Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Hackers. Show all posts
zero-click
Data Breach Hackers paragon Spyware WhatsApp zero-click

WhatsApp Fixes Security Flaw Exploited by Spyware

 



WhatsApp recently fixed a major security loophole that was being used to install spyware on users' devices. The issue, known as a zero-click, zero-day vulnerability, allowed hackers to access phones without the user needing to click on anything. Security experts from the University of Toronto’s Citizen Lab uncovered this attack and linked it to Paragon’s spyware, called Graphite.  

The flaw was patched by WhatsApp in late 2023 without requiring users to update their app. The company also chose not to assign a CVE-ID to the vulnerability, as it did not meet specific reporting criteria.  

A WhatsApp spokesperson confirmed that hackers used the flaw to target certain individuals, including journalists and activists. WhatsApp directly reached out to around 90 affected users across multiple countries.  


How the Attack Worked  

Hackers used WhatsApp groups to launch their attacks. They added their targets to a group and sent a malicious PDF file. As soon as the file reached the victim’s phone, the device automatically processed it. This triggered the exploit, allowing the spyware to install itself without any user action.  

Once installed, the spyware could access sensitive data and private messages. It could also move beyond WhatsApp and infect other apps by bypassing Android’s security barriers. This gave attackers complete control over the victim’s device.  


Who Was Targeted?  

According to Citizen Lab, the attack mostly focused on individuals who challenge governments or advocate for human rights. Journalists, activists, and government critics were among the key targets. However, since only 90 people were officially notified by WhatsApp, experts believe the actual number of victims could be much higher.  

Researchers found a way to detect the spyware by analyzing Android device logs. They identified a forensic marker, nicknamed "BIGPRETZEL," that appears on infected devices. However, spotting the spyware is still difficult because Android logs do not always capture all traces of an attack.  


Spyware Linked to Government Agencies  

Citizen Lab also investigated the infrastructure used to operate the spyware. Their research uncovered multiple servers connected to Paragon’s spyware, some of which were linked to government agencies in countries like Australia, Canada, Cyprus, Denmark, Israel, and Singapore. Many of these servers were rented through cloud platforms or hosted directly by government agencies.  

Further investigation revealed that the spyware's digital certificates contained the name “Graphite” and references to installation servers. This raised concerns about whether Paragon's spyware operates similarly to Pegasus, another surveillance tool known for being used by governments to monitor individuals.  


Who Is Behind Paragon Spyware?  

Paragon Solutions Ltd., the company behind Graphite spyware, is based in Israel. It was founded in 2019 by Ehud Barak, Israel’s former Prime Minister, and Ehud Schneorson, a former commander of Unit 8200, an elite Israeli intelligence unit.  

Paragon claims that it only sells its technology to democratic governments for use by law enforcement agencies. However, reports have shown that U.S. agencies, including the Drug Enforcement Administration (DEA) and Immigration and Customs Enforcement (ICE), have purchased and used its spyware.  

In December 2024, a U.S.-based investment firm, AE Industrial Partners, bought Paragon, further raising questions about its future operations and how its surveillance tools may be used.  


Protecting Yourself from Spyware  

While WhatsApp has fixed this specific security flaw, spyware threats continue to evolve. Users can take the following steps to protect themselves:  

1. Update Your Apps: Always keep your apps updated, as companies frequently release security patches.  

2. Be Cautious of Unknown Files: Never open suspicious PDFs, links, or attachments from unknown sources.  

3. Enable Two-Factor Authentication: Adding an extra layer of security to your accounts makes it harder for hackers to break in.  

4. Check Your Device Logs: If you suspect spyware, seek professional help to analyze your phone’s activity.  

Spyware attacks are becoming more advanced, and staying informed is key to protecting your privacy. WhatsApp’s quick response to this attack highlights the ongoing battle against cyber threats and the need for stronger security measures.  


Read more »
vite
Cyber Attacks Hackers Mallicious URLs vite

Security Warning: New Vite Vulnerability Exposes Private Files

 



A serious security issue has been discovered in Vite, a widely used tool for building web applications. This flaw, identified as CVE-2025-30208, allows attackers to access restricted files on a server. If exploited, it could lead to leaks of sensitive data and potential security risks.  


How the Vulnerability Works  

Vite’s development server is designed to block access to certain files, ensuring that only permitted content is available. However, researchers have found a way to bypass these restrictions using specific URL parameters. By adding "?raw??"or "?import&raw??" to a web address, hackers can trick the system into providing access to protected files.  


Who Is at Risk?  

This issue only affects developers who have made their Vite development server accessible over the internet. Normally, this server is used for local testing, but some developers configure it to be available outside their network using options like “–host” or “server.host.” If a server is open in this way, attackers can use the vulnerability to retrieve private information.  


How Hackers Can Exploit This Flaw  

The problem occurs because Vite handles web addresses incorrectly. In some parts of the system, special characters like “?” are removed, while other parts fail to detect these changes. This inconsistency allows hackers to bypass security restrictions and gain access to files they should not be able to see.  

A Proof-of-Concept (PoC) exploit has already been released, showing how attackers can use this flaw to steal sensitive data. For example, one attack method attempts to read the “.bash_history” file, which can contain records of past commands, stored passwords, and other important details.  


Affected Versions  

This security weakness is present in several versions of Vite, including:  

• 6.2.0 to 6.2.2  

• 6.1.0 to 6.1.1  

• 6.0.0 to 6.0.11  

• 5.0.0 to 5.4.14  

• All versions before 4.5.9  


How to Stay Safe  

To protect against this threat, developers using affected versions of Vite should update immediately to a secure version. The patched versions are:  

• 6.2.3 and newer 

• 6.1.2 and newer  

• 6.0.12 and newer  

• 5.4.15 and newer 

• 4.5.10 and newer  

Additionally, it is best to avoid exposing Vite’s development server to the internet unless absolutely necessary. Keeping development environments private reduces the risk of attacks and protects sensitive data.  

This vulnerability is a reminder that keeping software up to date is essential for security. Developers should act quickly to install the latest patches and ensure their applications remain protected from cyber threats.

Read more »
Malwares
Cyber Attacks cybercriminals data security Data Theft Hackers Infostealer Infostealer Malware Malware attacks Malwares

The Growing Threat of Infostealer Malware: What You Need to Know

 

Infostealer malware is becoming one of the most alarming cybersecurity threats, silently stealing sensitive data from individuals and organizations. This type of malware operates stealthily, often going undetected for long periods while extracting valuable information such as login credentials, financial details, and personal data. As cybercriminals refine their tactics, infostealer attacks have become more frequent and sophisticated, making it crucial for users to stay informed and take preventive measures. 

A significant reason for concern is the sheer scale of data theft caused by infostealers. In 2024 alone, security firm KELA reported that infostealer malware was responsible for leaking 3.9 billion passwords and infecting over 4.3 million devices worldwide. Similarly, Huntress’ 2025 Cyber Threat Report revealed that these threats accounted for 25% of all cyberattacks in the previous year. This data highlights the growing reliance of cybercriminals on infostealers as an effective method of gathering personal and corporate information for financial gain. 

