Cyber Training Group International (CTGI)

Tag: data breach

  • Beware of Computer Worms

    Beware of Computer Worms

    The first computer worm to spread extensively across the internet was the Morris Worm, released on November 2, 1988.

    This computer worm was created by Robert Tappan Morris, a graduate student at Cornell University, it was originally designed as an experiment to gauge the size of the early internet. However, a design flaw caused it to replicate much faster than intended, leading to the first major cyberattack in history.

    Within 24 hours, it infected approximately 6,000 computers, which was about 10% of the internet at the time. It exploited vulnerabilities in the Unix operating system, specifically in programs like sendmail and the finger service. The worm didn’t delete data, but it reinfected machines multiple times, consuming so much processing power that it caused systems to crash or become unusable.

    SO WHAT IS A COMPUTER WORM?

    A computer worm or digital worm is a standalone malware computer program designed to replicate itself and spread across networks without requiring human interaction.

    However, unlike computer viruses, these digital worms don’t require a host file or program to latch onto. Instead, they exist as self-contained files or scripts.

    While both are types of malicious software (malware) that replicate themselves and damage computer systems, the main difference is how they spread. Computer viruses require a “host” and human interaction to spread, whereas computer worms are standalone programs that spread by themselves across networks.


    WHAT ARE THE MAIN DIFFERENCES BETWEEN A COMPUTER VIRUS AND A
    COMPUTER WORM?

    Computer Virus
    A computer virus attaches itself to a clean computer program or file (host) and hides there. It stays completely still until a user accidentally opens the infected file or runs the program. Once activated, the virus infects other files and spreads when the user shares those files with others. Computer virus takes time to spread because it relies on human movement.


    Computer Worms
    A computer worm is a standalone, independent program. It does not need a host file to exist, nor does it need you to click anything. Once a computer worm gets onto your device (often through a network connection or software loophole), it replicates itself and spread automatically. Computer worms spread rapidly through network connections such as the internet and Local Area Network.

    Internet Image
    Computer Worms can spread across the Internet and Local Area Network.


    Both computer worm and computer virus can harm your device, delete files, or steal personal information.
    To keep your devices and data safe while browsing, you don’t need to be a tech expert—you just need to stay alert. Here are the most effective habits to adopt:

    1. Check for the “Padlock”
    Always look at the address bar for HTTPS (and the padlock icon) before entering any passwords or credit card info. This means your connection is encrypted, making it much harder for hackers to “listen in” on your data.

    2. Be Skeptical of Links and Pop-ups
    Think before you click:     Hover your mouse over a link to see the actual URL destination in the bottom corner of your browser. If it looks gibberish or slightly misspelled (like g00gle.com instead of google.com), stay away.

    Avoid “Free” Traps: Sites offering free movie streams or cracked software are prime breeding grounds for the worms and viruses we discussed.

    3. Use a Password Manager
    Reusing the same password is a huge risk. Use a password manager (like Bitwarden, Google Password Manager or 1Password) to create and store unique, complex passwords for every site. This way, if one site gets hacked, your other accounts stay safe.

    4. Enable Two-Factor Authentication (2FA)
    Even if a hacker gets your password, 2FA acts as a second lock. Always choose an authenticator app or a security key over SMS (text) codes when possible, as they are more secure.

    5. Keep Your Browser Updated
    Those “Update Available” pop-ups are actually critical. They often contain security patches for newly discovered vulnerabilities that hackers are already trying to exploit.

    6. Use an Ad Blocker
    Many malicious scripts (malvertising) are delivered through shady ads. Using an extension like uBlock Origin can stop these scripts from even loading on your page.

    Experts are warning about computer “worms” created with AI that can infect devices and harm users without restraint. University of Toronto professor Nicolas Papernot joins with more. Credits: CBS NEWS

    TYPES OF COMPUTER WORMS

    1) Email Worms
    Also called mass-mailer worms, they propagate by sending copies of themselves (whether as email attachments or malicious links). Upon opening the file or clicking on the link, a worm will activate, and it will have access to contacts of the recipient to continue spreading.


