Hacktivist group KillSec has revealed a new weapon in their digital arsenal: a Ransomware as a Service (RaaS) program designed to empower aspiring cybercriminals with hacking capabilities. The threat actor revealed the RaaS program on June 24, 2024, sharing its features for those looking to deploy ransomware attacks on their targets.  The centerpiece of KillSec RaaS is its advanced locker, meticulously crafted in C++ for optimal performance and efficiency. This encryption tool is engineered to lock down files on victims' computers, rendering them inaccessible until a ransom is paid and a decryption key is provided. Operating through a user-friendly dashboard accessible via the Tor network, known for its anonymity features, KillSec ensures that its clients can operate discreetly.

KillSec Announces New RaaS Program for Hackers

[caption id="attachment_79012" align="alignnone" width="532"] Source: Dark Web[/caption] The dashboard boasts several essential features designed to streamline the ransomware deployment process. Users can track the success of their campaigns with detailed statistics, manage communications via an integrated chat function, and customize ransomware configurations using the built-in builder tool. In addition to its current capabilities, KillSec has announced forthcoming enhancements to its RaaS program. These include a stresser tool for launching distributed denial-of-service (DDoS) attacks, automated phone call capabilities to pressure victims into paying ransoms, and an advanced stealer for harvesting sensitive data such as passwords and financial information. Access to KillSec's RaaS program is available for a fee of $250, aimed at "trusted individuals," with KillSec taking a 12% commission from any ransom payments collected. This pricing model highlights the group's commitment to making advanced cyber weaponry accessible while maintaining a profitable partnership with their clients.

Who is the KillSec Hacktivist Group?

Founded in 2021, KillSec has emerged as a prominent force in the hacktivist community, often aligning itself with the ethos of the Anonymous movement. Their activities have included high-profile website defacements, data breaches, and ransomware attacks, including recent breaches affecting traffic police websites in Delhi and Kerala. Ransomware as a Service (RaaS) programs, similar to what KillSec has announced, represent an evolution in cybercrime tactics, democratizing access to powerful malicious software for a global audience.  The RaaS program model allows less technically skilled individuals to engage in cyber extortion with relative ease, leveraging customizable ransomware variants to target businesses and individuals worldwide. The proliferation of RaaS platforms has contributed to the escalating frequency and severity of ransomware attacks, posing substantial challenges to law enforcement agencies worldwide. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A newly surfaced banking trojan named "Sniffthem," also known as Tnaket has emerged on the dark web forums. This Sniffthem trojan, introduced by threat actor oliver909 on the XSS Russian language forum, targets a wide spectrum of Windows operating systems ranging from Windows 7 to the latest Windows 11. Oliver909's forum post on June 24, 2024, detailed the capabilities of the banking trojan Sniffthem, highlighting its advanced functionalities designed for financial fraud. Among its notable features, Sniffthem possesses the ability to perform HTML injection, enabling it to compromise websites—even those secured with SSL certificates—by injecting malicious HTML code. This tactic undermines the integrity of supposedly secure web pages, facilitating the theft of sensitive information.

Dark Web Actors Reveals Banking Trojan Sniffthem

[caption id="attachment_78990" align="alignnone" width="1906"] Source: Dark Web[/caption] Another key feature of Sniffthem is its credit card grabber capability, allowing it to stealthily capture credit card details through the injection of fake web pages. This method operates covertly, ensuring that the theft of financial data goes unnoticed by users and security measures alike. Moreover, the trojan supports a wide range of web browsers including Firefox, Google Chrome, Edge, and Yandex, ensuring compatibility across various user environments. To evade detection, the banking trojan Sniffthem employs crypters, enhancing its stealth and persistence on infected systems. These crypters cloak the trojan's code, making it difficult for antivirus programs and security defenses to detect and remove the malware effectively. Oliver909 demonstrated the trojan's functionalities through a video shared on the forum, showcasing its management panel and user interface designed for seamless control over malicious activities. In terms of pricing, oliver909 offers Sniffthem on a subscription basis, setting a monthly rate of USD 600. This pricing strategy positions Sniffthem as a lucrative option within the cybercriminal marketplace, appealing to threat actors looking to capitalize on financial fraud opportunities.

Technical Insights into Sniffthem Banking Trojan

Sniffthem's technical specifications highlight its sophistication and potential impact on cybersecurity. The Sniffthem banking trojan operates persistently as a hidden process, evading detection and maintaining a covert presence on infected systems. Its integration with a web-based management panel allows threat actors to efficiently control compromised devices and orchestrate malicious activities remotely. Furthermore, Sniffthem's compatibility with a wide array of browsers—64 in total—highlights its versatility and ability to infiltrate diverse user environments. This capability extends its reach across various sectors, with a particular focus on the BFSI (Banking, Financial Services, and Insurance) industry where financial transactions and sensitive data are prime targets. The emergence of Sniffthem signifies a heightened threat to organizations and individuals alike, particularly within the financial sector. To mitigate risks associated with banking trojans like Sniffthem, cybersecurity best practices are essential. Organizations should prioritize regular software updates, endpoint protection, and employee training to recognize and respond to phishing attempts effectively. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Hacktivist group AzzaSec has announced the release of a Windows ransomware builder. The builder was posted via the Telegram channel on June 23, 2024. Designed in .NET, this malicious software features sophisticated functionality including SHA 512 and AES encryption, ensuring its undetectable (FUD) status with minimal risk of detection, as verified by its single hit on KleenScan. AzzaSec claims their ransomware can bypass major antivirus solutions such as Windows 10 / 11 Defender, Avast, Kaspersky, and AVG. In addition to its encryption prowess, the builder includes anti-virtual machine, anti-debugging, and anti-sandbox capabilities, as demonstrated in a revealing demo video shared alongside the announcement. This video showcases how decryption keys and victim information are stored securely on a centralized Command and Control (C2) server.

AzzaSec Announces New Windows Ransomware Builder

[caption id="attachment_78968" align="alignnone" width="373"] Source: Dark Web[/caption] Pricing for AzzaSec's ransomware varies, from $300 for a single-use stub to a subscription model costing up to $4500 for six months. The source code for this Windows ransomware builder is also available for purchase at a steep $8000. The development of AzzaSec's ransomware marks a new advancement in cyber threats, highlighting the evolution of ransomware-as-a-service (RaaS). This model not only empowers threat actors with turnkey tools but also commodifies cyber extortion, potentially increasing the frequency and impact of ransomware attacks globally. The group's announcement highlights a growing trend where malicious actors leverage sophisticated technologies and monetization strategies to maximize their impact on unsuspecting victims. As cybersecurity defenses evolve, so do the tactics of those seeking illicit gains through digital means.

Features and Functionality of the Windows Ransomware Builder

In their Telegram post, AzzaSec described their ransomware's capabilities in detail. Developed with VB.NET and weighing 10MB, the ransomware utilizes a unique algorithm for encryption. It operates with a fully undetectable structure, boasting a detection rate of only 1 out of 40 on KleenScan. Tested against various security solutions including Windows Defender, Avast, Kaspersky, and AVG, AzzaSec ensures its malware's effectiveness in compromising systems. The ransomware functions by connecting to a C2 server, where decryption keys and device information are stored. This approach allows the threat actors to monitor and control the ransomware's impact remotely. Furthermore, the ransomware includes anti-virtual machine, anti-debugging, and anti-sandbox features, making it resilient against common security countermeasures. AzzaSec also outlined its pricing strategy: $300 for a single-use stub, escalating to $4500 for a six-month subscription. For those seeking full control, the source code is available for $8000, enabling other threat actors to customize and deploy the ransomware independently. AzzaSec's emergence into the ransomware scene signals a reminder for organizations and individuals alike to upgrade their cybersecurity measures and remain vigilant against online threats. As ransomware-as-a-service models become more accessible, preemptive cybersecurity measures and incident response plans are essential defenses against these ever-present dangers.

Neiman Marcus has issued a notification to its customers regarding a massive data breach that occurred in May 2024, potentially exposing sensitive personal information. The Neiman Marcus data breach, affecting approximately 64,472 customers, involved unauthorized access to a cloud database platform used by the luxury retailer, which is operated by Snowflake, a third-party provider. In a conversation with The Cyber Express, a Neiman Marcus spokesperson confirmed the breach, stating, "Neiman Marcus Group (NMG) recently learned that an unauthorized party gained access to a cloud database platform used by NMG that is provided by a third party, Snowflake." Prompt action was taken, with the spokesperson adding, "Promptly after discovering the incident, NMG took steps to contain it, including by disabling access to the platform."

Neiman Marcus Data Breach Confirmed

The Neiman Marcus data breach compromised a range of personal data, including customer names, contact details, dates of birth, and Neiman Marcus gift card numbers. "Based on our investigation, the unauthorized party obtained certain personal information stored in the platform," the spokesperson continued, clarifying that "The types of personal information affected varied by individual, and included information such as name, contact information, date of birth, and Neiman Marcus or Bergdorf Goodman gift card numbers (but without gift card PINs)." Neiman Marcus has acted swiftly, launching an investigation with leading cybersecurity experts and notifying law enforcement authorities. In compliance with regulatory requirements, the company has begun notifying affected customers, including reaching out to the Maine Attorney General's office. The retailer has advised customers to monitor their financial statements for any suspicious activity and has provided resources for individuals concerned about identity theft.

Mitigation Against the Neiman Marcus Data Leak

"We also began an investigation with assistance from leading cybersecurity experts and notified law enforcement authorities," the spokesperson emphasized. Customers are encouraged to request free credit reports, report any suspected fraud to law enforcement and the Federal Trade Commission, and consider placing a security freeze on their credit files as precautionary measures. Neiman Marcus Group, Inc., based in Dallas, Texas, is a popular luxury retailer that oversees brands such as Neiman Marcus, Bergdorf Goodman, Horchow, and Last Call. Since September 2021, it has been under the ownership of a consortium of investment firms led by Davidson Kempner Capital Management, Sixth Street Partners, and Pacific Investment Management. Following this Neiman Marcus data leak, the firm has established a dedicated toll-free hotline (1-885-889-2743) for affected customers seeking further information or assistance related to the data breach incident. 

A security threat has surfaced on dark web forums: a zero-day exploit targeting a use-after-free (UAF) vulnerability in the Linux Kernel, specifically version 6.6.15-amd64. This use-after-free vulnerability, advertised for sale by an actor known as Cas, promises capabilities that include privileged code execution and potential access to sensitive data. According to the post, which has garnered attention from cybersecurity communities, the Linux Kernel vulnerability exploit is being offered for $150,000 in either Monero or Bitcoin. The threat actor Cas has specified that interested buyers must demonstrate proof of sufficient funds before any transaction can proceed, highlighting the illicit nature and high stakes of such transactions.

Use-After-Free Vulnerability Targets Linux Kernel

[caption id="attachment_78815" align="alignnone" width="1553"] Source: Dark Web[/caption] The Linux Kernel vulnerability, if successfully deployed, could allow malicious actors to escalate their privileges locally within affected systems, potentially executing code with root-level permissions. This type of vulnerability poses severe risks to both individual users and organizations relying on Linux-based systems. Selling Oday Use-after free in the Linux Kernel, you can use it to do a Privileged Code Execution (LPE (Local Privilege Escalation), or execute code with root privileges), (Data Leakage )..etc Affected version: 6.6.15-amd64. Environment arch: 64-bit and Price: 150k Monero & BTC", reads the threat actor post. Moderators on these forums have highlighted another individual, known as IntelBroker, who claims to have verified the proof-of-concept (PoC) behind the exploit privately. This endorsement adds credibility to Cas's offer, despite the lack of publicly available evidence.

Previous Instances and Industry Impact

Earlier, cybersecurity firm Rewterz reported a similar instance involving CVE-2024-36886, where a use-after-free flaw in the Linux Kernel (version 4.1) could be exploited by remote attackers to execute arbitrary code. This use-after-free vulnerability, triggered by fragmented TIPC messages, highlights ongoing challenges in securing Linux environments against sophisticated exploits. A use-after-free (UAF) vulnerability occurs when a program continues to access memory that has already been deallocated. This issue arises when dynamic memory allocation, typically managed by functions like free() in languages such as C or C++, is mishandled.  The program may inadvertently reference this freed memory, leading to unpredictable behavior such as crashes or security vulnerabilities. Exploitation of UAF vulnerabilities can allow attackers to manipulate the program's behavior, potentially executing arbitrary code or escalating privilege Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The National Central Bureau (NCB) Buenos Aires, a vital division of Interpol in Argentina, has been listed by a dark web actor, claiming to leak methods to exploit XSS and CSRF vulnerabilities in the domain of the Argentine Division of Interpol. The alleged leak came to light when a threat actor known as “emocat” posted on BreachForums detailing techniques to exploit these vulnerabilities within the domain. The threat actor also shared a URL hinting at a potential error message on the affected web page.

XSS and CSRF Vulnerabilities Targeting Interpol in Argentina

The disclosure has raised concerns within the governmental and law enforcement sectors, affecting not only Interpol but also Argentina's broader cybersecurity landscape. Despite Emocat's claims, there is currently no confirmed evidence of active exploitation on the NCB Buenos Aires website, interpol.gov.ar. As of now, the website remains operational without visible signs of compromise, suggesting that the vulnerabilities disclosed have not yet been exploited. [caption id="attachment_78793" align="alignnone" width="1563"] Source: Dark Web[/caption] The Cyber Express has reached out to the  National Central Bureau (NCB) Buenos Aires to learn more about this leak of XSS and CSRF vulnerabilities or any confirmation of active exploitation. However, at the time of writing this, no official statement or response has been received, leaving the claims for this exploitation of XSS and CSRF vulnerabilities to stand unverified.  This lack of official confirmation highlights the uncertain nature of the current threat status regarding Interpol's operations in Buenos Aires.

What are XSS and CSRF Vulnerabilities?

XSS (Cross-Site Scripting) and CSRF (Cross-Site Request Forgery) are critical security vulnerabilities that pose significant risks to web applications and user data. XSS involves attackers injecting malicious scripts, typically JavaScript, into web pages viewed by other users.  These scripts execute in the victim's browser context, allowing attackers to steal sensitive information, hijack sessions, modify page content, or redirect users to malicious sites. XSS vulnerabilities come in several forms: reflected, where the script is part of the request URL and reflected in the response; stored, where the script is permanently stored on the server and executed whenever the affected page is accessed; and DOM-based, where the attack occurs within the client-side script itself.  In contrast, CSRF exploits the trust that a web application has in a user's browser after authentication. Attackers trick users into unwittingly performing actions on a trusted site where they are authenticated. This is achieved by crafting a malicious request that appears legitimate to the application but originates from a different site visited by the victim. CSRF attacks can lead to unauthorized actions such as changing account settings, making purchases, or transferring funds without the victim's knowledge.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A new supply chain attack has impacted several plugins hosted on WordPress.org. This WordPress vulnerability, discovered on June 24th, 2024, by the Wordfence Threat Intelligence team, initially centered around the Social Warfare plugin. The plugin was found to have been compromised with malicious code inserted as early as June 22nd, 2024, according to a forum post by the WordPress.org Plugin Review team. Upon identifying the malicious file within Social Warfare, the Wordfence team promptly uploaded it to their internal Threat Intelligence platform for analysis. Subsequently, their investigation revealed that the same malicious code had infected four additional plugins. Despite efforts to notify the WordPress plugins team about these compromised plugins, the response has been limited, although the affected plugins have since been delisted from the official repository.

