Category Archives: Financial

Four men plead guilty to being go-to ‘bulletproof’ hosts for cybercriminals

Posted on by

Four Eastern European men pleaded guilty to a scheme overseeing websites that hosted malware used to cause victims hundreds of millions of dollars in losses, the Justice Department said Friday. Russian nationals Aleksandr Grichishkin and Andrei Skvortsov, along with Aleksandr Skorodumov from Lithuania and Pavel Stassi of Estonia, allegedly oversaw an organization that rented IP addresses, computers servers and domains to cybercriminals between 2008 and 2015.  The practice, known as “bulletproof hosting,” is popular with digital thieves trying to evade law enforcement agencies. Grichishkin, Skvortsov, Skorodumov and Stassi pleaded guilty to one count of RICO conspiracy. They each face up to 20 years in prison. Crooks have used the hacking tools allegedly hosted by the defendants’ organizations to repeatedly infect U.S. financial institutions and defraud victims. That includes Zeus, a notorious piece of malicious code that a variety of criminals have used to steal over $100 million from victims. Despite […]

The post Four men plead guilty to being go-to ‘bulletproof’ hosts for cybercriminals appeared first on CyberScoop.

Continue reading Four men plead guilty to being go-to ‘bulletproof’ hosts for cybercriminals→

As Methbot trial gets underway, prosecutors say a former scammer will testify against alleged ringleader

Posted on by

Nearly three years after he was arrested in a Belgium apartment, Aleksander Zhukov was seated in a Brooklyn courtroom this week to face charges of running a complex fraud scheme that netted millions of dollars.  Zhukov, a Russian national, allegedly functioned as the ringleader of a scheme to use traditional cybercrime techniques to carry out a larger advertising fraud conspiracy, known as Methbot, that the U.S. Department of Justice says netted some $7 million between 2014 and 2016. The trial, scheduled to take place in the coming weeks in a Brooklen federal courtroom, is slated to include testimony from a range of FBI agents, cybersecurity executives and, as the prosecution said on Wednesday, a cooperating witness who worked with Zhukov to carry out the work.  The ruse involved Zhukov’s use of a fake advertising company, which he used to charge marketing firms to run ads, prosecutors said during their opening […]

The post As Methbot trial gets underway, prosecutors say a former scammer will testify against alleged ringleader appeared first on CyberScoop.

Continue reading As Methbot trial gets underway, prosecutors say a former scammer will testify against alleged ringleader→

Magecart scammers aim at restaurants’ online delivery systems

Posted on by

Cybercriminals are increasingly targeting third-party infrastructure that restaurants across the U.S. use to place online orders, private investigators have found. The last six months have seen hacks of five online ordering platforms, exposing some 343,000 payment cards, threat intelligence firm Gemini Advisory said on April 29. With titles like MenuSifu and Food Dudes Delivery, the platforms may not be household names, but hundreds of restaurants use the platforms — and crooks know it. The coronavirus pandemic has only heightened criminals’ interest in online payment systems as people order delivery from restaurants in droves. “Attacks such as these are appealing because breaching the website of a single online ordering platform can compromise transactions at dozens or even hundreds of restaurants,” Gemini Advisory analysts wrote in a blog post. One of the breaches tracked by Gemini Advisory saw the attacker use an attack technique known as Magecart, which involves planting malicious code […]

The post Magecart scammers aim at restaurants’ online delivery systems appeared first on CyberScoop.

Continue reading Magecart scammers aim at restaurants’ online delivery systems→

Magecart scammers aim at restaurants’ online delivery systems

Posted on by

Cybercriminals are increasingly targeting third-party infrastructure that restaurants across the U.S. use to place online orders, private investigators have found. The last six months have seen hacks of five online ordering platforms, exposing some 343,000 payment cards, threat intelligence firm Gemini Advisory said on April 29. With titles like MenuSifu and Food Dudes Delivery, the platforms may not be household names, but hundreds of restaurants use the platforms — and crooks know it. The coronavirus pandemic has only heightened criminals’ interest in online payment systems as people order delivery from restaurants in droves. “Attacks such as these are appealing because breaching the website of a single online ordering platform can compromise transactions at dozens or even hundreds of restaurants,” Gemini Advisory analysts wrote in a blog post. One of the breaches tracked by Gemini Advisory saw the attacker use an attack technique known as Magecart, which involves planting malicious code […]

The post Magecart scammers aim at restaurants’ online delivery systems appeared first on CyberScoop.

Continue reading Magecart scammers aim at restaurants’ online delivery systems→

Crypto scammer who threatened victims’ families pleads guilty, faces 2-year minimum

Posted on by

A plan to steal cryptocurrency and hard-to-find social media accounts has ended with one schemer set to spend at least two years in prison.  Eric Meiggs, a 23-year-old Massachusetts man, pleaded guilty on Wednesday to participating in a plan to steal social media account names and hundreds of thousands of dollars worth of bitcoin, the U.S. Department of Justice announced. Meiggs and a team of associates used SIM swapping, a practice in which scammers take control of victims’ phone numbers, to try to steal more than $530,000 in cryptocurrency from 10 people, DOJ said.  SIM swapping is the process by which attackers convince a victim’s phone carrier to transfer control of a phone number to an attacker, or group of scammers. From there, the intruders abuse access to that phone number to gather passwords, financial transactions or other sensitive data associated with that number. In recent years, thieves have prioritized […]

The post Crypto scammer who threatened victims’ families pleads guilty, faces 2-year minimum appeared first on CyberScoop.

