The Russian hackers behind the massive SolarWinds cyberespionage campaign broke into the email accounts of some of the most prominent federal prosecutors’ offices around the country last year, the Justice Department said Friday.

The department said 80% of Microsoft email accounts used by employees in the four U.S. attorney offices in New York were breached. All told, the Justice Department said 27 U.S. Attorney offices had at least one employee’s email account compromised during the hacking campaign.

The Justice Department said in a statement that it believes the accounts were compromised from May 7 to Dec. 27, 2020. Such a timeframe is notable because the SolarWinds campaign, which infiltrated dozens of private-sector companies and think tanks as well as at least nine U.S. government agencies, was first discovered and publicized in mid-December.

The Biden administration in April announced sanctions, including the expulsion of Russian diplomats, in response to the SolarWinds hack and Russian interference in the 2020 U.S. presidential election. Russia has denied wrongdoing.

[…]

Source: Justice Department says Russians hacked federal prosecutors

This is another escalation in the finger pointing between the US, Russia and China

Law firm Campbell Conroy & O’Neil has warned of a breach from late February which may have exposed data from the company’s lengthy client list of big-name corporations including Apple and IBM.

The breach, which was discovered on 27 February 2021 when a ransomware infection blocked access to selected files on the company’s internal systems, has been blamed on an unnamed “unauthorised actor.”

[…]

While it’s not yet known precisely what data was accessed during the breach, the system affected held a treasure trove including “certain individuals’ names, dates of birth, driver’s license numbers/state identification numbers, financial account information, Social Security numbers, passport numbers, payment card information, medical information, health insurance information, biometric data, and/or online account credentials (i.e. usernames and passwords),” the company confirmed in a statement regarding the attack.

[…]

The company has also offered those affected a 24-month subscription to credit monitoring, fraud consultation, and identity theft restoration services – but only if they had their Social Security numbers held on the system. For those whose data did not include Social Security numbers, they get nothing bar the company’s apologies.

Source: US legal eagles representing Apple, IBM, and more take 5 months to inform clients of ransomware data breach • The Register

[…]

The threat actors are offering Saudi Aramco’s data starting at a negotiable price of $5 million.

Saudi Aramco has pinned this data incident on third-party contractors and tells BleepingComputer that the incident had no impact on Aramco’s operations.

“Zero-day exploitation” used to breach network

This month, a threat actor group known as ZeroX is offering 1 TB of proprietary data belonging to Saudi Aramco for sale.

ZeroX claims the data was stolen by hacking Aramco’s “network and its servers,” sometime in 2020.

As such, the files in the dump are as recent as 2020, with some dating back to 1993, according to the group.

When asked by BleepingComputer as to what method was used to gain access to the systems, the group did not explicitly spell out the vulnerability but instead called it “zero-day exploitation.”

To create traction among prospective buyers, a small sample set of Aramco’s blueprints and proprietary documents with redacted PII were first posted on a data breach marketplace forum in June this year:

However, at the time of initial posting, the .onion leak site had a countdown timer set to 662 hours, or about 28 days, after which the sale and negotiations would begin.

ZeroX told BleepingComputer that the choice of “662 hours,” was intentional and a “puzzle” for Saudi Aramco to solve, but the exact reason behind the choice remains unclear:

The group says that the 1 TB dump includes documents pertaining to Saudi Aramco’s refineries located in multiple Saudi Arabian cities, including Yanbu, Jazan, Jeddah, Ras Tanura, Riyadh, and Dhahran.

And, that some of this data includes:

1. Full information on 14,254 employees: name, photo, passport copy, email, phone number, residence permit (Iqama card) number, job title, ID numbers, family information, etc.
2. Project specification for systems related to/including electrical/power, architectural, engineering, civil, construction management, environmental, machinery, vessels, telecom, etc.
3. Internal analysis reports, agreements, letters, pricing sheets, etc.
4. Network layout mapping out the IP addresses, Scada points, Wi-Fi access points, IP cameras, and IoT devices.
5. Location map and precise coordinates.
6. List of Aramco’s clients, along with invoices and contracts.

[…]

Source: Saudi Aramco data breach sees 1 TB stolen data for sale

Palo Alto Networks’ global threat intelligence team, Unit 42, has detailed the tactics ransomware group REvil has employed to great impact so far this year – along with an estimation of the multimillion-dollar payouts it’s receiving.

