Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Latest News

Rise in Data-Stealing Malware Targeting Developers, Sonatype Warns

  A recent report released on April 2 has uncovered a worrying rise in open-source malware aimed at developers. These attacks, described a...

All the recent news you need to know
User Security
Cyber Fraud Deepfakes Financial Scam Hong Kong Police User Security

Eight Arrested Over Financial Scam Using Deepfakes

 

Hong Kong police have detained eight people accused of running a scam ring that overcame bank verification checks to open accounts by replacing images on lost identification cards with deepfakes that included scammers' facial features. 

Senior Superintendent Philip Lui Che-ho of the force's financial intelligence and investigation division stated on Saturday that the raid was part of a citywide operation on scams, cybercrime, and money laundering that took place between April 7 and 17. Officers arrested 503 persons aged 18 to 80. Losses in the cases surpassed HK$1.5 billion (US$193.2 million. 

Officers arrested the eight suspects on Thursday for allegedly using at least 21 Hong Kong identification cards that were reported lost to make 44 applications to create local bank accounts, according to Chief Inspector Sun Yi-ki of the force's cybersecurity and technology crime branch. 

“The syndicate first tried to use deepfake technology to merge the scammer’s facial features with the cardholder’s appearance, followed by uploading the scammer’s selfie to impersonate the cardholder and bypass the online verification process,” Sun said. 

Following the successful completion of online identification checks at banks, thirty out of the forty-four applications were accepted. In half of the successful attempts, artificial intelligence was used to construct images that combined the identity card's face with the scammer's. The others just substituted the scammer's photo for the one on the ID.

Police claimed the bank accounts were used to apply for loans and make credit card transactions worth HK$860,000, as well as to launder more than HK$1.2 million in suspected illegal proceeds. Sun said the force was still looking into how the syndicate obtained the ID cards, which were claimed lost between 2023 and 2024. On suspicion of conspiracy to defraud and money laundering, police detained the six men and two women and seized numerous laptops, phones, and external storage devices. 

The accused range in age from 24 to 41, with the mastermind and main members of the ring allegedly belonging to local triad gangs. Lui urged the public against renting, lending, or selling access to their bank accounts to anyone.

The 333 men and 170 women arrested during the citywide raid were discovered to be engaged in 404 crimes, the most of which were employment frauds, financial swindles, and internet shopping scams. They were caught for conspiracy to defraud, gaining property by deception, and money laundering. Two cross-border money-laundering operations were busted in coordination with mainland Chinese authorities over the last two weeks. 

Lui claimed that one of the syndicates laundered alleged illicit earnings from fraud operations by hiring tourists from the mainland to purchase gold jewellery in Hong Kong. Between last December and March of this year, the syndicate was discovered to have been involved in 240 mainland scam instances, resulting in losses of 18.5 million yuan (US$2.5 million). 

“Syndicate masterminds would recruit stooges from various provinces on the mainland, bringing them to Hong Kong via land borders and provide hostel accommodation,” the senior superintendent stated.

Syndicate members would then arrange for the recruits to purchase gold jewellery in the city using digital payment methods, with each transaction costing tens to hundreds of thousands of Hong Kong dollars. On Tuesday last week, Hong Kong police apprehended three individuals who had just purchased 34 pieces of gold jewellery for HK$836,000 per the syndicate's orders. Two of them had two-way passes, which are travel documents that allow mainlanders to access the city. The third suspect was a Hong Konger.

On the same day, mainland police arrested 17 persons. The second cross-border syndicate arranged for mainlanders to create accounts in Hong Kong using fraudulent bank, employment, and utility bill documents. Police in Hong Kong and the mainland arrested a total of 16 persons in connection with the investigation. From December 2023 to April, the syndicate was involved in 61 scam instances in the city, resulting in losses of HK$26.7 million. Accounts were created to receive the scam money.
Read more »
Ransomwares
Cyber Attacks Cyber Researchers Dark Web data security Interlock Interlock ransomware Malware Attack Ransomware attack Ransomwares

Interlock Ransomware Gang Deploys ClickFix Attacks to Breach Corporate Networks

 

Cybersecurity researchers have revealed that the Interlock ransomware gang has adopted a deceptive social engineering technique called ClickFix to infiltrate corporate networks. This method involves tricking users into executing malicious PowerShell commands under the guise of resolving system errors or completing identity verification steps, leading to the deployment of file-encrypting malware. 

