Category Archives: U.S. Department of Justice

New Leak Shows Business Side of China’s APT Menace

Posted on by

A new data leak that appears to have come from one of China’s top private cybersecurity firms provides a rare glimpse into the commercial side of China’s many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage campaigns to the nation’s burgeoning and highly competitive cybersecurity industry. Continue reading New Leak Shows Business Side of China’s APT Menace→

Botnet Attack Targeted Routers: A Wake-Up Call for Securing Remote Employees’ Hardware

Posted on by

The FBI spotted this state-sponsored attack that highlights how home office setups can be overlooked when it comes to employees’ cybersecurity. Continue reading Botnet Attack Targeted Routers: A Wake-Up Call for Securing Remote Employees’ Hardware→

BlackCat Ransomware Raises Ante After FBI Disruption

Posted on by

The U.S. Federal Bureau of Investigation (FBI) disclosed today that it infiltrated the world’s second most prolific ransomware gang, a Russia-based criminal group known as ALPHV and BlackCat. The FBI said it seized the gang’s darknet website, and released a decryption tool that hundreds of victim companies can use to recover systems. Meanwhile, BlackCat responded by briefly “unseizing” its darknet site with a message promising 90 percent commissions for affiliates who continue to work with the crime group, and open season on everything from hospitals to nuclear power plants. Continue reading BlackCat Ransomware Raises Ante After FBI Disruption→

U.S. Hacks QakBot, Quietly Removes Botnet Infections

Posted on by

The U.S. government today announced a coordinated crackdown against QakBot, a complex malware family used by multiple cybercrime groups to lay the groundwork for ransomware infections. The international law enforcement operation involved seizing control over the botnet’s online infrastructure, and quietly removing the Qakbot malware from tens of thousands of infected Microsoft Windows computer systems. Continue reading U.S. Hacks QakBot, Quietly Removes Botnet Infections→

Feds Take Down 13 More DDoS-for-Hire Services

Posted on by

The U.S. Federal Bureau of Investigation (FBI) this week seized 13 domain names connected to “booter” services that let paying customers launch crippling distributed denial-of-service (DDoS) attacks. Ten of the domains are reincarnations of DDoS-for-hire services the FBI seized in December 2022, when it charged six U.S. men with computer crimes for allegedly operating booters. Continue reading Feds Take Down 13 More DDoS-for-Hire Services→

$10M Is Yours If You Can Get This Guy to Leave Russia

Posted on by

The U.S. government this week put a $10 million bounty on the head of a Russian man who for the past 18 years operated Try2Check, one of the cybercrime underground’s most trusted services for checking the validity of stolen credit card data. U.S. authorities say 43-year-old Denis Kulkov’s card-checking service made him at least $18 million, which he used to buy a Ferrari, Land Rover, and other luxury items. Continue reading $10M Is Yours If You Can Get This Guy to Leave Russia→

UK Sets Up Fake Booter Sites To Muddy DDoS Market

Posted on by

The United Kingdom’s National Crime Agency (NCA) has been busy setting up phony DDoS-for-hire websites that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.  Continue reading UK Sets Up Fake Booter Sites To Muddy DDoS Market→

Meet the Administrators of the RSOCKS Proxy Botnet

Posted on by

Authorities in the United States, Germany, the Netherlands and the U.K. last week said they dismantled the “RSOCKS” botnet, a collection of millions of hacked devices that were sold as “proxies” to cybercriminals looking for ways to route their malicious traffic through someone else’s computer. While the coordinated action did not name the Russian hackers allegedly behind RSOCKS, KrebsOnSecurity has identified its owner as a Russian man living abroad who also runs the world’s top Russian spamming forum. Continue reading Meet the Administrators of the RSOCKS Proxy Botnet→

RaidForums Gets Raided, Alleged Admin Arrested

Posted on by

The U.S. Department of Justice (DOJ) said today it seized the website and user database for RaidForums, an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. The DOJ also charged the alleged administrator of RaidForums — 21-year-old Diogo Santos Coelho, of Portugal — with six criminal counts, including conspiracy, access device fraud and aggravated identity theft. Continue reading RaidForums Gets Raided, Alleged Admin Arrested→

Actions Target Russian Govt. Botnet, Hydra Dark Market

Posted on by

The U.S. Federal Bureau of Investigation (FBI) says it has disrupted a giant botnet built and operated by a Russian government intelligence unit known for launching destructive cyberattacks against energy infrastructure in the United States and Ukraine. Separately, law enforcement agencies in the U.S. and Germany moved to decapitate “Hydra,” a billion-dollar Russian darknet drug bazaar that also helped to launder the profits of multiple Russian ransomware groups. Continue reading Actions Target Russian Govt. Botnet, Hydra Dark Market→