    2) File-sharing Worms
    Since file-sharing worms allow infected users to hide behind the guise of real media files, they are shared in filesharing aids. Once the file is downloaded by a user, the worm turns the device into an evil server that may accumulate personal data or credentials to be used or sold.

    3) Crypto Worms
    Crypto worms are like ransomware. They spread through systems, encrypt files of users, and then request that decryption key be returned by payment, typically in cryptocurrency. These worms can lock down entire networks if not contained.

    4) Internet Worms
    This category of Computer Worms has the specific purpose of targeting widely used websites with weak Cyber Security measures. The goal of these worms is to infiltrate the website’s system, which then allows them to spread to any computer that has accessed the site and infect them as well.

    5) Instant Messaging Worms
    The worms sent by Instant Messaging Worms exploit an instant messaging program and social media by spitting off impersonation links or files sent by a trusted source. They are usually filled with clickbait, making a user unintentionally infect himself or herself and share it with others.

    6) IRC Worms
    Internet Relay Chat (IRC) Worms spread into chat rooms or forums through the vulnerability of IRC clients. They transmit virulent links or move orders to the people and propagate at high-speed using real-time chats.

    7) P2P Worms
    P2P Worms take advantage of peer-to-peer file-sharing programs by assuming the form of desirable downloadable content. After being downloaded, they multiply through shared folders and also linked users, so infection becomes widespread even without the knowledge of the user.


    Computer Worm Examples

    1) Morris (1988)
    Created by Robert Morris, this worm unintentionally overloaded 6,000 UNIX Operating Systems leading to crashes and damages up to £8 million.

    2) Mydoom (2004)
    Targeting Windows systems, Mydoom became one of the fastest-spreading worms, causing an estimated £30 billion in damages. It persists, accounting for a significant portion of malicious emails.

    3) Storm Worm (2007)
    Storm Worm was carried by emails with eye catching headlines like 230 killed as storm swept Europe which even fooled the user into clicking. After activation, it infected systems, making them a botnet to send spam and attack computers with millions of computers.

    4) ILOVEYOU (2020)
    ILOVEYOU was a love letter worm which made itself known as a love letter, also called the Love Bug. It hit more than 50 million devices within two weeks of its outbreak and resulted in clean-up and recovery costs which amount to about 12 billion pounds.

    5) Conficker
    Also referred to as Downup or Kido, Conficker exploited vulnerabilities in Microsoft Windows to spread rapidly. It infected millions of computers across more than 100 countries. It disrupted networks worldwide and demonstrated how unpatched systems can be compromised at a massive scale.

    6) Code Red
    Code Red was a widespread Computer Worm that emerged in 2001, infecting more than 300,000 systems. It targeted Microsoft IIS web servers and generated massive traffic from compromised machines, even overwhelming high-profile websites such as that of the White House.

    How do I know if I have a computer worm?

    Computer worms are a type of self-replicating malware. Because they consume resources and spread without your knowledge, they typically leave behind specific red flags.

    Signs of a Computer Worm Infection

    1. Sudden Performance Drops: Unusually high CPU usage, frequent freezing, or a sluggish system.
    2. Rapidly Disappearing Hard Drive Space: Because worms replicate repeatedly, they can eat up large chunks of your storage.
    3. Network Activity Outburst: Your internet becomes incredibly slow, or you notice unusually high network traffic even when you aren’t browsing.
    4. Unfamiliar Emails: People in your contact list receive strange or spam emails that you never sent.
    5. Missing or Strange Files: System files go missing, or you notice unknown programs/folders suddenly appearing on your hard drive.
    6. Programs Running Automatically: Web browsers or programs launching on their own without you clicking them.

    How to Confirm and Remove the Worm

    Disconnect the Network: Unplug your Ethernet cable or turn off Wi-Fi. This isolates the computer worm so it cannot infect other devices.

    1. Run an Offline Antivirus Scan:
    • Windows: Open the Windows Security app, go to Virus & threat protection > Scan options, and select Microsoft Defender Antivirus offline scan. The PC will restart and perform a deep, 15-minute scan while the malware is inactive.

    2. Check Task Manager:

    • Press Ctrl + Shift + Esc to open Task Manager.
    • Look for any unusual processes taking up massive amounts of
      memory or using unfamiliar names.
    • If you spot a suspicious process, right-click and open its file
      location to delete it.

