By Deeba Ahmed
Ethereum Network Stake Loses $41 Million Worth of Crypto After Private Key Leak.
This is a post from HackRead.com Read the original post: World’s Largest Cryptocurrency Casino Stake Hacked for $41 Million

Cryptocurrency casino Stake experienced suspicious funds outflow with $15.7m drained on Ethereum and $25.6 m collectively lost in Binance Smart Chain and Polygon.

**Key Findings**

*   **On September 4, 2023, the world’s largest Australian cryptocurrency casino and sportsbook platform Stake became a target of a financially motivated cyberattack, losing over $41 million worth of cryptocurrencies.**

*   **The hackers exploited a leaked private key to gain access to Stake’s hot wallets, which contain the platform’s most liquid funds.**

*   **The hackers stole a total of $16 million worth of Ethereum, $17.8 million across the Binance Smart Chain, and $7.8 million in Polygon.**

*   **The hackers converted the stolen funds to Ether and transferred them to multiple externally owned wallets.**

*   **Stake has suspended all deposits and withdrawals and is currently investigating the attack.**

According to reports from on-chain analyst Cyvers and blockchain researcher ZachXBT, on September 4, 2023, the world’s largest Australian cryptocurrency casino and sportsbook platform Stake became a target of a financially motivated cyberattack, losing over $41 million worth of cryptocurrencies.

Cyves has dubbed it a suspicious outflow of funds, most of which were sent to an account labelled ‘Stake.com Hacker.’ Further probing revealed that the withdrawals resulted from a leaked private key. The casino apparently was targeted by an exploit.

Etherscan reported that the first transaction to the alleged hacker’s wallet took place at 12:48 pm in which $3.9m worth of Tether was transferred followed by two more transactions draining out 6,001 Ether. Hackers kept removing tokens for the next few minutes, stealing $1m in USD coins. Altogether $16m worth of Ethereum, $17.8 across the Binance Smart Chain, and $7.8m in Polygon were stolen.

On X (former Twitter), Cyves shared news of the incident to alert Stake users about the unauthorized draining of funds:

“ALERT🚨Our AI-powered system has detected multiple suspicious transactions with @Stake. (https://etherscan.io/address/0x3130662aece32f05753d00a7b95c0444150bcd3c) address received about $16M in $ETH $USDC $USDT and $DAI. All the stablecoins are converted to $ETH and distributed to different EOAs.”

The hackers converted the stolen funds to Ether. They transferred the amount to multiple externally owned wallets before the withdrawals stopped, leaving the casino with $340,000 worth of Ether and $2.1m in other altcoins.

The casino suspended all deposits/withdrawals, due to which most users cannot access their funds as of now. The platform also confirmed the breach, stating that unauthorized transactions were made from its hot wallets.

“Three hours ago, unauthorized tx’s were made from Stake’s ETH/BSC hot wallets. We are investigating and will get the wallets up as soon as they’re completely re-secured. User funds are safe. BTC, LTC, XRP, EOS, TRX + all other wallets remain fully operational,” Stake’s statement on X read.

Stake is a popular betting platform known for its affiliation with rapper Drake and the Formula One fame Alfa Romeo, recording $2.6 bn in revenues in 2022. It allows users to deposit/play with cryptocurrencies. As per its co-founder Ed Craven, Stake accounted for 6% of all Bitcoin transactions, 15% of all Litecoin transactions, and 12% of all Dogecoin transactions last year.

The draining of such a hefty amount is a big blow for the casino and the cryptocurrency industry as in July 2023, another platform Alphapo lost $31m in suspicious withdrawals. In 2022, over $3.7bn worth of crypto was lost in different exploits and hacks, and this incident highlights that the industry continues to be vulnerable to cybercrime.

**RELATED ARTICLES**

1.  Hackers drain $25 million in assets from dForce
2.  Hacker Returns $200 Million Stolen from Euler Finance
3.  Crypto ATM Manufacturer General Bytes Suffers $1.5m Bitcoin Theft
4.  Researcher Exposes Cryptocurrency Scam Network of 300 Domains
5.  Kroll SIM-Swapping Attack Causes Data Breach at 3 Top Crypto Firms

World’s Largest Cryptocurrency Casino Stake Hacked for $41 Million

By Owais Sultan
In this article, we will discuss cybersecurity for startups and how implementing effective measures can contribute to their overall success and growth
This is a post from HackRead.com Read the original post: Cybersecurity for Startups: Best Tips and Strategies

  
In the modern business landscape, cybersecurity is of paramount importance for startups. It serves as a protective barrier against digital threats that can compromise sensitive data, disrupt operations, and negatively impact the reputation of a young business. In this article, we will discuss cybersecurity for startups and how implementing effective measures can contribute to their overall success and growth

**Why Cybersecurity for Startups is Important**

Cybersecurity is important not only for large corporations but also for startups. New ventures often possess valuable intellectual property, customer data, and proprietary information, rendering them appealing to cyberattacks. Hackers may leverage system vulnerabilities to gain unauthorized access, leading to data breaches or theft.

Secondly, startups might lack the financial resilience to recover from cyber incidents. The costs associated with data breaches, legal consequences, and reputational damage can be overwhelming for startups, potentially leading to financial ruin.

Additionally, startups rely heavily on their reputation and customer trust to succeed. A cybersecurity breach can erode this trust and tarnish their brand, deterring customers and investors alike.

Lastly, emerging businesses are increasingly interconnected with partners, clients, and suppliers through digital platforms. A breach within the startup’s ecosystem can spread to affect others, causing cascading consequences. 

**Assessing Your Startup’s Cybersecurity Needs**

When thinking about cybersecurity for startups, it’s crucial to start by looking at the risks you might face. This involves identifying potential threats like data breaches, hacking attempts, and malware infections. Consider the probability of these risks occurring and the potential consequences they might bring to your business. To do this effectively:

*   **Research Threats**: Stay informed about the latest cybersecurity threats relevant to startups.
*   **Prioritize Risks**: Evaluate the risks based on their likelihood and potential damage.
*   **Analyze Impact**: Understand how each risk could affect your business operations, reputation, and financial stability.