Infostealers operate by quietly collecting various forms of sensitive data. This includes login credentials, browser cookies, email conversations, banking details, and even clipboard content. Some variants incorporate keylogging capabilities to capture every keystroke a victim types, while others take screenshots or exfiltrate files. Cybercriminals often use the stolen data for identity theft, unauthorized financial transactions, and large-scale corporate breaches. Because these attacks do not immediately disrupt a victim’s system, they are harder to detect, allowing attackers to extract vast amounts of information over time. Hackers distribute infostealer malware through multiple channels, making it a widespread threat. 

Phishing emails remain one of the most common methods, tricking victims into downloading infected attachments or clicking malicious links. However, attackers also embed infostealers in pirated software, fake browser extensions, and even legitimate platforms. For example, in February 2025, a game called PirateFi was uploaded to Steam and later found to contain infostealer malware, compromising hundreds of devices before it was removed. Social media platforms, such as YouTube and LinkedIn, are also being exploited to spread malicious files disguised as helpful tools or software updates. 

Beyond stealing data, infostealers serve as an entry point for larger cyberattacks. Hackers often use stolen credentials to gain unauthorized access to corporate networks, paving the way for ransomware attacks, espionage, and large-scale financial fraud. Once inside a system, attackers can escalate their access, install additional malware, and compromise more critical assets. This makes infostealer infections not just an individual threat but a major risk to businesses and entire industries.  

The prevalence of infostealer malware is expected to grow, with attackers leveraging AI to improve phishing campaigns and developing more advanced evasion techniques. According to Check Point’s 2025 Cybersecurity Report, infostealer infections surged by 58% globally, with Europe, the Middle East, and Africa experiencing some of the highest increases. The SYS01 InfoStealer campaign, for instance, impacted millions across multiple continents, showing how widespread the issue has become. 

To mitigate the risks of infostealer malware, individuals and organizations must adopt strong security practices. This includes using reliable antivirus software, enabling multi-factor authentication (MFA), and avoiding downloads from untrusted sources. Regularly updating software and monitoring network activity can also help detect and prevent infections. Given the growing threat, cybersecurity awareness and proactive defense strategies are more important than ever.
Read more »
Ransom
Automobile Industry Cyber Attacks Hackers Ransom

Auto Industry Faces Sharp Rise in Cyberattacks, Raising Costs and Risks

 



The growing use of digital systems in cars, trucks, and mobility services has made the automotive industry a new favorite target for hackers. Companies involved in making vehicles, supplying parts, and even selling them are now dealing with a sudden rise in cyberattacks, many of which are leading to heavy losses.

A recent report by cybersecurity firm Upstream Security shows that these attacks are not only increasing but also affecting much larger groups of vehicles and connected systems. In 2024, nearly 60% of the reported incidents impacted thousands or even millions of assets—this includes vehicles, electric vehicle charging stations, smart driving apps, and other connected tools used in transportation.

Even more worrying is the spike in large-scale cyberattacks. Cases where millions of vehicles were hit at once rose sharply from 5% in 2023 to 19% in 2024. These massive events now account for almost 60% of all attacks recorded in the year.

Experts warn that attackers have changed their approach. Instead of just hacking into a single vehicle’s system, they now aim to cause widespread damage or steal large amounts of data. By doing so, they increase the pressure on companies to pay hefty ransoms to avoid public embarrassment or serious business disruption.

Jason Masker, a cybersecurity specialist from Upstream, explained that hackers often search for the most damaging way to force companies into paying them. If they can gain control of millions of vehicles or access sensitive information, they can easily threaten a company’s image and safety standards.

The report also shared a serious example of how hackers can even manipulate a car’s safety features. Researchers found that the radar used for adaptive cruise control— a system that keeps cars at a safe distance can be tricked. Hackers could make it appear that the vehicle ahead is speeding up when it isn’t, potentially causing a crash.

Several major cyber incidents have already occurred:

• A leading Japanese car company’s U.S. unit was targeted by ransomware, leaking 22GB of vehicle and customer data.

• A Chinese auto supplier suffered a large breach involving 1.2TB of sensitive information, affecting both local and global carmakers.

• In Italy, a German automaker’s branch faced a data breach that exposed private customer details.

The report further explains that traditional cyberattacks— like locking systems and demanding ransom, are slowly becoming less effective, as many companies have backups ready. Now, hackers prefer stealing data and threatening to leak it unless they’re paid.

What’s more concerning is the gap between what cybersecurity rules require and how prepared companies actually are. Many businesses falsely believe they are fully protected, while attackers continue finding new ways to break through.

Upstream Security suggests companies need to act beyond just following regulations. Safety, smooth operations, and protecting customer data must be prioritized.

To help prevent future attacks, Upstream monitors over 25 million vehicles worldwide, tracking billions of data points daily. They also watch online forums where cybercriminals sometimes plan their attacks.

Looking at the bigger picture, experts predict artificial intelligence will become a vital tool in spotting and blocking cyber threats quickly. As vehicles get more connected, the risk of cyberattacks is expected to grow, putting companies, drivers, and users of smart mobility systems at greater risk.


Read more »
Software
Cisco Cyber Security Hackers Software

Cisco Warns of Critical Security Flaw in IOS XR Software – Immediate Update Recommended




Cisco has issued a security warning about a newly identified vulnerability in its IOS XR Software. This security flaw, labeled CVE-2025-20138, has been rated 8.8 on the CVSS scale, meaning it poses a major risk to affected devices.


What Is the Problem?

The issue is found in the Command Line Interface (CLI) of Cisco’s IOS XR Software. If an attacker gains access to a system with limited user privileges, they can exploit this weakness to execute commands with the highest level of control. This would allow them to make major modifications to the system, potentially leading to severe security threats.

The root of the problem is improper validation of user inputs in certain CLI commands. Because the system does not correctly filter these inputs, attackers can manipulate it using carefully crafted commands. If successful, they can obtain full administrative access, giving them total control over the device.


Who Is Affected?

This vulnerability affects all configurations of Cisco IOS XR 64-bit Software. Users should check Cisco’s official security advisory to confirm if their specific version is vulnerable.

However, some Cisco software versions are confirmed to be unaffected, including:

IOS Software

IOS XE Software

IOS XR 32-bit Software

NX-OS Software

No Quick Fixes—Users Must Update Their Software

Cisco has stated that there are no temporary solutions or workarounds for this security flaw. The only way to protect affected systems is to install the latest software updates provided by Cisco.

The company has outlined which versions require updates:

1. Users running Cisco IOS XR Software Release 24.1 or earlier need to switch to a patched version.

2. Those using Release 24.2 should upgrade to version 24.2.21 when it becomes available.

3. Users on Release 24.3 must transition to a secure version.

Release 24.4 is not affected by this issue.

As of now, there have been no reports of hackers exploiting this flaw. However, because of the severity of the issue, users should not delay in updating their devices.

Cisco is urging all users running affected versions of IOS XR Software to review the security advisory and apply the necessary updates as soon as possible. Keeping software up to date is the only way to ensure systems remain protected from potential cyber threats.

