Google has disrupted over 175,000 YouTube and Blogger instances related to the Chinese influence operation Dragonbridge.

The post Google Disrupts More China-Linked Dragonbridge Influence Operations appeared first on SecurityWeek.

Guardian: The average public library is not only a provider of the latest Anne Enright or Julia Donaldson: it is now an informal citizens advice bureau, a business development centre, a community centre and a mental health provider. It is an unofficial Sure Start centre, a homelessness shelter, a literacy and foreign language-learning centre, a calm space where tutors can help struggling kids, an asylum support provider, a citizenship and driving theory test centre, and a place to sit still all day and stare at the wall, if that is what you need to do, without anyone expecting you to buy anything.

Notorious ransomware group BianLian has claimed to have added two new organizations as its latest cyberattack victims. The BianLian ransomware attack was allegedly carried out on two US-based firms, namely, Better Business Bureau Inc and U.S. Dermatology Partners. The infamous actor has claimed to have accessed sensitive data including financial, contract, and employee profiles from both its victims.

BianLian Ransomware Attack: Critical Details  

The first organization targeted by hackers was Better Business Bureau (BBB), which is a private, nonprofit organization founded in 1912 in Arlington, Virginia. The firm maintains a massive database of accredited and non-accredited businesses, providing ratings based on several factors. The Better Business Bureau has a revenue of $430.6 Million. [caption id="attachment_79001" align="alignnone" width="1259"] Source: X[/caption] The threat actor claims to have accessed 1.2 TB of organization data, including accounting, budget, and financial data; contract data and NDAs; files from the CFO's computer; operational and business files; and email and PST archives. The group has also disclosed sensitive information such as the names, personal email addresses, and phone numbers of BBB’s CEO, vice president, chief accreditation officer, and chief activation officer. The other organization that has allegedly fallen victim to the ransomware group is US Dermatology Partners. The organization, with a revenue of $213.7 Million, is one of the premier dermatology practitioners in the USA, caring for over two million patients annually. [caption id="attachment_79002" align="alignnone" width="1259"] Source: X[/caption] The hackers claimed to have accessed 300 GB of organization data, including personal data, accounting and budget information, financial data, contract data and NDAs, and employee profiles.

Potential Impact of BianLian Ransomware Attack

If proven, the potential consequences of this ransomware attack could be critical as the accounting and financial details of both these firms could be leaked. The organizations should take appropriate measures to protect the privacy and security of the stakeholders involved. Financial data breaches can lead to identity theft, financial fraud, and a loss of trust among clients, potentially jeopardizing the company’s standing in the industry. Currently, details regarding the extent of the BianLian ransomware attack, data compromise, and the motive behind the cyber assault remain undisclosed. Despite the claims made by BianLian, the official websites of the targeted companies remain fully functional. This discrepancy has raised doubts about the authenticity of the BianLian group’s assertion. To ascertain the veracity of the claims, The Cyber Express has reached out to the officials of the affected organizations. As of the writing of this news report, no response has been received, leaving the ransomware attack claim unverified.

History of BianLian Ransomware Group Attacks

BianLian, a ransomware group, has been targeting critical infrastructure sectors in the U.S. and Australia since June 2022. They exploit RDP credentials, use open-source tools for discovery, and extort data via FTP or Rclone. FBI, CISA, and ACSC advise implementing mitigation strategies to prevent ransomware attacks. Initially employing a double-extortion model, they shifted to exfiltration-based extortion by 2023. According to a report by  BlackBerry, BianLian ransomware showcases exceptional encryption speed and is coded in the Go programming language (Golang). This sophisticated approach has enabled the group to strike multiple organizations, leaving a trail of unverified claims in its wake. Earlier in 2024, the group targeted companies such as North Star Tax and Accounting, KC Pharmaceuticals, Martinaire. In its attack on MOOver, the group claimed to have accessed a staggering 1.1 terabytes of the firm’s data. Subsequently, Northeast Spine and Sports Medicine also found themselves on the list of victims. All these claims, similar to the recent attack, remain unverified. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The infamous cybercrime marketplace BreachForums faced an awkward scenario on June 25, 2024, when a threat actor leaked unverified information about "Aegis”, one of the forum moderators. The doxxing incident of BreachForums moderator was first reported by a LinkedIn user on a cybersecurity forum named “CISO2CISO”.

