://krebsonsecurity.com/wp-content/uploads/2024/08/cencora-disc-768x301.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/cencora-disc-782x307.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-68276" class="wp-caption-text">Cencora&#8217;s 2024 1st quarter report documents a $30 million cost associated with a data exfiltration event in mid-February 2024.</p></div>
<p>In its most recent <a href="media/04313bc2.sophos-state-of-ransomware-2024-wp.pdf" data-original-source="https://assets.sophos.com/X24WTUEQ/at/9brgj5n44hqvgsp5f5bqcps/sophos-state-of-ransomware-2024-wp.pdf" target="_blank" rel="noopener">State of Ransomware report</a> (PDF), security firm <strong>Sophos</strong> found the average ransomware payment had increased fivefold in the past year, from $400,000 in 2023 to $2 million. Sophos says that <em>in more than four-fifths (82%) of cases funding for the ransom came from multiple sources</em>. Overall, 40% of total ransom funding came from the organizations themselves and 23% from insurance providers.</p>
<p>Further reading: <a href="media/6f7425b3.threatlabz-ransomware-report.pdf" data-original-source="https://www.zscaler.com/resources/industry-reports/threatlabz-ransomware-report.pdf" target="_blank" rel="noopener">ThreatLabz ransomware report</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=68279
title: Cybercrime Rapper Sues Bank over Fraud Investigation
uri: Cybercrime-Rapper-Sues-Bank-over-Fraud-Investigation
url: https://krebsonsecurity.com/2024/08/cybercrime-rapper-sues-bank-over-fraud-investigation/
content:
<div id="attachment_66136" style="width: 630px" class="wp-caption aligncenter"><a href="media/e59ed402.punchmadecardskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadecardskim.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66136" decoding="async" class="wp-image-66136 size-full" src="media/e59ed402.punchmadecardskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadecardskim.png" alt="" width="620" height="822" /></a><p id="caption-attachment-66136" class="wp-caption-text">A partial selfie posted by Punchmade Dev to his Twitter account. Yes, that is a functioning handheld card skimming device, encrusted in diamonds. Underneath that are more medallions, including a diamond-studded bitcoin and payment card.</p></div>
<p>In January, KrebsOnSecurity wrote about rapper <strong>Punchmade Dev</strong>, whose music videos sing the praises of a cybercrime lifestyle. That story showed how Punchmade&#8217;s social media profiles promoted Punchmade-themed online stores selling bank account and payment card data. The subject of that piece, a 22-year-old Kentucky man, is now brazenly suing his financial institution after it blocked a $75,000 wire transfer and froze his account, citing an active law enforcement investigation.</p>
<p>With memorable hits such as “Internet Swiping” and “Million Dollar Criminal” earning millions of views, Punchmade Dev has leveraged his considerable following to peddle tutorials on how to commit financial crimes online. But until recently, there wasn’t much to support a conclusion that Punchmade was actually doing the cybercrime things he promotes in his songs.</p>
<p>That changed earlier this year when KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/01/e-crime-rapper-punchmade-dev-debuts-card-shop/" target="_blank" rel="noopener">showed</a> how Punchmade&#8217;s social media handles were promoting Punchmade e-commerce shops online that sold access to <strong>Cashapp </strong>and <strong>PayPal</strong> accounts with balances, software for printing checks, as well as personal and financial data on Americans.</p>
<div id="attachment_66135" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66135" decoding="async" loading="lazy" class="wp-image-66135" src="media/e1240061.punchmadeshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop.png" alt="" width="750" height="478" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop.png 1260w, https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop-768x489.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/punchmadeshop-782x498.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66135" class="wp-caption-text">Punchmade Dev&#8217;s previous online shop (now defunct). His Telegram channel has more than 75,000 followers.</p></div>
<p>The January story traced Punchmade&#8217;s various online properties to a 22-year-old <strong>Devon Turner</strong> from Lexington, Ky. Reached via his <a href="https://twitter.com/punchmade" target="_blank" rel="noopener">profile on X/Twitter</a>, Punchmade Dev said they were not affiliated with the lawsuit filed by Turner [Punchmade&#8217;s X account provided this denial even though it has still not responded to requests for comment from the first story about him in January]. Meanwhile, Mr. Turner has declined multiple requests to comment for this story.</p>
<p>On June 26, Turner filed a <em>pro se</em> lawsuit against <strong>PNC Bank</strong>, alleging &#8220;unlawful discriminatory and tortuous action&#8221; after he was denied a wire transfer in the amount of $75,000. PNC Bank did not respond to a request for comment.</p>
<p>Turner&#8217;s complaint states that a follow-up call to his bank revealed the account had been closed due to &#8220;suspicious activity,&#8221; and that he was no longer welcome to patronize PNC Bank.</p>
<p>&#8220;The Plaintiff is a very successful African-American business owner, who has generated millions of dollars with his businesses, has hired 30 plus people to work for his businesses,&#8221; Turner wrote.</p>
<p>As reported in January, among Turner&#8217;s businesses is a Lexington entity called <strong>OBN Group LLC</strong> (assumed name <strong>Punchmade LLC</strong>). Business incorporation documents from the Kentucky Secretary of State show he also ran a record label called <strong>DevTakeFlightBeats Inc.</strong></p>
<p>Turner&#8217;s lawsuit alleges that bank staff made disparaging remarks about him, suggesting the account was canceled because it would be unusual for a person like him to have that kind of money.</p>
<div id="attachment_68303" style="width: 630px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68303" decoding="async" loading="lazy" class="size-full wp-image-68303" src="media/e8f0443d.turnerlawsuit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/turnerlawsuit.png" alt="" width="620" height="441" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/turnerlawsuit.png 620w, https://krebsonsecurity.com/wp-content/uploads/2024/08/turnerlawsuit-100x70.png 100w" sizes="(max-width: 620px) 100vw, 620px" /><p id="caption-attachment-68303" class="wp-caption-text">A snippet from Turner&#8217;s lawsuit vs. PNC.</p></div>
<p>Incredibly, Turner acknowledges that <em>PNC told him his account was flagged for attention from law enforcement officials</em>.</p>
<p>&#8220;The PNC Bank customer service representative also explained that there was a note on the account that law enforcement would be contacted at some point in time,&#8221; the lawsuit reads.</p>
<p>&#8220;The Plaintiff, who was not worried at all about law enforcement being involved because nothing illegal occurred, informed the PNC Bank representative that this was one big mistake and asked him what his options were,&#8221; the complaint states.<span id="more-68279"></span></p>
<div id="attachment_66142" style="width: 752px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66142" decoding="async" loading="lazy" class=" wp-image-66142" src="media/394811f7.devonturner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner.png" alt="" width="742" height="584" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner.png 827w, https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner-768x605.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/devonturner-782x616.png 782w" sizes="(max-width: 742px) 100vw, 742px" /><p id="caption-attachment-66142" class="wp-caption-text">Devon Turner, a.k.a. &#8220;Punchmade Dev,&#8221; in an undated photo, wearing a diamond-covered Visa card. Image: tiktok.com/brainjuiceofficial</p></div>
<p>Turner&#8217;s lawsuit said PNC told him they would put a note on his account allowing him to withdraw the funds from any branch, but that when he visited a PNC branch and asked to withdraw the entire amount in his account &#8212; $500,000 &#8212; PNC refused, saying the money had been seized.</p>
<p>&#8220;Ultimately, PNC bank not only refused his request to release his funds but informed him that his funds would be seized indefinitely as [sic] PNC Bank,&#8221; Turner lawsuit recounts.</p>
<p>The Punchmade shops selling financial data that were profiled in the January story are long gone, but Punchmade&#8217;s Instagram account now promotes <strong>punchmade[.]cc</strong>, which behaves and looks the same as his older shop.</p>
<div id="attachment_68323" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68323" decoding="async" loading="lazy" class=" wp-image-68323" src="media/ab91ecbf.punchmadecc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/punchmadecc.png" alt="" width="749" height="443" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/punchmadecc.png 1464w, https://krebsonsecurity.com/wp-content/uploads/2024/08/punchmadecc-768x454.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/punchmadecc-782x462.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-68323" class="wp-caption-text">Punchmade&#8217;s current shop, which DomainTools says was registered to a Lexington, Ky. phone number used by accounts under the name of Devon Turner at multiple online retailers.</p></div>
<p>The breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> finds the email address associated with Turner&#8217;s enterprise OBN Group LLC &#8212; <strong>obndevpayments@gmail.com </strong>&#8212; was used by a Devon Turner from Lexington to purchase software online. That record includes the Lexington, Ky. mobile phone number <strong>859-963-6243</strong>, which Constella also finds was used to register accounts for Devon Turner at the retailer Neiman Marcus, and at the home decor and fashion site poshmark.com.</p>
<p>A search on this phone number at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> shows it is associated with two domain names since 2021. The first is the aforementioned punchmade[.]cc. The other is foreverpunchmade[.]com, which is registered to a Devon Turner in Lexington, Ky. A copy of this site at archive.org indicates it once sold Punchmade <a href="https://web.archive.org/web/20231030160708/https://www.foreverpunchmade.com/" target="_blank" rel="noopener">Dev-branded t-shirts and other merchandise</a>.</p>
<p>Mr. Turner included his contact information at the bottom of his lawsuit. What phone number did he leave? Would you believe <strong>859-963-6243?</strong></p>
<div id="attachment_68337" style="width: 684px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68337" decoding="async" loading="lazy" class="size-full wp-image-68337" src="media/a37bc092.turner-phone.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/turner-phone.png" alt="" width="674" height="701" /><p id="caption-attachment-68337" class="wp-caption-text">The closing section of Mr. Turner&#8217;s complaint includes a phone number that was used to register a popular online fraud shop named after Punchmade.</p></div>
<p>Is Punchmade Dev a big-time cybercriminal enabler, as his public personna would have us believe? Or is he some two-bit nitwit who has spent so much on custom medallions that he can&#8217;t afford a lawyer? It&#8217;s hard to tell.</p>
<p>But he definitively has a broad reach: His Instagram account has ~860k followers, and his Telegram channel has more than 75,000 subscribers, all no doubt seeking that sweet &#8220;C@sh App sauce,&#8221; which apparently has something to do with moving cryptocurrencies through Cash App in a way that financially rewards people able and willing to open up new accounts.</p>
<p>It&#8217;s incredibly ironic that Punchmade sells tutorials on how to have great &#8220;opsec,&#8221; a reference to &#8220;operational security,&#8221; which in the cybercriminal context means the ability to successfully separate one&#8217;s cybercriminal identity from one&#8217;s real-life identity: This guy can&#8217;t even register a domain name anonymously.</p>
<p>A copy of Turner&#8217;s complaint is available <a href="media/9903a80e.punchmadevpnc.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/punchmadevpnc.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>For more on Punchmade, check out the TikTok video <a href="https://www.tiktok.com/@brainjuiceofficial/video/7265359384908139806" target="_blank" rel="noopener">How Punchmade Dev Got Started Scamming</a>.</p>
<p><strong>Update, Aug. 8, 8:49 a.m. ET:</strong> A reader pointed out that Turner also <a href="https://www.courtlistener.com/docket/68464221/1/turner-v-zeigler-hoffman-estates-i-llc/" target="_blank" rel="noopener">recently sued a Mercedes Benz dealership in Illinois</a>, allegedly for selling him a lemon. In that pro se complaint, Turner included the contact email address <strong>punchmadedev@gmail.com</strong>.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-68345" src="media/d2f94b6d.punchmade-lemon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/punchmade-lemon.png" alt="" width="314" height="433" /></p>


feed_id: https://krebsonsecurity.com/?p=68355
title: Six 0-Days Lead Microsoft’s August 2024 Patch Push
uri: Six-0-Days-Lead-Microsoft-s-August-2024-Patch-Push
url: https://krebsonsecurity.com/2024/08/six-0-days-lead-microsofts-august-2024-patch-push/
content:
<p><strong>Microsoft</strong> today released updates to fix at least 90 security vulnerabilities in <strong>Windows</strong> and related software, including <em>a whopping six zero-day flaws</em> that are already being actively exploited by attackers.</p>
<div id="attachment_68358" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68358" decoding="async" class=" wp-image-68358" src="media/2b24f517.clicktofix.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/clicktofix.png" alt="" width="750" height="516" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/clicktofix.png 757w, https://krebsonsecurity.com/wp-content/uploads/2024/08/clicktofix-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68358" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>This month&#8217;s bundle of update joy from Redmond includes patches for security holes in <strong>Office</strong>, <strong>.NET</strong>, <strong>Visual Studio</strong>, <strong>Azure</strong>, <strong>Co-Pilot</strong>, <strong>Microsoft Dynamics</strong>, <strong>Teams</strong>, <strong>Secure Boot,</strong> and of course Windows itself. Of the six zero-day weaknesses Microsoft addressed this month, half are local privilege escalation vulnerabilities &#8212; meaning they are primarily useful for attackers when combined with other flaws or access.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38106" target="_blank" rel="noopener">CVE-2024-38106</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38107" target="_blank" rel="noopener">CVE-2024-38107</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38193" target="_blank" rel="noopener">CVE-2024-38193</a> all allow an attacker to gain SYSTEM level privileges on a vulnerable machine, although the vulnerabilities reside in different parts of the Windows operating system.</p>
<p>Microsoft&#8217;s advisories include little information about the last two privilege escalation flaws, other than to note they are being actively exploited. Microsoft says CVE-2024-38106 exists in the Windows Kernel and is being actively exploited, but that it has a high &#8220;attack complexity,&#8221; meaning it can be tricky for malware or miscreants to exploit reliably.</p>
<p>&#8220;Microsoft lists exploit complexity as high due to the attacker needing to win a race condition,&#8221; Trend Micro&#8217;s <strong>ZeroDay Initiative</strong> (ZDI) noted. &#8220;However, some races are easier to run than others. It’s times like this where the CVSS can be misleading. Race conditions do lead to complexity high in the CVSS score, but with attacks in the wild, it’s clear this bug is readily exploitable.&#8221;<span id="more-68355"></span></p>
<p>Another zero-day this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38178" target="_blank" rel="noopener">CVE-2024-38178</a>, a remote code execution flaw that exists when the built-in <strong>Windows Edge</strong> browser is operating in &#8220;Internet Explorer Mode.&#8221; IE mode is not on by default in Edge, but it can be enabled to work with older websites or applications that aren&#8217;t supported by modern Chromium-based browsers.</p>
<p>&#8220;While this is not the default mode for most users, this exploit being actively exploited suggests that there are occasions in which the attacker can set this or has identified an organization (or user) that has this configuration,&#8221; wrote <strong>Kev Breen</strong>, senior director of threat research at Immersive Labs.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38213" target="_blank" rel="noopener">CVE-2024-38213</a> is a zero-day flaw that allows malware to bypass the &#8220;Mark of the Web,&#8221; a security feature in Windows that marks files downloaded from the Internet as untrusted (this Windows Smartscreen feature is responsible for the &#8220;Windows protected your PC&#8221; popup that appears when opening files downloaded from the Web).</p>
<p>&#8220;This vulnerability is not exploitable on its own and is typically seen as part of an exploit chain, for example, modifying a malicious document or exe file to include this bypass before sending the file via email or distributing on compromised websites,&#8221; Breen said.</p>
<p>The final zero-day this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-38189" target="_blank" rel="noopener">CVE-2024-38189</a>, a remote code execution flaw in <strong>Microsoft Project</strong>. However, Microsoft and multiple security firms point out that this vulnerability only works on customers who have already disabled notifications about the security risks of running VBA Macros in Microsoft Project (not the best idea, as malware has a long history of hiding within malicious Office Macros).</p>
<p>Separately, <strong>Adobe</strong> today released 11 security bulletins addressing at least 71 security vulnerabilities across a range of products, including <strong>Adobe Illustrator</strong>, <strong>Dimension</strong>, <strong>Photoshop</strong>, <strong>InDesign</strong>, <strong>Acrobat</strong> and <strong>Reader</strong>, <strong>Bridge</strong>, <strong>Substance 3D Stager</strong>, <strong>Commerce</strong>, <strong>InCopy</strong>, and <strong>Substance 3D Sampler/Substance 3D Designer</strong>. Adobe says it is not aware of active exploitation against any of the flaws it fixed this week.</p>
<p>It’s a good idea for Windows users to stay current with security updates from Microsoft, which can quickly pile up otherwise. That doesn’t mean you have to install them on Patch Tuesday each month. Indeed, waiting a day or three before updating is a sane response, given that sometimes updates go awry and usually within a few days Microsoft has fixed any issues with its patches. It’s also smart to back up your data and/or image your Windows drive before applying new updates.</p>
<p>For a more detailed breakdown of the individual flaws addressed by Microsoft today, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft%20August%202024%20Patch%20Tuesday/31164/" target="_blank" rel="noopener">SANS Internet Storm Center’s list</a>. For those admins responsible for maintaining larger Windows environments, it pays to keep an eye on <a href="https://www.askwoody.com/" target="_blank" rel="noopener">Askwoody.com</a>, which frequently points out when specific Microsoft updates are creating problems for a number of users.</p>


feed_id: https://krebsonsecurity.com/?p=68375
title: NationalPublicData.com Hack Exposes a Nation’s Data
uri: NationalPublicData-com-Hack-Exposes-a-Nation-s-Data
url: https://krebsonsecurity.com/2024/08/nationalpublicdata-com-hack-exposes-a-nations-data/
content:
<p>A great many readers this month reported receiving alerts that their Social Security Number, name, address and other personal information were exposed in a breach at a little-known but aptly-named consumer data broker called <strong>NationalPublicData.com</strong>. This post examines what we know about a breach that has exposed hundreds of millions of consumer records. We&#8217;ll also take a closer look at the data broker that got hacked &#8212; a background check company founded by an actor and retired sheriff&#8217;s deputy from Florida.</p>
<p><img decoding="async" class="aligncenter size-medium wp-image-68389" src="media/eb9f4d87.nationalpublicdata-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata-home.png" alt="" width="1269" height="745" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata-home.png 1269w, https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata-home-768x451.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata-home-782x459.png 782w" sizes="(max-width: 1269px) 100vw, 1269px" /></p>
<p>On July 21, 2024, denizens of the cybercrime community <strong>Breachforums</strong> released more than 4 terabytes of data they claimed was stolen from nationalpublicdata.com, a Florida-based company that collects data on consumers and processes background checks.</p>
<p>The breach tracking service <strong>HaveIBeenPwned.com</strong> and the cybercrime-focused Twitter account <a href="https://twitter.com/vxunderground" target="_blank" rel="noopener">vx-underground</a> both concluded the leak is the same information first put up for sale in April 2024 by a prolific cybercriminal who goes by the name &#8220;<strong>USDoD</strong>.&#8221;</p>
<p>On April 7, USDoD posted a sales thread on Breachforums for four terabytes of data &#8212; 2.9 billion rows of records &#8212; they claimed was taken from nationalpublicdata.com. The snippets of stolen data that USDoD offered as teasers showed rows of names, addresses, phone numbers, and Social Security Numbers (SSNs). Their asking price? $3.5 million.</p>
<p>Many media outlets mistakenly reported that the National Public data breach affects 2.9 billion people (that figure actually refers to the number of rows in the leaked data sets). HaveIBeenOwned.com&#8217;s <strong>Troy Hunt</strong> <a href="https://www.troyhunt.com/inside-the-3-billion-people-national-public-data-breach/" target="_blank" rel="noopener">analyzed the leaked data</a> and found it is a somewhat disparate collection of consumer and business records, including the real names, addresses, phone numbers and SSNs of millions of Americans (both living and deceased), and 70 million rows from a database of U.S. criminal records.</p>
<p>Hunt said he found 137 million unique email addresses in the leaked data, but stressed that there were no email addresses in the files containing SSN records.</p>
<p>&#8220;If you find yourself in this data breach via HaveIBeenPwned.com, there&#8217;s no evidence your SSN was leaked, and if you&#8217;re in the same boat as me, the data next to your record may not even be correct.&#8221;</p>
<p>Nationalpublicdata.com publicly acknowledged a breach in <a href="https://nationalpublicdata.com/Breach.html" target="_blank" rel="noopener">a statement on Aug. 12</a>, saying &#8220;there appears to have been a data security incident that may have involved some of your personal information. The incident appears to have involved a third-party bad actor that was trying to hack into data in late December 2023, with potential leaks of certain data in April 2024 and summer 2024.&#8221;</p>
<p>The company said the information &#8220;suspected of being breached&#8221; contained name, email address, phone number, social security number, and mailing address(es).</p>
<p>&#8220;We cooperated with law enforcement and governmental investigators and conducted a review of the potentially affected records and will try to notify you if there are further significant developments applicable to you,&#8221; the statement continues. &#8220;We have also implemented additional security measures in efforts to prevent the reoccurrence of such a breach and to protect our systems.&#8221;</p>
<p>Hunt&#8217;s analysis didn&#8217;t say how many unique SSNs were included in the leaked data. But according to researchers at <strong>Atlas Data Privacy Corp.</strong>, there are 272 million unique SSNs in the entire records set.</p>
<p>Atlas found most records have a name, SSN, and home address, and that approximately 26 percent of those records included a phone number. Atlas said they verified 5,000 addresses and phone numbers, and found the records pertain to people born before Jan. 1, 2002 (with very few exceptions).</p>
<p>If there is a tiny silver lining to the breach it is this: Atlas discovered that a great many of the records related to people who are now almost certainly deceased. They found the average age of the consumer in these records is 70, and fully two million records are related to people whose date of birth would make them more than 120 years old today.<span id="more-68375"></span></p>
<h2>TWISTED HISTORY</h2>
<p>Where did National Public Data get its consumer data? The company&#8217;s website doesn&#8217;t say, but it is operated by an entity in Coral Springs, Fla. called <strong>Jerico Pictures Inc.</strong> The website for Jerico Pictures is not currently responding. However, <a href="https://web.archive.org/web/20230330052412/http://www.jericopictures.com/" target="_blank" rel="noopener">cached versions of it at archive.org</a> show it is a film studio with offices in Los Angeles and South Florida.</p>
<p>The Florida Secretary of State says Jerico Pictures is owned by <strong>Salvatore (Sal) Verini Jr.</strong>, a retired deputy with the Broward County Sheriff&#8217;s office. The Secretary of State also says Mr. Verini is or was a founder of several other Florida companies, including <strong>National Criminal Data LLC</strong>, <strong>Twisted History LLC</strong>, <strong>Shadowglade LLC</strong> and <strong>Trinity Entertainment Inc.</strong>, among others.</p>
<p>Mr. Verini did not respond to multiple requests for comment. Cached copies of Mr. Verini&#8217;s vanity domain <a href="https://web.archive.org/web/20230323175843/http://www.salvatoreverini.com/" target="_blank" rel="noopener">salvatoreverini.com</a> recount his experience in acting (e.g. a role in the 80s detective drama B.L. Stryker with Burt Reynolds) and more recently producing dramas and documentaries for several streaming channels.</p>
<div id="attachment_68384" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68384" decoding="async" loading="lazy" class=" wp-image-68384" src="media/09feeb23.salverini-imdb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/salverini-imdb.png" alt="" width="749" height="546" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/salverini-imdb.png 849w, https://krebsonsecurity.com/wp-content/uploads/2024/08/salverini-imdb-768x560.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/salverini-imdb-782x570.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-68384" class="wp-caption-text">Sal Verini&#8217;s profile page at imdb.com.</p></div>
<p>Pivoting on the email address used to register that vanity domain, <strong>DomainTools.com</strong> finds several other domains whose history offers a clearer picture of the types of data sources relied upon by National Public Data.</p>
<p>One of those domains is <strong>recordscheck.net</strong> (formerly <strong>recordscheck.info</strong>), which advertises &#8220;instant background checks, SSN traces, employees screening and more.&#8221; Another now-defunct business tied to Mr. Verini&#8217;s email &#8212; <a href="https://web.archive.org/web/20150110212648/http://www.publicrecordsunlimited.com/products.html" target="_blank" rel="noopener">publicrecordsunlimited.com</a> &#8212; said it obtained consumer data from a variety of sources, including: birth, marriage and death records; voting records; professional licenses; state and federal criminal records.</p>
<div id="attachment_68387" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68387" decoding="async" loading="lazy" class=" wp-image-68387" src="media/04272ea5.publicrecordsunlimited.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/publicrecordsunlimited.png" alt="" width="750" height="687" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/publicrecordsunlimited.png 870w, https://krebsonsecurity.com/wp-content/uploads/2024/08/publicrecordsunlimited-768x704.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/publicrecordsunlimited-782x716.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68387" class="wp-caption-text">The homepage for publicrecordsunlimited.com, per archive.org circa 2017.</p></div>
<p>It remains unclear how thieves originally obtained these records from National Public Data. KrebsOnSecurity sought comment from USDoD, who is perhaps best known for <a href="https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/" target="_blank" rel="noopener">hacking into Infragard, an FBI program</a> that facilitates information sharing about cyber and physical threats with vetted people in the private sector.</p>
<p>USDoD said they indeed sold the same data set that was leaked on Breachforums this past month, but that the person who leaked the data did not obtain it from them. USDoD said the data stolen from National Public Data had traded hands several times since it was initially stolen in December 2023.</p>
<p>&#8220;The database has been floating around for a while,&#8221; USDoD said. &#8220;I was not the first one to get it.&#8221;</p>
<p>USDoD said the person who originally stole the data from NPD was a hacker who goes by the handle <strong>SXUL</strong>. That user appears to have deleted their Telegram account several days ago, presumably in response to intense media coverage of the breach.</p>
<h2>ANALYSIS</h2>
<p>Data brokers like National Public Data typically get their information by scouring federal, state and local government records. Those government files include voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more.</p>
<p>Americans may believe they have the right to opt out of having these records collected and sold to anyone. But experts say these underlying sources of information &#8212; the above-mentioned &#8220;public&#8221; records &#8212; are carved out from every single state consumer privacy law. This includes California&#8217;s privacy regime, which is often held up as the national leader in state privacy regulations.</p>
<p>You see, here in America, virtually anyone can become a consumer data broker. And with few exceptions, there aren&#8217;t any special requirements for brokers to show that they actually care about protecting the data they collect, store, repackage and sell so freely.</p>
<p>In February 2023, <strong>PeopleConnect</strong>, the owners of the background search services <strong>TruthFinder</strong> and <strong>Instant Checkmate</strong>, <a href="https://www.bleepingcomputer.com/news/security/truthfinder-instant-checkmate-confirm-data-breach-affecting-20m-customers/" target="_blank" rel="noopener">acknowledged a breach affecting 20 million customers</a> who paid the data brokers to run background checks. The data exposed included email addresses, hashed passwords, first and last names, and phone numbers.</p>
<p>In 2019, malicious hackers <a href="https://www.wired.com/story/billion-records-exposed-online/" target="_blank" rel="noopener">stole data on more than 1.5 billion people from People Data Labs</a>, a San Francisco data broker whose people-search services linked hundreds of millions of email addresses, LinkedIn and Facebook profiles and more than 200 million valid cell phone numbers.</p>
<p>These data brokers are the digital equivalent of massive oil tankers wandering the coast without GPS or an anchor, because when they get hacked, the effect is very much akin to the ecological and economic fallout from a giant oil spill.</p>
<p>It&#8217;s an apt analogy because the dissemination of so much personal data all at once has ripple effects for months and years to come, as this information invariably feeds into a vast underground ocean of scammers who are already equipped and staffed to commit identity theft and account takeovers at scale.</p>
<p>It&#8217;s also apt because much like with real-life oil spills, the cleanup costs and effort from data spills &#8212; even just vast collections of technically &#8220;public&#8221; documents like the NPD corpus &#8212; can be enormous, and most of the costs associated with that fall to consumers, directly or indirectly.</p>
<h2>WHAT SHOULD YOU DO?</h2>
<p>Should you worry that your SSN and other personal data might be exposed in this breach? That isn&#8217;t necessary for people who&#8217;ve been following the advice here for years, which is to <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">freeze one&#8217;s credit file</a> at <a href="https://www.usa.gov/credit-freeze" target="_blank" rel="noopener">each of the major consumer reporting bureaus</a>. Having a freeze on your files makes it much harder for identity thieves to create new accounts in your name, and it limits who can view your credit information.</p>
<p>The main reason I recommend the freeze is that all of the information ID thieves need to assume your identity is now broadly available from multiple sources, thanks to the multiplicity of data breaches we&#8217;ve seen involving SSN data and other key static data points about people.</p>
<p>But beyond that, there are numerous cybercriminal services that offer detailed background checks on consumers, including full SSNs. These services are powered by compromised accounts at data brokers that cater to private investigators and law enforcement officials, and some are now fully automated via Telegram instant message bots. Meaning, if you&#8217;re an American who hasn&#8217;t frozen their credit files and you haven&#8217;t yet experienced some form of new account fraud, the ID thieves probably just haven&#8217;t gotten around to you yet.</p>
<p>All Americans are also entitled to obtain a free copy of their credit report once a year from each of the three major credit bureaus, through the website <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a>. If you haven&#8217;t done this in a while, now would be an excellent time to order your files (or just get one now, and then a report from a different bureau in 4-5 months, and so on).</p>
<p>Either way, review the reports and dispute any errors you may find. Identity theft and new account fraud is not a problem that gets easier to solve by letting it fester.</p>
<p>Mr. Verini probably didn&#8217;t respond to requests for comment because his company is <a href="https://news.bloomberglaw.com/privacy-and-data-security/background-check-data-of-3-billion-stolen-in-breach-suit-says?ref=troyhunt.com" target="_blank" rel="noopener">now the subject of a class-action lawsuit</a> (NB: the lawsuit also erroneously claims 3 billion people were affected). These lawsuits are practically inevitable now after a major breach, but they also have the unfortunate tendency to let regulators and lawmakers off the hook.</p>
<p>Almost every time there&#8217;s a major breach of SSN data, Americans are offered credit monitoring services. Most of the time, those services come from one of the three major consumer credit bureaus, the same companies that profit by compiling and selling incredibly detailed dossiers on consumers&#8217; financial lives. The same companies that use dark patterns to trick people into paying for &#8220;credit lock&#8221; services that achieve a similar result as a freeze but still let the bureaus sell your data to their partners.</p>
<p>But class-actions alone will not drive us toward a national conversation about what needs to change. Americans currently have very few rights to opt out of the personal and financial surveillance, data collection and sale that is pervasive in today&#8217;s tech-based economy.</p>
<p>The breach at National Public Data may not be the worst data breach ever. But it does present yet another opportunity for this country&#8217;s leaders to acknowledge that the SSN has completely failed as a measure of authentication or authorization. It was never a good idea to use as an authenticator to begin with, and it is certainly no longer suitable for this purpose.</p>
<p>The truth is that these data brokers will continue to proliferate and thrive (and get hacked and relieved of their data) until Congress begins to realize it’s time for some consumer privacy and data protection laws that are relevant to life in the 21st century.</p>


feed_id: https://krebsonsecurity.com/?p=68428
title: National Public Data Published Its Own Passwords
uri: National-Public-Data-Published-Its-Own-Passwords
url: https://krebsonsecurity.com/2024/08/national-public-data-published-its-own-passwords/
content:
<p>New details are emerging about a breach at <strong>National Public Data</strong> (NPD), a consumer data broker that recently spilled hundreds of millions of Americans&#8217; Social Security Numbers, addresses, and phone numbers online. KrebsOnSecurity has learned that another NPD data broker which shares access to the same consumer records inadvertently published the passwords to its back-end database in a file that was freely available from its homepage until today.</p>
<p><img decoding="async" class="aligncenter wp-image-68388" src="media/01a76cb8.nationalpublicdata.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata.png" alt="" width="748" height="201" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata.png 964w, https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata-768x206.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/nationalpublicdata-782x210.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></p>
<p>In April, a cybercriminal named <strong>USDoD</strong> began selling data stolen from NPD. In July, someone leaked what was taken, including the names, addresses, phone numbers and in some cases email addresses for more than 272 million people (including many who are now deceased).</p>
<p>NPD <a href="https://nationalpublicdata.com/Breach.html" target="_blank" rel="noopener">acknowledged the intrusion on Aug. 12</a>, saying it dates back to a security incident in December 2023. In an interview last week, USDoD blamed the July data leak on another malicious hacker who also had access to the company&#8217;s database, which they claimed has been floating around the underground since December 2023.</p>
<p>Following <a href="https://krebsonsecurity.com/2024/08/nationalpublicdata-com-hack-exposes-a-nations-data/" target="_blank" rel="noopener">last week&#8217;s story on the breadth of the NPD breach</a>, a reader alerted KrebsOnSecurity that a sister NPD property &#8212; the background search service <strong>recordscheck.net</strong> &#8212; was hosting an archive that included the usernames and password for the site&#8217;s administrator.</p>
<p>A review of that archive, which was available from the Records Check website until just before publication this morning (August 19), shows it includes the source code and plain text usernames and passwords for different components of recordscheck.net, which is visually similar to nationalpublicdata.com and features identical login pages.</p>
<p>The exposed archive, which was named &#8220;<strong>members.zip</strong>,&#8221; indicates RecordsCheck users were all initially assigned the same six-character password and instructed to change it, but many did not.</p>
<p>According to the breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a>, the passwords included in the source code archive are identical to credentials exposed in previous data breaches that involved email accounts belonging to NPD&#8217;s founder, an <a href="https://www.imdb.com/name/nm4701915/" target="_blank" rel="noopener">actor</a> and retired sheriff&#8217;s deputy from Florida named <strong>Salvatore &#8220;Sal&#8221; Verini</strong>.</p>
<p>Reached via email, Mr. Verini said the exposed archive (a .zip file) containing recordscheck.net credentials has been removed from the company&#8217;s website, and that the site is slated to cease operations &#8220;in the next week or so.&#8221;</p>
<p>&#8220;Regarding the zip, it has been removed but was an old version of the site with non-working code and passwords,&#8221; Verini told KrebsOnSecurity. &#8220;Regarding your question, it is an active investigation, in which we cannot comment on at this point. But once we can, we will [be] with you, as we follow your blog. Very informative.&#8221;</p>
<p>The leaked recordscheck.net source code indicates the website was created by a web development firm based in Lahore, Pakistan called <strong>creationnext.com</strong>, which did not return messages seeking comment. CreationNext.com&#8217;s homepage features a positive testimonial from Sal Verini.</p>
<div id="attachment_68433" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68433" decoding="async" loading="lazy" class=" wp-image-68433" src="media/c2a1d40a.verini-creationnext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/verini-creationnext.png" alt="" width="750" height="513" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/verini-creationnext.png 1212w, https://krebsonsecurity.com/wp-content/uploads/2024/08/verini-creationnext-768x525.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/verini-creationnext-782x535.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68433" class="wp-caption-text">A testimonial from Sal Verini on the homepage of CreationNext, the Lahore, Pakistan-based web development firm that apparently designed NPD and RecordsCheck.</p></div>
<p>There are now several websites that have been stood up to help people learn if their SSN and other data was exposed in this breach. One is <a href="https://www.npdbreach.com" target="_blank" rel="noopener">npdbreach.com</a>, a lookup page erected by <strong>Atlas Data Privacy Corp</strong>. Another lookup service is available at <a href="https://npd.pentester.com/" target="_blank" rel="noopener">npd.pentester.com</a>. Both sites show NPD had old and largely inaccurate data on Yours Truly. <span id="more-68428"></span></p>
<p>The best advice for those concerned about this breach is to <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">freeze one’s credit file</a> at <a href="https://www.usa.gov/credit-freeze" target="_blank" rel="noopener">each of the major consumer reporting bureaus</a>. Having a freeze on your files makes it much harder for identity thieves to create new accounts in your name, and it limits who can view your credit information.</p>
<p>A freeze is a good idea because all of the information that ID thieves need to assume your identity is now broadly available from multiple sources, thanks to the multiplicity of data breaches we’ve seen involving SSN data and other key static data points about people.</p>
<div id="attachment_65685" style="width: 310px" class="wp-caption alignright"><a href="media/34e43f6e.usis-tg-names.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/usis-tg-names.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65685" decoding="async" loading="lazy" class="wp-image-65685" src="media/34e43f6e.usis-tg-names.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/11/usis-tg-names.png" alt="" width="300" height="376" /></a><p id="caption-attachment-65685" class="wp-caption-text">Screenshots of a Telegram-based ID theft service that was selling background reports using hacked law enforcement accounts at USInfoSearch.</p></div>
<p>There are numerous cybercriminal services that offer detailed background checks on consumers, including full SSNs. These services are powered by compromised accounts at data brokers that cater to private investigators and law enforcement officials, and some are now fully automated via Telegram instant message bots.</p>
<p>In November 2023, KrebsOnSecurity wrote about one such service, which was being powered by <a href="https://krebsonsecurity.com/2023/11/id-theft-service-resold-access-to-usinfosearch-data/" target="_blank" rel="noopener">hacked accounts at the U.S. consumer data broker USInfoSearch.com</a>. This is notable because the leaked source code indicates Records Check pulled background reports on people by querying NPD&#8217;s database and records at USInfoSearch. KrebsOnSecurity sought comment from USInfoSearch and will update this story if they respond.</p>
<p>The point is, if you’re an American who hasn’t frozen their credit files and you haven’t yet experienced some form of new account fraud, the ID thieves probably just haven’t gotten around to you yet.</p>
<p>All Americans are also entitled to obtain a free copy of their credit report weekly from each of the three major credit bureaus. It used to be that consumers were allowed one free report from each of the bureaus annually, but in October 2023 the <strong>Federal Trade Commission</strong> <a href="https://consumer.ftc.gov/consumer-alerts/2023/10/you-now-have-permanent-access-free-weekly-credit-reports" target="_blank" rel="noopener">announced</a> the bureaus had permanently extended a program that lets you check your credit report once a week for free.</p>
<p>If you haven’t done this in a while, now would be an excellent time to order your files. To place a freeze, you&#8217;ll need to create an account at each of the three major reporting bureaus, <a href="https://www.equifax.com/" target="_blank" rel="noopener">Equifax</a>, <a href="https://www.experian.com/" target="_blank" rel="noopener">Experian</a> and <a href="https://www.transunion.com/" target="_blank" rel="noopener">TransUnion</a>. Once you’ve established an account, you should be able to then view and freeze your credit file. If you spot errors, such as random addresses and phone numbers you don’t recognize, do not ignore them. Dispute any inaccuracies you may find.</p>