It’s also important to protect valuable assets and data. Identify the most critical assets, such as customer data, intellectual property, and financial documents. Then, follow these steps:

*   **Data Mapping:** Know where your data resides and how it flows within your organization.
*   **Access Control:** Restrict access to sensitive data to only those who need it.
*   **Data Classification:** Classify data based on its sensitivity level in order to implement suitable security measures.

**Essential Cybersecurity Measures for Startups**

Safeguarding your startup requires a proactive approach. Consider these fundamental cybersecurity actions:

**Implement Strong Password Policies**

Establish stringent rules for password creation. Ensure passwords are unique, combining letters, numbers, and symbols. Regularly prompt employees to update passwords and avoid using easily guessable information.

**Multi-factor Authentication for Critical Accounts**

Enhance security for critical accounts by adding an extra layer of protection. Multi-factor authentication requires an extra verification step beyond passwords, which lowers the likelihood of unauthorized access.

**Choose Software that Prioritizes Security**

Extend your cybersecurity diligence to the tools you use. When incorporating additional software, such as HR management systems or project management platforms, prioritize security as a non-negotiable criterion.

For instance, if you use time tracking software, consider apps that blur screenshots and offer data encryption for the captured information.

**Keep Software and Systems Updated**

Regularly update operating systems, applications, and software. Updates often contain security patches that shield your systems from known vulnerabilities.

**Install Firewalls and Antivirus Software**

Firewalls function as virtual barriers, managing the movement of data in and out of your network. They effectively prevent unauthorized entry. On a different note, antivirus software acts as a shield against harmful programs that could damage your systems. Setting up and adjusting both of these tools contributes a strong protective shield to your cybersecurity strategy.

**Encrypt Sensitive Data and Communications**

Implement encryption to scramble sensitive information. Encryption is a technique that transforms sensitive information into a coded format. This coding ensures that if someone without the proper authorization intercepts the data, they won’t be able to understand its contents.

**Regular Data Backups and Recovery Planning**

Create a routine of backing up data and critical information. In the event of data loss or a breach, having backups ensures you can restore your information and continue operations smoothly.

**Building a Strong Cybersecurity Culture**

To create a robust cybersecurity culture in your startup, consider the following actions:

**Engage managers to promote cybersecurity**: Start by having your leaders actively support and advocate for cybersecurity. When managers prioritize security, it sets a strong example for everyone else. They should allocate resources, make security decisions, and communicate the importance of cybersecurity to the whole team.

**Cultivate security awareness among employees:** Every team member plays a role in cybersecurity. Make sure that everyone understands their responsibility in keeping the digital environment secure. This involves following security policies, reporting suspicious activities, and being cautious with emails and links.  

**Execute regular security training and workshops:** Educate your employees by arranging regular training sessions and workshops. This keeps everyone updated about the latest threats and helps employees understand how to handle security incidents and maintain a secure work environment.

**Managing Incidents and Ensuring Disaster Recovery**

In the event of a breach or other security incident, having a well-structured plan is your first line of defense. Here’s how to manage incidents and ensure a swift recovery:

**Develop an incident response plan:** Create a plan outlining steps to take when a cybersecurity incident occurs. This plan should cover roles, responsibilities, and immediate actions to mitigate the impact of the incident.  

**Establish communication protocols in case of a breach:** Have a clear communication strategy that specifies who needs to be informed both within your organization and externally – customers, partners, regulatory authorities, etc. Open and timely communication assists in effectively managing the situation and maintaining trust.

**Regularly test and update disaster recovery procedures:** Simulate different types of incidents to assess the effectiveness of your response plan. This testing process can unveil gaps or weaknesses in your procedures, allowing you to refine and improve them.

Moreover, keep your disaster recovery procedures up-to-date. Technology and threats evolve, and your response strategies need to keep pace. Regularly review and update your plan to align with the changing threat landscape and technological advancements.

**Compliance and Legal Considerations**

Meeting legal requirements is a crucial aspect of cybersecurity. Here’s how to navigate compliance and protect both your startup and customer interests:

**Navigating Relevant Data Protection Regulations**

Different regions have different data protection regulations, like the General Data Protection Regulation (GDPR) in Europe or the California Consumer Privacy Act (CCPA) in the United States. Understand the specific regulations that apply to your startup’s operations and ensure your cybersecurity practices align with these requirements.

**Protecting Customer Data and Privacy Rights**

Customers trust you with their data; protecting it is not only ethical but often legally mandated. Implement robust security measures to safeguard customer information. Offer clarity regarding the collection, utilization, and storage of their data, and give them the option to control their privacy preferences.

**Understanding Legal Implications of a Data Breach**

In the unfortunate event of a data breach, there are legal ramifications to consider. Different jurisdictions have varying reporting requirements and potential penalties for breaches. Familiarize yourself with these implications to ensure you respond appropriately and fulfil your legal obligations.  

**Budgeting for Cybersecurity**

Effective cybersecurity requires the prudent allocation of resources. Just as you allocate funds for marketing or product development, earmark a portion of your budget specifically for cybersecurity. This financial commitment reflects the importance of protecting your digital assets and maintaining operational continuity.

While cybersecurity investments come with costs, weigh them against the potential risks and consequences of a breach. A cyber incident can result in financial losses, reputation damage, and legal repercussions that far outweigh the initial investment in security measures.

By allocating a realistic budget for cybersecurity and making informed decisions that balance costs and risks, your startup positions itself to effectively mitigate threats and maintain the trust of customers and partners. This proactive approach safeguards your operations and bolsters your overall business resilience.

**Looking Ahead: Future Cybersecurity Trends for Startups**

The world of cybersecurity is dynamic. Consider these trends that could impact startups in the near future:

**Emerging Threats and Attack Vectors**

As technology evolves, so do the tactics of cyber attackers. Stay vigilant against emerging threats like advanced phishing techniques, AI-driven attacks, and threats targeting IoT (Internet of Things) devices.