BreachForums Moderator Doxxing Details

On Tuesday, Bhavesh Mohinani, an SOC analyst and a member of "CISO2CISO,"  shared screenshots of a BreachForums post by an anonymous threat actor that allegedly contained sensitive Personally Identifiable Information (PII) of BreachForums moderator "Aegis". [caption id="attachment_78802" align="alignnone" width="1069"] Source: LinkedIn[/caption] The threat actor claimed that he obtained “bits and pieces” information about Aegis through his friend. “One thing I was given was a first name and an IP. Looking into it, you find out his information is very much out there! So much OPSEC, am I right,” the TA wrote in his post. OPSEC or Operational Security, is a process that identifies seemingly innocuous actions that could inadvertently reveal critical or sensitive data to a cybercriminal. Elaborating the details of Aegis, the threat actor claimed, “Aegis is a 17-year-old Egyptian resident living with his mother. His father seems not to have been found. Aegis started off being a skid, stealing code, claiming to be harmful and so on...he is a loser. “Aegis will most likely deny this being his information but if this post gets taken down, you will know the truth/ love everyone! Expect this loser,” the TA wrote. The user also shared details claiming to be the moderator’s phone number, IP address, residential address and telegram account. [caption id="attachment_78803" align="alignnone" width="1091"] Source: LinkedIn[/caption] While there is no confirmation or credibility to the claims shared by the anonymous actor, the post was deleted as soon as it was shared. However, the post has raised concerns about the security and trustworthiness of online communities.

What is Doxxing?

Doxxing, or doxing for short, is when someone puts your personal information out there on the internet. This can include information like where you work, your home address, your credit card numbers, and other private details. Usually, the intention of the threat actor is to harass the victims. The word "doxxing" first came about in the 1990s, starting from the word "documents," which got shortened to "docs," and then finally became "dox." When people talk about "dropping dox," they mean cybercriminals revealing the true identities of their rivals, taking away their anonymity, and making them vulnerable to the authorities. A doxxing attack begins with the threat actor gathering extensive information about their target, searching online and checking social media for clues. Social media can reveal workplace details, which can be exploited for attacks. Skilled threat actors might also trace a target’s IP address to determine their location. The more data a threat actor collects, the more harm they can inflict. While some doxxing incidents are minor, like sending unwanted pizza deliveries, others can lead to severe consequences such as online harassment, swatting, identity theft, reputational damage, physical assault, job loss, or stalking. The alleged doxxing of the BreachForums moderator has raised questions about whether it would lead to the arrest of another threat actor and if it signals the decline of the forums. For example, in California, doxing is considered a serious offense, and individuals engaging in this activity could face legal consequences. Individuals arrested and charged with cyber harassment (doxing) under Penal Code §653.2 face up to one year in jail and a fine of up to $1,000. In April 2023, Hong Kong’s privacy watchdog, Office of the Privacy Commissioner for Personal Data, arrested a 27-year-old woman on suspicion of doxxing after she allegedly posted the personal details of her friend’s ex-boyfriend on social media.

Prevention Against Doxxing

To protect users against doxxing, one must use strong, unique passwords for each account and enable Multi-Factor Authentication (MFA). Cleaning the digital footprint by removing personal information from online sites, deactivating old accounts, and adjusting privacy settings is regarded as a healthy practice. Using a VPN is recommended to hide the user’s IP address and prevent location tracking. Users must also be vigilant against phishing scams by recognizing poor spelling, mismatched email addresses, and unsolicited links. Finally, avoiding oversharing personal information online and keeping social media profiles private is a healthy digital practice to enhance security. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Will a social media warning really help children’s mental health?

The variety of tactics, from fake lotteries to impersonating officials, demonstrates the broad scope of threats targeting the Paris 2024 Olympic Games.

The post Cybercrime Targeting Paris 2024 Olympic Games Gains Steam appeared first on Security Boulevard.