While ClickFix attacks have previously been associated with ransomware campaigns, this marks the first confirmed use by Interlock, a ransomware operation that surfaced in late September 2024. The group targets both Windows systems and FreeBSD servers and maintains a dark web leak portal to pressure victims into paying ransoms that can reach millions of dollars. Interlock does not seem to operate as a ransomware-as-a-service (RaaS) model. 

According to Sekoia researchers, Interlock began using ClickFix tactics in January 2025. Attackers set up fake websites mimicking legitimate IT tools—such as Microsoft Teams and Advanced IP Scanner—to lure victims. These fake sites prompt users to click a “Fix it” button, which silently copies a malicious PowerShell script to the user’s clipboard. If run, the command downloads a 36MB PyInstaller payload that installs malware under the guise of a legitimate tool. 

Researchers found the malicious campaign hosted on spoofed domains like microsoft-msteams[.]com, microstteams[.]com, ecologilives[.]com, and advanceipscaner[.]com. Only the last domain led to the actual malware dropper disguised as Advanced IP Scanner. When users unknowingly run the script, a hidden PowerShell window executes actions such as system reconnaissance, persistence via Windows Registry, and data exfiltration. The attackers deploy a range of malware via command-and-control (C2) servers, including LummaStealer, BerserkStealer, keyloggers, and the Interlock RAT—a basic remote access trojan capable of dynamic configuration, file exfiltration, shell command execution, and DLL injection. 

Post-compromise, Interlock operators use stolen credentials to move laterally through networks via RDP, leveraging remote access tools like PuTTY, AnyDesk, and LogMeIn. Data is exfiltrated to Azure Blob Storage, after which the Windows variant of Interlock ransomware is scheduled to run daily at 8:00 PM—a redundancy tactic to ensure encryption if the initial payload fails. The gang’s ransom notes have also evolved, now placing emphasis on the legal and regulatory consequences of leaked data. 

ClickFix attacks are gaining popularity among various cybercriminal groups, with recent reports also linking them to North Korean state-sponsored actors like the Lazarus Group, who use similar tactics to target job seekers in the cryptocurrency sector.
Read more »
Vulnerabilities
Andriod ATR Cyber Hackers Cybersecurity CyberThreat MaaS malware NFC SiperCard TLS Vulnerabilities

New Android Threat Raises Concern Over NFC Relay Attack Vulnerabilities

 


In recent times, there has been considerable concern with regards to some newly uncovered Android-based malware-as-a-service (Maas) platforms, particularly those based on Android and known as SuperCard X. This is because this platform was able to execute these attacks in near-field communication (NFC). A sophisticated tool such as this enables threat actors to make unauthorised contactless payments, allowing them to withdraw money without requiring direct physical access to their cards. 

Through advanced near-field communication (NFC) relay techniques, this malware is able to allow threat actors to authorize illicit transactions at contactless-enabled ATMs and Point-of-Sale (POS) terminals without actually requiring the victim to give them their card details. Using such methods, the attacker deceives users into installing a malicious Android application, during which their payment cards are tapped against their compromised devices. 

The sensitive data from the NFC tags is intercepted and relayed in real time to the attacker-controlled infrastructure while the attack is taking place. It appears that the platform has been part of a Malware-as-a-Service MaasS) ecosystem for Chinese-speaking users. In addition, it appears to have a significant amount of code overlap with NGate, a malicious NFC toolkit that was previously documented by ESET in 2024. The campaign has had a wide-reaching impact on not only banking customers but also credit card issuers and payment processors as well. 

