Author Archives: Jeff Stone

IRS used vape store receipts to gather evidence against alleged Ukrainian scammer

Posted on by

U.S. law enforcement officials gathered details about a suspected cybercriminal by collecting intelligence from his apparent messages to vape shops in Ukraine. The accused scammer, Glib Oleksandr Ivanov-Tolpintsev, was arraigned Tuesday during an 11-minute hearing in which he appeared virtually from the Pinellas County Jail near Tampa, Fla. Ivanov-Tolpintsev is accused of accessing victims’ username and password credentials between 2016 and 2020, then acting as a seller on a cybercriminal forum where he sold the sensitive data and leased access to a botnet, an army of hacked computers capable of sending spam or infecting more computers. Using the aliases “sergios” and “mars,” Ivanov-Tolpintsev allegedly claimed that his botnet was capable of accessing 2,000 usernames and passwords a day, enabling other perpetrators to carry out identity theft or other kinds of fraud. U.S. officials accused the defendant of earning more than $80,000 as part of the scheme over four years. The […]

The post IRS used vape store receipts to gather evidence against alleged Ukrainian scammer appeared first on CyberScoop.

Continue reading IRS used vape store receipts to gather evidence against alleged Ukrainian scammer→

A spyware app designed to monitor Kurdish targets attracted more than 1,400 downloads

Posted on by

More than 1,400 people have downloaded a spyware app that, while appearing to deliver news, enables hackers to collect sensitive data about the Kurds, an ethnic community living throughout Iran, Iraq and northern Syria. The espionage campaign involves duping Android smartphone owners into downloading a program that spies use to record phone calls, extract files, take screenshots and gather other information from unwitting victims, according to details published Tuesday by the security vendor ESET. The endeavor marks the latest attempt to undercut the Kurds, an indigenous people embedded in conflicts of the Middle East over the past generation. Kurdish fighters have been active in the fight against the Islamic State group dating back to 2014, aligning with U.S forces while also struggling against the Turkish government. Suspected Iranian hackers also used mobile spyware to monitor Kurdish targets, the security firm Check Point reported in February. The effort that ESET discovered […]

The post A spyware app designed to monitor Kurdish targets attracted more than 1,400 downloads appeared first on CyberScoop.

Continue reading A spyware app designed to monitor Kurdish targets attracted more than 1,400 downloads→

ProtonMail said Swiss court order left no choice but to log activist’s IP address

Posted on by

ProtonMail, the encrypted email service that’s built a reputation for safeguarding user data, said it had no choice but to provide details about an activist to French authorities, amid mounting questions about the privacy protections in the popular mail client. Swiss-based ProtonMail is an end-to-end encrypted service that markets itself as a tool that encrypts messages and other user data before the company accesses it. It’s a technique that, for more than 50 million users, aims to provide additional layers of protection than are available with more common email options, such as Gmail. A French police report published on Sept. 2 appears to show that police used ProtonMail to collect the IP address, a specific number that pertains to an individual computer, of an unnamed French activist who was demonstrating against real estate gentrification in Paris. The case appears to undercut ProtonMail’s assurance that it does not log the IP […]

The post ProtonMail said Swiss court order left no choice but to log activist’s IP address appeared first on CyberScoop.

Continue reading ProtonMail said Swiss court order left no choice but to log activist’s IP address→

Cyber Command alerts US firms of ‘ongoing’ hacks targeting Atlassian enterprise software

Posted on by

U.S. Cyber Command is warning American organizations that hackers are exploiting software flaws in a popular project management tool, an indication that attackers could be preparing for a larger campaign that creates headaches throughout the private sector. Cyber Command — the Defense Department’s cyber unit — said in a tweet Friday that “mass exploitation” of the issue “is ongoing and expected to accelerate.” The issue exists in Atlassian Confluence, an enterprise application marketed as a means of enabling remote work in corporate environments. Atlassian, an Australian corporation, warned clients on Aug. 25 to update their systems to the latest version of Confluence. “Please patch immediately if you haven’t already — this cannot wait until after the weekend,” the Cyber Command warning stated. The message comes after the Department of Homeland Security’s cyber division, along with the FBI, warned firms to be on guard for ransomware attacks ahead of Labor Day, […]

The post Cyber Command alerts US firms of ‘ongoing’ hacks targeting Atlassian enterprise software appeared first on CyberScoop.

Continue reading Cyber Command alerts US firms of ‘ongoing’ hacks targeting Atlassian enterprise software→

FBI warns of ‘large increase’ in sextortion attacks, with $8 million in reported losses in 2021

Posted on by

Hackers and creeps extorted $8 million from Americans over the first seven months of the year by threatening to publish sexual images unless victims paid a fee, according to figures from the Federal Bureau of Investigation. The FBI bulletin published Thursday confirms what many cybercrime researchers may have already feared: Sextortion scams are prevalent, and profitable. More than 16,000 victims reported their issues to the FBI, with nearly half of the complaints coming from people between 20 and 39 years old. The 16,000 complaints almost certainly represent a fraction of the true figure, as victims of sex-related crimes often choose not to report issues to the police for a variety of reasons, including fears of retaliation or a belief that authorities won’t help resolve the issue. The bureau reports that the number of complaints in 2021 marks a “large increase,” though the precise size of the uptick remains unclear. The […]

The post FBI warns of ‘large increase’ in sextortion attacks, with $8 million in reported losses in 2021 appeared first on CyberScoop.

