Spain Arrests Hackers in Crackdown on Major Criminal Organization

Spanish authorities this week announced the arrest of 40 individuals for their roles in a criminal organization that performed bank fraud, document forgery, identity theft, and money laundering.

Two of the individuals, the authorities say, were in charge of carrying out online bank fraud, while 15 others were involved in other illegal activities.

Called ‘Trinitarians’, the criminal organization employed phishing and smishing (SMS phishing) to distribute malicious links that took unsuspecting victims to fake bank login pages where they were prompted to enter their credentials.

Using hacking tools purchased from cybercriminals, the gang monitored in real time the credentials their victims entered on the fake pages. They used the obtained login information to access the victims’ real accounts and request loans or link the victim’s cards to virtual wallets on attacker-controlled phones.

The gang also bought cryptocurrency coupons that were then exchanged in a wallet functioning as a ‘common box’ for the organization, and contracted point-of-sale (PoS) devices in the name of fake companies to make false purchases.

According to the authorities, the group also relied on an extensive network of money mules that received money transfers to their accounts and withdrew cash at ATMs.

Some of the proceeds were sent to bank accounts abroad and used to purchase real estate in the Dominican Republic, the Spanish authorities say.

Advertisement. Scroll to continue reading.

The gang raked in more than €700,000 (~$760,000) from the schemes and used proceeds to pay for lawyer fees for gang members in prison, buy drugs to resell, and acquire weapons.

During the takedown operation, the Spanish police made 13 house searches in Madrid, Guadalajara, and Seville, and seized computer equipment, lock picks and other instruments for opening doors, padlocks, cash, and documents describing the group’s structure.

https://www.securityweek.com/spain-arrests-hackers-in-crackdown-on-major-criminal-organization/

Former Ubiquiti Employee Who Posed as Hacker Sentenced to Prison

Nickolas Sharp, the former Ubiquiti employee who posed as a hacker and attempted to extort nearly $2 million from the company, has been sentenced to six years in prison.

In addition to the prison sentence, Sharp will be under supervised release for three years and will have to pay more than $1.5 million in restitution.

Sharp was employed by the US-based communications and IoT device maker between August 2018 and April 2021.

According to authorities, in December 2020, he abused his access to Ubiquiti systems to download gigabytes of confidential information while interviewing for another company.

The next month, while part of a team tasked with responding to the incident, the man sent a ransom note to the company, claiming to be a hacker who had breached the company’s systems.

He instructed Ubiquiti to pay 50 bitcoin (at the time worth roughly $1.9 million) to prevent the data from getting leaked. The company refused to pay up and Sharp made public some of the stolen files.

In the meantime, the FBI traced the hacking activities back to Sharp and executed a search warrant at his residence in Portland, Oregon. During the search, which resulted in several devices being seized, the man lied to agents.

Advertisement. Scroll to continue reading.

Days after, Sharp, claiming to be a whistleblower working for Ubiquiti, contacted investigative journalist Brian Krebs and provided false information, claiming that a hacker had gained root administrator access to Ubiquiti’s AWS accounts. This led to the publication of several news articles, which resulted in Ubiquiti’s shares falling roughly 20%, representing losses of more than $4 billion.

Charges against Sharp were announced in late 2021 and he pleaded guilty in February 2023.

It’s worth noting that Ubiquity is not actually named in the indictment or the press releases published by the DoJ throughout this case.

“Nickolas Sharp was paid close to a quarter million dollars a year to help keep his employer safe,” said Damian Williams, the US Attorney for the Southern District of New York.

“He abused that trust by stealing a massive amount of sensitive data, attempting to implicate innocent employees in his attack, extorting his employer for ransom, obstructing law enforcement, and spreading false news stories that harmed the company and anyone who invested into the company. Sharp now faces serious penalties for his callous crimes,” Williams added,

https://www.securityweek.com/former-ubiquiti-employee-who-posed-as-hacker-sentenced-to-prison/

ECCC, apre il centro di competenze cyber dell’Ue. R. Viola (DG Connect): “La cybersicurezza la chiave per garantire una Europa digitale”

Prende ufficialmente il via il centro europeo di competenza in materia di cibersicurezza (ECCC), il centro con cui l’Unione mira a sostenere l’innovazione e la politica industriale in materia di cibersicurezza, nonché a sviluppare e coordinare i progetti di sicurezza informatica dell’UE. Oggi è stata inaugurata la sua nuova sede a Bucarest, in Romania, presso il Campus Building dell’Università Politecnica.