To counter these threats, ongoing education and awareness among your team are paramount. Regularly update your cybersecurity protocols to incorporate the latest threat intelligence and consider working with cybersecurity experts who can provide insights into emerging attack vectors.

**Integration of AI and Automation in Cybersecurity**

Artificial Intelligence (AI) and automation are becoming essential tools in the fight against cyber threats. These technologies can detect anomalies, provide real-time responses to incidents, and improve the overall efficiency of cybersecurity operations.

Consider investing in AI-driven cybersecurity tools that can augment your defense mechanisms. Collaborate with AI experts to fine-tune these solutions according to your startup’s unique needs.

**Conclusion**

Cybersecurity for startups is among the most critical factors to consider. Embrace cybersecurity not as a one-time task, but as an ongoing commitment. Implement a comprehensive approach that involves training, monitoring, and continuous improvement. By staying informed about emerging threats and embracing a proactive mindset, your startup positions itself to navigate the future cybersecurity landscape with resilience and confidence.

Cybersecurity for Startups: Best Tips and Strategies

By Habiba Rashid
Key Findings Cybersecurity researchers have warned of fake Signal and Telegram apps that have been distributed through the…
This is a post from HackRead.com Read the original post: Chinese APT Slid Fake Signal and Telegram Apps onto Official App Stores

**Key Findings**

*   Fake Signal and Telegram apps have been distributed through the Google Play Store and Samsung Galaxy Store.

*   The apps are designed to steal user data, including contact lists, call logs, and device information.

*   The apps were created by a Chinese APT known as GREF, while malicious code found in these apps is attributed to the BadBazaar malware.

*   The apps were initially targeted at users in China, but have since expanded to other countries.

*   If you have installed Signal Plus Messenger or FlyGram, you should remove them from your phone.

*   Before uninstalling the apps, make sure to unlink your Signal and Telegram accounts to prevent further data exposure.

Cybersecurity researchers have warned of fake Signal and Telegram apps that have been distributed through the Google Play Store and Samsung Galaxy Store. The apps, which are called Signal Plus Messenger and FlyGram, are designed to steal user data, including contact lists, call logs, and device information.

Signal Plus Messenger, a bogus version of the popular Signal app, managed to slip under the radar for nine months in the Google Play Store. It garnered over 100 downloads before Google finally removed it from the app storefront.

FlyGram, developed by the same threat actor, followed a similar trajectory but was removed in 2021. The Slovak cybersecurity firm ESET has identified these apps as malicious versions of Signal and Telegram, designed to deliver malware to unsuspecting users.

Fake Singnal and Telegram apps on Google Play Store and Samsung Galaxy Store (Image: ESET)

These fake apps were more than just imitations; they were sophisticated tools for cyber espionage. In a blog post, ESET researchers mentioned that the counterfeit Telegram app could harvest basic device information, sensitive data, Google accounts, and call logs. Additionally, it had a feature enabling it to back up data to a remote server controlled by the attacker.

The malicious Signal Plus app, on the other hand, could monitor both incoming and outgoing messages, transmitting them to a remote server for unauthorized access. To appear legitimate, dedicated websites were created for both apps, complete with links for direct installation from the Google Play Store.

The apps were created by a China-based hacking group known as GREF. GREF, also know as APT15, Ke3chang, Mirage, Vixen Panda and Playful Dragon, was also pointed out in July 2020 over the China’s insidious surveillance against Uyghurs with Android malware

Back in March 2018, these same threat actors were also found targeting a UK Government Contractor to steal military technology secrets. GREF is know the BadBazaar malware and in this campaign, the malicious code found in these apps is also attributed to the BadBazaar malware.

This should not be surprising, as another Chinese APT group, Smishing Triad, was recently reported to be carrying out a large-scale smishing campaign against users in the United States. This attack involved impersonating leading mail and delivery services.

Initially, users in China were the primary targets of these fake apps. However, the threat has since expanded to include users in Ukraine, Poland, the Netherlands, Spain, Portugal, Germany, Hong Kong, and the United States. 

If you’ve unwittingly installed Signal Plus Messenger or FlyGram, removing them from your phone is crucial. However, exercise caution when doing so. Before uninstalling these apps, make sure to unlink your Signal and Telegram accounts to prevent further data exposure. Google has labeled these apps as malicious and capable of stealing personal information.

**Some quick tips for staying safe from fake apps**

*   Only download apps from official app stores, such as the Google Play Store and the Apple App Store.
*   Be wary of apps that ask for more permissions than they need.
*   Read the reviews of an app before you download it.
*   Keep your apps updated.
*   Regularly scan your device for malware using a security app.

1.  Phishers Now Actively Automating Scams with Telegram
2.  Telegram and Discord Bots Delivering Infostealing Malware
3.  New MMRat Android Trojan Uses Fake App Stores for Bank Fraud
4.  Researcher Identifies Popular Swing VPN Android App as DDoS Botnet

Chinese APT Slid Fake Signal and Telegram Apps onto Official App Stores

By Deeba Ahmed
China's reply to OpenAI's ChatGPT is here, and it's called Baidu's Ernie Bot.
This is a post from HackRead.com Read the original post: China’s Baidu Introduces ChatGPT Rival Ernie Bot

Ernie Bot (full name: Enhanced Representation through Knowledge Integration) is the first generative AI chatbot publicly released in China. Although it is available globally, users need a Chinese phone number to register and log in.

*   Baidu’s AI chat service Ernie Bot is the first Chinese rival to ChatGPT.

*   Ernie Bot is powered by Baidu’s Ernie language model, which is trained on a massive dataset of text and code.

*   Ernie Bot can be used for a variety of tasks, including generating text, translating languages, writing different kinds of creative content, and answering your questions in an informative way.

*   The Chinese government is still in the process of regulating the generative AI industry, so there are some restrictions on how Ernie Bot can be used.

*   Despite these restrictions, Ernie Bot is a significant development in the field of AI and has the potential to be a powerful tool for businesses and individuals.

After the stupendous success of OpenAI’s ChatGPT, every company wants to integrate AI technology, and many want to develop customized AI language models, such as Baidu. The Chinese multinational AI tech firm Baidu has officially received the go-ahead for its own AI-based chatbot Ernie Bot, regarded as the rival of ChatGPT.