Continue reading FBI warns of ‘large increase’ in sextortion attacks, with $8 million in reported losses in 2021→

SolarWinds hackers targeted Autodesk in latest confirmed fallout from cyber-espionage campaign

Posted on by

The list of victims keeps growing for the suspected Russian hackers who breached a U.S. federal contractor in order to gather intelligence from throughout the federal government. Autodesk, an American software and security company, said in a recent filing to the U.S. Securities and Exchange Commission that hackers had targeted the firm with the Sunburst malicious software. Cozy Bear, a state-sponsored Russian hacking group, relied on Sunburst to carry out an attack against SolarWinds, an IT firm that spies used as a foothold into targets throughout the government and private sector. In a 10-Q filing to the SEC, Autodesk said it discovered that one of its servers had been compromised, and that it had taken steps to remediate the fallout. The California-based firm makes design software and 3D technology tools for American customers in the architecture, engineering and education sectors. It is only the latest publicly listed company to confirm […]

The post SolarWinds hackers targeted Autodesk in latest confirmed fallout from cyber-espionage campaign appeared first on CyberScoop.

Continue reading SolarWinds hackers targeted Autodesk in latest confirmed fallout from cyber-espionage campaign→

Scammers pounce on internet-for-rent services, generating cryptocurrency in quiet

Posted on by

As if ransomware and email fraud didn’t already create enough revenue for cybercriminals, scammers now are auctioning access to their victims’ internet connections in an effort to find more profits. Hackers are seizing on a category of legitimate digital services that allow internet users to rent out access to their web connection in exchange for a small payment. While the stated goal of each of these services varies — one, Honeygain, markets itself as a tool for “effortlessly” earning a “passive income” — they typically promise to enable broadband customers to collect a fee every time an outsider connects to their hotspot. The promise of using an emerging technology to earn a quick buck has been enough to generate consistent engagement on forum sites like Reddit. Hackers are watching, too, of course. Fraudsters are “taking multiple avenues to monetize these new platforms” for their own gain, Cisco’s Talos threat intelligence […]

The post Scammers pounce on internet-for-rent services, generating cryptocurrency in quiet appeared first on CyberScoop.

Continue reading Scammers pounce on internet-for-rent services, generating cryptocurrency in quiet→

FBI warns that Hive ransomware hackers are calling victims by phone

Posted on by

Americans already trying to avoid calls from telemarketers, call support scammers and long-winded in-laws now have another reason to ignore that ringing phone: ransomware hackers. Scammers affiliated with a digital extortion outfit known as Hive are using phone calls to dial victims who are infected with a malicious software strain that locks up their files until they agree to pay a hostage fee, according to an August 25 FBI alert. Investigators first observed hackers deploying the malware in June, with attackers leveraging Microsoft’s Remote Desktop Protocol to infect business networks. In some cases, if victims don’t pay the demanded fee within two to six days, they have reported receiving phone calls from the hacking group. It’s the latest iteration of a personal tactic pioneered by other gangs — Maze, Conti and Ryuk, for instance — in which malware operators are thought to outsource tasks to a call center. Security firms […]

The post FBI warns that Hive ransomware hackers are calling victims by phone appeared first on CyberScoop.

Continue reading FBI warns that Hive ransomware hackers are calling victims by phone→

Why grassroots efforts like #ShareTheMicInCyber play a vital role in a whole-of-society approach to cyber

Posted on by

Amid increasingly sophisticated ransomware and supply chain attacks, the cybersecurity community needs a cultural shift and novel ideas to help new executive branch leadership operationalize President Biden’s recent Executive Order. The insight and authority of the government — coupled with the agility and innovation of the private sector — will create a powerful force multiplier capable of painting a clearer picture of the threat landscape, timelier coordination of defensive activities, and quicker recovery. Unfortunately, for many reasons, like fear of legal or regulatory liability, lack of regulations and incentives, and uncertainty in where to turn, strong collaboration is largely unrealized today and is limiting US’s ability to get ahead of cyber threats. The lack of trust between the public and private sectors must be overcome at the grassroots level by creating strong communities and humanizing practitioners. But the onus of creating partnerships across sectors cannot rest with the government or the private sector alone. The entire […]

The post Why grassroots efforts like #ShareTheMicInCyber play a vital role in a whole-of-society approach to cyber appeared first on CyberScoop.

Continue reading Why grassroots efforts like #ShareTheMicInCyber play a vital role in a whole-of-society approach to cyber→

Accused CIA leaker Joshua Schulte allowed to represent himself at next Vault 7 trial

Posted on by

A U.S. judge ruled Monday that a former CIA software engineer accused of providing classified information to WikiLeaks will be allowed to represent himself at his next trial. Judge Paul Crotty, of the Southern District of New York, said in a July 26 decision that Joshua Schulte, a former employee at the Central Intelligence Agency, would be allowed to discharge his current legal representation, and waive his right to counsel.  Schulte is scheduled to stand trial again in October 2021, marking the second time he will face espionage-related charges for allegedly stealing details about U.S. hacking tools from the CIA, then transmitting that data to WikiLeaks. The result, prosecutors say, was the 2017 publication of the so-called Vault 7 files, a cache of data revealing the agency’s ability to compromise consumer technology like smart TVs and web browsers for espionage purposes.  The incident represented the largest leak in CIA history.  […]

The post Accused CIA leaker Joshua Schulte allowed to represent himself at next Vault 7 trial appeared first on CyberScoop.

Continue reading Accused CIA leaker Joshua Schulte allowed to represent himself at next Vault 7 trial→