Author Archives: Jeff Stone

FIN7 scammers posed as SEC officials, sick restaurant customers to hack victims

Posted on by

A hacking group known for innovative fraud techniques impersonated angry restaurant customers and targeted specific individuals with unique access to financial information, U.S. prosecutors argue in a court filing that sheds new light on the scammers’ work. The FIN7 gang, which researchers have blamed for more than $1 billion in theft since 2015, relied on more than 70 members who were assigned to various departments under the larger organization, according to court documents filed on June 17 in U.S. District Court in Seattle. By masquerading as a cybersecurity testing company dubbed Combi Security, FIN7 leaders organized their personnel into separate teams charged with developing malware, crafting phishing documents and collecting money from breached victims. The group targeted hundreds of U.S. companies, prosecutors say, infecting victims as diverse as the burrito chain Chipotle and the department store Saks Fifth Avenue. Court documents filed in the case of Andrii Kolpakov, who pleaded […]

The post FIN7 scammers posed as SEC officials, sick restaurant customers to hack victims appeared first on CyberScoop.

Continue reading FIN7 scammers posed as SEC officials, sick restaurant customers to hack victims→

Snapchat stalker pleads guilty to using stolen passwords to torment college students

Posted on by

A New York City man admitted to accessing more than 300 Snapchat accounts to steal victims’ nude pictures as part of a cyberstalking case that ensnared at least 14 people. David Mondore, 29, pleaded guilty Wednesday to hacking-related charges for orchestrating a scheme in which he would solicit explicit photos from college students by impersonating their friends. The fraud, in which Mondore would dupe Snapchat users into providing their passwords, represents only the latest example of ways that scammers exploit otherwise innocuous social media relationships to harass, abuse and torment unwitting users. “This case should serve as a cautionary reminder that many individuals lurking on social media use those platforms to engage in decidedly anti-social behavior,” U.S. Attorney James Kennedy said in a statement. Unlike advanced cyber-espionage activity or digital extortion, cyberstalking is typically aimed at individual victims who have few obvious solutions. While instances of the problem are difficult […]

The post Snapchat stalker pleads guilty to using stolen passwords to torment college students appeared first on CyberScoop.

Continue reading Snapchat stalker pleads guilty to using stolen passwords to torment college students→

Ukrainian cops seize cash, computers as part of Clop ransomware crew disruption

Posted on by

Ukrainian authorities said Wednesday they’ve taken action against a hacking outfit that was responsible for roughly half a billion dollars in digital extortion in recent years, in a rare example of law enforcement disrupting accused ransomware scammers. Six unnamed suspects are accused of infecting organizations in the U.S. and South Korea with the Clop ransomware. Investigators previously linked prior Clop activity to TA505, a financial hacking group, and a messy data breach at Accellion, in which hackers leveraged access to an IT vendor to threaten a number of its partners. Ukrainian authorities did not explicitly state they have arrested the accused hackers in a statement Wednesday. Police carried out 21 searches in the capital city of Kyiv, including the homes and cars of the defendants, to seize computer equipment and $5 million in Ukrainian hryvnia currency (roughly $184,000 in U.S. dollars). Whether police had targeted Clop developers or an affiliate […]

The post Ukrainian cops seize cash, computers as part of Clop ransomware crew disruption appeared first on CyberScoop.

Continue reading Ukrainian cops seize cash, computers as part of Clop ransomware crew disruption→

How FireEye attributed the SolarWinds hacking campaign to Russian spies

Posted on by

Careful data collection, specific keyword searches and the type of breach were factors that FireEye used to determine that Kremlin-sponsored hackers were behind one of the largest cyber-espionage operations in recent years. The first revelations about what would come to be known as the SolarWinds campaign — in which spies exploited the federal contractor to breach nine U.S. government agencies and roughly 100 companies — occurred in early December 2020, when FireEye announced that hackers had stolen its security testing tools. The Milpitas-based company discovered that SolarWinds software was affected during the course of its own investigation, sparking examinations throughout U.S. national security circles that remain ongoing. “We learned it’s fair game to hack the supply chain,” FireEye CEO Kevin Mandia said Tuesday during CyberTalks, a summit presented by CyberScoop. While scrambling to understand the scope of the breach, FireEye investigators observed that hackers had searched for specific keywords, an […]

The post How FireEye attributed the SolarWinds hacking campaign to Russian spies appeared first on CyberScoop.

Continue reading How FireEye attributed the SolarWinds hacking campaign to Russian spies→

How recent disinformation campaigns tied to Russia, Pakistan blended fake engagement with real life

Posted on by

Influence operations aren’t just about spreading fake news. International governments and corporate public relations firms also are using inauthentic social media behavior to boost attention around real-world events that fit into foreign policy goals, a panel of experts said Tuesday at CyberTalks, a summit presented by CyberScoop. The propaganda campaigns are increasingly layered, with a number of examples that have relied on contract workers who may not have realized they were involved in an astroturfing effort. In May, Facebook removed 30 pages, six groups, 83 accounts and 49 Instagram profiles that were linked to Yevgeny Prigozhin, a Russian oligarch who had distributed food baskets to impoverished communities in Sudan. The amplification of pro-Russia content appeared to be designed to improve the populations’ impression of Prigozhin, and thus the Kremlin, at a time when Russia is trying to keep Russian warships stationed at Port Sudan on the Red Sea, according to […]

The post How recent disinformation campaigns tied to Russia, Pakistan blended fake engagement with real life appeared first on CyberScoop.

