News by TechnologistsInSync.com

An individual from the UK has been accused in the US for allegedly operating the now-defunct The Real Deal dark web market, which offered narcotics and weapons in addition to hacking tools, botnets, and stolen account passwords.

According to the US Department of Justice, Daniel Kaye, 34, was charged with access device fraud, using and trafficking in illegal access devices, possession of unauthorized and counterfeit access devices, and conspiracy to launder money.

Authorities claim that Kaye (also known as "Popopret," "Bestbuy," "TheRealDeal," "Logger," "David Cohen," "Marc Chapon," "UserL0ser," "Spdrman," "Dlinch Kravitz," "Fora Ward," and "Ibrahim Sahil") sold on The Real Deal login credentials for computers belonging to a number of US government organizations, including the Postal Service, the National Oceanic and Atmosp

Kaye traded in stolen social security numbers with his partner, "thedarkoverlord," a member of his criminal organization. Through Bitcoin "mixing" services, the defendant is accused of laundering bitcoin that he acquired from The Real Deal.

The virus known as GovRAT, which has been used in operations against US military and government institutions, was created and sold by Daniel Kaye. Additionally, he was responsible for the 2016 Deutsche Telekom hack, in which 900,000 routers belonging to a telecom operator were taken over by a Mirai malware version. In a 2019 court case in London, Kaye admitted to carrying out a series of cyberattacks on the Liberian telecoms firm Lonestar that for many days rendered the nation's internet unusable. 

For his offenses, the individual received a jail term of more than two years.

~ Jai Krishna Ponnappan

According to a recent ransomware report from Israeli cyber-intelligence company KELA, LockBit, Black Basta, Hive, Alphv (aka BlackCat), and BianLian were the most active ransomware and data leak perpetrators in Q3, 2022, with each group disclosing between 20 and 200 victims.

According to the experts, Hive boosted its activity by roughly 67% (in comparison to Q2), whereas Alphv dropped it by 28%. Around 50 victims were taken by Black Basta in each of the two quarters as activity remained constant.

With 55% of assaults coming from LockBit, Alphv, and Hive, the professional services industry was the most often attacked. Manufacturing and industrial goods, healthcare and life sciences, technology, engineering, and construction were the next most frequently attacked industries. The US, UK, Italy, Germany, and Canada are the nations that are most often attacked.

Threat actors are reportedly charging $4,000,000 for access to 576 business networks globally, according to KELA.

"KELA identified about 570 network access listings for sale in Q3 2022, with a total asking price of over USD $4 million; one access was offered for USD $3 million. When compared to the total amount of about USD 660,000 required in Q2, this represents a substantial rise. However, if one USD 3 million access were excluded, the difference wouldn't be as significant, thus further calculations were done without this offer (particularly in light of the fact that the actor behind this listing does not seem to be credible)," the research states.

The average cost of access was close to $2800, a significant increase from just under $1500 in the prior quarter. Additionally, the median cost has climbed from $300 in Q2 to $1350 in Q3. As a result, because there were about the same amount of listings overall in Q3, actors provided more costly listings. In Q3, there were about 190 access listings every month, which was a little more than in Q2.

Based on the public remarks made by the sellers, the average time it took to sell access was 1.6 days. RDP and VPN were the two access methods that threat actors most often provided.

~ Jai Krishna Ponnappan

In order to assist businesses in securing their supply chains, the US National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence (ODNI) have developed a joint advice for software vendors.

"The task of serving as a liaison between the client and the program developer falls to the software provider (vendor). As a result, the document states that vendors have obligations to guarantee the software's integrity and security via contracts, software releases and updates, alerts, and vulnerability mitigations.

In order to assist developers in achieving security, the agencies also published best practices that have undergone government and industry evaluation.

A handbook with suggestions on how to stop or lessen the effects of distributed denial of service (DDOS) assaults was released by CISA earlier this week.

~ Jai Krishna Ponnappan

Dropbox, a provider of file hosting services, reported falling victim to a phishing scam that gave an unauthorized person access to 130 of its GitHub-hosted source code projects.

