Archive for Cyber Attacks

Objectives for Ransomware Attack Against Nuclear Contractor Sol Oriens Remain Unknown

 

New Mexico-based government contractor Sol Oriens was attacked by the Russian REvil ransomware group that sparked worries in the national security community, because of the company's work with the Department of Energy's National Nuclear Security Administration.

However, the motives for the attack remain unknown. Sol Oriens confirmed it was targeted in May, according to CNBC's Eamon Javers, and the corporation stated no sensitive or important security-related material was compromised. The company's website remained down as of Friday, and Mother Jones reported that it had been down since June 3. Sol Oriens has yet not confirmed if the attack was ransomware. 

According to Michael DeBolt, senior vice president of intelligence at Intel 471, Sol Oriens was targeted by REvil, the same group that was accused of targeting meat manufacturer JBS. 

“From the REvil blog, all indications are that Sol Oriens was a target of opportunity, and not of design tied to some state-sponsored entity,” DeBolt stated. 

“However the sensitive nature of this particular victim did not elude the REvil operators and affiliates responsible for the attack. In fact, they explicitly threatened to reveal ‘documentation and data to military agencies of our choice [sic]’ and shared proof by way of screenshots on their name and shame blog. Even so, these actors primarily remain financially motivated.” 

According to Gary Kinghorn, senior director of marketing and alliances at Tempered Networks, the vulnerability of the information in this breach appears to be less than catastrophic if it was restricted to personal information and contacts, but there's no way of knowing if it went further than that. The goals of this attack, according to Kinghorn, are clearly useful to geopolitical opponents, and enterprises must be aware of the immense sophistication and resources behind these operations, regardless of purpose. 

Kinghorn added, “Organizations, particularly those holding DoE-class information and secrets, have to realize that yesterday’s security tools are no longer enough and are too error-prone to justify.” 

“The National Security Agency has already strongly suggested that government agencies move to zero trusts and even ensure encryption of all data in motion. These advanced steps can effectively make networks unhackable. However, right now, organizations are still weighing the costs and ROI until they get exposed like this to make changes.”

CD Projekt Red Confirmed that its Data is Disseminated Online

 

The company alleges the hacked information stolen from the CD project is being distributed online. The company behind Cyberpunk 2077 and The Witcher 3 claim that they cannot verify the actual details of the information shared but they believe that the stolen data relates to their games, contractors, and both current and past employees. 

Earlier in this year, it faced a ransomware attack, which “gained access to our internal network, collected certain data belonging to CD PROJEKT Capital Group and left a ransom note,” by a threat group (which was considered to be the HelloKitty Gang), the company said. 

The ransomware encrypted the system for the organization too, but CD Projekt Red managed to restore all the data from the backup — making stolen data the actual problem. 

The threat of "double extortion" has been increased by Ransomware groups, with a warning that if the victims do not pay, they will Auction stolen data. Many also maintain sites with "name and shame" title that operators use to publish leaked victims' information who was not able to pay the ransom. 

And the cybercriminals stated that they had "dumped full copies" of Cyberpunk 2077's, Gwent's, Witcher 3's and Witcher's "unreleased version;" and acquired the sensitive company information about bookkeeping, administration, HR, investor relations, law, and more. 

“Source codes will be sold or leaked online, and your documents will be sent to our contacts in gaming journalism,” according to a note. 

In a late Thursday statement, CD Projekt Red stated that its security staff “now have reason to believe that internal data illegally obtained during the attack is currently being circulated on the internet.” 

The report further states, “though we believe it may include current/former employee and contractor details in addition to data related to our games. Furthermore, we cannot confirm whether or not the data involved may have been manipulated or tampered with following the breach.” 

This incidence is not different after updated ransomware playbook 'breach, extract, encrypt, offer,' "Dirk Schrader, global security research Vice President at New Net Technologies (NNT), has remarked. However, he added, “It was some sort of luck on CD Projekt Red’s side that – as far as we know – no customer data was involved, because if so the story would have evolved in very different ways. ”

It is worth noting that ransomware gang has fulfilled its pledge to auction off the company's data beforehand, where in February on the well-known Russian-language underground forum 'Exploit' the source code for Cyberpunk 2077 and its previously unreleased version of Witcher 3 were allegedly on sale. 

The lot was sold one day later, and though cyber investigators established the presence of the auction, they could not check for the quantity or veracity of what was sold. The auction demanded an opening offer of $1 million.

Lately, threat actors posted approximately 300GB of data that reportedly belongs to the CD Projekt Red on the Payload.bin data leak site. 

“Digital Shadows has seen several attempts to either sell or expose data related to CD Projekt Red since February, with unconfirmed actors first trying to auction game and other internal company data on a well-known Russian language forum,” Sean Nikkel, senior cyber-threat intel analyst at Digital Shadows said. 

The company added, “regardless of the authenticity of the data being circulated — we will do everything in our power to protect the privacy of our employees, as well as all other involved parties. We are committed and prepared to take action against parties sharing the data in question.”

Iranian Hackers Attacked Websites of an African Bank and US Federal Library

 

According to Iran Briefing, hackers posing as Iranians targeted the websites of the Sierra Leone Commercial African Bank and the United States Federal Depository Library Program, by posting pro-Iranian remarks and graphics. 

The website of Sierra Leone Commercial Bank was found to be "H4ck3D IRANIAN HACKER" in Google search results. 

The words "hacked by Iranian hacker, hacked by shield Iran" were written in Twitter screenshots on a drawing of former IRGC Quds Force commander Qasem Soleimani, who was killed in a US airstrike. 