Ernie Bot, similar to its primary competitor ChatGPT, offers users the ability to inquire about various topics or request assistance in creating market analysis, generating marketing slogans, and summarizing documents.

**Chinese Public Received the Country’s First AI Chatbot:**

Baidu’s AI chat service Ernie Bot was initially launched on March 16 2023 as the first-ever Chinese rival to ChatGPT and made available to the public on August 30 after the government released regulations in July. Within 24 hours of its official release, the chatbot attracted 1 million users and over 33.4 million user queries.

The same day Baidu announced the release of another batch of AI applications and initiated the registration process for its chatbot. However, it is worth noting that when it was released in mid-March, MIT Technology Review’s Zeyi Yang dubbed its performance mediocre compared to ChatGPT.

**Chinese Tech Sector Eyeing Generative AI Industry**

According to Chinese media outlets, at least eight Chinese generative AI chatbots are part of the first batch of approved apps for the public. This includes ByteDance’s chatbot Doubao released on August 18 and Zidong Taichu 2.0 from the Institute of Automation at the Chinese Academy of Sciences. However, AI bots from Alibaba, JD, iFLYTEK, and 360 weren’t part of the first batch.

So far, over a dozen Chinese chatbots have been released, and most offer similar features as ChatGPT and other Western AI bots as all can converse in text, answer queries, solve math problems, compose poems, and write programming code.

**China Not Ready to Allow Free Access to AI Tech**

Ernie Bot and all other Chinese chatbots will be released with certain restrictions, which makes it difficult for the Chinese public to use these tools. In July 2023, the Chinese government released regulations before allowing the public access to generative AI models, which included a condition that companies would need to obtain relevant administrative licenses but didn’t specify what it meant.

To use Ernie Bot, users must create an account on Baidu and obtain a use license, which may take up to three months. That’s why many early members are now selling secondhand Baidu accounts on e-comm platforms for up to $100.

China’s Baidu Introduces ChatGPT Rival Ernie Bot

By Deeba Ahmed
Smishing Triad Impersonating Leading Mail/Delivery Services in New Attack
This is a post from HackRead.com Read the original post: Chinese Smishing Triad Gang Hits US Users in Extensive Cybercrime Attack

Triad cleverly impersonates postal/delivery services like Royal Mail or USPS to trap unsuspecting US citizens in its newly detected smishing campaign.

Cybersecurity rsearcgers at Resecurity have published an advisory about the newly discovered large-scale smishing campaign from the Chinese-speaking cybercrime group Smishing Triad targeting US-based users through impersonating popular mail and delivery services.

According to Resecurity, Smishing Triad originates from China and uses smishing attacks as its primary attack vector. Researchers found that Smishing Triad has affiliations with several different cybercrime groups and that the group offers cybercrime-as-a-service infrastructure with its Smishing kit subscription starting at $200/month. Subscribers receive activation codes and deployment scripts with different frameworks.

“It is complicated to disrupt cyber-criminal activity committed by actors located in foreign jurisdictions like China without proper regulatory harmonization and mutual legal assistance abroad. Resecurity is thus sharing information about the ‘Smishing Triad’ with the cybersecurity community and general public to raise awareness to help organizations better safeguard their customers,” the advisory read.

**What is a Smishing Attack?**

Smishing (aka SMS Phishing), scammers exploit SMS or text message features and services to trap unsuspecting users into revealing sensitive personal and financial details, including passwords, banking credentials, and debit/credit card numbers, and lure them into downloading malicious software.

Threat actors mimic some credible government or private entity for instance, postal services, government institutions, or banks for creating a sense of legitimacy around these messages. 

**How Does the Attack Occur?**

The group generally exploits iMessage service for sending package-tracking scams, and steals PII (personally identifiable information) and financial data (such as payment card details or banking credentials) to conduct credit card fraud and identity theft.

This time, Smishing Triad has changed its strategy slightly and exploits messages from compromised Apple iCloud accounts to trick users. Its smishing kit is also up for sale on Telegram IM groups to create an extensive and well-organized fraud-as-a-service network.

Resecurity threat intelligence team accessed and reverse-engineered one such kit and discovered an SQL injection vulnerability through which they could retrieve sensitive data of more than 108,000 victims and warned them about the likelihood of identity theft.

**Who are the Targets?**

In this campaign, Smishing Triad is targeting US citizens. The group impersonates most leading postal and delivery services to trick users, including the following:

*   USPS
*   Correos (Spain)
*   New Zealand Post
*   The Royal Mail (UK)
*   Postnord (Sweden)
*   Poczta Polska (Poland)
*   J&T Express (Indonesia)
*   New Zealand Postal Service (NZPOST)
*   Poste Italiane and the Italian Revenue Service (Agenzia delle Entrate)

The victim receives a message from any of these services requesting additional information or payment of delivery fees through a credit card. After obtaining the desired information, the attackers can commit financial fraud.

Phished text – What happens when the phishing link is clicked (Rsecurity)

In its earlier campaigns, the group targeted users from diverse regions such as the UK, Poland, Japan, Indonesia, Sweden, and Italy.

**Protection from Smishing Attacks**

Protecting yourself from smishing (SMS phishing) is important for safeguarding your personal information and financial security. Here are five points to help you stay safe from smishing:

*   **Verify the Sender**: Always verify the sender’s identity before responding to any SMS messages, especially those that ask for personal or financial information. Legitimate organizations usually include their name and contact information in their messages.
*   **Don’t Click on Links**: Avoid clicking on links or downloading attachments in text messages, especially if you didn’t expect to receive such a message. These links may lead to malicious websites or install malware on your device.
*   **Be Cautious with Personal Information**: Never share personal or financial information via text messages, such as Social Security numbers, credit card details, or login credentials. Legitimate organizations will not ask for such sensitive data through SMS.
*   **Use Trusted Sources**: If you receive an SMS claiming to be from a bank, government agency, or other official institution, don’t trust it blindly. Instead, contact the organization directly using a trusted phone number or website to verify the message’s authenticity.
*   **Install Security Software**: Use reputable antivirus and anti-malware software on your mobile device. These tools can help detect and block malicious SMS messages and links.