Read more »
Ransomware
Cyber Attacks Hackers Microsoft Paragon Software Ransomware

Hackers Exploit Flaw in Microsoft-Signed Driver to Launch Ransomware Attacks

 



Cybercriminals are exploiting a vulnerability in a Microsoft-signed driver developed by Paragon Software, known as BioNTdrv.sys, to carry out ransomware attacks. This driver, part of Paragon Partition Manager, is typically used to manage hard drive space, but hackers have found a way to misuse it for malicious purposes.  


How the Attack Works  

The vulnerability, identified as CVE-2025-0289, allows attackers to use a technique called "bring your own vulnerable driver" (BYOVD). This means they introduce the legitimate but flawed driver into a system and exploit it to gain high-level access. Once they obtain SYSTEM-level privileges, they can execute ransomware, steal data, or disable security software without being detected.  

The alarming part is that the vulnerability can be exploited even on devices that do not have Paragon Partition Manager installed, as long as the driver exists on the system.  


Other Vulnerabilities  

Researchers also found four additional flaws in the driver:  

1. CVE-2025-0288: Allows access to kernel memory, helping attackers gain control.  

2. CVE-2025-0287: Can crash the system using a null pointer error.  

3. CVE-2025-0286: Enables attackers to execute malicious code in kernel memory.  

4. CVE-2025-0285: Allows manipulation of kernel memory, escalating control. 


Response from Microsoft and Paragon  

Microsoft confirmed that hackers are already using this flaw to spread ransomware and has responded by blocking the vulnerable driver through its Vulnerable Driver Blocklist. Meanwhile, Paragon Software has released a security patch and advised users to update their drivers immediately to avoid potential risks.  


How to Stay Safe  

To protect your system from these attacks:  

1. Update your drivers from Paragon Software to the latest version.  

2. Install Windows security updates regularly.  

3. Use reliable antivirus software to detect suspicious activities.  

4. Monitor your system for unexpected crashes or slow performance.    

While Microsoft and Paragon Software have taken steps to contain the damage, users must stay proactive in securing their systems through regular updates and vigilant monitoring.

Read more »
Technology
Energy Hackers Renewable Energy Solar Power Technology

Hackers Can Attack Your Rooftop Solar Panels, With Ease

Hackers Can Attack Your Rooftop Solar Panels, With Ease

Do not set weak passwords for your solar panels

Hackers are attracted to weak passwords like moths to flame. Imagine this: your password is weak enough to be hacked via brute-force attack, or already known because you haven’t reset the factory admin default. 

In that case, it is a win-win for hackers who want to steal your data, as there is no need for advanced infostealer malware campaigns. However, when the case is “energy,” and the entry route is via solar panels installed on your rooftops, the price to pay increases. 

Global shift and security gaps in solar power

The Global move for smart-energy production has added new security gaps to national power grids. German International Broadcaster “Deutsche Welle” (DW) talked with hackers who have revealed flaws in solar power plants and rooftop installations around the world.

DW has alerted that “hackers can easily access solar power plants due to weak passwords and vulnerable software, posing a significant threat to energy security.” Rooftop installations are the main concern because the “ transition to renewable energy relies on digital networks that can be targeted by hackers,” Mathis Richtmann, reporter at Deutsche Welle said.

Security gaps explained

In October 2024, Secura studied the cybersecurity danger to the solar power industry in the Netherlands. The report found 27 different cases where large-scale attacks of solar power panels could be executed. 

Secura researchers described the attack as “disastrous,” involving “severe economic damage, physical damage and even damage to society itself, certainly if the secondary consequences of the cyberattacks are taken into consideration.” The report investigated every aspect, “small domestic rooftop installations” via SME and large-scale “solar farms.” Supply chain attacks, hardware hacking, and web portal attacks were also researched.

The Problem of Password with Solar Panel

DW talked to a U.S hacker Aditya Sood, who showed how easy it was to hack into a remote dashboard for a solar power plant in India’s Tamil Nadu region. “There it goes,” Aditya said, explaining how “People deploy their devices and forget to actually change default passwords”, or “they have configured very weak passwords.”

A German company that looked into the design of the solar control setup in the Tamil Nadu plant told Richtmann that “while it is technically possible for a customer to assign a weak password and provide open access to their network on the internet, we do not recommend this.” Sood agrees with the intent, but hackers with malicious aims will exploit this opportunity, he demonstrated. 

How to be safe?

Takeaways? The answer is simple: change your password, immediately. And make it a strong one. Don’t depend on factory defaults, and never share your login details. A user might think “How is it a big deal? My rooftop solar panel is just a small part in a big machine,” but when attacked, the consequences will be severe.

Read more »
Phishing Attacks
Cyber Attacks CyberCriminal Evasion Tactics Hackers JavaScript Obfuscation Technique Phishing Attacks

Hackers Use Invisible Unicode Trick to Hide Phishing Attacks

 


Cybercriminals have discovered a new way to conceal malicious code inside phishing attacks by using invisible Unicode characters. This technique, identified by Juniper Threat Labs, has been actively used in attacks targeting affiliates of a U.S. political action committee (PAC). By making their scripts appear as blank space, hackers can evade detection from traditional security tools and increase the likelihood of successfully compromising victims. 

The attack, first observed in early January 2025, is more advanced than typical phishing campaigns. Hackers customized their messages using personal, non-public details about their targets, making the emails seem more legitimate. They also implemented various tricks to avoid detection, such as inserting debugger breakpoints and using timing checks to prevent cybersecurity professionals from analyzing the script. 

Additionally, they wrapped phishing links inside multiple layers of Postmark tracking links, making it harder to trace the final destination of the attack. The method itself isn’t entirely new. In October 2024, JavaScript developer Martin Kleppe introduced the idea as an experimental programming technique. However, cybercriminals quickly adapted it for phishing attacks. 

The trick works by converting each character in a JavaScript script into an 8-bit binary format. Instead of using visible numbers like ones and zeros, attackers replace them with invisible Hangul Unicode characters, such as U+FFA0 and U+3164. Since these characters don’t appear on-screen, the malicious code looks completely empty, making it difficult to detect with the naked eye or automated security scans. 

The hidden script is stored as a property inside a JavaScript object, appearing as blank space. A separate bootstrap script then retrieves the hidden payload using a JavaScript Proxy get() trap. When accessed, this proxy deciphers the invisible Unicode characters back into binary, reconstructing the original JavaScript code and allowing the attack to execute. To make detection even more difficult, hackers have layered additional evasion techniques. They use base64 encoding to further disguise the script and implement anti-debugging measures. If the script detects that it’s being analyzed—such as when someone tries to inspect it with a debugger—it will shut down immediately and redirect the user to a harmless website. 

This prevents cybersecurity researchers from easily studying the malware. This technique is particularly dangerous because it allows attackers to blend their malicious code into legitimate scripts without raising suspicion. The invisible payload can be injected into otherwise safe websites, and since it appears as empty space, many security tools may fail to detect it. 

Juniper Threat Labs linked two of the domains used in this campaign to the Tycoon 2FA phishing kit, a tool previously associated with large-scale phishing operations. This connection suggests that the technique could soon be adopted by other cybercriminals. As attackers continue to develop new evasion strategies, cybersecurity teams will need to create better detection methods to counter these hidden threats before they cause widespread damage.
Read more »
Security Cameras
Encryption Hackers Passwords Privacy Security Cameras

Protect Your Security Cameras from Hackers with These Simple Steps

 



Security cameras are meant to keep us safe, but they can also become targets for hackers. If cybercriminals gain access, they can spy on you or tamper with your footage. To prevent this, follow these straightforward tips to ensure your security cameras remain under your control.