WordPress Plugin Vulnerability Leads to Supply Chain Attack

According to Wordfence researchers, the listed plugins leading to supply chain attacks include 5 popular names. Among them, Social Warfare versions 4.4.6.4 to 4.4.7.1 were compromised, but a patched version (4.4.7.3) has since been released. Blaze Widget versions 2.2.5 to 2.5.2 and Wrapper Link Element versions 1.0.2 to 1.0.3 were also affected, with no available patched versions. Interestingly, although the malicious code appears removed in Wrapper Link Element version 1.0.0, this version is lower than the infected ones, complicating the update process. Users are advised to uninstall the plugin until a properly tagged version is issued. Similarly impacted were Contact Form 7 Multi-Step Addon versions 1.0.4 to 1.0.5 and Simply Show Hooks version 1.2.1, with no patched versions currently released for either plugin. The injected malware's primary function involves attempting to create unauthorized administrative user accounts on affected websites. These accounts are then leveraged to exfiltrate sensitive data back to servers controlled by the attackers. Additionally, the attackers embedded malicious JavaScript into the footers of compromised websites, potentially impacting SEO by introducing spammy content.

Ongoing Investigation and Recovery

Despite the malicious code's discovery, it was noted for its relative simplicity and lack of heavy obfuscation, featuring comments throughout that made it easier to trace. The attackers appear to have begun their activities as early as June 21st, 2024, and were actively updating plugins as recently as a few hours before detection. The Wordfence team is currently conducting a thorough analysis to develop malware signatures aimed at detecting compromised versions of these plugins. They advise website administrators to utilize the Wordfence Vulnerability Scanner to check for vulnerable plugins and take immediate action—either by updating to patched versions or removing affected plugins altogether. Key indicators of compromise include the IP address 94.156.79.8, used by the attackers' server, and specific unauthorized administrative usernames such as 'Options' and 'PluginAuth'. To mitigate risks, administrators are urged to conduct comprehensive security audits, including checking for unauthorized accounts and conducting thorough malware scans.

Lindex Group, an international retail giant specializing in high-quality fashion, has reportedly fallen victim to a data breach. According to claims made by threat actor IntelBroker on dark web forums, the Lindex Group data breach allegedly occurred in June 2024, targeting Lindex Group's internal GitLab. The perpetrator allegedly exploited vulnerabilities stemming from developers storing credentials in their Jira workplace, thereby gaining access to a collection of source code belonging to the company. Lindex Group, which has been a part of the Finnish Stockmann Group since 2007, operates approximately 480 stores across 18 markets, including the Nordic countries, the Baltic states, Central Europe, and the Middle East. With a workforce of around 5,000 employees, the company holds a prominent position in the retail industry, focusing on an omnichannel approach to fashion retailing.

Decoding IntelBroker’s Claims of Lindex Group Data Breach

[caption id="attachment_78687" align="alignnone" width="1242"] Source: X[/caption] The claims made by IntelBroker on the dark web suggest that the compromised source code of Lindex Group is now accessible through undisclosed channels, although specific details such as the price for access or direct communication channels have not been publicly disclosed. The situation has prompted concerns about the potential impact on Lindex Group's operations and the security of its customers' data. Despite these reports, Lindex Group has yet to issue an official statement or response regarding the alleged breach. The Cyber Express has reached out to the organization to learn more about this the breach claims. However, at the time of this, no official statement or response has been received. Visitors to Lindex Group's website may find it operational without immediate signs of intrusion, suggesting that the attack may have targeted backend systems rather than initiating a more visible front-end assault like a Distributed Denial-of-Service (DDoS) attack or website defacements.

IntelBroker Hacking Spree

IntelBroker, the solo hacker claiming responsibility for the breach, has a history of similar actions, having previously claimed involvement in cybersecurity incidents affecting other major companies. One notable example includes an alleged data breach targeting Advanced Micro Devices (AMD), a leading semiconductor manufacturer, and Apple was another alleged victim. The incident, disclosed on platforms like BreachForums, involved the exposure of sensitive data, prompting AMD to initiate investigations in collaboration with law enforcement authorities and third-party cybersecurity experts. The situation highlights the persistent nature of hackers like IntelBroker, who continue to exploit vulnerabilities in digital infrastructure for financial gain or malicious intent. For organizations like Lindex Group, the fallout from such breaches can encompass not only financial losses but also reputational damage and regulatory scrutiny. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Crypto portfolio tracking app Coinstats has found itself at the center of a security breach, impacting approximately 1,590 user wallets. The Coinstats data breach, which occurred on June 22, 2024, has been attributed to a group with alleged ties to North Korea, marking a concerning development for crypto investors.  Coinstats swiftly responded to the breach by taking down its application temporarily. This proactive measure was aimed at containing the data breach at Coinstats and preventing further unauthorized access to user data and funds.  The affected wallets, constituting about 1.3% of all Coinstats wallets, were primarily those created directly within the app. Fortunately, wallets connected to external exchanges and platforms remained unaffected, providing some relief amidst the security scare.

Understanding the Coinstats Data Breach 

[caption id="attachment_78679" align="alignnone" width="733"] Source: Coinstats on X[/caption] In a public statement addressing the breach, Coinstats reassured its user base that the incident has been mitigated, and immediate steps have been taken to secure the platform. Users whose wallet addresses were compromised were advised to take action by transferring their funds using exported private keys. A spreadsheet link was provided for users to check if their wallets were among those affected. CEO Narek Gevorgyan highlighted the seriousness of the situation, acknowledging the challenges posed by the Coinstats cyberattack while emphasizing Coinstats' commitment to restoring normal operations swiftly and securely. Gevorgyan outlined that comprehensive security measures were being implemented during the restoration process to fortify the platform against future vulnerabilities. "We're actively working to bring the app back online as quickly as possible. Thank you for your patience," stated Gevorgyan in an update shared via Coinstats' official channels.

North Korea-linked Hackers Behind the Data Breach at Coinstats

The revelation of North Korea-linked hackers being behind the breach adds a geopolitical dimension to the Coinstats data breach incident, highlighting the global reach and sophisticated tactics employed by cyber threat actors targeting digital assets and platforms. This aspect of the breach highlights the need for heightened cybersecurity measures across the cryptocurrency sector. In a similar case, another crypto firm, BtcTurk faced a cyberattack on its hot wallets on June 22, 2024. Binance Binance CEO Richard Teng confirmed this attack, pledging ongoing support for BtcTurk's investigation. Cryptocurrency investigator ZachXBT hinted at a possible link between the breach and a $54 million Avalanche transfer.  Coinstats users have been urged to remain vigilant and monitor their accounts closely for any unauthorized transactions or suspicious activities. The company assured its users that it is actively investigating the extent of funds moved during the breach and pledged to provide updates as new information becomes available. In response to the breach, regulatory bodies and industry stakeholders may scrutinize Coinstats' security practices and response protocols. The outcome of such scrutiny could influence future cybersecurity standards within the cryptocurrency industry, potentially leading to more stringent requirements for platform security and user protection.

The Handala hacker group has claimed responsibility for breaching Zerto, an Israeli firm specializing in critical cybersecurity services. The Zerto cyberattack reportedly yielded a substantial 51 terabytes of data, potentially exposing sensitive information integral to Zerto's operations. Zerto is renowned for its pivotal role in disaster recovery synchronization and site recovery, providing essential services utilized by numerous global enterprises. The cyberattack on Zerto by Handala, a group sympathetic to Palestinian causes and named after a symbol of Palestinian resilience, highlights the increasing intersection of geopolitical tensions and cybersecurity threats.

Handala Hacker Group Claims Responsibility for Zerto Cyberattack

[caption id="attachment_78661" align="alignnone" width="1280"] Source: X[/caption] According to the threat actor's post, Handala hacker group claims that they have targeted Zerto and also shared multiple screenshots on dashboards associated with the cybersecurity company. The group, previously claimed cyberattack on Israel’s radars and allegedly took down Iron Dome missile defense systems. The Handala hacker group draws its inspiration from the iconic figure created by Palestinian cartoonist Naji al-Ali. The character, depicted as a ten-year-old with hands clasped behind his back, symbolizes defiance against imposed solutions and solidarity with the marginalized Palestinian population. Since al-Ali's tragic assassination in 1987, Handala has remained a potent symbol of Palestinian identity, prominently displayed across the West Bank, Gaza, and Palestinian refugee camps. The cyberattack on Zerto marks another chapter in Handala's campaign, aligning their actions with broader movements supporting Palestinian rights globally. The group's activities have resonated within these movements, akin to its adoption by the Boycott, Divestment, and Sanctions movement and the Iranian Green Movement. Despite the bold claims by the Handala hacker group, official confirmation from Israeli authorities regarding the extent and impact of the cyberattack is pending. However, security experts within Israel have expressed concerns over the plausibility of Iranian involvement in cyber operations targeting critical Israeli infrastructure.

The Implication of Cyberattack on Zerto

The Cyber Express reached out to Handala for further insights into their motives and objectives behind the Zerto cyberattack. As of the latest update, no formal response has been received, leaving the claims and motivations of the attack unverified. The incident highlights the ongoing cybersecurity challenges faced by firms operating in sensitive sectors, exacerbated by geopolitical tensions and sophisticated cyber threats. The implications of the Zerto breach are profound, highlighting vulnerabilities in cybersecurity defenses and the need for robust measures to protect critical infrastructure. As stakeholders await further developments, The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged Zerto cyberattack or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Following the massive cyberattack on Turkish cryptocurrency exchange BtcTurk, Binance has joined efforts to investigate the incident and has frozen over $5.3 million in stolen funds. Binance CEO Richard Teng confirmed this intervention on X, sharing operation details. The BtcTurk cyberattack, which occurred on June 22, 2024, targeted BtcTurk's hot wallets, exposing vulnerabilities in the exchange's internet-connected software-based crypto wallets. [caption id="attachment_78617" align="alignnone" width="738"] Source: X[/caption] BtcTurk reassured its users in a statement on its website and denoted that most assets stored in cold wallets remained secure, safeguarding the bulk of its users' holdings. Binance CEO Richard Teng stated on X that their team is actively supporting BtcTurk in their investigation and pledged to provide updates as their security teams uncover more information. 

Decoding the BtcTurk Cyberattack

Cryptocurrency investigator ZachXBT hinted at a potential link between the BtcTurk breach and a $54 million Avalanche transfer. The transfer, involving 1.96 million AVAX to Coinbase and subsequent Bitcoin withdrawals from Binance, coincided suspiciously with the timing of the cyberattack on BtcTurk. [caption id="attachment_78620" align="alignnone" width="755"] Source: X[/caption] Despite the setback, BtcTurk announced plans to gradually restore crypto deposit and withdrawal services once their cybersecurity measures are completed. They emphasized that their financial resilience surpasses the amount lost in the attack, ensuring that user assets remain unaffected. “Our teams have detected that there was a cyber attack on our platform on June 22, 2024, which caused uncontrolled footage to be taken. Only some of the balances in the hot wallets of 10 cryptocurrencies were affected by the cyber attack in question, and our cold wallets, where most of the assets are kept, are safe. BtcTurk's financial strength is well above the amounts affected by this attack, and user assets will not be affected by these losses”, reads the organization's statement. 

Mitigation Against the Cyberattack on BtcTurk

The BtcTurk cyberattack specifically impacted deposits of various cryptocurrencies, including Bitcoin (BTC), Aave (AAVE), Algorand (ALGO), Ankr (ANKR), Cardano (ADA), Avalanche (AVAX), ApeCoin (APE), Axie Infinity (AXS), Chainlink (LINK), Cosmos (ATOM), Filecoin (FIL), among others, says BtcTurk's. “Our teams are carrying out detailed research on the subject. At the same time, official authorities were contacted. As a precaution, cryptocurrency deposits and withdrawals have been stopped and will be made available for use as soon as our work is completed. You can follow the current status of the transactions on https://status.btcturk.com”, concludes the statement.  As investigations continue, both BtcTurk and Binance are working diligently to mitigate the impact of the cyberattack and strengthen their security protocols to prevent future incidents. Users are encouraged to monitor official channels for updates on the situation. By collaborating and taking swift action, Binance and BtcTurk aim to uphold trust within the cryptocurrency community while enhancing the resilience of their platforms against online threats.

Among the diverse array of Android malware available on the dark web markets, Rafel RAT stands out as a particularly potent tool for malicious actors. Rafel RAT, an open-source remote administration tool, enables remote access and control over infected Android devices. Its capabilities include surveillance, data exfiltration, persistence mechanisms, and manipulation of device functionalities.

The Relation Between APT-C-35 and Rafel RAT

Recent research by Check Point has uncovered instances of APT-C-35, also known as DoNot Team, leveraging Rafel RAT in their espionage operations. This discovery highlights the tool's versatility and effectiveness across different threat actor profiles and operational objectives. The group has been observed using Rafel RAT to conduct extensive espionage campaigns and targeting high-profile organizations, including those in the military sector. Analysis reveals approximately 120 distinct malicious campaigns associated with Rafel RAT, some of which have successfully targeted prominent organizations globally. Victims primarily hail from the United States, China, and Indonesia, with Samsung, Xiaomi, Vivo, and Huawei being the most affected device brands. Notably, a portion of targeted devices runs on unsupported Android versions, exacerbating security vulnerabilities due to the lack of essential security patches.

Technical Insights and Modus Operandi

Rafel RAT employs sophisticated techniques to evade detection and execute malicious operations discreetly. Upon infiltration, the malware initiates communication with a command-and-control (C&C) server, facilitating remote data exfiltration, surveillance, and device manipulation. Its command set includes capabilities for accessing phone books, SMS messages, call logs, location tracking, and even initiating ransomware operations. Threat actors utilizing Rafel RAT operate through a PHP-based C&C panel, leveraging JSON files for data storage. This streamlined infrastructure enables attackers to monitor infected devices comprehensively, accessing crucial information such as device models, Android versions, geographical locations, and network operator details. Such insights empower threat actors to tailor their malicious activities and campaigns effectively.

