Author Archives: Jeff Stone

Joker’s Stash, a forum for stolen data, says it will shut down within 30 days

Posted on by

An administrator of a notorious forum for stolen payment data and illicitly obtained personal information says they will shutter the site in 30 days.  The Joker’s Stash — an online hub where millions of credit card numbers from restaurants and supermarket chains, among others — will cease operation in the coming month, according to post Friday seen by multiple threat intelligence firms. Word of the closure comes from an administrator whom one researcher described as “credible,” and comes after a recent law enforcement action against part of the site.  The site will shut down on Feb. 15, according to the administrator who goes by the name “JokerStash.” “Joker goes on a well-deserved retirement. Joker’s Stash is closing,” the post said, according to a transcript provided to CyberScoop by Gemini Advisory, a security firm. “When we opened years ago, nobody knew us. Today we are one of the largest cards/dumps marketplace[s].” […]

The post Joker’s Stash, a forum for stolen data, says it will shut down within 30 days appeared first on CyberScoop.

Continue reading Joker’s Stash, a forum for stolen data, says it will shut down within 30 days→

After judge orders release of hacker tied to ISIS, US says ‘Not so fast’

Posted on by

A convicted hacker whom a U.S. court granted compassionate release during the coronavirus pandemic may remain behind bars after all, following accusations that he committed crimes while in custody.  Since 2016, Ardit Ferizi, a Kosovan national, has been serving a 20-year prison sentence for providing details about 1,300 U.S. military and government personnel to the Islamic State terrorist group. A judge in December awarded Ferizi, who is overweight and has asthma, compassionate release, citing his vulnerability to COVID-19.  That was until the U.S. Department of Justice on Jan. 12 unsealed a federal complaint against Ferizi alleging that he had committed multiple new federal crimes while he had been in prison. The charges involve Ferizi allegedly operating a scheme with a family member — who had access to Ferizi’s old email accounts — to monetize stolen personal information, credit card numbers and other data.  Ferizi was being held in the Federal […]

The post After judge orders release of hacker tied to ISIS, US says ‘Not so fast’ appeared first on CyberScoop.

Continue reading After judge orders release of hacker tied to ISIS, US says ‘Not so fast’→

Larger CyberBunker investigation yields shutdown of DarkMarket

Posted on by

German law enforcement has shut down an internet market where users bought and sold narcotics, stolen data and hacking tools, authorities said Tuesday. The forum, known as DarkMarket, was the internet’s largest bazaar for illicit goods, the European police agency Europol said, with more than 2,400 vendors and 320,000 transactions completed. Police said they apprehended a single suspect, a 34-year-old Australian man accused of operating the site, near the German-Danish border.  The law enforcement action originated in a larger investigation into the internet hosting provider known as CyberBunker, a notorious service that scammers for a generation have used to operate with little fear of detection.  The CyberBunker hosting service was based in former North Atlantic Treaty Organization bunkers in Holland and then Germany, helping controversial sites avoid police legal enforcement from military-style basements. CyberBunker has housed servers for the Pirate Bay, WikiLeaks and a range of dark net markets as […]

The post Larger CyberBunker investigation yields shutdown of DarkMarket appeared first on CyberScoop.

Continue reading Larger CyberBunker investigation yields shutdown of DarkMarket→

Larger CyberBunker investigation yields shutdown of DarkMarket

Posted on by

German law enforcement has shut down an internet market where users bought and sold narcotics, stolen data and hacking tools, authorities said Tuesday. The forum, known as DarkMarket, was the internet’s largest bazaar for illicit goods, the European police agency Europol said, with more than 2,400 vendors and 320,000 transactions completed. Police said they apprehended a single suspect, a 34-year-old Australian man accused of operating the site, near the German-Danish border.  The law enforcement action originated in a larger investigation into the internet hosting provider known as CyberBunker, a notorious service that scammers for a generation have used to operate with little fear of detection.  The CyberBunker hosting service was based in former North Atlantic Treaty Organization bunkers in Holland and then Germany, helping controversial sites avoid police legal enforcement from military-style basements. CyberBunker has housed servers for the Pirate Bay, WikiLeaks and a range of dark net markets as […]

The post Larger CyberBunker investigation yields shutdown of DarkMarket appeared first on CyberScoop.

Continue reading Larger CyberBunker investigation yields shutdown of DarkMarket→

The anatomy of a modern day ransomware conglomerate

Posted on by

If school administrators, medical organizations and other crucial industries haven’t already had enough bad news over the past year, a new hacking group that relies on emerging techniques to rip off its victims should fulfill that need.  What makes the pain even worse is that the group is using an innovative structure that’s becoming more common in the cybercrime underworld. This ransomware gang, dubbed Egregor, in recent months appears to have hacked more than 130 targets, including schools, manufacturing firms, logistics companies and financial institutions, according to the U.K.-based security firm Sophos. Egregor works much like other strains of ransomware — holding data hostage until a victim pays a fee — though in some ways the group behind it also exemplifies the current state of the hacking economy.  Rather than relying on lone hackers who mastermind massive data breaches, or dark web forums frequented only by Russian scammers, today’s cybercriminals […]

The post The anatomy of a modern day ransomware conglomerate appeared first on CyberScoop.

