Hydra, the world’s biggest cybercrime forum, is no more. Authorities in Germany have seized servers and other infrastructure used by the sprawling, billion-dollar enterprise along with a stash of about $25 million in bitcoin.

Hydra had been operating since at least 2015 and had seen a meteoric rise since then. In 2020, it had annual revenue of more than $1.37 billion, according to a 2021 report jointly published by security firm Flashpoint and blockchain analysis company Chainalysis. In 2016, the companies said Hydra had a revenue of just $9.4 million. German authorities said the site had 17 million customers and more than 19,000 seller accounts registered.

Cybercrime bazaar

Available exclusively through the Tor network, Hydra was a bazaar that brokered sales of narcotics, fake documents, cryptocurrency-laundering services, and other digital goods. Flashpoint and Chainalysis identified 11 core operators but said the marketplace was so big that it likely was staffed by “several dozen people, with clearly delineated responsibilities.”

In a post published on Tuesday, Germany’s Central Office for Combating Cybercrime (known as ZIT) and the Federal Criminal Police Office (BKA) said they confiscated Hydra’s server infrastructure and 543 bitcoins, worth about $25 million.

People who attempt to visit the site can’t access any of the previously available pages or resources. Instead, they see the following graphic bearing the seals of multiple law enforcement agencies, including the FBI and the Drug Enforcement Administration. The graphic declares that the site has been shut down.

“The seizures carried out today were preceded by extensive investigations that have been conducted by the BKA and the ZIT since August 2021 and in which several US authorities were involved,” authorities wrote in Tuesday’s statement.

Shaken, not stirred

A key service available on Hydra was the Bitcoin Bank Mixer, a service for obfuscating digital transactions so they’re harder for law enforcement to track. Hydra, according to blockchain analysis firm Elliptic, facilitated the laundering of some of the $7 billion in bitcoin stolen from the Bitfinex exchange in 2016. Elliptic also said the darknet site helped launder money the Dark Side ransomware group extorted in a hack of Colonial Pipeline last year.

Overall, Hydra has facilitated more than $5 billion in transactions, Elliptic said. The shuttering of the site leaves a tremendous vacuum in the cybercrime world, one that no doubt will be filled either by the same operators as they rebuild their empire or a new enterprising entrant.

“Overall, today’s actions are a significant success for law enforcement, demonstrating that cybercriminals operating within Russia and surrounding countries are not immune to enforcement action,” Elliptic researchers wrote. “Today’s news is likely to have a significant impact on the Russian cybercrime community, and law enforcement should be praised for such a notable success.”

https://arstechnica.com/?p=1846025

Il cybercrime dilaga. Nel 2021, i pagamenti estorti alle aziende tramite attacchi ransomware hanno raggiunto nuovi record, con i criminali informatici che si sono rivolti sempre più spesso ai siti del Dark Web minacciando di di rilasciare dati sensibili, facendo così pressione sulle vittime.

La richiesta media di riscatto nei casi analizzati dagli incident responder nell’ultimo report di Palo Alto è aumentata del 144% nel 2021, raggiungendo quota 2,2 milioni di dollari, mentre il pagamento medio è salito del 78%, a 541.010 dollari. I settori più colpiti sono stati i servizi professionali e legali, costruzioni, commercio all’ingrosso e retail, sanitario e manifatturiero.

Ransomware: tra i gruppi criminali più pericolosi spiccano Conti e Revil

Tra i gruppi criminali autori degli attacchi ransomware spicca il gruppo Conti, responsabile della maggior parte dell’attività (15,1%), che rappresenta oltre 1 caso su 5 tra quelli analizzati dall’azienda nel 2021. REvil, noto anche come Sodinokibi, si è posizionato al secondo posto, con il 7,1%, seguito da Hello Kitty (4,8%), Phobos (4,8%) e SunCrypt (4,8%). Conti ha anche pubblicato i nomi di 511 organizzazioni sul suo sito Dark Web, confermandosi il più “attivo” tra tutti i gruppi individuati.