feed_id: https://krebsonsecurity.com/?p=68352
title: Local Networks Go Global When Domain Names Collide
uri: Local-Networks-Go-Global-When-Domain-Names-Collide
url: https://krebsonsecurity.com/2024/08/local-networks-go-global-when-domain-names-collide/
content:
<p>The proliferation of new top-level domains (TLDs) has exacerbated a well-known security weakness: Many organizations set up their internal Microsoft authentication systems years ago using domain names in TLDs that didn&#8217;t exist at the time. Meaning, they are continuously sending their Windows usernames and passwords to domain names they do not control and which are freely available for anyone to register. Here&#8217;s a look at one security researcher&#8217;s efforts to map and shrink the size of this insidious problem.</p>
<p><img decoding="async" class="aligncenter wp-image-68467" src="media/601d5f6a.tld-cloud.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/tld-cloud.png" alt="" width="746" height="405" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/tld-cloud.png 1055w, https://krebsonsecurity.com/wp-content/uploads/2024/08/tld-cloud-768x417.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/tld-cloud-782x425.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/08/tld-cloud-370x200.png 370w" sizes="(max-width: 746px) 100vw, 746px" /></p>
<p>At issue is a well-known security and privacy threat called “<a href="https://www.computerworld.com/article/3480799/icann-seeks-to-tackle-dns-namespace-collision-risks.html" target="_blank" rel="noopener">namespace collision</a>,” a situation where domain names intended to be used exclusively on an internal company network end up overlapping with domains that can resolve normally on the open Internet.</p>
<p>Windows computers on a private corporate network validate other things on that network using a Microsoft innovation called <a href="https://en.wikipedia.org/wiki/Active_Directory" target="_blank" rel="noopener">Active Directory</a>, which is the umbrella term for a broad range of identity-related services in Windows environments. A core part of the way these things find each other involves a Windows feature called “<a href="https://www.itprotoday.com/security/whats-dns-name-devolution" target="_blank" rel="noopener">DNS name devolution</a>,” a kind of network shorthand that makes it easier to find other computers or servers without having to specify a full, legitimate domain name for those resources.</p>
<p>Consider the hypothetical private network internalnetwork.example.com: When an employee on this network wishes to access a shared drive called “drive1,” there’s no need to type “drive1.internalnetwork.example.com” into Windows Explorer; entering “\\drive1\” alone will suffice, and Windows takes care of the rest.</p>
<p>But problems can arise when an organization has built their Active Directory network on top of a domain they don&#8217;t own or control. While that may sound like a bonkers way to design a corporate authentication system, keep in mind that many organizations built their networks long before the introduction of hundreds of new top-level domains (TLDs), like .network, .inc, and .llc.</p>
<p>For example, a company in 2005 builds their Microsoft Active Directory service around the domain <strong>company.llc</strong>, perhaps reasoning that since .llc wasn&#8217;t even a routable TLD, the domain would simply fail to resolve if the organization&#8217;s Windows computers were ever used outside of its local network.</p>
<p>Alas, in 2018, the .llc TLD was born and began selling domains. From then on, anyone who registered company.llc would be able to passively intercept that organization&#8217;s Microsoft Windows credentials, or actively modify those connections in some way &#8212; such as redirecting them somewhere malicious.</p>
<p><strong>Philippe Caturegli</strong>, founder of the security consultancy <a href="https://www.seralys.com" target="_blank" rel="noopener">Seralys</a>, is one of several researchers seeking to chart the size of the namespace collision problem. As a professional penetration tester, Caturegli has long exploited these collisions to attack specific targets that were paying to have their cyber defenses probed. But over the past year, Caturegli has been gradually mapping this vulnerability across the Internet by looking for clues that appear in self-signed security certificates (e.g. SSL/TLS certs).</p>
<p>Caturegli has been scanning the open Internet for self-signed certificates referencing domains in a variety of TLDs likely to appeal to businesses, including <strong>.ad, .associates, .center, .cloud, .consulting, .dev, .digital, .domains, .email, .global, .gmbh, .group, .holdings, .host, .inc, .institute, .international, .it, .llc, .ltd, .management, .ms, .name, .network, .security, .services, .site, .srl, .support, .systems, .tech, .university, .win </strong>and<strong> .zone</strong>, among others.</p>
<p>Seralys found certificates referencing more than 9,000 distinct domains across those TLDs. Their analysis determined many TLDs had far more exposed domains than others, and that about 20 percent of the domains they found ending .ad, .cloud and .group remain unregistered.</p>
<p>&#8220;The scale of the issue seems bigger than I initially anticipated,&#8221; Caturegli said in an interview with KrebsOnSecurity. &#8220;And while doing my research, I have also identified government entities (foreign and domestic), critical infrastructures, etc. that have such misconfigured assets.&#8221;</p>
<h2>REAL-TIME CRIME</h2>
<p>Some of the above-listed TLDs are not new and correspond to country-code TLDs, like <strong>.it</strong> for Italy, and <strong>.ad</strong>, the country-code TLD for the tiny nation of <a href="https://en.wikipedia.org/wiki/Andorra" target="_blank" rel="noopener">Andorra</a>. Caturegli said many organizations no doubt viewed a domain ending in .ad as a convenient shorthand for an internal <strong>A</strong>ctive <strong>D</strong>irectory setup, while being unaware or unworried that someone could actually register such a domain and intercept all of their Windows credentials and any unencrypted traffic.</p>
<p>When Caturegli discovered an encryption certificate being actively used for the domain <strong>memrtcc.ad, </strong>the domain was still available for registration. He then learned the .ad registry requires prospective customers to show a valid trademark for a domain before it can be registered.</p>
<p>Undeterred, Caturegli found a domain registrar that would sell him the domain for $160, and handle the trademark registration for another $500 (on subsequent .ad registrations, he located a company in Andorra that could process the trademark application for half that amount).</p>
<p>Caturegli said that immediately after setting up a DNS server for memrtcc.ad, he began receiving a flood of communications from hundreds of Microsoft Windows computers trying to authenticate to the domain. Each request contained a username and a hashed Windows password, and upon searching the usernames online Caturegli concluded they all belonged to police officers in Memphis, Tenn.</p>
<p>&#8220;It looks like all of the police cars there have a laptop in the cars, and they&#8217;re all attached to this memrtcc.ad domain that I now own,&#8221; Caturegli said, noting wryly that &#8220;memrtcc&#8221; stands for &#8220;<strong>Memphis Real-Time Crime Center</strong>.&#8221;</p>
<p>Caturegli said setting up an email server record for memrtcc.ad caused him to begin receiving automated messages from the police department&#8217;s IT help desk, including trouble tickets regarding the city&#8217;s Okta authentication system.</p>
<p><strong>Mike Barlow</strong>, information security manager for the City of Memphis, confirmed the Memphis Police&#8217;s systems were sharing their Microsoft Windows credentials with the domain, and that the city was working with Caturegli to have the domain transferred to them.</p>
<p>&#8220;We are working with the Memphis Police Department to at least somewhat mitigate the issue in the meantime,&#8221; Barlow said.</p>
<p>Domain administrators have long been encouraged to use <strong>.local</strong> for internal domain names, because this TLD is <a href="https://en.wikipedia.org/wiki/.local" target="_blank" rel="noopener">reserved for use by local networks</a> and cannot be routed over the open Internet. However, Caturegli said many organizations seem to have missed that memo and gotten things backwards &#8212; setting up their internal Active Directory structure around the perfectly routable domain <strong>local.ad</strong>.</p>
<p>Caturegli said he knows this because he &#8220;defensively&#8221; registered local.ad, which he said is currently used by multiple large organizations for Active Directory setups &#8212; including a European mobile phone provider, and the <strong>City of Newcastle</strong> in the United Kingdom.<span id="more-68352"></span></p>
<h2>ONE WPAD TO RULE THEM ALL</h2>
<p>Caturegli said he has now defensively registered a number of domains ending in .ad, such as internal.ad and schema.ad. But perhaps the most dangerous domain in his stable is <strong>wpad.ad</strong>. WPAD stands for <a href="https://en.wikipedia.org/wiki/Web_Proxy_Auto-Discovery_Protocol" target="_blank" rel="noopener">Web Proxy Auto-Discovery Protocol</a>, which is an ancient, on-by-default feature built into every version of Microsoft Windows that was designed to make it simpler for Windows computers to automatically find and download any proxy settings required by the local network.</p>
<p>Trouble is, any organization that chose a .ad domain they don&#8217;t own for their Active Directory setup will have a whole bunch of Microsoft systems constantly trying to reach out to wpad.ad if those machines have proxy automated detection enabled.</p>
<p>Security researchers have been beating up on WPAD for more than two decades now, warning time and again how it can be abused for nefarious ends. At this year&#8217;s DEF CON security conference in Las Vegas, for example, a researcher <a href="https://defcon.org/html/defcon-32/dc-32-speakers.html" target="_blank" rel="noopener">showed</a> what happened after they registered the domain <strong>wpad.dk</strong>: Immediately after switching on the domain, they received a flood of WPAD requests from Microsoft Windows systems in Denmark that had namespace collisions in their Active Directory environments.</p>
<div id="attachment_68468" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68468" decoding="async" loading="lazy" class=" wp-image-68468" src="media/61e8320a.wpad-defcon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/wpad-defcon.png" alt="" width="748" height="314" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/wpad-defcon.png 884w, https://krebsonsecurity.com/wp-content/uploads/2024/08/wpad-defcon-768x322.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/wpad-defcon-782x328.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-68468" class="wp-caption-text">Image: Defcon.org.</p></div>
<p>For his part, Caturegli set up a server on wpad.ad to resolve and record the Internet address of any Windows systems trying to reach <strong>Microsoft Sharepoint</strong> servers, and saw that over one week it received more than 140,000 hits from hosts around the world attempting to connect.</p>
<p>The fundamental problem with WPAD is the same with Active Directory: Both are technologies originally designed to be used in closed, static, trusted office environments, and neither was built with today&#8217;s mobile devices or workforce in mind.</p>
<p>Probably one big reason organizations with potential namespace collision problems don&#8217;t fix them is that rebuilding one&#8217;s Active Directory infrastructure around a new domain name can be incredibly disruptive, costly, and risky, while the potential threat is considered comparatively low.</p>
<p>But Caturegli said ransomware gangs and other cybercrime groups could siphon huge volumes of Microsoft Windows credentials from quite a few companies with just a small up-front investment.</p>
<p>&#8220;It&#8217;s an easy way to gain that initial access without even having to launch an actual attack,&#8221; he said. &#8220;You just wait for the misconfigured workstation to connect to you and send you their credentials.&#8221;</p>
<p>If we ever learn that cybercrime groups are using namespace collisions to launch ransomware attacks, nobody can say they weren&#8217;t warned. <strong>Mike O&#8217;Connor</strong>, an early domain name investor who registered a number of choice domains such as bar.com, place.com and television.com, warned loudly and often back in 2013 that then-pending plans to add more than 1,000 new TLDs would massively expand the number of namespace collisions. O&#8217;Connor was so concerned about the problem that he <a href="https://www.haven2.com/index.php/archives/new-gtlds-and-namespace-collision" target="_blank" rel="noopener">offered $50,000, $25,000 and $10,000 prizes</a> for researchers who could propose the best solutions for mitigating it.</p>
<p>Mr. O&#8217;Connor&#8217;s most famous domain is <strong>corp.com</strong>, because for several decades he <a href="https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/" target="_blank" rel="noopener">watched in horror</a> as hundreds of thousands of Microsoft PCs continuously blasted his domain with credentials from organizations that had set up their Active Directory environment around the domain corp.com.</p>
<p>It turned out that Microsoft had actually used corp.com as an example of how one might set up Active Directory in some editions of Windows NT. Worse, some of the traffic going to corp.com was coming from Microsoft&#8217;s internal networks, indicating some part of Microsoft&#8217;s own internal infrastructure was misconfigured. When O&#8217;Connor said he was ready to sell corp.com to the highest bidder in 2020, Microsoft <a href="https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/" target="_blank" rel="noopener">agreed to buy the domain for an undisclosed amount</a>.</p>
<p>&#8220;I kind of imagine this problem to be something like a town [that] knowingly built a water supply out of lead pipes, or vendors of those projects who knew but didn&#8217;t tell their customers,&#8221; O&#8217;Connor told KrebsOnSecurity. &#8220;This is not an inadvertent thing like Y2K where everybody was surprised by what happened. People knew and didn&#8217;t care.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=68493
title: New 0-Day Attacks Linked to China’s ‘Volt Typhoon’
uri: New-0-Day-Attacks-Linked-to-China-s-Volt-Typhoon
url: https://krebsonsecurity.com/2024/08/new-0-day-attacks-linked-to-chinas-volt-typhoon/
content:
<p>Malicious hackers are exploiting a zero-day vulnerability in <strong>Versa Director</strong>, a software product used by many Internet and IT service providers. Researchers believe the activity is linked to <strong>Volt Typhoon</strong>, a Chinese cyber espionage group focused on infiltrating critical U.S. networks and laying the groundwork for the ability to disrupt communications between the United States and Asia during any future armed conflict with China.</p>
<div id="attachment_68507" style="width: 850px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68507" decoding="async" class="size-full wp-image-68507" src="media/aa145fbb.ss-dissolvingsphere.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/ss-dissolvingsphere.png" alt="" width="840" height="508" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/ss-dissolvingsphere.png 840w, https://krebsonsecurity.com/wp-content/uploads/2024/08/ss-dissolvingsphere-768x464.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/ss-dissolvingsphere-782x473.png 782w" sizes="(max-width: 840px) 100vw, 840px" /><p id="caption-attachment-68507" class="wp-caption-text">Image: Shutterstock.com</p></div>
<p>Versa Director systems are primarily used by Internet service providers (ISPs), as well as managed service providers (MSPs) that cater to the IT needs of many small to mid-sized businesses simultaneously. In <a href="https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/" target="_blank" rel="noopener">a security advisory</a> published Aug. 26, Versa urged customers to deploy a patch for the vulnerability (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39717" target="_blank" rel="noopener">CVE-2024-39717</a>), which the company said is fixed in <em>Versa Director 22.1.4</em> or later.</p>
<p>Versa said the weakness allows attackers to upload a file of their choosing to vulnerable systems. The advisory placed much of the blame on Versa customers who &#8220;failed to implement system hardening and firewall guidelines&#8230;leaving a management port exposed on the internet that provided the threat actors with initial access.&#8221;</p>
<p>Versa&#8217;s advisory doesn&#8217;t say how it learned of the zero-day flaw, but its vulnerability listing at mitre.org acknowledges &#8220;there are reports of others based on backbone telemetry observations of a 3rd party provider, however these are unconfirmed to date.&#8221;</p>
<p>Those third-party reports came in late June 2024 from <strong>Michael Horka</strong>, senior lead information security engineer at <strong>Black Lotus Labs</strong>, the security research arm of <strong>Lumen Technologies</strong>, which operates one of the global Internet&#8217;s largest backbones.</p>
<p>In an interview with KrebsOnSecurity, Horka said Black Lotus Labs identified a web-based backdoor on Versa Director systems belonging to four U.S. victims and one non-U.S. victim in the ISP and MSP sectors, with the earliest known exploit activity occurring at a U.S. ISP on June 12, 2024.</p>
<p>&#8220;This makes Versa Director a lucrative target for advanced persistent threat (APT) actors who would want to view or control network infrastructure at scale, or pivot into additional (or downstream) networks of interest,&#8221; Horka <a href="https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/" target="_blank" rel="noopener">wrote</a> in a blog post published today.</p>
<p>Black Lotus Labs said it assessed with &#8220;medium&#8221; confidence that Volt Typhoon was responsible for the compromises, noting the intrusions bear the hallmarks of the Chinese state-sponsored espionage group &#8212; including zero-day attacks targeting IT infrastructure providers, and Java-based backdoors that run in memory only.</p>
<p>In May 2023, the <strong>National Security Agency</strong> (NSA), the <strong>Federal Bureau of Investigation</strong> (FBI), and the <strong>Cybersecurity Infrastructure Security Agency</strong> (CISA) issued <a href="media/893438e6.CSA_Living_off_the_Land.PDF" data-original-source="https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF" target="_blank" rel="noopener">a joint warning</a> (PDF) about Volt Typhoon, also known as &#8220;<strong>Bronze Silhouette</strong>&#8221; and &#8220;<strong>Insidious Taurus</strong>,&#8221; which described how the group uses small office/home office (SOHO) network devices to hide their activity.</p>
<p>In early December 2023, Black Lotus Labs <a href="https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/" target="_blank" rel="noopener">published its findings</a> on &#8220;<strong>KV-botnet</strong>,&#8221; thousands of compromised SOHO routers that were chained together to form a covert data transfer network supporting various Chinese state-sponsored hacking groups, including Volt Typhoon.</p>
<p>In January 2024, the <strong>U.S. Department of Justice</strong> disclosed the FBI had <a href="https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" target="_blank" rel="noopener">executed a court-authorized takedown</a> of the KV-botnet shortly before Black Lotus Labs released its December report.<span id="more-68493"></span></p>
<p>In February 2024, CISA again joined the FBI and NSA in <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a" target="_blank" rel="noopener">warning</a> Volt Typhoon had compromised the IT environments of multiple critical infrastructure organizations &#8212; primarily in communications, energy, transportation systems, and water and wastewater sectors &#8212; in the continental and non-continental United States and its territories, including Guam.</p>
<p>&#8220;Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT [operational technology] assets to disrupt functions,&#8221; that alert warned.</p>
<p>In a speech at Vanderbilt University in April, FBI Director <strong>Christopher Wray</strong> <a href="https://www.reuters.com/technology/cybersecurity/fbi-says-chinese-hackers-preparing-attack-us-infrastructure-2024-04-18/" target="_blank" rel="noopener">said</a> China is developing the &#8220;ability to physically wreak havoc on our critical infrastructure at a time of its choosing,&#8221; and that China&#8217;s plan is to &#8220;land blows against civilian infrastructure to try to induce panic.&#8221;</p>
<p><strong>Ryan English</strong>, an information security engineer at Lumen, said it&#8217;s disappointing his employer didn&#8217;t at least garner an honorable mention in Versa&#8217;s security advisory. But he said he&#8217;s glad there are now a lot fewer Versa systems exposed to this attack.</p>
<p>&#8220;Lumen has for the last nine weeks been very intimate with their leadership with the goal in mind of helping them mitigate this,&#8221; English said. &#8220;We&#8217;ve given them everything we could along the way, so it kind of sucks being referenced just as a third party.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=68528
title: When Get-Out-The-Vote Efforts Look Like Phishing
uri: When-Get-Out-The-Vote-Efforts-Look-Like-Phishing
url: https://krebsonsecurity.com/2024/08/when-get-out-the-vote-efforts-look-like-phishing/
content:
<p>Multiple media reports this week warned Americans to be on guard against a new phishing scam that arrives in a text message informing recipients they are not yet registered to vote. A bit of digging reveals the missives were sent by a California political consulting firm as part of a well-meaning but potentially counterproductive get-out-the-vote effort that had all the hallmarks of a phishing campaign.</p>
<div id="attachment_68534" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68534" decoding="async" class=" wp-image-68534" src="media/26a6147c.wdiv-sms.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/wdiv-sms.png" alt="" width="749" height="413" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/08/wdiv-sms.png 1160w, https://krebsonsecurity.com/wp-content/uploads/2024/08/wdiv-sms-768x423.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/08/wdiv-sms-782x431.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-68534" class="wp-caption-text">Image: WDIV Detroit on Youtube.</p></div>
<p>On Aug. 27, the local Channel 4 affiliate <strong>WDIV</strong> in Detroit <a href="https://www.youtube.com/watch?v=kXkKZ4T25h0" target="_blank" rel="noopener">warned</a> about a new SMS message wave that they said could prevent registered voters from casting their ballot. The story didn&#8217;t explain how or why the scam could block eligible voters from casting ballots, but it did show one of the related text messages, which linked to the site <strong>all-vote.com</strong>.</p>
<p>&#8220;We have you in our records as not registered to vote,&#8221; the unbidden SMS advised. &#8220;Check your registration status &amp; register in 2 minutes.&#8221;</p>
<p>Similar warnings came from <a href="https://www.abc15.com/news/political/elections/spam-or-real-unsolicited-text-messages-say-you-arent-registered-to-vote" target="_blank" rel="noopener">an ABC station in Arizona</a>, and from <a href="https://www.wgal.com/article/south-central-pennsylvania-voters-question-text-message-about-registration-status/61960563" target="_blank" rel="noopener">an NBC affiliate in Pennsylvania</a>, where election officials <a href="https://co.lancaster.pa.us/CivicAlerts.aspx?AID=2204" target="_blank" rel="noopener">just issued an alert</a> to be on the lookout for scam messages coming from all-vote.com. Some people interviewed who received the messages said they figured it was a scam because they knew for a fact they <em>were</em> registered to vote in their state. WDIV even interviewed a seventh-grader from Canada who said he also got the SMS saying he wasn&#8217;t registered to vote.</p>
<p>Someone trying to determine whether all-vote.com was legitimate might visit the main URL first (as opposed to just clicking the link in the SMS) to find out more about the organization. But visiting all-vote.com directly presents one with a login page to an online service called bl.ink. <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> finds all-vote.com was registered on July 10, 2024. Red flag #1.</p>
<div id="attachment_68538" style="width: 268px" class="wp-caption alignright"><img aria-describedby="caption-attachment-68538" decoding="async" loading="lazy" class=" wp-image-68538" src="media/6a407733.winvotecheckstatus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/08/winvotecheckstatus.png" alt="" width="258" height="406" /><p id="caption-attachment-68538" class="wp-caption-text">The information requested from people who visited votewin.org via the SMS campaign.</p></div>
<p>Another version of this SMS campaign told recipients to check their voter status at a site called <strong>votewin.org</strong>, which DomainTools says was registered July 9, 2024. There is little information about who runs votewin.org on its website, and the contact page leads to generic contact form. Red Flag #2.</p>
<p>What&#8217;s more, Votewin.org asks visitors to supply their name, address, email address, date of birth, mobile phone number, while pre-checking options to sign the visitor up for more notifications. Big Red Flag #3.</p>
<p>Votewin.org&#8217;s Terms of Service referenced a California-based voter engagement platform called <strong>VoteAmerica LLC.</strong> The same voter registration query form advertised in the SMS messages is available if one clicks the &#8220;check your registration status&#8221; link on voteamerica.org.</p>
<p>VoteAmerica founder <strong>Debra Cleaver</strong> told KrebsOnSecurity the entity responsible for the SMS campaigns telling people they weren&#8217;t registered is <strong>Movement Labs</strong>, a political consulting firm in San Francisco.</p>
<p>Cleaver said her office had received several inquiries about the messages, which violate a key tenet of election outreach: Never tell the recipient what their voter status may be.</p>
<p>&#8220;That&#8217;s one of the worst practices,&#8221; Cleaver said. &#8220;You never tell someone what the voter file says because voter files are not reliable, and are often out of date.&#8221;</p>
<p>Reached via email, Movement Labs founder <strong>Yoni Landau</strong> said the SMS campaigns targeted &#8220;underrepresented groups in the electorate, young people, folks who are moving, low income households and the like, who are unregistered in our databases, with the intent to help them register to vote.&#8221;</p>
<p>Landau said filling out the form on Votewin.org merely checks to see if the visitor is registered to vote in their state, and then attempts to help them register if not.</p>
<p>&#8220;We understand that many people are jarred by the messages &#8211; we tested hundreds of variations of messages and found that these had the largest impact on someone&#8217;s likelihood to register,&#8221; he said. &#8220;I&#8217;m deeply sorry for anyone that may have gotten the message in error, who is registered to vote, and we&#8217;re looking into our content now to see if there are any variations that might be less certain but still as effective in generating new legal registrations.&#8221;</p>
<p>Cleaver said Movement Labs&#8217; SMS campaign may have been incompetent, but it wasn&#8217;t malicious.</p>
<p>&#8220;When you work in voter mobilization, it&#8217;s not enough to want to do good, you actually need to be good,&#8221; she said. &#8220;At the end of the day the end result of incompetence and maliciousness is the same: increased chaos, reduced voter turnout, and long-term harm to our democracy.&#8221;</p>
<p>To register to vote or to update your voter registration, visit <a href="https://www.vote.gov" target="_blank" rel="noopener">vote.gov</a> and select your state or region.</p>


feed_id: https://krebsonsecurity.com/?p=68585
title: Sextortion Scams Now Include Photos of Your Home
uri: Sextortion-Scams-Now-Include-Photos-of-Your-Home
url: https://krebsonsecurity.com/2024/09/sextortion-scams-now-include-photos-of-your-home/
content:
<p>An old but persistent email scam known as &#8220;<strong>sextortion</strong>&#8221; has a new personalized touch: The missives, which claim that malware has captured webcam footage of recipients pleasuring themselves, now include a photo of the target&#8217;s home in a bid to make threats about publishing the videos more frightening and convincing.</p>
<p><img decoding="async" class="aligncenter wp-image-44412" src="media/4f452cd1.sextortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/sextortion.png" alt="" width="750" height="134" /></p>
<p>This week, several readers reported receiving sextortion emails that addressed them by name and included images of their street or front yard that were apparently lifted from an online mapping application such as <strong>Google Maps</strong>.</p>
<p>The message purports to have been sent from a hacker who’s compromised your computer and used your webcam to record a video of you while you were watching porn. The missive threatens to release the video to all of your contacts unless you pay a Bitcoin ransom. In this case, the demand is just shy of $2,000, payable by scanning a QR code embedded in the email.</p>
<p>Following a salutation that includes the recipient&#8217;s full name, the start of the message reads, &#8220;Is visiting [recipient&#8217;s street address] a more convenient way to contact if you don&#8217;t take action. Nice location btw.&#8221; Below that is the photo of the recipient&#8217;s street address.</p>
<div id="attachment_68587" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68587" decoding="async" loading="lazy" class=" wp-image-68587" src="media/23d91340.sextortion-maps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/sextortion-maps.png" alt="" width="748" height="677" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/sextortion-maps.png 996w, https://krebsonsecurity.com/wp-content/uploads/2024/09/sextortion-maps-768x695.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/sextortion-maps-782x707.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-68587" class="wp-caption-text">A semi-redacted screenshot of a newish sextortion scam that includes a photo of the target&#8217;s front yard.</p></div>
<p>The message tells people they have 24 hours to pay up, or else their embarrassing videos will be released to all of their contacts, friends and family members.</p>
<p>&#8220;Don&#8217;t even think about replying to this, it&#8217;s pointless,&#8221; the message concludes. &#8220;I don&#8217;t make mistakes, [recipient&#8217;s name]. If I notice that you&#8217;ve shared or discussed this email with someone else, your shitty video will instantly start getting sent to your contacts.&#8221;</p>
<p>The remaining sections of the two-page sextortion message (which arrives as a PDF attachment) are fairly formulaic and include thematic elements seen in most previous sextortion waves. Those include claims that the extortionist has installed malware on your computer (in this case the scammer claims the spyware is called &#8220;Pegasus,&#8221; and that they are watching everything you do on your machine).</p>
<p>Previous innovations in sextortion customization involved sending emails that <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">included at least one password they had previously used</a> at an account online that was tied to their email address. <span id="more-68585"></span></p>
<div class="entry-content">
<p>Sextortion — even semi-automated scams like this one with no actual physical leverage to backstop the extortion demand — is a serious crime that can lead to devastating consequences for victims. Sextortion occurs when someone threatens to distribute your private and sensitive material if you don’t provide them with images of a sexual nature, sexual favors, or money.</p>
<p>According to the FBI, here are some things you can do to avoid becoming a victim:</p>
<p>-Never send compromising images of yourself to anyone, no matter who they are — or who they say they are.<br />
-Don’t open attachments from people you don’t know, and be wary of opening attachments even from those you do know.<br />
-Turn off [and/or cover] any web cameras when you are not using them.</p>
<p>The FBI says in many sextortion cases, the perpetrator is an adult pretending to be a teenager, and you are just one of the many victims being targeted by the same person. If you believe you’re a victim of sextortion, or know someone else who is, the FBI wants to hear from you: Contact your local FBI office (or toll-free at 1-800-CALL-FBI).</p>
</div>


feed_id: https://krebsonsecurity.com/?p=68557
title: Owners of 1-Time Passcode Theft Service Plead Guilty
uri: Owners-of-1-Time-Passcode-Theft-Service-Plead-Guilty
url: https://krebsonsecurity.com/2024/09/owners-of-1-time-passcode-theft-service-plead-guilty/
content:
<p>Three men in the United Kingdom have pleaded guilty to operating <strong>otp[.]agency</strong>, a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.</p>
<p>Launched in November 2019, OTP Agency was a service for intercepting one-time passcodes needed to log in to various websites. Scammers who had already stolen someone&#8217;s bank account credentials could enter the target’s phone number and name, and the service would initiate an automated phone call to the target that warned them about unauthorized activity on their account.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/45GsKWyF63U?si=WcCChUe4gFLTpnxO" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The call would prompt the target to enter a one-time passcode that was sent to the user via SMS when the thieves attempted to log in. Any codes shared by the target were then relayed to the scammer’s user panel at the OTP Agency website.</p>
<p>A <a href="https://www.nationalcrimeagency.gov.uk/news/website-operators-promised-fraudsters-profit-within-minutes-if-they-subscribed-to-illegal-service" target="_blank" rel="noopener">statement</a> published Aug. 30 by the U.K.&#8217;s <strong>National Crime Agency</strong> (NCA) said three men pleaded guilty to running OTP Agency: <strong>Callum Picari</strong>, 22, from Hornchurch, Essex; <strong>Vijayasidhurshan Vijayanathan</strong>, 21, from Aylesbury, Buckinghamshire; and <strong>Aza Siddeeque</strong>, 19, from Milton Keynes, Buckinghamshire.</p>
<p>KrebsOnSecurity profiled OTP Agency in <a href="https://krebsonsecurity.com/2021/02/u-k-arrest-in-sms-bandits-phishing-service/" target="_blank" rel="noopener">a February 2021 story</a> about arrests tied to another phishing-related service based in the U.K. Someone claiming to represent OTP Agency then posted several comments on the piece, wherein <a href="media/e57dc78a.otp-support.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/otp-support.png" target="_blank" rel="noopener">they claimed</a> the story was libelous and that they were a legitimate anti-fraud service. However, the service&#8217;s Telegram channel clearly showed its proprietors had built OTP Agency with one purpose in mind: To help their customers take over online accounts.</p>
<p>Within hours of that publication, OTP Agency shuttered its website and announced it was closing up shop and purging its user database. The NCA said the February 2021 story prompted a panicked message exchange between Picari and Vijayanathan:</p>
<blockquote><p>Picari said: bro we are in big trouble… U will get me bagged… Bro delete the chat</p>
<p>Vijayanathan: Are you sure</p>
<p>Picari: So much evidence in there</p>
<p>Vijayanathan: Are you 100% sure</p>
<p>Picari: It’s so incriminating&#8230;Take a look and search &#8216;fraud&#8217;&#8230;Just think of all the evidence&#8230;that we cba to find&#8230;in the OTP chat&#8230;they will find</p>
<p>Vijayanathan: Exactly so if we just shut EVERYTHING down</p>
<p>Picari: They went to our first ever msg&#8230;We look incriminating&#8230;if we shut down&#8230;I say delete the chat&#8230;Our chat is Fraud 100%</p>
<p>Vijayanathan : Everyone with a brain will tell you stop it here and move on</p>
<p>Picari: Just because we close it doesn’t mean we didn’t do it&#8230;But deleting our chat&#8230;Will f*^k their investigations&#8230;There’s nothing fraudulent on the site</p></blockquote>
<p>Despite deleting its Telegram channel, OTP Agency evidently found it difficult to walk away from its customers (and/or the money). Instead of shutting down as Vijayanathan wisely advised, just a few days later OTP Agency was communicating with customers <a href="media/e57dc78a.otp-support.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/otp-support.png" target="_blank" rel="noopener">on a new Telegram channel</a>, offering a new login page and assuring existing customers that their usernames, passwords and balances would remain the same.</p>
<div id="attachment_68562" style="width: 785px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68562" decoding="async" loading="lazy" class="size-full wp-image-68562" src="media/a6acb712.optagency-reborn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/optagency-reborn.png" alt="" width="775" height="632" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/optagency-reborn.png 775w, https://krebsonsecurity.com/wp-content/uploads/2024/09/optagency-reborn-768x626.png 768w" sizes="(max-width: 775px) 100vw, 775px" /><p id="caption-attachment-68562" class="wp-caption-text">OTP Agency, immediately after their initial shutdown, telling customers their existing logins will still work.</p></div>
<p><span id="more-68557"></span>But that revival would be short-lived. The NCA said the site was taken offline less than a month later when the trio were arrested. NCA investigators said more than 12,500 people were targeted by OTP Agency users during the 18 month the service was active.</p>
<p>Picari was the owner, developer and main beneficiary of the service, and his personal information and ownership of OTP Agency was revealed in February 2020 in a &#8220;dox&#8221; posted to the now-defunct English-language cybercrime forum <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">Raidforums</a>. The NCA said it began investigating the service in June 2020.</p>
<div id="attachment_68565" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68565" decoding="async" loading="lazy" class=" wp-image-68565" src="media/ef6d0d88.otpa-mugshots.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/otpa-mugshots.png" alt="" width="748" height="440" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/otpa-mugshots.png 775w, https://krebsonsecurity.com/wp-content/uploads/2024/09/otpa-mugshots-768x452.png 768w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-68565" class="wp-caption-text">The OTP Agency operators who pleaded guilty to running the service; Aza Siddeeque, Callum Picari, and Vijayasidhurshan Vijayanathan.</p></div>
<p>OTP Agency might be gone, but several other similar OTP interception services are still in operation and accepting new customers, including a long-running service <a href="https://krebsonsecurity.com/2021/09/the-rise-of-one-time-password-interception-bots/" target="_blank" rel="noopener">KrebsOnSecurity profiled in September 2021</a> called <strong>SMSRanger</strong>. More on SMSRanger in an upcoming post.</p>
<p>Text messages, emails and phone calls warning recipients about potential fraud are some of the most common scam lures. If someone (or something) calls saying they&#8217;re from your bank, or asks you to provide any personal or financial information, <em>do not respond</em>.  Just hang up, full stop.</p>
<p>If the call has you worried about the security and integrity of your account, check the account status online, or call your financial institution — ideally using a phone number that came from the bank’s Web site or from the back of your payment card.</p>
<p>Further reading: <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">When in Doubt, Hang Up, Look Up, and Call Back</a></p>