Continue reading How recent disinformation campaigns tied to Russia, Pakistan blended fake engagement with real life→

Biden, Putin conduct diplomatic dance over hypothetical hacker exchange

Posted on by

A discussion over an exchange of accused hackers from Russia and the U.S. could be on the agenda this week when President Joe Biden meets with his Russian counterpart on the shores of Lake Geneva in Switzerland. Vladimir Putin, in an interview with Russian state media Sunday, said his government would consider the possibility of extraditing accused hackers from Russia to America under the condition that the U.S. would do the same. During a news conference at a Group of Seven (G7) summit, Biden said he would be “open” to the idea of holding accused hackers in the U.S. accountable for violating the law. The two world leaders are scheduled to meet on Wednesday amid a spate of high profile ransomware attacks in which alleged Russian-based hacking gangs disrupted operations at Colonial Pipeline, a U.S. fuel carrier, and the meat processing firm JBS. “If there’s crimes committed against Russia that, […]

The post Biden, Putin conduct diplomatic dance over hypothetical hacker exchange appeared first on CyberScoop.

Continue reading Biden, Putin conduct diplomatic dance over hypothetical hacker exchange→

SIM swapping victim alleges T-Mobile failed to stop $20,000 cryptocurrency scam

Posted on by

A Pennsylvania woman who lost the equivalent of $20,000 in cryptocurrency as part of a mobile fraud scheme says T-Mobile failed to protect her account in the face of a wave of similar incidents. Sima Kesler, in a complaint filed Wednesday in Pennsylvania Eastern District Court, alleges she was the victim of a May 2020 SIM swapping scheme, in which scammers convince a phone carrier to give them control of an individual user’s account. With control of a victim’s phone information, thieves can receive text messages and access unrelated accounts tied to the victim’s mobile number. In this case, Kesler says she stored roughly $20,000 in a Coinbase account connected to her T-Mobile subscription. Unknown fraudsters had tricked T-Mobile customer service personnel into handing over access to Kesler’s account, which they then used to deplete her Coinbase of virtually all cryptocurrency, according to the complaint. Kesler’s complaint alleges that she […]

The post SIM swapping victim alleges T-Mobile failed to stop $20,000 cryptocurrency scam appeared first on CyberScoop.

Continue reading SIM swapping victim alleges T-Mobile failed to stop $20,000 cryptocurrency scam→

FBI blames REvil gang for JBS ransomware hack as global meat supplier gets back to work

Posted on by

A prolific ransomware operation known as REvil is to blame for a ransomware attack against the global meat supplier JBS, the FBI said Wednesday. REvil, also called Sodinokibi, is an infamous hacking group perhaps best known for launching digital extortion attacks against Apple and a biotechnology firm that was researching methods of slowing the coronavirus, among other victims. In a statement, the FBI said it is “working diligently to bring the threat actors to justice” following a May 30 breach at JBS that forced the temporary closure of meat processing facilities in the U.S., Canada and Australia. Security researchers have suggested that REvil is based in Russia, as the group seems to avoid infecting Russian targets. Russian President Vladimir Putin has said that if hackers “did not break Russian law, there is nothing to prosecute them for in Russia.” The bureau said: “We continue to focus our efforts on imposing […]

The post FBI blames REvil gang for JBS ransomware hack as global meat supplier gets back to work appeared first on CyberScoop.

Continue reading FBI blames REvil gang for JBS ransomware hack as global meat supplier gets back to work→

Team of romance scammers defrauded US victims out of $2.5M since 2016, DOJ says

Posted on by

U.S. prosecutors have charged nine people in connection with a scheme to defraud elderly Americans out of more than $2.5 million by pretending to be friends or romantic partners online. The suspects, who hail from Nigeria, Ghana and the U.S., used websites like Facebook and Google to find victims seeking friendship, companionship and love. By masquerading as interested partners who needed money, the thieves would convince unwitting victims, often senior citizens, to send them thousands of dollars at a time, the Justice Department said. The charges, unsealed Tuesday, are the latest allegations of so-called romance scams, in which fraudsters exploit lonely web users to try emptying their bank accounts. Victims reported $304 million in losses from romance scams in 2020, according to the Federal Trade Commission, a figure that does not account for any losses not disclosed to the government. Conversations typically begin innocuously on dating apps and social media […]

The post Team of romance scammers defrauded US victims out of $2.5M since 2016, DOJ says appeared first on CyberScoop.

Continue reading Team of romance scammers defrauded US victims out of $2.5M since 2016, DOJ says→

Global beef provider JBS interrupted by ‘organized’ attack

Posted on by

Production at a number of meat packaging facilities in Australia, Canada and the U.S. entered a second day of interruption Monday as JBS, the world’s largest meat supplier, contended with a digital security incident. Brazil-based JBS, which employs more than 230,000 people globally, said Sunday it had been the target of an “organized cybersecurity attack” that apparently targeted the firm’s IT systems in North America and Australia. The company is the largest meat and food processing firm in Australia, with 47 facilities there as well as offices in Canada and Colorado. The specific nature of the security incident remains unclear. The hack, though, comes just three weeks after hackers infected another commodities provider, Colonial Pipeline, with ransomware, which halted fuel deliveries in the southern U.S. for multiple days. “The company took immediate action, suspending all affected systems, notifying authorities and activating the company’s global network of IT professionals and third […]

The post Global beef provider JBS interrupted by ‘organized’ attack appeared first on CyberScoop.

Continue reading Global beef provider JBS interrupted by ‘organized’ attack→