Il Centro mira ad aumentare le capacità, l’innovazione e la competitività della sicurezza informatica in Europa, lavorando con una rete di Centri di coordinamento nazionali (NCC) e la comunità della sicurezza informatica in tutta l’UE. L’ECCC decide sui finanziamenti dell’UE per la sicurezza informatica nell’ambito dei programmi di lavoro DIGITAL Europe e Orizzonte Europa e gestisce progetti, riunendo risorse dall’UE, dagli Stati membri e da altri attori. Il centro ha recentemente adottato un’agenda per gli investimenti strategici sulla sicurezza informatica e aprirà presto nuovi bandi per i progetti dell’UE sulla sicurezza informatica.

Roberto Viola: “La cybersicurezza è la chiave per garantire una Europa digitale”

“Il Centro di Competenza Europeo per la Cybersecurity (ECCC) garantirà il funzionamento del Cyber Shield a livello dell’UE”, ha affermato Roberto Viola, Direttore Generale del Dipartimento della Commissione Europea per le Reti di Comunicazione, i Contenuti e la Tecnologia (DG CNECT).

“È stato un lungo percorso, inaugurato più di quattro anni fa durante la Presidenza rumena del Consiglio dell’Unione europea, ha detto Viola. “Il sentimento di instabilità che stiamo affrontando solleva la questione di quanto siamo adeguati e preparati di fronte a queste sfide di sicurezza. Per questo motivo, in queste circostanze, la proposta della Commissione è stata quella di creare una rete di cooperazione tra i centri, fornendo uno scudo di sicurezza che continui a monitorare l’ambiente, al fine di identificare quelle debolezze in modo che possiamo, in qualsiasi momento, identificare e combattere un attacco, se si verifica, per proteggere i nostri beni e i cittadini. Il Centro europeo guiderà questo sviluppo. È uno sforzo che comporterà miliardi di euro di finanziamenti. Il Centro sarà responsabile dell’acquisizione, dell’operatività e della rete di questi centri operativi individuali, ha aggiunto il Dg.

Europe goes digital & #cybersecurity is key.

Cyber threats know no borders. The @Cybersec_ECCC will step up cybersecurity in EU. It will be EU excellence, an example of fostering the best EU talents & technologies.

It took time, was a dream & now is a reality!
On #EuropeDay 🇪🇺! pic.twitter.com/804aX8kDPY

— Roberto Viola (@ViolaRoberto) May 9, 2023

“Il centro garantirà che questo scudo di protezione cibernetica funzioni in tutta Europa, e non si tratta solo di avere centri operativi, ma anche di avere squadre di intervento tecnico rapido che possono intervenire ovunque in Europa, che possono rilevare e proteggere durante un attacco cibernetico, analizzarlo e quindi, sulla base delle conclusioni, migliorare i nostri sistemi, capire cosa è stato fatto, dove sono stati commessi errori e come le cose possono essere migliorate per il futuro. La creazione di questa squadra di esperti in grado di reagire rapidamente farà parte della missione del centro, lavorando con esperti provenienti da tutta Europa. Questo campus, ha concluso Viola, diventerà un punto di riferimento per la cybersecurity non solo a livello europeo ma anche a livello globale, perché l’Europa è un pilastro di stabilità a livello globale dal punto di vista della cybersecurity”.

https://www.key4biz.it/eccc-apre-il-centro-di-competenze-cyber-dellue-roberto-viola-dg-connect-la-cybersicurezza-e-la-chiave-per-garantire-una-europa-digitale/445421/

US Announces Takedown of Card-Checking Service, Charges Against Russian Operator

The US Department of Justice this week announced the takedown of card-checking platform ‘Try2Check’ and charges against its Russian administrator.

The individual, Denis Gennadievich Kulkov, 43, created the platform in 2005 and operated it until the takedown. The US is offering a $10 million reward for information leading to his capture.

According to the indictment (PDF), Try2Check was created as a service for cybercriminals who sold and purchased stolen credit cards in bulk, allowing them to check whether the cards were valid and active. Cybercriminals then used the results to advertise the valid credit card numbers they had for sale.

Authorities estimate that the platform was processing tens of millions of card numbers on a yearly basis, enabling the illicit credit card trade through major card shops. The platform charged $0.20 per check, in Bitcoin.