feed_id: https://krebsonsecurity.com/?p=68633
title: Bug Left Some Windows PCs Dangerously Unpatched
uri: Bug-Left-Some-Windows-PCs-Dangerously-Unpatched
url: https://krebsonsecurity.com/2024/09/bug-left-some-windows-pcs-dangerously-unpatched/
content:
<p><strong>Microsoft Corp.</strong> today released updates to fix at least 79 security vulnerabilities in its <strong>Windows</strong> operating systems and related software, including multiple flaws that are already showing up in active attacks. Microsoft also corrected a critical bug that has caused some <strong>Windows 10</strong> PCs to remain dangerously unpatched against actively exploited vulnerabilities for several months this year.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>By far the most curious security weakness Microsoft disclosed today has the snappy name of <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43491" target="_blank" rel="noopener">CVE-2024-43491</a>, which Microsoft says is a vulnerability that led to the rolling back of fixes for some vulnerabilities affecting &#8220;optional components&#8221; on certain Windows 10 systems produced in 2015. Those include Windows 10 systems that installed the monthly security update for Windows released in March 2024, or other updates released until August 2024.</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, said that while the phrase &#8220;exploitation detected&#8221; in a Microsoft advisory normally implies the flaw is being exploited by cybercriminals, it appears labeled this way with CVE-2024-43491 because the rollback of fixes reintroduced vulnerabilities that were previously know to be exploited.</p>
<p>&#8220;To correct this issue, users need to apply both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates,&#8221; Narang said.</p>
<p><strong>Kev Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>, said the root cause of CVE-2024-43491 is that on specific versions of Windows 10, the build version numbers that are checked by the update service were not properly handled in the code.</p>
<p>&#8220;The <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43491" target="_blank" rel="noopener">notes from Microsoft</a> say that the &#8216;build version numbers crossed into a range that triggered a code defect&#8217;,&#8221; Breen said. &#8220;The short version is that some versions of Windows 10 with optional components enabled was left in a vulnerable state.&#8221;<span id="more-68633"></span></p>
<p>Zero Day #1 this month is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38226" target="_blank" rel="noopener">CVE-2024-38226</a>, and it concerns a weakness in <strong>Microsoft Publisher</strong>, a standalone application included in some versions of <strong>Microsoft Office</strong>. This flaw lets attackers bypass Microsoft&#8217;s &#8220;<strong>Mark of the Web</strong>,&#8221; a Windows security feature that marks files downloaded from the Internet as potentially unsafe.</p>
<p>Zero Day #2 is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217" target="_blank" rel="noopener">CVE-2024-38217</a>, also a Mark of the Web bypass affecting Office. Both zero-day flaws rely on the target opening a booby-trapped Office file.</p>
<p>Security firm <strong>Rapid7</strong> notes that CVE-2024-38217 has been publicly disclosed via <a href="https://www.elastic.co/security-labs/dismantling-smart-app-control" target="_blank" rel="noopener">an extensive write-up</a>, with exploit code also available on GitHub.</p>
<p>According to Microsoft, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38014" target="_blank" rel="noopener">CVE-2024-38014</a>, an &#8220;elevation of privilege&#8221; bug in the Windows Installer, is also being actively exploited.</p>
<p>June&#8217;s coverage of Microsoft Patch Tuesday was titled &#8220;<a href="https://krebsonsecurity.com/2024/06/patch-tuesday-june-2024-recall-edition/" target="_blank" rel="noopener">Recall Edition</a>,&#8221; because the big news then was that Microsoft was facing a torrent of criticism from privacy and security experts over &#8220;<strong>Recall</strong>,&#8221; a new artificial intelligence (AI) feature of Redmond’s flagship Copilot+ PCs that constantly takes screenshots of whatever users are doing on their computers.</p>
<p>At the time, Microsoft responded by suggesting Recall would no longer be enabled by default. But last week, the software giant clarified that <a href="https://www.theverge.com/2024/9/2/24233992/microsoft-recall-windows-11-uninstall-feature-bug" target="_blank" rel="noopener">what it really meant</a> was that the ability to disable Recall was a bug/feature in the preview version of Copilot+ that will not be available to Windows customers going forward. Translation: New versions of Windows are shipping with Recall deeply embedded in the operating system.</p>
<p>It&#8217;s pretty rich that Microsoft, which already collects an insane amount of information from its customers on a near constant basis, is calling the Recall removal feature a bug, while treating Recall as a desirable feature. Because from where I sit, Recall is a feature nobody asked for that turns Windows into a bug (of the surveillance variety).</p>
<p>When Redmond first responded to critics about Recall, they noted that Recall snapshots never leave the user’s system, and that even if attackers managed to hack a Copilot+ PC they would not be able to exfiltrate on-device Recall data.</p>
<p>But that claim rang hollow after former Microsoft threat analyst <strong>Kevin Beaumont</strong> <a href="https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e" target="_blank" rel="noopener">detailed on his blog</a> how any user on the system (even a non-administrator) can export Recall data, which is just stored in an SQLite database locally.</p>
<p>As it is apt to do on Microsoft Patch Tuesday, Adobe has <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">released updates</a> to fix security vulnerabilities in a range of products, including <strong>Reader</strong> and <strong>Acrobat</strong>, <strong>After Effects</strong>, <strong>Premiere Pro</strong>, <strong>Illustrator</strong>, <strong>ColdFusion</strong>, <strong>Adobe Audition</strong>, and <strong>Photoshop</strong>. Adobe says it is not aware of any exploits in the wild for any of the issues addressed in its updates.</p>
<p>Seeking a more detailed breakdown of the patches released by Microsoft today? Check out the SANS Internet Storm Center&#8217;s <a href="https://isc.sans.edu/forums/diary/Microsoft+September+2024+Patch+Tuesday/31254/" target="_blank" rel="noopener">thorough list</a>. People responsible for administering many systems in an enterprise environment would do well to keep an eye on <a href="https://www.askwoody.com" target="_blank" rel="noopener">AskWoody.com</a>, which often has the skinny on any wonky Windows patches that may be causing problems for some users.</p>
<p>As always, if you experience any issues applying this month&#8217;s patch batch, consider dropping a note in the comments here about it.</p>
<p>&nbsp;</p>


feed_id: https://krebsonsecurity.com/?p=68600
title: The Dark Nexus Between Harm Groups and ‘The Com’
uri: The-Dark-Nexus-Between-Harm-Groups-and-The-Com
url: https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/
content:
<p>A cyberattack that shut down two of the top casinos in Las Vegas last year quickly became one of the most riveting security stories of 2023: It was the first known case of native English-speaking hackers in the United States and Britain teaming up with ransomware gangs based in Russia. But that made-for-Hollywood narrative has eclipsed a far more hideous trend: Many of these young, Western cybercriminals are also members of fast-growing online groups that exist solely to bully, stalk, harass and extort vulnerable teens into physically harming themselves and others.</p>
<div id="attachment_68692" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68692" decoding="async" class=" wp-image-68692" src="media/613bdae8.vegasnight-ss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/vegasnight-ss.png" alt="" width="748" height="498" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/vegasnight-ss.png 885w, https://krebsonsecurity.com/wp-content/uploads/2024/09/vegasnight-ss-768x511.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/vegasnight-ss-782x520.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-68692" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>In September 2023, a Russian ransomware group known as <strong>ALPHV/Black Cat</strong> claimed credit for an intrusion at the <strong>MGM Resorts</strong> hotel chain that quickly brought MGM&#8217;s casinos in Las Vegas to a standstill. While MGM was still trying to evict the intruders from its systems, an individual who claimed to have firsthand knowledge of the hack contacted multiple media outlets to offer interviews about how it all went down.</p>
<p>One <a href="https://archive.ph/MuU4s" target="_blank" rel="noopener">account of the hack</a> came from a 17-year-old in the United Kingdom, who told reporters the intrusion began when one of the English-speaking hackers phoned a tech support person at MGM and tricked them into resetting the password for an employee account.</p>
<p>The security firm <strong>CrowdStrike</strong> dubbed the group &#8220;<strong>Scattered Spider</strong>,&#8221; a recognition that the MGM hackers came from different hacker cliques scattered across an ocean of Telegram and Discord servers dedicated to financially-oriented cybercrime.</p>
<p>Collectively, this archipelago of crime-focused chat communities is known as &#8220;<strong>The Com</strong>,&#8221; and it functions as a kind of distributed cybercriminal social network that facilitates instant collaboration.</p>
<p>But mostly, The Com is a place where cybercriminals go to boast about their exploits and standing within the community, or to knock others down a peg or two. Top Com members are constantly sniping over who pulled off the most impressive heists, or who has accumulated the biggest pile of stolen virtual currencies.</p>
<p>And as often as they extort victim companies for financial gain, members of The Com are constantly trying to wrest stolen money from their cybercriminal rivals &#8212; often in ways that spill over into <a href="https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/" target="_blank" rel="noopener">physical violence in the real world</a>.</p>
<p>CrowdStrike would go on to produce and <a href="https://www.crowdstrikeswag.com/Scattered-Spider-Figurine-P723.aspx" target="_blank" rel="noopener">sell Scattered Spider action figures</a>, and it featured <a href="https://twitter.com/vxunderground/status/1787661809547088194" target="_blank" rel="noopener">a life-sized Scattered Spider sculpture</a> at this year&#8217;s RSA Security Conference in San Francisco.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-68665" src="media/43edd921.scatteredspider-figure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/scatteredspider-figure.png" alt="" width="750" height="536" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/scatteredspider-figure.png 945w, https://krebsonsecurity.com/wp-content/uploads/2024/09/scatteredspider-figure-768x549.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/scatteredspider-figure-782x559.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/09/scatteredspider-figure-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>But marketing security products and services based on specific cybercriminal groups can be tricky, particularly if it turns out that robbing and extorting victims is by no means the most abhorrent activity those groups engage in on a daily basis.</p>
<p>KrebsOnSecurity examined the Telegram user ID number of the account that offered media interviews about the MGM hack &#8212; which corresponds to the screen name &#8220;<strong>@Holy&#8221;</strong> &#8212; and found the same account was used across a number of cybercrime channels that are entirely focused on extorting young people into harming themselves or others, and recording the harm on video.</p>
<p>In one post on a Telegram channel dedicated to youth extortion, this same user can be seen asking if anyone knows the current Telegram handles for several core members of 764, an extremist group known for victimizing children through coordinated online campaigns of extortion, doxing, swatting and harassment.</p>
<h2>HOLY NAZI</h2>
<p>Holy was known to possess multiple prized Telegram usernames, including @bomb, @halo, and @cute, as well as one of the highest-priced Telegram usernames ever put up for sale: <strong>@nazi</strong>. A source close to the investigation said @Holy also was a moderator on &#8220;<strong>Harm Nation</strong>,&#8221; an offshoot of 764.</p>
<p>People affiliated with harm groups like 764 will often recruit new members by lurking on gaming platforms, social media sites and mobile applications that are popular with young people, including <strong>Discord</strong>, <strong>Minecraft</strong>, <strong>Roblox</strong>, <strong>Steam</strong>, <strong>Telegram</strong>, and <strong>Twitch</strong>.</p>
<p>&#8220;This type of offence usually starts with a direct message through gaming platforms and can move to more private chatrooms on other virtual platforms, typically one with video enabled features, where the conversation quickly becomes sexualized or violent,&#8221; warns a <a href="https://www.rcmp-grc.gc.ca/en/news/2024/rcmp-reminds-canadians-violent-online-groups-targeting-youth" target="_blank" rel="noopener">recent alert</a> from the <strong>Royal Canadian Mounted Police</strong> (RCMP) about the rise of sextortion groups on social media channels.</p>
<p>&#8220;One of the tactics being used by these actors is sextortion, however, they are not using it to extract money or for sexual gratification,&#8221; the RCMP continued. &#8220;Instead they use it to further manipulate and control victims to produce more harmful and violent content as part of their ideological objectives and radicalization pathway.&#8221;</p>
<p>The 764 network is among the most populated harm communities, but there are plenty more. Some of the largest such known groups include <strong>CVLT</strong>, <strong>Court</strong>, <strong>Kaskar</strong>, <strong>Leak Society</strong>, <strong>7997</strong>, <strong>8884</strong>, <strong>2992</strong>, <strong>6996</strong>, <strong>555</strong>, <strong>Slit Town</strong>, <strong>545</strong>, <strong>404</strong>, <strong>NMK</strong>, <strong>303</strong>, and <strong>H3ll</strong>.</p>
<p>In March, a consortium of reporters from <em>Wired,</em> <em>Der Spiegel</em>, <em>Recorder</em> and <em>The Washington Post</em> examined millions of messages across more than 50 Discord and Telegram chat groups.</p>
<p>&#8220;The abuse perpetrated by members of com groups is extreme,&#8221; Wired&#8217;s <strong>Ali Winston</strong> <a href="https://www.wired.com/story/764-com-child-predator-network/" target="_blank" rel="noopener">wrote</a>. &#8220;They have coerced children into sexual abuse or self-harm, causing them to deeply lacerate their bodies to carve &#8216;cutsigns&#8217; of an abuser’s online alias into their skin.&#8221; The story continues:</p>
<blockquote><p>&#8220;Victims have flushed their heads in toilets, attacked their siblings, killed their pets, and in some extreme instances, attempted or died by suicide. Court records from the United States and European nations reveal participants in this network have also been accused of robberies, in-person sexual abuse of minors, kidnapping, weapons violations, swatting, and murder.&#8221;</p>
<p>&#8220;Some members of the network extort children for sexual pleasure, some for power and control. Some do it merely for the kick that comes from manipulation. Others sell the explicit CSAM content produced by extortion on the dark web.&#8221;</p></blockquote>
<p>KrebsOnSecurity has learned Holy&#8217;s real name is <strong>Owen David Flowers</strong>, and that he is the previously unnamed 17-year-old who was <a href="https://www.westmidlands.police.uk/news/west-midlands/news/news/2024/july/walsall-teenager-arrested-in-joint-west-midlands-police-and-fbi-operation/" target="_blank" rel="noopener">arrested in July 2024</a> by the U.K.&#8217;s West Midlands Police as part of a joint investigation with the FBI into the MGM hack.</p>
<p>Early in their cybercriminal career (as a 15-year-old), @Holy went by the handle &#8220;<strong>Vsphere</strong>,&#8221; and was a proud member of the <strong>LAPSUS$</strong> cybercrime group. Throughout 2022, LAPSUS$ <a href="https://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/" target="_blank" rel="noopener">would hack and social engineer their way into some of the world&#8217;s biggest technology companies</a>, including <strong>EA Games,</strong> <strong>Microsoft</strong>, <strong>NVIDIA</strong>, <strong>Okta</strong>, <strong>Samsung</strong>, and <strong>T-Mobile</strong>.</p>
<h2>JUDISCHE/WAIFU</h2>
<p>Another timely example of the overlap between harm communities and top members of The Com can be found in a group of criminals who recently stole obscene amounts of customer records from users of the cloud data provider <strong>Snowflake</strong>.</p>
<p>At the end of 2023, malicious hackers figured out that many major companies have uploaded massive amounts of valuable and sensitive customer data to Snowflake servers, all the while protecting those Snowflake accounts with little more than a username and password (no multi-factor authentication required). The group then searched darknet markets for stolen Snowflake account credentials, and began raiding the data storage repositories used by some of the world&#8217;s largest corporations.</p>
<p>Among those that had data exposed in Snowflake was <strong>AT&amp;T</strong>, which <a href="https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/" target="_blank" rel="noopener">disclosed in July</a> that cybercriminals had stolen personal information and phone and text message records for roughly 110 million people &#8212; nearly all its customers.</p>
<p>A report on the extortion group from the incident response firm <strong>Mandiant</strong> notes that Snowflake victim companies were privately approached by the hackers, who demanded a ransom in exchange for a promise not to sell or leak the stolen data. All told, more than 160 organizations were extorted, including <strong>TicketMaster</strong>, <strong>Lending Tree</strong>, <strong>Advance Auto Parts</strong> and <strong>Neiman Marcus</strong>.</p>
<p>On May 2, 2024, a user by the name &#8220;<strong>Judische</strong>&#8221; claimed on the fraud-focused Telegram channel <strong>Star Chat</strong> that they had hacked <strong>Santander Bank</strong>, one of the first known Snowflake victims. Judische would repeat that claim in Star Chat on May 13 &#8212; the day before Santander publicly disclosed a data breach &#8212; and would periodically blurt out the names of other Snowflake victims before their data even went up for sale on the cybercrime forums.</p>
<p>A careful review of Judische&#8217;s account history and postings on Telegram shows this user is more widely known under the nickname &#8220;<strong>Waifu</strong>,&#8221; an early moniker that corresponds to one of the more accomplished SIM-swappers in The Com over the years.</p>
<p>In <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">a SIM-swapping attack</a>, the fraudsters will phish or purchase credentials for mobile phone company employees, and use those credentials to redirect a target&#8217;s mobile calls and text messages to a device the attackers control.</p>
<p>Several channels on Telegram maintain a frequently updated leaderboard of the 100 richest SIM-swappers, as well as the hacker handles associated with specific cybercrime groups (Waifu is ranked #24). That leaderboard has long included Waifu on a roster of hackers for a group that called itself &#8220;<strong>Beige</strong>.&#8221;</p>
<p>Beige members were implicated in two stories published here in 2020. The first was <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener">an August 2020 piece called Voice Phishers Targeting Corporate VPNs</a>, which warned that the COVID-19 epidemic had brought a wave of voice phishing or &#8220;vishing&#8221; attacks that targeted work-from-home employees via their mobile devices, and tricked many of those people into giving up credentials needed to access their employer&#8217;s network remotely.</p>
<p>Beige group members also have claimed credit for <a href="https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/" target="_blank" rel="noopener">a breach at the domain registrar GoDaddy</a>. In November 2020, intruders thought to be associated with the Beige Group tricked a GoDaddy employee into installing malicious software, and with that access they were able to redirect the web and email traffic for multiple cryptocurrency trading platforms.</p>
<p>The Telegram channels that Judische and his related accounts frequented over the years show this user divides their time between posting in SIM-swapping and cybercrime cashout channels, and harassing and stalking others in harm communities like Leak Society and Court.</p>
<p>Mandiant has attributed the Snowflake compromises to a group it calls “<strong>UNC5537</strong>,” with members based in North America and <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">Turkey</a>. KrebsOnSecurity has learned Judische is a 26-year-old software engineer in Ontario, Canada.</p>
<p>Sources close to the investigation into the Snowflake incident tell KrebsOnSecurity the UNC5537 member in Turkey is <strong>John Erin Binns</strong>, an elusive American man indicted by the <strong>U.S. Department of Justice</strong> (DOJ) for <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">a 2021 breach at T-Mobile</a> that exposed the personal information of at least 76.6 million customers.</p>
<p>Binns is currently in custody in a Turkish prison and fighting his extradition. Meanwhile, he has been suing almost every federal agency and agent that contributed investigative resources to his case.</p>
<p>In June 2024, a Mandiant employee <a href="https://archive.ph/dI52m#selection-1721.0-1721.339" target="_blank" rel="noopener">told Bloomberg</a> that UNC5537 members have made death threats against cybersecurity experts investigating the hackers, and that in one case the group used artificial intelligence to create fake nude photos of a researcher to harass them.<span id="more-68600"></span></p>
<h2>ViLE</h2>
<p>In June 2024, two American men <a href="https://www.justice.gov/usao-edny/pr/two-men-plead-guilty-computer-intrusion-and-aggravated-identity-theft-hacking-federal" target="_blank" rel="noopener">pleaded guilty</a> to hacking into a <strong>U.S. Drug Enforcement Agency</strong> (DEA) online portal that <a href="https://krebsonsecurity.com/2022/05/dea-investigating-breach-of-law-enforcement-data-portal/" target="_blank" rel="noopener">tapped into 16 different federal law enforcement databases</a>.  <strong>Sagar &#8220;Weep&#8221; Singh</strong>, a 20-year-old from Rhode Island, and <strong>Nicholas &#8220;Convict&#8221; Ceraolo</strong>, 25, of Queens, NY, were both active in SIM-swapping communities.</p>
<p>Singh and Ceraolo hacked into a number of foreign police department email accounts, and used them to make phony &#8220;<a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">emergency data requests</a>&#8221; to social media platforms seeking account information about specific users they were stalking. According to the government, in each case the men impersonating the foreign police departments told those platforms the request was urgent because the account holders had been trading in child pornography or engaging in child extortion.</p>
<p>Eventually, the two men formed part of a group of cybercriminals known to its members as “<strong>ViLE</strong>,” who specialize in obtaining personal information about third-party victims, which they then used to harass, threaten or extort the victims, a practice known as “doxing.”</p>
<p>The U.S. government says Singh and Ceraolo worked closely with a third man &#8212; referenced in the indictment as co-conspirator #1 or &#8220;CC-1&#8221; &#8212; to administer a doxing forum where victims could pay to have their personal information removed.</p>
<p>The government doesn&#8217;t name CC-1 or the doxing forum, but CC-1&#8217;s hacker handle is &#8220;<strong>Kayte</strong>&#8221; (a.k.a. &#8220;<strong>KT</strong>&#8220;) which corresponds to the nickname of a 23-year-old man who lives with his parents in Coffs Harbor, Australia. For several years (with <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener">a brief interruption</a>), KT has been the administrator of a truly vile doxing community known as the <strong>Doxbin</strong>.</p>
<div id="attachment_63060" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63060" decoding="async" loading="lazy" class=" wp-image-63060" src="media/a6c3c7ae.ViLE.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/ViLE.png" alt="" width="748" height="494" /><p id="caption-attachment-63060" class="wp-caption-text">A screenshot of the website for the cybercriminal group &#8220;ViLE.&#8221; Image: USDOJ.</p></div>
<p>People whose names and personal information appear on the Doxbin can quickly find themselves the target of extended harassment campaigns, account hacking, SIM-swapping and even <a href="https://krebsonsecurity.com/?s=swatting" target="_blank" rel="noopener"><strong>swatting</strong></a> &#8212; which involves falsely reporting a violent incident at a target&#8217;s address to trick local police into responding with potentially deadly force.</p>
<p>A handful of Com members targeted by federal authorities have gone so far as to perpetrate swatting, doxing, and other harassment against the same federal agents who are trying to unravel their alleged crimes. This has led some investigators working cases involving the Com to begin redacting their names from affidavits and indictments filed in federal court.</p>
<p>In January 2024, KrebsOnSecurity broke the news that prosecutors in Florida had <a href="https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/" target="_blank" rel="noopener">charged a 19-year-old alleged Scattered Spider member</a> named <strong>Noah Michael Urban</strong> with wire fraud and identity theft. That story recounted how Urban&#8217;s alleged hacker identities &#8220;<strong>King Bob</strong>&#8221; and &#8220;<strong>Sosa</strong>&#8221; inhabited a world in which rival cryptocurrency theft rings frequently settled disputes through so-called <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">&#8220;violence-as-a-service&#8221; offerings</a> &#8212; hiring strangers online to perpetrate firebombings, beatings and kidnappings against their rivals.</p>
<p>Urban&#8217;s indictment is currently sealed. But a copy of the document obtained by KrebsOnSecurity shows the name of the federal agent who testified to it has been blacked out.</p>
<div id="attachment_68663" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68663" decoding="async" loading="lazy" class=" wp-image-68663" src="media/4273d488.sosa-redact.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/sosa-redact.png" alt="" width="750" height="480" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/sosa-redact.png 899w, https://krebsonsecurity.com/wp-content/uploads/2024/09/sosa-redact-768x491.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/sosa-redact-782x500.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68663" class="wp-caption-text">The final page of Noah Michael Urban&#8217;s indictment shows the investigating agent redacted their name from charging documents.</p></div>
<h2>HACKING RINGS, STALKING VICTIMS</h2>
<p>In June 2022, this blog told the story of two men charged with <a href="https://krebsonsecurity.com/2022/12/hacked-ring-cams-used-to-record-swatting-victims/" target="_blank" rel="noopener">hacking into the Ring home security cameras</a> of a dozen random people and then methodically swatting each of them. Adding insult to injury, the men used the compromised security cameras to record live footage of local police swarming those homes.</p>
<div id="attachment_62212" style="width: 260px" class="wp-caption alignright"><img aria-describedby="caption-attachment-62212" decoding="async" loading="lazy" class=" wp-image-62212" src="media/a3da20c9.JTAMcCarty-Mugshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/JTAMcCarty-Mugshot.png" alt="" width="250" height="307" /><p id="caption-attachment-62212" class="wp-caption-text">McCarty, in a mugshot.</p></div>
<p><strong>James Thomas Andrew McCarty</strong>, Charlotte, N.C., and <strong>Kya Christian Nelson</strong>, of Racine, Wisc., conspired to hack into <strong>Yahoo</strong> email accounts belonging to victims in the United States. The two would check how many of those Yahoo accounts were associated with Ring accounts, and then target people who used the same password for both accounts.</p>
<p>The <strong>Telegram</strong> and <strong>Discord</strong> aliases allegedly used by McCarty — “<strong>Aspertaine</strong>” and “<strong>Couch</strong>,” among others — correspond to an identity that was active in certain channels dedicated to SIM-swapping.</p>
<p>What KrebsOnSecurity didn&#8217;t report at the time is that both ChumLul and Aspertaine were active members of CVLT, wherein those identities clearly participated in harassing and exploiting young teens online.</p>
<p>In June 2024, McCarty was sentenced to seven years in prison after pleading guilty to making hoax calls that elicited police SWAT responses. Nelson also pleaded guilty and received a seven-year prison sentence.</p>
<h2>POMPOMPURIN</h2>
<p>In March 2023, U.S. federal agents in New York announced they&#8217;d arrested &#8220;<strong>Pompompurin</strong>,&#8221; <a href="https://krebsonsecurity.com/2023/03/feds-charge-ny-man-as-breachforums-boss-pompompurin/" target="_blank" rel="noopener">the alleged administrator of Breachforums</a>, an English-language cybercrime forum where hacked corporate databases frequently appear for sale. In cases where the victim organization isn&#8217;t extorted in advance by hackers, being listed on Breachforums has often been the way many victims first learned of an intrusion.</p>
<p>Pompompurin had been a nemesis to the FBI for several years. In November 2021, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/" target="_blank" rel="noopener">thousands of fake emails about a cybercrime investigation were blasted out from the FBI’s email systems and Internet addresses</a>.</p>
<p>Pompompurin took credit for that stunt, and said he was able to send the FBI email blast by exploiting a flaw in an FBI portal designed to share information with state and local law enforcement authorities. The FBI later acknowledged that a software misconfiguration allowed someone to send the fake emails.</p>
<p>In December, 2022, KrebsOnSecurity detailed how <a href="https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/" target="_blank" rel="noopener">hackers active on BreachForums had infiltrated the FBI’s InfraGard program</a>, a vetted network designed to build cyber and physical threat information sharing partnerships with experts in the private sector. The hackers impersonated the CEO of a major financial company, applied for InfraGard membership in the CEO’s name, and were granted admission to the community.</p>
<p>The feds named Pompompurin as 21-year-old Peekskill resident <strong>Conor Brian Fitzpatrick</strong>, who was originally charged with one count of conspiracy to solicit individuals to sell unauthorized access devices (stolen usernames and passwords). But after FBI agents raided and searched the home where Fitzpatrick lived with his parents, prosecutors tacked on charges for possession of child pornography.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-68703" src="media/8f324d45.pompom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/pompom.png" alt="" width="756" height="568" /></p>
<h2>DOMESTIC TERRORISM?</h2>
<p>Recent actions by the DOJ indicate the government is well aware of the significant overlap between leading members of The Com and harm communities. But the government also is growing more sensitive to the criticism that it can often take months or years to gather enough evidence to criminally charge some of these suspects, during which time the perpetrators can abuse and recruit countless new victims.</p>
<p>Late last year, however, the DOJ signaled a new tactic in pursuing leaders of harm communities like 764: Charging them with domestic terrorism.</p>
<p>In December 2023, the government <a href="media/543bf014.gov.uscourts.hid.167961.1.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.hid.167961/gov.uscourts.hid.167961.1.0.pdf" target="_blank" rel="noopener">charged</a> (PDF) a Hawaiian man with possessing and sharing sexually explicit videos and images of prepubescent children being abused. Prosecutors <a href="https://www.justice.gov/usao-hi/pr/hilo-man-arrested-child-pornography-violation" target="_blank" rel="noopener">allege</a> <strong>Kalana Limkin</strong>, 18, of Hilo, Hawaii, admitted he was an associate of CVLT and 764, and that he was the founder of a splinter harm group called <strong>Cultist</strong>. Limkin&#8217;s Telegram profile shows he also was active on the harm community Slit Town.</p>
<p>The relevant citation from Limkin&#8217;s complaint reads:</p>
<blockquote><p>&#8220;Members of the group &#8216;764&#8217; have conspired and continue to conspire in both online and in-person venues to engage in violent actions in furtherance of a Racially Motivated Violent Extremist ideology, wholly or in part through activities that violate federal criminal law meeting the statutory definition of Domestic Terrorism, defined in Title 18, United States Code, § 2331.&#8221;</p></blockquote>
<p>Experts say charging harm groups under <a href="https://www.law.cornell.edu/uscode/text/18/2331" target="_blank" rel="noopener">anti-terrorism statutes</a> potentially gives the government access to more expedient investigative powers than it would normally have in a run-of-the-mill criminal hacking case.</p>
<p>&#8220;What it ultimately gets you is additional tools you can use in the investigation, possibly warrants and things like that,&#8221; said <strong>Mark Rasch</strong>, a former U.S. federal cybercrime prosecutor and now general counsel for the New York-based cybersecurity firm <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit 221B</a>. &#8220;It can also get you additional remedies at the end of the case, like greater sanctions, more jail time, fines and forfeiture.&#8221;</p>
<p>But Rasch said this tactic can backfire on prosecutors who overplay their hand and go after someone who ends up challenging the charges in court.</p>
<p>&#8220;If you&#8217;re going to charge a hacker or pedophile with a crime like terrorism, that&#8217;s going to make it harder to get a conviction,&#8221; Rasch said. &#8220;It adds to the prosecutorial burden and increases the likelihood of getting an acquittal.&#8221;</p>
<p>Rasch said it&#8217;s unclear where it is appropriate to draw the line in the use of terrorism statutes to disrupt harm groups online, noting that there certainly are circumstances where individuals can commit violations of domestic anti-terrorism statutes through their Internet activity alone.</p>
<p>&#8220;The Internet is a platform like any other, where virtually any kind of crime that can be committed in the real world can also be committed online,&#8221; he said. &#8220;That doesn&#8217;t mean all misuse of computers fits within the statutory definition of terrorism.&#8221;</p>
<p>The RCMP&#8217;s <a href="https://www.rcmp-grc.gc.ca/en/news/2024/rcmp-reminds-canadians-violent-online-groups-targeting-youth" target="_blank" rel="noopener">warning on sexual extortion of minors over the Internet</a> lists a number of potential warning signs that teens may exhibit if they become immeshed in these harm groups. The FBI <a href="https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/sextortion/financially-motivated-sextortion" target="_blank" rel="noopener">urges</a> anyone who believes their child or someone they know is being exploited to contact their local FBI field office, call 1-800-CALL-FBI, or report it online at <a href="https://tips.fbi.gov" target="_blank" rel="noopener">tips.fbi.gov.</a></p>


feed_id: https://krebsonsecurity.com/?p=68604
title: Scam ‘Funeral Streaming’ Groups Thrive on Facebook
uri: Scam-Funeral-Streaming-Groups-Thrive-on-Facebook
url: https://krebsonsecurity.com/2024/09/scam-funeral-streaming-groups-thrive-on-facebook/
content:
<p>Scammers are flooding <strong>Facebook</strong> with groups that purport to offer video streaming of funeral services for the recently deceased. Friends and family who follow the links for the streaming services are then asked to cough up their credit card information. Recently, these scammers have branched out into offering fake streaming services for nearly any kind of event advertised on Facebook. Here&#8217;s a closer look at the size of this scheme, and some findings about who may be responsible.</p>
<div id="attachment_68781" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68781" decoding="async" class=" wp-image-68781" src="media/fbf1a5b5.fakebookfuneral.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/fakebookfuneral.png" alt="" width="749" height="545" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/fakebookfuneral.png 1239w, https://krebsonsecurity.com/wp-content/uploads/2024/09/fakebookfuneral-768x558.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/fakebookfuneral-782x569.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-68781" class="wp-caption-text">One of the many scam funeral group pages on Facebook. Clicking to view the &#8220;live stream&#8221; of the funeral takes one to a newly registered website that requests credit card information.</p></div>
<p>KrebsOnSecurity recently heard from a reader named George who said a friend had just passed away, and he noticed that a Facebook group had been created in that friend&#8217;s memory. The page listed the correct time and date of the funeral service, which it claimed could be streamed over the Internet by following a link that led to a page requesting credit card information.</p>
<p>&#8220;After I posted about the site, a buddy of mine indicated [the same thing] happened to her when her friend passed away two weeks ago,&#8221; George said.</p>
<p>Searching Facebook/Meta for a few simple keywords like &#8220;funeral&#8221; and &#8220;stream&#8221; reveals countless funeral group pages on Facebook, some of them for services in the past and others erected for an upcoming funeral.</p>
<p>All of these groups include images of the deceased as their profile photo, and seek to funnel users to a handful of newly-registered video streaming websites that require a credit card payment before one can continue. Even more galling, some of these pages request donations in the name of the deceased.</p>
<p>It&#8217;s not clear how many Facebook users fall for this scam, but it&#8217;s worth noting that many of these fake funeral groups attract subscribers from at least some of the deceased&#8217;s followers, suggesting those users have subscribed to the groups in anticipation of the service being streamed. It&#8217;s also unclear how many people end up missing a friend or loved one&#8217;s funeral because they mistakenly thought it was being streamed online.</p>
<div id="attachment_68812" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68812" decoding="async" loading="lazy" class=" wp-image-68812" src="media/fcb2f2e7.vortexvibe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/vortexvibe.png" alt="" width="749" height="545" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/vortexvibe.png 1239w, https://krebsonsecurity.com/wp-content/uploads/2024/09/vortexvibe-768x558.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/vortexvibe-782x569.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-68812" class="wp-caption-text">One of many look-alike landing pages for video streaming services linked to scam Facebook funeral groups.</p></div>
<p>George said their friend&#8217;s funeral service page on Facebook included a link to the supposed live-streamed service at <strong>livestreamnow[.]xyz</strong>, a domain registered in November 2023.</p>
<p>According to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a>, the organization that registered this domain is called &#8220;<strong>apkdownloadweb</strong>,&#8221; is based in Rajshahi, Bangladesh, and uses the DNS servers of a Web hosting company in Bangladesh called <strong>webhostbd[.]net</strong>.</p>
<p>A search on &#8220;apkdownloadweb&#8221; in DomainTools shows three domains registered to this entity, including <strong>live24sports[.]xyz</strong> and <strong>onlinestreaming[.]xyz</strong>. Both of those domains also used webhostbd[.]net for DNS. Apkdownloadweb has <a href="https://www.facebook.com/apkdownloadweb/?paipv=0&amp;eav=AfZR8fNrOqm6A-vmGfCkVTafTNaCEU_fcg0bwO2N-93FU5Rcqzuw2K9taQ7yfU9srjU&amp;_rdr" target="_blank" rel="noopener">a Facebook page</a>, which shows a number of &#8220;live video&#8221; teasers for sports events that have already happened, and says its domain is <strong>apkdownloadweb[.]com</strong>.</p>
<p>Livestreamnow[.]xyz is currently hosted at a Bangladeshi web hosting provider named <strong>cloudswebserver[.]com</strong>, but historical DNS records show this website also used DNS servers from webhostbd[.]net.</p>
<p>The Internet address of livestreamnow[.]xyz is <strong>148.251.54.196</strong>, at the hosting giant Hetzner in Germany. DomainTools shows this same Internet address is home to <a href="https://krebsonsecurity.com/wp-content/uploads/2024/09/148-251-54-196-pdns.csv" target="_blank" rel="noopener">nearly 6,000 other domains</a> (.CSV), including hundreds that reference video streaming terms, like <strong>watchliveon24[.]com</strong> and <strong>foxsportsplus[.]com</strong>.</p>
<p>There are thousands of domains at this IP address that include or end in the letters &#8220;<strong>bd</strong>,&#8221; the country code top-level domain for Bangladesh. Although many domains correspond to websites for electronics stores or blogs about IT topics, just as many contain a fair amount of placeholder content (think &#8220;lorem ipsum&#8221; text on the &#8220;contact&#8221; page). In other words, the sites appear legitimate at first glance, but upon closer inspection it is clear they are not currently used by active businesses.</p>
<p>The passive DNS records for 148.251.54.196 show a surprising number of results that are basically two domain names mushed together. For example, there is <strong>watchliveon24[.]com.playehq4ks[.]com</strong>, which displays links to multiple funeral service streaming groups on Facebook.</p>
<p><img decoding="async" loading="lazy" class=" wp-image-68772 aligncenter" src="media/3904cf4f.watchliveontv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/watchliveontv.png" alt="" width="746" height="835" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/watchliveontv.png 805w, https://krebsonsecurity.com/wp-content/uploads/2024/09/watchliveontv-768x860.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/watchliveontv-782x875.png 782w" sizes="(max-width: 746px) 100vw, 746px" /></p>
<p>Another combined domain on the same Internet address &#8212; livestreaming24[.]xyz.allsportslivenow[.]com &#8212; lists dozens of links to Facebook groups for funerals, but also for virtually all types of events that are announced or posted about by Facebook users, including graduations, concerts, award ceremonies, weddings, and rodeos.</p>
<p>Even community events promoted by state and local police departments on Facebook are fair game for these scammers. A Facebook page maintained by the police force in Plympton, Mass. for a town social event this summer called <a href="https://www.facebook.com/story.php/?story_fbid=817825613867240&amp;id=100069194260186" target="_blank" rel="noopener">Plympton Night Out</a> was quickly made into two different Facebook groups that informed visitors they could stream the festivities at either <strong>espnstreamlive[.]co</strong> or <strong>skysports[.]live</strong>.<span id="more-68604"></span></p>
<h2>WHO&#8217;S BEHIND THE FAKEBOOK FUNERALS?</h2>
<p>Recall that the registrant of livestreamnow[.]xyz &#8212; the bogus streaming site linked in the Facebook group for George&#8217;s late friend &#8212; was an organization called &#8220;Apkdownloadweb.&#8221; That entity&#8217;s domain &#8212; <strong>apkdownloadweb[.]com</strong> &#8212; is registered to a <a href="https://www.linkedin.com/in/mazidul-islam-274174205/" target="_blank" rel="noopener"><strong>Mazidul Islam</strong></a> in Rajshahi, Bangladesh (this domain is also using Webhostbd[.]net DNS servers).</p>
<p>Mazidul Islam&#8217;s LinkedIn page says he is the organizer of a now defunct IT blog called gadgetsbiz[.]com, which DomainTools finds was registered to a <strong>Mehedi Hasan</strong> from Rajshahi, Bangladesh.</p>
<p>To bring this full circle, DomainTools finds the domain name for the DNS provider on all of the above-mentioned sites  &#8212; webhostbd[.]net &#8212; was originally registered to a <strong>Md Mehedi</strong>, and to the email address <strong>webhostbd.net@gmail.com </strong>(&#8220;MD&#8221; is a common abbreviation for Muhammad/Mohammod/Muhammed).</p>
<p>A search on that email address at Constella finds a breached record from the data broker Apollo.io saying its owner&#8217;s full name is <strong>Mohammod Mehedi Hasan. </strong>Unfortunately, this is not a particularly unique name in that region of the world.</p>
<p>But as luck would have it, sometime last year the administrator of apkdownloadweb[.]com managed to infect their Windows PC with password-stealing malware. We know this because the raw logs of data stolen from this administrator&#8217;s PC were indexed by the breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> [full disclosure: As of this month, Constella is an advertiser on this website].</p>
<p>These so-called &#8220;stealer logs&#8221; are mostly generated by opportunistic infections from information-stealing trojans that are sold on cybercrime markets. A typical set of logs for a compromised PC will include any usernames and passwords stored in any browser on the system, as well as a list of recent URLs visited and files downloaded.</p>
<p>Malware purveyors will often deploy infostealer malware by bundling it with &#8220;cracked&#8221; or pirated software titles. Indeed, the stealer logs for the administrator of apkdownloadweb[.]com show this user&#8217;s PC became infected immediately after they downloaded a booby-trapped mobile application development toolkit.</p>
<p>Those stolen credentials indicate Apkdownloadweb[.]com is maintained by a 20-something native of Dhaka, Bangladesh named <a href="https://www.facebook.com/xiahusam/" target="_blank" rel="noopener"><strong>Mohammod Abdullah Khondokar</strong></a>.</p>
<p>The &#8220;browser history&#8221; folder from the admin of Apkdownloadweb shows Khondokar recently left a comment on the Facebook page of <a href="https://www.facebook.com/profile.php?id=100071400887497" target="_blank" rel="noopener">Mohammod Mehedi Hasan</a>, and Khondokar&#8217;s Facebook profile says the two are friends.</p>
<p>Neither MD Hasan nor MD Abdullah Khondokar responded to requests for comment. KrebsOnSecurity also sought comment from Meta.</p>