With the help of widely adopted contactless payment technologies, attackers are able to devise an extremely effective means of executing an unauthorised cashout, especially if they trick the user into disabling transaction limits. This campaign's success has been attributed to its combination of streamlined malware and persuasive social engineering, a development that signals a significant change in the tactics used by mobile threat actors in the future.

Apparently, the current campaign appears to be primarily targeting Italian bank customers and cardholders, according to recent research conducted by the fraud prevention firm Cleafy. It is reported that the attackers intend to collect sensitive payment card data through a methodical and layering approach in a very systematic way. Several analysts, including Federico Valentini, Alessandro Strino, and Michele Roviello, have concluded that SuperCard X uses a multiphase strategic attack method. 

Social engineering tactics are used to lure victims into installing malicious Android applications, which can intercept NFC data that has been compromised from a compromised device. This can include SMS-based phishing (smishing) as well as deceptive phone calls that lure victims into installing malicious Android applications. Additionally, preliminary findings indicate that the service is actively promoted on Telegram channels, which suggests that the tool’s distribution and monetisation are being supported by a larger underground network. 

The campaign's focus is on covert data harvesting and real-time exploitation of data, a trend which highlights the importance of mobile devices as a critical point of entry for financial fraudsters. A growing number of mobile payments is highlighting a need for enhanced awareness of users, robust security protocols, and real-time threat intelligence to combat the ever-increasing number of mobile-focused cyberattacks. As far as the malware's operational architecture is concerned, it displays a clever combination of sophistication and subtlety. 

To keep the component known as "Reader" from being detected by security platforms that are based on heuristics or signature-based and signature-driven algorithms, such as VirusTotal, the component is intentionally designed to only ask for basic system permissions as well as some NFC permissions, an intentional design choice. The technical findings of Cleafy indicate significant code reuse from the open-source relay toolkit NFCGate and the malicious variant NGate, both of which were identified by ESET in 2024. 

Using publicly available frameworks has probably accelerated development and led to a quicker onboarding process for new threat actor affiliates because it allows development to take place faster. When victims are coerced into tapping their credit or debit cards against a compromised device, they are silently captured, including low-level smart card responses such as the Answer To Reset (ATR) messages, from the compromised device. This is often done through social engineering.

Data such as this is sent instantly through a command-and-control network that is based on HTTP and protected with mutually negotiated TLS authentication, which limits communication to validated client instances and reduces the probability of external intrusion. During the same time, a secondary application on a separate attacker-controlled Android device called the "Tapper" is played that simulates the victim's card at a payment terminal or contactless ATM by using Host-Based Card Emulation (HCE). 

With a combination of disabling the card spending limits for the victim, this tactic can ensure that the maximum number of fraudulent withdrawals are made while remaining virtually undetectable by standard mobile security solutions. As a result of Cleafy's analysis, SuperCard X is designed to be stealthy, and it has remained undetected by all antivirus solutions listed on VirusTotal until today. 

Having such a restricted permission model, as well as the absence of overtly malicious behaviours, such as screen overlays and intrusive access requests, which are commonly flagged by heuristic-based security engines, contributes greatly to this success. There is an evident high level of technical competence among the threat actors behind SuperCard X, particularly in the implementation of an ATR-based (Answer to Reset) card emulation system, which demonstrates a high level of technical competence. 

A malware program that replicates the initial response sequence of the smartcard convincingly allows fraudulent transactions to be processed without raising suspicions at a payment terminal by convincingly mimicking authentic smartcard behaviour. In addition to this, users have built a command-and-control infrastructure with mutual Transport Layer Security (MTLS), which ensures that no client devices are permitted to communicate unless they are authenticated. 

A certificate-based verification ensures that not only is data integrity protected, but the network traffic analysis process is hindered significantly by security researchers and law enforcement agencies due to the fact that this certificate is based on verification. Together, these technical safeguards ensure that this malware does not leave a large footprint on the networks and demonstrate how mature the campaign is operationally. 