1. Avoid Cheap or Second-Hand Cameras

While it might be tempting to buy an inexpensive or used security camera, doing so can put your privacy at risk. Unknown brands or knockoffs may have weak security features, making them easier to hack. Used cameras, even if reset, could still contain old software vulnerabilities or even hidden malware. Always choose reputable brands with good security records.

2. Choose Cameras with Strong Encryption

Encryption ensures that your video data is protected from unauthorized access. Look for brands that offer end-to-end encryption, which keeps your footage secure even if intercepted. Some brands, like Ring and Arlo, provide full encryption options, while others offer partial protection. The more encryption a company provides, the better your data is protected.

3. Research Security Reputation Before Buying

Before purchasing a camera, check if the company has a history of data breaches or security flaws. Some brands have had incidents where hackers accessed user data, so it’s essential to choose a manufacturer with a strong commitment to cybersecurity. Look for companies that use offline storage or advanced security features to minimize risks.

4. Strengthen Your Wi-Fi and App Passwords

A weak Wi-Fi password can allow hackers to access all connected devices in your home, including security cameras. Always use a strong, unique password for both your Wi-Fi network and camera app. Enable encryption on your router, activate built-in firewalls, and consider using a virtual private network (VPN) for extra protection. If you experience life changes like moving or breaking up with a partner, update your passwords to prevent unauthorized access.

5. Keep Your Camera Software Updated

Security camera companies regularly release updates to fix vulnerabilities and improve protection. If your camera has an option for automatic updates, turn it on. If not, make sure to check for updates manually through your camera app to ensure your system has the latest security patches.

6. Enable Two-Factor Authentication (2FA)

Two-factor authentication adds an extra layer of security by requiring a second verification step, such as a text message or email code, before logging in. This prevents unauthorized users from accessing your camera, even if they have your password.


Modern security cameras are much safer than before, thanks to improved encryption and security features. Most hacking attempts happen when users fail to secure their accounts or choose unreliable brands. However, there is still a risk if the camera company itself experiences a data breach. To minimize exposure, consider cameras with local storage or privacy covers for indoor models.

Who Tries to Hack Security Cameras?

In most cases, security cameras are not hacked by strangers. Instead, unauthorized access usually comes from people you know, such as an ex-partner or family member who already has login details. Occasionally, unethical employees at security companies have been caught misusing access. Ensuring strong passwords, encryption, and additional security measures can help prevent these issues.

By following these simple steps, you can keep your security cameras safe from hackers and ensure your home remains private and secure.


Read more »
Hackers
CVE CVEs Cybersecurity Dark Web Data Breach Data Leak data security FortiGate devices Hackers

Hackers Leak 15,000 FortiGate Device Configs, IPs, and VPN Credentials

 

A newly identified hacking group, the Belsen Group, has leaked critical data from over 15,000 FortiGate devices on the dark web, making sensitive technical details freely available to cybercriminals. The leak includes configuration files, IP addresses, and VPN credentials, significantly increasing security risks for affected organizations. 

Emerging on cybercrime forums and social media just this month, the Belsen Group has been actively promoting itself. As part of its efforts, the group launched a Tor website where it released the stolen FortiGate data, seemingly as a way to establish its presence in the hacking community. In a post on an underground forum, the group claimed responsibility for breaching both government and private-sector systems, highlighting this operation as its first major attack. 

The exposed data is structured within a 1.6 GB archive, organized by country. Each country’s folder contains multiple subfolders corresponding to specific FortiGate device IP addresses. Inside, configuration files such as configuration.conf store FortiGate system settings, while vpn-passwords.txt holds various credentials, some of which remain in plaintext. 

Cybersecurity researcher Kevin Beaumont examined the leak and confirmed that these files include firewall rules, private keys, and other highly sensitive details that could be exploited by attackers. Further analysis suggests that the breach is linked to a known vulnerability from 2022—CVE-2022-40684—which was actively exploited before Fortinet released a security patch. 

According to Beaumont, evidence from a forensic investigation into a compromised device revealed that this zero-day vulnerability provided attackers with initial access. The stolen data appears to have been gathered in October 2022, around the same time this exploit was widely used. Fortinet had previously warned that CVE-2022-40684 was being leveraged by attackers to extract system configurations and create unauthorized super-admin accounts under the name fortigate-tech-support. 

Reports from the German news site Heise further confirm that the leaked data originates from devices running FortiOS firmware versions 7.0.0-7.0.6 or 7.2.0-7.2.2. The fact that FortiOS 7.2.2 was specifically released to address this vulnerability raises questions about whether some systems remained compromised even after the fix was made available. 

Although the leaked files were collected over two years ago, they still pose a significant threat. Configuration details, firewall rules, and login credentials could still be exploited if they were not updated after the original breach. Given the scale of the leak, cybersecurity experts strongly recommend that administrators review their FortiGate device settings, update passwords, and ensure that no outdated configurations remain in use.
Read more »
Sensitive Information
Data Breach Data Leak data security DDoS Hackers Personal Data Police Sensitive Information

Hackers Leak 8,500 Files from Lexipol, Exposing U.S. Police Training Manuals

 

An anonymous hacker group called the “puppygirl hacker polycule” recently made headlines by leaking over 8,500 files from Lexipol, a private company that provides training materials and policy manuals for police departments across the United States. 

As first reported by The Daily Dot, the data breach exposed internal documents, including thousands of police policies, emails, phone numbers, addresses, and other sensitive information about Lexipol employees. The hackers published the stolen data on Distributed Denial of Secrets (DDoS), a nonprofit platform for leaked information. In a statement, the group said they targeted Lexipol because, in their view, there aren’t “enough hacks against the police,” so they took action themselves.  

Founded in 2003, Texas-based Lexipol LLC, also known for its online training platform PoliceOne, has become a significant force in police privatization. The company supplies policy manuals and training content to more than 20% of U.S. police departments, according to a 2022 Indiana Law Journal analysis. This widespread adoption has effectively shaped public policy, despite Lexipol being a private company. 

Critics have long raised concerns about Lexipol’s focus on minimizing legal liability for police departments rather than addressing issues like excessive force or racial profiling. The Intercept reported in 2020 that Lexipol’s training materials, used by the NYPD after the George Floyd protests, prioritized protecting departments from lawsuits rather than promoting accountability or reform. 

Additionally, Lexipol has actively opposed proposed changes to police use-of-force standards, favoring a more lenient “objectively reasonable” standard. The leaked documents revealed striking similarities in policy language across different police departments, with matching sections on use-of-force protocols and even identical “Code of Ethics” pages — some ending with a religious oath dedicating officers to their profession before God. 

Despite Lexipol’s intent to reduce legal risks for its clients, some police departments using its policies have faced legal consequences. In 2017, Culver City, CA, adopted a Lexipol manual that suggested detaining suspected undocumented immigrants based on “lack of English proficiency,” contradicting the city’s sanctuary status. Similarly, Spokane, WA, paid a $49,000 settlement in 2018 after police violated local immigration laws using Lexipol’s guidance. 