feed_id: https://krebsonsecurity.com/?p=68849
title: This Windows PowerShell Phish Has Scary Potential
uri: This-Windows-PowerShell-Phish-Has-Scary-Potential
url: https://krebsonsecurity.com/2024/09/this-windows-powershell-phish-has-scary-potential/
content:
<p>Many<strong> GitHub</strong> users this week received a novel phishing email warning of critical security holes in their code. Those who clicked the link for details were asked to distinguish themselves from bots by pressing a combination of keyboard keys that causes <strong>Microsoft Windows</strong> to download password-stealing malware. While it&#8217;s unlikely that many programmers fell for this scam, it&#8217;s notable because less targeted versions of it are likely to be far more successful against the average Windows user.</p>
<p>A reader named Chris shared an email he received this week that spoofed GitHub&#8217;s security team and warned: &#8220;Hey there! We have detected a security vulnerability in your repository. Please contact us at https://github-scanner[.]com to get more information on how to fix this issue.&#8221;</p>
<p><img decoding="async" class="aligncenter size-full wp-image-68857" src="media/a2dbcc00.powerphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/powerphish.png" alt="" width="681" height="330" /></p>
<p>Visiting that link generates a web page that asks the visitor to &#8220;Verify You Are Human&#8221; by solving an unusual CAPTCHA.</p>
<div id="attachment_68856" style="width: 793px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68856" decoding="async" loading="lazy" class="size-full wp-image-68856" src="media/d7825dbd.verifyhuman.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/verifyhuman.png" alt="" width="783" height="397" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/verifyhuman.png 783w, https://krebsonsecurity.com/wp-content/uploads/2024/09/verifyhuman-768x389.png 768w" sizes="(max-width: 783px) 100vw, 783px" /><p id="caption-attachment-68856" class="wp-caption-text">This malware attack pretends to be a CAPTCHA intended to separate humans from bots.</p></div>
<p>Clicking the &#8220;I&#8217;m not a robot&#8221; button generates a pop-up message asking the user to take three sequential steps to prove their humanity. Step 1 involves simultaneously pressing the keyboard key with the Windows icon and the letter &#8220;R,&#8221; which opens a Windows &#8220;Run&#8221; prompt that will execute any specified program that is already installed on the system.</p>
<div id="attachment_68855" style="width: 1204px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68855" decoding="async" loading="lazy" class="size-full wp-image-68855" src="media/bea7ff3f.githubscanner.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/githubscanner.png" alt="" width="1194" height="679" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/githubscanner.png 1194w, https://krebsonsecurity.com/wp-content/uploads/2024/09/githubscanner-768x437.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/githubscanner-782x445.png 782w" sizes="(max-width: 1194px) 100vw, 1194px" /><p id="caption-attachment-68855" class="wp-caption-text">Executing this series of keypresses prompts the built-in Windows Powershell to download password-stealing malware.</p></div>
<p>Step 2 asks the user to press the &#8220;CTRL&#8221; key and the letter &#8220;V&#8221; at the same time, which pastes malicious code from the site&#8217;s virtual clipboard.</p>
<p>Step 3 &#8212; pressing the &#8220;Enter&#8221; key &#8212; causes Windows to launch a <strong>PowerShell</strong> command, and then fetch and execute a malicious file from github-scanner[.]com called &#8220;<strong>l6e.exe</strong>.&#8221;<span id="more-68849"></span></p>
<p>PowerShell is a powerful, cross-platform automation tool built into Windows that is designed to make it simpler for administrators to automate tasks on a PC or across multiple computers on the same network.</p>
<p>According to <a href="https://www.virustotal.com/gui/file/d737637ee5f121d11a6f3295bf0d51b06218812b5ec04fe9ea484921e905a207/details" target="_blank" rel="noopener">an analysis</a> at the malware scanning service <strong>Virustotal.com</strong>, the malicious file downloaded by the pasted text is called <strong>Lumma Stealer</strong>, and it&#8217;s designed to snarf any credentials stored on the victim&#8217;s PC.</p>
<p>This phishing campaign may not have fooled many programmers, who no doubt natively understand that pressing the Windows and &#8220;R&#8221; keys will open up a &#8220;Run&#8221; prompt, or that Ctrl-V will dump the contents of the clipboard.</p>
<p>But I bet the same approach would work just fine to trick some of my less tech-savvy friends and relatives into running malware on their PCs. I&#8217;d also bet none of these people have ever heard of PowerShell, let alone had occasion to intentionally launch a PowerShell terminal.</p>
<p>Given those realities, it would be nice if there were a simple way to disable or at least heavily restrict PowerShell for normal end users for whom it could become more of a liability.</p>
<p>However, Microsoft strongly advises against nixing PowerShell because some core system processes and tasks may not function properly without it. What&#8217;s more, doing so requires tinkering with sensitive settings in the Windows registry, which can be a dicey undertaking even for the learned.</p>
<p>Still, it wouldn&#8217;t hurt to share this article with the Windows users in your life who fit the less-savvy profile. Because this particular scam has a great deal of room for growth and creativity.</p>


feed_id: https://krebsonsecurity.com/?p=68943
title: Timeshare Owner? The Mexican Drug Cartels Want You
uri: Timeshare-Owner-The-Mexican-Drug-Cartels-Want-You
url: https://krebsonsecurity.com/2024/09/timeshare-owner-the-mexican-drug-cartels-want-you/
content:
<p>The FBI is warning timeshare owners to be wary of a prevalent telemarketing scam involving a violent Mexican drug cartel that tries to trick people into believing someone wants to buy their property. This is the story of a couple who recently lost more than $50,000 to an ongoing timeshare scam that spans at least two dozen phony escrow, title and realty firms.</p>
<div id="attachment_68950" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68950" decoding="async" class=" wp-image-68950" src="media/dd677247.realestateassets-llc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc.png" alt="" width="751" height="405" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc.png 2330w, https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc-768x414.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc-1536x828.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc-2048x1104.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc-782x422.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/09/realestateassets-llc-370x200.png 370w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-68950" class="wp-caption-text">One of the phony real estate companies trying to scam people out of money over fake offers to buy their timeshares.</p></div>
<p>One evening in late 2022, someone phoned <strong>Mr. &amp; Mrs. Dimitruk</strong>, a retired couple from Ontario, Canada and asked whether they&#8217;d ever considered selling their timeshare in Florida. The person on the phone referenced their timeshare address and said they had an interested buyer in Mexico. Would they possibly be interested in selling it?</p>
<p>The Dimitruks had purchased the timeshare years ago, but it wasn&#8217;t fully paid off &#8212; they still owed roughly $5,000 before they could legally sell it. That wouldn&#8217;t be an issue for this buyer, the man on the phone assured them.</p>
<p>With a few days, their contact at a escrow company in New York called <strong>ecurrencyescrow[.]llc</strong> faxed them forms to fill out and send back to start the process of selling their timeshare to the potential buyer, who had offered an amount that was above what the property was likely worth.</p>
<p>After certain forms were signed and faxed, the Dimitruks were asked to send a small wire transfer of more than $3,000 to handle &#8220;administrative&#8221; and &#8220;processing&#8221; fees, supposedly so that the sale would not be held up by any bureaucratic red tape down in Mexico.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-68948" src="media/d477f744.ecurrencyesc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/ecurrencyesc.png" alt="" width="749" height="751" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/ecurrencyesc.png 1410w, https://krebsonsecurity.com/wp-content/uploads/2024/09/ecurrencyesc-768x770.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/ecurrencyesc-782x784.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>These document exchanges went on for almost a year, during which time the real estate brokers made additional financial demands, such as tax payments on the sale, and various administrative fees. Mrs. Dimitruk even sent them a $5,000 wire to pay off her remaining balance on the timeshare they thought they were selling.</p>
<p>In a phone interview with KrebsOnSecurity, Mr. Dimitruk said they lost over $50,000.</p>
<p>&#8220;They kept calling me after that saying, &#8216;Hey your money is waiting for you here&#8217;,&#8221; said <strong>William Dimitruk</strong>, a 73-year-old retired long-haul truck driver. &#8220;They said &#8216;We&#8217;re going to get in trouble if the money isn&#8217;t returned to you,&#8217; and gave me a toll-free number to call them at.&#8221;</p>
<p>In the last call he had with the scammers, the man on the other end of the line confessed that some bad people had worked for them previously, but that those employees had been fired.</p>
<p>&#8220;Near the end of the call he said, &#8216;You&#8217;ve been dealing with some bad people and we fired all those bad guys,'&#8221; Dimitruk recalled. &#8220;So they were like, yeah it&#8217;s all good. You can go ahead and pay us more and we&#8217;ll send you your money.&#8221;</p>
<p>According to the FBI, there are indeed some very bad people behind these scams. The FBI warns the timeshare fraud schemes have been linked to the <strong>Jalisco New Generation drug cartel</strong> in Mexico.</p>
<p>In July 2024, the FBI and the Treasury Department&#8217;s <strong>Financial Crimes Enforcement Network</strong> (FinCEN) <a href="https://www.fincen.gov/news/news-releases/fincen-ofac-and-fbi-joint-notice-timeshare-fraud-associated-mexico-based" target="_blank" rel="noopener">warned</a> the Jalisco cartel is running boiler room-like call centers that target people who own timeshares:</p>
<blockquote><p>&#8220;Mexico-based [transnational criminal organizations] such as the Jalisco New Generation Cartel are increasingly targeting U.S. owners of timeshares in Mexico through complex and often yearslong telemarketing, impersonation, and advance fee schemes. They use the illicit proceeds to diversify their revenue streams and finance other criminal activities, including the manufacturing and trafficking of illicit fentanyl and other synthetic drugs into the United States.&#8221;</p></blockquote>
<p>A <a href="https://www.cbsnews.com/news/us-sanctions-cartel-accountants-timeshare-scams-target-americans/" target="_blank" rel="noopener">July 2024 CBS News story</a> about these scams notes that U.S. and Mexican officials last year confirmed that as many as eight young workers were confirmed dead after they apparently tried to quit jobs at a call center operated by the Jalisco cartel.</p>
<div id="attachment_68958" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68958" decoding="async" loading="lazy" class=" wp-image-68958" src="media/b3daf238.jaliscocartel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/jaliscocartel.png" alt="" width="750" height="580" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/jaliscocartel.png 788w, https://krebsonsecurity.com/wp-content/uploads/2024/09/jaliscocartel-768x594.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/jaliscocartel-782x604.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68958" class="wp-caption-text">Source: US Department of the Treasury&#8217;s Office of Foreign Assets Control.</p></div>
<p>The phony escrow company the Dimitruks dealt with &#8212; <strong>ecurrencyescrow[.]llc</strong> &#8212; is no longer online. But the documents sent by their contact there referenced a few other still-active domains, including <strong>realestateassetsllc[.]com</strong></p>
<p>The original registration records of both of these domains reference another domain &#8212; <strong>datasur[.]host</strong> &#8212; that is associated with dozens of other real estate and escrow-themed domains going back at least four years. Some of these domains are no longer active, while others have been previously suspended at different hosting providers. <span id="more-68943"></span></p>
<p>061nyr[.]net<br />
061-newyorkrealty[.]net<br />
1nydevelopersgroupllc[.]com<br />
1oceanrealtyllc[.]com<br />
advancedclosingservicesllc[.]com<br />
americancorporatetitle[.]com<br />
asesorialegalsiglo[.]com<br />
atencion-tributaria.[]com<br />
carolinasctinc[.]net<br />
closingandsettlementservices[.]com<br />
closingandsettlementsllc[.]com<br />
closingsettlementllc[.]com<br />
crefaescrowslimited[.]net<br />
ecurrencyescrow[.]llc<br />
empirerllc[.]com<br />
fiduciarocitibanamex[.]com<br />
fondosmx[.]org<br />
freightescrowcollc[.]com<br />
goldmansachs-investment[.]com<br />
hgvccorp[.]com<br />
infodivisionfinanciera[.]com<br />
internationaladvisorllc[.]com<br />
jadehillrealtyllc[.]com<br />
lewisandassociaterealty[.]com<br />
nyreputable[.]org<br />
privateinvestment.com[.]co<br />
realestateassetsllc[.]com<br />
realestateisinc[.]com<br />
settlementandmanagement[.]com<br />
stllcservices[.]com<br />
stllcservices[.]net<br />
thebluehorizonrealtyinc[.]com<br />
walshrealtyny[.]net<br />
windsorre[.]com</p>
<p>By loading ecurrencyescrowllc[.]com into <a href="https://web.archive.org/web/20230214194256/http://ecurrencyescrow.llc/" target="_blank" rel="noopener">the Wayback Machine at archive.org</a>, we can see text at the top of the page that reads, &#8220;Visit our resource library for videos and tools designed to make managing your escrow disbursements a breeze.&#8221;</p>
<p>Searching on that bit of text at <a href="https://publicwww.com" target="_blank" rel="noopener">publicwww.com</a> shows the same text appears on the website of an escrow company called <strong>Escshieldsecurity Network</strong> (escshieldsecurity[.]com). This entity claims to have been around since 2009, but the domain itself is less than two years old, and there is no contact information associated with the site. The Pennsylvania Secretary of State also has no record of a business by this name at its stated address.</p>
<p>Incredibly, Escshieldsecurity pitches itself as a solution to timeshare closing scams.</p>
<p>&#8220;By 2015, cyber thieves had realized the amount of funds involved and had targeted the real estate, title and settlement industry,&#8221; the company&#8217;s website states. &#8220;As funding became more complex and risky, agents and underwriters had little time or resources to keep up. The industry needed a simple solution that allowed it to keep pace with new funding security needs.&#8221;</p>
<p>The domains associated with this scam will often reference legitimate companies and licensed professionals in the real estate and closing businesses, but those real professionals often have no idea they&#8217;re being impersonated until someone starts asking around. The truth is, the original reader tip that caused KrebsOnSecurity to investigate this scheme came from one such professional whose name and reputation was being used to scam others.</p>
<p>It is unclear whether the Dimitruks were robbed by people working for the Jalisco cartel, but it is clear that whoever is responsible for managing many of the above-mentioned domains &#8212; including the DNS provider datasur[.]host &#8212; recently compromised their computer with information-stealing malware.</p>
<p>That&#8217;s according to data collected by the breach tracking service <a href="https://www.constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> [Constella is currently an advertiser on KrebsOnSecurity]. Constella found that someone using the email address exposed in the DNS records for datasur[.]host &#8212; jyanes1920@gmail.com &#8212; also was relieved of credentials for managing most of the domains referenced above at a Mexican hosting provider.</p>
<p>It&#8217;s not unusual for victims of such scams to keep mum about their misfortune. Sometimes, it&#8217;s shame and embarrassment that prevents victims from filing a report with the local authorities. But in this case, victims who learn they&#8217;ve been robbed by a violent drug cartel have even more reason to remain silent.</p>
<p>William Dimitruk acknowledged that he and his wife haven&#8217;t yet filed a police report. But after acknowledging it could help prevent harm to other would-be victims, Mr. Dimitruk said he would consider it.</p>
<p>There is another reason victims of scams like this should notify authorities: Occasionally, the feds will bust up one of these scam operations and seize funds that were stolen from victims. But those investigations can take years, and it can be even more years before the government starts trying to figure out who got scammed and how to remunerate victims. All too often, the real impediment to returning some of those losses is that the feds have no idea who the victims are.</p>
<p>If you are the victim of a timeshare scam like this, please consider filing a report with the FBI&#8217;s Internet Crime Complaint Center (IC3), at <a href="https://www.ic3.gov" target="_blank" rel="noopener">ic3.gov</a>. Other places where victims may wish to file a complaint:</p>
<p><strong>Federal Trade Commission – </strong><a href="https://www.ftccomplaintassistant.gov" target="_blank" rel="noopener noreferrer">https://www.ftccomplaintassistant.gov</a><br />
<strong>International Consumer Protection and Enforcement Network – </strong><a href="https://www.econsumer.gov/en/Home/FileAComplaint/1#crnt" target="_blank" rel="noopener noreferrer">https://www.econsumer.gov/en</a><br />
<strong>Profeco – Mexican Attorney General</strong> – <a href="https://consulmex.sre.gob.mx/montreal/index.php/en/foreigners/services-foreigners/318-consumer-protection">https://consulmex.sre.gob.mx/montreal/index.php/en/foreigners/services-foreigners/318-consumer-protection</a></p>