Additionally, keeping your phone’s operating system and apps up-to-date, using strong and unique passwords for your accounts, and enabling two-factor authentication wherever possible can further enhance your protection against smishing and other cyber threats.

Chinese Smishing Triad Gang Hits US Users in Extensive Cybercrime Attack

By Habiba Rashid
The database contained over 17 billion records, which is equivalent to about 6.35 terabytes of data.
This is a post from HackRead.com Read the original post: Cigna Health Data Leak: 17 Billion Records Exposed

**Key Findings**

*   **A non-password-protected database containing over 17 billion records was exposed.**

*   **The leaked records included healthcare provider information, such as names, addresses, and contact numbers.**

*   **The leaked records also included negotiated rates for medical procedures.**

*   **The data leak was caused by a security lapse at Cigna Health.**

*   **Cigna Health has taken steps to secure the database and is investigating the incident.**

Cybersecurity researcher Jeremiah Fowler has unearthed a concerning incident involving a non-password-protected database containing over a staggering 17 billion records. The extensive records were traced back to Cigna Health, a major player in the health insurance industry. The company’s effort to bolster transparency inadvertently led to this massive data leak, as disclosed by Fowler.

The leaked records, amounting to a colossal 6.35 terabytes, primarily consisted of healthcare provider information. Details included the names of hospitals and doctors, location addresses, contact numbers, and various identification numbers such as the National Provider Identifier (NPI). Importantly, these records also disclosed negotiated rates for medical procedures. However, it is essential to clarify that the exposed data did not encompass customer or patient information.

Screenshot from the leaked records (Jeremiah Fowler)

Fowler’s discovery prompted a swift response from Cigna, acknowledging the security lapse and taking immediate measures to secure the vulnerable database from public access. Cigna defended its stance by citing its Transparency in Coverage program, which adheres to federal regulations in place since 2022.

Notably, the information contained within the database was intended for public access due to regulatory requirements. However, the lack of proper security measures posed potential risks to Cigna’s broader internal storage network.

The exposed database, which offered an unprecedented behind-the-scenes look into Cigna Health, detailed the company’s operations spanning all 50 states in the United States. Cigna Health offers an array of health insurance plans, catering to individuals, families, employers, and various government programs. 

The database’s structure was logically organized and easily searchable, revealing provider records alongside Current Procedural Terminology (CPT) codes. Under the Affordable Care Act, health insurers are mandated to disclose negotiated rates publicly, emphasizing transparency. Despite the potential benefits of this disclosure, the size and complexity of these data files could prove challenging for non-technical individuals to navigate effectively.

Security concerns regarding the leaked data revolve around the potential misuse of National Provider Identifier (NPI) numbers, which serve as unique identifications for healthcare providers. While the leaked data did not indicate any misconduct by Cigna, NPIs have been exploited in the past for fraudulent activities such as Medicare and Medicaid scams and non-password-protected databases could expose companies to ransomware attacks.

**RELATED ARTICLES**

1.  Cybersecurity firm exposes 5 billion data breach records
2.  DreamHost hosting firm exposed almost a billion sensitive records
3.  9,517 unsecured databases identified with 10 billion records globally
4.  Online trading broker FBS exposes 20TB of data with 16 billion records
5.  Brazilian marketplace integrator Hariexpress exposed 1.75 billion records

Cigna Health Data Leak: 17 Billion Records Exposed

By Habiba Rashid
The cybersecurity researchers at FortiGuard Labs have identified several Adobe ColdFusion vulnerabilities impacting Windows and Mac devices.
This is a post from HackRead.com Read the original post: Hackers Exploit Adobe ColdFusion Vulnerabilities to Deploy Malware

*   Remote attackers can exploit pre-authentication RCE vulnerabilities in Adobe ColdFusion 2021 to seize control of affected systems.

*   Adobe has released security patches to address these vulnerabilities, but attackers are still exploiting them.

*   The attack campaign involves multiple stages, including probing, reverse shells, and the deployment of malware.

*   Four distinct malware strains have been identified: XMRig Miner, Satan DDoS/Lucifer, RudeMiner, and BillGates/Setag backdoor.

*   Users are advised to upgrade their systems promptly and deploy protection mechanisms to thwart ongoing attacks.

Numerous users of both Windows and macOS platforms are currently at risk due to vulnerabilities present in Adobe ColdFusion. This software suite, a popular choice for web application development, recently came under attack as remote attackers discovered and exploited pre-authentication remote code execution (RCE) vulnerabilities. Such vulnerabilities granted attackers the ability to seize control of affected systems, raising the alarm to a critical severity level.

The crux of these attacks targets the WDDX deserialization process within Adobe ColdFusion 2021. While Adobe responded swiftly with security updates (APSB23-40, APSB23-41, and APSB23-47), FortiGuard Labs observed continued exploitation attempts. 

An analysis of the attack patterns uncovered a process executed by the threat actors. They initiated probing activities using tools like “interactsh” to test the exploit’s effectiveness. These activities were observed involving multiple domains including mooo-ngcom, redteamtf, and h4ck4funxyz. The probing phase provided attackers insights into potential vulnerabilities and served as a precursor to more malicious actions.

The attack campaign’s sophistication extended to the utilization of reverse shells. By encoding payloads in Base64, attackers sought to gain unauthorized access to victim systems, enabling remote control. 

Notably, the analysis disclosed a multi-pronged approach, including the deployment of various malware variants. Attacks were launched from distinct IP addresses, raising concerns about the campaign’s widespread reach. Malware payloads were encoded in Base64, concealing their true nature until decoded. Researchers identified four distinct malware strains at play: XMRig Miner, Satan DDoS/Lucifer, RudeMiner, and BillGates/Setag backdoor.

The XMRig Miner, primarily associated with Monero cryptocurrency mining, was harnessed to hijack system processing power. By utilizing version 6.20.0, attackers managed to capitalize on compromised systems for their own financial gain.

