Author Archives: BrianKrebs

Fulton County, Security Experts Call LockBit’s Bluff

Posted on by

The ransomware group LockBit told officials with Fulton County, Ga. they could expect to see their internal documents published online this morning unless the county paid a ransom demand. Instead, LockBit removed Fulton County’s listing from its victim shaming website this morning, claiming county officials had paid. But county officials said they did not pay, nor did anyone make payment on their behalf. Security experts say LockBit was likely bluffing and probably lost most of the data when the gang’s servers were seized this month by U.S. and U.K. law enforcement. Continue reading Fulton County, Security Experts Call LockBit’s Bluff→

Calendar Meeting Links Used to Spread Mac Malware

Posted on by

Malicious hackers are targeting people in the cryptocurrency space in attacks that start with a link added to the target’s account at Calendly, a popular free calendar application for scheduling appointments and meetings. The attackers impersonate established cryptocurrency investors and ask to schedule a video conference call. But clicking the meeting link provided by the scammers prompts the user to run a script that quietly installs malware on macOS systems. Continue reading Calendar Meeting Links Used to Spread Mac Malware→

FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga.

Posted on by

The FBI’s takedown of the LockBit ransomware group last week came as LockBit was preparing to release sensitive data stolen from government computer systems in Fulton County, Ga. But LockBit is now regrouping, and the gang says it will publish the stolen Fulton County data on March 2 unless paid a ransom. LockBit claims the cache includes documents tied to the county’s ongoing criminal prosecution of former President Trump, but court watchers say teaser documents published by the crime gang suggest a total leak of the Fulton County data could put lives at risk and jeopardize a number of other criminal trials. Continue reading FBI’s LockBit Takedown Postponed a Ticking Time Bomb in Fulton County, Ga.→

New Leak Shows Business Side of China’s APT Menace

Posted on by

A new data leak that appears to have come from one of China’s top private cybersecurity firms provides a rare glimpse into the commercial side of China’s many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage campaigns to the nation’s burgeoning and highly competitive cybersecurity industry. Continue reading New Leak Shows Business Side of China’s APT Menace→

Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates

Posted on by

U.S. and U.K. authorities have seized the darknet websites run by LockBit, a prolific and destructive ransomware group that has claimed more than 2,000 victims worldwide and extorted over $120 million in payments. Instead of listing data stolen from ransomware victims who didn’t pay, LockBit’s victim shaming website now offers free recovery tools, as well as news about arrests and criminal charges involving LockBit affiliates. Continue reading Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates→

U.S. Internet Leaked Years of Internal, Customer Emails

Posted on by

The Minnesota-based Internet provider U.S. Internet Corp. has a business unit called Securence, which specializes in providing filtered, secure email services to businesses, educational institutions and government agencies worldwide. But until it was notified last week, U.S. Internet was publishing more than a decade’s worth of its internal email — and that of thousands of Securence clients — in plain text out on the Internet and just a click away for anyone with a Web browser. Continue reading U.S. Internet Leaked Years of Internal, Customer Emails→

Fat Patch Tuesday, February 2024 Edition

Posted on by

Microsoft Corp. today pushed software updates to plug more than 70 security holes in its Windows operating systems and related products, including two zero-day vulnerabilities that are already being exploited in active attacks. Continue reading Fat Patch Tuesday, February 2024 Edition→

Juniper Support Portal Exposed Customer Device Info

Posted on by

Until earlier this week, the support website for networking equipment vendor Juniper Networks was exposing potentially sensitive information tied to customer products, including the exact devices each customer bought, as well as each device’s warranty status, service contracts and serial numbers. Juniper said it has since fixed the problem, and that the inadvertent data exposure stemmed from a recent upgrade to its support portal. Continue reading Juniper Support Portal Exposed Customer Device Info→

From Cybercrime Saul Goodman to the Russian GRU

Posted on by

In 2021, the exclusive Russian cybercrime forum Mazafaka was hacked. The leaked user database shows one of the forum’s founders was an attorney who advised Russia’s top hackers on the legal risks of their work, and what to do if they got caught. A review of this user’s hacker identities shows that during his time on the forums he served as an officer in the special forces of the GRU, the foreign military intelligence agency of the Russian Federation. Continue reading From Cybercrime Saul Goodman to the Russian GRU→

Arrests in $400M SIM-Swap Tied to Heist at FTX?

Posted on by

Three Americans were charged this week with stealing more than $400 million in a November 2022 SIM-swapping attack. The U.S. government did not name the victim organization, but there is every indication that the money was stolen from the now-defunct cryptocurrency exchange FTX, which had just filed for bankruptcy on that same day. Continue reading Arrests in $400M SIM-Swap Tied to Heist at FTX?→