Cybercrime/malcode – Lifeboat News: The Blog

Jul 21
2022

U.S. government recovers nearly $500,000 from North Korean hack on Kansas medical facility

The U.S. Department of Justice seized roughly $500,000 in ransom payments that a medical center in Kansas paid to North Korean hackers last year, along with cryptocurrency used to launder the payments, Deputy Attorney General Lisa Monaco said Tuesday.

The hospital quickly paid the attackers, but also notified the FBI, “which was the right thing to do for both themselves and for future victims,” Monaco said in a speech at the International Conference on Cyber Security at Fordham University in New York City.

The notification enabled the FBI to trace the payment through the blockchain, an immutable public record of cryptocurrency transactions.

Jul 21
2022

EU warns of Russian cyberattack spillover, escalation risks

The Council of the European Union (EU) said today that Russian hackers and hacker groups increasingly attacking “essential” organizations worldwide could lead to spillover risks and potential escalation.

“This increase in malicious cyber activities, in the context of the war against Ukraine, creates unacceptable risks of spillover effects, misinterpretation and possible escalation,” the High Representative on behalf of the EU said Tuesday.

“The latest distributed denial-of-service (DDoS) attacks against several EU Member States and partners claimed by pro-Russian hacker groups are yet another example of the heightened and tense cyber threat landscape that EU and its Member States have observed.”

Jul 20
2022

Russian hackers use fake DDoS app to infect pro-Ukrainian activists

Google’s Threat Analysis Group (TAG), whose primary goal is to defend Google users from state-sponsored attacks, said today that Russian-backed threat groups are still focusing their attacks on Ukrainian organizations.

In a report regarding recent cyber activity in Eastern Europe, Google TAG security engineer Billy Leonard revealed that hackers part of the Turla Russian APT group have also been spotted deploying their first Android malware.

They camouflaged it as a DDoS attack tool and hosted it on cyberazov[.]com, a domain spoofing the Ukrainian Azov Regiment.

Jul 19
2022

Researchers warn about new “SATAn” that can hack air-gapped PCs using SATA cables

A new air-gap cyberattack technique has entered the frame. The researchers are referring to it as “SATAn” and it basically involves using ordinary SATA cables to transmit data wirelessly.

Jul 19
2022

Scientists hack fly brains to make them remote controlled

Researchers at Rice University have shown how they can hack the brains of fruit flies to make them remote controlled. The flies performed a specific action within a second of a command being sent to certain neurons in their brain.

The team started by genetically engineering the flies so that they expressed a certain heat-sensitive ion channel in some of their neurons. When this channel sensed heat, it would activate the neuron – in this case, that neuron caused the fly to spread its wings, which is a gesture they often use during mating.

The heat trigger came in the form of iron oxide nanoparticles injected into the insects’ brains. When a magnetic field is switched on nearby, those particles heat up, causing the neurons to fire and the fly to adopt the spread-wing pose.

Jul 19
2022

Flipkart-owned flight booking platform Cleartrip hit by data breach

Flipkart-owned Cleartrip, a flight booking platform, said that it suffered a major data breach in its internal systems.

In an email to customers, the company stated, “This is to inform you that there has been a security anomaly that entailed illegal and unauthorised access to a part of Cleartrip’s internal systems.”

However, the travel company assured them that no sensitive information pertaining to a user’s account had been compromised due to this incident, apart from a few personal details.

Jul 18
2022

Experts Notice Sudden Surge in Exploitation of WordPress Page Builder Plugin Vulnerability

Researchers have raised the alarm about a “sudden” spike in cyberattacks attempting to exploit an unpatched vulnerability in WordPress Plugin.

Pegasus spy software was used to hack into the devices of dozens of Thai pro-democracy activists as part of an extensive espionage operation.

Jul 18
2022

Pegasus Spyware Used to Hack Devices of Pro-Democracy Activists in Thailand

Pegasus spy software was used to hack into the devices of dozens of Thai pro-democracy activists as part of an extensive espionage operation.

Jul 17
2022

Beating hackers at bug hunting

An innovative new collaboration between EPFL’s HexHive Laboratory and Oracle has developed automated, far-reaching technology in the ongoing battle between IT security managers and attackers, hoping to find bugs before the hackers do.

On the 9th of December 2021 the world of IT security went into a state of shock. Before its developers even knew it, the log4j application—part of the Apache suite used on most web servers—was being exploited by hackers, allowing them to take control of servers and data centers all over the world.

The Wall Street Journal reported news that nobody wanted to hear: “U.S. officials say hundreds of millions of devices are at risk. Hackers could use the bug to steal data, install malware or take control.”

Jul 17
2022

‘Lives are at stake’: hacking of US hospitals highlights deadly risk of ransomware

The number of ransomware attacks on healthcare organizations increased 94% from 2021 to 2022, according to a report from the cybersecurity firm Sophos. More than two-thirds of healthcare organizations in the US said they had experienced a ransomware attack in 2021, the study said, up from 34% in 2020.

Ransomware attacks on healthcare are particularly common in the US, with 41% of such attacks globally having been carried out against US-based firms in 2021.

“The current outlook is terrible,” said Israel Barak, CISO of Cybereason. “We are seeing the industry experience an extremely sharp increase in both the quantity and level of sophistication of these attacks.”