    3. Use an On-Demand Scanner:

    • Once you have completed the built-in scan, download a reliable
      on-demand tool like Malwarebytes.
    • Free Scan to catch anything the primary antivirus might have
      missed.

  • How to Avoid Social Security Scams: Spot the Red Flags and Protect Yourself

    How to Avoid Social Security Scams: Spot the Red Flags and Protect Yourself

    Social Security scams are one of the most common and costly forms of fraud targeting Americans today.

    Criminals impersonate officials from the Social Security Administration (SSA), the Office of the Inspector General (OIG), or even the U.S. Department of Justice (DOJ) to try to trick you into handing over money or personal information. 

    These scams can arrive by phone, email, text, letter, or social media message. The scammers may even use real employee names, spoof government phone numbers, or send official-looking documents to gain your trust. 

    However, once you know the warning signs, you can protect yourself and help spread awareness to your friends and loved ones. 

    4 signs you’re dealing with a Social Security scam 

    Most Social Security-related scams follow a similar playbook. Watch out if you begin getting messages and they follow a pattern: 

    1. They pretend to be from a government agency you know, especially SSA or OIG. 
    2. They say there’s a problem or prize, like suspicious activity on your Social Security number or a sudden benefit increase. 
    3. They pressure you to act immediately, creating a sense of panic. 
    4. They tell you to pay in a specific, and often strange, way, like gift cards, cryptocurrency, wire transfers, or mailing cash. 

    Now, scammers are constantly evolving their playbook. But the reddest flag to look out for is the sense of urgency – the idea that something really good or really bad is about to happen, and you need to act fast. Scammers play on your emotions to try to get you to act before thinking.  

    What Social Security will never do 

    If you get a suspicious message, remember:

    • SSA will never threaten you with arrest or legal action for not paying immediately.
    • SSA will never suspend your Social Security number.
    • SSA will never ask for payment to activate a cost-of-living adjustment (COLA) or benefit increase.
    • SSA will never demand secrecy or direct message you on social media. 
    • SSA will never request payment via gift cards, prepaid debit cards, wire transfer, cryptocurrency, or cash in the mail.

    If someone does any of the above, stop replying. They’re a scammer. 

    Also Read: Online Safety Tips For Older Adults

    The Social Security scammer bag of tricks 

    Criminals keep updating their tactics and some can be scarily convincing. You might encounter: 

    • Spoofed phone numbers that look like government or local police lines. 
    • Fake social media accounts using SSA logos, photos, and jargon. 
    • Official-looking documents sent through email, text, or postal mail. 
    • AI-powered scams, including voice cloning, to make fake messages sound more convincing. 

    To verify SSA’s official social media accounts, visit: Social Media Hub | SSA  

    How to protect yourself from Social Security scams 

    If you get an unexpected message claiming to be from SSA: 

    1. Stay calm. Scammers often create urgency to cloud your judgment. 
    2. Hang up or ignore the message. Don’t click links or open attachments. Initiate communication with SSA through official channels. 
    3. Don’t send money. Never send payment in untraceable ways like gift cards, crypto, or wire transfers. 
    4. Guard your personal information. If the message mentions a problem you’ve never heard of, especially if they already know some of your personal details, be skeptical. 
    5. Spread the word. Share scam warnings with friends and family, especially seniors who are frequent targets. 

    How to report a Social Security scam

    Reporting scams helps authorities track criminals and warn others.

    • Report directly to SSA OIG 
    • If you’re unsure what type of scam it is, use the USA.gov scam reporting tool to find the right agency 
    • You can report the scam to the FBI and other federal law enforcement agencies through IC3. 

    What to do if you’ve been scammed 

    If you think you’ve given money or personal information to a scammer: 

    • Stop all contact with them immediately. 
    • Notify the three credit bureaus, Equifax, Experian, and TransUnion, to place a fraud alert on your credit report. Freeze your credit with all three bureaus. 
    • Protect your Social Security number, although you may need to request a replacement card or new SSN. 
    • If money was stolen, contact your bank and local law enforcement for further steps. 

