Emotet, NetWalker and TrickBot have taken big blows, but will it be enough?

A trio of operations meant to disrupt ransomware outfits in recent months — two of which came to light this week — could have lasting impacts even if they stop short of ending the threat, security experts say. Researchers are still sizing up the effects of recent busts of the Emotet and NetWalker gangs, but those operations have the potential to be more potent than last fall’s maneuvers against the TrickBot ransomware. In research out Friday, Menlo Security — echoing similar conclusions from other cyber firms — said it saw signs of TrickBot recovering, but the rebound has amounted to just a “trickle.” U.S. Cyber Command and Microsoft had led separate efforts to disrupt the hacking infrastructure of TrickBot, a massive army of zombified computers. The fear was that the botnet could be used to carry out ransomware attacks afflicting the November elections. This week’s two operations might be more promising […]

The post Emotet, NetWalker and TrickBot have taken big blows, but will it be enough? appeared first on CyberScoop.

Continue reading Emotet, NetWalker and TrickBot have taken big blows, but will it be enough?

Ransomware hackers launder bitcoin through just a handful of locations, researchers find

It’s starting to look like the ransomware industry is developing its own version of the 1%, where a small number of players enjoy most of the wealth.  Cybercrime investigators have suggested the spiraling trend of increasingly large ransomware cash demands and attack frequency is not the work of a large number of criminals, but instead the result of a specialized black market economy in which hackers will different skill-sets collaborate on a breach, then split the proceeds. A relatively small number of attack groups actually seem to make up most of that black market economy, offering their malicious software on a rental basis and then taking a sizable chunk of the profits and relying on money laundering to cover their tracks.  Researchers now are tracking more of this activity via the blockchain, an accessible ledger through which public bitcoin transactions are recorded. When ransomware victims pay attackers to unlock their systems to decrypt their […]

The post Ransomware hackers launder bitcoin through just a handful of locations, researchers find appeared first on CyberScoop.

Continue reading Ransomware hackers launder bitcoin through just a handful of locations, researchers find

Russian man tied to illicit hosting service Deer.io pleads guilty

A Russian computer security researcher has pleaded guilty to hacking-related charges in connection with U.S. law enforcement action against an internet marketplace where buyers purchased access to stolen personal data.  Kirill Firsov, a Russian national, acknowledged his involvement with Deer.io, an illicit web hosting service that enabled scammers to operate independent web stores where they sold access to hacked web accounts and other services. The U.S. Department of Justice shuttered the website in March 2020, weeks after Firsov was arrested at John F. Kennedy airport in New York City.  Firsov admitted his role in running Deer.io when he was apprehended at the airport, the plea deal states. He now faces up to 10 years in prison. Deer.io claimed to have more than 24,000 active websites with sales exceeding $17 million, the Justice Department said last year. Various sites hosted through the Deer.io platform offered Americans’ personal information, access to breached […]

The post Russian man tied to illicit hosting service Deer.io pleads guilty appeared first on CyberScoop.

Continue reading Russian man tied to illicit hosting service Deer.io pleads guilty

Intel says financial graphic was ‘hacked,’ forcing early release of 2020 report

Even the leak of a single infographic can be a big deal for a major corporation. Intel Corp. had to act fast Thursday afternoon when it discovered that an infographic from its unpublished quarterly report had been circulating outside the company. As a result, the chipmaker posted those fourth quarter 2020 financial results a few minutes before the stock market closed at 4 p.m., instead of afterward. Chief Financial Officer George Davis told the Financial Times that the graphic had been “hacked” from the company’s public relations newsroom website. Intel has not specified who the thief might be, or where the graphic had been illicitly shared online. As financial cybercrime goes, the incident appears to be small and isolated, but it highlights the appeal of financial data — even a single page from a slide deck — to anyone inclined to use illicitly acquired information to get a leg up […]

The post Intel says financial graphic was ‘hacked,’ forcing early release of 2020 report appeared first on CyberScoop.

Continue reading Intel says financial graphic was ‘hacked,’ forcing early release of 2020 report

Joker’s Stash, a forum for stolen data, says it will shut down within 30 days

An administrator of a notorious forum for stolen payment data and illicitly obtained personal information says they will shutter the site in 30 days.  The Joker’s Stash — an online hub where millions of credit card numbers from restaurants and supermarket chains, among others — will cease operation in the coming month, according to post Friday seen by multiple threat intelligence firms. Word of the closure comes from an administrator whom one researcher described as “credible,” and comes after a recent law enforcement action against part of the site.  The site will shut down on Feb. 15, according to the administrator who goes by the name “JokerStash.” “Joker goes on a well-deserved retirement. Joker’s Stash is closing,” the post said, according to a transcript provided to CyberScoop by Gemini Advisory, a security firm. “When we opened years ago, nobody knew us. Today we are one of the largest cards/dumps marketplace[s].” […]

The post Joker’s Stash, a forum for stolen data, says it will shut down within 30 days appeared first on CyberScoop.