Il report descrive come l’ecosistema delle estorsioni informatiche sia cresciuto anche numericamente nel 2021, con l’emergere di 35 nuove gang ransomware, e illustra come le imprese criminali abbiano investito gli elevati profitti nella creazione di strumenti più semplici da utilizzare, che sfruttano sempre più spesso vulnerabilità zero-day.

Parallelamente, nel 2021 è aumentato anche dell’85% il numero di vittime i cui dati sono stati pubblicati su siti di leak, raggiungendo quota 2.566 organizzazioni. Di queste, il 60% appartiene al continente americano, 31% all’area EMEA e 9% a quella Asia-Pacifico.

https://www.key4biz.it/ransomware-la-richiesta-dei-riscatti-e-aumentata-del-144-nel-2021-scarica-il-report/397995/

Aumento degli attacchi di spear-phishing di circa sette volte dall’inizio della pandemia. Lo rivela un recente sondaggio “The unsolved opportunities for cybersecurity providers” condotto da McKinsey sui fornitori di sicurezza informatica, che evidenzia come le organizzazioni stanno costringendo i fornitori di cybersecurity ad adattare le proprie strategie e le offerte di prodotti e servizi per soddisfare gli obiettivi postpandemici.

Gli elementi che le imprese devono proteggere (dati, dispositivi, persone, reti, macchine e applicazioni) e come devono proteggerli (prevenzione, rilevamento, risposta e ripristino), spiega il report, continuano ad evolversi, e i fornitori di cybersecurity devono ancora risolvere diverse sfide cruciali per i clienti.  

I risultati del sondaggio sui fornitori di cybersecurity hanno rivelato che i Chief Information Security Officer e i team operativi di cybersecurity continueranno a investire risorse di nicchia nelle aree della sicurezza perimetrale, nei sistemi di controllo dell’identità e di accesso di prossima generazione, nell’accesso remoto, nella automazione della sicurezza e nella formazione. Con un vasto ecosistema di piattaforme tecnologiche e partner, i fornitori di cybersecurity dovranno differenziarsi. 

Il Report suggerisce che rimangono quattro sfide irrisolte riguardate la cybersecurity:

GAP di visibilità

Senza visibilità sull’infrastruttura digitale, sarà difficile per le aziende riconoscere quando, dove o perché c’è un problema. Secondo un recente sondaggio McKinsey su circa 200 buyer di applicazioni operative di sicurezza nel mercato enterprise (aziende con più di 1.000 dipendenti o un fatturato superiore a 1 miliardo di dollari), circa il 60% dei buyer analizza e classifica meno del 40% dei dati di log delle loro aziende. Una cifra che potrebbe addirittura essere sottostimata: i dati di log di terze parti e del software-as-a-service sono spesso esclusi, poiché non sono ritenuti prioritari in molti ambienti aziendali.

Il tipico ambiente aziendale di oggi, tuttavia, può rendere difficile la visibilità. I chief information officer e i CISO devono anche ripensare le loro strategie di analisi sulla base del volume e della natura dei dati di oggi.

Frammentazione tecnologica

Parte del lavoro di un CISO ha un elemento di impossibilità. I loro team devono proteggere dai futuri cyberattacchi, la cui natura, il metodo, i tempi, sono sconosciuti. Queste incognite alimentano il timore ad affrontare una riduzione del numero di applicazioni di sicurezza, anche quelle apparentemente ridondanti, perché è possibile che l’applicazione presa di mira possa essere quella che salverà l’azienda.

Con la continua espansione dei regolamenti sui dati, e l’interesse dei clienti per la tutela della privacy dei dati, al CISO viene sempre più chiesto di aggiungere strumenti e  processi. In molti casi, questo ha portato a una proliferazione di strumenti, come la classificazione dei dati, l’etichettatura dei dati, la governance dell’accesso ai dati e la gestione della privacy, dove il modello operativo tra la sicurezza delle informazioni e la privacy (preoccupazioni di conformità) può diventare confuso.

Carenza di talenti nella cybersecurity

La carenza di talenti è un problema enorme, e sta colpendo sia i clienti che i fornitori. L’uso della tecnologia ha sopperito leggermente, ma la sua funzione è supportare gli analisti di sicurezza, permettendo alle capacità umane di essere più efficienti e di concentrarsi maggiormente su compiti in cui la loro esperienza e creatività sono essenziali. 