[…]

The group, which provides what security wonks have come to term “Ransomware as a Service” or RAAS, has been fingered in some high-profile attacks: Travelex, an entertainment-focused law firm with an A-lister client base; Apple supplier Quanta Computer; a major meat producer; a nuclear weapons contractor; and fashion giant French Connection UK – among many others.

Most recently, the group gained access to an estimated 1,500 companies through the Kayesa VSA platform. While the company denied a supply-chain attack, it disabled its Saas platform as a security measure – and, as of this morning, was struggling to recover.

[…]

“For these services, REvil takes a percentage of the negotiated ransom price as their fee. Affiliates of REvil often use two approaches to persuade victims into paying up: they encrypt data so that organizations cannot access information, use critical computer systems or restore from backups, and they also steal data and threaten to post it on a leak site (a tactic known as double extortion).”

According to research carried out by Martineau and colleagues, REvil and its affiliates averaged $2.25m in payouts per breach over the first six months of 2021 – chickenfeed compared to the $70m the group is demanding for a universal decryption tool designed to unlock the data being ransomed as a result of the Kaseya attack.

The methods chosen by the group to gain access to the target systems are depressingly simple, Martineau’s report claimed, with the most common methods being as simple as sending a phishing message or attempting to log in to Remote Desktop Protocol (RDP) servers using previously-compromised credentials.

“However,” Martineau noted, “we also observed a few unique vectors that relate to the recent Microsoft Exchange Server CVEs, as well as a case that involved a SonicWall compromise.”

Once in, REvil attackers cement their access by creating new local and domain user accounts, install Cobalt Strike’s Beacon covert payload – a commercial product which apparently delivers a little too well on its promise to “model advanced attackers” for “threat emulation” – and disable antivirus, security services, and other protection systems. The impact is further expanded to other devices on the network, using “various open-source tools to gather intelligence on a victim environment.”

It could be a while before the attack is noticed, too – no surprise given how the group often exfiltrates gigabytes of data as part of its ransom approach. “REvil threat actors often encrypted the environment within seven days of the initial compromise,” Martineau found. “However, in some instances, the threat actor(s) waited up to 23 days. [They] often used MEGASync software or navigated to the MEGASync website to exfiltrate archived data. In one instance, the threat actor used RCLONE to exfiltrate data.

[…]

The full report has been published on the Unit 42 site.

Source: Report shines light on REvil’s depressingly simple tactics: Phishing, credential-stuffing RDP servers… the usual • The Register

Ransomware attacks are on the rise, but quantifying the scope of the problem can be tricky when only the most high-profile cases make headlines. Enter Ransomwhere,

[…]

Jack Cable, a security architect at the cybersecurity consulting firm Krebs Stamos Group, launched the site on Thursday.

[…]

The way it works is Ransomwhere keeps a running tally of ransoms paid out to cybercriminals in the bitcoin cryptocurrency. This is largely made possible because of the transparent nature of bitcoin: All transactions involving the cryptocurrency are recorded on the blockchain, a decentralized database that acts as a public ledger, thus allowing anyone to track any transactions specifically associated with ransomware groups.

[…]

Since the U.S. dollar value of bitcoin is constantly fluctuating, Ransomwhere calculates each ransom amount based on the bitcoin exchange rate on the day that the transaction was sent.

[…]

So far in 2021, the Russia-linked cybercriminal gang that took credit for the Kaseya and JBS attacks, REvil, is leading the pack by a mile with more than $11 million in ransom payments, according to Ransomwhere. Coming in second with 6.2 million is Netwalker, one of the most popular ransomware-as-a-service offerings on the dark web. Though it should be noted that Netwalker has the dubious honor of racking up the most ransom payments of all time, with roughly $28 million to its name based on the site’s data.

REvil could soon surpass that record if its recent demands for $70 million are met. That’s how much the gang asked for on Sunday to publish a universal decryptor that would unlock all computers affected in the Kaseya hack, a supply chain attack that has crippled more than 1,000 companies worldwide and prompted a federal investigation.

[…]

Source: This Crowdsourced Ransomware Payment Tracker Shows How Much Cybercriminals Have Heisted

Cyberattacks reportedly disrupted Iran’s railway system on Friday, causing “unprecedented chaos” at stations throughout the country, according to state media.

The hackers, whoever they are, also reportedly trolled the nation’s Supreme Leader Ali Khamenei, posting his phone number as “the number to call for information” on multiple train station message boards, Reuters reports. According to some Iranian outlets, the number, 64411, was displayed on screens in train stations and redirected to Ayatolla Khamenei’s office when dialed.