The business said that the incident was similar to one that GitHub exposed in September, in which hackers impersonated the code integration and delivery platform CircleCI to get access to GitHub accounts.

Dropbox reported that several of its employees had been the target of phishing emails that pretended to be from CircleCI in early October. These emails led the recipients to a bogus CircleCI login page where they were asked to enter their GitHub username and password before using their hardware authentication key to send a One Time Password (OTP) to the malicious website.

The threat actor finally gained access to one of our GitHub groups using this, and they then copied 130 of our source repositories. These repositories included internal prototypes, certain tools and configuration files used by the security team, as well as our own versions of third-party libraries that had been somewhat altered for usage by Dropbox. It's important to note that they omitted the infrastructure or core app code. Even more restricted and tightly monitored access to such repositories is in place, the business said.

Dropbox claimed to have cycled all exposed developer credentials and that it has not discovered any proof that any customer information had been taken as a consequence of the issue.

~ Jai Krishna Ponnappan

Blackberry's threat research and intelligence team has discovered that a threat actor known as RomCom is employing rogue versions of well-known programs like SolarWinds Network Performance Monitor (NPM), KeePass Open-Source Password Manager, and PDF Reader Pro in attacks aimed at the UK and some English-speaking nations, including Ukraine.

The business released a technical study of a spear-phishing effort that was directed at Ukrainian government entities and that distributed the RomCom RAT a week prior to the release of the most recent report. 

The Cuba ransomware is thought to be operated by a gang known as UNC2596 (Tropical Scorpius), according to a report from the Computer Emergency Response Team of Ukraine (CERT-UA).

Blackberry claims that in the most recent campaign, the threat actor uses trojanized versions of popular programs, including SolarWinds NPM, KeePass, Advanced IP Scanner, and pdfFiller. These programs are distributed through phony websites that impersonate trustworthy websites and act as droppers for the RomCom RAT.

The threat research team described the RomCom threat actor's simplified attack preparation process as follows: "The RomCom threat actor performs the following streamlined scheme: scraping the original legitimate HTML code from the vendor to spoof, registering a malicious domain similar to the legitimate one, Trojanizing a legitimate application, uploading a malicious bundle to the decoy website, deploying targeted phishing emails to the victims, or in some cases, using additional infector vectors." "The RomCom threat actor is actively launching new initiatives that are directed at English-speaking targets globally and Ukrainian victims. According to the TOS, it's probable that victims in the UK are now the target while Ukraine remains the major area of interest.

The RomCom RAT, Cuba Ransomware, and Industrial Spy, a relatively recent ransomware actor first seen in April 2022, are thought to have an obvious relationship, according to the experts.

However, Blackberry said, "It's uncertain whether the underlying goal of the RomCom threat actor is merely cybercriminal in nature considering the targets' location and characteristics, paired with the present geopolitical scenario.

~ Jai Krishna Ponnappan

The largest copper producer in Europe, Aurubis, has been the victim of a cyberattack that looks to be part of a bigger assault on the mining and metals sector.

As a precaution, the corporation shut down a number of different systems at its locations as a result of the occurrence. 

"Production and environmental protection facilities at the smelting locations are functioning, and incoming and departing commodities are also being managed manually," the company said in a news statement.

Aurubis has not given any specifics on the nature of the cyber event, but it has said that it is collaborating with the authorities conducting the investigation to ascertain the severity of the cyberattack's effects. The corporation said that it is hard to predict when all of its systems would resume regular functioning.

~ Jai Krishna Ponnappan

A joint guide from the Federal Bureau of Investigation (FBI), the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the US Cybersecurity and Infrastructure Security Agency (CISA) was published to assist organizations in preventing or lessening the effects of distributed denial of service (DDOS) attacks.

