News

FBI Warns Business Email Compromise Scams Losses Have Increased Every Year

The US Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3) issued a PSA warning business that hackers are targeting cloud-based email services to steal money from the businesses that use them. Cyberattacks of this nature are known as Business Email Compromise (BEC) scams and accounted for $2.1 billion in reported losses between January 2014 and October 2019.

BEC scams often use a targeted phish kit, or spoofed backend, designed to look and function like the cloud-based email service. The targeted employee is tricked into giving up login credentials that leads to compromised business email accounts. The email account is scanned to look for evidence of financial transactions. In the end, the hacked email account is used to request or misdirect transfers of funds.

Cloud-based email services, like Microsoft Office 365, Amazon WorkMail, and Google G Suite, provide email service as well as shared calendars, file storage, and team messaging apps as subscription services. Some cloud-based services may also provide cyber security features like email phishing protection and two-factor or multi-factor authentication. Some of these features must be enabled by account administrators. Some cloud-based business email services charge more for these security features while others may provide these for no additional cost. These security features can help prevent BEC scams.

What are BEC Scams?

A Business Email Compromise occurs when a hacker gains access to a legitimate business email account and uses it to initiate or redirect an unauthorized money transfer to a bank account the hacker can access. The email accounts are often compromised using social engineering with information taken from corporate websites, press releases, or social media. BEC scams can also use information from malware attacks like infostealers and spyware.

Criminals impersonate email communications between compromised businesses, employees, business partners or third parties, such as vendors or customers. Businesses that routinely process electronic payments like wire transfers are typical targets of BEC scams.

In March 2020, the bookkeeper for Shark Tank host Barbara Corcoran was fooled into paying a fraudulent invoice. The malicious email appeared to come from Corcoran’s assistant and asked for payment for a real estate related transaction. This made sense for Corcoran’s line of work. But the nature of the email contained information that is easily gleaned from the internet especially when a high-profile person is targeted.

The creditor details were closely named for a German company Corcoran actually does business with. So, the bookkeeper paid it without verifying the email sender or the company requesting payment. Fortunately, they realized the error and with the cooperation of a German bank, the $388,700 wire transfer was recovered.

“Losses from BEC scams overall have increased every year since IC3 began tracking the scam in 2013. BEC scams have been reported in all 50 states and in 177 countries. Small and medium-size organizations, or those with limited IT resources, are most vulnerable to BEC scams because of the costs of robust cyber defense.” the FBI said in the PSA.

Recommendations for Cloud Email Users
It is important to protect account login credentials. Often humans are the weakest link in online account security. System administrators should enable alerts to warn them about suspicious activity, such as foreign logins.

• Use two-factor authentication (2FA) on all email accounts. If available, enable multi-factor authentication
• Verify all payments in person or by calling the payment recipient using a known telephone number. Do not use the phone number the creditor supplies
• Train employees to recognize online scams including BEC scams
• Teach employees about how to recognize and report phishing emails
• Educate employees on how to respond to suspected account compromises
• Establish protocols for help desk employees to follow when responding to requests for resetting passwords or account login credentials
• System Administrators should not allow users to forward emails to external email addresses
• Email filtering polices should be set up to block suspected phishing emails and certain types of email attachments
• Email protocols, such as POP, IMAP, and SMTP should not be allowed

If reported within 24 hours, unauthorized wire transfers can often be recalled by your financial institution.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

FBI Reports APT Group Using Kwampirs Malware to Infect Computers for Years Before Detection

The US Federal Bureau of Investigations (FBI) issued an alert the states that an Advanced Persistent Threat (APT) group is using Kwampirs Remote Access Trojan (RAT). The malware may infect IT systems by gaining access through third-party supply chain vendors. Kwampirs malware has been noted as persisting on network from three months to three years before detection. The malware attacks have been effective at gaining broad and sustained access to targeted entities computers and IT networks.