Emerging Threats and Mitigation Strategies

As Rafel RAT continues to evolve and proliferate, robust cybersecurity measures become imperative for Android users and enterprises alike. Effective strategies to mitigate risks include deploying comprehensive endpoint protection, staying updated with security patches, educating users about phishing and malware threats, and fostering collaboration across cybersecurity stakeholders. Rafel RAT exemplifies the nature of Android malware, characterized by its open-source nature, extensive feature set, and widespread adoption in illicit activities. Vigilance and proactive security measures are essential to safeguard against its threats, ensuring continued protection of user privacy, data integrity, and organizational security in an increasingly interconnected digital world.

The Ticketmaster data breach update is distressing as the threat actors have now released records of 1 million customers for free. The Ticketmaster data leak, earlier confirmed by Live Nation, Ticketmaster's parent company, involves unauthorized access and potential leak of sensitive customer information. According to the threat actor responsible for the breach, the stolen data in this incident includes a vast trove of data belonging to 680 million Ticketmaster customers. Initially demanding $100,000 for the stolen data, the threat actors have since escalated their tactics by publicly releasing records on a popular dark web forum. 

The Fallout of Ticketmaster Data Breach

This move appears to be an attempt to pressure Ticketmaster into meeting their demands, underlining the severity of the breach and its potential repercussions. [caption id="attachment_78485" align="alignnone" width="1415"] Source: Dark Web[/caption] In its post, the threat actor claims that Ticketmaster is not responding to the request to buy data from the hacker collective. In response, the hackers assert that the organization does not care “for the privacy of 680 million customers, so give you the first 1 million users free.” The compromised data includes a wide array of personal details: names, addresses, IP addresses, emails, dates of birth, credit card types, last four digits of credit cards, and expiration dates. This extensive breach of sensitive information raises serious concerns about the privacy and security of Ticketmaster's user base. The Ticketmaster data breach, which reportedly occurred on May 20, involved a database hosted on Snowflake, a third-party cloud storage provider utilized by Ticketmaster. Live Nation has acknowledged unauthorized activity within this cloud environment but has not provided specific details regarding the breach's origins or the complete extent of data exfiltrated.

Live Nation Confirms the Ticketmaster Data Leak Incident

Live Nation confirmed the Ticketmaster data leak in a regulatory filing, stating the incident occurred on May 20. They reported that a cybercriminal had offered what appeared to be company user data for sale on the dark web. The affected personal information is believed to be related to customers. “As of the date of this filing, the incident has not had, and we do not believe it is reasonably likely to have, a material impact on our overall business operations or on our financial condition or results of operations. We continue to evaluate the risks and our remediation efforts are ongoing”, reads the official filing.  Ticketmaster and Live Nation are expected to collaborate closely with cybersecurity experts and regulatory authorities to investigate the incident thoroughly. They will likely focus on enhancing security measures to prevent future breaches and mitigate the impact on affected customers. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A newly discovered vulnerability, CVE-2024-0762, dubbed "UEFIcanhazbufferoverflow," has recently come to light in the Phoenix SecureCore UEFI firmware, impacting various Intel Core desktop and mobile processors. The UEFIcanhazbufferoverflow vulnerability, disclosed by cybersecurity researchers, exposes a critical buffer overflow issue within the Trusted Platform Module (TPM) configuration, potentially allowing malicious actors to execute unauthorized code. Eclypsium, a firm specializing in supply chain security, identified the vulnerability through its automated binary analysis system, Eclypsium Automata. They reported that the flaw could be exploited locally to escalate privileges and gain control over the UEFI firmware during runtime. This exploitation bypasses higher-level security measures, making it particularly concerning for affected devices.

Decoding the UEFIcanhazbufferoverflow Vulnerability and its Impact

The affected Phoenix SecureCore UEFI firmware is utilized across multiple generations of Intel Core processors, including AlderLake, CoffeeLake, CometLake, IceLake, JasperLake, KabyLake, MeteorLake, RaptorLake, RocketLake, and TigerLake. Given the widespread adoption of these processors by various OEMs, the UEFIcanhazbufferoverflow vulnerability has the potential to impact a broad array of PC products in the market. According to Eclypsium researchers, the vulnerability arises due to an insecure variable handling within the TPM configuration, specifically related to the TCG2_CONFIGURATION variable. This oversight could lead to a scenario where a buffer overflow occurs, facilitating the execution of arbitrary code by an attacker. Phoenix Technologies, in response to the disclosure, promptly assigned CVE-2024-0762 to the UEFIcanhazbufferoverflow vulnerability and released patches on May 14, 2024, to mitigate the issue. The severity of the vulnerability is reflected in its CVSS score of 7.5, indicating a high-risk threat.

The Importance of UEFI Architecture Security 

In practical terms, the exploitation of UEFI firmware vulnerabilities like "UEFIcanhazbufferoverflow" highlights the critical role of firmware in device security. The UEFI architecture serves as the foundational software that initializes hardware and manages system runtime operations, making it a prime target for attackers seeking persistent access and control. This incident also highlights the challenges associated with supply chain security, where vulnerabilities in upstream components can have cascading effects across multiple vendors and products. As such, organizations are advised to leverage comprehensive scanning tools to identify affected devices and promptly apply vendor-supplied firmware updates. For enterprises relying on devices with potentially impacted firmware, proactive measures include deploying solutions to continuously monitor and assess device integrity. This approach helps mitigate risks associated with older devices and ensures ongoing protection against active exploitation of firmware-based vulnerabilities.

In the latest update of "Secure by Design”, the Cybersecurity and Infrastructure Security Agency (CISA) highlighted the critical importance of integrating security practices into basic services for software manufacturers. The paper highlights a notable concern: the imposition of an "SSO tax" where essential security features like Single Sign-On (SSO) are bundled as premium services, potentially hindering their adoption among Small and Medium-sized Businesses (SMBs).

Implementing Single Sign-On (SSO) into Small and Medium-sized Businesses (SMBs)

SSO simplifies access management by allowing users to authenticate once and gain access to multiple applications—a crucial feature for enhancing security postures across organizations. However, its adoption faces significant hurdles, primarily due to cost implications and perceived operational complexities. One of the primary challenges identified by CISA is pricing SSO capabilities as add-ons rather than including them in the base service. This "SSO tax" not only inflates costs but also creates a barrier for SMBs looking to bolster their security frameworks without incurring substantial expenses. By advocating for SSO to be a fundamental component of software packages, CISA aims to democratize access to essential security measures, positioning them as a customer right rather than a premium feature. Beyond financial considerations, the adoption of SSO is also influenced by varying perceptions among SMBs. While some view it as a critical enhancement to their security infrastructure, others question its cost-effectiveness and operational benefits. Addressing these concerns requires clearer communication on how SSO can streamline operations and improve overall security posture, thereby aligning perceived expenses with tangible returns on investment.

Improving User Experience and Support

Technical proficiency poses another hurdle. Despite vendors providing training materials, SMBs often face challenges in effectively deploying and maintaining SSO solutions. The complexity involved in integrating SSO into existing systems and the adequacy of support resources provided by vendors are critical factors influencing adoption rates. Streamlining deployment processes and enhancing support mechanisms can mitigate these challenges, making SSO more accessible and manageable for SMBs with limited technical resources. Moreover, the user experience with SSO implementation plays a pivotal role. Feedback from SMBs indicates discrepancies in the accuracy and comprehensiveness of support materials, necessitating multiple interactions with customer support—a time-consuming process for resource-constrained businesses. Simplifying user interfaces, refining support documentation, and offering responsive customer service are essential to improving the adoption experience and reducing operational friction. In light of these updates, there is a clear call to action for software manufacturers. Aligning with the principles of Secure by Design, manufacturers should integrate SSO into their core service offerings, thereby enhancing accessibility and affordability for SMBs. By addressing economic barriers, improving user interfaces, and providing robust technical support, manufacturers can foster a more conducive environment for SSO adoption among SMBs.

CISA has released the new version of the SAFECOM Guidelines. This exclusive guideline talks about the Emergency Communications Grants in cooperation with SAFECOM and NCSWIC. The new version aims to give the correct information to businesses globally. The National Council of Statewide Interoperability Coordinators (NCSWIC) and the Cybersecurity and Infrastructure Security Agency (CISA) work closely together to develop and maintain the SAFECOM Guidelines. According to the guidelines, the collaboration between the agencies goes into great detail about financial requirements, eligibility requirements, and technical requirements.

The New CISA SAFECOM Guidelines

The new SAFECOM guidelines help state, local, tribal, and territory governments secure federal money for crucial emergency communications projects is its main goal. Billy Bob Brown, Jr., Executive Assistant Director for Emergency Communications at CISA, stated: "The SAFECOM Guidance on Emergency Communications Grants is an essential resource that supports our collective efforts to strengthen the resilience and interoperability of emergency communications nationwide."  The guidance aims to provide a seamless experience to governments and agencies while also receiving new updates every year. These updates include new developments in technology and online risk management. It guarantees that grantees have access to the most recent guidelines and specifications required to construct reliable, safe, and compatible communication networks. By adhering to these standards, recipients can maximize government funding by ensuring that investments align with both national and community interests. "Incorporating SAFECOM Guidance into project planning not only enhances funding prospects but also strengthens the overall emergency response capabilities of our communities," Brown said. The document encourages stakeholders to adopt best practices in the planning, organizing, and execution of emergency communications projects to foster a uniform strategy across all governmental levels and public safety groups.

SAFECOM and Federal Agencies

Federal organizations such as the Office of Management and Budget and the Department of Homeland Security have acknowledged the SAFECOM Guidance as a vital resource since its establishment.  Grant candidates are encouraged to utilize the SAFECOM Guidance to ensure that their projects are in line with state, local, tribal, or territorial emergency communications strategies. To address the diverse needs of public safety organizations and communities, the research places a strong emphasis on the integration of new technologies, cybersecurity measures, and interoperable communication systems. Through the SAFECOM website, CISA offers resources and information on comprehending federal grant criteria to further assist stakeholders. The team is still dedicated to helping applicants create thorough plans that both satisfy funding requirements and improve emergency infrastructure's overall resilience.

A new deepfake investment scam has emerged on the internet, misusing prominent Indian figures like Asia's richest person, Mukesh Ambani, and former captain of the Indian national cricket team, Virat Kohli. These deepfake scam videos falsely depict the billionaire and cricket star endorsing betting apps, leading unsuspecting viewers into potential scams. Using advanced deepfake techniques, the video manipulates their appearances and voices to make it seem like they are endorsing the app. This deceptive tactic exploits the trust and influence these figures hold.

The Strange Case of Deepfake Scams

This deepfake investment scam also targets well-known TV journalists, manipulating footage to create a false impression of authenticity. These altered videos imply endorsements from reputable sources, exploiting public trust for illicit gains. In the video, which is widely being circulated online, Ambani is falsely quoted as saying, “Our honest app has already helped thousands of people in India earn money. There is a 95% chance of winning here.” https://www.facebook.com/watch/?v=2401849440205008 Meanwhile, Kohli is shown endorsing the app, stating, "Aviator is an investment game where you can make huge profits. For example, if you have 500 Rupees, that will be enough because when the airplane flies your stake will automatically multiply by the number that the airplane reaches. Your investment can multiply 10 times. I personally recommended this app.” Both individuals seem to be discussing the game and promising high returns, claiming minimal investments can lead to significant profits. Such false promises prey on the aspirations of viewers seeking easy financial gains, ultimately leading to financial losses for many who fall victim to these deepfake investment scams. The Cyber Express has investigated these Aviator game scams and found out most of these apps have been banned on platforms like Google Play Store and Apple App Store due to their deceptive practices. Despite this, scammers continue to circulate these apps through alternate channels, using deepfake investment scams to lend a spirit of legitimacy.

The Aviator Game Scams Leveraging Deepfake Technology 

Similar incidents involving other public figures have also come to light, including cricket legend Sachin Tendulkar. Fake videos were created to deceive the public, and Tendulkar himself spoke out against such misuse of technology. In one deepfake video, Tendulkar is depicted talking about his daughter Sara playing a particular game, falsely quoting him as saying, “I am surprised how easy it is to earn well these days." [caption id="attachment_78100" align="alignnone" width="720"] Sachin Tendulkar Deepfake Scam (Source: X)[/caption] Following this, Sachin Tendulkar himself posted a tweet explaining the deepfake investment scam behind the deepfake videos. Tendulkar tweeted, “These videos are fake. It is disturbing to see rampant misuse of technology. Request everyone to report videos, ads & apps like these in large numbers. Social Media platforms need to be alert and responsive to complaints. Swift action from their end is crucial to stopping the spread of misinformation and deepfakes.” Previously, the Indian media company The Quint decoded another instance of deepfake videos involving Mukesh Ambani's son, Anant Ambani, and Virat Kohli promoting gaming apps in viral clips circulating on social media. Concerns arose about Ambani's video due to discrepancies in lip-sync and mechanical movements, suggesting a potential deepfake. [caption id="attachment_78102" align="alignnone" width="720"] Anant Ambani Deepfake (Source: The Quint)[/caption] Investigation revealed the original context of Ambani's video related to an animal rescue program launch. Similarly, Kohli's video was traced back to a different context involving discussions on religious harmony, debunking claims of both videos promoting gaming applications as false. In all the cases combined, a single app that was heavily promoted by social media pages and deepfake videos was the Aviator game. Aviator, an online casino game developed by Spribe, has become the most controversial game on the internet. The game’s unique, “easy to make money” has been tried and tested to be too good to be true. Inside the game, players engage by flying planes to earn money, influencing outcomes through their actions—a unique feature in online gaming. The game includes bonus rounds and mini-games, accessible on desktop, mobile, and tablet platforms to reach a broad audience. However, despite its popularity, the Aviator game has garnered notoriety for its misleading promises and unfair practices. Users have reported massive financial losses after investing in what turned out to be a fraudulent scheme. Reviews and user experiences highlight consistent patterns of manipulation and rigged outcomes designed to benefit the operators at the expense of trusting players. To top it all off, these fake deepfake videos of celebrities endorsing the app adds more questions about the authenticity of the app and the intent behind this aggressive marketing strategy.  The proliferation of deepfake videos exploiting the reputations of public figures like Mukesh Ambani and Virat Kohli highlights the urgent need for stringent measures against digital deception. As consumers, vigilance and skepticism are essential in understanding an increasingly complex technological era with potential scams and misinformation.

The U.S. Army Aviation and Missile Command (AMCOM), based at Redstone Arsenal, Alabama, has been spotlighted following an alleged data breach claimed by a prolific dark web hacker. The AMCOM data breach, announced by the threat actor on June 16, 2024, but occurring in August 2023, involved the unauthorized release of critical documents related to key military aircraft. The US Army Aviation and Missile Command (AMCOM) plays a pivotal role in supporting the U.S. Army by managing the development, acquisition, and sustainment of aviation and missile systems. It ensures the operational readiness of these systems, provides logistical support and maintains the supply chain critical for defense operations.