The advise lists mitigation strategies that businesses may use to lower the risk of DDoS assaults and discusses the most typical kinds of denial of service (DoS) attacks. These include developing a DDoS response plan, performing a DDoS tabletop exercise, and/or testing the DDoS response plan on a regular basis. They also include enrolling in DDoS protection, understanding dedicated edge network defenses and service provider defenses, and knowing what services and assets are critical for an organization and how users connect to its network.

The guidelines also provide advice on how to respond to a DDoS assault and what to do once one has already taken place.

A separate DDoS guide for government organizations has been released by CISA.

~ Jai Krishna Ponnappan

A 22-year-old student from Bavaria has been detained by German authorities on suspicion of operating "Deutschland im Deep Web," one of the largest dark web markets in the nation.

The 2013 debut of Deutschland im Deep Web saw the sale of narcotics, guns, and ammo. The site was utilized by the terrorist who carried out the 2016 assault in Munich to purchase firearms. The marketplace was shut down by the German government a year later, and its operator was taken into custody and ultimately sentenced to seven years in jail.

Two new iterations of the site with the slogan "No control, everything permitted" debuted on the dark web in 2018. They were both removed in 2019. 

The person who was detained, according to Germany's criminal police (Bundeskriminalamt), was supposedly the operator of the platform's third iteration, which was disassembled in March 2022. 72 of the marketplace's approximately 16,000 registered members were active dealers at the time.

An infamous British hacker was recently indicted in the US for operating the now-defunct The Real Deal dark web market, which offered narcotics and firearms in addition to hacking tools, botnets, and stolen account passwords.

~ Jai Krishna Ponnappan

A previously unseen dropper was found to install backdoors and other malicious software by reading instructions from ostensibly secure Internet Information Services (IIS) logs.

The threat actor known as Cranfly or UNC3524 is using the dropper, which Broadcom's Symantec threat hunting team has dubbed "Geppei," to install yet another piece of malware that has not yet been identified (Trojan.Danfuan). It was the first time the approach has been used in a real-world assault, according to Symantec.

The first mention of Cranefly was in a Mandiant report from May 2022. 

The group was seen concentrating on the emails of staff members involved in company growth, mergers and acquisitions (M&A), and significant corporate transactions.

According to Mandiant's analysis, the attackers stayed on the target networks for at least 18 months. To avoid discovery, they put backdoors on devices including SANS arrays, load balancers, and wireless access point controllers that didn't support security tools. In addition to the ReGeorg web shell being used as a secondary backdoor, Mandiant saw the attackers downloading a brand-new backdoor called QuietExit, which is based on the free and open-source Dropbear SSH client-server program.

The threat actors that carried out the assault that Symantec saw used the Geppei dropper, which makes use of PyInstaller to turn Python script into an executable file.

Geppei interprets instructions from an authentic IIS log. By posing as online access requests, the attackers may transmit orders to a hacked web server. Geppei can interpret them as commands even if IIS reports them normally. The instructions include maliciously encoded.ashx files that act as backdoors and are stored in any arbitrary folder chosen by the command argument.

"In IIS log files, the strings Wrde, Exco, and Cllo are not often seen. Geppei seems to utilize them to parse malicious HTTP requests, and the existence of these strings causes the dropper to perform actions on a system. IIS reports 404 errors in the same log file by default, which allows attackers to submit these instructions using a fake or even nonexistent URL, according to the researchers.

The dropper installs two payloads on the target computer: Danfuan, a previously unreported virus that functions as a backdoor on infected computers, and the well-known ReGeorg web shell, which may construct a SOCKS proxy.

"Cranefly seems to be a reasonably sophisticated threat actor based on the deployment of a unique approach and bespoke tools, as well as the measures taken to mask signs of this activity on victim PCs. The tools used and the measures taken to hide this behavior, together with the activities previously reported by Mandiant, suggest that the most probable goal for this group is intelligence collection, even if we do not see data being exfiltrated from victim PCs, according to Symantec.

~ Jai Krishna Ponnappan

Russian agents broke into the former British Prime Minister Liz Truss's personal phone, the Mail on Sunday said, citing persons familiar with the situation.