Il ROI della cybersecurity

Il programma di cybersecurity di maggior successo è quello che nessuno nota e che permette al business di funzionare senza ostacoli. Le organizzazioni oggi hanno difficoltà a capire come misurare il ritorno della spesa in cybersecurity, così come a comunicare il suo valore agli stakeholder interni, quali la C-suite e i membri del consiglio di amministrazione. 

Per approfondire

https://www.key4biz.it/attacchi-spear-phishing-aumentati-di-7-volte-durate-la-pandemia-il-report/388423/

Nel 2030, la connettività avrà un impatto su ogni aspetto della vita quotidiana, sia a livello fisico che psicologico. I cybercriminali si evolveranno per utilizzare e approfittarsi delle innovazioni tecnologiche, come da loro abitudine.

Lo rivela Trend Micro in “Project 2030: Scenari per il futuro della cybersecurity”, uno studio a cui è legata una webserie che mostrano come potrebbe essere il mondo all’inizio del prossimo decennio, in modo particolare nel merito delle nuove minacce alla sicurezza informatica.

Tra queste, il gruppo annovera i prossimi standard di connettività 5G e 6G, che renderanno i tentativi di intromissione più precisi e sofisticati.

Poi gli strumenti di intelligenza artificiale, che potranno dare anche ad hacker senza competenze tecniche l’opportunità di compiere attacchi cybercriminali, su scale di ampiezza più grandi, facilitati da software automatici.

Ecco quello che potrebbe succedere nel 2030

• Gli strumenti di intelligenza artificiale permettono anche agli individui senza competenze tecniche di compiere attacchi cybercriminali, su una scala di grandezza mai vista prima
• Gli attacchi causano il caos nelle supply chain delle industrie e danni fisici agli esseri umani che utilizzano impianti cyber
• L’ingegneria sociale e la disinformazione diventano più radicate e difficili da ignorare, a causa dell’utilizzo di massa degli Heads Up Display (HUD)
• Gli ambienti caratterizzati da un utilizzo massivo di IoT (Massive IoT environments – MioT) attraggono azioni di sabotaggio ed estorsione, soprattutto nei settori manifatturiero, della logistica, dei trasporti, della sanità, dell’istruzione, della vendita al dettaglio e domestico
• Le tecniche di occultamento attraverso l’intelligenza artificiale rendono impossibile l’attribuzione delle identità, ponendo problematiche circa l’incident response e la gestione degli accessi
• Il 5G e il 6G rendono gli attacchi più precisi e sofisticati
• L’ “Everything as a Service” trasforma i cloud provider in ricchi obiettivi per i cyber criminali
• Il tecno-nazionalismo diventa uno strumento geostrategico chiave per alcune delle nazioni più potenti del mondo e questo allarga ulteriormente il divario con gli altri Paesi

Secondo il report le tecniche di occultamento attraverso l’intelligenza artificiale rendono impossibile l’attribuzione delle identità, ponendo problematiche sull’effettivo riconoscimento dei criminali e dei loro accessi non autorizzati ai sistemi violati. Spunto interessante è quello del “tecno-nazionalismo”. Con tale termine, gli specialisti indicano uno scenario in cui la tecnologia avanzata diviene “uno strumento geostrategico chiave per alcune delle nazioni più potenti del mondo e questo allargherà ulteriormente il divario con gli altri Paesi”. Project 2030 è stato costruito sulla base di ricerche open source, sullo studio di rapporti sul panorama delle minacce a firma di aziende e scienziati, sul monitoraggio di brevetti e con il supporto di un sondaggio online solo su invito e un altro rivolto ai CISO.

Scarica il report

https://www.key4biz.it/5g-e-intelligenza-artificiale-i-rischi-cyber-del-2030-il-report/386918/

Sono 11,11 milioni gli italiani vittima di furto di dati nel 2021, il 38,6% in meno rispetto allo scorso anno.

Lo rivela il report di Surfshark che evidenzia come il 2021 è stato leggermente peggiore dell’ultimo in termini di casi di data breach. Nei primi 11 mesi dell’anno in corso, gli account violati hanno superato i 950 milioni a livello globale. Questo vuol dire che un quinto di tutti i navigatori con almeno un’identità digitale ha visto sottratta una qualche informazione personale.

