admin

Over 1 million registered domains could be vulnerable to a cyberattack method known as “Sitting Ducks,” as recently unveiled in a new report from Infoblox Threat Intel. This relatively unknown attack vector allows malicious actors to hijack legitimate domains by exploiting misconfigurations in DNS settings. The Sitting Ducks attack, which has been active since 2018, enables threat actors to gain full control of a domain by taking over its DNS configurations. Infoblox’s monitoring initiative identified approximately 800,000 vulnerable domains, with about 70,000 of those already hijacked. Threat Groups Several threat actor groups have been exploiting this attack vector: The attack is particularly dangerous due to its stealthy nature. Hijacked domains often retain their positive reputation which allows them to evade detection by security tools. This makes it challenging for security teams to identify and mitigate the threat. The impact of Sitting Ducks attacks is far-reaching, affecting organizations, individuals, and security teams. Businesses face reputational damage, while individuals risk malware infections, credential theft, and fraud. Security teams struggle to defend against these attacks due to the use of trusted domains in malicious infrastructure. To protect against Sitting Ducks attacks, domain holders, registrars, and DNS providers must ensure correct configurations and implement proper ownership verification processes. Increased awareness and vigilance within the cybersecurity community are crucial to addressing this growing threat. Credit: Cybersecurity News

A new wave of international law enforcement actions has led to four arrests and the takedown of nine servers linked to the LockBit (aka Bitwise Spider) ransomware operation, marking the latest salvo against what was once a prolific financially motivated group. This includes the arrest of a suspected LockBit developer in France while on holiday outside of Russia, two individuals in the U.K. who allegedly supported an affiliate, and an administrator of a bulletproof hosting service in Spain used by the ransomware group, Europol said in a statement. In conjunction, authorities outed a Russian national named Aleksandr Ryzhenkov (aka Beverley, Corbyn_Dallas, G, Guester, and Kotosel) as one of the high-ranking members of the Evil Corp cybercrime group, while simultaneously painting him as a LockBit affiliate. Sanctions have also been announced against seven individuals and two entities linked to the e-crime gang. “The United States, in close coordination with our allies and partners, including through the Counter Ransomware Initiative, will continue to expose and disrupt the criminal networks that seek personal profit from the pain and suffering of their victims,” said Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence, Bradley T. Smith. The development, part of a collaborative exercise dubbed Operation Cronos, comes nearly eight months after LockBit’s online infrastructure was seized. It also follows sanctions levied against Dmitry Yuryevich Khoroshev, who was revealed to be the administrator and individual behind the “LockBitSupp” persona. A total of 16 individuals who were part of Evil Corp have been sanctioned by the U.K. Also tracked as Gold Drake and Indrik Spider, the infamous hacking crew has been active since 2014, targeting banks and financial institutions with the ultimate goal of stealing users’ credentials and financial information in order to facilitate unauthorized fund transfers. The group, responsible for the development and distribution of the Dridex (aka Bugat) malware, has been previously observed deploying LockBit and other ransomware strains in 2022 in order to get around sanctions imposed against the group in December 2019, including key members Maksim Yakubets and Igor Turashev. Ryzhenkov has been described by the U.K. National Crime Agency (NCA) as Yakubets’ right-hand man, with the U.S. Department of Justice (DoJ) accusing him of deploying BitPaymer ransomware to target victims across the country since at least June 2017. “Ryzhenkov used the affiliate name Beverley, made over 60 LockBit ransomware builds and sought to extort at least $100 million from victims in ransom demands,” officials said. “Ryzhenkov additionally has been linked to the alias mx1r and associated with UNC2165 (an evolution of Evil Corp affiliated actors).” Additionally, Ryzhenkov’s brother Sergey Ryzhenkov, who is believed to use the online alias Epoch, has been linked to BitPaymer, per cybersecurity firm Crowdstrike, which assisted the NCA in the effort. “Throughout 2024, Indrik Spider gained initial access to multiple entities through the Fake Browser Update (FBU) malware-distribution service,” it noted. “The adversary was last seen deploying LockBit during an incident that occurred during Q2 2024.” Notable among the individuals subjected to sanctions are Yakubets’ father, Viktor Yakubets, and his father-in-law, Eduard Benderskiy, a former high-ranking FSB official, underscoring the deep connection between Russian cybercrime groups and the Kremlin. “The group were in a privileged position, with some members having close links to the Russian state,” the NCA said. “Benderskiy was a key enabler of their relationship with the Russian Intelligence Services who, prior to 2019, tasked Evil Corp to conduct cyber attacks and espionage operations against NATO allies.” “After the U.S. sanctions and indictments in December 2019, Benderskiy used his extensive influence with the Russian state to protect the group, both by providing senior members with security and by ensuring they were not pursued by Russian internal authorities.” Credit: The Hacker News