Continue reading The anatomy of a modern day ransomware conglomerate→

A ‘coordinated police’ action against the Joker’s Stash took a small domain offline

Posted on by

An ongoing law enforcement operation has disrupted aspects of a leading website where internet scammers frequently buy and sell stolen data, according to the site’s administrators and multiple sources with visibility into the site.  A message posted Thursday on a forum at the Joker’s Stash, a marketplace where members have previously listed millions of payment cards stolen from U.S. restaurant chains, notifies members that “these bastards busted” an “external proxy server” connected to a section of the site. Other aspects of Joker’s Stash remained functioning normally at press time Thursday, though one researcher suggested the action represented a kind of warning to the site that has facilitated fraud since at least 2015.  “This relates to a coordinated police operational activity that is ongoing, and at this time we are not in a position to comment,” Interpol, the inter-governmental law enforcement organization based in France, said in an email. The affected […]

The post A ‘coordinated police’ action against the Joker’s Stash took a small domain offline appeared first on CyberScoop.

Continue reading A ‘coordinated police’ action against the Joker’s Stash took a small domain offline→

Suspect in case of Mirai botnet, which knocked major sites offline in 2016, pleads guilty

Posted on by

The U.S. Department of Justice on Wednesday announced that an unnamed defendant has pleaded guilty in connection with a cyberattack that rocked the internet in 2016. The October 2016 distributed denial-of-service attack affected Dyn, an internet infrastructure company, before rippling out to cause outages for sites including Twitter, Netflix, Spotify, AirBnb and Reddit, among others. DDoS attacks typically occur when attackers access a network of hacked computers, then direct those connections to a single point on the web, overwhelming the target with traffic and knocking it offline. In this case, the defendant in question conspired with others in September and October 2016 to leverage an offshoot of an army of hackers computers known as the Mirai botnet, the Justice Department said Wednesday. The malicious tool relied on connected video cameras, recorders and other devices to carry out the incident. Authorities withheld the name of the defendant because they were a […]

The post Suspect in case of Mirai botnet, which knocked major sites offline in 2016, pleads guilty appeared first on CyberScoop.

Continue reading Suspect in case of Mirai botnet, which knocked major sites offline in 2016, pleads guilty→

Why the Biden administration needs a National Cyber Director more than ever

Posted on by

As the Biden-Harris administration thinks about cyber appointments and cyber strategy for the first 100 days of the administration, appointing a National Cyber Director role requiring Senate confirmation is critical. The National Cyber Director will coordinate, support, and deconflict efforts on cyber, technology, and related issues led by executive branch agencies, engage the private sector to build trust and advance shared priorities, and represent the administration at home and abroad on cyber. The administration will face a number of cybersecurity and technology challenges upon entering the White House. Effective mobilization and coordination of the government, and engagement with industry and civil society requires a coordinated strategy led by an empowered National Cyber Director who is responsible for the work. That person also must be able to hold federal agencies accountable. The cybersecurity landscape has only grown more complex since President-Elect Biden left office as vice president. Election security, foreign investment […]

The post Why the Biden administration needs a National Cyber Director more than ever appeared first on CyberScoop.

Continue reading Why the Biden administration needs a National Cyber Director more than ever→

FIN7 recruiter Andrii Kolpakov pleads guilty to role in global hacking scheme

Posted on by

One of the ringleaders of FIN7, a global hacking crew accused of stealing more than $1 billion by posing as a cybersecurity vendor, has admitted his role in the scheme. Andrii Kolpakov pleaded guilty on Monday to conspiracy to commit wire and bank fraud and conspiracy to commit computer hacking as part of his involvement with FIN7. U.S. prosecutors had accused Kolpakov, a Ukrainian national, of working as a manager and recruiter for the crew, a role in which he hired and supervised computer specialists who spent their days stealing payment card information from dozens of companies, including Chipotle, Red Robin and Sonic Drive-In. “During the course of the scheme, [Kolpakov] received compensation for his participation in FIN7, which far exceeds comparable legitimate employment in Ukraine,” the plea deal notes. “For the purposes of this plea agreement, the parties agree that — during [Kolpakov’s] participation in the malware scheme — […]

The post FIN7 recruiter Andrii Kolpakov pleads guilty to role in global hacking scheme appeared first on CyberScoop.

Continue reading FIN7 recruiter Andrii Kolpakov pleads guilty to role in global hacking scheme→

Government learns that authenticators are key part of modernization

Posted on by

Now that federal agencies have shifted to mass telework and sorted through many of the related hardware and software needs, they’re able to take a closer look all the pieces necessary to implement zero-trust security architecture, a cybersecurity expert says. In particular, agencies have greatly embraced the use of different kinds of authenticators to help identify users and control their network access, said Brian Rosensteel, Cybersecurity Architect at Duo Security, during an SNG Live virtual discussion panel hosted by Scoop News Group on Oct. 20. Federal IT leaders are seeing that for telework, old forms of proving identity don’t translate, and they’re looking for other solutions. “That’s where we’ve seen zero trust really starting to take place,” he said. The zero-trust model assumes that the network is penetrable, so it forces users to verify themselves for each set of data or applications they want to access once they’re on the […]

The post Government learns that authenticators are key part of modernization appeared first on CyberScoop.

Continue reading Government learns that authenticators are key part of modernization→