    Keep your Social Security safe 

    If someone claims to be from Social Security, pressures you to act fast, or asks for unusual payment – stop, hang up, and report it. The SSA will never threaten you, suspend your SSN, or demand payment through gift cards or cryptocurrency. When in doubt, assume it’s a scam.

    Credits: National Cybersecurity Alliance

  • Ethiopia, Uganda, Angola, Ghana, Nigeria top African countries targeted by threats

    Check Point Software Technologies released its Global Threat Index for December 2024, emphasising the growing sophistication of cybercriminals. For Africa, December was hardly a season to be jolly with eight of the continent’s countries listed among the top 20 most attacked.

    Ethiopia retained its top spot as the most attacked country with a 98.2% Normalised Risk Index out of the 106 countries featured in the Index.

    Other African countries featured in the top 20 are:

    Uganda at 8th place with a Normalised Risk Index of 68,2. 
    Angola at 9th place with a Normalised Risk Index of 66,2.
    Ghana at 11th position with a Normalised Risk Index of 62,7.
    Nigeria at 13th position with a Normalised Risk Index of 62,3, not too far from Ghana.
    Kenya’s Normalised Risk Index has increased since last month, moving from position 20 to 17 with a Normalised Risk Index of 57,6. 
    Mozambique comes in at position 18 with a Normalised Risk Index of 56,9.
    In 20th position with a higher Normalised Risk Index than last month is Cote d’Ivoire with 55,6.
    In December, the malware focus was on the rise due to FunkSec, an emerging ransomware-as-a-service, RaaS operator leveraging Artificial Intelligence, alongside persistent threats from malware families like FakeUpdates and AgentTesla. Data from ransomware shame sites reveals FunkSec as the most active group in December, responsible for 14% of all published attacks.

    Linked to Algeria, FunkSec appears driven by financial gain and hacktivist ideologies, with its AI-assisted tactics pointing to the increasing use of advanced technologies in cybercrime.

    FunkSec’s operations have thrust it to the forefront of double-extortion ransomware groups. Publishing over 85 victims in December 2024 alone, FunkSec has surpassed its competitors in volume. However, Check Point Research has flagged many of these claims as recycled or unverified, raising doubts about the group’s credibility

    Among the most prevalent malware threats, FakeUpdates reclaimed the top spot globally, affecting 5% of organisations worldwide, followed closely by AgentTesla, 3% and Androxgh0st, 3%. FakeUpdates, also known as SocGholish, remains a versatile downloader that introduces additional malicious payloads, while AgentTesla continues to target sensitive credentials.

    Maya Horowitz, VP of Research at Check Point Software, commented on the findings. “The latest trends in cybercrime underscore the importance of vigilance and innovation in cybersecurity. Organisations must leverage advanced threat prevention measures to protect themselves against the evolving landscape of sophisticated attacks.”

    Credits: Intelligent CIO

  • Grubhub says hack on third-party exposed information on campus customers

    The delivery service Grubhub said a hacker stole personal data and partial payment card information from customers through a third-party contractor.

    In a statement published on Monday evening, the company said it recently identified a security incident that “originated with an account belonging to a third-party service provider that provided support services to Grubhub.”

    The information stolen includes names, email addresses, phone numbers, card types and the last four digits of card numbers. The hackers also stole hashed passwords for some legacy systems used by Grubhub. 

    The company did not respond to requests for comment about how many people were affected, when the incident happened and who was behind the attack. 

    “We recently detected unusual activity within our environment traced to a third-party service provider for our Support Team. Upon discovery, we promptly launched an investigation, identifying unauthorized access to an account associated with this provider. We immediately terminated the account’s access and removed the service provider from our systems altogether,” the company said.

    Also Read: US Treasury says Chinese hackers stole documents in ‘major incident’

    “The unauthorized individual accessed contact information of campus diners, as well as diners, merchants and drivers who interacted with our customer care service.”

    It is unclear what campus Grubhub is referring to. The company runs a service specifically for college students on campuses around the U.S. 

    The company said it “took immediate action” to contain the attack and worked with experts to investigate the incident. Grubhub added that it is “confident that the incident has been fully contained.” They have rotated any passwords that may have been leaked, according to the statement. 