According to CBC News, the library program's website was updated with a bloodied picture of US President Donald Trump being punched in the face, as well as a message is written in Farsi and English that read "martyrdom was Soleimani's... reward for years of implacable efforts," and another caption that read "this is only a small part of Iran's cyber ability!" 

A spokesman from the US Department of Homeland Security's Cybersecurity and Infrastructure Security Agency verified the incident. Though the hack has still proven to be the activity of Iranian state-sponsored actors. 

The representative stated, “We are aware the website of the Federal Depository Library Program [FDLP] was defaced with pro-Iranian, anti-US messaging”. 

“At this time, there is no confirmation that this was the action of Iranian state-sponsored actors”. 

The website has been removed from the internet and is no longer accessible. In coordination with the FDLP and other government partners, the Cybersecurity and Infrastructure Security Agency (CISA) is keeping an eye on the situation. 

According to another senior US official, the defacement was a minor event carried out by Iranian sympathizers. Former US Secretary of State Mike Pompeo indicated at the time that a cyberattack by Iran against the US could be a possible retaliation. 

It's unclear whether the hackers had a government position or had any connection to Iran. The hack occurs at a time when tensions between the US and Iran are still high following the assassination of Qasem Soleimani, the chief of Iran's Revolutionary Guards Corps Quds Force, by a US strike in Baghdad on Jan. 2. 

Iran has already threatened retaliation for the assassination, implying that US assets and interests in the Middle East, as well as US allies, may be targeted.

Russian hackers attacked the systems of the Dutch police during the investigation of the Boeing crash

 The Dutch newspaper Volkskrant on the day of the start of the hearing on the crash of the Malaysian Boeing in Ukraine published a material in which, citing anonymous sources, it claims that hackers allegedly connected with the Russian Foreign Intelligence Service (SVR) gained access to the Dutch police system in 2017 when the investigation into the crash of Flight MH17 was conducted.

According to the newspaper, the hacking was not noticed by the police, but it was the information of the Security Service (AIVD) that helped to detect it.

The hack led to a "great panic" over the MH17 investigation. The information was provided to the newspaper by people with knowledge of the incident, but the police and the AIVD refused to confirm or deny the hacking.

Sources told the newspaper that the hack detected by the AIVD came from the Dutch IP address of the police academy's server. "Traces of hackers were found in several places," Volkskrant reports, citing four sources. It is unclear if the hackers were able to gain access to any information relevant to the MH17 investigation, or what information they might have obtained.

Recall, a Malaysian Boeing flying from Amsterdam to Kuala Lumpur on flight MH17 crashed near Donetsk in 2014. All 298 people on board were killed. Kiev blamed the militia for the crash, but they said they did not have the means to shoot down an aircraft at such a height.

During the investigation of the joint investigation group (JIT) under the leadership of the Prosecutor General of the Netherlands, the investigation concluded that the Boeing was shot down from the Buk anti-aircraft missile system belonging to the Russian Armed Forces.

The Russian Foreign Ministry said that the accusations of Russia's involvement in the crash of the Malaysian Boeing are unfounded and regrettable, the investigation is biased and one-sided. President Vladimir Putin noted that Russia is not allowed to investigate the crash of the airliner in eastern Ukraine, and Moscow can recognize the results of the investigation if it takes a full part in it.

FBI Alerts: BEC Scammers are Posing as Construction Companies

 

The FBI has issued a warning to private sector enterprises about scammers masquerading construction companies in business email compromise (BEC) cyberattacks targeting firms in a variety of critical infrastructure sectors across the United States. 

BEC scammers utilize a variety of techniques (such as social engineering and phishing) to hijack or spoof business email accounts in order to redirect pending or future payments to bank accounts under their control. 

The alert was delivered to enterprises today via a TLP:GREEN Private Industry Notification (PIN) to assist cybersecurity professionals in defending against these ongoing threats. 

The instances are part of a BEC campaign that began in March 2021 and has already resulted in monetary losses ranging from hundreds of thousands of dollars to millions of dollars. 

The scammers use data collected from web services about the construction companies they spoof and the customers they're targeting to successfully carry out these BEC attacks. Local and state government budget data portals, as well as subscription-based construction sector data aggregators, are used to gather valuable data (e.g., contact information, bid data, and project prices). 

The attackers can modify emails to undermine the victim's business relationship with the construction contractors using the information they've gathered. The scammers send emails urging the victims to update their direct deposit account and automated clearing house (ACH) information to make the emails more convincing. The new account information leads to bank accounts controlled by criminals. 

To make sure the victims won’t be able to tell that the messages are fraudulent, they are sent using names that impersonate the contractors' actual sites and real corporate logos and visuals. 

Around $2 billion lost in 2020 BEC scams:

Between November 2018 and September 2020, the FBI warned of a new wave of BEC attacks increasingly targeting US state, local, tribal, and territorial (SLTT) government bodies, with losses ranging from $10,000 to $4 million. 

Microsoft discovered a large-scale BEC operation targeting over 120 companies last month that used typo-squatted domains registered just days before the attacks began. 

The FBI stated, "The FBI's Internet Crime Complaint Center (IC3) notes BEC is an increasing and constantly evolving threat as criminal actors become more sophisticated and adapt to current events. There was a 5 percent increase in adjusted losses from 2019 to 2020, with over $1.7 billion adjusted losses reported to IC3 in 2019 and over $1.8 billion adjusted losses reported in 2020." 

The FBI also warned last year that BEC scammers were using email auto-forwarding and cloud email platforms like Microsoft Office 365 and Google G Suite in their attacks.