feed_id: https://krebsonsecurity.com/?p=68817
title: U.S. Indicts 2 Top Russian Hackers, Sanctions Cryptex
uri: U-S-Indicts-2-Top-Russian-Hackers-Sanctions-Cryptex
url: https://krebsonsecurity.com/2024/09/u-s-indicts-2-top-russian-hackers-sanctions-cryptex/
content:
<p>The United States today unveiled sanctions and indictments against the alleged proprietor of <strong>Joker&#8217;s Stash</strong>, a now-defunct cybercrime store that peddled tens of millions of payment cards stolen in some of the largest data breaches of the past decade. The government also indicted and sanctioned a top Russian cybercriminal known as <strong>Taleon</strong>, whose cryptocurrency exchange <strong>Cryptex</strong> has evolved into one of Russia&#8217;s most active money laundering networks.</p>
<div id="attachment_34287" style="width: 675px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-34287" decoding="async" class=" wp-image-34287" src="media/145eceb8.jstash-domains-580x505.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/03/jstash-domains-580x505.png" alt="" width="665" height="579" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/03/jstash-domains-580x505.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/03/jstash-domains.png 716w" sizes="(max-width: 665px) 100vw, 665px" /><p id="caption-attachment-34287" class="wp-caption-text">A 2016 screen shot of the Joker&#8217;s Stash homepage. The links have been redacted.</p></div>
<p>The <strong>U.S. Department of Justice</strong> (DOJ) today unsealed an indictment against a 38-year-old man from Novosibirsk, Russia for allegedly operating Joker&#8217;s Stash, an extremely successful carding shop that <a href="https://krebsonsecurity.com/2016/03/carders-park-piles-of-cash-at-jokers-stash/" target="_blank" rel="noopener">came online in late 2014</a>. Joker&#8217;s sold cards stolen in a steady drip of breaches at U.S. retailers, including <a href="https://www.nbcnews.com/news/us-news/data-breach-saks-lord-taylor-compromises-customer-payment-data-n861856" target="_blank" rel="noopener">Saks Fifth Avenue, Lord and Taylor</a>, <a href="http://krebsonsecurity.com/2014/12/bebe-stores-confirms-credit-card-breach/" target="_blank" rel="noopener">Bebe Stores</a>, <a href="https://krebsonsecurity.com/2015/11/hilton-acknowledges-credit-card-breach/" target="_blank" rel="noopener">Hilton Hotels</a>, <a href="https://krebsonsecurity.com/2017/12/4-years-after-target-the-little-guy-is-the-target/" target="_blank" rel="noopener">Jason’s Deli</a>, <a href="https://www.cnbc.com/2017/09/28/whole-foods-suffers-data-breach-in-some-stores.html" target="_blank" rel="noopener">Whole Foods</a>, <a href="https://www.reuters.com/article/us-chipotle-cyber/chipotle-says-hackers-hit-most-restaurants-in-data-breach-idUSKBN18M2BY" target="_blank" rel="noopener">Chipotle</a>, <a href="https://krebsonsecurity.com/2020/01/wawa-breach-may-have-compromised-more-than-30-million-payment-cards/" target="_blank" rel="noopener">Wawa</a>, <a href="https://krebsonsecurity.com/2017/09/breach-at-sonic-drive-in-may-have-impacted-millions-of-credit-debit-cards/" target="_blank" rel="noopener">Sonic Drive-In</a>, the <a href="https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/" target="_blank" rel="noopener">Hy-Vee supermarket chain</a>, <a href="https://krebsonsecurity.com/2019/03/a-month-after-2-million-customer-cards-sold-online-buca-di-beppo-parent-admits-breach/" target="_blank" rel="noopener">Buca Di Beppo</a>, and <a href="https://krebsonsecurity.com/2020/10/breach-at-dickeys-bbq-smokes-3m-cards/" target="_blank" rel="noopener">Dickey’s BBQ</a>.</p>
<p>The government believes the brains behind Joker&#8217;s Stash is <strong>Timur Kamilevich Shakhmametov</strong>, an individual who is listed in Russian incorporation documents as <a href="https://play.google.com/store/apps/developer?id=ARPAPLUS&amp;hl=en_US" target="_blank" rel="noopener">the owner</a> of <strong>Arpa Plus</strong>, a Novosibirsk company that makes mobile games.</p>
<p>Early in his career (circa 2000) Shakhmametov was known as &#8220;<strong>v1pee</strong>&#8221; and was the founder of the Russian hacker group <a href="https://web.archive.org/web/20041207210236/http://nerf.ru/index.php?i=about" target="_blank" rel="noopener"><strong>nerf[.]ru</strong></a>, which periodically published hacking tools and exploits for software vulnerabilities.</p>
<div id="attachment_68900" style="width: 759px" class="wp-caption aligncenter"><a href="media/37c511f8.nerf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/nerf.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-68900" decoding="async" loading="lazy" class="wp-image-68900" src="media/37c511f8.nerf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/nerf.png" alt="" width="749" height="384" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/nerf.png 1643w, https://krebsonsecurity.com/wp-content/uploads/2024/09/nerf-768x394.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/nerf-1536x787.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/09/nerf-782x401.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-68900" class="wp-caption-text">The Russian hacker group Nerf as described in a March 2006 article in the Russian hacker magazine xakep.ru.</p></div>
<p>By 2004, v1pee had adopted the moniker &#8220;<strong>Vega</strong>&#8221; on the exclusive Russian language hacking forum <strong>Mazafaka</strong>, where this user became one of the more reliable vendors of stolen payment cards.</p>
<p>In the years that followed, Vega would cement his reputation as a top carder on other forums, including <strong>Verified</strong>, <strong>DirectConnection</strong>, and <strong>Carder[.]pro</strong>.</p>
<p>Vega also became known as someone who had the inside track on &#8220;<a href="https://krebsonsecurity.com/2018/08/fbi-warns-of-unlimited-atm-cashout-blitz/" target="_blank" rel="noopener">unlimited cashouts</a>,&#8221; a globally coordinated cybercrime scheme in which crooks hack a bank or payment card processor and use cloned cards at cash machines to rapidly withdraw millions of dollars in just a few hours.</p>
<p>&#8220;Hi, there is work on d+p, unlimited,&#8221; Vega wrote in a private message to another user on Verified in Dec. 2012, referring to &#8220;dumps and PINs,&#8221; the slang term for stolen debit cards with the corresponding PINs that would allow ATM withdrawals.</p>
<div id="attachment_40912" style="width: 753px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-40912" decoding="async" loading="lazy" class=" wp-image-40912" src="media/d381aac5.firetigerrr-580x581.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-580x581.png" alt="" width="743" height="744" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-580x581.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-150x150.png 150w, https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-768x770.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr.png 902w" sizes="(max-width: 743px) 100vw, 743px" /><p id="caption-attachment-40912" class="wp-caption-text">This batch of some five million cards put up for sale Sept. 26, 2017 on the now-defunct carding site Joker&#8217;s Stash has been tied to a breach at Sonic Drive-In.</p></div>
<p>Joker&#8217;s Stash came online in the wake of several enormous card breaches at retailers like <strong>Target</strong> and <strong>Home Depot</strong>, and the resulting glut of inventory had depressed prices for stolen cards. But Joker&#8217;s would distinguish itself by catering to high-roller customers &#8212; essentially street gangs in the United States that would purchase thousands of stolen payment cards in one go.</p>
<p>Faced with a buyer&#8217;s market, Joker&#8217;s Stash set themselves apart by focusing on loyalty programs, frequent buyer discounts, money-back guarantees, and just plain good customer service. Big spenders were given access to the most freshly hacked payment cards, and were offered the ability to get free replacement cards if any turned out to be duds.</p>
<p>Joker&#8217;s Stash also was unique because it claimed to sell only payment cards that its own hackers had stolen directly from merchants. At the time, card shops typically resold payment cards that were stolen and supplied by many third-party hackers of unknown reliability or reputation.</p>
<p>In January 2021, Joker&#8217;s Stash <a href="https://krebsonsecurity.com/2021/01/jokers-stash-carding-market-to-call-it-quits/" target="_blank" rel="noopener">announced it was closing up shop</a>, after European authorities seized a number of servers for the fraud store, and its proprietor came down with the Coronavirus.</p>
<p>Prosecutors allege Joker&#8217;s Stash earned revenues of at least $280 million, but possibly more than $1 billion (the broad range is a consequence of several variables, including the rapid fluctuation in the price of bitcoin and the stolen goods they were peddling).</p>
<h2>TALEON</h2>
<p>The proprietors of Joker&#8217;s Stash <a href="https://krebsonsecurity.com/?s=joker%27s+stash+breach" target="_blank" rel="noopener">may have sold tens of millions of stolen payment cards</a>, but Taleon is by far the bigger fish in this law enforcement action because his various cryptocurrency and cash exchanges have allegedly helped to move billions of dollars into and out of Russia over the past 20 years.</p>
<p>An indictment unsealed today names Taleon as <strong>Sergey Sergeevich Ivanov</strong>, 44, of Saint Petersburg, Russia. The government says Ivanov, who likely changed his surname from<strong> Omelnitskii </strong>at some point, laundered money for Joker&#8217;s Stash, among many other cybercrime stores.</p>
<p>In a statement today, the Treasury Department said Ivanov has laundered hundreds of millions of dollars’ worth of virtual currency for ransomware actors, initial access brokers, darknet marketplace vendors, and other criminal actors for approximately the last 20 years.</p>
<p>First appearing on Mazafaka in the early 2000s, Taleon was known on the forums as someone who could reliably move large amounts of physical cash. Sources familiar with the investigation said Taleon&#8217;s service emerged as one of the few remaining domestic cash delivery services still operating after Russia invaded Ukraine in Feb. 2022.</p>
<p>Taleon set up his service to facilitate transfers between Moscow, St. Petersburg and financial institutions in the West. Taleon&#8217;s private messages on some hacker forums have been leaked over the years and indexed by the cyber intelligence platform <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>. Those messages indicate Taleon worked on many of the same ATM cashouts as Vegas, so it&#8217;s clear the two had an established business relationship well before Joker&#8217;s Stash came into being.</p>
<p>Sometime around 2013, Taleon launched a partnership with a money transfer business called <strong>pm2btc[.]me</strong>. PM2BTC allowed customers to convert funds from the virtual currency <strong>Perfect Money</strong> (PM) into bitcoin, and then have the balance (minus a processing fee) available on a physical debit card that could be used at ATMs, for shopping online, or at retail stores.</p>
<div id="attachment_68928" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68928" decoding="async" loading="lazy" class=" wp-image-68928" src="media/41faba75.pm2btc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/pm2btc.png" alt="" width="750" height="240" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/pm2btc.png 974w, https://krebsonsecurity.com/wp-content/uploads/2024/09/pm2btc-768x246.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/pm2btc-782x250.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68928" class="wp-caption-text">A screenshot of a website reviewing PM2BTC.</p></div>
<p>The U.S. government itself set things in motion for Taleon&#8217;s nascent cryptocurrency exchange business in 2013 after the DOJ levied money laundering charges against the proprietors of <strong>Liberty Reserve</strong>, one of the largest virtual currencies in operation at the time.  Liberty Reserve was <a href="https://krebsonsecurity.com/?s=liberty+reserve" target="_blank" rel="noopener">heavily used by cybercriminals of all stripes</a>. The government said the service had more than a million users worldwide, and laundered in excess of $6 billion in suspected criminal proceeds.</p>
<p>In the days following the takedown of Liberty Reserve, KrebsOnSecurity <a href="https://krebsonsecurity.com/2013/05/underweb-payments-post-liberty-reserve/" target="_blank" rel="noopener">ran a story</a> that examined discussions across multiple top Russian cybercrime forums about where crooks could feel safe parking their stolen funds. The answer involved Bitcoin, but also Taleon&#8217;s new service.</p>
<h2>UAPS</h2>
<p>Part of the appeal of Taleon&#8217;s exchange was that it gave its vetted customers an &#8220;<strong>application programming interface</strong>&#8221; or <strong>API</strong> that made it simple for dodgy online shops selling stolen goods and cybercrime services to accept cryptocurrency deposits from their customers, and to manage payouts to any suppliers and affiliates.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-68912" src="media/c0e895ae.uapsso.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/uapsso.png" alt="" width="1787" height="841" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/uapsso.png 1787w, https://krebsonsecurity.com/wp-content/uploads/2024/09/uapsso-768x361.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/uapsso-1536x723.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/09/uapsso-782x368.png 782w" sizes="(max-width: 1787px) 100vw, 1787px" /></p>
<p>This API is synonymous with a service Taleon and friends operate in the background called <strong>UAPS</strong>, short for &#8220;<strong>Universal Anonymous Payment System</strong>.&#8221; UAPS has gone by several other names including &#8220;<a href="media/b3c0448d.bcpinpays-782x458.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/bcpinpays-782x458.png" target="_blank" rel="noopener"><strong>Pinpays</strong></a>,&#8221; and in October 2014 it landed Joker&#8217;s Stash as its first big client.</p>
<p>A source with knowledge of the investigation told KrebsOnSecurity that Taleon is a pilot who owns and flies around in his own helicopter.</p>
<p>Ivanov appears to have little to no social media presence, but the 40-year-old woman he lives with in St. Petersburg does, and she has a photo on her Vktontake page that shows the two of them in 2019 flying over Lake Ladoga, a large body of water directly north of St. Petersburg.</p>
<div id="attachment_68897" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68897" decoding="async" loading="lazy" class=" wp-image-68897" src="media/465eccbd.tale-heli.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/tale-heli.png" alt="" width="750" height="593" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/tale-heli.png 1043w, https://krebsonsecurity.com/wp-content/uploads/2024/09/tale-heli-768x607.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/tale-heli-782x619.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68897" class="wp-caption-text">Sergey &#8220;Taleon&#8221; Ivanov (right) in 2019 in his helicopter with the woman he lives with, flying over a lake north of St. Petersburg, Russia.</p></div>
<p><span id="more-68817"></span></p>
<h2>BRIANS CLUB</h2>
<p>In late 2015, a major competitor to Joker&#8217;s Stash emerged using UAPS for its back-end payments: <strong>BriansClub. </strong>BriansClub sullies this author&#8217;s name, photos and reputation to peddle millions of credit and debit cards stolen from merchants in the United States and around the world.</p>
<div id="attachment_49240" style="width: 946px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49240" decoding="async" loading="lazy" class="size-full wp-image-49240" src="media/5981cd16.briansdump.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/10/briansdump.gif" alt="" width="936" height="60" /><p id="caption-attachment-49240" class="wp-caption-text">An ad for BriansClub has been using my name and likeness for years to peddle millions of stolen credit cards.</p></div>
<p>In 2019, someone hacked BriansClub and <a href="https://krebsonsecurity.com/2019/10/takeaways-from-the-566m-briansclub-breach/" target="_blank" rel="noopener">relieved the fraud shop of more than 26 million stolen payment cards</a> &#8212; an estimated one-third of the 87 million payment card accounts that were on sale across all underground shops at that time. An anonymous source shared that card data with KrebsOnSecurity, which ultimately shared it with a consortium of financial institutions that issued most of the cards.</p>
<p>After that incident, the administrator of BriansClub changed the site&#8217;s login page so that it featured a copy of my phone bill, Social Security card, and a link to my full credit report [to this day, random cybercriminals <a href="https://krebsonsecurity.com/2021/08/phishing-sites-targeting-scammers-and-thieves/" target="_blank" rel="noopener">confuse Yours Truly with the proprietor of BriansClub</a>].</p>
<p><strong>Alex Holden</strong> is founder of the Milwaukee-based cybersecurity firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>. Holden has long maintained visibility into cryptocurrency transactions made by BriansClub.</p>
<p>Holden said those records show BriansClub sells tens of thousands of dollars worth of stolen credit cards every day, and that in the last two years alone the <em>BriansClub administrator has removed</em> <em>more than $242 million worth of cryptocurrency revenue from the UAPS platform</em>.</p>
<div id="attachment_59646" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59646" decoding="async" loading="lazy" class="wp-image-59646" src="media/ee2a2e5c.briansclubpart.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/briansclubpart.png" alt="" width="749" height="489" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/briansclubpart.png 1133w, https://krebsonsecurity.com/wp-content/uploads/2022/04/briansclubpart-768x501.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/briansclubpart-782x510.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-59646" class="wp-caption-text">The BriansClub login page, as it looked from late 2019 until recently.</p></div>
<p>Passive domain name system (DNS) records show that in its early days BriansClub shared a server in Lithuania along with just a handful of other domains, including <strong>secure.pinpays[.]com</strong>, the crime forum Verified, and a slew of carding shops operating under the banner <strong>Rescator</strong>.</p>
<p>As KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">detailed in December 2023</a>, the Rescator shops were directly involved in some of the largest payment card breaches of the past decade. Those include <a href="https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" target="_blank" rel="noopener">the 2013 breach at <strong>Target</strong></a> and the <a href="https://krebsonsecurity.com/2014/09/banks-credit-card-breach-at-home-depot/" target="_blank" rel="noopener">2014 breach at <strong>Home Depot</strong></a>, intrusions that exposed more than 100 million payment card records.</p>
<h2>CRYPTEX</h2>
<p>In early 2018, Taleon and the proprietors of UAPS launched a cryptocurrency exchange called <strong>Cryptex[.]net</strong> that has emerged as a major mover of ill-gotten crypto coins.</p>
<div id="attachment_68904" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68904" decoding="async" loading="lazy" class=" wp-image-68904" src="media/1eb609e7.taleon-cryptex.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/taleon-cryptex.png" alt="" width="748" height="568" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/taleon-cryptex.png 1011w, https://krebsonsecurity.com/wp-content/uploads/2024/09/taleon-cryptex-768x583.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/taleon-cryptex-782x593.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-68904" class="wp-caption-text">Taleon reminds UAPS customers they will enjoy 0% commission and no &#8220;know your customer&#8221; (KYC) requirements &#8220;on our exchange Cryptex.&#8221;</p></div>
<p>Cryptex has been associated with quite a few ransomware transactions, including the largest known ransomware payment to date. In February 2024, a Fortune 50 ransomware victim <a href="https://krebsonsecurity.com/2024/08/low-drama-dark-angels-reap-record-ransoms/" target="_blank" rel="noopener">paid a record $75 million ransom</a> to a Russian cybercrime group that calls themselves the <strong>Dark Angels</strong>. A source with knowledge of the investigation said an analysis of that payment shows roughly half of it was processed through Cryptex.</p>
<p>That source provided a screen shot of Cryptex&#8217;s sending and receiving exposure as viewed by <strong>Chainalysis</strong>, a company the U.S. government and many cryptocurrency exchanges rely on to flag transactions associated with suspected money laundering, ransomware payouts, or facilitating payments for darknet websites.</p>
<p>Chainalysis finds that Cryptex has received more than $1.6 billion since its inception, and that this amount is roughly equal to its sending exposure (although the total number of outflows is nearly half of the inflows).</p>
<p>The graphic indicates a great deal of money flowing into Cryptex &#8212; roughly a quarter of it &#8212; is <a href="https://krebsonsecurity.com/2021/08/phishing-sites-targeting-scammers-and-thieves/" target="_blank" rel="noopener">coming from bitcoin ATMs around the world</a>. Experts say most of those ATM inflows to Cryptex are bitcoin ATM cash deposits from customers of carding websites like BriansClub and Jokers Stash.</p>
<div id="attachment_68828" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68828" decoding="async" loading="lazy" class=" wp-image-68828" src="media/78951d9a.chainalysis-cryptex.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/chainalysis-cryptex.png" alt="" width="750" height="379" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/chainalysis-cryptex.png 1160w, https://krebsonsecurity.com/wp-content/uploads/2024/09/chainalysis-cryptex-768x388.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/chainalysis-cryptex-782x395.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-68828" class="wp-caption-text">A screenshot of Chainalysis&#8217;s summary of illicit activity on Cryptex since the exchange&#8217;s inception in 2018.</p></div>
<p>The indictments released today do not definitively connect Taleon to Cryptex. However, PM2BTC (which teamed up with Taleon to launch UAPS and Pinpays) and Cryptex <a href="https://home.treasury.gov/news/press-releases/jy2616" target="_blank" rel="noopener">have now been sanctioned</a> by the <strong>U.S. Department of the Treasury</strong>.</p>
<p>Treasury&#8217;s <strong>Financial Crimes Enforcement Network</strong> (FinCEN) levied sanctions today against PM2BTC under a powerful new &#8220;Section 9714&#8221; authority included in the <strong>Combating Russian Money Laundering Act</strong>, changes enacted in 2022 to make it easier to target financial entities involved in laundering money for Russia.</p>
<p>Treasury <a href="https://www.fincen.gov/news/news-releases/fincen-identifies-virtual-currency-exchange-bitzlato-primary-money-laundering" target="_blank" rel="noopener">first used this authority</a> last year against <strong>Bitzlato</strong>, a cryptocurrency exchange operating in Russia that became a <a href="https://www.chainalysis.com/blog/us-authorities-shut-down-high-risk-exchange-bitzlato/" target="_blank" rel="noopener">money laundering conduit for ransomware attackers and dark market dealers</a>.</p>
<h2>THE LAUNDROMAT</h2>
<p>An investigation into the corporate entities behind UAPS and Cryptex reveals an organization incorporated in 2012 in Scotland called <strong>Orbest Investments LP</strong>. Records from the United Kingdom&#8217;s business registry show the owners of Orbest Investments are two entities: <strong>CS Proxy Solutions CY</strong>, and <strong>RM Everton Ltd</strong>.</p>
<p>Public business records further reveal that CS Proxy Solutions and RM Everton are co-owners of <strong>Progate Solutions</strong>, a holding company that featured prominently in a June 2017 report from <a href="media/4f66e353.Offshore_In_The_UK_TIUK_June_2017.pdf" data-original-source="https://www.transparency.org.uk/sites/default/files/pdf/publications/Offshore_In_The_UK_TIUK_June_2017.pdf" target="_blank" rel="noopener">Bellingcat and Transparency International</a> (PDF) on money laundering networks tied to the Kremlin.</p>
<p>&#8220;Law enforcement agencies believe that the total amount laundered through this process could be as high as US$80 billion,&#8221; the joint report reads. &#8220;Although it is not clear where all of this money came from, investigators claim it includes significant amounts of money that were diverted from the Russian treasury and state contracts.&#8221;</p>
<p>Their story built on <a href="https://www.occrp.org/en/project/the-russian-laundromat-exposed/the-russian-laundromat-exposed" target="_blank" rel="noopener">reporting published earlier that year</a> by the <strong>Organized Crime and Corruption Project</strong> (OCCRP) and <strong><em>Novaya Gazeta</em></strong>, which found that at least US$20.8 billion was secretly moved out of Russia between 2010 and 2014 through a vast money laundering machine comprising over 5,000 legal entities known as &#8220;The Laundromat.&#8221;</p>
<div id="attachment_68891" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68891" decoding="async" loading="lazy" class="size-full wp-image-68891" src="media/decdbd35.occrp-laundromat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/occrp-laundromat.png" alt="" width="752" height="623" /><p id="caption-attachment-68891" class="wp-caption-text">Image: occrp.org</p></div>
<p>&#8220;Using company records, reporters tracked the names of some clients after executives refused to give them out,&#8221; the OCCRP report explains. &#8220;They found the heavy users of the scheme were rich and powerful Russians who had made their fortunes from dealing with the Russian state.&#8221;</p>
<p><strong>Rich Sanders</strong> is a blockchain analyst and investigator who advises the law enforcement and intelligence community. Sanders just returned from a three-week sojourn through Ukraine, traveling with Ukrainian soldiers while mapping out dodgy Russian crypto exchanges that are laundering money for narcotics networks operating in the region. Sanders said today&#8217;s sanctions by the Treasury Department will likely have an immediate impact on Cryptex and its customers.</p>
<p>&#8220;Whenever an entity is sanctioned, the implications on-chain are immense,&#8221; Sanders told KrebsOnSecurity. &#8220;Regardless of whether an exchange is actually compliant or just virtue signals it, it is the case across the board that exchanges will pay attention to these sanctions.&#8221;</p>
<p>&#8220;This action shows these payment processors for illicit platforms will get attention eventually,&#8221; Sanders continued. &#8220;Even if it took way too long in this case, Cryptex knew the majority of their volume was problematic, knew why it was problematic, and did it anyway. And this should be a wake up call for other exchanges that know full well that most of their volume is problematic.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=69011
title: Crooked Cops, Stolen Laptops & the Ghost of UGNazi
uri: Crooked-Cops-Stolen-Laptops-the-Ghost-of-UGNazi
url: https://krebsonsecurity.com/2024/09/crooked-cops-stolen-laptops-the-ghost-of-ugnazi/
content:
<p>A California man accused of failing to pay taxes on tens of millions of dollars allegedly earned from cybercrime also paid local police officers hundreds of thousands of dollars to help him extort, intimidate and silence rivals and former business partners, the government alleges. KrebsOnSecurity has learned that many of the man&#8217;s alleged targets were members of <strong>UGNazi</strong>, a hacker group behind multiple high-profile breaches and cyberattacks back in 2012.</p>
<div id="attachment_69018" style="width: 259px" class="wp-caption alignright"><img aria-describedby="caption-attachment-69018" decoding="async" class=" wp-image-69018" src="media/377563ed.iza-lasd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/iza-lasd.png" alt="" width="249" height="383" /><p id="caption-attachment-69018" class="wp-caption-text">A photo released by the government allegedly showing Iza posing with several LASD officers on his payroll.</p></div>
<p>A federal <a href="media/c04e3405.gov.uscourts.cacd.942083.1.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.cacd.942083/gov.uscourts.cacd.942083.1.0.pdf" target="_blank" rel="noopener">complaint</a> (PDF) filed last week said the <strong>Federal Bureau of Investigation</strong> (FBI) has been investigating Los Angeles resident <strong>Adam Iza</strong>. Also known as &#8220;<strong>Assad Faiq&#8221; </strong>and &#8220;<strong>The Godfather</strong>,&#8221; Iza is the 30-something founder of a cryptocurrency investment platform called <strong>Zort</strong> that advertised the ability to make smart trades based on artificial intelligence technology.</p>
<p>But the feds say investors in Zort soon lost their shorts, after Iza and his girlfriend began spending those investments on Lamborghinis, expensive jewelry, vacations, a $28 million home in Bel Air, even cosmetic surgery to extend the length of his legs.</p>
<p>The complaint states the FBI started looking at Iza after receiving multiple reports that he had on his payroll several active deputies with the <strong>Los Angeles Sheriff&#8217;s Department</strong> (LASD). Iza&#8217;s attorney did not immediately respond to requests for comment.</p>
<p>The complaint cites a letter from an attorney for a victim referenced only as &#8220;<strong>E.Z.</strong>,&#8221; who was seeking help related to an extortion and robbery allegedly committed by Iza. The government says that in March 2022, three men showed up at E.Z.&#8217;s home, and tried to steal his laptop in an effort to gain access to E.Z. cryptocurrency holdings online. A police report referenced in the complaint says three intruders were scared off when E.Z. fired several handgun rounds in the direction of his assailants.</p>
<p>The FBI later obtained a copy of a search warrant executed by LASD deputies in January 2022 for GPS location information on a phone belonging to E.Z., which shows an LASD deputy unlawfully added E.Z.&#8217;s mobile number to a list of those associated with an unrelated firearms investigation.</p>
<p>&#8220;Damn my guy actually filed the warrant,&#8221; Iza allegedly texted someone after the location warrant was entered. &#8220;That&#8217;s some serious shit to do for someone&#8230;.risking a 24 years career. I pay him 280k a month for complete resources. They&#8217;re active-duty.&#8221;</p>
<p>The FBI alleges LASD officers had on several previous occasions tried to kidnap and extort E.Z. at Iza&#8217;s behest. The complaint references a November 2021 incident wherein Iza and E.Z. were in a car together when Iza asked to stop and get snacks at a convenience store. While they were still standing next to the car, a van with several armed LASD deputies showed up and tried to force E.Z. to hand over his phone. E.Z. escaped unharmed, and alerted 911.</p>
<p>E.Z. appears to be short for <strong>Enzo Zelocchi</strong>, a self-described &#8220;<a href="https://www.instagram.com/enzozelocchi/" target="_blank" rel="noopener">actor</a>&#8221; who was featured in <a href="https://abc7.com/home-invasion-west-los-angeles-beverly-grove-armed-suspects/11692751/" target="_blank" rel="noopener">an ABC News story</a> about a home invasion in Los Angeles around that same time as the March 2022 home invasion, in which Zelocchi is quoted as saying at least two men tried to rob him at gunpoint (we&#8217;ll revisit Zelocchi&#8217;s acting credits in a moment).</p>
<div id="attachment_69025" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69025" decoding="async" loading="lazy" class="wp-image-69025" src="media/47c373c6.zelocchi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/zelocchi.png" alt="" width="745" height="365" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/zelocchi.png 796w, https://krebsonsecurity.com/wp-content/uploads/2024/09/zelocchi-768x376.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/zelocchi-782x383.png 782w" sizes="(max-width: 745px) 100vw, 745px" /><p id="caption-attachment-69025" class="wp-caption-text">One of many self portraits published on the Instagram account of Enzo Zelocchi.</p></div>
<p>The criminal complaint makes frequent references to a co-conspirator of Iza (&#8220;CC-1&#8221;) &#8212; his girlfriend at the time &#8212; who allegedly helped Iza run his businesses and spend the millions plunked down by Zort investors. We know what E.Z. stands for because Iza&#8217;s girlfriend then was a woman named <strong>Iris Au</strong>, and in November 2022 she <a href="https://www.tmz.com/2022/11/13/actor-enzo-zelocchi-sued-extortion-stolen-laptop-bitcoin-wallet-password/" target="_blank" rel="noopener">sued Zelocchi for allegedly stealing Iza&#8217;s laptop.</a></p>
<p>The complaint says Iza also harassed a man identified only as <strong>T.W</strong>., and refers to T.W. as one of two Americans currently incarcerated in the Philippines for murder. In December 2018, a then 21-year-old <strong>Troy Woody Jr.</strong> was arrested in Manilla after he was spotted dumping the body of his dead girlfriend <strong>Tomi Masters</strong> into a local river.</p>
<p>Woody is accused of murdering Masters with the help of his best friend and roommate at the time: <strong>Mir Islam</strong>, a.k.a. &#8220;<strong>JoshTheGod</strong>,&#8221; referred to in the Iza complaint as &#8220;M.I.&#8221; Islam and Woody were both core members of UGNazi, a hacker collective that sprang up in 2012 and claimed credit for hacking and attacking a number of high-profile websites.</p>
<p>In June 2016, Islam <a href="https://krebsonsecurity.com/2016/07/serial-swatter-stalker-and-doxer-mir-islam-gets-just-1-year-in-jail/" target="_blank" rel="noopener">was sentenced to a year in prison</a> for an impressive array of crimes, including stalking people online and posting their personal data on the Internet. Islam also pleaded guilty to reporting dozens of phony bomb threats and fake hostage situations at the homes of celebrities and public officials (Islam participated in <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">a swatting attack against this author in 2013</a>).</p>
<div id="attachment_46146" style="width: 756px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-46146" decoding="async" loading="lazy" class=" wp-image-46146" src="media/a0424334.troymir.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/troymir.jpg" alt="" width="746" height="546" /><p id="caption-attachment-46146" class="wp-caption-text">Troy Woody Jr. (left) and Mir Islam, are currently in prison in the Philippines for murder.</p></div>
<p>In December 2022, Troy Woody Jr. sued Iza, Zelocchi and Zort, <a href="media/943c5172.woodyvzort.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/woodyvzort.pdf" target="_blank" rel="noopener">alleging</a> (PDF) Iza and Zelocchi were involved in a 2018 home invasion at his residence, wherein Woody claimed his assailants stole laptops and phones containing <em>more than $200 million in cryptocurrencies</em>.</p>
<p>Woody&#8217;s complaint states that Masters also was present during his 2018 home invasion, as was another core UGNazi member: <strong>Eric &#8220;CosmoTheGod&#8221; Taylor</strong>. CosmoTheGod rocketed to Internet infamy in 2013 when he and a number of other hackers set up the Web site <a href="http://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank" rel="noopener">exposed[dot]su</a>, which published the address, Social Security numbers and other personal information of public figures, including the former <strong>First Lady Michelle Obama</strong>, the then-director of the FBI and the U.S. attorney general. The group also swatted many of the people they doxed.</p>
<div id="attachment_25473" style="width: 752px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-25473" decoding="async" loading="lazy" class=" wp-image-25473" src="media/7c9a9beb.exposed-su-600x462.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-600x462.png" alt="" width="742" height="572" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-600x462.png 600w, https://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-285x219.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su.png 1263w" sizes="(max-width: 742px) 100vw, 742px" /><p id="caption-attachment-25473" class="wp-caption-text">Exposed was built with the help of identity information obtained and/or stolen from ssndob dot ru.</p></div>
<p>In 2017, Taylor was <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank" rel="noopener">sentenced to three years probation</a> for participating in multiple swatting attacks, including the <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">one against my home in 2013</a>.</p>
<p>The complaint against Iza says the FBI interviewed Woody in Manilla where he is currently incarcerated, and learned that Iza has been harassing him about passwords that would unlock access to cryptocurrencies. The FBI&#8217;s complaint leaves open the question of how Woody and Islam got the phones in the first place, but the implication is that Iza may have instigated the harassment by having mobile phones smuggled to the prisoners.<span id="more-69011"></span></p>
<p>The government suggests its case against Iza was made possible in part thanks to Iza&#8217;s propensity for ripping off people who worked for him. The complaint cites information provided by a private investigator identified only as &#8220;K.C.,&#8221; who said Iza hired him to surveil Zelocchi but ultimately refused to pay him for much of the work.</p>
<p>K.C. stands for <strong>Kenneth Childs</strong>, who in 2022 <a href="media/07e4a509.kcvszort.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/kcvszort.pdf" target="_blank" rel="noopener">sued Iris Au and Zort</a> (PDF) for theft by deception and commercial disparagement, after it became clear his private eye services were being used as part of a scheme by the Zort founders to intimidate and extort others. Childs&#8217; complaint says Iza clawed back tens of thousands of dollars in payments he&#8217;d previously made as part of their contract.</p>
<p>The government also included evidence provided by an associate of Iza&#8217;s &#8212; named only as &#8220;R.C.&#8221; &#8212; who was hired to throw a party at Iza&#8217;s home. According to the feds, Iza paid the associate $50,000 to craft the event to his liking, but on the day of the party Iza allegedly told R.C. he was unhappy with the event and demanded half of his money back.</p>
<p>When R.C. balked, Iza allegedly surrounded the man with armed LASD officers, who then extracted the payment by seizing his phone. The government says Iza kept R.C.&#8217;s phone and spent the remainder of his bank balance.</p>
<div id="attachment_69026" style="width: 274px" class="wp-caption alignright"><img aria-describedby="caption-attachment-69026" decoding="async" loading="lazy" class=" wp-image-69026" src="media/ab8e0c14.drugarrest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/drugarrest.png" alt="" width="264" height="324" /><p id="caption-attachment-69026" class="wp-caption-text">A photo Iza allegedly sent to Tassilo Heinrich immediately after Heinrich&#8217;s arrest on unsubstantiated drug charges.</p></div>
<p>The FBI said that after the incident at the party, Iza had his bribed sheriff deputies pull R.C. over and arrest him on phony drug charges. The complaint includes a photo of R.C. being handcuffed by the police, which the feds say Iza sent to R.C. in order to intimidate him even further. The drug charges were later dismissed for lack of evidence.</p>
<p>The government alleges Iza and Au paid the LASD officers using Zelle transfers from accounts tied to two different entities incorporated by one or both of them: <strong>Dream Agency</strong> and <strong>Rise Agency</strong>. The complaint further alleges that these two entities were the beneficiaries of a business that sold hacked and phished <strong>Facebook</strong> advertising accounts, and bribed Facebook employees to unblock ads that violated its terms of service.</p>
<p>The complaint says Iza ran this business with another individual identified only as &#8220;<strong>T.H.</strong>,&#8221; and that at some point T.H. had personal problems and checked himself into rehab. T.H. told the FBI that Iza responded by stealing his laptop and turning him in to the government.</p>
<p>KrebsOnSecurity has learned that T.H. in this case is <strong>Tassilo Heinrich</strong>, a man <a href="https://techcrunch.com/2021/04/05/shopify-breach-hacker-indicted/" target="_blank" rel="noopener">indicted in 2022</a> for hacking into the e-commerce platform <strong>Shopify</strong>, and leaking the user database for <strong>Ledger</strong>, a company that makes hardware wallets for storing cryptocurrencies.</p>
<p>Heinrich pleaded guilty and was sentenced to time served, three years of supervised release, and ordered to pay restitution to Shopify. Upon his release from custody, Heinrich told the FBI that Iza was still using his account at the public screenshot service Gyazo to document communications regarding his alleged bribing of LASD officers.</p>
<p>Prosecutors say Iza and Au portrayed themselves as glamorous and wealthy individuals who were successful social media influencers, but that most of that was a carefully crafted facade designed to attract investment from cryptocurrency enthusiasts. Meanwhile, the U.K. tabloids <a href="https://www.thesun.co.uk/tv/28183222/davide-sanclimenti-mystery-woman-american-crypto-investor-mum-influencer/" target="_blank" rel="noopener">reported</a> this summer that Au was dating <strong>Davide Sanclimenti</strong>, the 2022 co-winner on the dating reality show <a href="https://en.wikipedia.org/wiki/Love_Island_(American_TV_series)" target="_blank" rel="noopener">Love Island.</a></p>
<div id="attachment_69032" style="width: 482px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69032" decoding="async" loading="lazy" class="wp-image-69032 size-full" src="media/6c8d6c9e.womenpreneur-me.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/womenpreneur-me.png" alt="" width="472" height="592" /><p id="caption-attachment-69032" class="wp-caption-text">Au was featured on the July 2024 cover of &#8220;Womenpreneur Middle East.&#8221;</p></div>
<p>Recall that we promised to revisit Mr. Zelocchi&#8217;s claimed acting credits. Despite being briefly listed on the <strong>Internet Movie Data Base</strong> (imdb.com) as the most awarded science fiction actor of all time, it&#8217;s not clear whether Mr. Zelocchi has starred in any real movies.</p>
<p>Earlier this year, an Internet sleuth on Youtube <a href="https://www.youtube.com/watch?v=_HxucXDEdFo" target="_blank" rel="noopener">showed</a> that even though Zelocchi&#8217;s IMDB profile has him earning more awards than most other actors on the platform (<a href="https://www.instagram.com/p/C-WbnP7IoNF/?img_index=1" target="_blank" rel="noopener">here he is</a> holding a Youtube top viewership award), Zelocchi is probably better known as the director of the movie once rated the absolute worst sci-fi flick on IMDB: A 2015 work called &#8220;Angel&#8217;s Apocalypse.&#8221; Most of the videos on Zelocchi&#8217;s Instagram page appear to be brief clips, some of which look more like a commercial for men&#8217;s cologne than scenes from a real movie.</p>
<div id="attachment_69027" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69027" decoding="async" loading="lazy" class=" wp-image-69027" src="media/77030f3c.wth-angels.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/09/wth-angels.png" alt="" width="754" height="340" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/09/wth-angels.png 1120w, https://krebsonsecurity.com/wp-content/uploads/2024/09/wth-angels-768x346.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/09/wth-angels-782x353.png 782w" sizes="(max-width: 754px) 100vw, 754px" /><p id="caption-attachment-69027" class="wp-caption-text">A Reddit post from a year ago calling attention to Zelocchi&#8217;s sci-fi film Angel&#8217;s Apocalypse somehow earning more audience votes than any other movie in the same genre.</p></div>
<p>In many ways, the crimes described in this complaint and the various related civil lawsuits would prefigure a disturbing new trend within English-speaking cybercrime communities that has bubbled up in the past few years: The emergence of <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">&#8220;violence-as-as-service&#8221; offerings</a> that allow cybercriminals to anonymously extort and intimidate their rivals.</p>
<p>Found on certain Telegram channels are solicitations for IRL or &#8220;In Real Life&#8221; jobs, wherein people hire themselves out as willing to commit a variety of physical attacks in their local geographic area, such as slashing tires, firebombing a home, or tossing a brick through someone&#8217;s window.</p>
<p>Many of the cybercriminals in this community have stolen tens of millions of dollars worth of cryptocurrency, and can easily afford to bribe police officers. KrebsOnSecurity would expect to see more of this in the future as young, crypto-rich cybercriminals seek to corrupt people in authority to their advantage.</p>


feed_id: https://krebsonsecurity.com/?p=68998
title: A Single Cloud Compromise Can Feed an Army of AI Sex Bots
uri: A-Single-Cloud-Compromise-Can-Feed-an-Army-of-AI-Sex-Bots
url: https://krebsonsecurity.com/2024/10/a-single-cloud-compromise-can-feed-an-army-of-ai-sex-bots/
content:
<p>Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services. Researchers say these illicit chat bots, which use custom jailbreaks to bypass content filtering, often veer into darker role-playing scenarios, including child sexual exploitation and rape.</p>
<div id="attachment_69091" style="width: 747px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69091" decoding="async" class=" wp-image-69091" src="media/cf8bb0c9.bedrock.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/bedrock.png" alt="" width="737" height="488" /><p id="caption-attachment-69091" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>Researchers at security firm <strong>Permiso Security</strong> say attacks against generative artificial intelligence (AI) infrastructure like <strong>Bedrock</strong> from Amazon Web Services (AWS) have increased markedly over the last six months, particularly when someone in the organization accidentally exposes their cloud credentials or key online, such as in a code repository like <strong>GitHub</strong>.</p>
<p>Investigating the abuse of AWS accounts for several organizations, Permiso found attackers had seized on stolen AWS credentials to interact with the <strong>large language models</strong> (LLMs) available on Bedrock. But they also soon discovered none of these AWS users had enabled logging (it is off by default), and thus they lacked any visibility into what attackers were doing with that access.</p>
<p>So Permiso researchers decided to leak their own test AWS key on GitHub, while turning on logging so that they could see exactly what an attacker might ask for, and what the responses might be.</p>
<p>Within minutes, their bait key was scooped up and used to power a service that offers AI-powered sex chats online.</p>
<p>&#8220;After reviewing the prompts and responses it became clear that the attacker was hosting an AI roleplaying service that leverages common jailbreak techniques to get the models to accept and respond with content that would normally be blocked,&#8221; Permiso researchers wrote in <a href="https://permiso.io/blog/exploiting-hosted-models" target="_blank" rel="noopener">a report released today</a>.</p>
<p>&#8220;Almost all of the roleplaying was of a sexual nature, with some of the content straying into darker topics such as child sexual abuse,&#8221; they continued. &#8220;Over the course of two days we saw over 75,000 successful model invocations, almost all of a sexual nature.&#8221;</p>
<p><strong>Ian Ahl</strong>, senior vice president of threat research at Permiso, said attackers in possession of a working cloud account traditionally have used that access for run-of-the-mill financial cybercrime, such as cryptocurrency mining or spam. But over the past six months, Ahl said, Bedrock has emerged as one of the top targeted cloud services.</p>
<p>&#8220;Bad guy hosts a chat service, and subscribers pay them money,&#8221; Ahl said of the business model for commandeering Bedrock access to power sex chat bots. &#8220;They don&#8217;t want to pay for all the prompting that their subscribers are doing, so instead they hijack someone else&#8217;s infrastructure.&#8221;</p>
<p>Ahl said much of the AI-powered chat conversations initiated by the users of their honeypot AWS key were harmless roleplaying of sexual behavior.</p>
<p>&#8220;But a percentage of it is also geared toward very illegal stuff, like child sexual assault fantasies and rapes being played out,&#8221; Ahl said. &#8220;And these are typically things the large language models won&#8217;t be able to talk about.&#8221;</p>
<p>AWS&#8217;s Bedrock uses large language models from <strong>Anthropic</strong>, which incorporates a number of technical restrictions aimed at placing certain ethical guardrails on the use of their LLMs. But attackers can evade or &#8220;jailbreak&#8221; their way out of these restricted settings, usually by asking the AI to imagine itself in an elaborate hypothetical situation under which its normal restrictions might be relaxed or discarded altogether.</p>
<p>&#8220;A typical jailbreak will pose a very specific scenario, like you&#8217;re a writer who&#8217;s doing research for a book, and everyone involved is a consenting adult, even though they often end up chatting about nonconsensual things,&#8221; Ahl said.</p>
<p>In June 2024, security experts at <strong>Sysdig</strong> <a href="https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/" target="_blank" rel="noopener">documented a new attack</a> that leveraged stolen cloud credentials to target ten cloud-hosted LLMs. The attackers Sysdig wrote about gathered cloud credentials through a known security vulnerability, but the researchers also found the attackers sold LLM access to other cybercriminals while sticking the cloud account owner with an astronomical bill.</p>
<p>&#8220;Once initial access was obtained, they exfiltrated cloud credentials and gained access to the cloud environment, where they attempted to access local LLM models hosted by cloud providers: in this instance, a local Claude (v2/v3) LLM model from Anthropic was targeted,&#8221; Sysdig researchers wrote. &#8220;If undiscovered, this type of attack could result in over $46,000 of LLM consumption costs per day for the victim.&#8221;<span id="more-68998"></span></p>
<p>Ahl said it&#8217;s not certain who is responsible for operating and selling these sex chat services, but Permiso suspects the activity may be tied to a platform cheekily named &#8220;<strong>chub[.]ai</strong>,&#8221; which offers a broad selection of pre-made AI characters with whom users can strike up a conversation. Permiso said almost every character name from the prompts they captured in their honeypot could be found at Chub.</p>
<div id="attachment_69090" style="width: 758px" class="wp-caption aligncenter"><a href="media/4ed2f1df.chubai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/chubai.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69090" decoding="async" loading="lazy" class="wp-image-69090 " src="media/4ed2f1df.chubai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/chubai.png" alt="" width="748" height="265" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/chubai.png 1521w, https://krebsonsecurity.com/wp-content/uploads/2024/10/chubai-768x272.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/chubai-782x277.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-69090" class="wp-caption-text">Some of the AI chat bot characters offered by Chub. Some of these characters include the tags &#8220;rape&#8221; and &#8220;incest.&#8221;</p></div>
<p>Chub offers free registration, via its website or a mobile app. But after a few minutes of chatting with their newfound AI friends, users are asked to purchase a subscription. The site&#8217;s homepage features a banner at the top that strongly suggests the service is reselling access to existing cloud accounts. It reads: &#8220;Banned from OpenAI? Get unmetered access to uncensored alternatives for as little as $5 a month.&#8221;</p>
<p>Until late last week Chub offered a wide selection of characters in a category called &#8220;<strong>NSFL</strong>&#8221; or Not Safe for Life, a term meant to describe content that is disturbing or nauseating to the point of being emotionally scarring.</p>
<p><em>Fortune</em> profiled Chub AI in <a href="https://finance.yahoo.com/news/meta-openai-spawned-wave-ai-140000660.html?guccounter=1" target="_blank" rel="noopener">a January 2024 story</a> that described the service as a virtual brothel advertised by illustrated girls in spaghetti strap dresses who promise a chat-based &#8220;world without feminism,&#8221; where &#8220;girls offer sexual services.&#8221; From that piece:</p>
<blockquote><p>Chub AI offers more than 500 such scenarios, and a growing number of other sites are enabling similar AI-powered child pornographic role-play. They are part of a broader uncensored AI economy that, according to Fortune’s interviews with 18 AI developers and founders, was spurred first by OpenAI and then accelerated by Meta’s release of its open-source Llama tool.</p></blockquote>
<p>Fortune says Chub is run by someone using the handle &#8220;<strong>Lore</strong>,&#8221; who said they launched the service to help others evade content restrictions on AI platforms. Chub charges fees starting at $5 a month to use the new chatbots, and the founder told Fortune the site had generated more than $1 million in annualized revenue.</p>
<p>KrebsOnSecurity sought comment about Permiso&#8217;s research from AWS, which initially seemed to downplay the seriousness of the researchers&#8217; findings. The company noted that AWS employs automated systems that will alert customers if their credentials or keys are found exposed online.</p>
<p>AWS explained that when a key or credential pair is flagged as exposed, it is then restricted to limit the amount of abuse that attackers can potentially commit with that access. For example, flagged credentials can&#8217;t be used to create or modify authorized accounts, or spin up new cloud resources.</p>
<p>Ahl said Permiso did indeed receive multiple alerts from AWS about their exposed key, including one that warned their account may have been used by an unauthorized party. But they said the restrictions AWS placed on the exposed key did nothing to stop the attackers from using it to abuse Bedrock services.</p>
<p>Sometime in the past few days, however, AWS responded by including Bedrock in the list of services that will be quarantined in the event an AWS key or credential pair is found compromised or exposed online. AWS confirmed that Bedrock was a new addition to its quarantine procedures.</p>
<p>Additionally, not long after KrebsOnSecurity began reporting this story, Chub&#8217;s website removed its NSFL section. It also appears to have removed cached copies of the site from the Wayback Machine at archive.org. Still, Permiso found that Chub&#8217;s user stats page shows the site has more than 3,000 AI conversation bots with the NSFL tag, and that 2,113 accounts were following the NSFL tag.</p>
<div id="attachment_69088" style="width: 758px" class="wp-caption aligncenter"><a href="media/8dcaf371.chub-nsfl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/chub-nsfl.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69088" decoding="async" loading="lazy" class="wp-image-69088" src="media/8dcaf371.chub-nsfl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/chub-nsfl.png" alt="" width="748" height="250" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/chub-nsfl.png 1718w, https://krebsonsecurity.com/wp-content/uploads/2024/10/chub-nsfl-768x256.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/chub-nsfl-1536x512.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/10/chub-nsfl-782x261.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-69088" class="wp-caption-text">The user stats page at Chub shows more than 2,113 people have subscribed to its AI conversation bots with the &#8220;Not Safe for Life&#8221; designation.</p></div>
<p>Permiso said their entire two-day experiment generated a $3,500 bill from AWS. Some of that cost was tied to the 75,000 LLM invocations caused by the sex chat service that hijacked their key. But they said the remaining cost was a result of turning on LLM prompt logging, which is not on by default and can get expensive very quickly.</p>
<p>Which may explain why none of Permiso&#8217;s clients had that type of logging enabled. Paradoxically, Permiso found that while enabling these logs is the only way to know for sure how crooks might be using a stolen key, the cybercriminals who are reselling stolen or exposed AWS credentials for sex chats have started including programmatic checks in their code to ensure they aren&#8217;t using AWS keys that have prompt logging enabled.</p>
<p>&#8220;Enabling logging is actually a deterrent to these attackers because they are immediately checking to see if you have logging on,&#8221; Ahl said. &#8220;At least some of these guys will totally ignore those accounts, because they don&#8217;t want anyone to see what they&#8217;re doing.&#8221;</p>
<p>In a statement shared with KrebsOnSecurity, AWS said its services are operating securely, as designed, and that no customer action is needed. Here is their statement:</p>
<blockquote><p>&#8220;AWS services are operating securely, as designed, and no customer action is needed. The researchers devised a testing scenario that deliberately disregarded security best practices to test what may happen in a very specific scenario. No customers were put at risk. To carry out this research, security researchers ignored fundamental security best practices and publicly shared an access key on the internet to observe what would happen.&#8221;</p>
<p>&#8220;AWS, nonetheless, quickly and automatically identified the exposure and notified the researchers, who opted not to take action. We then identified suspected compromised activity and took additional action to further restrict the account, which stopped this abuse. We recommend customers follow security best practices, such as protecting their access keys and avoiding the use of long-term keys to the extent possible. We thank Permiso Security for engaging AWS Security.&#8221;</p></blockquote>
<p>AWS said customers can configure <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" target="_blank" rel="noopener">model invocation logging</a> to collect Bedrock invocation logs, model input data, and model output data for all invocations in the AWS account used in Amazon Bedrock. Customers can also use <a href="https://docs.aws.amazon.com/bedrock/latest/userguide/logging-using-cloudtrail.html" target="_blank" rel="noopener">CloudTrail to monitor Amazon Bedrock API calls</a>.</p>
<p>The company said AWS customers also can use services such as GuardDuty to detect potential security concerns and <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/monitor_estimated_charges_with_cloudwatch.html" target="_blank" rel="noopener">Billing Alarms</a> to provide notifications of abnormal billing activity. Finally, <a href="https://aws.amazon.com/aws-cost-management/aws-cost-explorer/" target="_blank" rel="noopener">AWS Cost Explorer</a> is intended to give customers a way to visualize and manage Bedrock costs and usage over time.</p>
<p>Anthropic told KrebsOnSecurity it is always working on novel techniques to make its models more resistant to jailbreaks.</p>
<p>&#8220;We remain committed to implementing strict policies and advanced techniques to protect users, as well as publishing our own research so that other AI developers can learn from it,&#8221; Anthropic said in an emailed statement. &#8220;We appreciate the research community&#8217;s efforts in highlighting potential vulnerabilities.&#8221;</p>
<p>Anthropic said it uses feedback from child safety experts at <a href="https://www.thorn.org/" target="_blank" rel="noopener">Thorn</a> around signals often seen in child grooming to update its classifiers, enhance its usage policies, fine tune its models, and incorporate those signals into testing of future models.</p>


