Category Archives: Unit 221B

The Dark Nexus Between Harm Groups and ‘The Com’

Posted on by

A cyberattack that shut down some of the top casinos in Las Vegas last year quickly became one of the most riveting security stories of 2023: It was the first known case of native English-speaking hackers in the United States and Britain teaming up with ransomware gangs based in Russia. But that made-for-Hollywood narrative has eclipsed a far more hideous trend: Many of these young, Western cybercriminals are also members of fast-growing online groups that exist solely to bully, stalk, harass and extort vulnerable teens into physically harming themselves and others. Continue reading The Dark Nexus Between Harm Groups and ‘The Com’→

Hackers Claim They Breached T-Mobile More Than 100 Times in 2022

Posted on by

Three different cybercriminal groups claimed access to internal networks at communications giant T-Mobile in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert any T-Mobile user’s text messages and phone calls to another device. Continue reading Hackers Claim They Breached T-Mobile More Than 100 Times in 2022→

Thinking of Hiring or Running a Booter Service? Think Again.

Posted on by

Most people who operate DDoS-for-hire services attempt to hide their true identities and location. Proprietors of these so-called “booter” or “stresser” services — designed to knock websites and users offline — have long operated in a legally murky area of cybercrime law. But until recently, their biggest concern wasn’t avoiding capture or shutdown by the feds: It was minimizing harassment from unhappy customers or victims, and insulating themselves against incessant attacks from competing DDoS-for-hire services.

And then there are booter store operators like John Dobbs, a 32-year-old computer science graduate student living in Honolulu, Hawaii. For at least a decade until late last year, Dobbs openly operated IPStresser[.]com, a popular and powerful attack-for-hire service that he registered with the state of Hawaii using his real name and address. Likewise, the domain was registered in Dobbs’s name and hometown in Pennsylvania.

The only work experience Dobbs listed on his resume was as a freelance developer from 2013 to the present day. Dobbs’s resume doesn’t name his booter service, but in it he brags about maintaining websites with half a million page views daily, and “designing server deployments for performance, high-availability and security.”

In December 2022, the U.S. Department of Justice seized Dobbs’s IPStresser website and charged him with one count of aiding and abetting computer intrusions. Prosecutors say his service attracted more than two million registered users, and was responsible for launching a staggering 30 million distinct DDoS attacks. Continue reading Thinking of Hiring or Running a Booter Service? Think Again.→

Researchers Quietly Cracked Zeppelin Ransomware Keys

Posted on by

Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called “Zeppelin” in May 2020. He’d been on the job less than six months, and because of the way his predecessor architected things,… Read More » Continue reading Researchers Quietly Cracked Zeppelin Ransomware Keys→

Hackers Gaining Power of Subpoena Via Fake “Emergency Data Requests”

Posted on by

There is a terrifying and highly effective “method” that criminal hackers are now using to harvest sensitive customer data from Internet service providers, phone companies and social media firms. It involves compromising email accounts and websites tied to police departments and government agencies, and then sending unauthorized demands for subscriber data while claiming the information being requested can’t wait for a court order because it relates to an urgent matter of life and death. Continue reading Hackers Gaining Power of Subpoena Via Fake “Emergency Data Requests”→

As firms race to patch Microsoft Exchange flaw, security pros brace for ransomware outbreak

Posted on by

Nobody likes to hurry up and wait. It’s exactly how security professionals are urging vulnerable organizations to protect themselves, though, against a cavalcade of nation-state and criminal hacking groups reportedly working to exploit Microsoft Exchange Server flaws that were announced earlier this month. Suspected Chinese government-linked hackers were the first to allegedly exploit the Microsoft vulnerabilities. As soon as the company released a fix for the bugs, though, taking the issue public, a range of other hacking groups also appeared to try leveraging the flaw. At least ten different advanced threat groups are working to exploit the vulnerabilities now, according to ESET research, while other hackers have stolen email data and others have tried to generate financial revenue. With potentially tens of thousands of victims, the U.S. government — including the National Security Agency, the Department of Homeland Security’s cybersecurity agency, the FBI and the White House — has spent days […]

The post As firms race to patch Microsoft Exchange flaw, security pros brace for ransomware outbreak appeared first on CyberScoop.

Continue reading As firms race to patch Microsoft Exchange flaw, security pros brace for ransomware outbreak→

Voice Phishers Targeting Corporate VPNs

Posted on by

The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees. Continue reading Voice Phishers Targeting Corporate VPNs→

Twitter Hacking for Profit and the LoLs

Posted on by

The New York Times last week ran an interview with several young men who claimed to have had direct contact with those involved in last week’s epic hack against Twitter. These individuals said they were only customers of the person who had access to Twitter’s internal employee tools, and were not responsible for the actual intrusion or bitcoin scams that took place that day. But new information suggests that at least two of them operated a service that resold access to Twitter employees for the purposes of modifying or seizing control of prized Twitter profiles. Continue reading Twitter Hacking for Profit and the LoLs→

Privnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com

Posted on by

For the past year, a site called Privnotes.com has been impersonating Privnote.com, a legitimate, free service that offers private, encrypted messages which self-destruct automatically after they are read. Until recently, I couldn’t quite work out what Privnotes was up to, but today it became crystal clear: Any messages containing bitcoin addresses will be automatically altered to include a different bitcoin address, as long as the Internet addresses of the sender and receiver of the message are not the same. Continue reading Privnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com→