A fine novembre, un’indagine di Hootsuite ha stimato che 4,66 miliardi di persone al mondo usa internet, sebbene con mezzi e frequenze di accesso differenti. Il report di Surfshark evidenzia che i primi cinque paesi con il maggior numero di violazioni di dati rappresentano più della metà di tutte le perdite del 2021. Gli Stati Uniti sono arrivati primi, con un totale di 214,4 milioni di utenti violati. L’Iran è secondo, con 156,1 milioni di account, seguito da India (86,6 milioni), Russia (27 milioni) e Francia (24,6 milioni).A precedere l’Italia sono Brasile, Regno Unito, Iraq, Corea del Sud, Cina e Canada.

La sicurezza informatica che non va: la vulnerabilità Log4Shell che spaventa il mondo

Log4j, la vulnerabilità emersa ad inizio di dicembre, è senza dubbio la falla informatica del 2021. Così come era stato per il ransomware WannaCry, che bloccava i computer infettati richiedendo un riscatto, anche il bug che colpisce Java interessa un’ampia gamma di sistemi.

Stando alle ultime rilevazioni, sono oltre 4 milioni gli attacchi veicolati da gruppi criminali attraverso il bug, il 46% dei quali da parte di team già noti alle forze dell’ordine.

Cresce anche la percentuale delle reti aziendali prese di mira: il 48% di tutte quelle attive al mondo. In pratica, quasi una società su due ha visto i suoi sistemi dover affrontare minacce basate su Log4j. Ad oggi, non si conosce ancora il monte di tentativi andati in porto o bloccati dalle difese digitali dei vari network.

https://www.key4biz.it/cybercrime-11-milioni-di-italiani-vittime-di-data-breach-nel-2021/386652/

A Canadian teen has been arrested for their alleged role in the theft of roughly $36.5 million (CAD$46 million) worth of cryptocurrency from a single victim in the United States, according to the Hamilton Police in Ontario, Canada.

The arrest was made following an investigation that started in March 2020 and in which the FBI and the United States Secret Service Electronic Crimes Task Force participated as well.

SIM swapping was used to perform the cryptocurrency theft, authorities revealed. The technique involves manipulating employees at a wireless network services provider into transferring the victim’s phone number to a SIM card in the attacker’s possession.

This allows the cybercriminals to intercept phone calls and SMS messages the victim might receive, including those that contain two-factor authorization codes.

During the investigation, authorities discovered that some of the stolen funds were used to purchase an online username considered rare in the gaming community. Thus, they were able to uncover the account holder.

Hamilton Police said the unnamed teen was arrested on charges related to the theft of more than $5,000 and for “possession of property or proceeds of property obtained by crime.”

Authorities also said more than $5.5 million (more than CAD$7 million) in cryptocurrency was seized.

Related: FBI: Scams Involving Cryptocurrency ATMs and QR Codes on the Rise

Related: Twitter Hacker Charged Over Theft of $784,000 in Cryptocurrency

Related: Hackers Stole Cryptocurrency From Thousands of Coinbase Accounts

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/canadian-teen-arrested-over-theft-36-million-cryptocurrency

American pizza chain California Pizza Kitchen (CPK) is notifying employees of a data breach that might have resulted in some of their personal information being accessed by hackers.

The incident was identified on September 15, but the company says it needed several weeks to conclude its investigation. The company began sending out notification letters to affected individuals only on November 15.

Just over 103,000 people — current and former CPK employees — appear to have been affected by the data breach, the pizza chain told the Maine Attorney General.

“We immediately secured our environment and, with the assistance of leading third-party computer forensic specialists, launched an investigation to determine the nature and scope of the incident. On October 4, 2021, the investigation confirmed that certain files on our systems had been subject to unauthorized access,” the company told the affected employees.

Some of the compromised files, CPK explains, contained personal information related to its employees, including names and Social Security Numbers.

The company claims it has no evidence that the compromised information might have been misused, and says it decided to inform all of the potentially affected individuals “out of an abundance of caution.”