feed_id: https://krebsonsecurity.com/?p=69126
title: Patch Tuesday, October 2024 Edition
uri: Patch-Tuesday-October-2024-Edition
url: https://krebsonsecurity.com/2024/10/patch-tuesday-october-2024-edition/
content:
<p><strong>Microsoft</strong> today released security updates to fix at least 117 security holes in <strong>Windows</strong> computers and other software, including two vulnerabilities that are already seeing active attacks. Also, <strong>Adobe</strong> plugged 52 security holes across a range of products, and <strong>Apple</strong> has addressed a bug in its new <strong>macOS 15</strong> &#8220;<strong>Sequoia</strong>&#8221; update that broke many cybersecurity tools.</p>
<p><img decoding="async" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="702" height="515" /></p>
<p>One of the zero-day flaws &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43573" target="_blank" rel="noopener">CVE-2024-43573</a> &#8212; stems from a security weakness in <strong>MSHTML</strong>, the proprietary engine of Microsoft&#8217;s <strong>Internet Explorer</strong> web browser. If that sounds familiar it&#8217;s because this is the fourth MSHTML vulnerability found to be exploited in the wild so far in 2024.</p>
<p><strong>Nikolas Cemerikic</strong>, a cybersecurity engineer at <strong>Immersive Labs</strong>, said the vulnerability allows an attacker to trick users into viewing malicious web content, which could appear legitimate thanks to the way Windows handles certain web elements.</p>
<p>&#8220;Once a user is deceived into interacting with this content (typically through phishing attacks), the attacker can potentially gain unauthorized access to sensitive information or manipulate web-based services,&#8221; he said.</p>
<p>Cemerikic noted that while Internet Explorer is being retired on many platforms, its underlying MSHTML technology remains active and vulnerable.</p>
<p>&#8220;This creates a risk for employees using these older systems as part of their everyday work, especially if they are accessing sensitive data or performing financial transactions online,&#8221; he said.</p>
<p>Probably the more serious zero-day this month is <a href="https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-43572" target="_blank" rel="noopener">CVE-2024-43572</a>, a code execution bug in the <a href="https://en.wikipedia.org/wiki/Microsoft_Management_Console" target="_blank" rel="noopener">Microsoft Management Console</a>, a component of Windows that gives system administrators a way to configure and monitor the system.</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, observed that the patch for CVE-2024-43572 arrived a few months after researchers at <strong>Elastic Security Labs</strong> disclosed an attack technique called <a href="https://www.elastic.co/security-labs/grimresource" target="_blank" rel="noopener">GrimResource</a> that leveraged an old cross-site scripting (XSS) vulnerability combined with a specially crafted Microsoft Saved Console (MSC) file to gain code execution privileges.<span id="more-69126"></span></p>
<p>&#8220;Although Microsoft patched a different MMC vulnerability in September (CVE-2024-38259) that was neither exploited in the wild nor publicly disclosed,&#8221; Narang said. &#8220;Since the discovery of CVE-2024-43572, Microsoft now prevents untrusted MSC files from being opened on a system.&#8221;</p>
<p>Microsoft also patched <strong>Office,</strong> <strong>Azure</strong>, <strong>.NET</strong>, <strong>OpenSSH for Windows</strong>; <strong>Power BI</strong>; <strong>Windows Hyper-V</strong>; <strong>Windows Mobile Broadband</strong>, and <strong>Visual Studio</strong>. As usual, the <strong>SANS Internet Storm Center</strong> has <a href="https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20-%20October%202024/31336" target="_blank" rel="noopener">a list of all Microsoft patches released today</a>, indexed by severity and exploitability.</p>
<p>Late last month, Apple rolled out macOS 15, an operating system update called Sequoia that broke the functionality of security tools made by a number of vendors, including CrowdStrike, SentinelOne and Microsoft. On Oct. 7, <a href="https://techcrunch.com/2024/10/07/apple-fixes-bugs-in-macos-sequoia-that-broke-some-cybersecurity-tools/" target="_blank" rel="noopener">Apple pushed an update to Sequoia users</a> that addresses these compatibility issues.</p>
<p>Finally, Adobe has released security updates to plug a total of 52 vulnerabilities in a range of software, including <strong>Adobe Substance 3D Painter</strong>, <strong>Commerce</strong>, <strong>Dimension</strong>, <strong>Animate</strong>, <strong>Lightroom</strong>, <strong>InCopy</strong>, <strong>InDesign</strong>, <strong>Substance 3D Stager</strong>, and <strong>Adobe FrameMaker</strong>.</p>
<p>Please consider backing up important data before applying any updates. Zero-days aside, there&#8217;s generally little harm in waiting a few days to apply any pending patches, because not infrequently a security update introduces stability or compatibility issues. <strong>AskWoody.com</strong> usually has the skinny on any problematic patches.</p>
<p>And as always, if you run into any glitches after installing patches, leave a note in the comments; chances are someone else is stuck with the same issue and may have even found a solution.</p>


feed_id: https://krebsonsecurity.com/?p=69000
title: Lamborghini Carjackers Lured by $243M Cyberheist
uri: Lamborghini-Carjackers-Lured-by-243M-Cyberheist
url: https://krebsonsecurity.com/2024/10/lamborghini-carjackers-lured-by-243m-cyberheist/
content:
<p>The parents of a 19-year-old Connecticut honors student accused of taking part in a $243 million cryptocurrency heist in August were carjacked a week later &#8212; while out house-hunting in a brand new Lamborghini. Prosecutors say the couple was beaten and briefly kidnapped by six young men who traveled from Florida as part of a botched plan to hold the parents for ransom.</p>
<div id="attachment_69159" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69159" decoding="async" class=" wp-image-69159" src="media/2ab2a88a.abc-7-danbury.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/abc-7-danbury.png" alt="" width="751" height="389" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/abc-7-danbury.png 1133w, https://krebsonsecurity.com/wp-content/uploads/2024/10/abc-7-danbury-768x398.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/abc-7-danbury-782x405.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-69159" class="wp-caption-text">Image: ABC7NY.  youtube.com/watch?v=xoiaGzwrunY</p></div>
<p>Late in the afternoon of Aug. 25, 2024 in Danbury, Ct., a married couple in their 50s pulled up to a gated community in a new Lamborghini Urus (investigators say the sports car still had temporary tags) when they were intentionally rear-ended by a Honda Civic.</p>
<p>A <a href="http://youtube.com/watch?v=xoiaGzwrunY" target="_blank" rel="noopener">witness told police</a> they saw three men exit a van that was following the Honda, and said the men began assaulting the couple and forcing them into the van. Local police officers spotted the van speeding from the scene and pursued it, only to find the vehicle crashed and abandoned a short distance away.</p>
<p>Inside the disabled van the police found the couple with their hands and feet bound in duct tape, the man visibly bruised after being assaulted with a baseball bat. Danbury police soon reported arresting six suspects in the kidnapping, all men aged 18-26 from Florida. They also recovered the abandoned Lamborghini from a wooded area.</p>
<p>A <a href="media/5886c059.borrero-diaz-et-al.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/borrero-diaz-et-al.pdf" target="_blank" rel="noopener">criminal complaint</a> (PDF) filed on Sept. 24 against the six men does not name the victims, referring to them only as a married couple from Danbury with the initials <strong>R.C</strong>. and <strong>S.C.</strong> But prosecutors in Connecticut said they were targeted &#8220;because the co-conspirators believed the victims&#8217; son had access to significant amounts of digital currency.&#8221;</p>
<p>What made the Miami men so convinced R.C. and S.C.&#8217;s son was loaded with cryptocurrency? Approximately one week earlier, on Aug. 19, a group of cybercriminals that allegedly included the couple&#8217;s son executed a sophisticated phone-based social engineering attack in which they stole $243 million worth of cryptocurrency from a victim in Washington, D.C.</p>
<p>That&#8217;s according to<strong> ZachXBT</strong>, a frequently cited crypto crime investigator who <a href="https://x.com/zachxbt/status/1836753409749274895" target="_blank" rel="noopener">published a lengthy thread</a> that broke down how the theft was carried out and ultimately exposed by the perpetrators themselves.</p>
<p>ZachXBT&#8217;s post included <a href="https://x.com/zachxbt/status/1836753185718865979" target="_blank" rel="noopener">a screen recording</a> of a Discord chat session made by one of the participants to the $243 million robbery, noting that two of the people involved managed to leak the username of the Microsoft Windows PCs they were using to participate in the chat.</p>
<p>One of the usernames leaked during the chat was <strong>Veer Chetal</strong>. According to ZachXBT, that name corresponds to a 19-year-old from Danbury who allegedly goes by the nickname &#8220;<strong>Wiz,</strong>&#8221; although in the leaked video footage he allegedly used the handle &#8220;<strong>Swag</strong>.&#8221;  Swag was reportedly involved in executing the early stages of the crypto heist &#8212; gaining access to the victim&#8217;s Gmail and iCloud accounts.</p>
<div id="attachment_69144" style="width: 759px" class="wp-caption aligncenter"><a href="media/4a1f8c53.veerchetal-windows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/veerchetal-windows.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69144" decoding="async" loading="lazy" class="wp-image-69144" src="media/4a1f8c53.veerchetal-windows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/veerchetal-windows.png" alt="" width="749" height="415" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/veerchetal-windows.png 1328w, https://krebsonsecurity.com/wp-content/uploads/2024/10/veerchetal-windows-768x425.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/veerchetal-windows-782x433.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-69144" class="wp-caption-text">A still shot from a video screenshare in which one of the participants on the Discord voice chat used the Windows username Veer Chetal. Image: x.com/zachxbt</p></div>
<p>The same day ZachXBT published his findings, a <a href="https://www.justice.gov/usao-dc/media/1369661/dl?inline" target="_blank" rel="noopener">criminal indictment</a> was issued in Washington D.C. charging two of the men he named as involved in the heist. Prosecutors allege <strong>Malone &#8220;Greavys&#8221; Lam</strong>, 20, of Miami and Los Angeles, and <strong>Jeandiel &#8220;Box&#8221; Serrano</strong>, 21, of Los Angeles conspired to steal and launder over $230 million in cryptocurrency from a victim in Washington, D.C. The indictment alleges Lam and Serrano were helped by other unnamed co-conspirators.</p>
<p>&#8220;Lam and Serrano then allegedly spent the laundered cryptocurrency proceeds on international travel, nightclubs, luxury automobiles, watches, jewelry, designer handbags, and rental homes in Los Angeles and Miami,&#8221; reads <a href="https://www.justice.gov/usao-dc/pr/indictment-charges-two-230-million-cryptocurrency-scam" target="_blank" rel="noopener">a press release</a> from the <strong>U.S. Department of Justice</strong>.</p>
<p>By tracing the flow of funds stolen in the heist, ZachXBT concluded that Wiz received a large percentage from the theft, noting that &#8220;additional comfort [in naming him as involved] was gained as throughout multiple recordings accomplices refer to him as &#8216;Veer&#8217; on audio and in chats.&#8221;</p>
<p>&#8220;A cluster of [cryptocurrency] addresses tied to both Box/Wiz received $41M+ from two exchanges over the past few weeks primarily flowing to luxury goods brokers to purchase cars, watches, jewelry, and designer clothes,&#8221; ZachXBT wrote.</p>
<p>KrebsOnSecurity sought comment from Veer Chetal, and from his parents &#8212; <strong>Radhika Chetal</strong> and <strong>Suchil Chetal</strong>. This story will be updated in the event that anyone representing the Chetal family responds. Veer Chetal has not been publicly charged with any crime.</p>
<p>According to <a href="https://www.immaculatehs.org/discover-ihs/news/news-post/~board/mustang-monthly/post/mustang-moments-february-2022" target="_blank" rel="noopener">a news brief</a> published by a private Catholic high school in Danbury that Veer Chetal attended, in 2022 he successfully completed <strong>Harvard&#8217;s Future Lawyers Program</strong>, a &#8220;unique pre-professional program where students, guided by qualified Harvard undergraduate instructors, learn how to read and build a case, how to write position papers, and how to navigate a path to law school.&#8221; A <a href="https://patch.com/connecticut/danbury/immaculate-high-school-leads-pack-academics" target="_blank" rel="noopener">November 2022 story at patch.com</a> quoted Veer Chetal (class of 2024) crediting the Harvard program with his decision to pursue a career in law.</p>
<p>It remains unclear which Chetal family member acquired the 2023 Lamborghini Urus, which has a starting price of around $233,000. Sushil Chetal&#8217;s <a href="https://www.linkedin.com/in/sushil-chetal-0898048/" target="_blank" rel="noopener">LinkedIn profile</a> says he is a vice president at the investment bank <strong>Morgan Stanley</strong>.</p>
<p>It is clear that other alleged co-conspirators to the $243 million heist displayed a conspicuous consumption of wealth following the date of the heist. ZachXBT&#8217;s post <a href="media/c2081b55.malone-clubs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/malone-clubs.png" target="_blank" rel="noopener">chronicled Malone&#8217;s flashy lifestyle</a>, in which he allegedly used the stolen money to purchase more than 10 vehicles, rent palatial properties, travel with friends on chartered jets, and spend between $250,000 and $500,000 a night at clubs in Los Angeles and Miami.<span id="more-69000"></span></p>
<div id="attachment_69147" style="width: 730px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69147" decoding="async" loading="lazy" class="wp-image-69147 size-full" src="media/ee0d7626.maloneclubs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/maloneclubs.png" alt="" width="720" height="775" /><p id="caption-attachment-69147" class="wp-caption-text">In the photo on the bottom right, Greavys/Lam is the individual on the left wearing shades. They are pictured leaving a luxury goods store. Image: x.com/zachxbt</p></div>
<p><strong>WSVN-TV</strong> in Miami <a href="https://www.youtube.com/watch?v=izUK7loTKKw" target="_blank" rel="noopener">covered an FBI raid</a> of a large rented waterfront home around the time Malone and Serrano were arrested. The news station interviewed a neighbor of the home&#8217;s occupants, who reported a recent large party at the residence wherein the street was lined with high-end luxury vehicles &#8212; all of them with temporary paper tags.</p>
<p>ZachXBT unearthed a video showing a person identified as Wiz at a Miami nightclub earlier this year, wherein they could be seen dancing to the crowd&#8217;s chants while holding an illuminated sign with the message, &#8220;I win it all.&#8221;</p>
<div align="center"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/_oYSzRBx7Ac?si=psoe1E8OBLqdI7HW" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>It appears that all of the suspects in the cyber heist (and at least some of the alleged carjackers) are members of <strong>The Com</strong>, an archipelago of crime-focused chat communities which collectively functions as a kind of distributed cybercriminal social network that facilitates instant collaboration.</p>
<p>As documented in <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com/" target="_blank" rel="noopener">last month&#8217;s deep dive on top Com members</a>,  The Com is also a place where cybercriminals go to boast about their exploits and standing within the community, or to knock others down a peg or two. Prominent Com members are endlessly sniping over who pulled off the most impressive heists, or who has accumulated the biggest pile of stolen virtual currencies.</p>
<p>And as often as they extort and rob victims for financial gain, members of The Com are trying to wrest stolen money from their cybercriminal rivals — often in ways that spill over into <a href="https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/" target="_blank" rel="noopener">physical violence in the real world</a>.</p>
<p>One of the six Miami-area men arrested in the carjacking and extortion plot gone awry &#8212; <strong>Reynaldo &#8220;Rey&#8221; Diaz</strong> &#8212; was shot twice while parked in his bright yellow Corvette in Miami&#8217;s design district in 2022. In <a href="https://www.nbcmiami.com/news/local/man-shot-while-sitting-in-high-priced-vehicle-in-miamis-design-district/2691038/" target="_blank" rel="noopener">an interview</a> with a local <strong>NBC</strong> television station, Diaz said he was probably targeted for the jewelry he was wearing, which he described as &#8220;pretty expensive.&#8221;</p>
<p>KrebsOnSecurity has learned Diaz also went by the alias &#8220;<strong>Pantic</strong>&#8221; on Telegram chat channels dedicated to stealing cryptocurrencies. Pantic was known for participating in several much smaller cyber heists in the past, and spending most of his cut on designer clothes and jewelry.</p>
<div id="attachment_69146" style="width: 832px" class="wp-caption alignright"><img aria-describedby="caption-attachment-69146" decoding="async" loading="lazy" class="size-full wp-image-69146" src="media/4041c07c.diazvette.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/diazvette.png" alt="" width="822" height="443" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/diazvette.png 822w, https://krebsonsecurity.com/wp-content/uploads/2024/10/diazvette-768x414.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/diazvette-782x421.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/10/diazvette-370x200.png 370w" sizes="(max-width: 822px) 100vw, 822px" /><p id="caption-attachment-69146" class="wp-caption-text">The Corvette that Diaz was sitting in when he was shot in 2022. Image: NBC 6, South Florida.</p></div>
<p>Earlier this year, Diaz was &#8220;doxed,&#8221; or publicly outed as Pantic, with his personal and family information posted on a harassment and extortion channel frequented by members of The Com. The reason cited for Pantic&#8217;s doxing was widely corroborated by multiple Com members: Pantic had inexplicably robbed two close friends at gunpoint, one of whom recently died of a drug overdose.</p>
<p>Government prosecutors say the brazen daylight carjacking was paid for and organized by 23-year-old Miami resident <strong>Angel &#8220;Chi Chi&#8221; Borrero.</strong> In 2022, Borrero was arrested in Miami for <a href="https://miamidadefl.mugshots.zone/borrero-angel-mugshot-11-30-2022/" target="_blank" rel="noopener">aggravated assault with a deadly weapon</a>.</p>
<p>The six Miami men face charges including first-degree assault, kidnapping and reckless endangerment, and five of them are being held on a $1 million bond. One suspect is also charged with reckless driving, engaging police in pursuit and evading responsibility; his bond was set at $2 million. Lam and Serrano are each charged with conspiracy to commit wire fraud and conspiracy to launder money.</p>
<p>Cybercriminals hail from all walks of life and income levels, but some of the more accomplished cryptocurrency thieves also tend to be <a href="https://krebsonsecurity.com/2024/01/fla-man-charged-in-sim-swapping-spree-is-key-suspect-in-hacker-groups-oktapus-scattered-spider/" target="_blank" rel="noopener">among the more privileged</a>, and from relatively well-off families. In other words, these individuals aren&#8217;t stealing to put food on the table: They&#8217;re doing it so they can amass all the trappings of instant wealth, and so they can boast about their crimes to others on The Com.</p>
<p>There is also a penchant among this crowd to call attention to their activities in conspicuous ways that hasten their arrest and criminal charging. In many ways, the story arc of the young men allegedly involved in the $243 million heist tracks closely to that of <strong>Joel Ortiz</strong>, a valedictorian who <a href="https://krebsonsecurity.com/2019/02/more-alleged-sim-swappers-face-justice/" target="_blank" rel="noopener">was sentenced in 2019 to 10 years in prison for stealing more than $5 million in cryptocurrencies</a>.</p>
<p>Ortiz famously posted videos of himself and co-conspirators chartering flights and partying it up at LA nightclubs, with scantily clad women waving giant placards bearing their &#8220;OG&#8221; usernames &#8212; highly-prized, single-letter social media accounts that they&#8217;d stolen or purchased stolen from others.</p>
<div style="text-align: center;"><iframe loading="lazy" src="https://www.youtube.com/embed/usCik-feQNE" width="660" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Ortiz earned the distinction of being the first person convicted of SIM-swapping, a crime that involves using mobile phone company insiders or compromised employee accounts to transfer a target&#8217;s phone number to a mobile device controlled by the attackers. From there, the attacker can intercept any password reset links, and any one-time passcodes sent via SMS or automated voice calls.</p>
<p>But as the mobile carriers seek to <a href="https://www.lightreading.com/security/wireless-companies-want-another-year-for-sim-swap-compliance" target="_blank" rel="noopener">make their networks less hospitable to SIM-swappers</a>, and as more financial platforms seek to harden user account security, today&#8217;s crypto thieves are finding they don&#8217;t need SIM-swaps to steal obscene amounts of cryptocurrency. Not when tricking people over the phone remains such an effective approach.</p>
<p>According to ZachXBT, the crooks responsible for the $243 million theft initially compromised the target&#8217;s personal accounts after calling them as Google Support and using a spoofed number. The attackers also spoofed a call from account support representatives at the cryptocurrency exchange <strong>Gemini</strong>, claiming the target&#8217;s account had been hacked.</p>
<p>From there the target was social engineered over the phone into resetting multi-factor authentication and sending Gemini funds to a compromised wallet. ZachXBT says the attackers also convinced the victim to use <strong>AnyDesk</strong> to share their screen, and in doing so the victim leaked their private keys.</p>


feed_id: https://krebsonsecurity.com/?p=69210
title: Sudanese Brothers Arrested in ‘AnonSudan’ Takedown
uri: Sudanese-Brothers-Arrested-in-AnonSudan-Takedown
url: https://krebsonsecurity.com/2024/10/sudanese-brothers-arrested-in-anonsudan-takedown/
content:
<p>The U.S. government on Wednesday announced the arrest and charging of two Sudanese brothers accused of running <strong>Anonymous Sudan</strong> (a.k.a. <strong>AnonSudan</strong>), a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers. The younger brother is facing charges that could land him life in prison for allegedly seeking to kill people with his attacks.</p>
<div id="attachment_69232" style="width: 315px" class="wp-caption alignright"><img aria-describedby="caption-attachment-69232" decoding="async" class=" wp-image-69232" src="media/b6a4deba.as-kenya.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/as-kenya.png" alt="" width="305" height="440" /><p id="caption-attachment-69232" class="wp-caption-text">Image: FBI</p></div>
<p>Active since at least January 2023, AnonSudan has been described in media reports as a &#8220;hacktivist&#8221; group motivated by ideological causes. But in <a href="https://www.justice.gov/usao-cdca/media/1373586/dl?inline" target="_blank" rel="noopener">a criminal complaint</a>, the FBI said those high-profile cyberattacks were effectively commercials for the hackers&#8217; DDoS-for-hire service, which they sold to paying customers for as little as $150 a day &#8212; with up to 100 attacks allowed per day &#8212; or $700 for an entire week.</p>
<p>The complaint says despite reports suggesting Anonymous Sudan might be state-sponsored Russian actors pretending to be Sudanese hackers with Islamist motivations, AnonSudan was led by two brothers in Sudan &#8212; <strong>Ahmed Salah Yousif</strong> <strong>Omer</strong>, 22, and <strong>Alaa Salah Yusuuf Omer</strong>, 27.</p>
<p>AnonSudan claimed credit for successful DDoS attacks on numerous U.S. companies, causing a <a href="https://msrc.microsoft.com/blog/2023/06/microsoft-response-to-layer-7-distributed-denial-of-service-ddos-attacks/" target="_blank" rel="noopener">multi-day outage</a> for Microsoft&#8217;s cloud services in June 2023. The group hit <strong>PayPal</strong> the following month, followed by <strong>Twitter/X</strong> (Aug. 2023), and <strong>OpenAI</strong> (Nov. 2023). An <a href="https://www.justice.gov/usao-cdca/media/1373581/dl?inline" target="_blank" rel="noopener">indictment</a> in the Central District of California notes the duo even swamped the websites of the <strong>FBI</strong> and the <strong>Department of State</strong>.</p>
<p>Prosecutors say Anonymous Sudan offered a “Limited Internet Shutdown Package,” which would enable customers to shut down internet service providers in specified countries for $500 (USD) an hour. The two men also allegedly extorted some of their victims for money in exchange for calling off DDoS attacks.</p>
<p>The government isn&#8217;t saying where the Omed brothers are being held, only that they were arrested in March 2024 and have been in custody since. A <a href="https://www.justice.gov/usao-cdca/pr/two-sudanese-nationals-indicted-alleged-role-anonymous-sudan-cyberattacks-hospitals" target="_blank" rel="noopener">statement</a> by the <strong>U.S. Department of Justice</strong> says the government also seized control of AnonSudan&#8217;s DDoS infrastructure and servers after the two were arrested in March.</p>
<p>AnonSudan accepted orders over the instant messaging service <strong>Telegram</strong>, and marketed its DDoS service by several names, including &#8220;<strong>Skynet</strong>,&#8221; &#8220;<strong>InfraShutdown</strong>,&#8221; and the &#8220;<strong>Godzilla botnet</strong>.&#8221; However, the DDoS machine the Omer brothers allegedly built was not made up of hacked devices &#8212; as is typical with DDoS botnets.</p>
<p>Instead, the government alleges Skynet was more like a &#8220;distributed cloud attack tool,&#8221; with a command and control (C2) server, and an entire fleet of cloud-based servers that forwards C2 instructions to an array of open proxy resolvers run by unaffiliated third parties, which then transmit the DDoS attack data to the victims.</p>
<p><strong>Amazon</strong> was among many companies credited with helping the government in the investigation, and said AnonSudan launched its attacks by finding hosting companies that would rent them small armies of servers.</p>
<p>&#8220;Where their potential impact becomes really significant is when they then acquire access to thousands of other machines &#8212; typically misconfigured web servers &#8212; through which almost anyone can funnel attack traffic,&#8221; Amazon explained in <a href="https://www.aboutamazon.com/news/aws/amazon-US-department-of-justice-cybersecurity" target="_blank" rel="noopener">a blog post</a>. &#8220;This extra layer of machines usually hides the true source of an attack from the targets.&#8221;<span id="more-69210"></span></p>
<p>The security firm <strong>CrowdStrike</strong> <a href="https://www.crowdstrike.com/en-us/blog/anonymous-sudan-hacktivist-group-ddos-indictment/" target="_blank" rel="noopener">said</a> the success of AnonSudan&#8217;s DDoS attacks stemmed from a combination of factors, including sophisticated techniques for bypassing DDoS mitigation services. Also, AnonSudan typically launched so-called &#8220;<a href="https://www.cloudflare.com/learning/ddos/application-layer-ddos-attack/" target="_blank" rel="noopener">Layer 7</a>&#8221; attacks that sought to overwhelm targeted &#8220;<a href="https://www.cloudflare.com/learning/security/api/what-is-api-endpoint/" target="_blank" rel="noopener">API endpoints</a>&#8221; &#8212; the back end systems responsible for handling website requests &#8212; with bogus requests for data, leaving the target unable to serve legitimate visitors.</p>
<p>The Omer brothers were both charged with one count of conspiracy to damage protected computers. The younger brother &#8212; Ahmed Salah &#8212; was also charged with three counts of damaging protected computers.</p>
<div id="attachment_69233" style="width: 756px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69233" decoding="async" loading="lazy" class=" wp-image-69233" src="media/7a89a458.ahmedomer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/ahmedomer.png" alt="" width="746" height="481" /><p id="caption-attachment-69233" class="wp-caption-text">A passport for Ahmed Salah Yousif Omer. Image: FBI.</p></div>
<p>If extradited to the United States, tried and convicted in a court of law, the older brother Alaa Salah would be facing a maximum of five years in prison. But prosecutors say Ahmed Salah could face life in prison for allegedly launching attacks that sought to kill people.</p>
<p>As Hamas fighters broke through the border fence and attacked Israel on Oct. 7, 2023, a wave of rockets was launched into Israel. At the same time, AnonSudan announced it was attacking the APIs that power Israel&#8217;s widely-used &#8220;red alert&#8221; mobile apps that warn residents about any incoming rocket attacks in their area.</p>
<p>In February 2024, AnonSudan launched a digital assault on the <strong>Cedars-Sinai Hospital</strong> in the Los Angeles area, an attack that caused emergency services and patients to be temporarily redirected to different hospitals.</p>
<p>The complaint alleges that in September 2023, AnonSudan began a week-long DDoS attack against the Internet infrastructure of Kenya, knocking offline government services, banks, universities and at least seven hospitals.</p>


feed_id: https://krebsonsecurity.com/?p=69246
title: Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach
uri: Brazil-Arrests-USDoD-Hacker-in-FBI-Infragard-Breach
url: https://krebsonsecurity.com/2024/10/brazil-arrests-usdod-hacker-in-fbi-infragard-breach/
content:
<p>Brazilian authorities reportedly have arrested a 33-year-old man on suspicion of being &#8220;<strong>USDoD</strong>,&#8221; a prolific cybercriminal who rose to infamy in 2022 after infiltrating the <strong>FBI&#8217;s InfraGard</strong> program and leaking contact information for 80,000 members. More recently, USDoD was behind a breach at the consumer data broker <strong>National Public Data</strong> that led to the leak of Social Security numbers and other personal information for a significant portion of the U.S. population.</p>
<div id="attachment_62128" style="width: 759px" class="wp-caption aligncenter"><a href="media/56b3b33e.breachedige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62128" decoding="async" class="wp-image-62128" src="media/56b3b33e.breachedige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png" alt="" width="749" height="283" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png 1301w, https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige-768x290.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige-782x296.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-62128" class="wp-caption-text">USDoD&#8217;s InfraGard sales thread on Breached.</p></div>
<p>The Brazilian news outlet <strong>TV Globo</strong> <a href="https://g1.globo.com/politica/noticia/2024/10/16/pf-prende-hacker-de-33-anos-suspeito-de-invadir-sistemas-e-vazar-dados-de-policiais.ghtml" target="_blank" rel="noopener">first reported</a> the news of USDoD&#8217;s arrest, saying the Federal Police arrested a 33-year-old man from <a href="https://en.wikipedia.org/wiki/Belo_Horizonte" target="_blank" rel="noopener">Belo Horizonte</a>. According to TV Globo, USDoD is wanted domestically in connection with the theft of data on Brazilian Federal Police officers.</p>
<p>USDoD was known to use the hacker handles &#8220;<strong>Equation Corp</strong>&#8221; and &#8220;<strong>NetSec</strong>,&#8221; and according to the cyber intelligence platform <strong>Intel 471</strong> NetSec posted a thread on the <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">now-defunct cybercrime community</a> <strong>RaidForums</strong> on Feb. 22, 2022, in which they offered the email address and password for 659 members of the Brazilian Federal Police.</p>
<p>TV Globo didn&#8217;t name the man arrested, but the Portuguese tech news outlet <strong>Tecmundo</strong> published <a href="https://www.tecmundo.com.br/seguranca/288570-hacker-roubou-3-bilhoes-dados-eua-descoberto-brasileiro.htm" target="_blank" rel="noopener">a report</a> in August 2024 that named USDoD as 33-year-old <strong>Luan BG</strong> from Minas Gerais, Brazil. Techmundo said it learned the hacker&#8217;s real identity after being given a draft of a detailed, non-public report produced by the security firm <b>CrowdStrike</b>.</p>
<p>CrowdStrike did not respond to a request for comment. But a week after Techmundo&#8217;s piece, the tech news publication <strong>hackread.com</strong> <a href="https://hackread.com/usdod-hacker-ssn-leak-reveals-brazilian-citizen/" target="_blank" rel="noopener">published a story</a> in which USDoD reportedly admitted that CrowdStrike was accurate in identifying him. Hackread said USDoD shared a statement, which was partially addressed to CrowdStrike:</p>
<div id="attachment_69251" style="width: 635px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69251" decoding="async" loading="lazy" class="size-full wp-image-69251" src="media/48907bc9.usdodstatement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/usdodstatement.png" alt="" width="625" height="415" /><p id="caption-attachment-69251" class="wp-caption-text">A recent statement by USDoD, after he was successfully doxed by CrowdStrike and other security firms. Image: Hackread.com.</p></div>
<p>In August 2024, a cybercriminal began <a href="https://krebsonsecurity.com/2024/08/nationalpublicdata-com-hack-exposes-a-nations-data/" target="_blank" rel="noopener">selling Social Security numbers and other personal information</a> stolen from National Public Data, a private data broker in Florida that collected and sold SSNs and contact data for a significant slice of the American population.</p>
<p>Additional reporting revealed National Public Data had <a href="https://krebsonsecurity.com/2024/08/national-public-data-published-its-own-passwords/" target="_blank" rel="noopener">inadvertently published its own passwords</a> on the Internet. The company is now the target of multiple class-action lawsuits, and <a href="https://techcrunch.com/2024/10/14/national-public-data-the-hacked-data-broker-that-lost-millions-of-social-security-numbers-and-more-files-for-bankruptcy/" target="_blank" rel="noopener">recently declared bankruptcy</a>. In an interview with KrebsOnSecurity, USDoD acknowledged stealing the NPD data earlier this year, but claimed he was not involved in leaking or selling it.<span id="more-69246"></span></p>
<p>In December 2022, KrebsOnSecurity broke the news that USDoD had <a href="https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/" target="_blank" rel="noopener">social-engineered his way into the FBI&#8217;s InfraGard program</a>, an FBI initiative designed to build informal information sharing partnerships with vetted professionals in the private sector concerning cyber and physical threats to critical U.S. national infrastructure.</p>
<p>USDoD applied for InfraGard membership using the identity of the CEO of a major U.S. financial company. Even though USDoD listed the real mobile phone number of the CEO, the FBI apparently never reached the CEO to validate his application, because the request was granted just a few weeks later. After that, USDoD said he used a simple program to collect all of the contact information shared by more than 80,000 InfraGard members.</p>
<p>The FBI declined to comment on reports about USDoD&#8217;s arrest.</p>
<p>In a lengthy <a href="https://databreaches.net/?p=107720" target="_blank" rel="noopener">September 2023 interview</a> with <strong>databreaches.net</strong>, USDoD told the publication he was a man in his mid-30s who was born in South America and who holds dual citizenship in Brazil and Portugal. Toward the end of that interview, USDoD said they were planning to launch a platform for acquiring military intelligence from the United States.</p>
<p>Databreaches.net told KrebsOnSecurity USDoD has been a regular correspondent since that 2023 interview, and that after being doxed USDoD made inquiries with a local attorney to learn if there were any open investigations or charges against him.</p>
<p>&#8220;From what the lawyer found out from the federal police, they had no open cases or charges against him at that time,&#8221; Databreaches.net said. &#8220;From his writing to me and the conversations we had, my sense is he had absolutely no idea he was in imminent danger of being arrested.&#8221;</p>
<p>When KrebsOnSecurity last communicated with USDoD via Telegram on Aug. 15, 2024, they claimed they were &#8220;planning to retire and move on from this,&#8221; referring to multiple media reports that blamed USDoD for leaking nearly three billion consumer records from National Public Data.</p>
<p>Less than four days later, however, USDoD was back on his normal haunt at <strong>BreachForums</strong>, posting custom exploit code he claimed to have written to attack recently patched <a href="https://nvd.nist.gov/vuln/detail/CVE-2024-3807" target="_blank" rel="noopener">vulnerabilities</a> in a popular theme made for WordPress websites.</p>