Read 3 remaining paragraphs | Comments

On March 8, 2024, the Canadian National Security and Intelligence Committee of Parliamentarians (NSICOP) provided Prime Minister Justin Trudeau with the Special Report on Foreign Interference in Canada's Democratic Processes and Institutions (redacted pdf). On June 3, NSICOP tabled the report in Parliament. The document alleges that while "parliamentarians were unaware they were the target of foreign interference", others have been "wittingly assisting foreign state actors," though maybe not anybody currently in Parliament.

NSICOP is a cross-party group of MPs and Senators with the highest level of security clearance, chaired by Liberal MP David J. McGuinty and with members: 3 Senators (the Honourables Patricia Duncan, Marty Klyne, and Frances Lankin) and Bloc Québécois MP Stéphane Bergeron, NDP MP Don Davies, Liberal MP Patricia Lattanzio, Conservative MPs Rob Morrison and Alex Ruff, and two Liberal MPs who ceased membership on Sept 17, 2023, Iqra Khalid and James Maloney. Some background: In 2021 and 2022, the Conservative Party blamed Chinese influence campaigns for the defeat in the 2021 federal election of as many as 9 Conservative candidates, with another 4 also targeted who weren't in competitive ridings. Media reported on a vast, orchestrated disinformation campaign by the People's Republic of China which included funding some federal candidates. At the time, CSIS said they "saw attempts at foreign interference, but not enough to have met the threshold of impacting electoral integrity". In March 2023, the Prime Minister asked the National Security and Intelligence Review Agency (NSIRA) to conduct a review. NSIRA submitted its Review of the dissemination of intelligence on People's Republic of China political foreign interference, 2018-2023 to the Prime Minister a year later on March 5, 2024 and released a declassified version April 26 (pdf). Also in March 2023, Trudeau appointed an independent special rapporteur, former governor general David Johnston, to investigate. In June 2023, opposition MPs teamed up to pass an NDP motion to remove Johnston because he recommended against holding a public inquiry. In September 2023, the Government of Canada announced a public inquiry centering on "China, Russia and other foreign states or nonstate actors" interfering in the 43rd and 44th general elections. Public hearings began in January 2024. In April 2024, media reported that the People's Republic of China allegedly clandestinely paid "threat actors" in late 2018 or early 2019, who targeted 7 Liberal Party candidates and 4 Conservative Party candidates, with some apparently willing to co-operate in foreign interference and others apparently unaware of it. Additionally, international students may have been coerced by the PRC to vote for Independent (formerly Liberal) MP Han Dong, possibly without Dong's knowledge. P. 31 of the NSICOP redacted report talks about "a CSIS assessment on the degree to which an individual was implicated in these activities" but is silent on Dong's knowledge of them. India allegedly interfered in one race for the leadership of the Conservative Party of Canada, and the People's Republic of China allegedly interfered in two. Details were redacted from the NSICOP report. Former Conservative leader Erin O'Toole believes interference played a role in his 2022 ouster as party leader. Trudeau told the inquiry that allegations that China would prefer a Liberal minority government is "very improbable," as Canada-China relations have soured due to the Huawei and Two Michaels incidents. Canada doesn't have a foreign influence registry, a tool used by the US to remove PRC "police stations" like the ones in Toronto and Vancouver. Trudeau wants to ensure such a registry not target diaspora groups. Bill C-70, dubbed the "Countering Foreign Interference Act," was introduced in early May, though universties say it could chill research partnerships. Back to the NSICOP report: The declassified, redacted version of the NSICOP Special Report mentions:

• "members of Parliament who worked to influence their colleagues on India's behalf and proactively provided confidential information to Indian officials." (p.24)
• a PRC "network had some contact with at least 11 candidates and 13 campaign staffers, some of whom appeared to be wittingly working for the PRC" (p. 26)
• "Member of Parliament wittingly provided information *** to a foreign state . . . a particularly concerning case of a then-member of Parliament maintaining a relationship with a foreign intelligence officer" (p.26)
• "an example of the PRC using intermediaries to provide funds likely to support candidates in the 2019 federal election, including two transfers of funds approximating $250,000 through a prominent community leader, a political staffer and then an Ontario member of Provincial Parliament. CSIS could not confirm that the funds reached any candidate." (pp.28-29).