Decoding the AMCOM Data Breach Claims

The AMCOM data leak, disclosed on BreachForums by a user known as IntelBroker, exposed detailed technical documents and images about the Boeing CH-47F Chinook and Sikorsky H-60 Black Hawk helicopters. IntelBroker, a moderator on the platform, claimed responsibility for the leak, stating, "Today, I'm releasing the U.S. Army Aviation and Missile Command data breach." The Cyber Express reached out to the U.S. Army Aviation and Missile Command to learn more about the authenticity of the AMCOM data breach. However, at the time of writing this, no official statement or response has been received, leaving the claims for the AMCOM data leak unconfirmed right now.  Moreover, the AMCOM website appears operational, suggesting the breach may have targeted specific backend systems rather than impacting public-facing services like DDoS attacks or website defacements.

IntelBroker and the Recent Exploits 

IntelBroker, a notorious threat actor known for orchestrating multiple high-profile data breaches, recently claimed responsibility for infiltrating Apple's security infrastructure. This assertion follows their previous claims of breaching organizations like Advanced Micro Devices (AMD), where sensitive data such as customer databases and source code was compromised. The cybercriminal has a track record of targeting prominent entities such as government agencies like Europol and the U.S. State Department, as well as major corporations including Barclays Bank, Facebook Marketplace, and Home Depot. In the latest incident, IntelBroker purportedly accessed the source code of three internal tools utilized by Apple: AppleConnect-SSO, Apple-HWE-Confluence-Advanced, and AppleMacroPlugin. While Apple has not confirmed the breach, reports from tech news outlets detailed claims made on BreachForums suggesting a June 2024 data breach on Apple.com facilitated by IntelBroker. The threat actor's activities highlight the ongoing challenges in cybersecurity, highlighting vulnerabilities across diverse sectors and institutions globally. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The notorious threat actor known as Intelbroker claims to have orchestrated a massive data breach of Advanced Micro Devices (AMD), a top player in the semiconductor industry. The unconfirmed AMD data breach, disclosed on the notorious BreachForums site, shared details of the intrusion, with multiple data samples shared to the dark web forum users.  Between these speculations, AMD officials released a statement that it is investigating claims of a data breach by a cybercriminal organization. "We are working closely with law enforcement officials and a third-party hosting partner to investigate the claim and the significance of the data," the chipmaker told Reuters.

Decoding the AMD Data Breach Claims by Intelbroker

Intelbroker claims the AMD data leak encompasses a vast array of sensitive information from AMD's databases. This includes detailed data on future AMD products, specification sheets, customer databases, property files, ROMs, source code, firmware, financial records, and comprehensive employee data such as user IDs, full names, job functions, phone numbers, and email addresses. [caption id="attachment_77588" align="alignnone" width="926"] Source: Dark Web[/caption] Samples of the stolen data shared by Intelbroker highlight the potential severity of the AMD data leak. Screenshots and snippets from AMD's internal systems, allegedly obtained by the threat actor, provide a glimpse into the breadth and depth of the compromised information. Such disclosures not only highlight the possible extent of the intrusion but also highlight potential vulnerabilities within AMD's cybersecurity infrastructure. The incident is not the first time AMD has faced a cybersecurity challenge. In 2022, the company was reportedly targeted by the RansomHouse hacking group, which claimed responsibility for extracting data from AMD's networks. The 2022 breach, similar to the current incident, prompted AMD to launch an extensive investigation to assess the breach's impact and fortify its defenses against cyber threats.

Intelbroker's Modus Operandi

Intelbroker, the alleged perpetrator behind the new AMD data breach, has gained notoriety for a series of high-profile cyber intrusions targeting diverse organizations. Operating as a lone actor, Intelbroker has a documented history of penetrating critical infrastructure, major tech corporations, and government contractors. The hacker's actions suggest a sophisticated approach to exploiting vulnerabilities and accessing sensitive information. In previous instances, the hacker has claimed responsibility for breaches at institutions like the Los Angeles International Airport and Acuity, a U.S. federal technology consulting firm.

Data Samples and Technical Details

The data shared by Intelbroker includes technical specifications, product details, and internal communications purportedly from AMD's secure servers. These samples, posted on breach forums, reportedly reveal intricate details about AMD's upcoming products, financial documents, and proprietary software codes. Such disclosures not only could compromise AMD's competitive advantage but also raise concerns about intellectual property theft and corporate espionage. Technical codes and alphanumeric sequences, allegedly extracted from AMD's databases, have been posted alongside screenshots on BreachForums. These snippets, though cryptic to the untrained eye, contain critical information about AMD's internal systems and operational protocols. The exposure of such technical data could pose significant risks to AMD's reputation and operational integrity.

Response and Investigation

The Cyber Express has reached out to AMD to learn more about the potential data breach. However, at the time of publication, no official statement or response has been received, leaving the claims for the AMD data leak unconfirmed for now. Moreover, the official AMD website seems to be operational at the moment and doesn’t show any immediate sign of a cyberattack. The hacker could possibly have targeted the backend of the website or the databases instead of launching a front-end assault like a DDoS or a website defacement. AMD's response strategy will likely involve comprehensive forensic analysis, collaboration with cybersecurity agencies, and the implementation of enhanced security measures to mitigate future risks.

Previous Cyber Incidents Linked to Intelbroker

Intelbroker has demonstrated massive cyber operations beyond the alleged AMD data breach, targeting multinational corporations, government entities, and prominent tech firms globally. Notable breaches attributed to Intelbroker include infiltrations at Los Angeles International Airport (LAX), compromising millions of records encompassing personal and flight details. The hacker also accessed sensitive data from U.S. federal agencies via Acuity, exposing vulnerabilities in government IT systems. Furthermore, Intelbroker claimed responsibility for a cyberattack on Shoprite, Africa's largest retailer, highlighting their widespread impact. These incidents highlight Intelbroker's skill at exploiting security vulnerabilities to extract valuable data, posing significant challenges to affected organizations and cybersecurity professionals. The motivations driving Intelbroker's cyber activities range from financial gain through selling stolen data on dark web platforms to potential geopolitical agendas aimed at disrupting critical infrastructure and corporate operations. The Cyber Express will update readers as we get more information. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

META stealer v5.0 has recently launched, heralding a new phase of advanced and heightened features for the infostealer. This latest version introduces TLS encryption between the build and the C2 panel, a significant enhancement similar to recent updates in other leading stealers like Lumma and Vidar. The update announcement (screenshot below) emphasizes several key improvements aimed at enhancing functionality and security. This includes integration with TLS encryption, ensuring secure communication channels between the build and the control panel. This upgrade highlights the malware developer's commitment to enhance the stealer's capabilities and reach. [caption id="attachment_77605" align="alignnone" width="450"] META stealer 5.0 details (source: X)[/caption]

Decoding the New META Stealer v5.0: Features and Capabilities

The new META Stealer v5.0 update introduces a new build system allowing users to generate unique builds tailored to their specific requirements. This system is supported by the introduction of "Stub token" currency, enabling users to create new Runtime stubs directly from the panel. This feature enhances flexibility and customization options for users. Another notable addition is the "Crypt build" option, enhancing security by encrypting builds to avoid detection during scans. This feature ensures that builds remain undetected at scan time, reinforcing the stealer's stealth capabilities, thus creating the perfect hindering plan for the information stealer. Additionally, the update includes improvements to the panel's security and licensing systems. The redesigned panel incorporates enhanced protection measures, while the revamped licensing system aims to reduce operational disruptions for users.

Previous META Stealer Promises and Upgrades 

The makers of META Stealer released the new update on June 17th, 2024 with a special focus on implementing a new system for generating unique stubs per user. This approach enhances individualized security and also highlights the stealer's commitment to continuous improvement and user satisfaction. Previously, in February 2023, META Stealer underwent significant updates with version 4.3. This update introduced features such as enhanced detection cleaning, the ability to create builds in multiple formats (including *.vbs and *.js), and integration with Telegram for build creation. These enhancements demonstrate META stealer's commitment to target unsuspecting victims.  META stealer continues to evolve with each update, reinforcing its position as a versatile and robust information stealer designed to meet the diverse needs of its user base while continuing targeting victims globally. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Cybersecurity researchers have uncovered a disturbing trend in malware delivery tactics involving sophisticated social engineering techniques. These methods exploit user trust and familiarity with PowerShell scripts to compromise systems.  Among these threat actors, the two highlighted, TA571 and ClearFake campaign, were seen leveraging social engineering for spreading malware. According to researchers, the threat actors associated with TA571 and the ClearFake cluster have been actively using a novel approach to infiltrate systems.  This technique involves manipulating users into copying and pasting malicious PowerShell scripts under the guise of resolving legitimate issues.

Understanding the TA571 and ClearFake Campaign 

[caption id="attachment_77553" align="alignnone" width="1402"] Example of a ClearFake attack chain. (Source: Proofpoint)[/caption] The TA571 campaign, first observed in March 2024, distributed emails containing HTML attachments that mimic legitimate Microsoft Word error messages. These messages coerce users to execute PowerShell scripts supposedly aimed at fixing document viewing issues.  Similarly, the ClearFake campaign, identified in April 2024, employs fake browser update prompts on compromised websites. These prompts instruct users to run PowerShell scripts to install what appears to be necessary security certificates, says Proofpoint. Upon interaction with the malicious prompts, users unwittingly copy PowerShell commands to their clipboard. Subsequent instructions guide them to paste and execute these commands in PowerShell terminals or via Windows Run dialog boxes. Once executed, these scripts initiate a chain of events leading to the download and execution of malware payloads such as DarkGate, Matanbuchus, and NetSupport RAT. The complexity of these attacks is compounded by their ability to evade traditional detection methods. Malicious scripts are often concealed within double-Base64 encoded HTML elements or obscured in JavaScript, making them challenging to identify and block preemptively.

Attack Variants, Evolution, and Recommendations

Since their initial observations, Proofpoint has noted the evolution of these techniques. TA571, for instance, has diversified its lures, sometimes directing victims to use the Windows Run dialog for script execution instead of PowerShell terminals. Meanwhile, Clearlake has incorporated blockchain-based techniques like "EtherHiding" to host malicious scripts, adding a layer of obfuscation. These developments highlight the critical importance of user education and better cybersecurity measures within organizations. Employees must be trained to recognize suspicious messages and actions that prompt the execution of PowerShell scripts from unknown sources. Organizations should also deploy advanced threat detection and blocking mechanisms capable of identifying malicious activities embedded within seemingly legitimate web pages or email attachments. While the TA571 and ClearFake campaigns represent distinct threat actors with varying objectives, their utilization of advanced social engineering and PowerShell exploitation techniques demands heightened vigilance from organizations worldwide. By staying informed and implementing better cybersecurity practices, businesses can better defend against these online threats.

TETRA Technologies, Inc., a diversified oil and gas services company operating through divisions including Fluids, Production Testing, Compression, and Offshore, has reportedly fallen victim to the Akira ransomware group. This TETRA Technologies cyberattack has put crucial data at risk, including personal documents like passports, birth certificates, and driver’s licenses, as well as confidential agreements and NDAs. The threat actor responsible for the attack has indicated their intention to release approximately 40GB of sensitive data. Despite these claims, TETRA Technologies has not yet issued an official statement confirming or denying the breach.

Decoding the TETRA Technologies Cyberattack Claim by Akira Ransomware

[caption id="attachment_77529" align="alignnone" width="716"] Source: Dark Web[/caption] The Cyber Express has reached out to the organization to learn more about this TETRA Technologies cyberattack. However, at the time of writing this, no official statement or response has been received, leaving the claims for the TETRA Technologies cyberattack unconfirmed. While the company’s public-facing website appears to be operational, it is speculated that the attack may have targeted internal systems or backend infrastructure rather than causing a visible disruption like a DDoS attack or website defacement. The threat actor behind this attack, Akira ransomware, has emerged as a significant threat in cybersecurity, highlighted by the Cybersecurity and Infrastructure Security Agency (CISA) warning and its widespread impact across various industries worldwide. Known for a dual extortion tactic involving data exfiltration and encryption, Akira ransomware demands ransom payments to prevent data publication on their dark website and to receive decryption keys. The group's name references a 1988 anime film, and they use specific strings like "*.akira" and "akira_readme.txt" for detection. 

TETRA Technologies Releases New Processes for Managing Cybersecurity Risks and Governance

In their recent regulatory filings, specifically the 10-K filed on 2024-02-27, TETRA Technologies detailed their cybersecurity risk management and governance processes. These include ongoing risk assessments, incident response planning, and the implementation of cybersecurity training programs for employees. The company acknowledges the persistent evolution of cyber threats and emphasizes the importance of maintaining robust defenses against potential attacks. The Vice President of Information Technology leads TETRA Technologies’ cybersecurity initiatives, supported by a comprehensive framework to assess, identify, and manage cybersecurity risks across their operations. Regular updates and enhancements to their security protocols are integral to adapting to emerging threats and complying with regulatory standards. The Board of Directors and Audit Committee of TETRA Technologies provide oversight on cybersecurity matters, receiving periodic updates on the company’s cybersecurity risk profile and incident response capabilities. Management highlighted its commitment to safeguarding sensitive information and maintaining operational continuity despite the challenges posed by cyber threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a comprehensive set of advisories to secure Industrial Control Systems (ICS) against exploitable vulnerabilities. Released today, the CISA advisories are aimed at equipping users and administrators with timely insights into prevalent security issues, vulnerabilities, and potential exploits within ICS infrastructure. The CISA advisories, 20 in all, offer in-depth technical details and mitigation strategies for identified vulnerabilities across various ICS components. CISA highlights the importance of promptly reviewing these advisories to enhance the resilience of industrial systems against online threats.

CISA Issues 20 Industrial Control Systems Advisories

One of the critical vulnerabilities highlighted is CVE-2024-33500, impacting Siemens Mendix Applications. This vulnerability, stemming from improper privilege management, presents a risk of remote exploitation. Siemens recommends immediate updates to affected versions and implementing additional mitigations to thwart potential attacks. Another significant concern involves vulnerabilities affecting Siemens SIMATIC S7-200 SMART devices. These vulnerabilities, attributed to insufficiently random values, may pave the way for denial-of-service attacks. Siemens advocates for network access restrictions and adherence to industrial security protocols to mitigate risks effectively. Additionally, Siemens TIA Administrator faces vulnerabilities due to insecure permissions in temporary file creation processes. While no known public exploits exist presently, Siemens advises users to update to the latest version and enforce stringent network security measures.