Attackers’ webpage (FortiGuard Labs)

A hybrid bot combining cryptojacking and distributed denial of service (DDoS) functionalities, Lucifer emerged as a formidable entity. This malware variant showcased not only its mining capabilities but also its adeptness in command and control operations, propagation through vulnerabilities, and sophisticated DDoS attacks.

RudeMiner, connected to Lucifer, carried a DDoS attack legacy from previous campaigns. Its involvement in the ongoing threat landscape demonstrated its persistence and adaptability, marking it as a significant concern.

The BillGates/Setag backdoor, previously associated with Confluence Server vulnerabilities, resurfaced in this context. Its multifaceted capabilities encompassed system hijacking, C2 communication, and diverse attack methods, including SYN, UDP, ICMP, and HTTP-based attacks.

Despite the availability of security patches, the continuous stream of attacks underscores the urgency of action. Users are strongly advised to upgrade their systems promptly and to deploy protection mechanisms including antivirus services, IPS signatures, web filtering, and IP reputation tracking, to thwart ongoing attacks.

1.  Adobe Reset User Passwords as Precaution Against Data Breach Risks
2.  Apple mistakenly approved malware camouflaged as Adobe Flash Player
3.  Fake Adobe updates installing cryptomining malware while updating Flash

Hackers Exploit Adobe ColdFusion Vulnerabilities to Deploy Malware

By Owais Sultan
FPS games on Android have become trendy thanks to the strong smartphone CPU power and graphics from game developers.
This is a post from HackRead.com Read the original post: The Best FPS Games on Android In 2023: Popular by Demand

In recent years, the mobile gaming industry has witnessed a significant rise in first-person shooter (FPS) games. The year 2023 is well underway, Android users can expect an array of high-quality FPS games that have gained popularity by demand. This article aims to explore the best FPS games available on Android and analyze their appeal to gamers.

At the forefront of this trend is Call of Duty Mobile, which offers a thrilling multiplayer experience with its immersive gameplay and impressive graphics. Additionally, PUBG Mobile continues to captivate players with its intense battle royale mode, providing an adrenaline-fueled gaming experience.

Moreover, Apex Legends Mobile has emerged as a strong contender in the realm of FPS games on Android, offering dynamic gameplay and strategic team-based battles. These three titles exemplify how Android is leading the mobile gaming race by delivering top-notch FPS experiences for enthusiasts.

As we delve deeper into each game’s features and mechanics, it becomes evident why they have become favourites among gamers worldwide. By examining their success and analyzing player feedback, we can understand why these games are in such high demand on Android devices in 2023.

**The Rise of FPS Mobile Gaming in 2023**

In 2023, the popularity of FPS mobile gaming has experienced a significant rise, with Call of Duty Mobile emerging as the highest-played mobile FPS game, followed by PUBG Mobile and Apex Legends Mobile, according to a study by SecureCheats analyzing Google search data and player statistics. 

This study conducted by SecureCheats employed an analysis of Google search data and player statistics from the last 12 months to determine the most popular mobile FPS games. Each game was assigned its own total score based on these factors.

Call of Duty Mobile secured the top position in this study, affirming its widespread appeal among gamers. The game offers an immersive first-person shooting experience coupled with impressive graphics and a wide array of gameplay modes. 

PUBG Mobile claimed the second spot in this ranking, showcasing its enduring popularity within the FPS genre. Known for its intense battle royale matches and realistic gunplay mechanics, PUBG Mobile continues to captivate players worldwide.

Apex Legends Mobile secured the third place in this ranking, demonstrating its growing presence in the realm of mobile FPS gaming. With fast-paced gameplay and unique character abilities, it has garnered a dedicated fanbase.

The rise of FPS mobile gaming is evident through these rankings, indicating that players are increasingly gravitating towards engaging and competitive experiences on their smartphones. The dominance of Call of Duty Mobile further reinforces its status as a leading force within this genre.

**Call of Duty Mobile**

Call of Duty Mobile has gained significant traction among gamers for its immersive gameplay experience and realistic graphics. Developed by Tencent Games in collaboration with Activision, this first-person shooter (FPS) game offers a thrilling multiplayer mode that allows players to engage in fast-paced combat across various iconic maps from the Call of Duty franchise.

One of the key strengths of Call of Duty Mobile is its attention to detail in replicating the gameplay mechanics and overall feel of the popular console version. The controls have been optimized for touchscreens, providing smooth and responsive movements that enhance the overall gaming experience. Additionally, players can choose from a wide range of customizable load-outs, allowing them to tailor their playstyle to their preferences.

The graphics in Call of Duty Mobile are impressive, delivering stunning visuals that rival those seen on dedicated gaming consoles. From detailed character models to dynamic environments, every aspect contributes to creating an immersive world for players to explore.

Furthermore, regular updates and additions keep the game fresh and engaging. New maps, game modes, and weapons are frequently introduced, ensuring that players always have something new to discover.

Overall, Call of Duty Mobile stands as a testament to the ever-increasing quality and popularity of FPS games on mobile platforms. Its immersive gameplay experience coupled with realistic graphics make it a top choice among gamers seeking intense action on their Android devices.

**PUBG Mobile**

Developed by PUBG Corporation, PUBG Mobile has captivated gamers worldwide with its expansive open-world gameplay and intense battle royale experience. Released in 2018, the game quickly became a sensation, garnering millions of downloads and earning critical acclaim for its immersive and realistic gameplay.

PUBG Mobile offers players a highly competitive and adrenaline-fueled experience. The game drops 100 players onto an island where they must scavenge for weapons, vehicles, and supplies while eliminating opponents to become the last person standing. With its vast map and stunning graphics, PUBG Mobile provides an incredibly immersive environment that keeps players engaged.

One of the key aspects that sets PUBG Mobile apart from other FPS games is its focus on teamwork. Players can form squads with their friends or join forces with strangers to strategize and outmanoeuvre opponents. This cooperative element adds another layer of depth to the gameplay, fostering communication and coordination among teammates.