feed_id: https://krebsonsecurity.com/?p=69216
title: The Global Surveillance Free-for-All in Mobile Ad Data
uri: The-Global-Surveillance-Free-for-All-in-Mobile-Ad-Data
url: https://krebsonsecurity.com/2024/10/the-global-surveillance-free-for-all-in-mobile-ad-data/
content:
<p>Not long ago, the ability to digitally track someone’s daily movements just by knowing their home address, employer, or place of worship was considered a dangerous power that should remain only within the purview of nation states. But a new lawsuit in a likely constitutional battle over a New Jersey privacy law shows that anyone can now access this capability, thanks to a proliferation of commercial services that hoover up the digital exhaust emitted by widely-used mobile apps and websites.</p>
<div id="attachment_69282" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69282" decoding="async" class=" wp-image-69282" src="media/dca60e20.peoplephone.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/peoplephone.png" alt="" width="748" height="756" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/peoplephone.png 893w, https://krebsonsecurity.com/wp-content/uploads/2024/10/peoplephone-768x776.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/peoplephone-782x790.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-69282" class="wp-caption-text">Image: Shutterstock, Arthimides.</p></div>
<p>Delaware-based<strong> Atlas Data Privacy Corp.</strong> helps its users remove their personal information from the clutches of consumer data brokers, and from <a href="https://krebsonsecurity.com/?s=people+search" target="_blank" rel="noopener">people-search services online</a>. Backed by millions of dollars in litigation financing, Atlas so far this year has sued 151 consumer data brokers on behalf of a class that includes more than 20,000 New Jersey law enforcement officers who are signed up for Atlas services.</p>
<p>Atlas alleges all of these data brokers have ignored repeated warnings that they are violating <strong>Daniel’s Law</strong>, a New Jersey statute allowing law enforcement, government personnel, judges and their families to have their information completely removed from commercial data brokers. Daniel’s Law was passed in 2020 after the death of 20-year-old <strong>Daniel Anderl</strong>, who was killed in a violent attack targeting a federal judge &#8212; his mother.</p>
<p>Last week, Atlas invoked Daniel&#8217;s Law in <a href="media/1d33cf21.el_Street_Compl_w_Summons-Case_Info_-_4874-8628-4017_-_1__1_.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/2024.10.18_Babel_Street_Compl_w_Summons-Case_Info_-_4874-8628-4017_-_1__1_.pdf" target="_blank" rel="noopener">a lawsuit</a> (PDF) against <strong>Babel Street</strong>, a little-known technology company incorporated in Reston, Va. Babel Street&#8217;s core product allows customers to draw a digital polygon around nearly any location on a map of the world, and view a slightly dated (by a few days) time-lapse history of the mobile devices seen coming in and out of the specified area.</p>
<p>Babel Street’s <strong>LocateX</strong> platform also allows customers to track individual mobile users by their <strong>Mobile Advertising ID</strong> or <strong>MAID</strong>, a unique, alphanumeric identifier built into all Google Android and Apple mobile devices.</p>
<p>Babel Street can offer this tracking capability by consuming location data and other identifying information that is collected by many websites and broadcast to dozens and sometimes hundreds of ad networks that may wish to bid on showing their ad to a particular user.</p>
<div id="attachment_69280" style="width: 1458px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69280" decoding="async" loading="lazy" class="size-full wp-image-69280" src="media/05f34e83.mosque.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/mosque.jpeg" alt="" width="1448" height="990" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/mosque.jpeg 1448w, https://krebsonsecurity.com/wp-content/uploads/2024/10/mosque-768x525.jpeg 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/mosque-782x535.jpeg 782w" sizes="(max-width: 1448px) 100vw, 1448px" /><p id="caption-attachment-69280" class="wp-caption-text">This image, taken from a video recording Atlas made of its private investigator using Babel Street to show all of the unique mobile IDs seen over time at a mosque in Dearborn, Michigan. Each red dot represents one mobile device.</p></div>
<p>In an interview, Atlas said a private investigator they hired was offered a free trial of Babel Street, which the investigator was able to use to determine the home address and daily movements of mobile devices belonging to multiple New Jersey police officers whose families have already faced significant harassment and death threats.</p>
<p>Atlas said the investigator encountered Babel Street while testing hundreds of data broker tools and services to see if personal information on its users was being sold. They soon discovered Babel Street also bundles people-search services with its platform, to make it easier for customers to zero in on a specific device.</p>
<p>The investigator contacted Babel Street about possibly buying home addresses in certain areas of New Jersey. After listening to a sales pitch for Babel Street and expressing interest, the investigator was told Babel Street only offers their service to the government or to “contractors of the government.”</p>
<p>“The investigator (truthfully) mentioned that he was contemplating some government contract work in the future and was told by the Babel Street salesperson that ‘that’s good enough’ and that ‘they don’t actually check,’” Atlas shared in an email with reporters.</p>
<p>KrebsOnSecurity was one of five media outlets invited to review screen recordings that Atlas made while its investigator used a two-week trial version of Babel Street’s LocateX service. References and links to reporting by other publications, including <a href="https://www.404media.co/inside-the-u-s-government-bought-tool-that-can-track-phones-at-abortion-clinics/" target="_blank" rel="noopener"><strong>404 Media</strong></a>, <a href="https://www.haaretz.co.il/news/security/2024-10-23/ty-article-magazine/.premium/00000192-b90c-dc97-a593-f96f50800000" target="_blank" rel="noopener"><strong>Haaretz</strong></a>, <a href="https://www.notus.org/technology/cell-phone-tracking-law-enforcement-abortion-clinic" target="_blank" rel="noopener"><strong>NOTUS</strong></a>, and <strong>The New York Times</strong>, will appear throughout this story.</p>
<p>Collectively, these stories expose how the broad availability of mobile advertising data has created a market in which virtually anyone can build a sophisticated spying apparatus capable of tracking the daily movements of hundreds of millions of people globally.</p>
<p>The findings outlined in Atlas&#8217;s lawsuit against Babel Street also illustrate how mobile location data is set to massively complicate several hot-button issues, from the tracking of suspected illegal immigrants or women seeking abortions, to harassing public servants who are already in the crosshairs over baseless conspiracy theories and increasingly hostile political rhetoric against government employees.</p>
<h2>WARRANTLESS SURVEILLANCE</h2>
<p>Atlas says the Babel Street trial period allowed its investigator to find information about visitors to high-risk targets such as mosques, synagogues, courtrooms and abortion clinics. In one video, an Atlas investigator showed how they isolated mobile devices seen in a New Jersey courtroom parking lot that was reserved for jurors, and then tracked one likely juror’s phone to their home address over several days.</p>
<p>While the Atlas investigator had access to its trial account at Babel Street, they were able to successfully track devices belonging to several plaintiffs named or referenced in the lawsuit. They did so by drawing a digital polygon around the home address or workplace of each person in Babel Street’s platform, which focused exclusively on the devices that passed through those addresses each day.</p>
<div id="attachment_69273" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69273" decoding="async" loading="lazy" class=" wp-image-69273" src="media/c2d62942.sinai-temple.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/sinai-temple.jpeg" alt="" width="750" height="648" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/sinai-temple.jpeg 1446w, https://krebsonsecurity.com/wp-content/uploads/2024/10/sinai-temple-768x664.jpeg 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/sinai-temple-782x676.jpeg 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69273" class="wp-caption-text">Each red dot in this Babel Street map represents a unique mobile device that has been seen since April 2022 at a Jewish synagogue in Los Angeles, Calif. Image: Atlas Data Privacy Corp.</p></div>
<p>One unique feature of Babel Street is the ability to toggle a “night” mode, which makes it relatively easy to determine within a few meters where a target typically lays their head each night (because their phone is usually not far away).</p>
<p>Atlas plaintiffs <strong>Scott</strong> and <strong>Justyna Maloney</strong> are both veteran officers with the Rahway, NJ police department who live together with their two young children. In April 2023, Scott and Justyna became the target of intense harassment and death threats after Officer Justyna responded to a routine call about a man filming people outside of the Motor Vehicle Commission in Rahway.</p>
<p>The <a href="https://www.youtube.com/watch?v=sfEZWtC9bdI" target="_blank" rel="noopener">man filming</a> the Motor Vehicle Commission that day is a social media personality who often solicits police contact and then records himself arguing about constitutional rights with the responding officers.</p>
<p>Officer Justyna’s interaction with the man was entirely peaceful, and the episode appeared to end without incident. But after a selectively edited video of that encounter went viral, their home address and unpublished phone numbers were posted online. When their tormentors figured out that Scott was also a cop (a sergeant), the couple began receiving dozens of threatening text messages, including specific death threats.</p>
<p>According to the Atlas lawsuit, one of the messages to Mr. Maloney demanded money, and warned that his family would &#8220;pay in blood&#8221; if he didn’t comply. Sgt. Maloney said he then received a video in which a masked individual pointed a rifle at the camera and told him that his family was &#8220;going to get [their] heads cut off.&#8221;</p>
<p>Maloney said a few weeks later, one of their neighbors saw two suspicious individuals in ski masks parked one block away from the home and alerted police. Atlas’s complaint says video surveillance from neighboring homes shows the masked individuals circling the Maloney’s home. The responding officers arrested two men, who were armed, for unlawful possession of a firearm.</p>
<div id="attachment_69289" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69289" decoding="async" loading="lazy" class=" wp-image-69289" src="media/1f3bec49.babelstbldg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/babelstbldg.png" alt="" width="748" height="437" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/babelstbldg.png 1457w, https://krebsonsecurity.com/wp-content/uploads/2024/10/babelstbldg-768x449.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/babelstbldg-782x457.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-69289" class="wp-caption-text">According to Google Maps, Babel Street shares a corporate address with Google and the consumer credit reporting bureau TransUnion.</p></div>
<p>Atlas said their investigator was not able to conclusively find Scott Maloney’s iPhone in the Babel Street platform, but they did find Justyna’s. Babel Street had nearly 100,000 hits for her phone over several months, allowing Atlas to piece together an intimate picture of Justyna’s daily movements and meetings with others.<span id="more-69216"></span></p>
<p>An Atlas investigator visited the Maloneys and inspected Justyna’s iPhone, and determined the only app that used her device’s location data was from the department store <strong>Macy’s</strong>.</p>
<p>In a written response to questions, Macy&#8217;s said its app includes an opt-in feature for geo-location, &#8220;which allows customers to receive an enhanced shopping experience based on their location.&#8221;</p>
<p>&#8220;We do not store any customer location information,&#8221; Macy&#8217;s wrote. &#8220;We share geo-location data with a <a href="https://www.macys.com/ads.txt" target="_blank" rel="noopener">limited number of partners</a> who help us deliver this enhanced app experience. Furthermore, we have no connection with Babel Street&#8221; [link added for context].</p>
<p>Justyna’s experience highlights a stark reality about the broad availability of mobile location data: Even if the person you’re looking for isn’t directly identifiable in platforms like Babel Street, it is likely that at least some of that person’s family members are. In other words, it’s often trivial to infer the location of one device by successfully locating another.</p>
<p>The terms of service for Babel Street’s Locate X service state that the product &#8220;may not be used as the basis for any legal process in any country, including as the basis for a warrant, subpoena, or any other legal or administrative action.&#8221; But Scott Maloney said he’s convinced by their experience that not even law enforcement agencies should have access to this capability without a warrant.</p>
<p>&#8220;As a law enforcement officer, in order for me to track someone I need a judge to sign a warrant &#8211; and that&#8217;s for a criminal investigation after we&#8217;ve developed probable cause,&#8221; Mr. Maloney said in an interview. &#8220;Data brokers tracking me and my family just to sell that information for profit, without our consent, and even after we&#8217;ve explicitly asked them not to is deeply disturbing.&#8221;</p>
<p>Mr. Maloney’s law enforcement colleagues in other states may see things differently. In August, <strong>The Texas Observer</strong> <a href="https://www.texasobserver.org/texas-dps-surveillance-tangle-cobwebs/" target="_blank" rel="noopener">reported</a> that state police plan to spend more than $5 million on a contract for a controversial surveillance tool called <strong>Tangles</strong> from the tech firm PenLink. Tangles is an AI-based web platform that scrapes information from the open, deep and dark web, and it has a premier feature called <strong>WebLoc</strong> that can be used to geofence mobile devices.</p>
<p>The <strong>Associated Press</strong> <a href="https://apnews.com/article/technology-police-government-surveillance-d395409ef5a8c6c3f6cdab5b1d0e27ef" target="_blank" rel="noopener">reported last month</a> that law enforcement agencies from suburban Southern California to rural North Carolina have been using an obscure cell phone tracking tool called <strong>Fog Reveal</strong> — at times without warrants — that gives them the ability to follow people’s movements going back many months.</p>
<p>It remains unclear precisely how Babel Street is obtaining the abundance of mobile location data made available to users of its platform. The company did not respond to multiple requests for comment.</p>
<p>But according to <a href="media/7db0ae13.2020-HQFO-01656.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/2020-HQFO-01656.pdf" target="_blank" rel="noopener">a document</a> (PDF) obtained under a Freedom of Information Act request with the Department of Homeland Security&#8217;s Science and Technology directorate, Babel Street re-hosts data from the commercial phone tracking firm <strong>Venntel</strong>.</p>
<p>On Monday, the Substack newsletter <strong>All-Source Intelligence</strong> <a href="https://www.usaspending.gov/award/CONT_AWD_29FTC124C0060_2900_-NONE-_-NONE-" target="_blank" rel="noopener">unearthed documents</a> indicating that the <strong>U.S. Federal Trade Commission</strong> has opened an inquiry into Venntel and its parent company Gravy Analytics.</p>
<p>&#8220;Venntel has also been a data partner of the police surveillance contractor Fog Data Science, whose product has been described as ‘mass surveillance on a budget,'&#8221; All-Source&#8217;s <strong>Jack Poulson</strong> <a href="https://jackpoulson.substack.com/p/ftc-opened-investigation-into-commercial" target="_blank" rel="noopener">wrote</a>. &#8220;Venntel was also reported to have been a primary data source of the controversial ‘Locate X’ phone tracking product of the American data fusion company Babel Street.&#8221;</p>
<h2>MAID IN HELL</h2>
<p>The Mobile Advertising ID or MAID — the unique alphanumeric identifier assigned to each mobile device — was originally envisioned as a way to distinguish individual mobile customers without relying on personally identifiable information such as phone numbers or email addresses.</p>
<p>However, there is now <a href="https://datarade.ai/data-categories/device-graph-data" target="_blank" rel="noopener">a robust industry</a> of marketing and advertising companies that specialize in assembling enormous lists of MAIDs that are &#8220;enriched&#8221; with historical and personal information about the individual behind each MAID.</p>
<div id="attachment_69270" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69270" decoding="async" loading="lazy" class=" wp-image-69270" src="media/0926445e.bigdbm-us-maid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/bigdbm-us-maid.png" alt="" width="750" height="411" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/bigdbm-us-maid.png 1186w, https://krebsonsecurity.com/wp-content/uploads/2024/10/bigdbm-us-maid-768x420.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/bigdbm-us-maid-782x428.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69270" class="wp-caption-text">One of many vendors that &#8220;enrich&#8221; MAID data with other identifying information, including name, address, email address and phone number.</p></div>
<p>Atlas said its investigator wanted to know whether they could find enriched MAID records on their New Jersey law enforcement customers, and soon found plenty of ad data brokers willing to sell it.</p>
<p>Some vendors offered only a handful of data fields, such as first and last name, MAID and email address. Other brokers sold far more detailed histories along with their MAID, including each subject’s social media profiles, precise GPS coordinates, and even likely consumer category.</p>
<p>How are advertisers and data brokers gaining access to so much information? Some sources of MAID data can be apps on your phone such as <strong>AccuWeather</strong>, <strong>GasBuddy</strong>, <strong>Grindr</strong>, and <strong>MyFitnessPal</strong> that collect your MAID and location and sell that to brokers.</p>
<p>A user&#8217;s MAID profile and location data also is commonly shared as a consequence of simply using a smartphone to visit a web page that features ads. In the few milliseconds before those ads load, the website will send a &#8220;<strong>bid request</strong>&#8221; to various ad exchanges, where advertisers can bid on the chance to place their ad in front of users who match the consumer profiles they’re seeking. A great deal of data can be included in a bid request, including the user&#8217;s precise location (the current open standard for bid requests is detailed <a href="https://iabtechlab.com/standards/openrtb/" target="_blank" rel="noopener">here</a>).</p>
<p>The trouble is that virtually anyone can access the &#8220;bidstream&#8221; data flowing through these so-called &#8220;<strong>realtime bidding</strong>&#8221; networks, because the information is simultaneously broadcast in the clear to hundreds of entities around the world.</p>
<p>The result is that there are a number of marketing companies that now enrich and broker access to this mobile location information. Earlier this year, the German news outlet <strong>netzpolitik.org</strong> purchased a bidstream data set containing more than 3.6 billion data points, and shared the information with the German daily <strong>BR24</strong>. They concluded that the data they obtained (through a free trial, no less) made it possible to establish movement profiles — some of them quite precise — of <a href="https://interaktiv.br.de/ausspioniert-mit-standortdaten/en/index.html" target="_blank" rel="noopener">several million people across Germany</a>.</p>
<div id="attachment_69268" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69268" decoding="async" loading="lazy" class=" wp-image-69268" src="media/1ccba2a5.br24-netzpolitik.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/br24-netzpolitik.png" alt="" width="750" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/br24-netzpolitik.png 1279w, https://krebsonsecurity.com/wp-content/uploads/2024/10/br24-netzpolitik-768x504.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/br24-netzpolitik-782x513.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-69268" class="wp-caption-text">A screenshot from the BR24/Netzpolitik story about their ability to track millions of Germans, including many employees of the German Federal Police and Interior Ministry.</p></div>
<p><strong>Politico</strong> recently <a href="https://www.politico.com/newsletters/digital-future-daily/2024/09/23/tk-alfred-top-00180521" target="_blank" rel="noopener">covered</a> startling <a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4941708" target="_blank" rel="noopener">research</a> from universities in New Hampshire, Kentucky and St. Louis that showed how the mobile advertising data they acquired allowed them to link visits from investigators with the <strong>U.S. Securities and Exchange Commission</strong> (SEC) to insiders selling stock before the investigations became public knowledge.</p>
<p>The researchers in that study said they didn&#8217;t attempt to use the same methods to track regulators from other agencies, but that virtually anyone could do it.</p>
<p><strong>Justin Sherman</strong>, a distinguished fellow at Georgetown Law&#8217;s Center for Privacy and Technology, called the research a &#8220;shocking demonstration of what happens when companies can freely harvest Americans’ geolocation data and sell it for their chosen price.&#8221;</p>
<p>&#8220;Politicians should understand how they, their staff, and public servants are threatened by the sale of personal data—and constituent groups should realize that talk of data broker &#8216;controls&#8217; or &#8216;best practices&#8221; is designed by companies to distract from the underlying problems and the comprehensive privacy and security solutions,&#8221; Sherman <a href="https://www.lawfaremedia.org/article/data-brokers-and-threats-to-government-employees" target="_blank" rel="noopener">wrote for Lawfare this week</a>.</p>
<h2>A BIDSTREAM DRAGNET?</h2>
<p>The Orwellian nature of modern mobile advertising networks may soon have far-reaching implications for women’s reproductive rights, as more states move to outlaw abortion within their borders. The 2022 Dobbs decision by the U.S. Supreme Court discarded the federal right to abortion, and 14 states have since enacted strict abortion bans.</p>
<p>Anti-abortion groups are already using mobile advertising data to advance their cause. In May 2023, <strong>The Wall Street Journal</strong> <a href="https://archive.is/IZenH" target="_blank" rel="noopener">reported</a> that an anti-abortion group in Wisconsin used precise geolocation data to direct ads to women it suspected of seeking abortions.</p>
<p>As it stands, there is little to stop anti-abortion groups from purchasing bidstream data (or renting access to a platform like Babel Street) and using it to geofence abortion clinics, potentially revealing all mobile devices transiting through these locations.</p>
<p>Atlas said its investigator geofenced an abortion clinic and was able to identify a likely employee at that clinic, following their daily route to and from that individual&#8217;s home address.</p>
<div id="attachment_69272" style="width: 1610px" class="wp-caption aligncenter"><a href="media/1f815a0a.ab-clinic-employee.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/ab-clinic-employee.jpeg" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69272" decoding="async" loading="lazy" class="wp-image-69272 size-full" src="media/1f815a0a.ab-clinic-employee.jpeg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/ab-clinic-employee.jpeg" alt="" width="1600" height="1195" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/ab-clinic-employee.jpeg 1600w, https://krebsonsecurity.com/wp-content/uploads/2024/10/ab-clinic-employee-768x574.jpeg 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/ab-clinic-employee-1536x1147.jpeg 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/10/ab-clinic-employee-782x584.jpeg 782w" sizes="(max-width: 1600px) 100vw, 1600px" /></a><p id="caption-attachment-69272" class="wp-caption-text">A still shot from a video Atlas shared of its use of Babel Street to identify and track an employee traveling each day between their home and the clinic.</p></div>
<p>Last year, Idaho became the first state to outlaw &#8220;abortion trafficking,&#8221; which the <strong>Idaho Capital Sun</strong> <a href="https://idahocapitalsun.com/2024/08/26/helping-a-minor-travel-for-an-abortion-some-states-have-made-it-a-crime/" target="_blank" rel="noopener">reports</a> is defined as &#8220;recruiting, harboring or transporting a pregnant minor to get an abortion or abortion medication without parental permission.&#8221; Tennessee now has a similar law, and GOP lawmakers in five other states introduced abortion trafficking bills that failed to advance this year, the Sun reports.</p>
<p>Atlas said its investigator used Babel Street to identify and track a person traveling from their home in Alabama &#8212; where abortion is now illegal &#8212; to an abortion clinic just over the border in Tallahassee, Fla. &#8212; and back home again within a few hours. Abortion rights advocates and providers <a href="https://www.npr.org/2024/08/23/nx-s1-5082217/can-alabama-prosecute-someone-for-helping-people-travel-out-of-state-for-an-abortion" target="_blank" rel="noopener">are currently suing Alabama Attorney General Steve Marshall</a>, seeking to block him from prosecuting people who help patients travel out-of-state to end pregnancies.</p>
<p><strong>Eva Galperin</strong>, director of cybersecurity at the <strong>Electronic Frontier Foundation </strong>(EFF), a non-profit digital rights group, said she’s extremely concerned about dragnet surveillance of people crossing state lines in order to get abortions.</p>
<p>&#8220;Specifically, Republican officials from states that have outlawed abortion have made it clear that they are interested in targeting people who have gone to neighboring states in order to get abortions, and to make it more difficult for people who are seeking abortions to go to neighboring states,&#8221; Galperin said. &#8220;It&#8217;s not a great leap to imagine that states will do this.&#8221;</p>
<h2>APPLES AND GOOGLES</h2>
<p>Atlas found that for the right price (typically $10-50k a year), brokers can provide access to tens of billions of data points covering large swaths of the US population and the rest of the world.</p>
<p>Based on the data sets Atlas acquired — many of which included older MAID records — they estimate they could locate roughly 80 percent of Android-based devices, and about 25 percent of Apple phones. Google refers to its MAID as the &#8220;<strong>Android Advertising ID</strong>,&#8221; (AAID) while Apple calls it the &#8220;<strong>Identifier for Advertisers</strong>&#8221; (IDFA).</p>
<p>What accounts for the disparity between the number of Android and Apple devices that can be found in mobile advertising data? In April 2021, Apple shipped version 14.5 of its iOS operating system, which introduced a technology called <strong>App Tracking Transparency</strong> (ATT) that requires apps to get affirmative consent before they can track users by their IDFA or any other identifier.</p>
<p>Apple&#8217;s introduction of ATT had a swift and profound impact on the advertising market: Less than a year later Facebook <a href="https://www.cnbc.com/2022/02/02/facebook-says-apple-ios-privacy-change-will-cost-10-billion-this-year.html" target="_blank" rel="noopener">disclosed</a> that the iPhone privacy feature would decrease the company’s 2022 revenues by about $10 billion.</p>
<div id="attachment_69274" style="width: 890px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69274" decoding="async" loading="lazy" class="size-full wp-image-69274" src="media/a8819d7c.fb-2022-down10b.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/fb-2022-down10b.png" alt="" width="880" height="324" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/fb-2022-down10b.png 880w, https://krebsonsecurity.com/wp-content/uploads/2024/10/fb-2022-down10b-768x283.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/fb-2022-down10b-782x288.png 782w" sizes="(max-width: 880px) 100vw, 880px" /><p id="caption-attachment-69274" class="wp-caption-text">Source: cnbc.com.</p></div>
<p>Google runs by far the world&#8217;s largest ad exchange, known as <strong>AdX</strong>. The <strong>U.S. Department of Justice</strong>, which has <a href="https://www.nytimes.com/2024/09/20/technology/google-ad-antitrust-trial-arguments.html" target="_blank" rel="noopener">accused Google of building a monopoly</a> over the technology that places ads on websites, estimates that Google&#8217;s ad exchange controls 47 percent of the U.S. market and 56 percent globally.</p>
<p>Google&#8217;s <strong>Android</strong> is also the dominant mobile operating system worldwide, with more than 72 percent of the market. In the U.S., however, iPhone users claim approximately 55 percent of the market, according to <a href="https://www.techrepublic.com/article/ios-vs-android-market-share/" target="_blank" rel="noopener">TechRepublic</a>.</p>
<p>In response to requests for comment, Google said it does not send real time bidding requests to Babel Street, nor does it share precise location data in bid requests. The company added that its policies explicitly prohibit the sale of data from real-time bidding, or its use for any purpose other than advertising.</p>
<p>Google said its MAIDs are randomly generated and do not contain IP addresses, GPS coordinates, or any other location data, and that its ad systems do not share anyone’s precise location data.</p>
<p>&#8220;Android has clear controls for users to manage app access to device location, and reset or delete their advertising ID,&#8221; Google’s written statement reads. &#8220;If we learn that someone, whether an app developer, ad tech company or anyone else, is violating our policies, we take appropriate action. Beyond that, we support legislation and industry collaboration to address these types of data practices that negatively affect the entire mobile ecosystem, including all operating systems.&#8221;</p>
<p>In a written statement shared with reporters, Apple said Location Services is not on by default in its devices. Rather, users must enable Location Services and must give permission to each app or website to use location data. Users can turn Location Services off at any time, and can change whether apps have access to location at any time. The user&#8217;s choices include precise vs. approximate location, as well as a one-time grant of location access by the app.</p>
<p>&#8220;We believe that privacy is a fundamental human right, and build privacy protections into each of our products and services to put the user in control of their data,&#8221; an Apple spokesperson said. &#8220;We minimize personal data collection, and where possible, process data only on users’ devices.&#8221;</p>
<p><strong>Zach Edwards</strong> is a senior threat analyst at the cybersecurity firm <strong>SilentPush</strong> who has studied the location data industry closely. Edwards said Google and Apple can&#8217;t keep pretending like the MAIDs being broadcast into the bidstream from hundreds of millions of American devices aren’t making most people trivially trackable.</p>
<p>&#8220;The privacy risks here will remain until Apple and Google permanently turn off their mobile advertising ID schemes and admit to the American public that this is the technology that has been supporting the global data broker ecosystem,&#8221; he said.</p>
<h2>STATES ACT, WHILE CONGRESS DITHERS</h2>
<p>According to <strong>Bloomberg Law</strong>, between 2019 and 2023, threats against federal judges have more than doubled. Amid increasingly hostile political rhetoric and conspiracy theories against government officials, a growing number of states are <a href="https://news.bloomberglaw.com/us-law-week/cops-battle-data-brokers-for-privacy-in-constitutional-clash" target="_blank" rel="noopener">seeking to pass their own versions of Daniel’s Law</a>.</p>
<p>Last month, a retired <strong>West Virginia</strong> police officer <a href="https://therecord.media/west-virginia-law-enforcement-sues-broker" target="_blank" rel="noopener">filed a class action lawsuit</a> against the people-search service Whitepages for listing their personal information in violation of a statute the state passed in 2021 that largely mirrors Daniel’s Law.</p>
<p>In May 2024, Maryland passed the <strong>Judge Andrew F. Wilkinson Judicial Security Act</strong> — named after a county circuit court judge who was murdered by an individual involved in a divorce proceeding over which he was presiding. The law allows current and former members of the Maryland judiciary to request their personal information not be made available to the public.</p>
<p>Under the Maryland law, personal information can include a home address; telephone number, email address; Social Security number or federal tax ID number; bank account or payment card number; a license plate or other unique vehicle identifier; a birth or marital record; a child’s name, school, or daycare; place of worship; place of employment for a spouse, child, or dependent.</p>
<p>The law firm <strong>Troutman Pepper</strong> <a href="https://www.troutman.com/insights/maryland-enacts-the-judge-andrew-f-wilkinson-judicial-security-act-are-more-daniels-laws-on-the-horizon.html" target="_blank" rel="noopener">writes</a> that &#8220;so far in 2024, 37 states have begun considering or have adopted similar privacy-based legislation designed to protect members of the judiciary and, in some states, other government officials involved in law enforcement.”</p>
<p>Atlas alleges that in response to requests to have data on its New Jersey law enforcement clients scrubbed from consumer records sold by <strong>LexisNexis</strong>, the data broker retaliated by freezing the credit of approximately 18,500 people, and falsely reporting them as identity theft victims.</p>
<p>In addition, Atlas said LexisNexis started returning failure codes indicating they had no record of these individuals, resulting in denials when officers attempted to refinance loans or open new bank accounts.</p>
<p>The data broker industry has responded by having at least 70 of the Atlas lawsuits moved to federal court, and challenging the constitutionality of the New Jersey statute as overly broad and a violation of the First Amendment.</p>
<p>Attorneys for the data broker industry argued in their motion to dismiss that there is “no First Amendment doctrine that exempts a content-based restriction from strict scrutiny just because it has some nexus with a privacy interest.”</p>
<p>Atlas&#8217;s lawyers responded that data covered under Daniel&#8217;s Law &#8212; personal information of New Jersey law enforcement officers &#8212; is not free speech. Atlas notes that while defending against comparable lawsuits, the data broker industry has argued that home address and phone number data are not &#8220;communications.&#8221;</p>
<p>&#8220;Data brokers should not be allowed to argue that information like addresses are not &#8216;communications&#8217; in one context, only to turn around and claim that addresses are protectable communications,&#8221; Atlas <a href="media/d9f82576.FENDANTS-CONSOLIDATED-MOTION-TO-DISMISS-PLAINTIFFS-COMPLAINT.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/5.-PLAINTIFFS-MEMORANDUM-OF-LAW-IN-OPPOSITION-TO-DEFENDANTS-CONSOLIDATED-MOTION-TO-DISMISS-PLAINTIFFS-COMPLAINT.pdf" target="_blank" rel="noopener">argued</a> (PDF). &#8220;Nor can their change of course alter the reality that the data at issue is not speech.&#8221;</p>
<p>The judge overseeing the challenge is expected to rule on the motion to dismiss within the next few weeks. Regardless of the outcome, the decision is likely to be appealed all the way to the U.S. Supreme Court.</p>
<p>Meanwhile, media law experts say they’re concerned that enacting Daniel’s Law in other states could limit the ability of journalists to hold public officials accountable, and allow authorities <a href="https://newjerseymonitor.com/2023/09/21/judge-declines-to-limit-daniels-law-for-reporters/" target="_blank" rel="noopener">to pursue criminal charges against media outlets</a> that publish the same type of public and government records that fuel the people-search industry.</p>
<p><strong>Sen. Ron Wyden</strong> (D-Ore.) said Congress&#8217; failure to regulate data brokers, and the administration&#8217;s continued opposition to bipartisan legislation that would limit data sales to law enforcement, have created this current privacy crisis.</p>
<p>&#8220;Whether location data is being used to identify and expose closeted gay Americans, or to track people as they cross state lines to seek reproductive health care, data brokers are selling Americans&#8217; deepest secrets and exposing them to serious harm, all for a few bucks,” Wyden said in a statement shared with KrebsOnSecurity, 404 Media, Haaretz, NOTUS, and The New York Times.</p>
<p>Sen. Wyden said Google also deserves blame for refusing to follow Apple&#8217;s lead by removing companies&#8217; ability to track phones.</p>
<p>“Google&#8217;s insistence on uniquely tracking Android users &#8211; and allowing ad companies to do so as well &#8211; has created the technical foundations for the surveillance economy and the abuses stemming from it,” Wyden said.</p>
<p>Georgetown Law&#8217;s Justin Sherman said the data broker and mobile ad industries claim there are protections in place to anonymize mobile location data and restrict access to it, and that there are limits to the kinds of invasive inferences one can make from location data. The data broker industry also likes to tout the usefulness of mobile location data in fighting retail fraud, he said.</p>
<p>&#8220;All kinds of things can be inferred from this data, including people being targeted by abusers, or people with a particular health condition or religious belief,&#8221; Sherman said. &#8220;You can track jurors, law enforcement officers visiting the homes of suspects, or military intelligence people meeting with their contacts. The notion that the sale of all this data is preventing harm and fraud is hilarious in light of all the harm it causes enabling people to better target their cyber operations, or learning about people&#8217;s extramarital affairs and extorting public officials.&#8221;</p>
<h2>WHAT CAN YOU DO?</h2>
<p>Privacy experts say disabling or deleting your device&#8217;s MAID will have no effect on how your phone operates, except that you may begin to see far less targeted ads on that device.</p>
<p>Any Android apps with permission to use your location should appear when you navigate to the Settings app, Location, and then App Permissions. &#8220;Allowed all the time&#8221; is the most permissive setting, followed by &#8220;Allowed only while in use,&#8221; &#8220;Ask every time,&#8221; and &#8220;Not allowed.&#8221;</p>
<p>Android users can delete their ad ID permanently, by opening the Settings app and navigating to Privacy &gt; Ads. Tap &#8220;Delete advertising ID,&#8221; then tap it again on the next page to confirm. According to the EFF, this will prevent any app on your phone from accessing the ad ID in the future. Google&#8217;s documentation on this is <a href="https://policies.google.com/technologies/ads?hl=en-US&amp;ref=404media.co" target="_blank" rel="noopener">here</a>.</p>
<div id="attachment_69276" style="width: 660px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69276" decoding="async" loading="lazy" class=" wp-image-69276" src="media/d283d28a.android-ads-optout.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/android-ads-optout.png" alt="" width="650" height="589" /><p id="caption-attachment-69276" class="wp-caption-text">Image: eff.org</p></div>
<p>By default, Apple&#8217;s iOS requires apps to ask permission before they can access your device&#8217;s IDFA. When you install a new app, it may ask for permission to track you. When prompted to do so by an app, select the &#8220;Ask App Not to Track&#8221; option. Apple users also can set the &#8220;Allow apps to request to track&#8221; switch to the &#8220;off&#8221; position, which will block apps from asking to track you.</p>
<div id="attachment_69278" style="width: 585px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69278" decoding="async" loading="lazy" class="size-full wp-image-69278" src="media/e001a1b7.applerequesttotrack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/applerequesttotrack.png" alt="" width="575" height="390" /><p id="caption-attachment-69278" class="wp-caption-text">Apple&#8217;s Privacy and Ad Tracking Settings.</p></div>
<p>Apple also has its own targeted advertising system which is separate from third-party tracking enabled by the IDFA. To disable it, go to Settings, Privacy, and Apple Advertising, and ensure that the &#8220;Personalized Ads&#8221; setting is set to &#8220;off.&#8221;</p>
<p>Finally, if you&#8217;re the type of reader who&#8217;s the default IT support person for a small group of family or friends (bless your heart), it would be a good idea to set their devices not to track them, and to disable any apps that may have location data sharing turned on 24/7.</p>
<p>There is a dual benefit to this altruism, which is clearly in the device owner&#8217;s best interests. Because while <em>your</em> device may not be directly trackable via advertising data, making sure they&#8217;re opted out of said tracking also can reduce the likelihood that you are trackable simply by being physically close to those who <em>are</em>.</p>


