Site iconSite icon ForkLog

Jewelry Team dismantled; mass data leaks in Russia and other cybersecurity developments

ForkLog
Jewelry Team dismantled; mass data leaks in Russia and other cybersecurity developments

We have gathered the week’s most important cybersecurity news.

  • The Ministry of Internal Affairs, with the support of F.A.C.C.T. (formerly Group-IB), dismantled the Jewelry Team gang.
  • Unknown actors leaked data from several major Russian retailers.
  • Malware Fracturiser found in Minecraft mods.
  • Researchers built a robot to extract the contents of RAM.

The Ministry of Internal Affairs, with the support of F.A.C.C.T., dismantled Jewelry Team

The Ministry of Internal Affairs, with the support of F.A.C.C.T. (formerly Group-IB), investigators identified the Jewelry Team group, which stole money from Russians via the popular BlaBlaCar ride-hailing service.

According to investigators, starting in September 2021, the group posted fake driver advertisements. Subsequently, communications with users moved to a messenger where they sent links to a phishing resource allegedly for prepayment.

As a result, the criminals obtained not only deposits of 500 to 1,500 rubles but also card data. One user was targeted with a withdrawal of over 3 million rubles, but the bank blocked the transfer.

Researchers suggested that Jewelry Team was formed in January 2021 by former members of the scam crew HAUNTED FAMILY, or that it was its standalone unit.

Source: F.A.C.C.T.

In total, F.A.C.C.T. uncovered three dozen phishing sites created to obtain upfront payments.

The Ministry of Internal Affairs reported the dismantling of the group in May. An criminal case has been opened for the theft of funds. The alleged leader of Jewelry Team was placed under house arrest; one accomplice is under house arrest, another is in pre-trial detention.

Unknown attackers leaked data from customers of several major retailers in Russia

During the week, user data from several major Russian retailers appeared in the open. This was reported by the Telegram channel “Data Leaks”.

First to leak were databases of the chains Auchan and Your Home (Tvoy Dom) with 7.8 million and more than 713,000 lines respectively.

Data: Telegram channel “Data Leaks”.

Later they dumped data from customers of clothing retailer Gloria Jeans, mattress store Ascona and online bookstore book24.ru with 2-4 million lines.

Later they posted databases of Bukvoed (Bukvoed) online bookstore (6.8 million lines), clothing retailer TVOE (2.2 million lines), home improvement chain Leroy Merlin (5.1 million lines) and cooking site Eat at Home (Eдим Дома) (more than 535,000 lines).

In most of the leaked files there were:

Several companies, including Auchan, Gloria Jeans, Eksmo-AST (Book24) and Ascona, confirmed the incident and began internal investigations.

Presumably the data was leaked by the attackers responsible for the leak of Sber and other Russian companies.

They promised to publish new data soon.

In Minecraft mods discovered malware Fracturiser

In a number of Minecraft mods, the self-spreading malware Fracturiser was found, targeting Windows and Linux systems. This was reported by CurseForge.

And originally, the compromised accounts of developers were posted on this platform; The Bukkit.org site was also affected. Prism Launcher developers suggested that it was an exploitation of a vulnerability in Overwolf platform.

Some of the malicious copies are embedded into popular modpacks, including Better Minecraft with more than 4.6 million downloads.

The first information about infections of plugins and mods appeared as early as mid-April.

Windows shortcut created by Fractureiser. Data: Bleeping Computer.

Fracturiser malware is capable of:

CurseForge representatives blocked all accounts associated with the attacks. They stressed that none of their administrators were hacked.

Users were urged to immediately stop downloading and updating mods for the game, as well as to change passwords for all accounts.

To facilitate indicator discovery, investigators published scripts. CurseForge published a guide to eradicate the contamination.

Researchers created a robot to extract RAM contents

Red Balloon Security researchers Ang Cui and Yuanche Wu presented a cryomechanical robot capable of extracting the contents of DDR3 memory at low temperatures.

This attack is called Cold Boot Attack and is achieved thanks to the ability to retain data in dynamic and static memory after power is removed.

The device, costing less than $1,000, literally freezes one memory chip. To read data, the extracted physical memory is placed into a FPGA.

Data: REcon.

«With this approach you get the code, all data, the stack and the entire physical memory», — the developers said.

Researchers believe that using a more expensive FPGA-based platform (costing around $10,000) could extend their method to sophisticated attacks on DDR4 and DDR5.

Countering Cold Boot Attack can be achieved with memory encryption.

On Twitter, a new probable head of BreachForums named

By the end of June the hacker forum BreachForums, closed by U.S. authorities in March, may resume operations under the leadership of the hacking group ShinyHunters. This was stated by the Vx-underground community without naming a source.

ShinyHunters has been known since 2020 and is linked to high-profile leaks from T-Mobile and AT&T, resulting in tens of millions of dollars in losses.

In the summer of 2022, law enforcement arrested one of the group’s members, French national Sebastien Raoul. Later, two of his accomplices were detained in Morocco. They have all since been extradited to the United States, where they await trial.

According to experts, the relaunch of BreachForums could be driven by American intelligence agencies.

Criminals created a Telegram bot to profit from a fake search for intimate photos

Kaspersky Lab experts found a Telegram chat bot that purportedly uses ChatGPT 4.0 code and allows users to locate leaked intimate photos.

Users are invited to check romantic partners by sending a link to their social profile or phone number.

Then the service simulates the search and reports a “page found in the database.” The database, according to the bot authors, contains over 10 million photos and videos.

Ultimately, the client gets screenshots with blurred images and an estimated date of the leak.

Data: Kaspersky Lab.

For one-time removal of the blur, the bot’s creators charge 399 rubles; for unlimited access to the database, 990 rubles. In reality, users simply lose money and do not receive any photos.

Also on ForkLog:

What to read this weekend?

We analyse what Binance’s service to users from Russia means for the crypto ecosystem.

Exit mobile version