There is some evidence that the activity associated with SuperCard X is currently restricted to Italy geographically, although Cleafy's report cautions that the threat could rapidly escalate on a global scale if the problem is not addressed promptly. Cybercriminals can acquire and deploy malware-as-a-service (MaaaS) tools on dark web marketplaces that are readily available, which makes it easy for them to acquire and deploy malware against targets from any region. This raises concerns about possible expansion into broader markets, including those in North America and Europe. 

Using convincing social engineering tactics, such as urgent text messages masquerading as official communication from financial institutions, the campaign leverages persuasive social engineering techniques. The messages are designed in such a way that they cause panic in users and prompt them to immediately act, such as clicking on malicious links or downloading unauthorised applications, in order to generate immediate results. 

Individuals should ensure that they verify such messages independently by contacting their financial providers directly through trusted channels in cases where the sender's number matches the victim's actual bank number, especially if the sender's number has been spoofed to match that number. Whenever users receive a request to download an application through an external link, they should be aware that it is a red flag. No legitimate bank would ever ask users for this type of request. 

The user should only install applications from verified sources, such as the Google Play Store, which offer banking apps. It is essential to maintain the functionality of built-in security features on users' Android device, such as Google Play Protect, to mitigate the risk of exposure to threats like SuperCard X. This service continuously scans every application users install and any new applications they download for malicious behavior. 

There are a few things users should consider, such as installing a third-party mobile security solution, as well as awareness and good cyber hygiene practices. As this malware continues to circulate in the wild, awareness and good cyber hygiene are the two best ways to combat the increasing number of mobile malware threats.
Read more »
phones
Computer Cyber Security Data Storage digital data phones

How Clearing Digital Mess Can Help You Save Money and Feel Better


 

Many people today are struggling with digital clutter. This means having too many files, photos, apps, and emails saved on phones or computers. A new survey shows that more than three out of four people have more digital data than they need.

The research, done in early 2025 by Compass Datacenters, asked 1,000 people about their digital habits. It found that digital overload is becoming a serious problem, and most people don’t know how to deal with it.


Why It Feels Overwhelming

Sorting through digital files can feel stressful. Around 33% of people said the thought of organizing their digital space made them feel uneasy or anxious. Only a small number—about 10% felt sure of how to clean up their digital mess.

People understand that too many saved files can slow down devices and make it hard to find what’s important. Yet, most don’t take the time to delete old data. This is often because they don’t know where to start or feel it will take too long.


The High Price of Keeping Everything

Holding on to unnecessary data isn’t just bad for your device— it can also hurt your wallet. Cloud storage services charge monthly fees, and these costs add up. The survey shared an example: If someone starts paying $20 per month for storage at age 25 and continues until they’re 85, they could spend about $40,000 in total.

Many younger people are choosing to buy more storage space instead of clearing files they no longer use.


Easy Ways to Start Cleaning

Cleaning your digital space doesn’t have to be difficult. Begin by checking your photo gallery. Delete pictures that are blurry, repeated, or no longer needed. Doing this once a month makes it easier.

Then, look at your apps. Are there any you haven’t opened in a long time? If yes, remove them. You can always download them again later.

Your downloads folder and email inbox can also hold a lot of junk. Old receipts, random files, and unread emails can take up space. Try removing emails with attachments first—they usually take up more storage.

Instead of paying every month for cloud storage, you can buy a hard drive once and store your files there. These drives offer lots of space at a one-time cost that can save you money over the years.


Make Digital Clean-Up a Routine

Just like cleaning your home, organizing your digital life works best when done regularly. Pick a day every few months to sort through your phone or computer. It may seem boring at first, but it feels great once done.

By cleaning your digital space often, you can keep your devices faster, reduce stress, and stop spending extra money on storage you might not need.


Read more »
Symbolic
Backdoor Cyber Attacks FortiGate devices Security Patch Symbolic

Over 16,000 Fortinet Devices Infected With the Symlink Backdoor

 

Over 16,000 internet-connected Fortinet devices have been identified as having a new symlink backdoor that permits read-only access to sensitive data on previously compromised systems. 