Previous alerts have covered YARA rules to identify, sort, and classify malware, and indicators of compromise, or IOCs. Coronavirus thened malware attacks have increased

This FBI alert states, “The Kwampirs RAT is a modular RAT worm that gains system access to victim machines and networks, with the primary purpose of gaining broad, yet targeted, access to victim companies to enable follow-on computer network exploitation (CNE) activities.”

The goal of Kwampirs RAT is to acquire access to computers and IT networks for future follow-on computer network exploitation (CNE) activities. The APT group attacks companies in the United States, Europe, Asia, and the Middle East. Typical targeted industries include healthcare, software supply chain, energy sectors, and engineering firms but may also include financial institutions and major law firms. This malware has been around since about 2016.

Healthcare Sector targets range from major transnational healthcare companies to local hospital organizations and may target a few computers or the entire network. In these attacks, hospitals are compromised through vendor software supply chain and hardware products.

These cyberattacks target vendors in the imaging industry – networked document scanners and copiers – that have access to customer networks. The access required but the vendor’s equipment is targeted with malware to gain access to customers’ IT networks. Kwampirs RAT is modular and may download other malware payloads as move laterally across the infected network and spread to more computers.

Global imaging business products and services in the Enterprise Resource Planning (ERP) industry or that handle ICS maintenance functions may serve multiple industries like the healthcare and energy sectors, making them ideal targets for this APT group.

Hackers take advantage of mergers and acquisition and during the software co-development processes. The software supply chain vendor’s devices may be infected, and the malware is passed along to the devices installed on the customer’s network or cloud infrastructure.

To Defend Against Malware and Other Cyber Attacks, the FB Recommends Best Practices for Network Security and Defense:

• Schedule regular updates to applications and the host operating system
• Keep a copy of backups offline with a “known good” version
• Implement a least-privileges policy to help stop hackers and malware from escalating privileges
• Conduct regular system and application vulnerability scans
• Deploy a Web application firewall

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

FBI Warns of FIN7 hacking Groups Sending USB Flash Drives, Gift Cards, and Adorable Teddy Bears to Infect Your Computer

The US Federal Bureau of Investigations (FBI) warned of a new malware attack in which hackers are sending weaponized USB flash drives to victims using US Postal mail. So, no phishing emails this time – victims receive malware delivered via physical snail mail! This cyber attack gets even more unique as the hackers may also a gift as well – either a gift card or a teddy bear via postal mail. The FBI says that an organized hacking group is known as FIN7 which is known for stealing money from target businesses.

If the recipient inserts the flash drive into their computer, it infects their device with a JavaScript backdoor called GRIFFON.

The FBI warning stated that hackers from FIN7 mailed these packages using regular US Postal mail to businesses targeting employees in their human resources, IT, or executive management departments. These packages may or may not also include a gift card or other gifts like a plush teddy bear. Either way, the USB flash drive is accompanied by a letter that instructs the victim to insert the flash drive into their computer to see list of eligible products they can use the gift card to purchase.

USB drives can be preloaded with computer code that your computer will recognize as a keyboard. The USB drive can auto run computer code that sends keyboard strokes that your computer will respond just as if you were typing commands.

“Recently, the cybercriminal group FIN7, known for targeting such businesses through phishing emails, deployed an additional tactic of mailing USB devices via the United States Postal Service (USPS). The mailed packages sometimes include items like teddy bears or gift cards to employees of target companies working in the Human Resources (HR), Information Technology (IT), or Executive Management (EM) roles,” the FBI alert states.

In 2018, the FBI explained how FIN7 hacked and stole fifteen million payment cards from hundreds of US companies. The hacking group breached the IT networks of companies across 47 states plus the District of Columbia and stole over 15 million customer payment card records from more than 6,500 individual point-of-sale terminals. Three members of the group were arrested.

Once a device is compromised it executes JavaScript that can collect system information about the infected device and may download more malware. The goal of a keylogger is to record all of the keystrokes on a computer hoping to capture usernames, passwords, email address, and credit cards, or anything else valuable and send it back to the hackers. Since this malware attack is targeting human resource professionals at businesses, it is possible identity theft is also a goal. HR personnel are often the target of W-9 tax scams and other tax scams. Once system information is collected, the malware attempts to elevate itself to admin privileges.

