2022-09-16
The USG has a database of info taken from travelers' phones at checkpoints, with the default to download contacts, call logs & messages—and they're adding up to 10K travelers' info annually. CBP officers can search without a warrant. @drewharwell reports https://www.washingtonpost.com/ ...
Washington Post
Senator Ron Wyden reveals the CBP told Congress it adds data from ~10K travelers' devices per year to a database, accessible by 2,700 officers without a warrant
2022-04-13
BREAKING: A man who went to North Korea to give a cryptocurrency talk, Virgil Griffith, is getting a 5yr sentence. Feds say he was helping NK skirt sanctions & could've helped NK's nuclear weapons program. Via me & @Jose_Pagliery @arawnsley @thedailybeast https://www.thedailybeast.com/ ...
CoinDesk
Former Ethereum developer Virgil Griffith is sentenced to 5+ years in prison and fined $100K for helping North Koreans use cryptocurrencies to evade sanctions
Griffith previously pleaded guilty to one count of conspiracy to violate international sanctions for giving a talk at a crypto conference in Pyongyang in 2019.
2021-11-09
New: Russian-linked hackers are dropping like flies: Two more hackers linked with REvil ransomware, who have taken half a million euros in ransom payments, have been rounded up, Europol announces just now: https://www.europol.europa.eu/ ...
The Record
Europol has arrested seven people suspected of helping REvil and GandCrab with over 7,000 cyberattacks since early 2019, in a Romanian-led investigation
Catalin Cimpanu / The Record :
New: Russian-linked hackers are dropping like flies: Two more hackers linked with REvil ransomware, who have taken half a million euros in ransom payments, have been rounded up, Europol announces just now: https://www.europol.europa.eu/ ...
CNN
US charges a Ukrainian suspect, arrested in Poland last month, and a Russian citizen over REvil attacks, and says it seized $6M in ransom payments
(CNN)Law enforcement officials have seized an estimated $6 million in ransom payments, and the US Justice Department is expected to announce Monday …
2021-10-05
Ransomware actors, they're just like us: Other footage Ukraine released today of the ransomware raid shows one suspect seems to have had a puppy, as well as multiple bouquets of flowers (roses?), kept loads of cash in a shoebox & had several laptops: https://www.youtube.com/... https://twitter.com/...
The Record
Europol announces the arrest of two alleged ransomware gang members in Ukraine, with help from US and French authorities, as some think they may belong to REvil
Two members of a ransomware gang were arrested in Ukraine following a joint international law enforcement operation. Source: Europol .
2021-07-22
New: A 22-year-old U.K. national was arrested today in Spain for alleged involvement in the Twitter hack a little over a year ago, per DOJ. DOJ says he's also hacked TikTok and Snapchat user accounts: https://www.justice.gov/...
Engadget
Spanish police have arrested UK citizen Joseph O'Connor at the US' request over his alleged involvement in last year's hack of high-profile Twitter accounts
Jon Fingas / Engadget :
2021-07-20
A senior admin official says in addition to the Microsoft Exchange Server hacking, U.S. & allies plan to lay out how China's MSS works thru criminal hackers: “MSS is using, knowledgeably, criminal contract hackers to conduct unsanctioned cyber operations globally,” https://twitter.com/...
The Record
DOJ unseals charges against four Chinese nationals, believed to be part of China-backed APT 40 hacking group; charging docs focus on activity from 2011 to 2018
The US Department of Justice has indicted four Chinese nationals today for hacking companies, government agencies …
2021-07-19
A senior admin official says in addition to the Microsoft Exchange Server hacking, U.S. & allies plan to lay out how China's MSS works thru criminal hackers: “MSS is using, knowledgeably, criminal contract hackers to conduct unsanctioned cyber operations globally,” https://twitter.com/...
Axios
US, NATO, and other allies collectively blame China for malicious cyberattacks, including a March attack that exploited a flaw in Microsoft's Exchange Server
The U.S., NATO and other allies are collectively calling out China for malicious cyberattacks, including a March attack that exploited a flaw in Microsoft's Exchange Server.
2021-07-16
Iranian hackers posing as American job recruiters have been targeting nearly 200 American & European defense industry employees, in the latest job recruiter hacking campaign, @arawnsley reports. @thedailybeast https://www.thedailybeast.com/ ...
Financial Times
Facebook says it stopped a campaign by Iranian hackers, targeting about 200 defense and aerospace personnel, primarily from the US, using fake online personas
Hannah Murphy / Financial Times :
2021-07-14
Exclusive: DOD's Cyber Command tried to put a dent in a transnational cybercrime gang's ops last year, but there are signs the gang is working behind the scenes, quietly updating malware to monitor victims & gather intel, researchers say. @thedailybeast https://www.thedailybeast.com/ ...
The Daily Beast
Bitdefender says hackers behind TrickBot botnet, which was disrupted by US Cyber Command and Microsoft last year, have quietly rebuilt much of their operations
2021-07-04
Kaseya has warned customers to shut down VSA servers “IMMEDIATELY.” DHS' @CISAgov is warning about the incident as well (link: https://us-cert.cisa.gov/... https://twitter.com/...