Although the puppygirl hacker polycule isn’t linked to previous major breaches, their tactics echo those of SiegedSec, a group known for hacking government sites and playfully demanding research into “IRL catgirls.” As political tensions rise, the hackers predict more “hacktivist” attacks, aiming to expose injustices and empower public awareness. The Lexipol breach serves as a stark reminder of the vulnerabilities in privatized law enforcement systems and the growing influence of cyberactivism.
Read more »
Hackers
CVE CVE exploits CVE vulnerability Cyber Security data security Data Theft Hacker attack Hackers

Hackers Exploit ThinkPHP and ownCloud Vulnerabilities from 2022 and 2023

 

Hackers are increasingly exploiting outdated security flaws in poorly maintained systems, with vulnerabilities from 2022 and 2023 seeing a surge in attacks. According to threat intelligence platform GreyNoise, malicious actors are actively targeting CVE-2022-47945 and CVE-2023-49103, affecting the ThinkPHP Framework and the open-source ownCloud file-sharing solution. 

Both vulnerabilities are critical, allowing attackers to execute arbitrary commands or steal sensitive data, such as admin credentials and license keys. CVE-2022-47945 is a local file inclusion (LFI) flaw in ThinkPHP versions before 6.0.14. If the language pack feature is enabled, unauthenticated attackers can remotely execute operating system commands. 

Akamai reported that Chinese threat groups have exploited this flaw since late 2023, and GreyNoise recently detected 572 unique IPs actively attacking vulnerable systems. Despite having a low Exploit Prediction Scoring System (EPSS) rating of just 7% and not being listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, CVE-2022-47945 remains under heavy assault. 

The second vulnerability, CVE-2023-49103, impacts ownCloud’s file-sharing software. It stems from a third-party library that leaks PHP environment details through a public URL. After its disclosure in November 2023, hackers began exploiting the flaw to steal sensitive data. A year later, it was named one of the FBI, CISA, and NSA’s top 15 most exploited vulnerabilities. 

Even though a patch was released over two years ago, many ownCloud systems remain unpatched and exposed. GreyNoise recently observed malicious activity from 484 unique IPs targeting this vulnerability. To defend against these active threats, users are strongly advised to upgrade to ThinkPHP 6.0.14 or later and ownCloud GraphAPI 0.3.1 or newer. 

Taking vulnerable systems offline or placing them behind a firewall can significantly reduce the attack surface and prevent exploitation. As hackers continue to leverage older, unpatched vulnerabilities, staying vigilant with timely updates and robust security practices remains crucial in protecting critical systems and sensitive data.
Read more »
malware
Artificial Intelligence Hackers Identity Fraud malware

Cybercriminals Are Now Targeting Identities Instead of Malware

 



The way cybercriminals operate is changing. Instead of using malicious software to break into systems, they are now focusing on stealing and exploiting user identities. A recent cybersecurity report shows that three out of four cyberattacks involve stolen login credentials rather than traditional malware. This trend is reshaping the way security threats need to be addressed.

Why Hackers Are Relying on Stolen Credentials

The underground market for stolen account details has grown rapidly, making user identities a prime target for cybercriminals. With automated phishing scams, artificial intelligence-driven attacks, and social engineering techniques, hackers can gain access to sensitive data without relying on malicious software. 

According to cybersecurity experts, once a hacker gains access using valid credentials, they can bypass security barriers with ease. Many organizations focus on preventing external threats but struggle to detect attackers who appear to be legitimate users. This raises concerns about how companies can defend against these invisible intrusions.

Speed of Cyberattacks Is Increasing

Another alarming discovery is that hackers are moving faster than ever once they gain access. The shortest recorded time for a cybercriminal to spread through a system was just over two minutes. This rapid escalation makes it difficult for security teams to respond in time.

Traditional cybersecurity tools are designed to detect malware and viruses, but identity-based attacks leave no obvious traces. Instead, hackers manipulate system tools and access controls to remain undetected for extended periods. This technique, known as "living-off-the-land," enables them to blend in with normal network activity.

Attackers Are Infiltrating Multiple Systems

Modern cybercriminals do not confine themselves to a single system. Once they gain access, they move between cloud storage, company networks, and online services. This flexibility makes them harder to detect and stop.

Security experts warn that attackers often stay hidden in networks for months, waiting for the right moment to strike. Organizations that separate security measures—such as cloud security, endpoint protection, and identity management—often create loopholes that criminals exploit to maintain access and avoid detection.

AI’s Role in Cybercrime

Hackers are also taking advantage of artificial intelligence to refine their attacks. AI-driven tools help them crack passwords, manipulate users into revealing information, and automate large-scale cyber threats more efficiently than ever before. This makes it crucial for organizations to adopt equally advanced security measures to counteract these threats.

How to Strengthen Cybersecurity

Since identity theft is now a primary method of attack, organizations need to rethink their approach to cybersecurity. Here are some key strategies to reduce risk:

1. Enable Multi-Factor Authentication (MFA): This adds extra layers of protection beyond passwords.
2. Monitor Login Activities: Unusual login locations or patterns should be flagged and investigated.
3. Limit Access to Sensitive Data: Employees should only have access to the information they need for their work.
4. Stay Updated on Security Measures: Companies must regularly update their security protocols to stay ahead of evolving threats.


As hackers refine their techniques, businesses and individuals must prioritize identity security. By implementing strong authentication measures and continuously monitoring for suspicious activity, organizations can strengthen their defenses and reduce the risk of unauthorized access.





Read more »
Security Firm
AI technology CyberCrime Cybersecurity CyberThreat Data Breach Hackers Security Firm

Hackers Use Forked Stealer to Breach Russian Businesses

 


As of January 2025, there were multiple attacks on Russian organizations across several industries, including finance, retail, information technology, government, transportation, and logistics, all of which have been targeted by BI.ZONE. The threat actors have used NOVA stealer, a commercial modification of SnakeLogger, to retrieve credentials and then sell them on underground forums.

It has been identified by the BI.ZONE Threat Intelligence team that a sophisticated cyber-attack is targeting Russian-based organizations across multiple industries. Threat actors are using NOVA stealer, which is a brand new commercial variant of SnakeLogger, to infiltrate corporate networks and steal sensitive information.

As part of a Malware-as-a-Service (MaaS) package, this malware is available for sale on underground forums for a subscription fee of $50 per month. Social engineering tactics are employed by the attackers to spread malware using phishing emails that disguise the malware as an archive that is related to contracts. It is clear from this campaign that the adversaries greatly increased their chances of success by exploiting well-established file names and targeting employees in sectors with high email traffic. 

This campaign demonstrates the persistence of the threat posed by malware that steals your personal information. This stolen authentication data can be used as a weapon in the future for highly targeted cyberattacks, which may include ransomware operations. By using MaaS-based attack strategies, cybercriminals can optimize their resources to focus on rapid distribution rather than malware development, allowing them to maximize their resources.