What is FIN7?

FIN7 is an organized group of hackers with primarily targets retail businesses, restaurants, and the hospitality sector in the United States to steal money from them. FIN7 is also referred to as the Carbanak Group or the Navigator Group and has been around since 2015. The hacking group often uses phishing emails and hacks point of sale terminals to carry out their attacks.

How to Stop this USB Flash Drive Malware Attack

Never insert a USB flash drive into your computer if it from someone you don’t know or trust. Obviously, if you randomly receive a flash drive in the mail, destroy it. See our video on how to destroy a USB Flash Drive.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

Covid-19 continues to dominate the news cycle as the number of infections climbs by the thousands each day. Intrusion attempts are on the rise as unscrupulous individuals take advantage of the confusion and fear surrounding the virus. Phony apps that steal your data and malware that cracks your router are eveyrwhere, and we may see the digital fallout from this crisis in the years to come as the treasure trove of data uncovered from these activities finds its way into the wild. A Norwegian company, Uncast, is taking advantage of data that is, legally, publically available to show how different localities are handling social distancing. They’re taking advantage of GPS data that people knowingly, or perhaps unknowingly, make public or that are provided from an app run on the individual’s phone to show how well people maintain their distance from one another. They’ve provided grades for counties and states, with Tennessee getting a “B” while Hawai’i earns itself an “F”.

Uncast notes that the data they’ve used would constitute Personal Data, but is quick to point out that the public ways they’ve provided data is anonymized, so there’s no need to worry about an individual’s privacy being breached. Assuming, of course, that you’re fine with a random Norwegian company being able to track exactly where you’ve been for the past few weeks without you ever knowing.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

Chinese Hacking APT Group Installing Malware on iPhones Using Hong Kong News Website and Watering Holes to Infect iPhones with Spyware

Hackers are using a watering hole news website to install malware on iPhone users’ devices. The cyber attack is reported by Kaspersky Labs and Trend Micro . It is believed to be related to a known Chinese Advanced Persistent Threat (APT) Group that has been in operation for eight years. In this attack, the hackers infect iPhones with LightSpy surveillance malware. The cyberattack was first spotted on 10 January 10 and increased 18 February.

This affects all iPhones from iPhone 6 to the iPhone X.

The post from Kaspersky has dubbed this APT group “TwoSail Junk” but it is believed that this APT group may be a well-known APT group called Spring Dragon, Lotus Blossom, or Billbug. Spring Dragon has been active since about 2012 and hacks organization in the Southeast Asia region. These hackers use watering hole and spear phishing tactics to attack governmental organizations, political parties, universities, and the telecommunications sector.

The malware attack leverages CVE-2019-8605, a Safari browser vulnerability, that affects in iOS 12.1 and 12.2 and spans all models from iPhone 6 to iPhone X.

APT groups, short for Advanced Persistent Threats groups are organized professional hackers. APT groups work at the behest of nation-state governments. The hack to steal money for other operations or for espionage. They often stick to targeting certain geographical regions or industrial sectors.

Hackers infected legitimate news websites and setup a few of their own (e.g., hxxps://appledaily.googlephoto[.]vip/news[.]html) to target certain groups of readers and get them to click on links. The news websites used to lure in potential victims and thus is known as a watering hole because they are a trap. People visiting the watering hole websites only see what they believe is legitimate news content. In this case the hackers posted sex-related content and news about the COVID-19 Coronavirus to use as clickbait. But while readers visited the infected website, the hackers are using an iOS exploit to install malware on iPhones. However, in the background, they are really visiting a site setup to take advantage of iOS security bugs and infect their iPhones with malware.

How to Protect Against Malware on iPhone

This hack exploits a use after free memory flaw (CVE-2019-8605) This security bug was fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. The malware exploits a Safari security bug which has already been patched. If your app and operating system are not patched, then your iPhone is vulnerable to this cyberattack and others. DO not jailbreak your phone and download apps outside of the App Store.