The railway’s website, local ticket offices, and cargo services have all apparently been affected, the news outlet reports.

There isn’t otherwise a whole lot of information about this incident, though local reporting would appear to suggest that trains have been massively delayed but not totally stalled.

[…]

Source: Iran’s Train System Reportedly Hacked by Trolling Attackers

According to a new investigation from Bloomberg, cyber spies connected to the Russian government recently hacked into the Republican National Committee—though the RNC has denied that their systems were breached in this way.

According to Bloomberg, the hacker group known as “Cozy Bear”—thought to be connected to Russia’s intelligence service, the SVR—conducted the intrusion, though it’s not clear what they viewed or whether they stole any data. The hackers are believed to have gained entry to the RNC’s networks through one of its IT providers, a company called Synnex Corp.

The incident occurred this past 4th of July weekend—around the same time that a cybercriminal group was launching a massive ransomware attack on American IT firm Kaseya, the damage from which is still being assessed. The Russian cybercriminal group REvil has claimed responsibility for that attack.

A notorious threat actor, Cozy Bear has been blamed for large parts of the “SolarWinds” hack, the likes of which compromised close to a dozen federal agencies and droves of American businesses. The group, which also goes by its technical designation APT 29, has also been accused of hacking the Democratic National Committee in the past.

[…]

Source: Report: Russian Cyber Spies Recently Hacked the RNC

iPhone doesn’t even have to connect to the network to mess up.

Back in June, security researcher Carl Schou found that when he joined the network “%p%s%s%s%s%n”, his iPhone permanently disabled its wifi functionality. Luckily, this was fixed by resetting all network settings, which erased the villainous wifi name from his phone’s memory. You would think that would have been the end of connecting to networks with weird and fishy sounding names, but you are not Schou.

On Sunday, he decided to try his luck again by investigating a public wifi network named “%secretclub%power”. According to Schou, just having an iOS device in the vicinity of a wifi network with this name can permanently disable its wifi functionality.

“You can permanently disable any iOS device’s WiFI by hosting a public WiFi named %secretclub%power,” he wrote on Twitter. “Resetting network settings is not guaranteed to restore functionality.”

Schou apparently struggled to find his way out of this one and get his wifi functionality back. He said he reset network settings multiple times, forced restarted his iPhone, and even contacted Apple’s device security team. The researcher eventually got some help from Twitter, which advised him to manually edit an iPhone backup to remove malicious entries from the known networks plist files.

[…]

Source: Getting Your iPhone Near This Cursed Network Breaks Its Wifi

Cybersecurity teams worked feverishly Sunday to stem the impact of the single biggest global ransomware attack on record, with some details emerging about how the Russia-linked gang responsible breached the company whose software was the conduit.

An affiliate of the notorious REvil gang, best known for extorting $11 million from the meat-processor JBS after a Memorial Day attack, infected thousands of victims in at least 17 countries on Friday, largely through firms that remotely manage IT infrastructure for multiple customers, cybersecurity researchers said.

REvil was demanding ransoms of up to $5 million, the researchers said. But late Sunday it offered in a posting on its dark web site a universal decryptor software key that would unscramble all affected machines in exchange for $70 million in cryptocurrency.

Earlier, the FBI said in a statement that while it was investigating the attack its scale “may make it so that we are unable to respond to each victim individually.” Deputy National Security Advisor Anne Neuberger later issued a statement saying President Joe Biden had “directed the full resources of the government to investigate this incident” and urged all who believed they were compromised to alert the FBI.

Biden suggested Saturday the U.S. would respond if it was determined that the Kremlin is at all involved.

Less than a month ago, Biden pressed Russian President Vladimir Putin to stop giving safe haven to REvil and other ransomware gangs whose unrelenting extortionary attacks the U.S. deems a national security threat.

[…]

CEO Fred Voccola of the breached software company, Kaseya, estimated the victim number in the low thousands, mostly small businesses like “dental practices, architecture firms, plastic surgery centers, libraries, things like that.”

Voccola said in an interview that only between 50-60 of the company’s 37,000 customers were compromised. But 70% were managed service providers who use the company’s hacked VSA software to manage multiple customers. It automates the installation of software and security updates and manages backups and other vital tasks.

[…]

The cybersecurity firm ESET identified victims in least 17 countries, including the United Kingdom, South Africa, Canada, Argentina, Mexico, Indonesia, New Zealand and Kenya.