Also known as Try2Services, Try2Check relied on unauthorized access to a US-based payment processing company’s servers to perform the checks, the indictment alleges.

The US took the card-checking platform’s websites offline this week, working together with German and Austrian authorities.

According to the indictment, Kulkov made over $18 million in Bitcoin, which he used to purchase luxury items, including a Ferrari. However, it is unclear how much he made from the scheme, as he also received proceeds through other payment systems.

Advertisement. Scroll to continue reading.

Kulkov was charged with access device fraud, computer intrusion, and money laundering. If found guilty, he faces up to 20 years in prison.

https://www.securityweek.com/us-announces-takedown-of-card-checking-service-charges-against-russian-operator/

FIN7 Hackers Caught Exploiting Recent Veeam Vulnerability

Russian cybercrime group FIN7 has been observed exploiting unpatched Veeam Backup & Replication instances in recent attacks, cybersecurity company WithSecure reports.

Around since at least 2015 and also referred to as Anunak, and Carbanak, FIN7 is a financially motivated group mainly focused on credit card information theft. Security researchers believe there are numerous sub-groups operating under the FIN7 umbrella.

Over the past years, some of the threat actors overlapping with FIN7 operations were seen transitioning to ransomware, including REvil, DarkSide, BlackMatter, Alphv, and Black Basta.

At the end of March 2023, WithSecure caught FIN7 attacks that exploited internet-facing servers running Veeam Backup & Replication software to execute payloads on the compromised environment.

The cybersecurity firm observed a Veeam Backup process executing a shell command to download and execute a PowerShell script that turned out to be the Powertrash in-memory dropper known to be used by FIN7.

The dropper was used to drop Diceloader, a backdoor also known as Lizar, which enables attackers to perform various post-exploitation operations, and which has been linked to FIN7 before.

“The exact method used by the threat actor to invoke the initial shell commands remains unknown but was likely achieved through a recently patched Veeam Backup & Replication vulnerability, CVE-2023-27532, which can provide unauthenticated access to a Veeam Backup & Replication instance,” WithSecure says.

CVE-2023-27532 (CVSS score of 7.5) was disclosed and patched in early March. Roughly two weeks later, proof-of-concept (PoC) exploitation code targeting the vulnerability was released publicly.

According to Veeam, successful exploitation of the bug allows an attacker to obtain encrypted credentials that are stored in the configuration database. However, penetration testing firm Horizon3.ai, which released the PoC, says that the flaw allows attackers to obtain cleartext credentials.

As part of the observed FIN7 attacks, WithSecure identified suspicious activity targeting the exploited Veeam backup instances days before payloads were dropped, likely to probe and identify vulnerable servers.

The threat actor was seen performing network reconnaissance, stealing information from the Veeam backup database, exfiltrating stored credentials, achieving persistence for the Diceloader backdoor, and moving laterally using the stolen credentials.

“WithSecure Intelligence has so far identified two instances of such attacks conducted by FIN7. As the initial activity across both instances were initiated from the same public IP address on the same day, it is likely that these incidents were part of a larger campaign. However, given the probable rarity of Veeam backup servers with TCP port 9401 publicly exposed, we believe the scope of this attack is limited,” WithSecure notes.

CVE-2023-27532 was addressed with the release of Veeam Backup & Replication versions 12 (build 12.0.0.1420 P20230223) and 11a (build 11.0.1.1261 P20230227), which organizations need to install on the Veeam Backup & Replication server.

Vulnerabilities in Veeam’s product have been exploited in previous attacks and organizations are advised to update their Backup & Replication instances as soon as possible.

https://www.securityweek.com/fin7-hackers-caught-exploiting-recent-veeam-vulnerability/

International cooperation on cybercrime and electronic evidence: New tools, old debates?

In February 2022, the United Nations launched the negotiation of a “Comprehensive International Convention on Countering the Use of Information and Communications Technologies for Criminal Purposes”, a process that had been initiated by the Russian Federation. The treaty is scheduled to be finalized by January 2024.

In May 2022, the Council of Europe opened for signature the Second Additional Protocol to the Budapest Convention on Cybercrime on enhanced cooperation and disclosure of electronic evidence.

This presentation will provide an update on UN treaty process and how it relates to the framework of the Budapest Convention.