Multiple ICS Vulnerabilities Reported

The CISA advisories also shed light on vulnerabilities in Siemens SCALANCE XM-400 and XR-500 devices, Fuji Electric's Tellus Lite V-Simulator, and Rockwell Automation's FactoryTalk View SE, among others. These vulnerabilities, ranging from inadequate encryption strength to permission assignment flaws, highlights the diverse spectrum of risks facing industrial environments. Despite the absence of known public exploits targeting these vulnerabilities, CISA emphasizes the importance of proactive measures such as network segmentation, secure remote access methods, and heightened awareness of social engineering tactics. The CISA advisories also address vulnerabilities in Motorola Solutions' Vigilant License Plate Readers and Mitsubishi Electric's MELSEC-Q/L Series and Multiple Products. These vulnerabilities, discovered by security researchers, highlight the collaborative efforts needed to safeguard critical infrastructure against emerging cyber threats. As organizations navigate the complex landscape of industrial cybersecurity, the issuance of these CISA advisories serves as a crucial resource for bolstering defenses and fostering a resilient ICS ecosystem. By staying informed and implementing recommended mitigations, stakeholders can mitigate risks and uphold the integrity and reliability of critical industrial operations.

Hacktivist group 177 Members Team has claimed a cyberattack on Malaysia's leading internet service provider, Unifi TV. The Unifi TV cyberattack was posted on a dark web leak site, highlighting crucial details about the organization with links shared to confirm the intrusion. Unifi TV, a subsidiary of Telekom Malaysia Berhad, offers a range of services including internet access, VoIP, and IPTV. The threat actor claimed this attack on June 12, 2024, and took responsibility for compromising Unifi TV's systems and launching multiple Distributed Denial of Service (DDoS) attacks against the company.

177 Members Team Claims Unifi TV Cyberattack

[caption id="attachment_77209" align="alignnone" width="525"] Source: Dark Web[/caption] The cyberattack on Unifi TV was aimed at disrupting the operation of the organization and highlighted the importance of robust cybersecurity measures in safeguarding critical digital infrastructure. Despite claims by the threat actor that the Unifi TV website was down, the web pages seem to be operational at the moment and don’t show any immediate sign of the cyberattack. The impact of the cyberattack extends beyond Unifi TV, affecting not only the telecommunications industry but also posing a threat to Malaysia's digital ecosystem as a whole. With the country witnessing over 3,000 cyber attacks daily, according to Defence Minister Datuk Seri Mohamed Khaled Nordin, the cyberattacks on Malaysia highlights the growing nature of ransomware groups and hacktivist collectives targeting the nation. 

Previous Cybersecurity Incidents

While Unifi TV has yet to release an official statement regarding the cyberattack, concerns about data breaches have been previously raised. In July 2023, Telekom Malaysia issued a data breach alert to Unifi users, stating that personal information, including names, identification numbers, and contact details, may have been compromised. The company assured users that measures had been taken to contain the breach and protect customer data. In light of these incidents, cybersecurity experts emphasize the need for proactive measures to mitigate future threats. Collaborative efforts between government agencies, law enforcement, and private sector entities are crucial in addressing online threats that target Asian nations. As for the current Unifi TV cyberattack claims, this is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged attack or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Dordt University, a distinguished private Christian liberal arts college renowned for its reformed Christian perspective on education, has encountered a cybersecurity incident carried out by the BianLian ransomware group. The Dordt University data breach has listed a substantial amount of sensitive information online, leaving both the institution and its stakeholders in a state of vulnerability. The ramifications of this Dordt University data leak are profound, with a staggering revenue of $36.2 million and a data cache of approximately 3 terabytes compromised. Among the trove of exposed data are intricate financial records, personnel files, vital databases, internal and external email correspondences, incident logs, as well as comprehensive student profiles encompassing both local and international enrollees. 

Unverified Claims of Dordt University Data Breach

[caption id="attachment_77186" align="alignnone" width="1240"] Source: Dark Web[/caption] According to the threat actors, even minors' data has reportedly fallen prey to this Dordt University breach, alongside personally identifiable information (PII) and protected health records (PHI). Despite the gravity of the situation, official responses from Dordt University have yet to materialize, leaving the authenticity of the claims surrounding the Dordt University data leak in a precarious limbo.  Notably, the BianLian ransomware group seems to have targeted the database infrastructure rather than executing a frontal assault on the university's website, suggesting a meticulously orchestrated campaign targeting the institution's digital backbone.

The Rise of BianLian Ransomware Group

The BianLian ransomware group has carried out similar cyberattacks in the past and this Dordt University data leak has prompted a collaborative effort from cybersecurity agencies, including the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Cyber Security Centre (ACSC), to disseminate crucial intelligence on the modus operandi of the BianLian ransomware and data extortion group. Originating in June 2022, BianLian has brazenly targeted critical infrastructure sectors in both the United States and Australia, leveraging tactics such as exploiting valid Remote Desktop Protocol (RDP) credentials and employing open-source tools for reconnaissance and credential harvesting. The evolution of BianLian's extortion tactics, transitioning from double-extortion encryption schemes to data exfiltration-based coercion since January 2023, highlights the escalating sophistication of cyber threats faced by modern organizations. In response, FBI, CISA, and ACSC have issued a joint cybersecurity advisory, urging critical infrastructure entities and small- to medium-sized organizations to fortify their defenses against ransomware groups by implementing robust mitigation strategies outlined in the advisory. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A threat actor on a dark web forum has listed data from Truist Bank for sale following a cyberattack on the banking institution. Meanwhile, Kulicke and Soffa Industries, Inc. (K&S) is also dealing with a data breach. Reports indicate that Truist Bank client data, including sensitive information such as employee details and bank transactions, has been put up for sale on the dark web. The alleged Truist Bank data leak is attributed to a threat actor known as Sp1d3r. The data, reportedly obtained via the Snowflake breach, raises questions about the security measures in place at Truist Bank.

Truist Bank Data Breach Allegedly Goes on Sale on Dark Web

According to the threat actor’s post, the Truist Bank data breach is now selling for $1 million. The compromised data includes details of 65,000 employees, bank transactions containing names, account numbers, balances, and the source code for IVR funds transfers. [caption id="attachment_77051" align="alignnone" width="595"] Source: Dark Web[/caption] The post by the threat actor provides specific information about the data for sale and contact details for purchase. Additionally, the post includes various usernames, threads, reputation points, and contact information such as XMPP handles and email addresses associated with the threat actor. Meanwhile, Kulicke and Soffa Industries, a renowned semiconductor and electronics manufacturing company, disclosed a breach compromising millions of files. Initially detected on May 12, 2024, the breach exposed critical data, including source codes, engineering information, and personally identifiable information.

Two Cybersecurity Incidents at Once

In response to the Kulicke and Soffa data breach, K&S swiftly initiated containment measures in collaboration with cybersecurity experts and law enforcement agencies. The company's cybersecurity team worked diligently to isolate affected servers and prevent further intrusion. Despite the breach, K&S remains committed to safeguarding its systems and data integrity. In a filing with the U.S. Securities and Exchange Commission (SEC), K&S detailed its efforts to mitigate the impact of the breach. The company assured stakeholders that, as of the filing date, the incident had not materially disrupted its operations. However, investigations are ongoing to ascertain the full extent of the breach and increase the cybersecurity measures in place. The Truist Bank data breach and the Kulicke and Soffa cyber incident highlight the persistent threat of cyberattacks faced by organizations worldwide. While both entities are actively addressing the breaches, the incidents highlight a broader case of cybersecurity measures and their impact in safeguarding sensitive information and maintaining trust in the digital age. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Grand Traverse County, Michigan, finds itself at the center of a cyber crisis as authorities investigate a ransomware attack that has disrupted operations in public offices across the county and the City of Traverse City. The Grand Traverse County cyberattack began when county officials noticed "network irregularities" at 6:06 a.m. on Wednesday, prompting swift action from the IT Department and county leadership.  As a precautionary measure, both county and city offices were taken offline to assess the situation and prevent further damage.

Decoding the Grand Traverse County Cyberattack

Subsequent investigations confirmed the severity of the cyberattack on Grand Traverse County, leading officials to label it as a ransomware attack. Collaboration between Grand Traverse County, Michigan State Police, FBI, and liability providers is underway to comprehend the scope of the attack and plan a strategic response. As of now, there's no confirmation of data transfer, but a thorough investigation is ongoing to safeguard the integrity of the system. While disruptions are inevitable, emergency services such as 911, law enforcement, and fire operations remain operational, ensuring public safety amid the crisis. Nate Alger, Grand Traverse County Administrator, assured the public of swift action, stating, "Our IT Department acted promptly to isolate the incident and shut down affected networks to contain the threat. We're working closely with our partners to minimize disruptions and resolve the situation efficiently."

The Aftermath of the Cyberattack Grand Traverse County 

The impact of the cyberattack on Grand Traverse County extends to in-person customer services at county and city offices, particularly those reliant on network connectivity. Citizens are urged to postpone non-urgent in-person payments at the treasurer's offices, although online payment services remain unaffected and secure. Despite the challenges posed by the attack, the county and city websites remain accessible, hosted on separate servers to ensure uninterrupted public access to essential information and services. While the situation unfolds, authorities are deploying alternative measures and collaborative efforts to mitigate the impact and restore services promptly. Grand Traverse County remains resilient in the face of adversity, prioritizing the safety and well-being of its residents throughout the recovery process. This is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged Grand Traverse County cyberattack or any additional information from the county. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The St. Petersburg International Economic Forum (SPIEF 2024) was reportedly targeted by a siege from a prolonged cyberattack. The SPIEF 2024 cyberattack, orchestrated by the IT Army of Ukraine, unfolded over a four-day period, commencing on June 5 and culminating on June 8, 2024. This brazen act of digital aggression targeted not only the SPIEF but also its cybersecurity guardian, Solar SC, a state-owned enterprise specializing in safeguarding information assets. The modus operandi of the cyberattack on SPIEF 2024 primarily involved a barrage of Distributed Denial of Service (DDoS) assaults, with the intensity reaching a staggering 200,000 malicious requests per second. 

IT Army of Ukraine Claims SPIEF 2024 Cyberattack

[caption id="attachment_76981" align="alignnone" width="1000"] Source: Dark Web[/caption] The claim of responsibility was boldly asserted by the IT Army of Ukraine through their Telegram channel. Their message, accompanied by a tone of defiance, boasted of rattling the nerves of their adversaries, even if the anticipated "big bang" did not materialize. Meanwhile, amidst the chaos, there emerged reports of Samara students joining the ranks of cyber vigilantes, highlighting the growing complexity of cybersecurity challenges faced by nations worldwide. The impact of this SPIEF 2024 cyberattack beyond the St. Petersburg International Economic Forum itself, affecting Solar SC and its crucial role in fortifying the forum's digital infrastructure. The ramifications reverberated not only across the Russian Federation but also rippled through Europe and the UK, highlighting the interconnected nature of contemporary cyber warfare.

More Cyberattacks to Counter

In response to inquiries regarding the authenticity of these claims, Solar SC's General Director, Igor Lyapunov, reassured the public that despite the relentless onslaught, the forum's infrastructure remained resilient. The collaborative efforts of cybersecurity experts successfully repelled all attacks, safeguarding the integrity and functionality of SPIEF's digital ecosystem. However, concerns linger as to the broader implications of such cyber incursions, particularly in an era where economic forums serve as pivotal platforms for global cooperation and exchange. The sophistication and audacity demonstrated by threat actors underscore the pressing need for better cybersecurity measures and international collaboration to mitigate future risks. The Cyber Express reached out to SPIEF organizers for further insights into the incident and the authenticity of the IT Army of Ukraine's claims. As of the time of reporting, no official statement has been issued, leaving the allegations surrounding the SPIEF 2024 cyberattack unconfirmed. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A threat actor that goes by the name “enlared” surfaced on a dark web forum, offering a hacked method for online advertising: a "New Click Fraud Software for Google ADS." Priced at $700 per license, this software is promoted as an aggressive marketing tool for online fraud and taking down competitors.  The new click fraud software, according to the threat actor, had a bunch of practical features that go beyond conventional marketing practices. Specifically, the threat actor claims that the software can drain the competitor's budget and release multiple attacks.  “Tired of your competitors beating you on Google ADS? Want to level the playing field and drain their advertising budget? We have the perfect solution for you!”, reads the threat actor post. 

Understanding the New Click Fraud Software for Google Ads

The new click fraud software offers a range of features aimed at fraudsters and creating a hack in the competitive realm of online marketing. Its functionalities include location search change, allowing users to simulate clicks from different geographical areas to bypass detection algorithms used by advertising platforms.  Additionally, the software utilizes a network of proxies to generate clicks from multiple IP addresses, ensuring user anonymity. Users can also target specific ad domains and customize campaigns by selecting keywords, maximizing their campaigns' impact and relevance.

How It Operates and Pricing

The software integrates a user-friendly interface, facilitating quick setup and configuration in a matter of minutes. Users have full control over the parameters of their campaigns, from defining target locations and domains to specifying keyword targets. The results are immediate, says the threat actor, with competitors witnessing a rapid depletion of their advertising budgets as the software executes its strategy with ruthless efficiency. Additionally, the new click fraud software offers remote desktop demonstrations, providing potential buyers with a glimpse into the tool's potency before making a purchase decision. Priced at USD 700 per license, the software offers a compelling hack proposition for businesses seeking to gain an edge in the world of online advertising. Escrow payments are accepted to ensure security for both parties involved in the transaction. With its arsenal of advanced features and promise of tangible results, the new click fraud software for Google Ads represents a darker method for competing in the online advertising game. As businesses vie for visibility and market share in an increasingly competitive online sphere, this dark web tool offers a means of cheating and targeting competitors for a very cheap price.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The notorious Monti ransomware has been sold to new owners. According to the actor's latest update, "This project was bought. It was bought because it suited our goals perfectly and did not have a bad reputation." The change in ownership and a shift in focus towards Western countries highlights a new approach towards ransomware. According to recent statements, the project has been acquired, with new owners expressing their intentions to revamp its infrastructure for future endeavors. In a cryptic post on their platform, the group hinted at upcoming developments, rallying for a collaborative effort to "build the future of the USA and Europe together."

Monti Ransomware Group and Change in Ownership

[caption id="attachment_76870" align="alignnone" width="938"] Source: Dark Web[/caption] This announcement follows a string of cyberattacks perpetrated by the Monti ransomware gang. Notably, a recent incident in the South of France targeted three prominent institutions simultaneously: the Pau-Pyrénées airport, the Pau business school, and the city's digital campus. These attacks, occurring overnight from May 12 to May 13, 2024, disrupted operations and raised concerns regarding cybersecurity vulnerabilities in critical sectors. While the affected institutions scrambled to mitigate the fallout, journalists uncovered insights from the Chamber of Commerce and Industry (CCI) shedding light on the situation. Despite assurances of minimal disruption to activities, the compromised digital infrastructure left a trail of compromised data, including sensitive documents and personal information of employees and students. The modus operandi of the Monti ransomware group draws parallels to its predecessors, notably the Conti ransomware, which ceased operations in May 2022. The emergence of Monti, with its similar tactics and techniques, suggests a strategic emulation aimed at exploiting the void left by Conti's absence.