Kaseya says the attack only affected “on-premise” customers, organizations running their own data centers, as opposed to its cloud-based services that run software for customers. It also shut down those servers as a precaution, however.

Kaseya, which called on customers Friday to shut down their VSA servers immediately, said Sunday it hoped to have a patch in the next few days.

Active since April 2019, REvil provides ransomware-as-a-service, meaning it develops the network-paralyzing software and leases it to so-called affiliates who infect targets and earn the lion’s share of ransoms. U.S. officials say the most potent ransomware gangs are based in Russia and allied states and operate with Kremlin tolerance and sometimes collude with Russian security services.

[…]

Source: Scale, details of massive Kaseya ransomware attack emerge

Western Digital’s popular My Book Live hard drives are being deleted remotely by an unknown attacker, according to the company. And there’s not much anyone can do at this point but unplug their drives from the internet.

“We have determined that some My Book Live devices have been compromised by a threat actor,” Western Digital’s Jolin Tan told Gizmodo early Friday by email. “In some cases, this compromise has led to a factory reset that appears to erase all data on the device.”

[…]

“The My Book Live device received its final firmware update in 2015,” Tan continued. “At this time, we are recommending that customers disconnect their My Book Live devices from the Internet to protect their data on the device.”

[…]

Source: Western Digital Confirms ‘My Book Live’ Drives Are Being Deleted Remotely

Edit: Original research done by Wizcase: WizCase Report: Vulnerabilities found on WD My Book, NetGear Stora, SeaGate Home, Medion LifeCloud NAS

Microsoft (MSFT.O) said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers.

The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds (SWI.N) and Microsoft.

Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May.

[…]

Microsoft said it had also found the breach of its own agent, who it said had limited powers.

The agent could see billing contact information and what services the customers pay for, among other things.

“The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign,” Microsoft said.

Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in.

Microsoft said it was aware of three entities that had been compromised in the phishing campaign.

It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign.

Microsoft did not say whether the agent was at a contractor or a direct employee.

A spokesman said the latest breach by the threat actor was not part of Nobelium’s previous successful attack on Microsoft, in which it obtained some source code.

In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine U.S. federal agencies.

[…]

A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco.

“This appears to be largely unsuccessful, run-of-the-mill espionage,” the official said.

Source: Microsoft says new breach discovered in probe of suspected SolarWinds hackers | Reuters

Yup. Because espionage is “run-of-the-mill” nowadays. Nothing to see here. Boring. 😀

[…]

According to Wired, however, at least one researcher has found a way to avoid most of this trouble, drawing cash from ATMs like magic with a simple flick of his wrist. The outlet reported Thursday that Josep Rodriguez, a researcher and consultant at security firm IOActive, has built up a collection of bugs affecting NFC systems—a.k.a. near-field communication—which many modern machines rely on to wirelessly transmit data, including debit and credit card info.

Rodriguez, who’s hired to legally test machines to improve their security, has been able to use NFC readers to trigger what programmers call a “buffer overflow,” or excess of data that corrupts a machine’s memory. This decades-old attack has allowed Rodriguez to exploit ATMs and other point-of-sale machines—think retail store checkout machines—in a variety of ways: capturing payment card info, injecting malware, and even in one case “jackpotting” an ATM, which is exactly what it sounds like:

“Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems’ firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message.”

According to Wired, Rodriguez has kept his findings under wraps for around a year and is otherwise legally bound not to reveal the identities of certain companies he’s worked for. Nevertheless, being bothered that a decades-old technique is still affecting a host of modern machines, he intends to disclosure more technical details in the coming weeks in an effort to call attention to, as Wired puts it, “the abysmal state of embedded device security more broadly.”

Source: NFC Flaw Lets Hacker Break ATMs With a Phone

Which is why people think Responsible Disclosure is important – ie telling a company about a flaw and then giving them a reasonable time frame to fix it before going public with the full details of the flaw. If you don’t do it, the problem doesn’t get fixed.

On Friday, Volkswagen disclosed a data breach that it said affected 3.3 million customers and interested buyers. On Monday, hackers put the data stolen from the car maker on sale on a notorious hacking forum.

In the sales listing reviewed by Motherboard, a hacker that goes by 000 wrote that the data included email addresses and Vehicle Identification Numbers (VIN). The hacker also posted two samples of the data, which included full names, email addresses, mailing addresses, and phone numbers.