Furthermore, CPK says that it took steps to improve the security of its systems, including reviewing existing policies and implementing additional measures, to ensure that it can prevent similar incidents from happening.

“We also reported the incident to law enforcement and will cooperate with any investigation. We are notifying potentially impacted individuals, including you, so that you may take steps to protect your information,” the company notes.

Related: HPE Says Customer Data Compromised in Aruba Data Breach

Related: Missouri Budget Officials Outline $50M Cost of Data Breach

Related: Telecoms Giant Syniverse Discloses Years-Long Data Breach

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/california-pizza-kitchen-notifies-employees-data-breach

A North Korea-linked threat actor tracked as TA406 has intensified its attacks in 2021, particularly credential harvesting campaigns, Proofpoint reports.

The adversary, which security researchers also refer to as Kimsuky, Thallium, and Konni, has been targeting organizations in sectors such as education, government, media, and research, as well as other industries.

According to Proofpoint, TA406 aligns the most with Kimsuky activity, which the security firm tracks as three different threat actors, namely TA406, TA408 and TA427.

“Our analysts have tracked TA406 campaigns targeting customers since 2018, but the threat actor’s campaigns remained low in volume until the beginning of January 2021,” the company said.

During the first six months of the year, Proofpoint observed weekly attacks aimed at journalists, experts in foreign policy, and nongovernmental organizations (NGOs), especially those linked to activities that impact the Korean Peninsula. Academics and journalists were also targeted.

As part of a March 2021 campaign, TA406 targeted high-ranked elected officials at various governmental institutions, a consulting firm, defense institutions, law enforcement agencies, and economy and finance organizations. TA406 mainly focuses on targets in North America, China, and Russia.

Active since at least 2012, the adversary doesn’t typically employ malware in its attacks, but the espionage campaigns observed in 2021 were characterized by the use of both malware and credential harvesting.

Employed malware families include Amadey, Android Moez, BabyShark, CARROTBAT/CARROTBALL, FatBoy, KONNI, SANNY, and YoreKey. NavRAT and QuasarRAT also appear to have been used.

Just as other North Korean state-sponsored actors, TA406 has been engaged in financially-motivated attacks as well, including sextortion and in the targeting of cryptocurrency, the security researchers say.

“Proofpoint assesses with high confidence that TA406 operates on behalf of the North Korean government. […]Proofpoint anticipates this threat actor will continue to conduct corporate credential theft operations frequently, targeting entities of interest to the North Korean government,” the security firm notes.

Related: North Korean Hackers Targeting IT Supply Chain: Kaspersky

Related: ‘World’s Leading Bank Robbers’: North Korea’s Hacker Army

Related: Here’s How North Korean Hackers Stole Data From Isolated Network Segment

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/north-korean-hacker-group-intensifies-espionage-campaigns

The US Justice Department announced indictments Thursday of two Iranians who allegedly took part in an online “disinformation and threat” campaign to influence American voters in the 2020 presidential election.

Mohammad Hosein Musa Kazemi, 24, and Sajjad Kashian, 27, conducted a cyber campaign “to intimidate and influence American voters, and otherwise undermine voter confidence and sow discord,” the department said.

In parallel, the US Treasury announced sanctions on the two men and three others who ran the cybersecurity company they worked for, Emennet Pasargad.

The Treasury said the company was formerly known as Net Peygard Samavat, which was hit with sanctions in 2019, and the Justice Department gave its former name as Eeleyanet Gostar.

Kazemi and Kashian allegedly obtained confidential voter information and sent menacing emails, pushing out false information to influence both Democratic and Republican voters, and attempting to hack into state voting-related websites, the department said.

In one case, they sent out mass emails claiming to be from the far-right Proud Boys militia group that threatened people to change political parties.

[ Related: Supply Chain Security Fears Escalate as Iranian APTs Caught Hitting IT Services Sector ]

In another, they created and disseminated a video that purportedly showed a person hacking state voter websites and creating fraudulent ballots.

The indictment did not tie the two directly to the Iranian government, but noted that the company had done work for the government.

In 2019 the Treasury said Net Peygard Samavat worked with the Islamic Revolutionary Guard Corps.