Redacted are specific names. The classified version has now been read by the Prime Minister, Green Party Leader Elizabeth May, and NDP Leader Jagmeet Singh, who all have top security clearances. Conservative Leader Pierre Poilievre is refusing to go through the security clearance process to view the unredacted report, apparently so he won't be bound by the Security of Information Act. Bloc Québécois MP Jean-Denis Garon Mirabel said in debate that, "Agreeing to this security briefing means getting the information and the names. However, those who obtain the names are not allowed to disclose them, not allowed to talk about it and not allowed to act on this information. We are effectively being shut down." May said she was "vastly relieved" not to see disloyalty from current MPs, while Singh called those involved "traitors to the country," though he wouldn't confirm if he was referring to serving MPs, and slammed Trudeau for being "slow to act" and Conservative Party Leader Pierre Poilievre for ignoring claims of foreign interference within his party. Singh said the report named him as a target of interference, and that no NDP MPs are participants. Conservatives are calling for the names to be released but Public Safety Minister Dominic LeBlanc says that, in some cases, allegations are based on "uncorroborated or unverified" intelligence information. NSICOP chair McGuinty says the committee has revealed as much as they can without breaching the Security of Information Act, and it's the RCMP's responsibility to investigate the allegations. The Foreign Interference Commission public hearings will resume this autumn.

Casey Newton & Zoe Schiffer report that The Stanford Internet Observatory is being dismantled. The Observatory "was created to learn about the abuse of the internet in real time, to develop a novel curriculum on trust and safety that is a first in computer science, and to translate our research discoveries into training and policy innovations for the public good."

SIO and its researchers have been sued three times by conservative groups alleging that its researchers colluded illegally with the federal government to censor speech, forcing Stanford to spend millions of dollars to defend its staff and students.

Stanford denies that the Observatory is being shut down. This is in the context of GOP attacks on fact-checking (gift link), and making it increasingly obvious that they are taking direction from Putin.

Christopher Blair, a renowned “liberal troll” who posts falsehoods to Facebook, is having a banner year despite crackdowns by Facebook and growing competition from A.I.

© Greta Rybus for The New York Times

The federal team investigating the Titan disaster found that a detailed recounting of the craft’s descent was “made up.”

© IMAGO/OceanGate Expeditions, via Alamy

BNN Breaking had millions of readers, an international team of journalists and a publishing deal with Microsoft. But it was full of error-ridden content.

© Valentin Tkach

Read 7 remaining paragraphs | Comments

Read 26 remaining paragraphs | Comments

Israel’s Ministry of Diaspora Affairs ordered the operation, which used fake social media accounts urging U.S. lawmakers to fund Israel’s military, according to officials and documents about the effort.

© Gabriela Bhaskar for The New York Times, Kenny Holston/The New York Times

Google appears to have turned off its new A.I. Overviews for a number of searches as it works to minimize errors.

© Jeff Chiu/Associated Press

It was the latest example of journalists having to weigh the news value of a major political moment against the challenges of reporting on a candidate who regularly speaks in falsehoods.

© Doug Mills/The New York Times

A study found that hundreds of sites, many without obvious Kremlin links, copied Russian propaganda and spread it to unsuspecting audiences ahead of the E.U. election.

© Misha Friedman/Getty Images

Iran and an Israeli company also exploited the tools in online influence efforts, but none gained much traction, an OpenAI report said.

© Jason Henry for The New York Times

In 2016, Russia used an army of trolls to interfere in the U.S. presidential election. This year, an American given asylum in Moscow may be accomplishing much the same thing all by himself.

© Alexander Zemlianichenko/Associated Press

The company’s latest A.I. search feature has erroneously told users to eat glue and rocks, provoking a backlash among users.

© Jeff Chiu/Associated Press

Negotiators plan to ask for more time. Among the sticking points are equitable access to vaccines and financing to set up surveillance systems.