Continue reading Crypto scammer who threatened victims’ families pleads guilty, faces 2-year minimum→

US arrests alleged ‘Bitcoin Fog’ boss, who is accused of laundering millions

Posted on by

U.S. federal agents on Tuesday arrested the alleged operator of Bitcoin Fog, a cryptocurrency-obfuscation service that the dark web’s most notorious marketplaces have reportedly used to move tens of millions of dollars. Roman Sterlingov, a Russian-Swedish national, was arrested in Los Angeles and charged with money laundering for his alleged role as Bitcoin Fog’s mastermind, according to court documents. Created in 2011, Bitcoin Fog bills itself as a means of further anonymizing cryptocurrency transactions by separating transmitted bitcoin from a particular bitcoin address. Some $336 million in transactions were routed through Bitcoin Fog over a decade, according to a criminal complaint against Sterlingov filed in the U.S. District Court for the District of Columbia. That included tens of millions of dollars laundered for dark web forums like AlphaBay and Silk Road, which were known for trafficking in drugs and hacking tools, as well as other illicit products, before being shut […]

The post US arrests alleged ‘Bitcoin Fog’ boss, who is accused of laundering millions appeared first on CyberScoop.

Continue reading US arrests alleged ‘Bitcoin Fog’ boss, who is accused of laundering millions→

Do credit monitoring and ID protection services do much for breach victims?

Posted on by

It has become a staple for companies that are hit by big data breaches: extending free crediting monitoring and identity protection services to customers whose sensitive personal information is at risk. There’s nothing wrong with companies doing that, say consumer advocates — but those advocacy groups also say breached companies can do much, much better. The latest company to get hit by hackers and then offer credit monitoring or identity protection services, Geico, last week outlined a package that’s a little improved above the usual versions, one advocate said. These existing services seem to offer help, yet in some cases that benefit is limited and in others it’s difficult to measure their effectiveness. But overall, there’s little incentive for companies to offer improved redress, consumer advocacy groups contend. “Most breached entities go with credit monitoring because it’s a relatively inexpensive thing for someone to contract with to provide,” said Susan […]

The post Do credit monitoring and ID protection services do much for breach victims? appeared first on CyberScoop.

Continue reading Do credit monitoring and ID protection services do much for breach victims?→

Ransomware demands up by 43% so far in 2021, Coveware says

Posted on by

Ransomware hacking groups are getting greedier. The average demand for a digital extortion payment shot up in the first quarter of this year to $220,298, up 43% from the previous quarter, according to a quarterly report from Coveware, a ransomware response firm. The median payment, too, jumped up 58% from from $49,450 to $78,398. The majority of ransomware attacks in the first quarter also involved theft of corporate data, a continuation of a trend of ransomware actors increasingly relying on exfiltration and extortion demands. Seventy-seven percent of ransomware attacks included the threat to publish stolen data in the first quarter of this year, which is up 10% compared to the last quarter of 2020, Coveware found. The report comes as the U.S. government is working to improve law enforcement actions targeting the infrastructure that supports ransomware gangs. In recognition that extortion demands are an increasingly popular approach, the U.S. Department of […]

The post Ransomware demands up by 43% so far in 2021, Coveware says appeared first on CyberScoop.

Continue reading Ransomware demands up by 43% so far in 2021, Coveware says→

Stanford student finds glitch in ransomware payment system to save victims $27,000

Posted on by

The hackers behind a nascent strain of ransomware hit a snag this week when a security researcher found a flaw in the payment system and, he says, helped victims save $27,000 in potential losses. Stanford University student and security researcher Jack Cable got a call Wednesday from a family friend, who is a doctor, asking for help because cybercriminals had locked the doctor’s computer. The doctor was preparing to pay the ransom when Cable began looking at the hackers’ payment system, according to Cable. The hackers were demanding 0.01 Bitcoin, or roughly $550 at the time, to unlock the doctor’s files. Cable, who served as a cybersecurity adviser to the Department of Homeland Security during the 2020 election, realized that if he changed one letter from lowercase to uppercase in the “transaction ID” the hackers were using to track payments, the system mistook the input for a victim that had […]

The post Stanford student finds glitch in ransomware payment system to save victims $27,000 appeared first on CyberScoop.

Continue reading Stanford student finds glitch in ransomware payment system to save victims $27,000→

A botnet named after Prometheus jumps is also exploiting Exchange Server flaws

Posted on by

Sometimes a glaring new software vulnerability is all that scammers need to revive a trusty hacking scheme.  Just days after Microsoft announced that suspected Chinese spies were exploiting bugs in Microsoft Exchange Server software in March, Russian-speaking attackers controlling a botnet, or army of compromised computers, used those vulnerabilities to conduct a series of intrusions at companies in North America, according to incident responders at security firm Cybereason. The hacks, which are among several breaches involving the Exchange Server vulnerabilities, show how the same bugs in widely used software can be used for very different purposes. And the reemergence of the so-called Prometei botnet, named after the Russian word for Prometheus, the Greek god of fire, is a reminder of the many malicious purposes that the zombie computers serve. Cybereason said it was aware of more than a dozen recent hacking incidents involving the Prometei botnet, which the attackers typically use […]

The post A botnet named after Prometheus jumps is also exploiting Exchange Server flaws appeared first on CyberScoop.

Continue reading A botnet named after Prometheus jumps is also exploiting Exchange Server flaws→