Data breaches are becoming an expensive predicament for all of us, even if your data isn’t directly stolen in a breach. The latest IBM 2024 Cost of a Data Breach Report, released in July, reveals that when companies suffer these breaches, they often pass the hefty costs onto their customers. And data breaches are becoming extremely pricey, especially for small and medium sized businesses. The cost of data breaches According to the report, the global average cost of a data breach in 2024 has skyrocketed to $4.88 million! That’s a staggering 10% jump from the previous year! This study was carried out by the Ponemon Institute and sponsored and analyzed by IBM. It took a deep dive into data breaches at 604 organizations worldwide. They talked to over 3,500 security and business leaders who lived through these breaches to get the inside scoop.  Why are data breaches so expensive? Lost business, including downtime and customers going elsewhere, is a huge factor driving the increase. So is the cost of responding to the breach, including staffing up customer service help desks and regulatory fines for failing to protect data. Who pays the price? You do. Here’s where it gets personal: more than half of the organizations hit by data breaches pass those costs directly to consumers by charging more for goods and services. That’s right, when a company gets hacked, most will raise their prices to cover the damages. This year, 63% of businesses said they’re upping prices because of data breaches, compared to 57% last year. While many factors contribute to products becoming more expensive, data breaches are part of the equation in many cases now. The human factor One big reason these breaches are so costly is that cybersecurity teams are often understaffed. Over half of the companies surveyed said they’re struggling with severe staffing shortages in their security departments. And as companies rush to adopt new AI technologies, the pressure on these already overwhelmed teams is only increasing. What are hackers stealing? The report found that nearly half (46%) of all data breaches involve customer personal information like Social Security numbers, emails, phone numbers, and home addresses. Intellectual property, like trade secrets, was stolen in 43% of breaches. The financial fallout The costs associated with data breaches aren’t just about fixing the security hole. Businesses hemorrhage money due to system downtime, losing customers, and damaging their reputation. They also spend big on setting up call centers, providing credit monitoring services, and paying regulatory fines. This year, these lost business and response costs totaled a whopping $2.8 million per breach, the highest in the last six years. What helps and what hurts The report also examined what factors can make these costs go up or down.   What saved money?   What increased costs?  What can we do?  Understanding the dynamics of data breaches and increased customer prices is crucial. Businesses need to invest in strong cybersecurity measures and train their employees well. Making security systems easier for everyone to understand and addressing the cybersecurity skills gap can also help reduce the impact of breaches. The 2024 report is a stark reminder of how interconnected our economy is and why robust cybersecurity is more important than ever. Credits: Stay Safe Online

An enormous amount of sensitive information including Social Security numbers for millions of people could be in the hands of a hacking group after a data breach and may have been released on an online marketplace, The Los Angeles Times reported this week. The hacking group USDoD claimed it had allegedly stolen personal records of 2.9 billion people from National Public Data, according to a class-action lawsuit filed in U.S. District Court in Fort Lauderdale, Florida, reported by Bloomberg Law. The breach was believed to have happened in or around April, according to the lawsuit. Here’s what to know about the alleged data breach. Social security hack:National Public Data confirms massive data breach included Social Security numbers. What information is included in the data breach? The class-action law firm Schubert, Jonckheer & Kolbe said in a news release that the stolen file includes 277.1 gigabytes of data, and includes names, address histories, relatives and Social Security numbers dating back at least three decades. According to a post from a cybersecurity expert on X, formerly Twitter, USDoD claims to be selling the 2.9 billion records for citizens of the U.S., U.K. and Canada on the dark web for $3.5 million. Since the information was posted for sale in April, others have released different copies of the data, according to the cybersecurity and technology news site Bleeping Computer. A hacker known as “Fenice” leaked the most complete version of the data for free on a forum in August, Bleeping Computer reported. The news you need to start your day smart. Sign up for USA TODAY’s Daily Briefing newsletter. 2025 COLA:Estimate dips with inflation, but high daily expenses still burn seniors What is National Public Data? National Public Data is a Florida-based background check company operated by Jerico Pictures, Inc. USA TODAY has reached out to National Public Data for comment. The company has not publicly confirmed a data breach, but The Los Angeles Times reported that it has been telling people who contacted via email that “we are aware of certain third-party claims about consumer data and are investigating these issues.” What to do if you suspect your information has been stolen If you believe your information has been stolen or has appeared on the dark web, there are a few steps you can take to prevent fraud or identity theft. We recommend taking the following steps: Credits: USA Today