    The company claimed it has taken several other steps to secure its systems but did not elaborate on what measures have been instituted. 

    Grubhub is one of the world’s most popular food delivery apps, with more than 375,000 merchants serving over 4,000 U.S. cities. In November, Grubhub was sold by its Dutch owner to a company named Wonder for $650 million. 

    The company recently paid a $25 million penalty to settle charges from the Federal Trade Commission that it hid the cost of delivery from some customers, deceived workers about how much they would make from deliveries and listed restaurants without their permission as a pressure tactic.  

    The settlement was originally for $140 million but it was partially suspended because Grubhub could not pay the full amount. 

    Several other food delivery platforms have dealt with cyberattacks involving customer information, including Asian and Hispanic grocery service Weee!, PurFoods and others.

    Credit: The Record

  • US Treasury says Chinese hackers stole documents in ‘major incident’

    US Treasury says Chinese hackers stole documents in ‘major incident’

    WASHINGTON (Reuters) -Chinese state-sponsored hackers breached the U.S. Treasury Department’s computer security guardrails this month and stole documents in what Treasury called a “major incident,” according to a letter to lawmakers that Treasury officials provided to Reuters on Monday.

    The hackers compromised third-party cybersecurity service provider BeyondTrust and were able to access unclassified documents, the letter said.

    According to the letter, hackers “gained access to a key used by the vendor to secure a cloud-based service used to remotely provide technical support for Treasury Departmental Offices (DO) end users. With access to the stolen key, the threat actor was able to override the service’s security, remotely access certain Treasury DO user workstations, and access certain unclassified documents maintained by those users.”

    “Based on available indicators, the incident has been attributed to a China state-sponsored Advanced Persistent Threat (APT) actor,” the letter said.

    The Treasury Department said it was alerted to the breach by BeyondTrust on Dec. 8 and that it was working with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI to assess the hack’s impact.

    Treasury officials didn’t immediately respond to an email seeking further details about the hack. The FBI did not immediately respond to Reuters’ requests for comment, while CISA referred questions back to the Treasury Department.

    “China has always opposed all forms of hacker attacks,” Mao Ning, a spokesperson for China’s foreign ministry, told a regular news conference on Tuesday.

    A spokesperson for the Chinese Embassy in Washington rejected any responsibility for the hack, saying that Beijing “firmly opposes the U.S.’s smear attacks against China without any factual basis.”

    A spokesperson for BeyondTrust, based in Johns Creek, Georgia, told Reuters in an email that the company “previously identified and took measures to address a security incident in early December 2024” involving its remote support product. BeyondTrust “notified the limited number of customers who were involved,” and law enforcement was notified, the spokesperson said. “BeyondTrust has been supporting the investigative efforts.”

    The spokesperson referred to a statement posted on the company’s website on Dec. 8 sharing some details from the investigation, including that a digital key had been compromised in the incident and that an investigation was under way. That statement was last updated on Dec. 18.

    Tom Hegel, a threat researcher at cybersecurity company SentinelOne, said the reported security incident “fits a well-documented pattern of operations by PRC-linked groups, with a particular focus on abusing trusted third-party services – a method that has become increasingly prominent in recent years,” he said, using an acronym for the People’s Republic of China.”

    Credit: Reuters

  • New LightSpy Spyware Version Targets iPhones with Increased Surveillance Tactics

    New LightSpy Spyware Version Targets iPhones with Increased Surveillance Tactics

    Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up.

    “While the iOS implant delivery method closely mirrors that of the macOS version, the post-exploitation and privilege escalation stages differ significantly due to platform differences,” ThreatFabric said in an analysis published this week.

    LightSpy, first documented in 2020 as targeting users in Hong Kong, is a modular implant that employs a plugin-based architecture to augment its capabilities and allow it to capture a wide range of sensitive information from an infected device.

    Attack chains distributing the malware leverage known security flaws in Apple iOS and macOS to trigger a WebKit exploit that drops a file with the extension “.PNG,” but is actually a Mach-O binary responsible for retrieving next-stage payloads from a remote server by abusing a memory corruption flaw tracked as CVE-2020-3837.