Furthermore, PUBG Mobile regularly updates its content to keep players engaged and excited. New maps, weapons, game modes, and events are introduced frequently, ensuring that there is always something fresh for players to explore.

Overall, PUBG Mobile’s combination of expansive open-world gameplay, intense battle royale action, teamwork-oriented mechanics, and regular updates makes it one of the best FPS games available on Android in 2023. Its popularity is a testament to its captivating nature and ability to provide an adrenaline-pumping gaming experience for mobile gamers worldwide.

Apex Legends Mobile, a highly anticipated addition to the popular battle royale genre, offers players an exhilarating and fast-paced gameplay experience. Developed by Respawn Entertainment, this free-to-play game brings the thrilling action of Apex Legends to Android devices.

*   Diverse roster of characters: Apex Legends Mobile features a diverse lineup of legends, each with their own unique abilities and playstyles. From aggressive brawlers to tactical support characters, players can choose from a variety of options that suit their preferred playstyle.
*   Intense squad-based gameplay: In Apex Legends Mobile, teamwork is crucial for victory. Players are encouraged to form squads of three and work together to outmanoeuvre and eliminate opponents. The game promotes strategic decision-making and effective communication among team members.
*   Dynamic map design: The game’s map is meticulously designed with various terrains, providing players with opportunities for both close-quarters combat and long-range engagements. Additionally, the inclusion of jump pads and ziplines adds verticality to the gameplay, allowing for dynamic movement across the map.

With its diverse character roster, intense squad-based gameplay, and dynamic map design, Apex Legends Mobile delivers an immersive experience that has captivated fans of the battle royale genre. As it continues to evolve in popularity on Android devices in 2023, Apex Legends Mobile solidifies its position as one of the best FPS games available on this platform.

**Android Leading the Mobile Gaming Race**

Android has emerged as a dominant force in the mobile gaming industry, displaying its prowess and adaptability by consistently attracting a wide range of players with its diverse selection of games.

With advancements in technology and hardware capabilities, Android has positioned itself as a leading platform for gaming enthusiasts. The popularity of Android devices can be attributed to their affordability, accessibility, and compatibility with various game genres.

One key advantage that Android has over other platforms is its open-source nature, allowing developers to create innovative and immersive gaming experiences. This has resulted in a vast library of high-quality games available on the Google Play Store, catering to different preferences and interests. 

Furthermore, Android’s ability to support high-end graphics and smooth gameplay enhances the overall user experience.

Additionally, the integration of cloud gaming services such as Google Stadia and NVIDIA GeForce Now further solidifies Android’s position as a frontrunner in the mobile gaming race. These services allow users to stream console-level games directly onto their Android devices without compromising on performance or visual quality.

As more developers continue to prioritize Android development due to its market share and user base, it is expected that the platform will continue to dominate the mobile gaming industry in 2023 and beyond. Its adaptability, diverse game selection, affordability, and technological advancements make it an attractive choice for both casual gamers and hardcore enthusiasts alike.

The Best FPS Games on Android In 2023: Popular by Demand

By Habiba Rashid
Dubbed MalDoc in PDF attack by researchers, the new attack trend utilizes PDF and Word files to spread malware.
This is a post from HackRead.com Read the original post: MalDoc in PDF Attack: Hackers Hiding Malicious Word Files within PDFs

**KEY FINDINGS**

*   Hackers are using polyglot files to embed malicious Word documents within PDFs.

*   These files can appear in one format but can be interpreted as another, depending on the application.

*   The MalDoc in PDF attack can evade conventional detection mechanisms, such as PDF analysis tools, sandboxes, and antivirus software.

*   However, it can be detected by certain analysis tools, such as ‘OLEVBA.’

*   To protect yourself from this attack, disable macros in Microsoft Office and use a multi-layered security approach.

Security experts at Japan’s computer emergency response team (JPCERT) have uncovered a novel cyberattack technique dubbed ‘MalDoc in PDF.’ This innovative method involves embedding malicious Word files within PDF documents, allowing hackers to spread malware while evading conventional detection mechanisms.

The technique relies on the concept of polyglot files, which appear as one format but can be interpreted as another, depending on the application. Japan’s computer emergency response team (JPCERT) investigation into the ‘MalDoc in PDF’ attack capitalizes on polyglots – files containing two distinct formats that can be executed as different types, depending on the opening application. In this case, hackers utilize both PDF and Word document formats, allowing the malicious file to function in either format.

By leveraging polyglot files, cybercriminals create documents that appear harmless in one format but contain malicious code in another. In the ‘MalDoc in PDF’ attack, a PDF document conceals a Word file housing a VBS macro. When opened in Microsoft Office as a .doc file, the macro downloads and installs an MSI malware file on vulnerable systems.

However, it’s important to note that this attack relies on macros being enabled on the victim’s computer; disabling macros remains an effective security measure.

For your information, A polyglot file is a type of computer file that is designed to be valid and functional in multiple formats or applications simultaneously. Essentially, it’s a single file that can be interpreted differently depending on the software that opens it.

This characteristic is often exploited by attackers to create files that appear harmless in one context but contain malicious code in another, thus bypassing security measures that may not be capable of detecting the hidden malicious content.

The ingenuity of the ‘MalDoc in PDF’ can lead to confusion for PDF analysis tools, sandboxes, and antivirus software, which might fail to detect the embedded malicious components. However, certain analysis tools, like ‘OLEVBA,’ can still identify the concealed threats, suggesting that a multi-layered security approach remains effective.

JPCERT shares a Yara rule to aid in identifying files that deploy this method. This rule checks for patterns indicative of both PDF and Word document formats within the same file, offering a way to spot potential threats. 

**RELATED ARTICLES**

1.  Hackers abusing Google App Engine to spread PDF malware
2.  5 PDF Tricks You Should Know To Improve Document Productivity
3.  Banking Malware Delivered via Macro in PDF Embedded Word Document

MalDoc in PDF Attack: Hackers Hiding Malicious Word Files within PDFs

By Waqas
If you are an Airbnb user, you need to be vigilant against cybercriminals who are targeting your device, personal, and financial information.
This is a post from HackRead.com Read the original post: Crooks Using Stealers and Stolen Cookies to Hack Airbnb Accounts

The cybersecurity researchers at SlashNext have unveiled a concerning attack trend that targets unsuspecting users who own Airbnb accounts. This trend involves a wide range of malicious techniques, though not entirely new, that pose a significant threat.