A Deeper Dive into Monti Ransomware Group

A deeper dive into the Monti ransomware incident reveals a sophisticated operation orchestrated through the exploitation of vulnerabilities like the notorious Log4Shell. The attackers infiltrated networks, encrypted user desktops, and disrupted critical server clusters, leaving organizations grappling with the aftermath. Despite its relative obscurity, the Monti ransomware group has garnered attention within the cybersecurity community. Analysts speculate that the group's emulation of Conti's strategies may stem from the leaked trove of Conti's internal data, providing a blueprint for nefarious activities. As cybersecurity threats evolve, it becomes imperative for organizations to fortify their defenses and stay vigilant against threat actors like the Monti ransomware. Collaborative efforts between cybersecurity experts and stakeholders are essential to mitigate risks and safeguard critical infrastructures from malicious actors. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A dark web hacker that goes by the name “Tombstone” has claimed and advertised multiple vulnerabilities affecting a subdomain affiliated with Google LLC. The hacker claimed these flaws on the Russian-language cybercrime forum Exploit and stressed the susceptibility of the domain to XSS-DOM and prototype pollution vulnerabilities. Screenshots shared by threat actor Tombstone showcased 'edu.google.com' as one of the allegedly impacted domains, raising concerns about potential exploits. Tombstone's post on Exploit lacked a specified price for the vulnerabilities, urging interested parties to initiate private communications for further details. The disclosed vulnerabilities pose significant risks to Google and its associated services, warranting immediate attention to mitigate potential cyber threats. "These vulnerabilities are in the software, not the source code Note that I only sell bugs with POC and full proof not exploits With a great price for long-term cooperation in other projects Exchange of Apple, FB, Meta, Microsoft banks", reads the threat actor post.

Dark Web Hacker Claims Prototype Pollution and XSS-DOM Vulnerability

[caption id="attachment_76830" align="alignnone" width="1108"] Source: Dark Web[/caption] The vulnerabilities advertised by Tombstone have direct implications for Google LLC, a prominent entity within the IT & ITES industry. Notably, domains such as google.com and edu.google.com have been identified as being at risk, primarily affecting users currently using the Google services.  The vulnerabilities disclosed by Tombstone encompass XSS-DOM and prototype pollution, both of which can serve as entry points for malicious cyber activities. XSS-DOM vulnerabilities, in particular, enable threat actors to inject client-side scripts into web pages viewed by other users, potentially leading to session hijacking, phishing attacks, malware distribution, and data theft. Prototype pollution vulnerabilities, however, involve manipulating a JavaScript object's prototype to achieve unintended behavior, often resulting in unauthorized data manipulation or code execution. The combination of these vulnerabilities within Google's subdomain highlights the critical need for robust cybersecurity measures to safeguard against potential cyberattacks.

Previous Incidents and Security Research

Prior to Tombstone's disclosure, security researcher Henry N. Caga had identified the XSS vulnerability within a Google subdomain, further emphasizing the susceptibility of Google's infrastructure to such exploits. Caga's research revealed the presence of a vulnerability within the URL associated with 'https://aihub.cloud.google.com,' prompting an in-depth investigation. Despite initial challenges in replicating the XSS pop-up, Caga's persistence ultimately led to the discovery of a double-encoded payload that triggered the vulnerability. Subsequent testing unveiled the widespread nature of the vulnerability across all URLs within the aihub.cloud.google.com domain, accentuating the severity of the issue. Following responsible disclosure protocols, Caga promptly reported the findings to Google's security team, accompanied by comprehensive documentation and proof of concept scripts. Google's swift response included an upgrade in the issue's priority and severity levels, acknowledging Caga's contributions with a reward of $4,133.70, along with a $1,000 bonus for the thoroughness of the report and proof of concept scripts. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The notorious hacker group SN Blackmeta has allegedly claimed responsibility for a cyberattack on Snapchat's infrastructure. The Snapchat cyberattack has reportedly led to disruptions in service in specific regions and the disabling of login and account creation features within the app.  In a post attributed to SN Blackmeta, the threat actor outlined their motives for the cyberattack on Snapchat, citing reasons such as their opposition to the content promoted by the social media platform, which they claim includes pornography and undermines moral values.  Additionally, the group accuses the application of supporting Israel while opposing efforts in support of Palestine. These grievances, according to SN Blackmeta, prompted them to target Snapchat as a means to "test their strength."

Decoding the Snapchat Cyberattack by SN Blackmeta 

[caption id="attachment_76796" align="alignnone" width="379"] Source: X[/caption] The claimed Snapchat cyberattack has allegedly resulted in service disruptions in certain countries and the temporary incapacitation of key features within the Snapchat application. Despite SN Blackmeta's claims, Snapchat has not yet released an official statement about the incident, leaving the details of the cyberattack unconfirmed. The Cyber Express has reached out to the company, and we are currently awaiting their response.  [caption id="attachment_76798" align="alignnone" width="372"] Source: X[/caption] Interestingly, this isn't the first time SN Blackmeta has made headlines for their cyber activities. In the past few days alone, the group has launched attacks on various targets, including the Social Security Administration (SSA) website and Microsoft's OneDrive. These attacks aim to disrupt services and hinder user access, demonstrating the group's proficiency in executing cyber warfare. The recent surge in cyberattacks by SN Blackmeta comes amidst a backdrop of escalating tensions in the digital world. Other hacktivist groups have also been active, targeting prominent organizations and government entities with coordinated attacks.

Previous Cybersecurity Challenges

The current Snapchat cyberattack is not the first time that the Snap INC-owned platform has faced cybersecurity challenges. The most recent controversy with Snapchat was reported by Vice in May 2019 wherein researchers discovered that Snapchat employees were misusing their access privileges to spy on users. This breach of trust raised concerns about user privacy and data security within the platform. Between January 2014 and February 2018, Snapchat faced a series of cybersecurity challenges. In July 2017, a phishing attack compromised over 55,000 accounts by luring users to a fake login page. The attackers then published stolen credentials, granting unauthorized access.  In February 2016, a phishing scam targeted Snapchat employees, resulting in the disclosure of payroll information. The October 2014 incident involved a third-party app hack, leaking 200,000 explicit images. Though Snapchat denied system compromise, blame was placed on the app providers.  In January 2014, a security vulnerability led to the exposure of 4.6 million user details, despite Snapchat's claim of addressing the issue promptly. As for the current Snapchat cyberattack claim, this is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged cyberattack on the social media platform or any official confirmation from Snap INC.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Microsoft has released the June 2024 Patch Tuesday updates, reinforcing security and enhancing functionality for Windows 11 and 10 users alike. Among these updates, the tech giant has also addressed 49 vulnerabilities affecting Microsoft environments and products. “Microsoft patched 49 CVEs in its June 2024 Patch Tuesday release, another sub-60 CVE release for the second month in a row. This month, Microsoft did not patch any zero-day vulnerabilities exploited in the wild. Typically, Microsoft Patch Tuesday releases skew towards being mostly remote code execution vulnerabilities," said Satnam Narang, Senior Staff Research Engineer at Tenable. For those using the Windows 11 operating systems with versions 23H2 and 22H2, the KB5039212 patch awaits in the Windows Update queue. This comprehensive Microsoft Patch Tuesday Update introduces several notable tweaks.

Microsoft Patch Tuesday Update: All the Major Developments and Fixes

With this June Microsoft Patch Tuesday update, the tech giant has introduced a slew of user-friendly updates, including the ability to generate QR codes directly from the Windows Share menu in Microsoft Edge, facilitating seamless sharing of webpages and cloud files. Enhancements to the Windows Share feature now allow users to easily email content to themselves using their linked email address from their Microsoft account, while a subtle but impactful change prevents the abrupt dismissal of the Windows Share window, requiring users to click the designated close button instead. File management is streamlined with the ability to drag files between breadcrumbs within the File Explorer address bar, simplifying the process of relocating files within the same file path. Additionally, a new "Linked devices" page in the Settings menu enables users logged in with a Microsoft account to seamlessly manage their PCs and Xbox consoles, while the Windows Backup app now integrates with Microsoft accounts, offering secure backup options for files, themes, settings, installed apps, and Wi-Fi credentials to the cloud. Microsoft has also addressed underlying issues with this June 2024 Patch Tuesday, including a fix for an issue causing the taskbar to briefly malfunction or become unresponsive, as well as resolving an issue hindering systems from resuming from hibernation post-BitLocker activation. “In 2023, remote code execution flaws accounted for over one-third (35.1%) of all CVEs patched. However, this Patch Tuesday release was dominated by elevation of privilege flaws, accounting for nearly half of the CVEs patched (49%) this month. Microsoft patched CVE-2024-30089, an elevation of privilege flaw in the Microsoft Streaming Service. Like many of the elevation of privilege flaws patched as part of Patch Tuesday, Microsoft labelled this one as “Exploitation More Likely,” said Narang. For Windows 11 users on the original iteration of the OS (21H2), the KB5039213 patch primarily focuses on bug fixes, with the added activation of the SMB over QUIC client certificate authentication feature, providing IT administrators with enhanced control over client access to SMB over QUIC servers.

Addressing 49 Vulnerabilities with Vigilance

With cyber threats looming large, Microsoft's June 2024 Patch Tuesday release stands as a protective measure against hackers and ransomware groups alike, addressing a total of 49 CVEs. Among these, one is rated critical, marking a concerted effort to shore up security defenses. Notably, there have been no reported zero-day or publicly disclosed vulnerabilities, underscoring Microsoft's proactive stance on security. Elevation of Privilege (EoP) vulnerabilities take center stage, constituting 49% of the patched vulnerabilities this month, followed closely by Remote Code Execution (RCE) at 36.7%. Several critical vulnerabilities have been identified, including CVE-2024-30080, a Remote Code Execution flaw in Microsoft Message Queuing (MSMQ) with a CVSSv3 score of 9.8, deemed highly exploitable by Microsoft. Additionally, CVE-2024-30082, CVE-2024-30087, and CVE-2024-30091 highlight the significance of patching critical components like the Win32k driver to prevent potential exploits. Similarly, attention is drawn to Windows Kernel vulnerabilities CVE-2024-30064, CVE-2024-30068, CVE-2024-30088, and CVE-2024-30099, emphasizing the necessity of comprehensive patch management. Moreover, CVE-2024-30085 highlights the varied attack vectors adversaries may exploit, necessitating swift remediation. “These types of flaws are notoriously useful for cybercriminals seeking to elevate privileges on a compromised system. When exploited in the wild as a zero-day, they are typically associated with more advanced persistent threat actors or as part of targeted attacks," said Narang. He added further, "This vulnerability was disclosed to Microsoft by the same security researcher that disclosed CVE-2023-36802, another Microsoft Streaming Service elevation of privilege flaw, which was patched in the September 2023 Patch Tuesday. Curiously, that flaw was disclosed by the researcher, but it was Microsoft themselves that noted it as being exploited in the wild. Another Microsoft Streaming Service flaw was patched this month (CVE-2024-30090), but unlike CVE-2024-30089, this one is labeled as “Exploitation Less Likely.” Concurrently, Microsoft's cessation of security updates for Windows 10 21H2 across several editions stresses the importance of timely upgrades to ensure ongoing protection against online threats.

ValleyRAT, a notorious remote access trojan (RAT) with origins traced back to early 2023, has resurfaced with a vengeance. Designed with the malicious intent to infiltrate and seize control over systems, this Chinese threat actor-backed malware continues to evolve, presenting new challenges to cybersecurity experts worldwide. According to Zscaler ThreatLabz’s research, a new campaign orchestrated by a China-based threat actor unleashed the latest iteration of ValleyRAT. This threat campaign, characterized by its multi-stage approach, utilizes various tactics to ensnare unsuspecting victims.

ValleyRAT and the Intricate Attack Chain

[caption id="attachment_76569" align="alignnone" width="1080"] Source: ValleyRAT Infection Chain[/caption] At the heart of this campaign lies ValleyRAT's intricate attack chain. It begins with an initial stage downloader leveraging an HTTP File Server (HFS) to procure essential files for subsequent stages. Employing anti-virus checks, DLL sideloading, and process injection techniques, the downloader and loader meticulously navigate through defenses, ensuring seamless execution. Understanding the intricacies of this RAT and the makers behind it, the campaign's technical analysis unveils the sophisticated mechanisms employed by ValleyRAT. From XOR and RC4 decryption to dynamic API resolving, every step is meticulously crafted to obfuscate its malicious intentions. The malicious DLLs and shellcodes deployed in subsequent stages further attest to the threat actor's ingenuity. Persistence is key for ValleyRAT's longevity on compromised systems. By manipulating autorun keys and concealing file attributes, the malware ensures its survival, ready to execute its nefarious operations at a moment's notice.

Evolution of ValleyRAT

The latest variant of ValleyRAT boasts significant enhancements. From refined device fingerprinting capabilities to revamped bot ID generation processes, the malware is more adept at blending into its environment and evading detection. Moreover, the introduction of new commands expands its arsenal, empowering threat actors with greater control over infected systems. Mitigating ValleyRAT's threat requires a multi-faceted approach. Leveraging advanced threat detection mechanisms like Zscaler Cloud Sandbox is essential. Additionally, staying vigilant and leveraging threat intelligence to identify and thwart emerging threats is paramount in safeguarding against ValleyRAT's onslaught. As ValleyRAT continues to evolve, so must our defenses. With each iteration, online threats becomes more complex, necessitating proactive measures to counter emerging threats effectively. By staying informed and leveraging cutting-edge cybersecurity solutions, organizations can fortify their defenses and mitigate the risks posed by ValleyRAT and similar threats.

Recent cyber espionage activities have illuminated the pervasive threat posed by the China-linked hacking group Mustang Panda, as it strategically targets Vietnamese entities. Analysis by Cyble Research and Intelligence Labs (CRIL) reveals the sophisticated tactics employed by the Mustang Panda Advanced Persistent Threat (APT) in infiltrating government bodies, nonprofits, and educational institutions, among others. Mustang Panda, with its roots in China, operates with alarming precision, potentially indicating state-affiliated cyberespionage efforts. The group's reach extends beyond Vietnam, targeting organizations across the U.S., Europe, and various Asian regions, including Mongolia, Myanmar, Pakistan, and more.