Intervento a cura di: Alexander Seger, Head of Cybercrime Division, Council of Europe

La partecipazione all’evento è gratuita previa registrazione online al seguente link:
https://www.ictsecuritymagazine.com/eventi/cybercrimeconference2023

I posti sono limitati, potrà partecipare alla conferenza esclusivamente chi ha ricevuto il biglietto di ingresso a seguito dell’iscrizione.

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/notizie/international-cooperation-on-cybercrime-and-electronic-evidence-new-tools-old-debates/

Ukraine in cyberspace, 1 year after

Russian war in Ukraine is the first example of a full-scale cyber war. A dramatic increase in the number of cyberattacks and critical cyber incidents was observed in Ukraine in 2022 compared to previous years. Most of the attacks were targeted at state entities and critical infrastructure and were conducted by the special services of the russian federation, particularly the FSB and GRU APT groups. The goal of the attacks was to destroy Ukraine and cause maximum suffering to its people. No other country in the whole world has faced such massive attacks aimed at wiping out IT infrastructure. Various types of attacks were performed, including DDoS, website defacing, data theft, and the use of wipers. The cyberattacks were combined with psychological information operations and were often accompanied by kinetic attacks. However, despite the ongoing cyber aggression, Ukraine has developed protocols, algorithms, techniques, and tools to counter cyberattacks and has successfully learned to use them even under constant missile shelling and cyber pressure.

Intervento a cura di: Ivan Kalabashkin, Deputy Head of the Directorate, Security Service of Ukraine

La partecipazione all’evento è gratuita previa registrazione online al seguente link:
https://www.ictsecuritymagazine.com/eventi/cybercrimeconference2023

I posti sono limitati, potrà partecipare alla conferenza esclusivamente chi ha ricevuto il biglietto di ingresso a seguito dell’iscrizione.

Condividi sui Social Network:

https://www.ictsecuritymagazine.com/notizie/ukraine-in-cyberspace-1-year-after/

Russian Man Who Laundered Money for Ryuk Ransomware Gang Sentenced

Denis Mihaqlovic Dubnikov, the Russian national who recently pleaded guilty to charges related to laundering money for the Ryuk ransomware group, has been sentenced to time served.

Authorities said Dubnikov laundered money for the cybercrime gang between 2018 and August 2021. He was arrested in the Netherlands in November 2021 and extradited to the United States in August 2022. In February 2023, he pleaded guilty to one count of conspiracy to commit money laundering.

According to the Justice Department, Dubnikov on one occasion laundered $400,000 worth of cryptocurrency obtained by the ransomware group from a victim in the United States.

The 30-year-old Russian national and other members of the conspiracy allegedly laundered a total of at least $70 million in ransom proceeds.

For the charges brought against him, the man faced 20 years in federal prison, three years of supervised release, and a fine of up to $500,000. However, he has been sentenced to time served and ordered to pay $2,000 in restitution.

The Ryuk ransomware emerged in 2018 and it was one of the most active operations, until it was gradually replaced by Conti over the course of 2020 and 2021. In early 2021, researchers estimated that the Ryuk criminal enterprise had been worth $150 million.

https://www.securityweek.com/russian-man-who-laundered-money-for-ryuk-ransomware-gang-sentenced/

L’FBI avverte: attenzione alle porte USB pubbliche, rischio malware

Le prese pubbliche per la ricarica via USB possono essere usate per iniettare virus, malware e software spia nei telefoni.

L’allarme è stato lanciato dall’FBI la settimana scorsa per avvisare gli utenti di evitare le porte USB pubbliche attraverso l’account Twitter dell’FBI di Denver. L’Agenzia federale statunitense ha spiegato che le stazioni di ricarica pubbliche presenti in hotel, aeroporti e centri commerciali possono semplificare il lavoro degli hacker per diffondere malware e software spia sui dispositivi.

Avoid using free charging stations in airports, hotels or shopping centers. Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices. Carry your own charger and USB cord and use an electrical outlet instead. pic.twitter.com/9T62SYen9T

— FBI Denver (@FBIDenver) April 6, 2023

USB pubbliche, l’FBI inviata ad usate i vostri cavi e il proprio caricabatterie

L’FBI ha consigliato agli utenti di portare con sé il proprio caricabatterie e il proprio cavo USB. In questo modo, gli utenti possono usare una presa elettrica invece di una porta USB pubblica per ricaricare i propri dispositivi.