    This includes a component dubbed FrameworkLoader that, in turn, downloads LightSpy’s Core module and its assorted plugins, which have gone up significantly from 12 to 28 in the latest version (7.9.0).

    “After the Core starts up, it will perform an Internet connectivity check using Baidu.com domain, and then it will check the arguments that were passed from FrameworkLoader as the [command-and-control] data and working directory,” the Dutch security company said.

    “Using the working directory path /var/containers/Bundle/AppleAppLit/, the Core will create subfolders for logs, database, and exfiltrated data.”

    The plugins can capture a wide range of data, including Wi-Fi network information, screenshots, location, iCloud Keychain, sound recordings, photos, browser history, contacts, call history, and SMS messages, as well as gather information from apps like Files, LINE, Mail Master, Telegram, Tencent QQ, WeChat, and WhatsApp.

    Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.

    The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.

    Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.

    The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.

    Credit: The Hacker News

  • Microsoft Reveals macOS Vulnerability that Bypasses Privacy Controls in Safari Browser

    Microsoft has disclosed details about a now-patched security flaw in Apple’s Transparency, Consent, and Control (TCC) framework in macOS that has likely come under exploitation to get around a user’s privacy preferences and access data.

    The shortcoming, codenamed HM Surf by the tech giant, is tracked as CVE-2024-44133 (CVSS score: 5.5). It was addressed by Apple as part of macOS Sequoia 15 by removing the vulnerable code.

    HM Surf “involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent,” Jonathan Bar Or of the Microsoft Threat Intelligence team said.

    Microsoft said the new protections are limited to Apple’s Safari browser, and that it’s working with other major browser vendors to further explore the benefits of hardening local configuration files.

    HM Surf follows Microsoft’s discovery of Apple macOS flaws like Shrootless, powerdir, Achilles, and Migraine that could enable malicious actors to sidestep security enforcements.

    While TCC is a security framework that prevents apps from accessing users’ personal information without their consent, the newly discovered bug could enable attackers to bypass this requirement and gain access to location services, address book, camera, microphone, downloads directory, and others in an unauthorized manner.

    The access is governed by a set of entitlements, with Apple’s own apps like Safari having the ability to completely sidestep TCC using the “com.apple.private.tcc.allow” entitlement.

    While this allows Safari to freely access sensitive permissions, it also incorporates a new security mechanism called Hardened Runtime that makes it challenging to execute arbitrary code in the context of the web browser.

    That said, when users visit a website that requests location or camera access for the first time, Safari prompts for access via a TCC-like popup. These entitlements are stored on a per-website basis within various files located in the “~/Library/Safari” directory.

    The HM Surf exploit devised by Microsoft hinges on performing the following steps –

    • Changing the home directory of the current user with the dscl utility, a step that does not require TCC access in macOS Sonoma
    • Modifying the sensitive files (e.g., PerSitePreferences.db) within “~/Library/Safari” under the user’s real home directory
    • Changing the home directory back to the original directory causing Safari to use the modified files
    • Launching Safari to open a web page that takes a snapshot via the device’s camera and grab the location

    The attack could be extended further to save an entire camera stream or stealthily capture audio through the Mac’s microphone, Microsoft said. Third-party web browsers don’t suffer from this problem as they do not have the same private entitlements as Apple applications.

    Microsoft noted it observed suspicious activity associated with a known macOS adware threat named AdLoad likely exploiting the vulnerability, making it imperative that users take steps to apply the latest updates.

    “Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the AdLoad campaign is exploiting the HM surf vulnerability itself,” Bar Or said. “Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique.”

    Credit: The Hacker News

  • INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa

    INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa

    INTERPOL has announced the arrest of eight individuals in Côte d’Ivoire and Nigeria as part of a crackdown on phishing scams and romance cyber fraud.

    Dubbed Operation Contender 2.0, the initiative is designed to tackle cyber-enabled crimes in West Africa, the agency said.

    One such threat involved a large-scale phishing scam targeting Swiss citizens that resulted in financial losses to the tune of more than $1.4 million.

    The cybercriminals posed as buyers on small advertising websites and used QR codes to direct victims to fraudulent websites that mimicked a legitimate payment platform.