Researchers Unravel Mustang Panda Campaign

CRIL's scrutiny of recent attacks in Vietnam uncovers a pattern of deception, with Mustang Panda employing lures centered around tax compliance and the education sector. The campaigns exhibit a multi-layered approach, leveraging legitimate tools like forfiles.exe to execute malicious files hosted remotely. Furthermore, the group harnesses PowerShell, VBScript, and batch files to advance its operations, demonstrating a nuanced understanding of cybersecurity evasion tactics. One notable aspect of Mustang Panda's modus operandi is the ingenious embedding of partial lure documents within malicious LNK files, aimed at thwarting detection measures. By blending elements of the lure directly into the files, the hackers increase their payload's size while evading traditional security protocols. The intricacy of Mustang Panda's attacks is exemplified by its use of DLL sideloading techniques to execute malicious code on victim systems. By exploiting vulnerabilities in legitimate executables, the group establishes persistence and opens pathways for further infiltration. Recent findings also shed light on Mustang Panda's persistent activities since at least 2014, with documented engagements ranging from governmental targets to NGOs. Notably, a campaign in April 2017 targeting a U.S.-based think tank revealed distinctive tactics indicative of the group's extensive reach and operational longevity.

Mustang Panda Targets Vietnamese Organizations

In the most recent campaign observed in May 2024, Mustang Panda set its sights on Vietnamese entities with lures related to tax compliance, following a similar approach in April 2024, which targeted the education sector. Both campaigns were initiated with spam emails containing malicious attachments, showcasing the group's adaptability in exploiting topical themes to maximize success rates. Technical analysis of the May 2024 campaign unveils the group's sophisticated maneuvering, including the use of double extensions in malicious files to mask their true nature. This campaign's payload, disguised as a PDF document, conceals a series of PowerShell commands aimed at downloading and executing further malicious scripts from remote servers. DLL sideloading emerges as a recurrent theme, with Mustang Panda leveraging legitimate executables to cloak their malicious activities. By camouflaging their actions within routine system processes, the hackers minimize the risk of detection while maintaining access to compromised systems. The Mustang Panda campaigns highlight the growing threat of cybercriminals, characterized by increasingly sophisticated methodologies. By exploiting vulnerabilities in common software and leveraging social engineering techniques, the group demonstrates a formidable capacity to infiltrate and persist within targeted networks.

The Underground Team ransomware group has allegedly claimed a cyberattack on Central Securities Corporation, asserting access to a staggering 42.8 GB of sensitive data compromised, spanning decades of company history and containing a trove of confidential information. The scope of the Central Securities Corporation cyberattack is staggering, reportedly encompassing a range of data from historical reports to personal correspondence and even passports of employees and their relatives. Such a comprehensive breach not only threatens the integrity of Central Securities Corporation but also poses a significant risk to the privacy and security of its employees and stakeholders.

Underground Team Ransomware Claims Central Securities Corporation Cyberattack

[caption id="attachment_76481" align="alignnone" width="1319"] Source: Dark Web[/caption] The aftermath of the Central Securities Corporation cyberattack is evident as the company's website remains inaccessible, leaving concerned parties in the dark about the extent of the damage and the company's response. Efforts to reach out to Central Securities Corporation have been impeded by the website's downtime, exacerbating the sense of urgency surrounding the situation. The cybercriminals behind the Central Securities Corporation cyberattack have brazenly demanded nearly $3 million in ransom, further compounding the company's woes. This incident highlights the ransomware strain like the Underground Team leverages novel approaches to extort money and exploit sensitive data.

Researchers Highlight Underground Team Ransomware Group

Security experts from Cyble have previously warned of the growing prevalence of targeted attacks, where hackers tailor their strategies to infiltrate specific targets with devastating consequences. The emergence of new ransomware variants highlights the constant battle organizations face in safeguarding their digital assets against evolving threats. One such variant, the Underground Team ransomware, has caught the attention of researchers for its unique ransom note and sophisticated techniques. Offering more than just decryption services, the ransom note promises insights into network vulnerabilities and data recovery assistance, signaling a new level of sophistication in ransomware operations. Technical analysis of the ransomware reveals intricate mechanisms employed to identify and encrypt system files, demonstrating the attackers' proficiency in exploiting vulnerabilities. By selectively targeting files and directories while bypassing certain extensions and folders, the ransomware achieves its malicious objectives with alarming efficiency. As for the cyberattack on Central Securities Corporation, this is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged Central Securities Corporation cyberattack or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

INC Ransom group has targeted the building technology solutions provider, ControlNET LLC. The ControlNET cyberattack on June 10, 2024, allegedly targeted the supply chain factor of the organization and also asserted intrusion on Rockford Public Schools. ControlNET, renowned for its expertise in HVAC, lighting, video surveillance, access control, and power solutions, is now facing an alleged attack by a hacker group. In its post, the group not only infiltrated ControlNET's systems but also exposed sensitive information, including invoice details, building floor plans, email communications, and sample folders of ControlNET and their clientele.

Understanding the ControlNET Cyberattack

The ramifications of this breach extend beyond ControlNET with operations disrupted and data compromised for the organization. However, the claims for this cyberattack on ControlNET have not been verified. The hacker group’s post on the dark web shed light on their motives, citing ControlNET's alleged negligence in safeguarding customer data.  [caption id="attachment_76431" align="alignnone" width="1357"] Source: Dark Web[/caption] “This company has taken very poor care of the data entrusted to them by its customers. In the course of a successful attack, we stole a huge amount of data. We also attacked the clients of this company ROCKFORD SCHOOL. Which we have access to thanks to CONTROL NET”, reads the threat actor post.  The leaked information highlights the urgent need for enhanced cybersecurity measures, particularly in industries like construction and education, where sensitive data is at stake.

Who is the INC Ransom Hacker Group?

The Cyber Express has reached out to the organization to learn more about this ControlNET cyberattack and the authenticity of the claims made by the threat actor. However, at the time of writing this, no official statement or response has been received, leaving the claims for the cyberattack on ControlNET unverified.  Moreover, the company's website appears to be operational, suggesting that the attack may have targeted the backend infrastructure rather than the front-end interface. The threat actor in this attack, INC Ransom, is a ransomware group that emerged in August 2023, employing double and triple extortion tactics on victims, leaking data on their blog. Victims, mainly from Western countries, face threats and coercion during negotiations, with evidence packs published to pressure payment. The group's leaked blog includes light and dark UI options, a feedback box, and a Twitter link. While similar to LockBit 3.0's blog, INC Ransom does not charge for leaked data. Victims, spanning private sector businesses, a government organization, and a charity association, hail mostly from the United States and Europe, emphasizing the widespread impact of this cyber threat. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A dark web actor named "komarod” is claiming credit for a June 8 Shadow PC data breach, allegedly stealing data from the UK-based cloud service provider. The Shadow PC cybersecurity incident has raised concerns about the security of Shadow's systems and the safety of user data. The leaked database shared on an English-language cybercrime forum called Leakbase contains a staggering 545,014 records. These records encompass a range of data fields such as ID, email, first name, last name, user creation date, and billing address, all encapsulated in a JSON format.

Understanding the Shadow PC Data Breach Claims

[caption id="attachment_76271" align="alignnone" width="988"] Source: Dark Web[/caption] Shadow.tech, a cloud computing service developed by the French company Blade, has been at the forefront of innovative cloud technology, offering users the capability to run video games and other Windows software applications remotely on Windows 10 servers. This service, acquired by OVHcloud founder Octave Klaba in 2021, has garnered significant attention in the IT & ITES industry. The impact of the Shadow PC data breach extends to both Shadow.tech and its parent company, Blade. With the leak affecting users primarily in the United Kingdom and across Europe, concerns about the safety of personally identifiable information (PII) have heightened. While the cyberattack has yet to be officially confirmed by Shadow.tech or Blade, the threat actor's post on the cybercrime forum indicates a breach in the system's security defenses. The lack of an official statement or response from the organization has left the claims regarding the Shadow data breach unverified.

Previous Shadow.tech Cybersecurity Incidents

Interestingly, despite the Shadow PC data leak, the website remains operational, showing no immediate signs of a cyberattack. This suggests that the hacker group may have targeted the backend of the website, focusing on data extraction rather than launching a front-end assault such as a DDoS attack or website defacement. However, this is not the first time Shadow.tech has faced cybersecurity challenges. In a previous incident in 2023, the company experienced a similar breach where customer data was compromised due to a social engineering attack against one of its employees. Over half a million customers were potentially impacted by the breach, raising concerns about the security measures in place at Shadow. CEO Eric Sele, while acknowledging that breach, refrained from disclosing the exact number of individuals affected. Despite claims from the threat actor regarding the sale of stolen data on a cybercrime forum, the company remained tight-lipped about the specifics of the breach and its implications for customers. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The National Council of Statewide Interoperability Coordinators (NCSWIC) attempts to shed light on the significant duties and routine tasks performed by Statewide Interoperability Coordinators (SWICs). This new NCSWIC Video Series is crucial for highlighting the importance of interoperability and emergency communications in a variety of public safety circumstances. In the first episode of the NCSWIC Video Series, "What is a SWIC," members of NCSWIC talk about the vital role that SWICs play in supporting emergency response and interoperability efforts. They highlight the crucial role that SWICs play in assisting both federal and state authorities, bridging the gap between technology and policy to ensure effective communication during emergencies.

NCSWIC Video Series Highlights Inner Workings of Interoperability

https://www.youtube.com/watch?v=jQO89TxRDz0 The second video, "What are Emergency Communications?" goes into great detail about the subtleties of emergency communication systems. It highlights how important they are to first responders and why protecting the nation depends on them. The third and last video, "What is Interoperability," clarifies the difficulties associated with interacting across various systems and emphasizes the importance of teamwork regardless of the agency, level of government, or risk. The national growth of public safety communications is central to NCSWIC's purpose. NCSWIC works to improve interoperability and advance long-term emergency communications projects by encouraging coordination amongst SWICs.

The Daily Operations of SWIC and NCSWIC

SWICs, in their capacity, oversee the daily operations of their state's interoperability efforts. They coordinate projects, maintain governance structures, and spearhead the implementation of Statewide Communication Interoperability Plans (SCIP). To support public safety communications, SWICs also take part in outreach, program administration, grant coordination, and policy creation. To execute statewide interoperability programs in line with federal goals, state SWICs work with a range of stakeholders and governmental organizations. They promote cooperation throughout the emergency communications landscape, assist strategic planning, and guarantee transparency through consistent communication. As members of NCSWIC, SWICs at the national level promote interoperable communications and best practices. Serving as intermediaries between the federal government, business community, and state authorities, they plan funding campaigns and disseminate success stories to encourage the development of interoperable solutions. Through the NCSWIC Video Series, the council hopes to raise awareness of the vital role SWICs play in guaranteeing effective emergency communications. The goal of NCSWIC is to strengthen and secure the nation's public safety infrastructure by fostering cooperation and best practices.

💾

A threat actor known as spr1ngtr4p has purportedly advertised a Remote Code Execution (RCE) vulnerability affecting a subdomain of Italy's Ministry of Defence website. This RCE vulnerability was posted on June 7, 2024, on a Russian-language cybercrime forum called XSS and sheds light on the malicious intent of the threat actor.  RCE vulnerabilities, such as the one claimed by spr1ngtr4p, pose significant risks as they allow malicious actors to execute code remotely on targeted systems. The implications of such an exploit can be severe, ranging from the deployment of malware to the complete compromise of affected machines.

The RCE Vulnerability and Possible Cyberattack on the Italian Ministry of Defence

[caption id="attachment_76184" align="alignnone" width="1240"] Source: Dark Web[/caption] The affected organization, as claimed by the threat actor, is the Ministry of Defence of Italy, Ministero Difesa, highlighting the gravity of the situation. The website in question, difesa.it, falls under the purview of this governmental body, making it a matter of national security concern. With Italy being the impacted country, the ramifications extend to the wider European and UK regions, emphasizing the potential for geopolitical implications. The post by the threat actor, shared on the cybercrime forum, offers insights into the nature of the RCE vulnerability. However, it lacks substantial evidence to validate the claims made. The absence of proof raises doubts about the credibility of the assertions and necessitates a thorough investigation into the matter.

No Confirmation of Intrusion

Efforts to ascertain the authenticity of the alleged cyberattack on the Italian Ministry have been initiated, with inquiries directed towards the Ministry of Defence of Italy. As of the time of this report, official confirmation or denial from the ministry is pending, leaving the status of the Italian Ministry of Defence cyberattack unresolved. Despite the alarming nature of the disclosure, there are indications that the Ministry of Defence website remains operational and unaffected by any apparent cyber intrusion. This suggests that either the threat actor has refrained from exploiting the vulnerability or that the website's security measures have effectively thwarted any attempted attacks. Nevertheless, the potential threat posed by the RCE vulnerability cannot be understated, warranting proactive measures to mitigate risks and fortify cyber defenses. Organizations, especially those in the government and law enforcement sectors, must remain vigilant and employ robust security protocols to safeguard against emerging cyber threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Absolute Telecom Pte Ltd, a prominent telecommunications company based in Singapore, has fallen victim to an alleged cyberattack.  The Absolute Telecom data breach, allegedly on May 15, 2024, has been attributed to a hacker known as "GHOSTR," who claims to have infiltrated and compromised the company's server networks.  This Absolute Telecom data leak has resulted in the exposure of sensitive data totaling over 34GB, including internal information such as login credentials, passwords, and subscriber details.

Decoding the Absolute Telecom Data Breach Claims

[caption id="attachment_76122" align="alignnone" width="1280"] Source: Dark Web[/caption] The compromised data in this Absolute Telecom data breach encompasses a range of crucial information, including corporate records, accounting data, sales statistics, customer particulars, full credit card details, and call records. GHOSTR, in a post on a hacker forum, boasted about the successful breach and the acquisition of the extensive database belonging to Absolute Telecom Pte Ltd. Attempts to reach out to Absolute Telecom for clarification on the extent and impact of the breach have been impeded by the unavailability of their website, which is currently offline and unresponsive. This outage has hindered communication with the organization, leaving many questions unanswered regarding the security implications and measures being taken to address the breach. After the alleged cyberattack on Absolute Telecom's website, users attempting to access the site may encounter a 'took too long to respond' error message. This service disruption indicates the impact of the breach on the company's digital infrastructure, highlighting the severity of the situation and the challenges faced in restoring normalcy to their online operations.

Who is the GHOSTR Hacker Group?