To clean malware from your iPhone, try Kaspersky’s antivirus app to mitigate malware and block phishing emails.

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

Federal Security Service Shuts Down Russian Credit Card Theft Ring Operating Over 90 Websites to Sell Stolen Payment Card Numbers

Russia’s Federal Security Service (FSB) shut down a massive Russian credit card theft ring that involved an estimated 90 websites used for selling stolen payment cards to hackers. The FSB charged 25 people with circulating illegal means of payment. The Russian credit card fraud ring is believed to some of the biggest data breaches over the past ten years. One of the hackers arrested is reported by Krebs on Security to be one of the largest dealers of hacked credit cards stolen from Western businesses.

The stolen credit card numbers are obtained through data breaches, malware, and cyberattacks on businesses all over the world.

Although the FSB did not release the names of those arrested, hacker Alexey Stroganov, who uses the moniker “Flint” and “Flint24” along with his colleague Gerasim Silivanon were reported by blogger Андрей Споров (Andrey Sporaw) to be among them. In 2006, both Stroganov, and Silivanon were previously sentenced to six years but were release after only serving two years of their sentence.

The Russian credit card theft ring was believed to be operating a network of more than 90 websites (known as carding sites) used to sell the stolen payment cards to buyers. Although the FSB is not releasing details, about 40 websites known to be associated with Stroganov, are dead including httpXX://MrWhite[.]biz. Other carding sites – BingoDumps, DumpsKindgom, GoldenDumps, HoneyMoney and HustleBank – are also down according to Krebs.

According to U.S. law enforcement , Stroganov moved hundreds of millions of dollars through BTC-e which was a cryptocurrency exchange that was seized by U.S. authorities after the feds filed a $100 million USD complaint.

Caches of stolen payment cards were sold in groups of 100,000 pieces at a time. Stroganov was known for hacking banks and businesses within Russia, which is not as well tolerated in Russia as is hacking foreign targets.

How Does Credit Card Theft Work?

Credit card theft happens when a thief steals a payment card – a credit card, debit card, or bank card – and uses it for fraudulent charges. A small-time thief may steal one physical card of skim the card number from an ATM or POS terminal Skilled hackers steal thousands of payment cards at a time in large scale using breaches, malware attacks, phishing emails, and other card skimming tactics. In the case of major data breaches, hackers steal thousands of payment cards and sell them on the dark web to other scammers who cloned the numbers to physical cards and sell them. The original physical card never leaves the rightful owner’s possession.

How Do Hackers Steal Payment Cards?

• Data breaches
• Phishing emails
• Credit card skimmers
• Malware in Point of sale terminals or severs as in the Wawa data breach
• Discarded credit card or bank statements
• Online theft though compromised websites
• Nonsecure web browsers
• Nonsecure WiFi

Warning Signs of Credit Card Theft

Look out for these signs of credit card theft:

• Bills from Accounts You Did Not Open
• Notices of Increased Credit Limits
• Calls from creditors or collection agencies
• Increased Credit Limits on your credit report
• New charges on your bank statements

What is Russia’s FSB?

Federal Security Service of the Russian Federation, or FSB, is the main security agency of Russia. FSB is the successor of the Federal Counterintelligence Service of Russia (FSK) which succeeded the forer Soviet Union’s (USSR) KGB. The FSB is the counterpart of the US Federal Bureau of Investigation (FBI).

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

FBI Shuts Down Deer.io – Russian based Hacking Marketplace that Dealt in Stolen Corporate Data, Hacked User Accounts, Cyberattack Services

The US Federal Bureau of Investigation (FBI) announced the agency shut down a Russian-based online marketplace that specialized in selling compromised data and criminal services. The marketplace, DEER.IO, allowed hackers to set up online storefronts for a monthly fee to buy and sell stolen information and criminal hacking services. No legitimate companies were found to be buying or selling on the marketplace. DEER.IO was accessible to anyone online using any web browser. The reamains of the marketplac can be seen (Safely) here https://deer.io/

The marketplaces offered hackers individual storefronts where they could set up shop and sell compromised U.S. and international financial and corporate data, personally identifiable Information (PII) about employees, and hacked user accounts from U.S. companies. Anyone could purchase computer files, financial information, personally identifiable information (PII) for individuals, and login credentials to online accounts from computers infected with malware. Victims were located in the United States and overseas.