The cyber criminals apparently had access to private discussions and up to a year's worth of mails, as well as top-secret communications with important foreign partners. The texts are said to have included very private conversations concerning the conflict in Ukraine, including in-depth negotiations about armament supplies, with top international foreign ministers.

While serving as Foreign Secretary and Prime Minister, Liz Truss adopted a firm stance toward Vladimir Putin even though the UK has been one of the countries that has supported Ukraine the most.

When Liz Truss was the foreign secretary this summer, the hack was detected, but Boris Johnson, who was the prime minister at the time, hid the specifics of the event. The intrusion, according to a source, was so serious that the phone was kept in a locked safe within a guarded government building.

~ Jai Krishna Ponnappan

NIST researcher Cuong Nguyen contributed his testing knowledge to the OpenFMB PlugFest 2.0 in October 2022, which was sponsored by the Utility Communications Architecture International User's Group and held at the Duke Energy Mount Holly facility in North Carolina.

A "plugfest" is essentially a gathering of vendors and utilities to test whether the equipment will function and communicate with one another as required, lowering the possibility of having to make expensive modifications after the equipment is bought and installed. 

The OpenFMB PlugFest 2.0 aimed to verify the connectivity to the power grid and cybersecurity capabilities of vendors' renewable energy products, or "distributed energy resources." 

Additionally, this plugfest evaluated the systems' performance in accordance with the OpenFMB Message Bus standard, which was approved by the North American Energy Standards Board. 

This standard covers a variety of operations, including detecting, regulating, and communicating with distributed energy resources.

Buyers may be certain that the equipment is compliant with the OpenFMB Message Bus standard since it has been tested and certified by vendors. 

The Battery Innovation Center, a laboratory with headquarters in Ohio, will conduct this testing and certification.

Nguyen served as the official third party technical observer to evaluate the standard's implementation towards testing accreditation in accordance with the ISO/IEC 17025 standard, which deals with how to set up testing programs, as NIST's lead for testing and certification of smart grid and distributed energy systems. Nguyen offered his skills in relation to what was required for:

Technical proficiency to test to the OpenFMB Message Bus standard; and Testing to provide quality assurance that equipment will meet the standard.

The certification procedure is being completed at the Battery Innovation Center. Nguyen will assist with the ANSI evaluation of the Center's technical prowess as well.

~ Jai Krishna Ponnappan

You may anticipate an uptick in crime whether you're going or staying home since criminals utilize the holidays to prey on gullible visitors and online shoppers.

Holiday travel has made airports busier than ever. You arrive at the boarding gate with more than an hour to wait before your flight home after standing in what seemed like never-ending queues.

While connected to a public Wi-Fi network without data encryption, you choose to examine a few emails.

Unfortunately, a rival is waiting to catch their trip home at the same airport.

While they wait, they continue to be logged into the same open Wi-Fi network as you and are collecting unencrypted network data.

They may observe every website you visit, which unintentionally divulges private information.

If you decide to travel over the holidays, you'll probably experience increased security risks from criminals who prey on gullible tourists.

Due to their lack of familiarity with the local area and their propensity to make expensive purchases, travelers are frequently the top targets for thieves. Pickpockets may target wallets, and criminals may try to break into vacation rentals or rented automobiles, as well as seize handbags or shopping bags.

Travelers should always be mindful of their surroundings and should refrain from wearing or carrying high-value things out in the open.

Those who travel should be cautious about cyberattacks when they are overseas.

Travelers are especially vulnerable to physical device theft, identity and data theft on public networks, 

malware installation, 

targeted ransom assaults, 

and cryptojacking, which uses a victim's device to mine cryptocurrency.

What can you do to safeguard your mobile device? 

Wireless local area networks that are open to the public and do not need a password are known as public Wi-Fi networks.

Unfortunately, a large number of public Wi-Fi access points and hotspots do not provide encryption.

While using public wireless networks while traveling is practical, sensitive data may be exposed if a mobile device is not adequately protected and connects to a public Wi-Fi hotspot.