GhostR, a financially driven threat actor, gained notoriety for pilfering a confidential database of 5.3 million records from World-Check. They also leaked approximately 186GB of data from a stock trading platform. GhostR's activities on Breachforums include exposing extensive data breaches affecting Thai users, and revealing personal information like full names, phone numbers, email addresses, and ID card numbers. As of now, there are no associated families linked with this actor. The cyberattack on Absolute Telecom underscores the persistent threat posed by malicious actors seeking to exploit vulnerabilities in digital infrastructure. As organizations continue to rely heavily on technology to conduct their operations, safeguarding against cyber threats remains paramount to protect sensitive data and maintain the trust of customers and stakeholders alike. This is an ongoing story and The Cyber Express will be closely monitoring the situation. We'll update this post once we have more information on the alleged Absolute Telecom data breach or any official confirmation from the organization. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A threat actor has come forward, asserting responsibility for a significant breach in the security infrastructure of HopSkipDrive, a well-known rideshare service connecting families with reliable drivers. This HopSkipDrive data breach, allegedly occurring in June 2023, has led to the unauthorized access of sensitive data belonging to the company's drivers. According to the claims made by the hackers, HopSkipDrive's network and cloud infrastructure fell victim to this breach, resulting in the exposure of detailed personal information stored within its database. This compromised data reportedly includes a trove of 60,000 folders, each containing comprehensive details about individual users, ranging from driving licenses and insurance documents to vehicle inspection records and more.

Decoding the HopSkipDrive Data Breach Claims

The threat actor has purportedly made public a staggering 500GB of sensitive information, encompassing various personal identifiers such as first and last names, email addresses, Social Security Numbers (SSNs), home addresses, zip codes, and even countries of residence.  Additionally, the leaked data from this data leak HopSkipDriveallegedly includes source code snippets, including private admin panel information, alongside driving licenses, insurance particulars, vehicle inspection records, selfie photographs, and even criminal records. In a dark web post, the threat actor claimed responsibility, stating, "We disclose all HopSkipDrive data publicly. Indeed, in June 2023, we compromised the company's network and cloud infrastructure of HopSkipDrive." The HopSkipDrive data leak post further details the nature of the compromised data, providing evidence of the breach's magnitude and the extent of information exposed.

HopSkipDrive Data Leak Investigation

Efforts to verify these claims have been met with silence from HopSkipDrive, as the organization has yet to issue an official statement or response regarding the alleged data breach. Despite this lack of confirmation, the severity of the situation cannot be overstated, with the potential implications for affected drivers and their privacy remaining a cause for concern. Interestingly, despite the reported breach, the HopSkipDrive website appears to be operational, showing no immediate signs of an attack. This suggests that the threat actor may have gained access to the data without launching a visible front-end assault, such as a Distributed Denial of Service (DDoS) attack or website defacement. As the investigation into the HopSkipDrive data breach continues, the priority lies in addressing the security vulnerabilities that allowed such unauthorized access to occur. Additionally, affected individuals must remain vigilant and take necessary precautions to safeguard their personal information against potential misuse or exploitation in the aftermath of this breach. This is an ongoing story and The Cyber Express will be closely monitoring the situation. We’ll update this post once we have more information on the alleged HopSkipDrive data leak or any official confirmation from the organization. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Guardian Analytics Inc. and Webster Bank N.A. have agreed to pay over $1.4 million to resolve claims stemming from a data breach in 2022. The Guardian Analytics and Webster Bank data breach compromised the personal information of approximately 192,000 individuals, leading to allegations of inadequate protection of sensitive customer data. The settlement, which received final approval in federal court, addresses grievances brought forward in a consolidated class action lawsuit. Plaintiffs contended that both Guardian Analytics, a provider of data analytics services to financial institutions, and Webster Bank, failed to implement sufficient measures to safeguard sensitive customer information, including names, Social Security numbers, and financial account details.

Going Back to Guardian Analytics and Webster Bank Data Breach

During the Guardian Analytics data breach, unauthorized individuals gained access to Guardian's network systems between November 27, 2022, and January 26, 2023, obtaining the personally identifiable information (PII) of plaintiffs and class members. This data breach left affected individuals vulnerable to identity theft and other forms of fraud. The plaintiffs alleged that the defendants, Guardian Analytics and Webster Bank, breached their duty to implement and maintain adequate security measures, thereby allowing the breach to occur. As a result, plaintiffs and class members suffered various damages, including a significant risk of identity theft, loss of confidentiality of their PII, and financial losses due to inadequate data security measures.

The $1.4 Million Data Breach Lawsuit

The Guardian Analytics and Webster Bank data breach settlement agreement includes provisions to reimburse affected individuals for monetary losses, covering up to $5,000 for direct financial losses and up to $250 for ordinary losses. Additionally, the agreement compensates for four hours of lost time incurred by plaintiffs dealing with the aftermath of the breach. Individual plaintiffs, including Mark S. Holden, Richard Andisio, Edward Marshall, Ann Marie Marshall, Arthur Christiani, Johnielle Dwyer, Pawel Krzykowski, and Mariola Krzynowek, represented the class action lawsuit. Each plaintiff cited damages suffered as a result of the breach, ranging from financial losses to significant time spent rectifying the situation and monitoring accounts for fraudulent activity. The settlement serves as a reminder of the importance of robust data security measures in an era where cyber threats are increasingly prevalent. Both Guardian Analytics and Webster Bank have emphasized their commitment to enhancing security protocols to prevent similar incidents in the future. The legal proceedings shed light on the grave consequences of data breaches, including prolonged periods of identity theft resolution and financial instability for affected individuals. As technology continues to evolve, businesses must prioritize cybersecurity to protect customer data and maintain trust in an increasingly digital world.

The CyRC Vulnerability Advisory has reported a critical security flaw in EmailGPT, an AI-powered email writing assistant and Google Chrome extension that streamlines your email correspondence using advanced AI technology. This EmailGPT vulnerability (CVE-2024-5184), known as prompt injection, enables malicious actors to manipulate the service, potentially leading to the compromise of sensitive data. The core of this vulnerability in EmailGPT is the exploitation of API service, which allows malicious users to inject direct prompts, thereby gaining control over the service's logic. 

Understanding the New EmailGPT Vulnerability (CVE-2024-5184)

[caption id="attachment_75572" align="alignnone" width="1920"] Source: GitHub[/caption] By coercing the AI service, attackers can force the leakage of standard system prompts or execute unauthorized prompts, paving the way for various forms of exploitation. The implications of this EmailGPT vulnerability are profound.  By submitting a malicious prompt, individuals with access to the service can extract sensitive information, initiate spam campaigns using compromised accounts, or fabricate misleading email content, contributing to disinformation campaigns. Beyond data breaches, exploiting this vulnerability could result in denial-of-service attacks and direct financial losses through repeated requests to the AI provider's API. “When engaging with EmailGPT by submitting a malicious prompt that requests harmful information, the system will respond by providing the requested data. This vulnerability can be exploited by any individual with access to the service”, reads the CyRC Vulnerability Advisory.

CyRC Advises Users to Remove EmailGPT

With a CVSS score of 6.5 (Medium), the severity of this vulnerability highlights the urgency of remedial action. Despite the efforts of CyRC to engage with EmailGPT developers through responsible disclosure practices, no response has been received within the stipulated 90-day timeline. Consequently, the “CyRC recommends removing the applications from networks immediately”. As users navigate this security challenge, staying informed about updates and patches will be paramount to ensuring continued secure service use. Given the evolving landscape of AI technology, maintaining vigilance and implementing robust security practices are imperative to thwart potential threats. The EmailGPT vulnerability, CVE-2024-5184, serves as a stark reminder of the critical importance of prioritizing security in AI-powered tools. By heeding the recommendations of the CyRC and taking proactive measures to mitigate risks, users can safeguard their data and uphold the integrity of their digital communication systems.

On June 6, 2024, a cyberattack on UAE Ministry of Education's website was claimed by a dark web actor. The threat actor, called DarkStormTeam, is a hacktivist group that supports Palestine and is infamous for carrying out similar attacks. As per the threat actor's post, the UAE Ministry of Education website allegedly targeted in a Distributed Denial of Service (DDoS) attack. The UAE Ministry of Education cyberattack, which lasted for approximately three hours on their official website, allegedly caused disruptions in online services. The DarkStormTeam published a message outlining their plan to target important government services and Emirati infrastructure. This is because UAE's allegedly support Israel, in the ongoing cyberware. The cyberattack on the Ministry of Education's website is believed to be part of their bigger campaign against groups affiliated with countries that support Israel. The Cyber Express has reached out to the UAE Ministry of Education in an attempt to obtain more information about the cyberattack. However, at the time of writing this news report, no official response was received, leaving the claims unverified.

Understanding UAE Ministry of Education Cyberattack

The UAE Ministry of Education is a crucial federal government organization that oversees all matters pertaining to education within the country. The Ministry is crucial to the growth and management of the UAE's educational system. It was established in accordance with Sheikh Zayed's Federal Law No. of 1972. This is not an isolated incident; DarkStormTeam has been aggressively launching cyberattacks against a various governmental and commercial sector institutions worldwide. In March 2024, the group turned its attention to organizations, focusing on the US, Brazil, Denmark, Egypt, France, Israel, and the United Arab Emirates, among other countries. Although their precise intentions are still unknown, they might be anything from anti-Israel bigotry to political grievances.

The Rise of DarkStormTeam Hacker Group

It's worth noting that DarkStormTeam's activities often include promoting hacking services for hire, suggesting potential financial motivations alongside their ideological objectives. This blend of ideological and potentially profit-driven motives adds complexity to their operations and highlights the challenges in addressing cyber threats posed by hacktivist groups. This is an ongoing story and The Cyber Express will be closely monitoring the situation. TCE will update this post once it receive more information on the alleged UAE Ministry of Education cyberattack or any official confirmation from the ministry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A hack on Malaysia's Railway Assets Corporation (RAC) has been reported by a dark web actor. The key entity under Malaysia's Ministry of Transport was the target of the RAC data hack. The threat actor "billy100" carried out this breach and posted its allegations on the BreachForums platform.  The RAC data breach, which was made public on a dark web forum, refers to personnel records that have been allegedly leaked and connected to the Railway Assets Corporation (RAC). There are 481 lines of documents in the compromised database, according to billy100. As evidence, the threat actor provided samples from the CSV files "users_id" and "detail," which included hashed passwords, email addresses, and usernames.

RAC Data Breach Allegedly Exposes Sensitive Information

[caption id="attachment_75309" align="alignnone" width="1445"] Source: Dark Web[/caption] Established under the Railways Act of 1991, the Railway Assets Corporation (RAC) is a federal statutory entity tasked with supporting Malaysia's railway infrastructure. Since its founding in 1992, RAC has played a significant role in bringing the nation's railway industry up to par with other leading nations. Since the corporation is in charge of managing and growing railway assets, it is very important. Sensitive employee data is purportedly hidden in the RAC data breach exposed database. Information about several aspects of personnel records is one of the disclosed details. The two main files that make up the stolen data are users_id.csv, which contains vital user information like IDs, names, emails, passwords, and more, and detail.csv, which offers additional in-depth employee information such as personal identifiers, department information, salary, and dates of birth.

Investigation and Cyberattacks on the Railway Sector

Inquiries on the RAC data loss and potential ransomware gang involvement have been made to the organization by The Cyber Express. However, as of the time of this writing, no formal response or statement had been made, so the allegations regarding the RAC data leak remain unsubstantiated.  Railroads, being essential infrastructure in the digital age, are increasingly vulnerable to cyber threats that endanger both their daily operations and public safety. Attacks on international railway networks in recent times have brought attention to the need for stronger cybersecurity protections. Vulnerabilities brought on by outdated systems, unsecured networking, and IoT devices raise the risks.  Rail operators need to prioritize asset visibility, implement strong authentication, encrypt communication networks, and keep a stockpile of up-to-date patches and upgrades to strengthen security. Ensuring that staff members receive comprehensive cybersecurity training is also essential. If transportation is to continue being reliable and secure in the future, cybersecurity must be fully integrated into railway operations. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The FBI has retrieved almost 7,000 decryption keys related to the LockBit operation, which affected thousands of businesses. After the sequence of events that resulted in the arrest of the ransomware group, the FBI is now asking LockBit victims to come forward so they can retrieve their encrypted data without worrying about facing financial or legal repercussions. At the Boston Conference on Cyber Security in 2024, Assistant Director of the FBI's Cyber Division Bryan Vorndran spoke about the LockBit operation and the strategies taken by national security agencies to oppose it.  Vorndran continued by outlining the FBI's complex plan for thwarting LockBit ransomware attacks and emphasized the importance of taking preventative measures against this ransomware gang.

"Disrupting LockBit and its affiliates became a global effort, involving FBI work with agencies from 10 other countries, particularly the British National Crime Agency, over more than three years," states Vorndran, indicating the FBI's steadfast dedication to enforcing the law online.

FBI Urges LockBit Victims to Reclaim Their Encrypted Data

The recent action taken by the FBI against the well-known ransomware-as-a-service company LockBit was a critical turning point in the disruption of criminal networks. Vorndran provided insight into the workings of LockBit, blaming its growth on the business ventures of its creator, Dimitri Khoroshev.  “Additionally, from our ongoing disruption of LockBit, we now have over 7,000 decryption keys and can help victims reclaim their data and get back online. We are reaching out to known LockBit victims and encouraging anyone who suspects they were a victim to visit our Internet Crime Complaint Center at ic3.gov”, denoted Vorndran.  Citing previous legal actions against Khoroshev and his co-conspirators for fraud, extortion, and similar offenses, Vorndran reaffirmed the FBI's commitment to bringing perpetrators accountable in an unflinching stance against cyber enemies. He reaffirmed the FBI's commitment to seeking justice and offering assistance to victims by way of programs like the recovery of LockBit decryption keys. Vorndran underlined the significance of thorough cybersecurity procedures and cooperative partnerships in protecting against malevolent activities given the ongoing evolution of cyber threats. He urged all parties involved to band together in the battle against cybercrime, stressing that it is our shared duty to strengthen digital barriers and provide a safe online environment for everybody. Vorndran reaffirmed the FBI's steadfast dedication to thwarting cyber threats and promoting cross-sector cooperation. He called on people to support the idea of group resilience, reiterating the idea that working together is essential to overcoming the ever-changing threats posed by cybercriminals.

Ransomware-as-a-service Models on the Rise

Recognizing the critical role that partnerships play, Vorndran emphasized the importance of public-private partnerships working together both nationally and internationally to effectively tackle cyber threats. He underlined the value of victim engagement, pointing out that the FBI's operations strategy relies heavily on prompt threat response and all-encompassing victim care. Vorndran's thoughts on cybercrime included a discussion on the emergence of ransomware-as-a-service models. According to these models, affiliates receive sophisticated malware in exchange for payment from criminal syndicates that resemble elements of conventional organized crime. He alerted businesses to the growing threat posed by ransomware attacks, which often combine two or three different extortion techniques, leaving victims vulnerable to both data theft and financial extortion. Vorndran emphasized the need to take preventative action, advising companies to strengthen their cybersecurity defenses and allocate resources in a way that allows for reasonable downtime. Citing cybercriminals' careful assessment of possible victims based on susceptibility, brand reputation, and economic impact, he underlined the significance of target identification.