FBI Special Agent in Charge Omer Meisel stated, “Deer.io was the largest centralized platform, which promoted and facilitated the sale of compromised social media and financial accounts, personally identifiable information (PII) and hacked computers on the internet.”

Alleged Russian hacker, Kirill Victorovich Firsov, was arrested on March 7 in New York City. He is suspected of being the DEER.IO administrator.

DERR.IO allowed hackers to buy and sell hacked data, accounts, and personal information through their own online storefronts they paid to set up and host on DEER.IO. Individuals could also hire criminal hacking services like buying and selling malware attacks. The marketplace was in business since at least October 2013. The marketplace claimed to have 24,000 active shops with sales over $17 million USD.

FBI Bought Hacked Data

During the first week of March 2020, the FBI purchased about 1,100 gamer accounts from a DEER.IO storefront called ACCOUNTS-MARKET.DEER.IS for less than $20 in Bitcoin A day later, the FBI bought almost 1,000 PII accounts from another DEER.IO storefront called SHIKISHOP.DEER.IS for about $170 in Bitcoin. The agency then bought about another 2,650 PII accounts from a third DEER.IO storefront called SHIKISHOP.DEER.IS for $522 in Bitcoin. The PII accounts contained names, birthdates, and Social Security numbers for citizens in San Diego County.

DEER.IO sold easy to operate pre-packaged online storefronts that hackers could use to sell their stolen data, financial information, and accounts. The template storefronts even came with product uploaders and other tools to make managing a store easier. The platform was maintained on Russian-controlled infrastructure and was publicly accessible on the clear web. The storefronts used cryptocurrency digital wallets to collect payments for the purchased products and services.

Store owners paid a fee of 800 Rubles (about $12.50 USD) monthly to keep a store on DEER.IO.

“There is a robust underground market for hacked stolen information, and this was a novel way to try to market it to criminals hoping not to get caught,” said U.S. Attorney Robert Brewer.

Firsov will be extradited to San Francisco where he will appear in court on 06 April and faces charges of Unauthorized Solicitation of Access Devices, 18 USC Sec. 1029(a)(6)(A)

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

With responses in (somewhat) full swing aground the globe, people are suddenly finding themselves online a lot more and their exposure to threats has likewise gone up. Online shopping is increasing as people weigh the risks of contact with other people, and local stores are rushing to provide a way to purchase goods digitally. This sudden increase in use is likely to cause some failures or breakdowns in the network and we expect those events to be ruthlessly exploited by malicious actors. Netflix will be reducing its stream quality in Europe because of the huge increase in usage caused by the quarantine, and we expect other streaming services to do the same before long. Cyber research group Perimeter X has reported a massive spike in scraping and account takeover attacks against entertainment services and other supply providers. Worse, as demonstrated by the Eternal Blue attacks, hospitals and other critical healthcare facilities have a terrible record with enforcing proper cybersecurity protocols. Hospitals may find themselves in the crosshairs of some truly morally bankrupt individuals as nothing would be more likely to get a payout than threatening to shut down a hospital’s network. Admittedly, whatever group or individual did that would probably find themselves hunted to the ends of the Earth and then tried for manslaughter/murder.

In other news, Digital Revolution, a Russian hacking group, claims to have exposed the FSB’s Program Fronton which would allow them to hack into Internet of Things (IoT) devices. We’ve said it before (and we’ll probably keep saying it forever): IoT devices represent a massive vulnerability and should not be trusted anywhere where sensitive information resides. Really, IoT devices shouldn’t be trusted at all. Assume that they’re insecure and actively working to siphon your data and you’ll find yourself much more secure. From the documents they’ve released, Project Fronton appears to be an IoT Botnet, which is something we’ve seen in the past using wifi enabled security cameras to provide processing power.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/