[…]

Volkswagen said that “the majority” of affected data included: “first and last name, personal or business mailing address, email address, or phone number. In some instances, the data also included information about a vehicle purchased, leased, or inquired about, such as the Vehicle Identification Number (VIN), make, model, year, color and trim packages.” But for 90,000 victims, the data also included “more sensitive information relating to eligibility for a purchase, loan, or lease.

Nearly all of the more sensitive data (over 95%) consists of driver’s license numbers,” according to the company, which added that the majority of data pertains to Audi customers and interested buyers in the US and Canada only. The company also said it believes the data was left unsecured by a vendor. (Audi is owned by the Volkswagen Group.)

“There were also a very small number of dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers,” the website read.

[…]

The hacker said she is asking between $4,000 and $5,000 for the whole database. 

[…]

The company added that it believes “the data was obtained when the vendor left electronic data unsecured at some point between August 2019 and May 2021, when the source of the incident was identified.” The company did not identify the vendor responsible for the breach, saying only that it is used by Audi, Volkswagen, and some authorized dealers.

The company added that the stolen data ranged from 2014 until 2019, and that it is notifying all victims.

[…]

Source: Hackers Are Selling Data Stolen From Audi and Volkswagen

São Paulo pickpockets are increasingly stealing people’s smartphones not to pawn off the device, but rather to gain access to their bank account.

That’s according to a report from Brazilian newspaper Folha de S.Paulo this week. As first spotted by 9to5 Mac, the report claims this kind of theft has been going on since the early days of the pandemic, but now specialized gangs have adopted the tactic to empty users’ bank accounts, and it’s put local authorities on high alert.

It remains unclear exactly how these criminals are bypassing security measures for the phones and banks involved. According to São Paulo police chief Roberto Monteiro, they appear to target devices that have already been unlocked by the owner.

“Usually Waze users in the car with an Android smartphone are their main focus. Although breaking an iOS system is more difficult, they have also specialized in it,” he said, 9to5 Mac reports.

Transfers are carried out overnight to avoid arousing the victims’ attention, he continued. In at least one case, criminals appear to have impersonated a victim after breaking into their email account and convinced their bank to transfer thousands of dollars to outside accounts.

While no official statistics have been released at this time, the problem is severe enough that the region’s consumer protection regulator Procon-SP has called on smartphone manufacturers and banks to improve their security measures.

“Procon has already learned about a gang of cell phone receivers whose main illegal business is not the resale of cell phones, but the defrauding of passwords for bank fraud. This is being done through an army of hackers,” said Procon-SP executive director Fernando Capez according to a Google translation.

In some cases, banks have refused to refund the stolen money to victims, arguing that their security systems didn’t fail but rather the clients were negligent by not regularly updating their passwords, Folha de S.Paulo reports. However, clients have fiercely pushed back in these cases. One victim currently involved in a legal battle with the São Paulo-based bank Bradesco said she hadn’t slacked on updating her passwords and her phone was closed when thieves took it. Another victim claimed he had enabled facial recognition and token-based authentication on his phone when it was stolen.

[…]

Source: In Brazil, Criminals Steal Phones to Empty Victims’ Bank Account

Ukrainian police have arrested six people, alleged to be members of the notorious Clop* ransomware gang, seizing cash, cars – and a number of Apple Mac laptops and desktops.

“It was established that six defendants carried out attacks of malicious software such as ‘ransomware’ on the servers of American and [South] Korean companies,” alleged Ukraine’s national police force in a statement published at lunchtime today.

Ukrainian Police’s stash of seized cash from Clop ransomware gang Pic via: Ukraine police

While the gang is notorious in the West for indiscriminately targeting well-off companies and extorting ransoms in exchange for decryption keys, its most shocking moment was when a poorly secured Accellion file transfer appliance gave the criminals access to defence contractor Bombardier. There the criminals were able to copy blueprints for an airborne early warning radar fitted to the company’s flagship AWACS-style military jet.

The six suspects were arrested in joint raids carried out with South Korean law enforcement authorities earlier today, cops in Ukraine said.

Back in December, Clop had targeted a South Korean retailer, E-Land, reportedly stealing two million credit card details over a 12-month period. Cops in South Korea apparently identified the Clop suspects soon after.