Continue reading Joker’s Stash, a forum for stolen data, says it will shut down within 30 days

Iranian venture firm investing in cyber tech is subject of US sanctions

The U.S. sanctioned an Iranian venture capital firm on Wednesday that the Treasury Department said invests in cyberspace and information technology. Treasury’s Office of Foreign Assets Control identified the firm, Barkat Ventures, as an arm of an organization that the supreme leader of Iran controls called EIKO, short for Execution of Imam Khomeini’s Order. The sanctions also targeted a second Komeini-controlled organization, Astan Quds Razavi. “These institutions enable Iran’s elite to sustain a corrupt system of ownership over large parts of Iran’s economy,” said Secretary Steven Mnuchin. “The United States will continue to target those who enrich themselves while claiming to help the Iranian people.” Barkat Ventures has a small profile outside Iran. An apparent company website cites its desire to invest in technologies such as the internet of things, electronic health, cryptocurrency and software as a service. Its overall goal is to reduce barriers for entrepreneurs in “knowledge-based” businesses, […]

The post Iranian venture firm investing in cyber tech is subject of US sanctions appeared first on CyberScoop.

Continue reading Iranian venture firm investing in cyber tech is subject of US sanctions

Larger CyberBunker investigation yields shutdown of DarkMarket

German law enforcement has shut down an internet market where users bought and sold narcotics, stolen data and hacking tools, authorities said Tuesday. The forum, known as DarkMarket, was the internet’s largest bazaar for illicit goods, the European police agency Europol said, with more than 2,400 vendors and 320,000 transactions completed. Police said they apprehended a single suspect, a 34-year-old Australian man accused of operating the site, near the German-Danish border.  The law enforcement action originated in a larger investigation into the internet hosting provider known as CyberBunker, a notorious service that scammers for a generation have used to operate with little fear of detection.  The CyberBunker hosting service was based in former North Atlantic Treaty Organization bunkers in Holland and then Germany, helping controversial sites avoid police legal enforcement from military-style basements. CyberBunker has housed servers for the Pirate Bay, WikiLeaks and a range of dark net markets as […]

The post Larger CyberBunker investigation yields shutdown of DarkMarket appeared first on CyberScoop.

Continue reading Larger CyberBunker investigation yields shutdown of DarkMarket

Larger CyberBunker investigation yields shutdown of DarkMarket

German law enforcement has shut down an internet market where users bought and sold narcotics, stolen data and hacking tools, authorities said Tuesday. The forum, known as DarkMarket, was the internet’s largest bazaar for illicit goods, the European police agency Europol said, with more than 2,400 vendors and 320,000 transactions completed. Police said they apprehended a single suspect, a 34-year-old Australian man accused of operating the site, near the German-Danish border.  The law enforcement action originated in a larger investigation into the internet hosting provider known as CyberBunker, a notorious service that scammers for a generation have used to operate with little fear of detection.  The CyberBunker hosting service was based in former North Atlantic Treaty Organization bunkers in Holland and then Germany, helping controversial sites avoid police legal enforcement from military-style basements. CyberBunker has housed servers for the Pirate Bay, WikiLeaks and a range of dark net markets as […]

The post Larger CyberBunker investigation yields shutdown of DarkMarket appeared first on CyberScoop.

Continue reading Larger CyberBunker investigation yields shutdown of DarkMarket

Russian man sentenced to 12 years in prison for massive JPMorgan data heist

A U.S. federal judge on Thursday sentenced Andrei Tyurin, a 37-year-old Russian man, to 12 years in prison for his role in a hacking scheme that prosecutors say involved the theft of personal data from over 100 million customers of big U.S. financial firms. The brazen hacking operation, which ran from 2012 to 2015, is one of the biggest to hit Wall Street in recent memory. It involved Tyurin allegedly working with an Israeli man named Gery Shalon, among others, to breach big-name companies like JPMorgan Chase, ETrade and The Wall Street Journal. The scammers then sought to inflate stock prices by marketing them to people whose data they had stolen. Tyurin’s breach of JPMorgan Chase alone saw data on 80 million customers stolen, according to prosecutors. The Russian man made $19 million altogether from the hacking, the Justice Department said in a statement. The case is a win for […]

The post Russian man sentenced to 12 years in prison for massive JPMorgan data heist appeared first on CyberScoop.

Continue reading Russian man sentenced to 12 years in prison for massive JPMorgan data heist