Therefore, organizations should maintain vigilance against evolving cyber threats and strengthen the email security measures they have in place to mitigate the risks associated with these sophisticated attack vectors to remain competitive. According to a recent report published by Moscow-based cybersecurity firm BI.ZONE, NOVA stealer is a commercial malware variant derived from SnakeLogger. This variant has been actively sold on dark web marketplaces as a Malware-as-a-Service (MaaS) offering and is being sold on the black market as well. 

Using this device, cybercriminals can steal credentials and exfiltrate data simply and quickly with minimal technical effort by charging $50 per month or $630 for a lifetime license, depending on which option you choose. As a result of geopolitical tensions and a surge in cyberattacks targeting Russian organizations, the report comes amid a rise in cyberattacks, many believed to be state-sponsored operations. 

There is a war going on in Ukraine and several economic sanctions are being placed against Moscow, as a result of which Western cybersecurity companies have withdrawn from the Russian market. This has left gaps in the capabilities of cyber threat intelligence and incident response. It follows that most cases of cyber intrusions these days are reported by domestic security firms, which are often not equipped with the depth of independent verification and analysis that global cybersecurity firms are usually able to provide. 

Researchers from F.A.C.C.T., a Russian cybersecurity firm, recently discovered a cyberespionage attack that targeted chemical, food, and pharmaceutical firms. According to Rezet (Rare Wolf), a state-backed hacking group that has been responsible for approximately 500 cyberattacks on Russian, Belarusian, and Ukrainian organizations since 2018, the cyberespionage campaign is being conducted in response to the attacks. 

As part of its investigation of the cyber intrusion, Solar also found another cyber intrusion, indicating that an attack group known as APT NGC4020 used a vulnerability in a remote access tool developed by U.S.-based SolarWinds to target Russian industrial facilities and attempted to exploit the vulnerability. The attackers used the vulnerability to exploit the Russian industrial facilities. 

Rostelecom, which is one of the leading telecom companies in Russia, Roseltorg, which is one of the nation's primary electronic trading platforms, and Rosreestr, which is an independent governmental agency in charge of maintaining land records and property tax records, were recently the victims of cyberattacks. These cyber intrusions are becoming increasingly sophisticated and frequent, thereby reflecting the heightened threat landscape that Russian organizations are currently facing to mitigate potential risks as a result of the heightened threat landscape.
Read more »
Privacy
Authentication CyberCrime Cybersecurity CyberThreat Hackers MFA Privacy

The Evolving Role of Multi-Factor Authentication in Cybersecurity

 


In recent years, the cybersecurity landscape has faced an unprecedented wave of threats. State-sponsored cybercriminals and less experienced attackers armed with sophisticated tools from the dark web are relentlessly targeting weak links in global cybersecurity systems. End users, often the most vulnerable element in the security chain, are frequently exploited. As cyber threats grow increasingly sophisticated, multi-factor authentication (MFA) has emerged as a critical tool to address the limitations of password-based security systems.

The Importance of MFA in Modern Cybersecurity

Passwords, while convenient, have proven insufficient to protect against unauthorized access. MFA significantly enhances account security by adding an extra layer of protection, preventing account compromise even when login credentials are stolen. According to a Microsoft study, MFA can block 99.9% of account compromise attacks. By requiring multiple forms of verification—such as passwords, biometrics, or device-based authentication—MFA creates significant barriers for hackers, making unauthorized access extremely difficult.

Regulations and industry standards are also driving the adoption of MFA. Organizations are increasingly required to implement MFA to safeguard sensitive data and comply with security protocols. As a cornerstone of modern cybersecurity strategies, MFA has proven effective in protecting against breaches, ensuring the integrity of digital ecosystems, and fostering trust in organizational security frameworks.

However, as cyber threats evolve, traditional MFA systems are becoming increasingly inadequate. Many legacy MFA systems rely on outdated technology, making them vulnerable to phishing attacks, ransomware campaigns, and sophisticated exploits. The advent of generative AI tools has further exacerbated the situation, enabling attackers to create highly convincing phishing campaigns, automate complex exploits, and identify security gaps in real-time.

Users are also growing frustrated with cumbersome and inconsistent authentication processes, which undermine adherence to security protocols and erode organizational defenses. This situation underscores the urgent need for a reevaluation of security strategies and the adoption of more robust, adaptive measures.

The Role of AI in Phishing and MFA Vulnerabilities

Artificial intelligence (AI) has become a double-edged sword in cybersecurity. While it offers powerful tools for enhancing security, it also poses significant threats when misused by cybercriminals. AI-driven phishing attacks, for instance, are now virtually indistinguishable from legitimate communications. Traditional phishing indicators—such as typographical errors, excessive urgency, and implausible offers—are often absent in these attacks.

AI enables attackers to craft emails and messages that appear authentic, cleverly designed to deceive even well-trained users. Beyond mere imitation, AI systems can analyze corporate communication patterns and replicate them with remarkable accuracy. Chatbots powered by AI can interact with users in real-time, while deepfake technologies allow cybercriminals to impersonate trusted individuals with unprecedented ease. These advancements have transformed phishing from a crude practice into a precise, calculated science.

Outdated MFA systems are particularly vulnerable to these AI-driven attacks, exposing organizations to large-scale, highly successful campaigns. As generative AI continues to evolve at an exponential rate, the potential for misuse highlights the urgent need for robust, adaptive security measures.

Comprehensive Multi-Factor Authentication: A Closer Look

Multi-Factor Authentication (MFA) remains a cornerstone of cybersecurity, utilizing multiple verification steps to ensure that only authorized users gain access to systems or data. By incorporating layers of authentication, MFA significantly enhances security against evolving cyber threats. The process typically begins with the user providing credentials, such as a username and password. Once verified, an additional layer of authentication—such as a one-time password (OTP), biometric input, or other pre-set methods—is required. Access is only granted after all factors are successfully confirmed.

Key forms of MFA authentication include:

  1. Knowledge-Based Authentication: This involves information known only to the user, such as passwords or PINs. While widely used, these methods are vulnerable to phishing and social engineering attacks.
  2. Possession-Based Authentication: This requires the user to possess a physical item, such as a smartphone with an authentication app, a smart card, or a security token. These devices often generate temporary codes that must be used in combination with a password.
  3. Biometric Authentication: This verifies a user's identity through unique physical traits, such as fingerprints or facial recognition, adding an extra layer of security and personalization.
  4. Location-Based Authentication: This uses GPS data or IP addresses to determine the user's geographical location, restricting access to trusted or authorized areas.
  5. Behavioral Biometrics: This tracks and monitors unique user behaviors, such as typing speed, voice characteristics, or walking patterns, providing an adaptive layer of security.

The combination of these diverse approaches creates a robust defense against unauthorized access, ensuring superior protection against increasingly sophisticated cyberattacks. As organizations strive to safeguard sensitive data and maintain security, the integration of comprehensive MFA solutions is essential.

The cybersecurity landscape is evolving rapidly, with AI-driven threats posing new challenges to traditional security measures like MFA. While MFA remains a critical tool for enhancing security, its effectiveness depends on the adoption of modern, adaptive solutions that can counter sophisticated attacks. By integrating advanced MFA methods and staying vigilant against emerging threats, organizations can better protect their systems and data in an increasingly complex digital environment.