**KEY FINDINGS**

*   Cybercriminals are using a variety of methods to gain unauthorized access to Airbnb accounts, including stealers, stolen cookies, and account checkers.

*   Once cybercriminals have gained access to an Airbnb account, they can use it to book properties, make fraudulent purchases, or even steal the victim’s personal information.

*   The scale of the problem is significant, with thousands of Airbnb accounts available for purchase on digital stores for as low as one dollar.

*   To protect yourself from this type of fraud, it is important to take steps to secure your Airbnb account, such as using a strong password and enabling two-factor authentication.

*   You can also help to protect yourself from Airbnb scams by only booking with hosts who have a good reputation and positive reviews, being wary of offers that seem too good to be true, and never giving out your personal information to anyone you don’t know and trust.

Cybercriminals are constantly finding new ways to exploit popular online platforms, and Airbnb is no exception. In a recent investigation by SlashNext cybersecurity firm, researchers found that cybercriminals are using a variety of methods to gain unauthorized access to **Airbnb** accounts, including stealers, stolen cookies, and account checkers.

Once cybercriminals have gained access to an Airbnb account, they can use it to book properties, make fraudulent purchases, or even steal the victim’s personal information. In some cases, cybercriminals have even used stolen Airbnb accounts to commit identity theft.

The scale of the problem is significant. In the SlashNext investigation, researchers found that thousands of Airbnb accounts were available for purchase on digital stores for as low as one dollar. This suggests that cybercriminals are regularly stealing Airbnb account information and selling it on the black market.

A recent **blog post** released by cybersecurity firm SlashNext sheds light on the audacious tactics employed by cybercriminals to exploit Airbnb for their nefarious activities.

**Stealers**

Cybercriminals harness a breed of malicious software (malware or trojan), aptly named “stealers,” to extract sensitive information like usernames, passwords and other sensitive logs. from a targeted device. Once collected, these logs are typically routed to servers controlled by crooks.

The deployment of stealers is carried out through a variety of techniques, ranging from manipulating human psychology (**social engineering**) to exploiting software vulnerabilities and leveraging deceptive advertising (**malvertising**).

Beneath the digital underbelly lies a clandestine market where cybercriminals can purchase and vend unauthorized access to devices, referred to as “bots,” “installs,” or “infections,” en masse.

For those willing to invest, cybercriminals can swiftly acquire a repository of thousands, if not tens of thousands, of devices teeming with stealers.

Targeting web application account information across most browsers, stealers neatly package their loot within a structured format. This format comprises columns and rows, encapsulating a slew of data fragments—names, credit card particulars, and more. Aside from harvesting login credentials, stealers can also hijack cookies.

**Cookies: A Gateway to Illicit Access**

**Cookies**, unobtrusive data packets housing users’ online preferences and activities, have unwittingly become pawns in the hands of cybercriminals. These crooks thrive on stealing, trading, and buying Airbnb account cookies on various illicit forums. Armed with these ill-gotten tokens, cybercriminals temporarily breach Airbnb accounts without the need for legitimate usernames or passwords.

Imagine a scenario where cybercriminals purchase a trove of stolen Airbnb cookies, load them onto their browsers, and slip into victims’ accounts undetected. Armed with this unauthorized access, they can masquerade as legitimate users, booking properties or orchestrating other unauthorized transactions without triggering any alarms. It’s imperative to note that such session cookies possess a brief lifespan, compelling cybercriminals to act swiftly.

**Monetizing Stolen Data**

With user accounts compromised and stolen cookies in their arsenal, cybercriminals pivot toward monetizing. A common practice involves directly peddling stolen account data and cookies to other crooks. This trade occurs on online forums, dark web markets and even through **Telegram channels**.

According to SlashNext, the dark web and underground platforms are filled with thousands of Airbnb accounts on sale, a shocking devaluation reducing each account’s worth to a mere dollar.

Evidently, the scale of Airbnb account heists has created the emergence of “account checkers”—automated tools that systematically scrutinize Airbnb credentials stored in a text file.

**Navigating Airbnb Cookie Checkers**

The modus operandi behind account checkers is straightforward: threat actors input a text file crammed with stolen credentials, and the checker discerns the valid from the defunct. Some advanced iterations of these tools even execute specific actions, like making fraudulent bookings.

With a “passion” for innovation, cybercriminals have even initiated a service slashing up to 50% off Airbnb bookings. The profusion of interest in these services is evident, with forum threads racking up tens of thousands of views and hundreds of replies.

The unsettling reality is that cybercriminals have masterminded an array of techniques to exploit Airbnb’s popularity, leveraging stealers and purloined cookies to breach user accounts.

The stolen information is subsequently sold to other criminals or leveraged to offer discounted services on the **black market**. The rampant account theft underscores the pressing need for vigilance and proactive measures to counteract these insidious cyber threats.

Cybercriminals willing to pay for stolen Airbnb accounts – A popular market selling stolen Airbnb accounts – Airbnb account checker (Screenshots: SlashNext)

**Protection**

Hackread.com has compiled a list of steps that can help Airbnb users (or any unsuspecting user online) protect themselves against the growing trend of attacks.

*   Enable two-factor authentication.
*   Use a strong password and change it regularly.
*   Be careful about clicking on links in emails or messages from people you don’t know.
*   If you think your account has been compromised, immediately change your password and contact Airbnb customer support.

In addition to the tips above, here are some other things you can do to protect yourself from Airbnb scams:

*   Be wary of offers that seem too good to be true.
*   Only book with hosts who have a good reputation and positive reviews.
*   Never give out your personal information, such as your credit card number or passport number, to anyone you don’t know and trust.
*   If you have any concerns about a booking, contact Airbnb customer support.

However, the best defence against cybersecurity threats is using common sense. Therefore, employ it at all times.