In tutti i casi l’FBI suggerisce di evitare la ricarica da sistemi che non sono di nostra proprietà, evidenziando non poche insidie, spiegando che cybercriminali potrebbero sfruttare le prese USB pubbliche per diffondere malware e infettare smartphone di ignari utenti.

Come è facile immaginare, se in qualche modo i malintenzionati riescono a “iniettare” nel dispositivo un malware, da quest’ultimo potrebbe essere possibile ottenere password e vari dati sensibili. La ricarica usando sistemi di terze parti presenti in determinati luoghi deve essere solo una soluzione di emergenza (es. vi serve il biglietto dell’aereo che state per prendere, il documento si trova solo sul telefono e quest’ultimo è scarico).

Sul suo sito web, l’FBI ha anche un avvertimento simile riguardo all’uso delle stazioni di ricarica gratuite. Inoltre, l’FBI raccomanda di non usare il Wi-Fi pubblico per transazioni sensibili, di non aprire documenti sospetti, di non usare la stessa password per tutti gli account e di non cliccare su link indesiderati nei messaggi di testo e nelle e-mail.

https://www.key4biz.it/lfbi-avverte-attenzione-alle-porte-usb-pubbliche-rischio-malware/442318/

Moige, il 12 aprile a Milano la prima tappa del Tour sui rischi informatici e cyberbullismo

Partirà da Milano, e, più precisamente, dalla scuola secondaria I Grado Cassinis, il tour in Lombardia di “Giovani Ambasciatori per la cittadinanza digitale contro cyberbullismo e cyber risk”. Alle 8:00 di mercoledì 12 aprile arriverà presso l’istituto il centro mobile del MOIGE. Saranno 12 le tappe in Lombardia della campagna che promuove un uso sicuro della rete e mira a contrastare il bullismo, aumentato del 10%, e il cyber bullismo, cresciuto dell’8%.

Dalle 8 alle 13 si terranno cinque sessioni formative di 50 minuti su queste tematiche tenute da Chiara Biancacci e Marta Barraco, due psicologhe della task force anti bullismo del MOIGE.

Nel pomeriggio, il centro mobile e gli esperti MOIGE resteranno nel cortile dell’Istituto scolastico a disposizione di studenti, docenti, ma anche di tutti i cittadini, per rispondere a domande e offrire sostegno e consigli. Dalle 15:00 alle 16:00 si terrà un intervento diretto ai genitoripresso la scuola, per informarli su come aiutare i propri figli ad usare internet in sicurezza, e sensibilizzarli su bullismo e cyber bullismo, insegnando loro a percepire anche i piccoli campanelli di allarme nei minori, sia che si tratti di vittime, sia di bulli.

Secondo l’ultimo studio condotto dal MOIGE in collaborazione con l’Istituto Piepoli, più della metà dei minori in Italia (54%) ha subito prepotenze sul web o di persona. Si tratta di un dato cresciuto di ben il 10% in soli 2 anni. Il 10% dei minori (+3%) ha preso parte ad episodi di prepotenza, il 6% ha usato foto o video per offendere altre persone, e il 53% (+15% rispetto al 2020) prende abitualmente in giro uno o più amici, dicendo che, però, lui/loro sanno che lo fa per scherzare. Alla domanda su come si comportano i compagni quando assistono a prepotenze, solo il 34% risponde “aiutano la vittima”, un dato che nel 2020 era il 44%.

Comportamenti incauti,ma anche forti responsabilità dei social, che portano a valutare in modo superficiale i rischi e che mettono in pericolo i nostri figli.

“Giovani Ambasciatori per la cittadinanza digitale contro cyberbullismo e cyber risk” è la campagna del MOIGE, sostenuta da Enel Cuore Onlus, in collaborazione con Polizia di Stato, Anci, associazione nazionale comuni italiani, Un nodo blu del Ministero dell’Istruzione, CONI e Fondazione Cariplo, per rendere gli studenti più consapevoli dei rischi di internet, responsabilizzare, e stimolare docenti e genitori ad avere un ruolo di guida e controllo più attivo. In questa settima edizione sono coinvolte 300 scuole, circa 75.000 alunni, oltre 2000 docenti e 150.000 genitori sul territorio nazionale.

https://www.key4biz.it/moige-il-12-aprile-a-milano-la-prima-tappa-del-tour-sui-rischi-informatici-e-cyberbullismo/442114/