This is because networks without data-in-transit security measures run the danger of having sensitive data on them being accessed by unwanted eavesdroppers.

Employees may work remotely from a variety of public locations, including hotels, airports, and coffee shops, using public Wi-Fi.

On their portable mobile devices, users of public Wi-Fi may hold private, sensitive, and/or confidential information, or they may utilize such devices to remotely access corporate resources.

If information is compromised, a business might suffer substantial injury, financial loss, or reputational damage.

What does listening in mean? 

A data-in-transit attack known as eavesdropping occurs when a third party intercepts, changes, or deletes data being transferred between two devices.

When a person connects to an unencrypted, unsafe network, an attack may take place.

An attacker would be aware of the domains, internet protocol (IP) addresses, and services (indicated by port numbers) to which the device connects; an attacker could use this knowledge for an adversary-in-the-middle attack against the device or the user even if the transmitted data was encrypted by the application.

Such exposure could potentially lead to the theft of personally identifiable data (PII).

Theft of PII is exceedingly risky and raises serious issues.

PII may take many different forms, including: 

login passwords, 

financial information, 

personal data, 

photographs, 

location information,

and special device identifiers like the International Mobile Equipment Identity (IMEI) 

and the Universal Device Identifier (UDID).

Once a malicious party has access to a user's login information and logs into their personal accounts and sites, they may do harm or steal personally identifiable information (PII).

This happens when the user's mobile device network data is not encrypted.

An opponent may intercept information exchanged over the Internet using public Wi-Fi.

Reduce the Threat 

Individuals or businesses may be careful to use secure connections to websites and services in order to lessen this hazard. Several alternatives include: 

A virtual private network (VPN) solution can guarantee that all data going to and coming from their apps is encrypted before it leaves the device;

Websites that utilize HTTPS, or Hypertext Transfer Protocol Secure, which is HTTP sent via Transport Layer Security, assist in maintaining the confidentiality and integrity of data and confirm website authentication;

Stay away from using unsecured public WiFi, such as those offered by hotels, airports, and cafés;

Enabling remote wiping on all devices;

Get business travel insurance to limit possible losses from lost or stolen data or equipment.

Public Wi-Fi networks might not offer data-in-transit protection, but with the right safeguards in place, their convenience can be used with greater assurance. Bring Your Own Device (BYOD) for mobile device security.

NIST Special Publication 1800-22 has further details on how to safeguard against these and other possible mobile risks.

Holiday Online Shopping Safety

Online Christmas shopping provides a perfect chance for crooks to use schemes and cyberattacks to target consumers and tourists. 

Your identity might be stolen, your credit card information could be used to make transactions, or harmful software could be installed on your personal devices. 

These frauds and schemes take many different shapes:

1. Internet fraud. 

Emails, advertisements, or dubious websites that offer sales, deals, and hard-to-find brand-name goods but, upon delivery, are not what was promised. 

Scams may also emerge as social media postings, often passing for holiday promotions or giveaways that promise coupons, gift cards, freebies, competitions, and fake or phony goods. 

These techniques often aim to deceive users into disclosing personal data that may be exploited for fraud or identity theft.

2. Phony charities 

False charities may be established by perpetrators to deceive people into giving to real charity organizations. 

Cold calls, email promotions, crowdfunding websites, phony social media profiles, and websites may all be used as means of solicitation.

3. Counterfeit gift cards 

Shoppers may get counterfeit emails, calls, or messages from people posing as friends asking them to buy several gift cards for either personal or professional reasons throughout the holiday season. 

The subsequent purchase of goods and services—which may or may not be legal—is made possible by the gift cards.

The following steps can help you avoid Holiday shopping frauds online:

Before entering financial or personal information on websites, be sure they are legitimate.

On your devices and in your personal and professional accounts, enable multi-factor authentication (MFA).

To create and preserve unique passwords, use strong passwords and a password manager.

If a deal seems too good to be true, it probably is, especially if the seller is unknown.

Avoid clicking links in emails or texts from unknown senders, and double-check any "known" senders.