[ Related: Microsoft Exposes Iran-Linked APT Targeting U.S., Israeli Defense Tech Sectors ]

And in March 2021 US intelligence released a report that said the Iranian government was behind a multi-pronged influence campaign aimed at hurting former president Donald Trump’s reelection chances.

Kazemi and Kashian are charged in federal court in New York with conspiracy to commit computer fraud and abuse for trying to intimidate voters, voter intimidation, and transmission of interstate threats.

Kazemi was also charged with computer hacking and computer fraud. The penalties for the various charges run from one to 10 years in prison.

© AFP 2020

Previous Columns by AFP:

Tags:

https://www.securityweek.com/us-indicts-iranians-election-meddling

Costco, one of the world’s largest retailers, has warned customers that they may have had bank card details stolen, following reports that payment card skimming devices were discovered at Costco warehouses.

“If unauthorized parties were able to remove information from the device before it was discovered, they may have acquired the magnetic stripe of your payment card, including your name, card expiration date, and CVV,” Kevin Green, VP Midwest region operations at Costco, wrote in a letter to potentially affected customers.

The letter, dated November 5, 2021, was uploaded to Documentcloud by Bleeping Computer.

The letter offers customers who may have been affected free credit monitoring from IDX for 12 months, but provides no further details on the device itself, nor the period in which it was operational. 

It was discovered “as a result of regular pin pad inspections conducted by Costco personnel.” It was therefore potentially operational for any part of the period between this and the previous inspection. Fox Business reports that a total of five skimmers were found in four different Chicago-area warehouses during pin pad inspections at the end of August. 

“The data that the attacker can obtain from the magnetic strip on a card actually depends on the card itself. While things like the credit card number, full name, expiration, and country code is universal, other cards can contain additional information like billing address or rewards account numbers,” comments Randy Watkins, CTO at managed detection and response firm Critical Start.

Armen Najarian, chief identity officer at Outseer, warns that we can expect to see a growth in such attacks as we get closer to the holiday season – a threat made worse by staff shortages cause by the pandemic. “As we head into the holiday season, hackers and other bad actors will target retailers made vulnerable by short staffing and high transaction volumes,” he said. 

“All of this, unfortunately, will be amplified this year as pandemic-induced labor shortages reach unprecedented levels. If retailers want to keep their customers safe and happy this holiday season, they need to prioritize payment authentication software for in-store and online transactions alike.”

Such physical attacks only affect the users of the compromised devices and should not be confused with the software skimming technique of a Magecart attack.  At Black Hat Europe on November 10, 2021, external attack surface management firm Cyberpion announced the possibility of a new wave of Magecart attacks. It analyzed more than 30,000 Magecart vulnerabilities over the last two years and found that more than 10,000 are still active. 

“There were also severe lapses in enterprises disclosing security vulnerabilities or exploits occurring along their digital supply chains to their customers, ultimately placing all connected organizations at severe risk of a critical breach.”

Magecart is the common name for a style of cyber attack used by multiple threat actors. Hackers compromise third party code (typically JavaScript that runs in browsers) to steal, or scrape, information such as credit card data from web-applications (for example, online checkout software) or websites that incorporate the code. Big name victims of such attacks include British Airways and Ticketmaster in 2018, Forbes magazine in 2019, plus local US government portals and messaging service Telegram 2020.

“Our conclusion from the analysis is that as of today, organizations fail to face Magecart threats and detect the vulnerabilities and exploits that hackers leverage to conduct these attacks,” said Cyberpion CEO Nethanel Gelernter. “Victims are often the last to know as it’s only later that organizations find that their data was sold or exploited, with the problem extending beyond any single vendor or client relationship. For enterprises in particular, Magecart attacks pose a significant challenge because it is problematic to set up a solution at scale.”

Related: Online Retailers Ill-Prepared for Holiday Season

Related: Hackers Favoring Shimmers Over Skimmers for ATM Attacks

Related: Hunting for Magecart With URLscan.io

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Previous Columns by Kevin Townsend:

Tags:

https://www.securityweek.com/costco-hit-card-skimming-attack-head-holiday-season