Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label NetWalker. Show all posts
REvil
Bitcoin Canada Crypto heist Cyber Security Double extortion FBI NetWalker RaaS REvil

Netwalker: Ex Canadian Government Employee Pleads Guilty to Cybercrimes 

 

An ex-government of Canada official pleaded guilty in a US court to crimes related to data theft stemming from his involvement with the NetWalker ransomware group. 

Sebastien Vachon-Desjardins admitted on Tuesday that he had planned to commit bank fraud and phishing scams, intentionally damaged a protected computer, and also sent another demand regarding that illegally damaged computer. 

 Plea agreement filled 

Vachon-Desjardins, 34, who had previously been sentenced to six years and eight months in prison after entering a guilty plea to five criminal offenses in Canada, was deported to the United States in March. 
Vachon-Desjardins is "one of the most prolific NetWalker Ransomware affiliates," as per his plea agreement, and was in charge of extorting millions of dollars from several businesses all over the world. Along with 21 laptops, smartphones, game consoles, and other technological devices, he will also forfeit $21.5 million. 

He has pleaded guilty to conspiracy to commit computer fraud, conspiracy to commit wire fraud, intentionally harming a protected computer, and conveying a demand related to intentionally damaging a protected computer, according to a court filing submitted this week. The accusations carry a maximum punishment of 40 years in jail combined. The attorneys did not identify the targeted business, but they did indicate that it is based in Tampa and was assaulted on May 1, 2020. 

 NetWalker gang's collapse

In 2019, a ransomware-as-a-service operation called NetWalker first surfaced. It is thought that the malware's creators are based in Russia. Its standard procedure – a profitable strategy also known as double extortion, includes acquiring sensitive personal data, encrypting it, and then holding it hostage in exchange for cryptocurrencies, or risk having the material exposed online.

According to reports, the NetWalker gang intentionally targeted the healthcare industry during the COVID-19 pandemic to take advantage of the global disaster. To work for other RaaS groups like Sodinokibi (REvil), Suncrypt, and Ragnarlocker, Vachon-Desjardins is suspected of being connected to at least 91 attacks since April 2020 in his capacity as one of the 100 affiliates for the NetWalker gang. 

The Feds dismantled the crime gangs' servers and the dark website is used to contact ransomware victims as part of the takedown of the NetWalker gang. Then they took down Vachons-Desjardins, who, according to the FBI, made $27 million for the NetWalker gang. 

His role in cybercrime is said to have included gathering information on victims, managing the servers hosting tools for reconnaissance, privilege escalation, data theft, as well as running accounts that posted the stolen data on the data leak site and collecting payments following a successful attack. 

However, some victims did pay fees, and the plea deal connected Vachons-Desjardins to the successful extortion of roughly 1,864 Bitcoin in ransom payments, or about $21.5 million, from multiple businesses around the world.
Read more »
US
Canada Cyber Attacks Cyber Criminal NetWalker Netwalker ransomware US

FBI Warned Against a Canadian Indicted for Attacks Against US and Canada

 

The FBI and the Justice Department unveiled warrants today charging 31-year-old Canadian Matthew Philbert with a variety of ransomware-related offenses. On Tuesday, authorities from the Ontario Provincial Police made a public statement in Ottawa to disclose the charges and Philbert's arrest. 

U.S. Attorney Bryan Wilson of the District of Alaska said in a statement that Philbert “conspired with others known and unknown to the United States to damage computers, and in the course of that conspiracy did damage a computer belonging to the State of Alaska in April 2018.” 

Canadian officials received assistance from Dutch authorities and Europol in this case; Canadian authorities also charged Philbert, claiming that he was apprehended on November 30. Authorities did not specify which ransomware gang Philbert was a member of or which operations he is responsible for. 

"Cybercriminals are opportunistic and will target any business or individual they identify as vulnerable," stated Deputy Commissioner Chuck Cox of the Ontario Provincial Police. 

