Archive for May 31, 2019

3 million dollar was stolen from Investment company through email hacking scam




According to authorities, Two con artists from New Jersey and their team hacked into several corporate accounts stealing almost $3 million which was meant for a Manhattan real state transaction on Thursday.

The fraud took place after two foreigners gained access to the corporate email account of the investment company, they were keeping eye on potential investment deals through the emails. The name of the investment firm has not been revealed.

Before a deal of $2.8 million dollar was done, the foreigners emailed the investment company fraudulent account details that appeared to be coming from intended recipient. According to the prosecutors, the two foreigners who planned and stole the money from investment company are known by the name  Estarlin Reynoso and  Lucy Beswick

According to the court papers, Beswick, 27 instructed  Reynoso, 29, step by step on how to open a business account and how to wire the stolen funds through the whatsapp messaging service.

Manhattan DA Cyrus Vance said “New Yorkers whose jobs include wiring money should pay attention to this case, Business email compromises cause billions in worldwide losses each year, but there are steps that companies large and small can take to avoid becoming a victim.”

Vance has suggested businesses to be careful of the authenticity of the emails. They should be verified through verbal communication if transfer of funds are involved.He also suggested to use anti-phishing tools to authenticate emails.

According to the Prosecutor, Reynoso transferred funds to three different banks in China before the fraud was detected. Both the accused were charged with Larceny,identity theft and criminal possession of stolen funds.
The investment company was able to recover most of the funds. Beswick was freed without bail while Reynoso was released on bail for $10000.

Matrimonial Sites an Easy and Fast Platform to Dupe Brides-To-Be



Cybercrimes are at a rise once again and this time it's the matrimonial sites turning into a rather easy platform for those out to dupe the brides-to-be.

The recent case of a Hyderabad based software engineer who in the hopes of finding an ideal counterpart for her on a rather well-known and popular matrimonial site wound up giving up Rs 30,000 to somebody impersonating an All India Institute of Medical Sciences (AIIMS) Doctor.

Neha Saxena, the victim, has lodged a complaint at the Cyber-Crimes police station against the individual who hoodwinked her, said that she had given him the cash supposing he was a surgeon at AIIMS. First it was Rs 30,000 on the 7th of March and then it was Rs 20,000 more on the 20th of March.

Alarmingly, this is a not an irregular case as cyber matrimonial fraud is on the quick ascend, much to the worry of the cops, as in the previous six months alone more than 100 such cases have resurfaced.

U Rammohan, SP, Digital Violations, CID, says "There was an instance where an employee of a star hotel, posing as an IIT graduate with a salary of Rs 50 lakh per annum, duped up to 11 women. However, only one woman was ready to lodge a complaint, which is also a reason for the lack of swift action,"

Top cybercrime specialists said that most women neglect to report such cases as they dread harm of their reputation. In many cases though, women are also subjected to physical molestation and in some the victim were contacted over telephone and hoodwinked citing to personal emergency even surgery in some instances.

By and large, as the police say the fraudsters use profile information of actual person to reach the victim to anticipate doubt and shockingly enough women also are into matrimonial fraud.

The cybercrime police of the city thusly caution the many individuals who are already registered on such sites advising them to stay wary and alert.


Victoria health systems vulnerable to cyber attacks: Report

An audit by the office of the Auditor-General found patient data stored in Victoria's public health system is highly vulnerable to cyber-attacks, and many health agencies have low risk awareness of the security flaws.

The audit exploited weaknesses in four audited agencies and accessed patient data to demonstrate the multitude of risks to the security of patient data and hospital services.

The report found deficiencies in how health services manage user access to digital records, including unused and terminated employee accounts still enabled, and failure to keep user access forms as proof that users have had their access approved.

The work also uncovered a lack of any formal, regular user access review to ensure only staff who need access have it—only one audited health service was found to provide mandatory cyber and data security training to all staff.

“Given that staff actions can undermine ICT and physical controls, it is vital that all staff—including clinical staff—can identify and manage the risks to patient data,” the audit reported.

The report stated that Victoria’s public health system is “highly vulnerable” to the kind of cyber attacks recently a Melbourne-based cardiology provider, which resulted in stolen or unusable patient data and disrupted hospital services.