Holiday Cyber Safety Tips For Your Home

Homes stuffed with presents and valuables make particularly attractive targets for thieves, whether you're traveling or remaining home for the holidays. 

These evildoers are probably on the lookout for locals who are taking lengthy vacations and leaving their houses unoccupied, making them easy targets for break-ins. 

It can already be too late by the time you discover a burglary has taken place.

While you are absent for short intervals at a time, burglars can target your automobile or home.

Criminals may follow you home from the shop after watching your social media to determine your purchases and travel plans.

Be on the lookout for people dumping pricey presents and goods. In one incident, two armed thieves entered a Los Angeles house during a party and took jewelry, phones, and other items from the visitors.

To keep your house secure throughout the holidays, take the following precautions:

Avoid posting about your trip on social media or posting notes on your door notifying your neighbors or delivery services of your absence. Instead, get in touch with them personally and give them instructions for the time being.

To create the illusion that someone is home, leave some lights on and/or a radio or TV on low level while you are gone.

Lock all windows and doors because opportunistic robbers often alter their targets when even a little amount of deterrent is present.

~ Jai Krishna Ponnappan

Cisco, a manufacturer of networking hardware, has issued a warning about two security flaws in its Cisco AnyConnect Secure Mobility Client for Windows that are being used in the public.

The two flaws, identified as CVE-2020-3433 and CVE-2020-3153, might let local attackers run arbitrary code on the system, conduct DLL hijacking attacks, and transfer files to system directories with SYSTEM rights.

Cisco released a fix for the issues in their AnyConnect Secure Mobility Client for Windows in 2020.

"The Cisco PSIRT learned of more attempts to exploit this issue in the wild in October 2022. In an updated security warning, Cisco said that it "continues to highly suggest that clients upgrade to a corrected software version to remedy this issue."

Two of the aforementioned issues have also been added to the list of known exploited vulnerabilities maintained by the US Cybersecurity and Infrastructure Security Agency (CISA).

~ Jai Krishna Ponnappan

Find Jai on Twitter | LinkedIn | Instagram

A new malvertising campaign distributing malicious Google Chrome and Microsoft Edge extensions that capture searchers' and browser data and insert affiliate links on web pages has been described in a study by Guardio Labs researchers.

The campaign was given the name "Dormant Colors" by the researchers since the majority of the extensions it uses provide color enhancement features and first install without any malicious code.

The report states that the attack "begins with the trickery malvertising campaign, continues with a clever novel way to side-load the real malicious code without anyone noticing (until now! ), and culminates with stealing not only your searches and browsing data, but also affiliation to 10,000 targeted sites — a capability that is easily leveraged for targeted spear phishing, account takeover, and credential extraction."

More than a million installations of at least 30 different variations of these extensions were seen by Guardio Labs in the official online shops for Chrome and Edge.

A malicious extension has a backbone of servers that gather data from millions of users, identify prospective targets, and let it to target particular users with a variety of social engineering attack vectors. It also has stealth modules for code update and telemetry collecting.

Ads that are meant to deceive a user into downloading an apparently innocent extension start the infection chain. The user is routed to yet another advertising after installing the extension, and at the same time, malicious scripts are side-loaded to alter the browser's behavior.

The extension will reroute search requests to provide results from websites connected to the extension's creator when it performs search hijacking. Through this approach, threat actors are able to make money from the selling of search data and ad impressions. The campaign also depends on connection with 10,000 specific websites to bring in extra money. Once a user clicks on a link from the list, they are sent to the same page, but this time there are affiliate links to the URL, making it look as though the affiliate guided the user. Therefore, the website's owners will get an affiliate fee for each transaction the user makes there.

The researchers noted that it is possible to quickly change the operation using the stealth update module and also directly on the server side to add other even more malicious flows. This includes showing phishing fake log-in pages in place of account login pages for domains like Facebook, Twitter, and even banks and organization cloud account portals, they said.