Read more »
Privacy
Cyberattacks Cybercrimes Cyberhackers Cybersafety Cybersecurity Cyberthreats Hackers Privacy

The Evolution of Data Protection: Moving Beyond Passwords

 


As new threats emerge and defensive strategies evolve, the landscape of data protection is undergoing significant changes. With February 1 marking Change Your Password Day, it’s a timely reminder of the importance of strong password habits to safeguard digital information.

While conventional wisdom has long emphasized regularly updating passwords, cybersecurity experts, including those at the National Institute of Standards and Technology (NIST), have re-evaluated this approach. Current recommendations focus on creating complex yet easy-to-remember passphrases and integrating multi-factor authentication (MFA) as an additional layer of security.

Microsoft’s Vision for a Passwordless Future

Microsoft has long envisioned a world where passwords are no longer the primary method of authentication. Instead, the company advocates for the use of passkeys. While this vision has been clear for some time, the specifics of how this transition would occur have only recently been clarified.

In a detailed update from Microsoft’s Identity and Access Management team, Sangeeta Ranjit, Group Product Manager, and Scott Bingham, Principal Product Manager, outlined the anticipated process. They highlighted that cybercriminals are increasingly aware of the declining relevance of passwords and are intensifying password-focused attacks while they still can.

Microsoft has confirmed that passwords will eventually be phased out for authentication. Although over a billion users are expected to adopt passkeys soon, a significant number may continue using both passkeys and traditional passwords simultaneously. This dual usage introduces risks, as both methods can be exploited, potentially leading to privacy breaches.

According to Bingham and Ranjit, the long-term focus must be on phishing-resistant authentication techniques and the complete elimination of passwords within organizations. Simplifying password management while enhancing security remains a critical challenge.

The Need for Advanced Security Solutions

While passwords still play a role in authentication, they are no longer sufficient as the sole defense against increasingly sophisticated cyber threats. The shift toward passwordless authentication requires the development of new technologies that provide robust security without complicating the user experience.

One such solution is compromised credential monitoring, which detects when sensitive information, such as passwords, is exposed on the dark web. This technology promptly notifies administrators or affected users, enabling them to take immediate corrective actions, such as changing compromised credentials.

As the era of passwords draws to a close, organizations and individuals must embrace more secure and user-friendly authentication methods. By adopting advanced technologies and staying informed about the latest developments, we can better protect our digital information in an ever-evolving threat landscape.

Read more »
Vulnerabilities and Exploits
CyberCrime Cyberfrauds Cybersecurity Cyberthreats Darkweb Databreach Hackers Vulnerabilities and Exploits

FortiGate Vulnerability Exposes 15,000 Devices to Risks

 



Fortinet Firewall Data Breach: 15,000 Devices Compromised by Belsen Group

On January 14, 2025, it was reported that the configuration data of over 15,000 Fortinet FortiGate firewalls was leaked on the dark web. The hacker group, identified as Belsen, shared this data for free on its newly created TOR website. The leaked information includes full firewall configurations, plaintext VPN credentials organized by IP address and country, serial numbers, management certificates, and other sensitive data. This breach poses a significant security risk to affected organizations, as it enables attackers to compromise internal networks with ease.

Exploitation of Critical Vulnerabilities

According to cybersecurity analysts, the Belsen Group exploited a zero-day vulnerability, identified as CVE-2022-40684, to obtain the leaked data. This vulnerability, published in 2022, allowed attackers to bypass administrative authentication through specially crafted HTTP/HTTPS requests. By leveraging this flaw, the attackers exfiltrated configuration files containing sensitive details such as passwords, firewall rules, and advanced settings. These files, though obtained in 2022, remained undisclosed until January 2025, significantly increasing the risk exposure for affected organizations.

In response to this ongoing threat, Fortinet released patches for CVE-2022-40684 and announced a new critical authentication bypass vulnerability, CVE-2024-55591, on the same day the leak was disclosed. This new vulnerability is being actively exploited in campaigns targeting FortiGate firewalls, particularly those with public-facing administrative interfaces. Devices running outdated FortiOS versions are especially at risk.

Impact and Recommendations

The leaked configuration files provide a comprehensive map of victim networks, including firewall rules and administrator credentials. Threat actors can exploit this information to:

  • Bypass perimeter defenses and gain unauthorized access to internal networks.
  • Deploy ransomware, perform lateral movement, and exfiltrate sensitive data.
  • Identify additional vulnerabilities within the network architecture to maximize attack impact.

Organizations affected by this breach must take immediate action to mitigate risks. This includes:

  • Updating credentials for all compromised devices.
  • Applying the latest security patches, including fixes for CVE-2022-40684 and CVE-2024-55591.
  • Conducting thorough security audits to identify and address additional vulnerabilities.

Cybersecurity expert Kevin Beaumont has announced plans to release an IP list from the leak to help FortiGate administrators determine if their devices were affected. Meanwhile, security firms like CloudSEK and Arctic Wolf have emphasized the importance of prioritizing updates and vigilance against future exploitation campaigns.

Fortinet devices' history of vulnerabilities has made them frequent targets for cybercriminals and nation-state actors. Addressing these security gaps is crucial to preventing further breaches and protecting sensitive organizational data.

Read more »
Phishing Scams
2FA Cyber Attacks cybersecurity challenges Google Google Ads Hackers MalwareBytes Online Advertising Online Scams phishing kit Phishing Scams

Google Ads Phishing Scam Reaches New Extreme, Experts Warn of Ongoing Threat


Cybercriminals Target Google Ads Users in Sophisticated Phishing Attacks

Cybercriminals are intensifying their phishing campaigns against Google Ads users, employing advanced techniques to steal credentials and bypass two-factor authentication (2FA). This new wave of attacks is considered one of the most aggressive credential theft schemes, enabling hackers to gain unauthorized access to advertiser accounts and exploit them for fraudulent purposes.

According to cybersecurity firm Malwarebytes, attackers are creating highly convincing fake Google Ads login pages to deceive advertisers into entering their credentials. Once stolen, these login details allow hackers to fully control compromised accounts, running malicious ads or reselling access on cybercrime forums. Jérôme Segura, Senior Director of Research at Malwarebytes, described the campaign as a significant escalation in malvertising tactics, potentially affecting thousands of advertisers worldwide.

How the Attack Works

The attack process is alarmingly effective. Cybercriminals design fake Google Ads login pages that closely mimic official ones. When advertisers enter their credentials, the phishing kits deployed by attackers capture login details, session cookies, and even 2FA tokens. With this information, hackers can take over accounts instantly, running deceptive ads or selling access to these accounts on the dark web.

Additionally, attackers use techniques like cloaking to bypass Google’s ad policies. Cloaking involves showing different content to Google’s reviewers and unsuspecting users, allowing fraudulent ads to pass through Google's checks while leading victims to harmful websites.

Google’s Response and Recommendations

Google has acknowledged the issue and stated that measures are being taken to address the threat. “We have strict policies to prevent deceptive ads and actively remove bad actors from our platforms,” a Google spokesperson explained. The company is urging advertisers to take immediate steps if they suspect their accounts have been compromised. These steps include resetting passwords, reviewing account activity, and enabling enhanced security measures like security keys.