BleepingComputer
REvil is pushing ransomware via an update for Kaseya's IT management software, hitting hundreds of managed service providers with thousands of customers
A massive REvil ransomware attack affects multiple managed service providers and their clients through a reported Kaseya supply-chain attack.
2021-07-03
Kaseya has warned customers to shut down VSA servers “IMMEDIATELY.” DHS' @CISAgov is warning about the incident as well (link: https://us-cert.cisa.gov/... https://twitter.com/...
BleepingComputer
REvil is pushing ransomware via an update for Kaseya's IT management software, hitting eight or more large managed service providers with thousands of customers
A massive REvil ransomware attack affects multiple managed service providers and their clients through a reported Kaseya supply-chain attack.
2021-05-15
NSA Dir. Nakasone, also the commander of Cyber Command, DOD's offensive cyber unit, declines to comment on any potential ongoing/current response to Colonial Pipeline. “I won't get into any of the operations...right now” in response to a question from Matt Gaetz...
Elliptic Blog
Analysis: the wallet used by DarkSide received a total of $17.5M in Bitcoin transactions since March, including a 75 BTC payment made by Colonial
Elliptic's Co-founder and Chief Scientist discusses cryptocurrency forensics, investigations, compliance, and sanctions.
2021-01-02
New Microsoft alert on SolarWinds breach: “we discovered 1 account had been used to view source code in a number of source code repositories. The account did not have permissions to modify any code” — MSFT says its services & customer data aren't at risk. https://msrc-blog.microsoft.com/ ...
New York Times
Microsoft says SolarWinds hackers were able to view some of its source code by hacking into an employee account but were unable to modify code or access emails
The hackers gained more access than the company previously revealed, though the attackers were unable to modify code or access emails.
2021-01-01
New Microsoft alert on SolarWinds breach: “we discovered 1 account had been used to view source code in a number of source code repositories. The account did not have permissions to modify any code” — MSFT says its services & customer data aren't at risk. https://msrc-blog.microsoft.com/ ...
New York Times
Microsoft says SolarWinds hackers were able to view some of its source code by hacking into an employee account but were unable to modify code or access emails
The hackers gained more access than the company previously revealed, though the attackers were unable to modify code or access emails.
2020-12-09
A state-sponsored attacker has accessed FireEye's Red Team tools, which it uses to test customer security, & primarily sought info on gov customers. FEYE is releasing ways to detect use of the stolen tools to try neutralizing hackers' attempts to use them https://www.fireeye.com/...
Wall Street Journal
FireEye says some internal systems were hacked by nation state actors, compromising its Red Team tools, used to test the defenses of its thousands of customers
The cybersecurity company said the attack compromised its software tools used to test the defenses of its thousands of customers
2020-10-24
Ransomware has hit a county in Georgia & disrupted an IT system tied to election admin—the 1st known ransomware/election incident this cycle. Voters' ability to cast ballots likely unaffected, but the signature-matching process may be slowed via @brfreed https://statescoop.com/...
Reuters
Sources: the Louisiana National Guard was called in to stop cyberattacks aimed at small government offices in recent weeks, after a similar case in Washington
(Reuters) - The Louisiana National Guard was called in to stop a series of cyberattacks aimed at small government offices across …
2020-10-18
New Google TAG threat report notes after Treasury Dept sanctioned Andriy Derkach — a Ukrainian politician who the USG says is a Russian agent — for attempting to influence 2020 US elections, Google “removed 14 Google accounts that were linked to him” https://blog.google/...
CyberScoop
Google says Chinese state-linked hacker group, known as APT31, has been using malware on GitHub to upload and download files on networks in targeted attacks
Former vice president Joe Biden. Chinese hackers have unsuccessfully targeted the campaign, according to Google. (Flickr / Gage Skidmore)
2020-10-17
New Google TAG threat report notes after Treasury Dept sanctioned Andriy Derkach — a Ukrainian politician who the USG says is a Russian agent — for attempting to influence 2020 US elections, Google “removed 14 Google accounts that were linked to him” https://blog.google/...
CyberScoop
Google says Chinese state-linked hacker group, known as APT31, has been using malware on GitHub to upload and download files on networks in targeted attacks
Former vice president Joe Biden. Chinese hackers have unsuccessfully targeted the campaign, according to Google. (Flickr / Gage Skidmore)
2020-09-24
A must-read on Arkady Bukh, the “godfather of cybercriminal defense,” from @jeffstone500, who weaves a masterful tale about a decade of hacking, the fusion of nation-state espionage & crime, & pressures from Russian govt officials. Read on @CyberScoopNews https://www.cyberscoop.com/...
CyberScoop
How Arkady Bukh, a New York-based immigrant from the former Soviet bloc, emerged as the go-to defense lawyer for the cybercrime underworld
Jeff Stone / CyberScoop : Tweets: @jeffstone500 , @snlyngaas , @iblametom , @jgamblin , @jscros , @underworld_pod , and @shanvav . Thanks: @jwarminsky Tweets: Jeff Stone / @jeffst...