Site iconSite icon ForkLog

Shifts in the bitcoin-ransomware market, the Russian Federal Tax Service breach, and other cybersecurity news

ForkLog
Shifts in the bitcoin-ransomware market, the Russian Federal Tax Service breach, and other cybersecurity news

We round up the week’s most important cybersecurity news.

  • Ukraine’s GUR said it hacked the Russian Federal Tax Service.
  • The websites of two ransomware groups went offline.
  • OAuth applications were used to automate covert mining.
  • In Spain, the alleged Kelvin Security leader was arrested.

OAuth applications used to automate covert mining

Researchers at Microsoft discovered a series of cyber incidents in which OAuth applications were used to automate phishing campaigns, compromise business email and conceal cryptocurrency mining.

The attackers targeted accounts lacking reliable authentication mechanisms. Through compromised accounts, they created new OAuth applications with high privileges, which gave the malware operators persistent and stealthy access to the system.

In one case the Storm-1283 group deployed virtual machines for crypto mining using OAuth. Losses ranged from $10,000 to $1.5 million depending on the duration of the attack.

Data: Microsoft.

In aggregate, experts found and removed about 17 000 malicious versions of the app, through which from July to November attackers sent more than 927 000 phishing emails.

Ukraine’s GUR said it hacked the Russian Federal Tax Service

On December 12, Ukraine’s GUR cyber division stated that it hacked 2,300 regional servers of the Russian Federal Tax Service by infecting them with malware.

According to the GUR, the attack led to the complete destruction of the agency’s primary database and its backups. The Russian IT firm Office.ed-it.ru, which provides the tax service’s data-centre services, was also breached, disrupting the link between regional tax offices and the central office in Moscow.

Data: GUR.

According to the Ukrainian side, paralyzing the Russian tax system will last at least a month, and full restoration is unlikely.

The publication Bleeping Computer could not independently verify the information.

In Spain, the alleged Kelvin Security leader was arrested

On December 7, Spanish police arrested a Venezuelan citizen in Alicante believed to be one of the leaders of the hacking group Kelvin Security.

Law enforcement says that since 2020, the cybercriminals have targeted no fewer than 300 government institutions in 90 countries, including Spain, Germany, Italy, Argentina, Chile, Japan, and the United States. The stolen data were sold on hacker forums.

The detainee, according to investigators, laundered the illicit proceeds via cryptocurrency.

Police seized computer equipment intended to help identify associates of the suspect, data buyers, and other entities linked to him.

The two ransomware groups’ sites went offline

Last week the server infrastructure of the ALPHV (BlackCat) and NoEscape ransomware gangs suddenly became inaccessible.

A few days later, the negotiation and data-leak sites were restored, albeit without content. They attributed the outage to hosting-side issues.

Meanwhile, NoEscape operators were suspected by X users of staging an exit scam for several millions of dollars.

Some independent sources suggested that the outages could have been caused by US law enforcement interference. The publication Bleeping Computer independently confirmed this information.

Meanwhile, the LockBit gang, taking advantage of the moment, announced plans to recruit operators from ALPHV and NoEscape.

Data from one of ALPHV’s victims — the German energy agency — has already been posted on LockBit’s leak site.

Toyota warned clients about a leak of personal and financial information

Toyota Financial Services, a subsidiary of Toyota Motor Corporation, told clients that a third party gained access to their confidential and financial data. The incident occurred in November and affected subsidiaries in Europe and Africa.

Data: Heise.

The attack was carried out by the Medusa group. After they failed to obtain an $8 million ransom, they leaked the stolen information on their leak site.

The compromised data included:

Toyota continues its internal investigation and promises to inform affected customers promptly if further data disclosures are discovered.

Fraud schemes around cryptocurrency investments spread in Russia

Since the start of 2023, the security company F.A.C.C.T. has identified 10 active scam partner programs attracting users from Russia through giveaways and crypto investments.

To scale their illegal business, attackers buy ready-made phishing resources and template payment pages, as well as traffic, for a share of the money stolen from victims.

Mostly these scam pages focus on lotteries with prize boxes, crypto investments, and especially “lucrative” offers from marketplaces. Less often, there are offers to buy a “pretty” domain name for a site.

Fraudsters’ affiliate programs in numbers. Data: F.A.C.C.T.

Monthly, one such program can bring in about 4.3 million rubles for participants in the “affiliate community.”

Also on ForkLog:

What to read this weekend?

We discuss the specifics of ethical hacking with staff from the Ukrainian analytics firm HAPI.

Exit mobile version