The Shadowserver Foundation, a threat monitoring platform, has stated that 14,000 machines were exposed. Earlier this week, Shadowserver's Piotr Kijewski told a local media source that the cybersecurity firm now recognises 16,620 devices affected by the newly discovered persistence method. 

Last week, Fortinet notified customers that they had found a new persistence mechanism employed by a threat actor to maintain read-only remote access to files in the root filesystem of previously hacked but now patched FortiGate devices. 

Fortinet stated that this was not due to the exploitation of new vulnerabilities, but rather to attacks beginning in 2023 and continuing into 2024, in which a threat actor used zero days to compromise FortiOS devices. 

After gaining access to the devices, they made symbolic connections to the root file system on SSL-VPN-enabled devices in the language files folder. Even after the initial vulnerabilities were fixed, the threat actor could still access the root file system by browsing to the language files, which are publically available on FortiGate devices with SSL-VPN enabled. 

"A threat actor used a known vulnerability to implement read-only access to vulnerable FortiGate devices. This was achieved via creating a symbolic link connecting the user filesystem and the root filesystem in a folder used to serve language files for the SSL-VPN. This modification took place in the user filesystem and avoided detection," Fortinet stated. 

"Therefore, even if the customer device was updated with FortiOS versions that addressed the original vulnerabilities, this symbolic link may have been left behind, allowing the threat actor to maintain read-only access to files on the device's file system, which may include configurations.” 

Earlier this month, Fortinet began discreetly notifying customers via email about FortiGate devices that FortiGuard discovered as being infected with this symlink backdoor. In order to identify and eliminate this malicious symbolic link from compromised devices, Fortinet has released an improved AV/IPS signature.

Additionally, the firmware has been updated to the most recent version in order to detect and remove the link. The upgrade also stops the integrated web server from serving unrecognised files and folders. Finally, if a device was identified as hacked, it is probable that the threat actors had access to the latest configuration files, including credentials.
Read more »
Ransomwares
Backdoor Backdoor Attacks Critical Infrastructure Cyber Attacks Healthcare Malware Attack RansomHub Ransomware attack Ransomwares

Symantec Links Betruger Backdoor Malware to RansomHub Ransomware Attacks

 

A sophisticated custom backdoor malware called Betruger has been discovered in recent ransomware campaigns, with Symantec researchers linking its use to affiliates of the RansomHub ransomware-as-a-service (RaaS) group. The new malware is considered a rare and powerful tool designed to streamline ransomware deployment by minimizing the use of multiple hacking tools during attacks. 

Identified by Symantec’s Threat Hunter Team, Betruger is described as a “multi-function backdoor” built specifically to aid ransomware operations. Its functions go far beyond traditional malware. It is capable of keylogging, network scanning, privilege escalation, credential theft, taking screenshots, and uploading data to a command-and-control (C2) server—all typical actions carried out before a ransomware payload is executed. Symantec notes that while ransomware actors often rely on open-source or legitimate software like Mimikatz or Cobalt Strike to navigate compromised systems, Betruger marks a departure from this norm. 

The tool’s development suggests an effort to reduce detection risks by limiting the number of separate malicious components introduced during an attack. “The use of custom malware other than encrypting payloads is relatively unusual in ransomware attacks,” Symantec stated. “Betruger may have been developed to reduce the number of tools dropped on a network during the pre-encryption phase.” Threat actors are disguising the malware under file names like ‘mailer.exe’ and ‘turbomailer.exe’ to pose as legitimate mailing applications and evade suspicion. While custom malware isn’t new in ransomware operations, most existing tools focus on data exfiltration. 

Notable examples include BlackMatter’s Exmatter and BlackByte’s Exbyte, both created to steal data and upload it to cloud platforms like Mega.co.nz. However, Betruger represents a more all-in-one solution tailored for streamlined attack execution. The RansomHub RaaS operation, previously known as Cyclops and Knight, surfaced in early 2024 and has quickly become a major threat actor in the cybercrime world. Unlike traditional ransomware gangs, RansomHub has focused more on data theft and extortion rather than just data encryption. Since its emergence, RansomHub has claimed several high-profile victims including Halliburton, Christie’s auction house, Frontier Communications, Rite Aid, Kawasaki’s EU division, Planned Parenthood, and Bologna Football Club. 