Philbert is charged with one count of conspiracy to commit fraud as well as another count of fraud and associated activities involving computers. 

Cox stated during the press conference that the FBI alerted officials in Ontario over Philbert's activities, which also included ransomware cyberattacks on businesses, government entities, and individual citizens. Police further stated they were able to seize multiple laptops, hard drives, blank cards with magnetic stripes, as well as a Bitcoin seed phrase while Philbert was being arrested. 

In January, authorities in Florida apprehended another Canadian individual concerning several Netwalker ransomware attacks. According to the DOJ, Sebastien Vachon-Desjardins made around $27.6 million through various ransomware attacks on Canadian companies such as the Northwest Territories Power Corporation, the College of Nurses of Ontario, and the Canadian tire business in British Columbia. 

Some people believe that ransomware attacks originated in Russia or the Commonwealth of Independent States, according to Emsisoft risk analyst Brett Callow, a ransomware expert located in Canada. 

Whereas the ransomware was "made" in certain countries, Callow pointed out that the people who use it to carry out attacks could be located elsewhere. 

"In fact, there's so much money to be made from ransomware, it would be extremely surprising if individuals in countries like Canada, America, and the UK hadn't entered the market. Those individuals may, however, be sleeping a little less well at night than they used to. In the past, there was a near-zero chance of them being prosecuted for their crimes, but that's finally starting to change," Callow said.
Read more »
Ransomware attack
Cyber Crime NameSouth NetWalker Ransomware attack

NameSouth’s Data Leaked for not Paying Ransom to Cybercriminals

 

NameSouth is by all accounts the most recent casualty of the ransomware group that surfaced at some point in 2019. NetWalker's objectives range across different enterprises, with archives of purloined information from around a hundred exploited organizations openly posted on the gang's darknet site to date. NameSouth LLC, a provider of veritable, OE, and OEM trade car parts for German-brand vehicles is situated in Mooresville, North Carolina. Set up in 2004, the organization distributes replacement parts for vehicles fabricated by Audi, BMW, Mercedes, Porsche, Saab, Volkswagen, and Volvo across North America.

The NameSouth archive leaked by NetWalker incorporates classified organization information and delicate archives, including monetary and accounting information, financial records, personally identifiable worker data, and different legal reports. In light of backup file creation dates, the document was exfiltrated from the NameSouth network on November 26, 2020. Apparently, the information was leaked days after the fact after the organization missed the gang's deadline to pay the ransom. A large portion of the information in the leaked archive seems to have a place with the organization instead of its accomplices or clients, which implies that it is NameSouth and its workers who are well on the way to endure the worst part of the harm. 

The leaked archive contains 3GB worth of report examines, including: 

 • Invoices containing tax identification numbers. 

 • Complete names, addresses, telephone numbers, and definite working long periods of at least 12 NameSouth representatives.

 • Client names and addresses.

 • Financial records dating from 2010 to 2020. 

 • Monetary and accounting information. 

From what samples of the leaked documents they had the option to get to, apparently, the records in the archive contain individual data of at least 12 NameSouth representatives, including their definite working hours. Such data would make it simpler for criminals to complete spear phishing assaults against the representatives. Getting to NameSouth's monetary and accounting information, including credit card records that date as far back as 2010, would permit criminals to commit fraud in the organization's name, for example, applying for government-supported Covid alleviation loans. 

To avoid becoming victims of such ransomware attacks, here are a few precautions:

 • Build up an intelligent danger recognition framework or a security incident event framework. In case of a break by pernicious criminals, such frameworks will caution your IT faculty about the occurrence constantly and assist them with keeping information exfiltration from organization servers. 

 • Utilize a salted secure encryption algorithm to encode your confidential information. At the point when scrambled, your organization information would be everything except futile to criminals. The information would be scrambled by the algorithm, which would deliver it incoherent for unapproved parties without an encryption key.
Read more »
Subscribe to: Posts (Atom)