[…]

Source: Cuffed: Ukraine police collar six Clop ransomware gang suspects in joint raids with South Korean cops • The Register

Alibaba’s Chinese shopping operation Taobao has suffered a data breach of over a billion data points including usernames and mobile phone numbers. The info was lifted from the site by a crawler developed by an affiliate marketer.

Chinese outlet 163.com reported the case last week and today it was picked up by the Wall Street Journal.

Both reports state that a developer created a crawler that was able to reach beneath information available to the human eye on Taobao, and that the crawler operated for several months before Alibaba noticed the effort.

163.com suggests the source of the crawler was a company that makes money from affiliate referrals to Taobao, and that the site was scraped from November 2019 until Alibaba noticed the activity in July 2020. Alibaba notified authorities, an investigation commenced, and the matter landed in the People’s Court of Suiyang District — which in May convicted a developer and his employer of lifting the data.

Both were sentenced to three years inside.

Thankfully, the perps appear not to have shared the data, instead hoarding it for their own purposes.

[…]

Source: Alibaba suffers billion-item data leak of usernames and mobile numbers • The Register

Internal company data leaked during a February security breach is now being circulated on the internet, Polish video games maker CD Projekt (CDR.WA) said in a statement published on Thursday.

The attack, which compromised some of its internal systems including the source code to its much-hyped game Cyberpunk 2077, dealt another blow to the Warsaw-based business after the game’s launch was beset by glitches.

“We are not yet able to confirm the exact contents of the data in question, though we believe it may include current/former employee and contractor details in addition to data related to our games,” the statement said.

[…]

Source: Internal data from breach circulating online -CD Projekt | Reuters

McDonald’s Corp. said hackers stole some data from its systems in markets including the U.S., South Korea and Taiwan, in another example of cybercriminals infiltrating high-profile global companies.

The burger chain said Friday that it recently hired external consultants to investigate unauthorized activity on an internal security system, prompted by a specific incident in which the unauthorized access was cut off a week after it was identified, McDonald’s said. The investigators discovered that company data had been breached in markets including the U.S., South Korea and Taiwan, the company said.

In a message to U.S. employees, McDonald’s said the breach disclosed some business contact information for U.S. employees and franchisees, along with some information about restaurants such as seating capacity and the square footage of play areas. The company said no customer data was breached in the U.S., and that the employee data exposed wasn’t sensitive or personal. The company advised employees and franchisees to watch for phishing emails and to use discretion when asked for information.

McDonald’s said attackers stole customer emails, phone numbers and addresses for delivery customers in South Korea and Taiwan. In Taiwan, hackers also stole employee information including names and contact information, McDonald’s said. The company said the number of files exposed was small without disclosing the number of people affected. The breach didn’t include customer payment information, McDonald’s said.

[…]

Source: McDonald’s Hit by Data Breach – WSJ

Also Russia and South Africa may have been hit

The group of hackers who stole a wealth of data from game publishing giant Electronic Arts broke into the company in part by tricking an employee over Slack to provide a login token, Motherboard has learned.

The group stole the source code for FIFA 21 and related matchmaking tools, as well as the source code for the Frostbite engine that powers games like Battlefield and other internal game development tools. In all, the hackers claim they have 780GB of data, and are advertising it for sale on various underground forums. EA previously confirmed the data impacted in the breach to Motherboard.

A representative for the hackers told Motherboard in an online chat that the process started by purchasing stolen cookies being sold online for $10 and using those to gain access to a Slack channel used by EA. Cookies can save the login details of particular users, and potentially let hackers log into services as that person. In this case, the hackers were able to get into EA’s Slack using the stolen cookie. (Although not necessarily connected, in February 2020 Motherboard reported that a group of researchers discovered an ex-engineer had left a list of the names of EA Slack channels in a public facing code repository).

“Once inside the chat, we messaged a IT Support members we explain to them we lost our phone at a party last night,” the representative said.

The hackers then requested a multifactor authentication token from EA IT support to gain access to EA’s corporate network. The representative said this was successful two times.

Once inside EA’s network, the hackers found a service for EA developers for compiling games. They successfully logged in and created a virtual machine giving them more visibility into the network, and then accessed one more service and downloaded game source code.

The representative for the hackers provided screenshots to help corroborate the various steps of the hack, including the Slack chats themselves. EA then confirmed to Motherboard the contours of the description of the breach given by the hackers.