The audited health services are not proactive enough, and do not take a whole-of-hospital approach to security that recognises that protecting patient data is not just a task for their IT staff,” the report concluded.

The Auditor-General Andrew Greaves examined Barwon Health (BH), the Royal Children’s Hospital (RCH), and the Royal Victorian Eye and Ear Hospital (RVEEH), and also examined how two areas of the Department of Health and Human Services (DHHS), the Digital Health branch and Health Technology Solutions (HTS), are supporting health services.

“This weak security culture among government staff is a significant and present risk that must be urgently addressed,” the report said. “At one site, we accessed discarded, sensitive information too easily.

New China-Based Campaign Targets Windows MS-SQL and Phpmyadmin Servers Worldwide


A china based attack campaign has primarily targeted on servers having a place with the healthcare, telecommunications, media, and IT segments. The campaign named as Nansh0u is known to target Windows MS-SQL and PHPMyAdmin servers around the world.

Despite the fact that the campaign was detected towards the start of April, however the attacks were observed to go back to February 26. All through the campaign the threat actors used 20 unique payloads, and continued making at least one payload a week and utilized them right away.


More than 50,000 servers were reported to be breached in this campaign, when the targeted servers compromised they were infected with a rather pernicious payload, which thusly drops a crypto-miner that mines TurtleCoin and sophisticated kernel-mode rootkit.

The hackers behind this campaign utilize propelled systems pursued by APTS groups, like the 'fake certificates and privilege escalation exploits' so to state the Nansh0u campaign isn't only a crypto-miner attack.

The attack begins with a serious of login endeavors targeting MS-SQL servers in order to gain administrator privileges. Attacker’s infrastructure consolidates the following modules to dispatch an attack on MS-SQL servers.
  • Port scanner
  • MS-SQL brute-force tool
  • Remote Code Executor


And by analysing the 20 payload samples from the attacker’s servers and Guardicore Global Sensor Network, each payload is a wrapper and has several functionalities.

The reasons being why the researchers are quite confident in accessing that Chinese attackers have operated this campaign are:
  •  The attacker choosing to write their tools with EPL, a Chinese-based programming language.
  • Some of the file servers deployed for this campaign are HFSs in Chinese.
  • Many log files and binaries on the servers included Chinese strings, such as (“duplicates removed”) in logs containing breached machines, or (“start”) in the name of the script initiating port scans.

Cyber criminals thrive in India’s IT capital

Cyber criminals seem to be thriving in India’s IT capital; in the last four months alone, Bengalureans lost Rs 32 crore to various online scams. A 39-year-old woman was the biggest victim—a fraudulent suitor who befriended her through a matrimonial website made away with Rs 33 lakh.

The cybercrime police station of the Bengaluru city police has recorded a staggering 3,180 cases in four months since mid-January.

Last year, Sumathi (name changed) from Jayanagar had registered with a well-known marriage portal to find a match. Little did she know that the prince charming who approached her as a UK-based Indian doctor expressing interest to settle down with her in Bengaluru was an online imposter. He got her into parting her hard-earned money through numerous online transfers.

“She was lured by an exciting gift packet the man claimed to have sent from the UK. Then came the false excuse of Indian customs officials seizing the gift for duty. She fell for it and transferred lakhs of rupees, trusting the man who trapped her with sweet words and promise of marriage in a brief period,” said an officer.

Rise in matrimonial fraud

Sumathi is one among the many victims of online imposters who’ve siphoned off Rs 32 crore since February through various techniques—credit card skimming, vishing, phishing, e-wallet scam, online car sales con, Facebook fraud, airline ticketing trickery and an array of other Nigerian scams. Matrimonial frauds topped the charts in the four months with hundreds of women being targeted by crooks, mainly through paid portals and Facebook messenger.

“Every day, we register close to 40 FIRs regarding bank frauds, including phishing, vishing and illegal money withdrawal from accounts through ATMs. People still fall prey to lottery fraud, the oldest trick in the trade,” said an officer. He said the cybercrime wing register nearly 1,000 FIRs a month.