    This allowed victims to inadvertently enter personal information such as their credentials or card numbers. The perpetrators also impersonated the unnamed platform’s customer service agents over the phone to further deceive them.

    As many as 260 scam reports are said to have been received by Swiss authorities between August 2023 and April 2024, prompting a collaborative investigation that traced the roots of the campaign to Côte d’Ivoire.

    The main suspect behind the attacks confessed to the scheme and making illicit financial gains of over $1.9 million. Five other individuals conducting cybercriminal activities at the same location have also been arrested.

    In a separate case, authorities said they apprehended a suspect and their accomplice in Nigeria on April 27, 2024, in connection with a romance scam after Finnish authorities alerted the Nigerian Police Force via INTERPOL that a victim was scammed out of a “substantial amount of money.”

    Such financial grooming crimes entail scammers creating fake online identities on dating apps and social media platforms to develop romantic or close relationships with prospective victims, only to steal money from them.

    “Leveraging the increased reliance on technology in every aspect of our daily lives, cybercriminals are employing a range of techniques to steal data and execute fraudulent activities,” Neal Jetton, Director of the Cybercrime Directorate, said.

    “These recent successful collaborations, under the umbrella of Operation Contender 2.0, demonstrate the importance of continued international cooperation in combating cybercrime and bringing perpetrators to justice.”

    The development comes as the U.S. Department of Justice (DoJ) said a 45-year-old dual citizen of Nigeria and the United Kingdom, Oludayo Kolawole John Adeagbo, has been sentenced to seven years in prison for his role in a multimillion-dollar business email compromise (BEC) scheme.

    Adeagbo “conspired with others to participate in multiple cyber-enabled BEC schemes that defrauded a North Carolina university of more than $1.9 million, and attempted to steal more than $3 million from victim entities in Texas, including local government entities, construction companies, and a Houston-area college,” the DoJ said.

    It also follows an announcement from Meta that it’s teaming up with U.K. banks to combat scams on its platforms as part of an information-sharing partnership program dubbed Fraud Intelligence Reciprocal Exchange (FIRE).

    Credit: The Hackers News

  • Ticketmaster Data Breach May Affect More Than 500 Million Customers. What to Know

    Ticketmaster, a subsidiary of Live Nation, suffered a data breach, which may impact millions of customers.

    Live Nation confirmed in a regulatory filing with the U.S. Securities and Exchange Commission (SEC) on Friday that its subsidiary Ticketmaster has suffered a data breach.

    The filing stated that on May 20, the company noticed “unauthorized activity” within a database that contained “Company data” and subsequently “launched an investigation with industry-leading forensic investigators to understand what happened.” The filing went on to describe that on May 27, a “criminal threat actor” offered to sell, what it alleged to be, Ticketmaster data on “the dark web.”

    What do we know about the Ticketmaster data breach and the force behind it?

    Hackread reported on May 28 that the hacking group named ShinyHunters had claimed responsibility for the cyber-attack on the online forum BreachForums, a hacking website used to facilitate data breaches and the sharing of said data. In the post, the hacking group reportedly states it is seeking $500,000 for the 1.3TB database of compromised customer data, which it claims includes names, addresses, phone numbers, and credit card details of 560 million users.

    Live Nation’s regulatory filing does not state how many of its Ticketmaster users’ data has been compromised by the hack, nor does it confirm if ShinyHunters is the culprit. 

    TIME has reached out to Live Nation and Ticketmaster for comment and further information.

    In the filing, Live Nation stated it was “working to mitigate risk to [their] users” and was  cooperating with law enforcement officials. They went on to say that in their investigation, the breach was unlikely to make “a material impact on our overall business operations or on our financial condition or results of operations.”

    What can Ticketmaster customers do to protect themselves?

    In the aftermath of this breach, Ticketmaster users can protect themselves by staying vigilant against phishing attempts, monitor accounts and credit cards, and change passwords, using strong and unique alternatives.

    Live Nation and Ticketmaster have yet to release a public statement addressing the breach, but on Ticketmaster’s website blog in April, ahead of the data hack, they provided general advice on how to protect information and tickets. They advised users to make sure to get contact information only from Ticketmaster’s official website and to be aware of fake customer service phone numbers that could appear in search engines.