"This campaign is still active, changing domains, introducing new extensions, and adding additional color- and style-altering features that you can undoubtedly live without. Additionally, the code injection approach examined here has a wide infrastructure for evasion and mitigation, enabling future exploitation of the campaign for even more nefarious actions, according to a warning from Guardio Labs.

~ Jai Krishna Ponnappan

Find Jai on Twitter | LinkedIn | Instagram

The iOS and iPadOS operating systems of American tech giant Apple have been updated to fix 20 security flaws, including a zero-day bug that is said to have been actively used by hackers.

A local program may have been able to utilize the flaw (CVE-2022-42827), an out-of-bounds write problem, to run arbitrary code with kernel privileges.

Apple just states that it "is aware of a report that this problem may have been actively exploited" without providing any more information on who or when the vulnerability was exploited.

With its most recent patch, Apple has now fixed nine zero-day vulnerabilities since the year's beginning.

In addition to CVE-2022-42827, the iPhone manufacturer has patched a number of high-risk holes that might have led to man-in-the-middle (MitM) attacks or permitted remote code execution.

The affected devices include iPad Pro (all models), iPad Air (3rd generation and later), iPad (5th generation and later), and iPad mini (5th generation and later). The vulnerabilities affect iPhone 8 and later.

~ Jai Krishna Ponnappan

Find Jai on Twitter | LinkedIn | Instagram

The RomCom remote access virus is being distributed via a new spear-phishing effort that targets Ukrainian government entities, according to the Computer Emergency Response Team of Ukraine (CERT-UA) (RAT).

The effort makes use of spear-phishing emails purporting to be from the General Staff of the Ukrainian Armed Forces. The email has a bait document in Ukrainian named "aка 309.pdf" and an embedded link that goes to a phony website that informs users that their PDF Reader software needs to be updated. An executable file called "AcroRdrDCx642200120169 uk UA.exe" is loaded into the system when the download button is clicked.

When this file is run, another file called "rmtpak.dll," which is the RomCom RAT, is dropped.

This attack has been linked by CERT-UA to UNC2596 (Tropical Scorpius), a threat actor thought to be behind the Cuba ransomware.

The security team at BlackBerry, who published their own technical study on this issue, claims that in addition to Ukraine, the RomCom threat actor also targets food brokers, IT firms, and food production in the US, Brazil, and the Philippines.

~ Jai Krishna Ponnappan

Find Jai on Twitter | LinkedIn | Instagram

The Iranian Nuclear Power Production and Development Company's internal email system was compromised, according to a hacktivist group going by the name "Black Reward," which also said it would release photos of Iran's nuclear facilities and at least 50GB of data from the country's atomic energy organization (AEOI).

The organization expressed support for the current demonstrations in Iran, which were started by the murder of Mahsa Amini, 22, on September 16 while she was being held by Iran's morality police after being detained for allegedly breaking the nation's stringent dress code for women.

Internal emails, contracts, and construction plans pertaining to the "management and operational schedules of different parts of the Bushehr power plant" as well as "atomic development contracts and agreements with domestic and foreign partners" are reportedly among the documents that have been made public.

Despite acknowledging the breach, the nuclear agency played down the event, claiming that "these illicit actions out of despair are intended to gain public attention." The AEOI did not identify the foreign nation it suspects of being responsible for the assault.

In related news, the Iranian group "Emennet Pasargad" has been conducting hack-and-leak operations against US and Israeli entities, according to a security notice issued by the US Federal Bureau of Investigation (FBI) last week. Emennet has been using cyber-enabled information operations to target organizations, primarily in Israel, since at least 2020. These operations typically involve an initial intrusion, data theft, and subsequent data leak, followed by amplification through social media and online forums and, in some cases, the use of destructive encryption malware.

The Daixin Team, a cybercrime gang that actively targets US businesses, primarily in the healthcare sector, with ransomware and data extortion operations, was also profiled in a joint advisory published by the US cybersecurity and intelligence agencies.

~ Jai Krishna Ponnappan

Find Jai on Twitter | LinkedIn | Instagram