Cybersecurity experts, including Segura, recommend advertisers exercise caution when clicking on sponsored ads, even those that appear legitimate. Additional safety measures include:

  • Using ad blockers to limit exposure to malicious ads.
  • Regularly monitoring account activity for any unauthorized changes.
  • Being vigilant about the authenticity of login pages, especially for critical services like Google Ads.

Despite Google’s ongoing efforts to combat these attacks, the scale and sophistication of phishing campaigns continue to grow. This underscores the need for increased vigilance and robust cybersecurity practices to protect sensitive information and prevent accounts from being exploited by cybercriminals.

Read more »
Treasury Department
CISA & FBI CybeCrime Cyber Attacks Cyberfraud Cyberhackers Cybersecurity Hackers Treasury Department

Emerging Allegations of Chinese Espionage Targeting US Treasury

 


An alleged hacker named Yin Kecheng and a cybersecurity company called Sichuan Juxinhe Network Technology Co were sanctioned on Friday by the US Treasury Department for involvement in a string of hacks against American telecom companies.

Kecheng is a Shanghai-based cybercriminal with an affiliation with the PRC Ministry of State Security who has been associated with the recent breach of the Department of Treasury's network. An organization called Sichuan Juxinhe, a cybersecurity company based in Sichuan, was directly involved with Salt Typhoon's cyber-attacks. 

PRC-linked Salt Typhoon cyber-espionage activities have resulted in numerous compromises of US telecommunications and internet service provider companies as part of a broad cyber espionage campaign, that has been carried out for several years. As a result of these intrusions, which are known as the Salt Typhoon, a massive number of American call logs have been exposed to Chinese spies, raising alarms in the US intelligence community. 

As far as some lawmakers are concerned, there have been instances where hackers have intercepted conversations with prominent politicians and government officials in the United States. Some lawmakers have described them as the worst hack on a telecom company in American history.

An agency within the U.S. Treasury Department (OFAC) has imposed sanctions on a Chinese cybersecurity firm and a Shanghai-based cyber actor in the wake of the recent compromise of a federal agency that appears to be connected to an organized criminal group known as Salt Typhoon. After the attack, it was revealed that the attackers had targeted the Office of Foreign Assets Control (OFAC) in addition to the Treasury Secretary's Office. 

According to a Washington Post report that cited unidentified US officials, China has been targeting the tools that the US uses to achieve its national security objectives, such as economic sanctions against adversaries, to do so. The Cybersecurity and Infrastructure Security Agency (CISA) has recently issued an update that supports the notion that the attack directly targeted the US's structure that controls foreign economic affairs, supported by an update provided by CISA this week that further supports this theory. 

It has been reported that malicious cyber actors linked to the People's Republic of China (PRC) continue to target U.S. government systems, including the recent cyberattacks on Treasury's information technology (IT) systems, as well as sensitive US critical infrastructure," according to the Treasury. Also, Salt Typhoon, a group that is believed to be linked to the People's Republic of China, has recently allegedly breached nine major telecommunications firms in a huge attack on US critical infrastructure, according to reports. 

As a result of this, Verizon, AT&T, and Lumen Technologies were among the many victims, where threat actors had lurked in their networks for months. The Treasury's announcement is just one in a series of similar actions against Chinese threat actors. The company Integrity Technology Group, based in Beijing, was sanctioned on January 3 for its involvement in a Chinese state hacking group known as Flax Typhoon, which allegedly participated in the hacking. 

It has been reported that in December, another Chinese hacking contractor, Sichuan Silence Information Technology, was subjected to U.S. sanctions after being blacklisted along with an arrest warrant against a Chinese national who is accused of developing a zero-day exploit for Sophos firewalls while employed at Sichuan Silence. 

Aside from the designations, there have been several other steps taken by the Treasury to combat malicious cyber activity originating from Chinese hackers. The agency has previously sanctioned Integrity Technology Group (Flax Typhoon), Sichuan Silence Information Technology Company (Pacific Rim), and Wuhan Xiaoruizhi Science and Technology Company (APT31). A new executive order signed by the Biden administration on Thursday would allow Treasury to extend its authority to sanction anyone complicit in hacking crimes under the extortion laws, indicating the administration's intention to prosecute them more aggressively going forward. 

Treasury is empowered to sanction anyone who, directly or indirectly, enabled hacking, as well as anyone who knowingly uses hacked data for financial gain, under the executive order of January 15, 2011. The director of CISA, in a blog post dated January 15, 2009, wrote that Beijing’s cyber program is very sophisticated and well-resourced, which poses a threat to the critical infrastructure in the United States. 

As Easterly pointed out, the administration has managed to eradicate some Chinese intrusions, however, there is a need for further strengthening cyber security and vigilance across the public and private sectors to reduce threats from these groups. CISA has in response, she said, developed three "lines of effort" aimed at addressing persistent threats and reducing the risk to American citizens. The first step is to exterminate Chinese cyber actors from the victims' networks. There is also the possibility of collaborating on cyber defence with key industry partners in the fields of information technology, communication, and cybersecurity. 

As a final step, cybersecurity services such as CyberSentry, a threat detection capability managed by CISA, can be utilized to reduce the risk of Chinesecybercriminalss posing a threat. In addition to attack surface management, CISA also provides a form of cyber defence that involves identifying and mitigating the technology defects that allow cyber threats to gain an edge, and 7,000 critical service organizations have already used CISA's services. 

Easterly noted that the CISA service was already offered to more than 7,000 organizations that rely on critical services. The attackers are reported to have broken into no less than 400 computers owned by the Treasury, as reported in a recent Bloomberg report and stolen more than 3,500 files. These include documents such as policies and travels, organizational charts, sanctions, and foreign investment materials as well as 'Law Enforcement Sensitive' materials. Additionally, they were able to gain access unauthorized to the computers of Secretary Janet Yellen, Deputy Secretary Adewale Adeyemo, and Acting Under Secretary Bradley T Smith, as well as materials relating to investigations conducted by the Committee on Foreign Investment in the United States. 

Silk Typhoon has been linked to a cluster of Chinese espionage actors known for using Ivanti zero-day vulnerabilities extensively, which has been tracked by Google's Mandiant under the moniker UNC5221 by Mandiant, which is an espionage network owned by Mandiant. Throughout the last year, there have been an increased number of court actions, which led to the arrest of hacking suspect Yin Kecheng in Shanghai and the imposing of sanctions against Sichuan Juxinhe Network Technology Co., LTD, as well as their ability to conduct business in the United States. 

In the first instance, the Treasury Department sanctioned a Beijing-based cybersecurity company that is suspected of being involved in multiple cyberattacks targeting vital infrastructures in the United States earlier this month. U.S. accusations of hacking have been repeatedly denied by the Chinese government, including last month's dispute about the Treasury Department hacking allegations. 

The sanctions announced on Friday do not provide any new details regarding the scope of the hack into the Treasury Department, which the agency said was discovered on December 8. Thus, a third-party software provider, BeyondTrust, has pointed out that hackers were stealing a key that was used by the vendor to secure a cloud-based service that provides remote technical support to workers. This key facilitated the hackers in overriding the security measures of the service and gaining remote access to several employee workstations as a result.
Read more »
Subscribe to: Posts (Atom)