    Ticketmaster’s data breach comes at a trying time

    Ticketmaster specifically dominates the market for live events in the United States—so much so that on May 23, the U.S. Department of Justice (DOJ) sued Live Nation and Ticketmaster, accusing them of running an “illegal monopoly” over live events in America—destroying competition and driving up prices for fans.

    Per the complaint, in 2022 “Ticketmaster accounted for at least 70% of the total face value associated with all tickets sold at large arenas and amphitheaters.” In stark contrast, “no other rival ticketed more than 14%.”

    In the DOJ lawsuit, Live Nation is accused of multiple tactics, including using long-term contracts to keep venues from choosing rival ticketers, blocking venues from using multiple ticket sellers, and threatening venues that they could lose money and fans if they didn’t choose Ticketmaster.

    What do we know about ShinyHunters?

    The hacking group claiming responsibility, ShinyHunters, is well known for its data hacking of multiple companies in 2020 and 2021, including the Indonesian e-commerce site Tokopedia, the Indian education platform Unacademy, Wattpad, AT&T Wireless, and Microsoft. In January, one member of the ShinyHunters hacking group—a French citizen named Sebastien Raoult—was arrested and sentenced in U.S. District Court in Seattle to three years in prison.

    In a statement following the arrest, the Justice Department said that between April 2020 and July 2021, ShinyHunters posted sales of hacked data from more than 60 companies, and that they stole hundreds of millions of customer records and caused loss to victim companies that is estimated to exceed $6 million.

    Credit: Time.com

  • The Post Millennial hack leaked data impacting 26 million people

    Have I Been Pwned has added the information for 26,818,266 people whose data was leaked in a recent hack of The Post Millennial conservative news website.

    The Post Millennial is a conservative Canadian online news magazine belonging to the Human Events Media Group, which also operates the American ‘Human Events’ news platform.

    Earlier this month, both news platforms were hacked, with their sites’ front pages defaced with fake messages claiming to be written by The Post Millennial’s editor, Andy Ngo.

    As part of the attacks, the threat actors claim to have stolen the company’s mailing lists, subscriber database, and details of the company’s writers and editors, sharing links to the stolen data shared on the defaced pages.

    The data quickly spread online, being shared in torrents and hacking forums, allowing threat actors and others to download the data easily.

    Post Millennial hack

    The exposed data during the Post Millennial hack includes the following types of information:

    • Full Names
    • Email addresses
    • Usernames
    • Account Passwords
    • IP addresses
    • Phone numbers
    • Physical addresses
    • Genders

    This data allegedly belongs to writers, editors, and subscribers to the sites, which could create significant privacy and security risks to the exposed individuals.

    Yesterday, Troy Hunt added the data to the Have I Been Pwned data breach notification service, noting that the data has not been confirmed to have been stolen directly from Human Events or The Post Millennial.

    As the leaked data is for a considerable number of users, Hunt decided to add it to HIBP to alert those potentially exposed.

    Related News: Scammers can easily phish your multi-factor authentication codes. Here’s how to avoid it

    “The breach resulted in the defacement of the website and links posted to 3 different corpuses of data including hundreds of writers and editors (IP, physical address, and email exposed), tens of thousands of subscribers to the site (name, email, username, phone and plain text password exposed), and tens of millions of email addresses from several thousand mailing lists alleged to have been used by The Post Millennial (this has not been independently verified),” reads HIBP’s post.

    “The mailing lists appear to be sourced from various campaigns not necessarily run by The Post Millennial and contain a variety of different personal attributes including name, phone and physical address (depending on the campaign).”

    As tweeted by Troy Hunt, while the data was leaked as part of The Post Millennial defacement, it is unclear where it originated from.

    By the time of writing this, The Post Millennial has not issued a public statement regarding the site’s defacement or to warn its subscribers that data may have been exposed.

    BleepingComputer has contacted both The Post Millennial and Human Events for a comment but has not received a reply.

    In the meantime, reset your passwords and monitor account activity closely if you are a subscriber to the mentioned news outlets. Also, treat all communications (email, call, SMS) with vigilance.

    Credits: Bleeping Computer