The group also leaked Change Healthcare’s stolen data after the BlackCat/ALPHV ransomware group’s infamous $22 million exit scam. More recently, the gang claimed responsibility for breaching BayMark Health Services, North America’s largest addiction treatment provider. BayMark serves over 75,000 patients daily across more than 400 locations in the US and Canada. According to the FBI, as of August 2024, RansomHub affiliates have compromised over 200 organizations, many of which are part of critical infrastructure sectors such as government, healthcare, and energy. 

As ransomware groups evolve and adopt more custom-built malware like Betruger, cybersecurity experts warn that defenses must adapt to meet increasingly sophisticated threats.
Read more »
Data Leak
Anonymous Cyber Vigilantes CyberCrime Cyberhackers Cybersecurity CyberThreat Data Breach Data Leak

Cyber Vigilantes Strike Again as Anonymous Reportedly Leaks 10TB of Sensitive Russian Data

 


It has been a dramatic turn in the cyber world for the globally recognised hacktivist collective Anonymous in the last few days, with the claim that a colossal data breach has been perpetrated against the Russian government and its business elite. This is a bold claim made by Anonymous. According to reports, a group known for its high-profile digital interventions has allegedly leaked tens of terabytes of sensitive and classified data online. 
 
As a result of several sources that have been tracking the activities of the group, it appears that the breach may encompass a wide range of internal communications, financial records, and unreleased documents that are related to many key Russian institutions and corporations, including many of their key financial records. 

They first announced the leak in a post on X (formerly known as Twitter), stating the extent of the breach and describing the type of data that was compromised. There is also a mention of an unusual file titled "Leaked Data of Donald Trump" that is allegedly included within the cyber trove, adding an unexpected twist to the cyber saga. 

The authenticity of this particular file is still subject to scrutiny, but its presence implies that repercussions could extend beyond the borders of Russia because it has been leaked in the first place. As a result, it would be one of the largest political data leaks in recent years, raising serious concerns about cybersecurity vulnerabilities as well as the evolving tactics of digital activism in geopolitics, which could have a significant impact on the international landscape. Cyber analysts are closely watching the situation, as governments and corporations assess the potential fallout. 

Many are anticipating a wave of digital confrontations across global borders, as well as a response by governments and corporations. It was reported on Tuesday that the latest breach is a result of ongoing tensions between Russia and the digital activist community Anonymous, which is a decentralised and leaderless collective known for conducting cyberattacks against oppressive or corrupt entities. Anonymous warned internet users that former US President Donald Trump and Russian President Vladimir Putin have been alleged to be linked. 

Digital disruption has long been a cornerstone of the group's agenda, which seeks to promote transparency. In most cases, the group targets authoritarian regimes, controversial political figures, and powerful corporations, often blurring the line between cyberwarfare and protest. 

On April 15, 2025, a leaked archive allegedly contained a large amount of politically charged material that has been leaked. Several classified documents have been compiled in the book, including classified details on the internal political machinery of the Russian Federation, as well as sensitive information on local companies and their financial operations. Particularly noteworthy are files that are allegedly about Kremlin-linked assets located overseas and influence networks spanning Western countries. 

An anonymous statement was published on their official X (formerly Twitter) account by Anonymous on September 21st: "In defense of Ukraine, Anonymous has released 10TB of data in support of Ukraine, including leaked information about every Russian business operating in the West, all Kremlin assets, pro-Russian officials, Donald Trump, and many more." In light of the extent of the unprecedented in scope as well as the implication wave of speculation, scrutiny, and concern has swept global intelligence and cybersecurity officials. 
 
With the publication of this digital exposition, it has been possible to shed new light on a variety of things that occurred behind the scenes, ranging from undisclosed financial affiliations to private information regarding high-profile politicians and other figures. As a result of the addition of data allegedly related to Donald Trump to the breach, the geopolitical implications of it grow even more significant, suggesting that Anonymous may not only be trying to expose the Russian state's inner workings, but also to highlight covert operations and transnational alliances that were previously unknown. 
 