[…]

Source: How Hackers Used Slack to Break into EA Games

The FBI has revealed how it managed to hoodwink the criminal underworld with its secretly backdoored AN0M encrypted chat app, leading to hundreds of arrests, the seizure of 32 tons of drugs, 250 firearms, 55 luxury cars, more than $148M, and even cocaine-filled pineapples.

About 12,000 smartphones with AN0M installed were sold into organized crime rings: the devices were touted as pure encrypted messaging tools — no GPS, email or web browsing, and certainly no voice calls, cameras, and microphones. They were “designed by criminals, for criminals exclusively,” one defendant told investigators, Randy Grossman, Acting US Attorney for the Southern District of California, told a press conference on Tuesday.

However, AN0M was forged in a joint operation by Australian and US federal law enforcement, and was deliberately and surreptitiously engineered so that agents could peer into the encrypted conversations and read crooks’ messages. After Australia’s police broke the news that the messaging app had recorded everything from drug deals to murder plots — leading to hundreds of arrests — now the FBI has spilled its side of the story, revealing a complex sting dubbed Operation Trojan Shield.

The Dept of Justice’s Randy Grossman walks through journalists through Operation Trojan Shield at a press conference on Tuesday

“For the first time the FBI developed and operated its own hardened encrypted device company, called AN0M,” Grossman said.

“Criminal organizations and the individual defendants we have charged purchased and distributed AN0M devices in an effort to secretly plan and execute their crimes. But the devices were actually operated by the FBI.”

Playing the long game

According to court documents [PDF] this all came about after the shutdown of Phantom Secure, a Canadian biz selling Blackberry phones customized for encrypted chat to the criminal community. CEO Vincent Ramos pleaded guilty in 2018 to conspiring with drug traffickers and was sentenced to nine years behind bars and had $80M in assets seized.

The closure of Phantom Secure put the staff working there on the FBI’s radar. The bureau’s San Diego office recruited a developer at the company as a confidential human source (CHS), court documents state. This source had previously been sentenced to six years in the clink for importing illegal drugs, and agreed to cooperate with the Feds to reduce any future punishment potentially coming their way.

Crucially, not only had this programmer worked on the Phantom Secure’s encrypted messaging software, but they were also doing work on rival encrypted comms service Sky Global — which also sold modified handsets with secure messaging features — as well as developing their own secure customized phone called AN0M.

“The CHS … had invested a substantial amount of money into the development of a new hardened encrypted device,” the indictment by FBI Special Agent Nicholas Cheviron reads.

“The CHS offered this next generation device, named ‘AN0M,’ to the FBI to use in ongoing and new investigations. The CHS also agreed to offer to distribute AN0M devices to some of the CHS’s existing network of distributors of encrypted communications devices.”

And so, in October 2018, the three-year sting operation began.

The CHS — who was paid $120,000 plus $59,000 in living and travel expenses by the authorities — worked with the FBI and the Australian Federal Police to hide a master decryption key into the AN0M app. Messages sent by the software’s users were quietly copied and sent off to servers controlled by law enforcement, who were able to use the key to decrypt the texts.

[…]

In this beta test, 50 handsets were passed out Down Under, and this phase of the operation was successful; two of the country’s biggest criminal gangs were successfully penetrated and the message copying system worked perfectly. Aussie police reviewing the texts said they found 100 per cent were related to crime. Everyone who used the app was assigned a unique ID, and these handles were known to the police.

Let’s go global

In the next phase, the CHS expanded the distribution network beyond Australia, and the FBI found itself in a position to collect the data. After negotiations with an unnamed third country, a message-relaying iBot server was set up in that nation to collect the BCC’d conversations, and on October 21, 2019, it began beaming copies of crooks’ chats from AN0M handhelds to an FBI-owned system every Monday, Wednesday, and Friday. The third country’s officials had secured a court order for the surveillance, and the FBI used a Mutual Legal Assistance Treaty, also known as an MLAT, to obtain the decrypted material.

Sales of AN0M grew steadily, and got a boost when French and Dutch police took down the EncroChat encrypted service in 2020. When a similar swoop shuttered Sky Global in 2021, demand skyrocketed. After the latter take-down, AN0M sales tripled to more than 9000 handsets, each costing $1700 with a six-month subscription to the AN0M encrypted messaging network, Grossman said.

The data haul from the application was immense: more than 27 million messages from 100 countries, and between 300 criminal gangs. This included more than 400,000 photos, typically of drugs or guns and, crucially, shipment plans.