feed_id: https://krebsonsecurity.com/?p=69341
title: Change Healthcare Breach Hits 100M Americans
uri: Change-Healthcare-Breach-Hits-100M-Americans
url: https://krebsonsecurity.com/2024/10/change-healthcare-breach-hits-100m-americans/
content:
<p><strong>Change Healthcare</strong> says it has notified approximately 100 million Americans that their personal, financial and healthcare records may have been stolen in a February 2024 ransomware attack that caused the largest ever known data breach of protected health information.</p>
<div id="attachment_69353" style="width: 639px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69353" decoding="async" class="wp-image-69353" src="media/e0c763f7.cardio-epi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/cardio-epi.png" alt="" width="629" height="522" /><p id="caption-attachment-69353" class="wp-caption-text">Image: Tamer Tuncay, Shutterstock.com.</p></div>
<p>A ransomware attack at Change Healthcare in the third week of February quickly spawned disruptions across the U.S. healthcare system that reverberated for months, thanks to the company&#8217;s central role in processing payments and prescriptions on behalf of thousands of organizations.</p>
<p>In April, Change estimated the breach would affect a &#8220;substantial proportion of people in America.&#8221; On Oct 22, the healthcare giant <a href="https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html" target="_blank" rel="noopener">notified</a> the <strong>U.S. Department of Health and Human Resources</strong> (HHS) that &#8220;approximately 100 million notices have been sent regarding this breach.&#8221;</p>
<p>A notification letter from Change Healthcare said the breach involved the theft of:</p>
<p>-Health Data: Medical record #s, doctors, diagnoses, medicines, test results, images, care and treatment;<br />
-Billing Records: Records including payment cards, financial and banking records;<br />
-Personal Data: Social Security number; driver&#8217;s license or state ID number;<br />
-Insurance Data: Health plans/policies, insurance companies, member/group ID numbers, and Medicaid-Medicare-government payor ID numbers.</p>
<p>The <em>HIPAA Journal</em> <a href="https://www.hipaajournal.com/change-healthcare-responding-to-cyberattack/" target="_blank" rel="noopener">reports</a> that in the nine months ending on September 30, 2024, Change&#8217;s parent firm <strong>United Health Group</strong> had incurred $1.521 billion in direct breach response costs, and $2.457 billion in total cyberattack impacts.</p>
<p>Those costs include $22 million the company admitted to paying their extortionists &#8212; a ransomware group known as <strong>BlackCat</strong> and <strong>ALPHV</strong> &#8212; in exchange for a promise to destroy the stolen healthcare data.</p>
<p>That ransom payment <a href="https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/" target="_blank" rel="noopener">went sideways</a> when the affiliate who gave BlackCat access to Change&#8217;s network said the crime gang had cheated them out of their share of the ransom. The entire BlackCat ransomware operation shut down after that, absconding with all of the money still owed to affiliates who were hired to install their ransomware.<span id="more-69341"></span></p>
<div id="attachment_69348" style="width: 260px" class="wp-caption alignright"><a href="media/c16d0236.changeletterr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/changeletterr.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-69348" decoding="async" loading="lazy" class="wp-image-69348" src="media/c16d0236.changeletterr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/changeletterr.png" alt="" width="250" height="338" /></a><p id="caption-attachment-69348" class="wp-caption-text">A breach notification from Change Healthcare.</p></div>
<p>A few days after BlackCat imploded, the same stolen healthcare data was offered for sale by a competing ransomware affiliate group called <strong>RansomHub</strong>.</p>
<p>&#8220;Affected insurance providers can contact us to prevent leaking of their own data and [remove it] from the sale,&#8221; RansomHub&#8217;s victim shaming blog announced on April 16. &#8220;Change Health and United Health processing of sensitive data for all of these companies is just something unbelievable. For most US individuals out there doubting us, we probably have your personal data.&#8221;</p>
<p>It remains unclear if RansomHub ever sold the stolen healthcare data. The chief information security officer for a large academic healthcare system affected by the breach told KrebsOnSecurity they participated in a call with the FBI and were told a third party partner managed to recover at least four terabytes of data that was exfiltrated from Change by the cybercriminal group. The FBI did not respond to a request for comment.</p>
<p>Change Healthcare&#8217;s breach notification letter offers recipients two years of credit monitoring and identity theft protection services from a company called <strong>IDX</strong>. In the section of the missive titled &#8220;Why did this happen?,&#8221; Change shared only that &#8220;a cybercriminal accessed our computer system without our permission.&#8221;</p>
<p>But in June 2024 testimony to the Senate Finance Committee, <a href="https://www.hipaajournal.com/change-healthcare-responding-to-cyberattack/#:~:text=As%20covered%20by%20The%20HIPAA,exposed%20to%20the%20public%20Internet." target="_blank" rel="noopener">it emerged</a> that the intruders had stolen or purchased credentials for a Citrix portal used for remote access, and that no multi-factor authentication was required for that account.</p>
<p>Last month, <strong>Sens. Mark Warner</strong> (D-Va.) and <strong>Ron Wyden</strong> (D-Ore.) <a href="https://www.finance.senate.gov/chairmans-news/wyden-and-warner-introduce-bill-to-set-strong-cybersecurity-standards-for-american-health-care-system" target="_blank" rel="noopener">introduced a bill</a> that would require HHS to develop and enforce a set of tough minimum cybersecurity standards for healthcare providers, health plans, clearinghouses and businesses associates. The measure also would remove the existing cap on fines under the Health Insurance Portability and Accountability Act, which severely limits the financial penalties HHS can issue against providers.</p>
<p>According to the HIPAA Journal, the biggest penalty imposed to date for a HIPAA violation was the paltry $16 million fine against the insurer <strong>Anthem Inc.</strong>, which suffered a data breach in 2015 affecting 78.8 million individuals. Anthem reported revenues of around $80 billion in 2015.</p>
<div id="attachment_69358" style="width: 723px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69358" decoding="async" loading="lazy" class=" wp-image-69358" src="media/e7f7dc54.ransomhub-change.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/ransomhub-change.png" alt="" width="713" height="667" /><p id="caption-attachment-69358" class="wp-caption-text">A post about the Change breach from RansomHub on April 8, 2024. Image: Darkbeast, ke-la.com.</p></div>
<p>There is little that victims of this breach can do about the compromise of their healthcare records. However, because the data exposed includes more than enough information for identity thieves to do their thing, it would be prudent to place a security freeze on your credit file and on that of your family members if you haven&#8217;t already.</p>
<p>The best mechanism for preventing identity thieves from creating new accounts in your name is to freeze your credit file with <strong><a href="https://www.equifax.com" target="_blank" rel="noopener">Equifax</a>, <a href="https://www.experian.com" target="_blank" rel="noopener">Experian</a>,</strong> and <a href="https://www.transunion.com" target="_blank" rel="noopener"><strong>TransUnion</strong></a>. This process is now free for all Americans, and simply blocks potential creditors from viewing your credit file. Parents and guardians can now also freeze the credit files for their children or dependents.</p>
<p>Since very few creditors are willing to grant new lines of credit without being able to determine how risky it is to do so, freezing your credit file with the Big Three is a great way to stymie all sorts of ID theft shenanigans. Having a freeze in place does nothing to prevent you from using existing lines of credit you may already have, such as credit cards, mortgage and bank accounts. When and if you ever do need to allow access to your credit file &#8212; such as when applying for a loan or new credit card &#8212; you will need to lift or temporarily thaw the freeze in advance with one or more of the bureaus.</p>
<p>All three bureaus allow users to place a freeze electronically after creating an account, but all of them try to steer consumers away from enacting a freeze. Instead, the bureaus are hoping consumers will opt for their confusingly named &#8220;credit lock&#8221; services, which accomplish the same result but allow the bureaus to continue selling access to your file to select partners.</p>
<p>If you haven&#8217;t done so in a while, now would be an excellent time to review your credit file for any mischief or errors. By law, everyone is entitled to <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">one free credit report every 12 months</a> from each of the three credit reporting agencies. But the Federal Trade Commission <a href="https://consumer.ftc.gov/consumer-alerts/2023/10/you-now-have-permanent-access-free-weekly-credit-reports" target="_blank" rel="noopener">notes</a> that the big three bureaus have permanently extended a program enacted in 2020 that lets you check your credit report at each of the agencies once a week for free.</p>


feed_id: https://krebsonsecurity.com/?p=69374
title: Booking.com Phishers May Leave You With Reservations
uri: Booking-com-Phishers-May-Leave-You-With-Reservations
url: https://krebsonsecurity.com/2024/11/booking-com-phishers-may-leave-you-with-reservations/
content:
<p>A number of cybercriminal innovations are making it easier for scammers to cash in on your upcoming travel plans. This story examines a recent spear-phishing campaign that ensued when a California hotel had its <strong>booking.com</strong> credentials stolen. We&#8217;ll also explore an array of cybercrime services aimed at phishers who target hotels that rely on the world&#8217;s most visited travel website.</p>
<p>According to the market share website <strong>statista.com</strong>, booking.com is by far the Internet&#8217;s busiest travel service, with nearly 550 million visits in September. KrebsOnSecurity last week heard from a reader whose close friend received a targeted phishing message within the Booking mobile app just minutes after making a reservation at a California.</p>
<p>The missive bore the name of the hotel and referenced details from their reservation, claiming that booking.com&#8217;s anti-fraud system required additional information about the customer before the reservation could be finalized.</p>
<div id="attachment_69390" style="width: 425px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69390" decoding="async" class="size-full wp-image-69390" src="media/9aac77c8.bookingcomphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/bookingcomphish.png" alt="" width="415" height="725" /><p id="caption-attachment-69390" class="wp-caption-text">The phishing message our reader&#8217;s friend received after making a reservation at booking.com in late October.</p></div>
<p>In an email to KrebsOnSecurity, booking.com confirmed one of its partners had suffered a security incident that allowed unauthorized access to customer booking information.</p>
<p>&#8220;Our security teams are currently investigating the incident you mentioned and can confirm that it was indeed a phishing attack targeting one of our accommodation partners, which unfortunately is not a new situation and quite common across industries,&#8221; booking.com replied. &#8220;Importantly, we want to clarify that there has been no compromise of Booking.com&#8217;s internal systems.&#8221;</p>
<div id="attachment_69387" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69387" decoding="async" loading="lazy" class=" wp-image-69387" src="media/177fd878.bookingdotcomphishingsite.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/bookingdotcomphishingsite.png" alt="" width="749" height="458" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/bookingdotcomphishingsite.png 1558w, https://krebsonsecurity.com/wp-content/uploads/2024/11/bookingdotcomphishingsite-768x470.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/bookingdotcomphishingsite-1536x940.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/11/bookingdotcomphishingsite-782x478.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-69387" class="wp-caption-text">The phony booking.com website generated by visiting the link in the text message.</p></div>
<p>Booking.com said it now <a href="https://partner.booking.com/en-gb/help/legal-security/security/securing-your-account" target="_blank" rel="noopener">requires 2FA</a>, which forces partners to provide a one-time passcode from a mobile authentication app (Pulse) in addition to a username and password.</p>
<p>&#8220;2FA is required and enforced, including for partners to access payment details from customers securely,&#8221; a booking.com spokesperson wrote. &#8220;That&#8217;s why the cybercriminals follow-up with messages to try and get customers to make payments outside of our platform.&#8221;</p>
<p>&#8220;That said, the phishing attacks stem from partners&#8217; machines being compromised with malware, which has enabled them to also gain access to the partners&#8217; accounts and to send the messages that your reader has flagged,&#8221; they continued.</p>
<p>It&#8217;s unclear, however, if the company&#8217;s 2FA requirement is enforced for all or just newer partners. Booking.com did not respond to questions about that, and its current <a href="https://www.booking.com/trust-and-safety/partners.en-gb.html#tns_partners_account_safe" target="_blank" rel="noopener">account security advice</a> urges customers to enable 2FA.</p>
<div id="attachment_69410" style="width: 631px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69410" decoding="async" loading="lazy" class=" wp-image-69410" src="media/b724a75e.whybooking.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/whybooking.png" alt="" width="621" height="171" /><p id="caption-attachment-69410" class="wp-caption-text">A scan of social media networks showed this is not an uncommon scam.</p></div>
<p>In November 2023, the security firm <strong>SecureWorks</strong> <a href="https://www.secureworks.com/blog/vidar-infostealer-steals-booking-com-credentials-in-fraud-scam" target="_blank" rel="noopener">detailed</a> how scammers targeted booking.com hospitality partners with data-stealing malware. SecureWorks said these attacks had been going on since at least March 2023.</p>
<p>&#8220;The hotel did not enable multi-factor authentication (MFA) on its Booking.com access, so logging into the account with the stolen credentials was easy,&#8221; SecureWorks said of the booking.com partner it investigated.</p>
<p>In June 2024, booking.com <a href="https://www.bbc.com/news/articles/c8003dd8jzeo" target="_blank" rel="noopener">told the BBC</a> that phishing attacks targeting travelers had increased 900 percent, and that thieves taking advantage of new artificial intelligence (AI) tools were the primary driver of this trend.</p>
<p>Booking.com told the BCC the company had started using AI to fight AI-based phishing attacks. Booking.com&#8217;s statement said their investments in that arena &#8220;blocked 85 million fraudulent reservations over more than 1.5 million phishing attempts in 2023.&#8221;</p>
<p><span id="more-69374"></span></p>
<p>The domain name in the phony booking.com website sent to our reader&#8217;s friend &#8212; <strong>guestssecureverification[.]com</strong> &#8212; was registered to the email address <strong>ilotirabec207@gmail.com</strong>. According to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a>, this email address was used to register more than 700 other phishing domains in the past month alone.</p>
<p>Many of the 700+ domains appear to target hospitality companies, including platforms like booking.com and <strong>Airbnb</strong>. Others seem crafted to phish users of <strong>Shopify</strong>, <strong>Steam</strong>, and a variety of financial platforms. A full, defanged list of domains is available <a href="https://docs.google.com/spreadsheets/d/1k8c2d2XZLXIG9tFUaU6MGRK-puAKxoCuWuzB8GSqkAM/edit?usp=sharing" target="_blank" rel="noopener">here</a>.</p>
<p>A cursory review of recent posts across dozens of cybercrime forums monitored by the security firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> shows there is a great demand for compromised booking.com accounts belonging to hotels and other partners.</p>
<p>One post last month on the Russian-language hacking forum <strong>BHF</strong> offered up to $5,000 for each hotel account. This seller claims to help people monetize hacked booking.com partners, apparently by using the stolen credentials to set up fraudulent listings.</p>
<p>A service advertised on the English-language crime community <strong>BreachForums</strong> in October courts phishers who may need help with certain aspects of their phishing campaigns targeting booking.com partners. Those include more than two million hotel email addresses, and services designed to help phishers organize large volumes of phished records. Customers can interact with the service via an automated Telegram bot.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-69394" src="media/1f803db4.airbnb-bf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/airbnb-bf.png" alt="" width="747" height="588" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/airbnb-bf.png 952w, https://krebsonsecurity.com/wp-content/uploads/2024/11/airbnb-bf-768x605.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/airbnb-bf-782x616.png 782w" sizes="(max-width: 747px) 100vw, 747px" /></p>
<p>Some cybercriminals appear to have used compromised booking.com accounts to power their own travel agencies catering to fellow scammers, with up to 50 percent discounts on hotel reservations through booking.com. Others are selling ready-to-use &#8220;config&#8221; files designed to make it simple to conduct automated login attempts against booking.com administrator accounts.</p>
<p>SecureWorks found the phishers targeting booking.com partner hotels used malware to steal credentials. But today&#8217;s thieves can just as easily just visit crime bazaars online and purchase stolen credentials to cloud services that do not enforce 2FA for all accounts.</p>
<p>That is <a href="https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/" target="_blank" rel="noopener">exactly what transpired</a> over the past year with many customers of the cloud data storage giant <strong>Snowflake</strong>. In late 2023, cybercriminals figured out that while tons of companies had stashed enormous amounts of customer data at Snowflake, many of those customer accounts were not protected by 2FA.</p>
<p>Snowflake responded by making 2FA mandatory for all new customers. But that change came only after thieves used stolen credentials to siphon data from 160 companies &#8212; including <strong>AT&amp;T</strong>, <strong>Lending Tree</strong> and <strong>TicketMaster</strong>.</p>


feed_id: https://krebsonsecurity.com/?p=67735
title: Canadian Man Arrested in Snowflake Data Extortions
uri: Canadian-Man-Arrested-in-Snowflake-Data-Extortions
url: https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/
content:
<p>A 26-year-old man in Ontario, Canada has been arrested for allegedly stealing data from and extorting more than 160 companies that used the cloud data service <strong>Snowflake</strong>.</p>
<div id="attachment_69434" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-69434" decoding="async" class="wp-image-69434" src="media/516630eb.snowflaking.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/11/snowflaking.png" alt="" width="748" height="432" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/11/snowflaking.png 983w, https://krebsonsecurity.com/wp-content/uploads/2024/11/snowflaking-768x443.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/11/snowflaking-782x451.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-69434" class="wp-caption-text">Image: https://www.pomerium.com/blog/the-real-lessons-from-the-snowflake-breach</p></div>
<p>On October 30, Canadian authorities arrested <strong>Alexander Moucka, </strong>a.k.a.<strong> Connor Riley Moucka </strong>of Kitchener, Ontario, on a provisional arrest warrant from the United States. Bloomberg first <a href="https://www.bloomberg.com/news/articles/2024-11-05/hacker-said-to-be-behind-breach-of-snowflake-customers-arrested?embedded-checkout=true" target="_blank" rel="noopener">reported</a> Moucka&#8217;s alleged ties to the Snowflake hacks on Monday.</p>
<p>At the end of 2023, malicious hackers learned that many large companies had uploaded huge volumes of sensitive customer data to Snowflake accounts that were protected with little more than a username and password (no multi-factor authentication required). After scouring darknet markets for stolen Snowflake account credentials, the hackers began raiding the data storage repositories used by some of the world’s largest corporations.</p>
<p>Among those was <strong>AT&amp;T</strong>, which <a href="https://krebsonsecurity.com/2024/07/hackers-steal-phone-sms-records-for-nearly-all-att-customers/" target="_blank" rel="noopener">disclosed in July</a> that cybercriminals had stolen personal information and phone and text message records for roughly 110 million people — nearly all of its customers. <strong>Wired.com</strong> <a href="https://www.wired.com/story/atandt-paid-hacker-300000-to-delete-stolen-call-records/" target="_blank" rel="noopener">reported in July</a> that AT&amp;T paid a hacker $370,000 to delete stolen phone records.</p>
<p>A report on the extortion attacks from the incident response firm <strong>Mandiant</strong> notes that Snowflake victim companies were privately approached by the hackers, who demanded a ransom in exchange for a promise not to sell or leak the stolen data. All told, more than 160 Snowflake customers were relieved of data, including <strong>TicketMaster</strong>, <strong>Lending Tree</strong>, <strong>Advance Auto Parts</strong> and <strong>Neiman Marcus</strong>.</p>
<p>Moucka is alleged to have used the hacker handles <strong>Judische</strong> and <strong>Waifu</strong>, among many others. These monikers correspond to a prolific cybercriminal whose exploits were the subject of <a href="https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com" target="_blank" rel="noopener">a recent story published here</a> about the overlap between Western, English-speaking cybercriminals and extremist groups that harass and extort minors into harming themselves or others.</p>
<p>On May 2, 2024, Judische claimed on the fraud-focused Telegram channel <strong>Star Chat</strong> that they had hacked <strong>Santander Bank</strong>, one of the first known Snowflake victims. Judische would repeat that claim in Star Chat on May 13 — the day before Santander publicly disclosed a data breach — and would periodically blurt out the names of other Snowflake victims before their data even went up for sale on the cybercrime forums.</p>
<p>404 Media <a href="https://www.404media.co/alleged-snowflake-hacker-appears-in-court-says-prison-in-lockdown/" target="_blank" rel="noopener">reports</a> that at a court hearing in Ontario this morning, Moucka called in from a prison phone and said he was seeking legal aid to hire an attorney.</p>
<p>KrebsOnSecurity has learned that Moucka is currently named in multiple indictments issued by U.S. prosecutors and federal law enforcement agencies. However, it is unclear which specific charges the indictments contain, as all of those cases remain under seal.</p>
<h2>TELECOM DOMINOES</h2>
<p>Mandiant has attributed the Snowflake compromises to a group it calls “<strong>UNC5537</strong>,” with members based in North America and <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">Turkey</a>. Sources close to the investigation tell KrebsOnSecurity the UNC5537 member in Turkey is <strong>John Erin Binns</strong>, an elusive American man indicted by the <strong>U.S. Department of Justice</strong> (DOJ) for <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">a 2021 breach at T-Mobile</a> that exposed the personal information of at least 76.6 million customers.</p>
<p>In a statement on Moucka&#8217;s arrest, Mandiant said UNC5537 aka Alexander ‘Connor’ Moucka has proven to be one of the most consequential threat actors of 2024. </p>
<p>&#8220;In April 2024, UNC5537 launched a campaign, systematically compromising misconfigured SaaS instances across over a hundred organizations,&#8221; wrote <strong>Austin Larsen</strong>, Mandiant&#8217;s senior threat analyst. &#8220;The operation, which left organizations reeling from significant data loss and extortion attempts, highlighted the alarming scale of harm an individual can cause using off-the-shelf tools.&#8221;</p>
<p>Sources involved in the investigation said UNC5537 has focused on hacking into telecommunications companies around the world. Those sources told KrebsOnSecurity that Binns and Judische are suspected of <a href="https://economictimes.indiatimes.com/tech/technology/bsnl-suffers-second-data-breach-in-six-months/articleshow/111264707.cms?from=mdr" target="_blank" rel="noopener">stealing data from India&#8217;s largest state-run telecommunications firm</a> <strong>Bharat Sanchar Nigam Ltd</strong> (BNSL), and that the duo even bragged about being able to intercept or divert phone calls and text messages for a large portion of the population of India.</p>
<p>Judische appears to have outsourced the sale of databases from victim companies who refuse to pay, delegating some of that work to a cybercriminal who uses the nickname <strong>Kiberphant0m</strong> on multiple forums. In late May 2024, Kiberphant0m began advertising the sale of hundreds of gigabytes of data stolen from BSNL.</p>
<p>&#8220;Information is worth several million dollars but I&#8217;m selling for pretty cheap,&#8221; Kiberphant0m wrote of the BSNL data in a post on the English-language cybercrime community <strong>Breach Forums</strong>. &#8220;Negotiate a deal in Telegram.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-69334" src="media/8fbc0bcb.kiberphant0m-bf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/10/kiberphant0m-bf.png" alt="" width="750" height="310" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/10/kiberphant0m-bf.png 1115w, https://krebsonsecurity.com/wp-content/uploads/2024/10/kiberphant0m-bf-768x317.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/10/kiberphant0m-bf-782x323.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Also in May 2024, Kiberphant0m took to the Russian-language hacking forum <strong>XSS</strong> to sell more than 250 gigabytes of data stolen from an unnamed mobile telecom provider in Asia, including a database of all active customers and software allowing the sending of text messages to all customers.</p>
<p>On September 3, 2024, Kiberphant0m posted a sales thread on XSS titled &#8220;Selling American Telecom Access (100B+ Revenue).&#8221; Kiberphant0m&#8217;s asking price of $200,000 was apparently too high because they reposted the sales thread on Breach Forums a month later, with a headline that more clearly explained the data was stolen from <strong>Verizon</strong>&#8216;s &#8220;push-to-talk&#8221; (PTT) customers &#8212; primarily U.S. government agencies and first responders.</p>
<p><a href="https://www.404media.co/hackers-advertise-stolen-verizon-push-to-talk-call-logs/" target="_blank" rel="noopener">404Media reported recently</a> that the breach does not appear to impact the main consumer Verizon network. Rather, the hackers broke into a third party provider and stole data on Verizon&#8217;s PTT systems, which are a separate product marketed towards public sector agencies, enterprises, and small businesses to communicate internally.</p>
<h2>INTERVIEW WITH JUDISCHE</h2>
<p>Investigators say Moucka shared a home in Kitchener with other tenants, but not his family. His mother was born in Chechnya, and he speaks Russian in addition to French and English. Moucka&#8217;s father died of a drug overdose at age 26, when the defendant was roughly five years old.</p>
<p>A person claiming to be Judische began communicating with this author more than three months ago on Signal after KrebsOnSecurity started asking around about hacker nicknames previously used by Judische over the years (Waifu, <strong>Ned</strong>, <strong>Nedral Onfroy</strong>, <strong>Noctuliuss</strong>, and <strong>November</strong>).</p>
<p>Judische admitted to stealing and ransoming data from Snowflake customers, but he said he&#8217;s not interested in selling the information, and that others have done this with some of the data sets he stole.</p>
<p>&#8220;I&#8217;m not really someone that sells data unless it&#8217;s crypto [databases] or credit cards because they&#8217;re the only thing I can find buyers for that actually have money for the data,&#8221; Judische told KrebsOnSecurity. &#8220;The rest is just ransom.&#8221;</p>
<p>Judische has sent this reporter dozens of unsolicited and often profane messages from several different Signal accounts, all of which claimed to be an anonymous tipster sharing different identifying details for Judische. This appears to have been an elaborate effort by Judische to &#8220;detrace&#8221; his movements online and muddy the waters about his identity.</p>
<p>Judische frequently claimed he had unparalleled &#8220;<strong>opsec</strong>&#8221; or <strong>operational security</strong>, a term that refers to the ability to compartmentalize and obfuscate one&#8217;s tracks online. On several occasions, he shared screenshots and other information indicating someone with access to intelligence gathered by Mandiant had given him the company&#8217;s assessment of who and where they thought he was.</p>
<p>But in a conversation with KrebsOnSecurity on October 26, Judische acknowledged it was likely that the authorities were closing in on him, and said he would seriously answer certain questions about his personal life.</p>
<p>&#8220;They&#8217;re coming after me for sure,&#8221; he said.<span id="more-67735"></span></p>
<p>In several previous conversations, Judische referenced suffering from an unspecified personality disorder, and when pressed said he has a condition called &#8220;schizotypal personality disorder&#8221; (STPD).</p>
<p>According to the <a href="https://my.clevelandclinic.org/health/diseases/23061-schizotypal-personality-disorder#:~:text=Schizotypal%20personality%20disorder%20(STPD)%20is,to%20form%20and%20maintain%20relationships." target="_blank" rel="noopener">Cleveland Clinic</a>, schizotypal personality disorder is marked by a consistent pattern of intense discomfort with relationships and social interactions: &#8220;People with STPD have unusual thoughts, speech and behaviors, which usually hinder their ability to form and maintain relationships.&#8221;</p>
<p>Judische said he was prescribed medication for his psychological issues, but that he doesn&#8217;t take his meds. Which might explain why he never leaves his home.</p>
<p>&#8220;I never go outside,&#8221; Judische allowed. &#8220;I&#8217;ve never had a friend or true relationship not online nor in person. I see people as vehicles to achieve my ends no matter how friendly I may seem on the surface, which you can see by how fast I discard people who are loyal or [that] I&#8217;ve known a long time.&#8221;</p>
<p>Judische later admitted he doesn&#8217;t have an official STPD diagnosis from a physician, but said he knows that he exhibits all the signs of someone with this condition.</p>
<p>&#8220;I can&#8217;t actually get diagnosed with that either,&#8221; Judische shared. &#8220;Most countries put you on lists and restrict you from certain things if you have it.&#8221;</p>
<p>Asked whether he has always lived at his current residence, Judische replied that he had to leave his hometown for his own safety.</p>
<p>&#8220;I can&#8217;t live safely where I&#8217;m from without getting robbed or arrested,&#8221; he said, without offering more details.</p>
<p>A source familiar with the investigation said Moucka previously lived in Quebec, which he allegedly fled after being charged with harassing others on the social network <strong>Discord</strong>.</p>
<p>Judische claims to have made at least $4 million in his Snowflake extortions. Judische said he and others frequently targeted business process outsourcing (BPO) companies, staffing firms that handle customer service for a wide range of organizations. They also went after managed service providers (MSPs) that oversee IT support and security for multiple companies, he claimed.</p>
<p>&#8220;Snowflake isn&#8217;t even the biggest BPO/MSP multi-company dataset on our networks, but what&#8217;s been exfiltrated from them is well over 100TB,&#8221; Judische bragged. &#8220;Only ones that don&#8217;t pay get disclosed (unless they disclose it themselves). A lot of them don&#8217;t even do their SEC filing and just pay us to fuck off.&#8221;</p>
<h2>INTEL SECRETS</h2>
<p>The other half of UNC5537 &#8212; 24-year-old John Erin Binns &#8212; was arrested in Turkey in late May 2024, and currently resides in a Turkish prison. However, it is unclear if Binns faces any immediate threat of extradition to the United States, where he is currently wanted on criminal hacking charges tied to the 2021 breach at T-Mobile.</p>
<p>A person familiar with the investigation said Binns&#8217;s application for Turkish citizenship was inexplicably approved after his incarceration, leading to speculation that Binns may have bought his way out of a sticky legal situation.</p>
<p>Under the Turkish constitution, a Turkish citizen cannot be extradited to a foreign state. Turkey has been <a href="https://www.fdd.org/analysis/2023/07/20/turkey-is-granting-citizenship-to-international-criminals/" target="_blank" rel="noopener">criticized for its &#8220;golden passport&#8221; program</a>, which provides citizenship and sanctuary for anyone willing to pay several hundred thousand dollars.</p>
<div id="attachment_68097" style="width: 568px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68097" decoding="async" loading="lazy" class="size-full wp-image-68097" src="media/73c67b12.binnspassport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/binnspassport.png" alt="" width="558" height="399" /><p id="caption-attachment-68097" class="wp-caption-text">This is an image of a passport that Binns shared in one of many unsolicited emails to KrebsOnSecurity since 2021. Binns never explained why he sent this in Feb. 2023.</p></div>
<p>Binns&#8217;s alleged hacker alter egos &#8212; &#8220;<strong>IRDev</strong>&#8221; and &#8220;<strong>IntelSecrets</strong>&#8221; &#8212; were at once feared and revered on several cybercrime-focused Telegram communities, because he was known to possess a powerful weapon: A massive botnet. From reviewing the Telegram channels Binns frequented, we can see that others in those communities &#8212; including Judische &#8212; heavily relied on Binns and his botnet for a variety of cybercriminal purposes.</p>
<p>The IntelSecrets nickname corresponds to an individual who has claimed responsibility for modifying the source code for the<a href="https://krebsonsecurity.com/?s=mirai" target="_blank" rel="noopener"> Mirai “Internet of Things” botnet</a> to create a variant known as “<strong>Satori</strong>,” and supplying it to others who used it for criminal gain and <a href="https://krebsonsecurity.com/2019/09/satori-iot-botnet-operator-pleads-guilty/" target="_blank" rel="noopener">were later caught and prosecuted</a>.</p>
<p>Since 2020, Binns has filed a flood of lawsuits naming various federal law enforcement officers and agencies — including the <a href="https://www.courtlistener.com/docket/18719615/13/1/binns-v-federal-bureau-of-investigation/#text" target="_blank" rel="noopener">FBI</a>, the <a href="https://www.courtlistener.com/docket/17348542/binns-v-central-intelligence-agency/" target="_blank" rel="noopener">CIA</a>, and the <a href="media/1070b59f.FOIA20Log20FY202020.pdf" data-original-source="https://www.socom.mil/FOIA/FOIA%20Logs/FOIA%20Log%20FY%202020.pdf" target="_blank" rel="noopener">U.S. Special Operations Command</a> (PDF), demanding that the government turn over information collected about him and seeking restitution for his alleged kidnapping at the hands of the CIA.</p>
<p>Binns claims he was kidnapped in Turkey and subjected to various forms of psychological and physical torture. According to Binns, the <strong>U.S. Central Intelligence Agency</strong> (CIA) falsely told their counterparts in Turkey that he was a supporter or member of the Islamic State (ISIS), a claim he says led to his detention and torture by the Turkish authorities.</p>
<p>However, in a 2020 lawsuit he filed against the CIA, Binns himself acknowledged having visited a previously ISIS-controlled area of Syria prior to moving to Turkey in 2017.</p>
<div id="attachment_68107" style="width: 748px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-68107" decoding="async" loading="lazy" class="size-full wp-image-68107" src="media/b4e32f21.binnscialawsuit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/07/binnscialawsuit.png" alt="" width="738" height="741" /><p id="caption-attachment-68107" class="wp-caption-text">A segment of a lawsuit Binns filed in 2020 against the CIA, in which he alleges U.S. put him on a terror watch list after he traveled to Syria in 2017.</p></div>
<p>Sources familiar with the investigation told KrebsOnSecurity that Binns was so paranoid about possible surveillance on him by American and Turkish intelligence agencies that his erratic behavior and online communications actually brought about the very government snooping that he feared.</p>
<p>In several online chats in late 2023 on Discord, IRDev lamented being lured into a law enforcement sting operation after trying to buy a rocket launcher online. A person close to the investigation confirmed that at the beginning of 2023, IRDev began making earnest inquiries about how to purchase a <a href="https://en.wikipedia.org/wiki/FIM-92_Stinger" target="_blank" rel="noopener">Stinger</a>, an American-made portable weapon that operates as an infrared surface-to-air missile.</p>
<p>Sources told KrebsOnSecurity Binns&#8217; repeated efforts to purchase the projectile earned him multiple visits from the Turkish authorities, who were justifiably curious why he kept seeking to acquire such a powerful weapon.</p>
<h2>WAIFU</h2>
<p>A careful study of Judische&#8217;s postings on Telegram and Discord since 2019 shows this user is more widely known under the nickname &#8220;<strong>Waifu</strong>,&#8221; a moniker that corresponds to one of the more accomplished &#8220;SIM swappers&#8221; in the English-language cybercrime community over the years.</p>
<p><a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">SIM swapping</a> involves phishing, tricking or bribing mobile phone company employees for credentials needed to redirect a target&#8217;s mobile phone number to a device the attackers control &#8212; allowing thieves to intercept incoming text messages and phone calls.</p>
<p>Several SIM-swapping channels on Telegram maintain a frequently updated leaderboard of the 100 richest SIM-swappers, as well as the hacker handles associated with specific cybercrime groups (Waifu is ranked #24). That list has long included Waifu on a roster of hackers for a group that called itself &#8220;<strong>Beige</strong>.&#8221;</p>
<p>The term &#8220;Beige Group&#8221; came up in reporting on two stories published here in 2020. The first was in <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener">an August 2020 piece called Voice Phishers Targeting Corporate VPNs</a>, which warned that the COVID-19 epidemic had brought a wave of targeted voice phishing attacks that tried to trick work-at-home employees into providing access to their employers&#8217; networks. Frequent targets of the Beige group included employees at numerous top U.S. banks, ISPs, and mobile phone providers.</p>
<p>The second time Beige Group was mentioned by sources was in reporting on <a href="https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/" target="_blank" rel="noopener">a breach at the domain registrar GoDaddy</a>. In November 2020, intruders thought to be associated with the Beige Group tricked a GoDaddy employee into installing malicious software, and with that access they were able to redirect the web and email traffic for multiple cryptocurrency trading platforms. Other frequent targets of the Beige group included employees at numerous top U.S. banks, ISPs, and mobile phone providers.</p>
<p>Judische&#8217;s various Telegram identities have long claimed involvement in the 2020 GoDaddy breach, and he didn&#8217;t deny his alleged role when asked directly. Judische said he prefers voice phishing or &#8220;vishing&#8221; attacks that result in the target installing data-stealing malware, as opposed to tricking the user into entering their username, password and one-time code.</p>
<p>&#8220;Most of my ops involve malware [because] credential access burns too fast,&#8221; Judische explained.</p>
<h2>CRACKDOWN ON HARM GROUPS?</h2>
<p>The Telegram channels that the Judische/Waifu accounts frequented over the years show this user divided their time between posting in channels dedicated to financial cybercrime, and harassing and stalking others in harm communities like <strong>Leak Society</strong> and <strong>Court</strong>.</p>
<p>Both of these Telegram communities are known for victimizing children through coordinated online campaigns of extortion, doxing, swatting and harassment. People affiliated with harm groups like Court and Leak Society will often recruit new members by lurking on gaming platforms, social media sites and mobile applications that are popular with young people, including <strong>Discord</strong>, <strong>Minecraft</strong>, <strong>Roblox</strong>, <strong>Steam</strong>, <strong>Telegram</strong>, and <strong>Twitch</strong>.</p>
<p>“This type of offence usually starts with a direct message through gaming platforms and can move to more private chatrooms on other virtual platforms, typically one with video enabled features, where the conversation quickly becomes sexualized or violent,” warns a <a href="https://www.rcmp-grc.gc.ca/en/news/2024/rcmp-reminds-canadians-violent-online-groups-targeting-youth" target="_blank" rel="noopener">recent alert</a> from the <strong>Royal Canadian Mounted Police</strong> (RCMP) about the rise of sextortion groups on social media channels.</p>
<p>“One of the tactics being used by these actors is sextortion, however, they are not using it to extract money or for sexual gratification,” the RCMP continued. “Instead they use it to further manipulate and control victims to produce more harmful and violent content as part of their ideological objectives and radicalization pathway.”</p>
<p>Some of the largest such known groups include those that go by the names <strong>764</strong>, <strong>CVLT</strong>, <strong>Kaskar</strong>, <strong>7997</strong>, <strong>8884</strong>, <strong>2992</strong>, <strong>6996</strong>, <strong>555</strong>, <strong>Slit Town</strong>, <strong>545</strong>, <strong>404</strong>, <strong>NMK</strong>, <strong>303</strong>, and <strong>H3ll</strong>.</p>
<p>On the various cybercrime-oriented channels Judische frequented, he often lied about his or others&#8217; involvement in various breaches. But Judische also at times shared nuggets of truth about his past, particularly when discussing the early history and membership of specific Telegram- and Discord-based cybercrime and harm groups.</p>
<p>Judische claimed in multiple chats, including on Leak Society and Court, that they were an early member of the <a href="https://en.wikipedia.org/wiki/Atomwaffen_Division" target="_blank" rel="noopener">Atomwaffen Division</a> (AWD), a white supremacy group whose members are suspected of having committed multiple murders in the U.S. since 2017.</p>
<p>In 2019, KrebsOnSecurity exposed how a loose-knit group of neo-Nazis, some of whom were affiliated with AWD, had <a href="https://krebsonsecurity.com/2019/07/neo-nazi-swatters-target-dozens-of-journalists/" target="_blank" rel="noopener">doxed and/or swatted nearly three dozen journalists at a range of media publications</a>. Swatting involves communicating a false police report of a bomb threat or hostage situation and tricking authorities into sending a heavily armed police response to a targeted address.</p>
<p>Judsiche also told a fellow denizen of Court that years ago he was active in an older harm community called &#8220;<strong>RapeLash</strong>,&#8221; a truly vile Discord server known for attracting Atomwaffen members. A 2018 retrospective on RapeLash posted to the now defunct neo-Nazi forum <strong>Fascist Forge</strong> explains that RapeLash was awash in gory, violent images and child pornography.</p>
<p>A Fascist Forge member named &#8220;Huddy&#8221; recalled that RapeLash was the third incarnation of an extremist community also known as &#8220;FashWave,&#8221; short for Fascist Wave.</p>
<p>&#8220;I have no real knowledge of what happened with the intermediary phase known as &#8216;FashWave 2.0,&#8217; but FashWave 3.0 houses multiple known Satanists and other degenerates connected with AWD, one of which got arrested on possession of child pornography charges, last I heard,&#8221; Huddy shared.</p>
<p>In June 2024, a Mandiant employee <a href="https://archive.ph/dI52m#selection-1721.0-1721.339" target="_blank" rel="noopener">told Bloomberg</a> that UNC5537 members have made death threats against cybersecurity experts investigating the hackers, and that in one case the group used artificial intelligence to create fake nude photos of a researcher to harass them.</p>
<p><strong>Allison Nixon</strong> is chief research officer with the New York-based cybersecurity firm <a href="https://unit221b.com" target="_blank" rel="noopener">Unit 221B</a>. Nixon is among several researchers who have faced harassment and specific threats of physical violence from Judische.</p>
<p>Nixon said Judische is likely to argue in court that his self-described psychological disorder(s) should somehow excuse his long career in cybercrime and in harming others.</p>
<p>&#8220;They ran a misinformation campaign in a sloppy attempt to cover up the hacking campaign,&#8221; Nixon said of Judische. &#8220;Coverups are an acknowledgment of guilt, which will undermine a mental illness defense in court. We expect that violent hackers from the [cybercrime community] will experience increasingly harsh sentences as the crackdown continues.&#8221;</p>