In a statement released on Tuesday, April 15, Anonymous claimed responsibility for the leak of approximately ten terabytes of Kremlin-linked data, which was the result of what they described as a massive cyber attack conducted by the hacktivist group in support of Ukraine. Initially, Anonymous TV, a prominent affiliate channel on the social media platform X (formerly Twitter), made the disclosure as part of their first campaign for public awareness of the group’s activities. There is an indication that this trove has been leaked by the Russian government, as well as the Kremlin assets located in the West as and pro-Russian officials. 

Among the information gathered was a reshared file titled “Leaked Data of Corrupt Officials”, which was originally published by Anonymous France, a second X-based account associated with this movement. Because Anonymous is a decentralised and loosely coordinated organisation, it remains unclear what the exact relationship is between these different factions, such as Anonymous TV and Anonymous France, because their nature remains decentralised and loosely coordinated. 

Often, because of the movement's structure, cells and supporters can act independently from each other, blurring the lines between direct affiliations and amplifying the reach and impact of their campaigns at the same time. Among the screenshots shared by Anonymous TV, a glimpse of the structure of the directory was revealing. To describe the contents of the folder, it was divided into several subfolders under the heading "Leaked Data of", which contained the names of people and organisations from various fields. There was a remarkable number of entries, including those of Serbian President Aleksandar Vučić, former US President Donald Trump and, not surprisingly, the American fast food chain Domino's Pizza. 

A broad range of entities included in this data release suggests the release is not just aimed at governments and politicians, but is likely to target commercial interests believed to be operating in Kremlin-linked spheres of influence. There is no doubt that Anonymous's digital crusade is complex and it is often controversial, because of the breadth and unpredictability of its targets. There has been widespread media coverage of the alleged Anonymous data leak, but questions have emerged about the source and significance of the data that have ascended to thrface as a result. 

According to Technology journalist Mikael Thalen, in a separate report, there could be a possible source of the files as well: A user using the handle @CyberUnknown45 who reportedly had begun teasing about and discussing the existence of such data caches as early as December 2023. 

In this regard, Thalen believes that a significant percentage of the leaked material consists of previous leaks, as well as documents which have already been publicly available, scraped from various online sources, as well as documents which were previously leaked in prior hacks. Additionally, he referred to cyber researcher Best, whose insights aligned with this assessment as well. Further, Cybernews, a well-known cybersecurity publication, expressed scepticism about the archive, saying it contained a “large amount of random data,” according to the publication. 

According to the publication, early impressions from the cybersecurity community indicate that the leak is not as sensational as initially claimed. According to Cybernews, the vast trove of leaked information seems to be simply not that exciting and is more of a noise than anything. Cybernews wrote that most people do not seem to be that interested in the information released. However, an analysis of the data has been provided by an individual whose Reddit profile is titled civilservant2011, who claims to have downloaded and examined it. Their post indicated that the archive was mainly divided into company-specific folders, which contained a variety of PDF documents related to various Russian companies, primarily those associated with the defence sector. 

The user mentioned that this archive may be useful for the Ukrainian armed forces, since it contains hundreds of documents about Russian defence contractors, as well as many others related to the Ukrainian armed forces. There is no doubt that this content does not appear to be headline-worthy at first glance, however, it can still have a substantial strategic value to military intelligence or geopolitical analysts. Additionally, the report is contextualised by previous claims that Ukraine’s Defence Intelligence Agency (HUR) made in March 2024, when it claimed that Russian Ministry of Defence databases were breached.  

In addition, the HUR report also states that this operation yielded sensitive data on the Russian Armed Forces, enabling Ukraine to better understand its adversary's military infrastructure. As a result of these developments, it is becoming increasingly apparent that cyber warfare is becoming increasingly complex, where the line between hacktivism, espionage, and information warfare is continuing to get blurred.
Read more »
Subscribe to: Posts (Atom)