© Denis Balibouse/Reuters

The platform will keep state-affiliated media accounts out of users’ feeds if they “attempt to reach communities outside their home country on current global events and affairs.”

© Jon Nazca/Reuters

The island democracy was early to ban TikTok on government phones, and the ruling party refuses to use it. But a U.S.-style ban is not under consideration.

© An Rong Xu for The New York Times

The prominent A.I. start-up is also joining an industrywide effort to spot content made with artificial intelligence.

© Jim Wilson/The New York Times

America’s adversaries have mounted online campaigns to amplify the social and political conflicts over Gaza flaring at universities, researchers say.

© Amir Hamja/The New York Times

The inquiry is intended to pressure the tech giant to more aggressively police Facebook and Instagram ahead of the European Union’s closely watched elections in June.

© Frederick Florin/Agence France-Presse — Getty Images

A high school athletic director in the Baltimore area was arrested after he used A.I., the police said, to make a racist and antisemitic audio clip.

© Kim Hairston/The Baltimore Sun

For years, federal lawmakers have tried to pass legislation to rein in the tech giants. The TikTok law was their first success.

© Haiyun Jiang for The New York Times

This week on the Lock and Code podcast…

A disappointing meal at a restaurant. An ugly breakup between two partners. A popular TV show that kills off a beloved, main character.

In a perfect world, these are irritations and moments of vulnerability. But online today, these same events can sometimes be the catalyst for hate. That disappointing meal can produce a frighteningly invasive Yelp review that exposes a restaurant owner’s home address for all to see. That ugly breakup can lead to an abusive ex posting a video of revenge porn. And even a movie or videogame can enrage some individuals into such a fury that they begin sending death threats to the actors and cast mates involved.

Online hate and harassment campaigns are well-known and widely studied. Sadly, they’re also becoming more frequent.

In 2023, the Anti-Defamation League revealed that 52% of American adults reported being harassed online at least some time in their life—the highest rate ever recorded by the organization and a dramatic climb from the 40% who responded similarly just one year earlier. When asking teens about recent harm, 51% said they’d suffered from online harassment in strictly the 12 months prior to taking the survey itself—a radical 15% increase from what teens said the year prior.

The proposed solutions, so far, have been difficult to implement.

Social media platforms often deflect blame—and are frequently shielded from legal liability—and many efforts to moderate and remove hateful content have either been slow or entirely absent in the past. Popular accounts with millions of followers will, without explicitly inciting violence, sometimes draw undue attention to everyday people. And the increasing need to have an online presence for teens—even classwork is done online now—makes it near impossible to simply “log off.”

Today, on the Lock and Code podcast with host David Ruiz, we speak with Tall Poppy CEO and co-founder Leigh Honeywell, about the evolution of online hate, personal defense strategies that mirror many of the best practices in cybersecurity, and the modern risks of accidentally becoming viral in a world with little privacy.

“It’s not just that your content can go viral, it’s that when your content goes viral, five people might be motivated enough to call in a fake bomb threat at your house.”

Leigh Honeywell, CEO and co-founder of Tall Poppy

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

---

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

A weekly email from Yotam Ottolenghi, Meera Sodha, Felicity Cloake and Rachel Roddy, featuring the latest recipes and seasonal eating ideas

Each week we’ll send you an exclusive newsletter from our star food writers. We’ll also send you the latest recipes from Yotam Ottolenghi, Nigel Slater, Meera Sodha and all our star cooks, stand-out food features and seasonal eating inspiration, plus restaurant reviews from Grace Dent and Jay Rayner.

Sign up below to start receiving the best of our culinary journalism in one mouth-watering weekly email.

Continue reading...

💾

© Composite: The Guardian

💾

© Composite: The Guardian

Be the first to see our latest thought-provoking films, bringing you bold and original storytelling from around the world

Discover the stories behind our latest short films, learn more about our international film-makers, and join us for exclusive documentary events. We’ll also share a selection of our favourite films, from our archives and from further afield, for you to enjoy. Sign up below.

Can’t wait for the next newsletter? Start exploring our archive now.

Continue reading...

💾

© Illustration: Guardian Design

💾

© Illustration: Guardian Design