[…]

Police around the world have made 800 arrests from AN0M-gathered intelligence, including cuffing six US law enforcement officers. Of all of those detained, they primarily face charges of drug trafficking, money laundering, gun violations, and violent crime.

Grossman also announced Uncle Sam had indicted 17 suspects on RICO charges relating to the use and marketing of the AN0M handsets. Most of these people are said to be distributors, though the prosecutor said three were administrators who helped run the service. Eight of those RICO suspects have already been collared and detained.

[…]

Source: FBI paid renegade developer $180k for backdoored AN0M chat app that brought down drug underworld • The Register

(WASHINGTON) — The Justice Department has recovered most of a multimillion-dollar ransom payment made to hackers after a cyberattack that caused the operator of the nation’s largest fuel pipeline to halt its operations last month, officials said Monday.

The operation to seize cryptocurrency paid to the Russia-based hacker group is the first of its kind to be undertaken by a specialized ransomware task force created by the Biden administration Justice Department.

[…]

Colonial officials have said they took their pipeline system offline before the attack could spread to its operating system, and decided soon after to pay ransom of 75 bitcoin — then valued at roughly $4.4 million — in hopes of bringing itself back online as soon as it could. The company’s president and chief executive, Joseph Blount, is set to testify before congressional panels this week.

[…]

The Bitcoin amount seized — 63.7, currently valued at $2.3 million after the price of Bitcoin tumbled— amounted to 85% of the total ransom paid, which is the exact amount that the cryptocurrency-tracking firm Elliptic says it believes was the take of the affiliate who carried out the attack. The ransomware software provider, DarkSide, would have gotten the other 15%.

“The extortionists will never see this money,” said Stephanie Hinds, the acting U.S. attorney for the Northern District of California, where a judge earlier Monday authorized the seizure warrant.

[…]

Source: DOJ Recovers Most of Colonial Pipeline Hack Ransom | Time

[…]

Despite paying for the ransom, the encryption tools handed over did not work or help the company’s efforts to restore its systems.   

The Justice Department obtained a warrant from a California district court on Monday in order to seize the money. 

“Following the money remains one of the most basic, yet powerful tools we have,” Monaco said. “Today’s announcements also demonstrate the value of early notification to law enforcement; we thank Colonial Pipeline for quickly notifying the FBI when they learned that they were targeted by DarkSide.”

[…]

Colonial Pipeline faced significant backlash for paying the ransom but the FBI and Justice Department said they were able to use the Bitcoin public ledger to trace the payments back to “a specific address, for which the FBI has the ‘private key,’ or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address.”

[…]

“We cannot guarantee and we may not be able to do this in every instance.”

Source: ‘Majority’ of ransom paid by Colonial Pipeline seized and returned by DOJ | ZDNet

The Times of India reports Air India has revealed that a breach compromised about 4.5 million passengers whose data was registered at system provider SITA between August 2011 and late February 2021. The intruders couldn’t obtain passwords, but they had access to names, contact info, tickets and frequent flyer info (including for Star Alliance).

The perpetrators also had access to credit card info, although the usefulness of that data might be limited as the CVV/CVC numbers weren’t included.

The airline said it first learned of the incident on February 25th (and issued a warning on March 19th), but that it only learned the identities of affected passengers on March 25th and May 4th. It was already investigating the breach and had locked down the affected servers, including resetting passwords for its frequent flyer program.

It’s not clear who was responsible for the breach. However, the damage isn’t limited to one airline. STIA told BleepingComputer in a statement that customers from several airlines were victims, including travelers who flew with Air New Zealand, Cathay Pacific, Finnair, Jeju Air, Lufthansa, Malaysia Airlines, SAS and Singapore Airlines. While this isn’t as large as the 2018 Cathay Pacific breach that touched up to 9.4 million customers, the repercussions could be felt worldwide for a while to come.

Source: Air India breach compromised data for 4.5 million passengers | Engadget

This shows how incredibly interconnected we are and how poorly our data carriers care for our data

CNA Finaincial, the US insurance conglomerate, has apparently paid $40m to ransomware operators to gets its files back.

In March the business revealed it had been hit by an extensive Phoenix Locker infection; this strain of malware was developed by Russian scam artists calling themselves Evil Corp, which may have links to Russian intelligence.

All CNA systems are now back up and running though it appears that the company didn’t manage this themselves and instead coughed up a widely reported $40m to the extortionists for the means to decrypt the scrambled files.

Source: American insurance giant CNA reportedly pays $40m to ransomware crooks • The Register