By Owais Sultan
Onboarding new hires is not as simple as saying, “Welcome Aboard!” You have to navigate this tricky process…
This is a post from HackRead.com Read the original post: Ultimate New Hire Onboarding Checklist: Your Roadmap to Success

**Onboarding new hires** is not as simple as saying, “Welcome Aboard!” You have to navigate this tricky process – from setting up their first day in the office to making sure they feel welcomed and have all of the tools needed for success. This post will guide you on the onboarding checklist for new Hires.

**1\. Pre-Onboarding**

Before you even set foot in the office, it’s essential to make sure everything is ready for your newbie’s arrival. Inform them about what to expect during their first day(s), such as company culture or dress code policy; send out some fun swag ahead of time, like branded shirts or mugs with clever sayings \[take a note from Mailchimp here\].

First impressions do last a lifetime, so don’t let your new hire show up with no desk space or computer/tablet setup if that’s required within their role. Additionally, ensure they have everything necessary, such as mouse pads or specialized software, before arriving.

**2\. Day One & Beyond**

One thing more daunting than being a newcomer is coming into an environment where everyone else knows each other already. Help ease anxiety by appointing someone on your team (e.g., culture ambassador) whose primary responsibility is to welcome newcomers!

A good starting point after introductions would be to provide detailed information about job responsibilities followed by expectations from both parties moving forward (new hire manager). Schedule regular check-ins throughout probationary periods allowing ample time for addressing any concerns promptly.

**3\. Welcoming New Staff**

Let’s face it – we all like feeling special and appreciated when starting something new, a job included. Set up small gestures such as a shoutout at weekly meetings or introduce them to other departments to expand their network and encourage engagement throughout. Speaking from experience, things like an office tour with designated spots of interest or even a scavenger hunt can create a sense of fun and excitement.

**4\. Training**

Familiarization doesn’t happen overnight. Ensure that the formal training schedule has been developed prior, ensuring the emphasis is placed on meeting company standards while demonstrating individual growth potential. Make sure your new hires comprehend concepts before moving on.

**5\. Set up access**

**Information Security**– our favourite, right? Ensure access rights granted to relevant software/apps conform with the position held by the new hire(s). You may consider writing out a detailed authentication process before beginning so that no loose ends are untied post-hire.

**6\. Technology Update**

When grappling with tech-related issues, make certain pertinent information for trouble-shooting readily available as part of your **IT checklist for new hires** to avoid causing unnecessary frustrations. A troubleshooting guide detailing steps for key concerns should suffice – simple ‘catch-ups’ can prevent issues from snowballing.

**7\. Buddy System/Mentorship programs**

Starting Fresh consumes huge buckets of energy; hence most people prefer having co-workers they trust guiding them through uncharted waters through support systems **such as mentors** or buddies—allowing time to foster lasting relationships, especially when introducing friends outside work circles!

**8\. Generation Z onboarded**

One thing little thought about is catering makes a difference in how one approaches prospective hire’s preferences; younger folks prefer differently compared to millennial counterparts! **According to** Forbes Magazine,” Gen-Z seeks autonomy \[autonomy allows independence when working\] and positive and negative feedback. You’ll find meaningful appeal in emphasizing these points clearly during introductions.

So with all of the above in mind, write up your checklist for onboarding new hires. Every company has different cultures, personalities, and expectations – cater to those differences as you plan. And most importantly: have fun! It’s a learning curve for both parties- let them grow together!

Ultimate New Hire Onboarding Checklist: Your Roadmap to Success

By Habiba Rashid
Malware-Driven Proxy Servers Exploit Unsuspecting Users.
This is a post from HackRead.com Read the original post: New Malware Turns Windows and macOS Devices into Proxy Nodes

*   **Malware transforms Windows and macOS devices into proxy nodes.**
*   **Compromised machines reroute traffic as covert proxy exit points.**
*   **Malicious actors exploit infected systems for proxy requests.**
*   **Windows and macOS devices were repurposed for unauthorized activities.**
*   **AT&T Alien Labs reveals an alarming malware-driven proxy phenomenon.**

The cybersecurity researchers at AT&T Alien Labs have shed light on an alarming phenomenon where malicious actors are harnessing malware-infected Windows and macOS machines as proxy exit nodes to reroute proxy requests.

These actors, utilizing a proxy server application, are covertly leveraging compromised systems to establish proxy exit nodes, enabling them to redirect proxy requests. It appears that these proxy exit nodes are not exclusively originating from users who have knowingly agreed to participate, as the proxy service’s website claims.

The attack vector involves delivering proxy servers through various malware strains that target unsuspecting users enticed by offers of cracked software and games. The proxy application, coded using the versatile Go programming language, ensures compatibility across multiple operating systems, including macOS and Windows.

One striking observation is the difference in the detection rates between macOS and Windows systems. While the Windows version of the proxy application effortlessly evades security measures due to its signed nature, the macOS variant is more easily detected. 

According to AT&T’s blog post, Once executed on a compromised system, the malware discreetly installs the proxy application, sidestepping user interaction and simultaneously introducing additional malware or adware components. To achieve this covert process, the malware creators employ Inno Setup, a widely-used Windows installer. This tool enables the creation of packed executables, facilitating the proxy’s seamless installation and persistence within the system.

The nature of the malware-driven proxy server extends to its communication with the command and control server (C&C). The proxy application not only relays specific parameters to the C&C but also collects critical information about the compromised system, including processes, CPU and memory usage, and even battery status. This adaptive data collection ensures the proxy’s optimal performance and responsiveness while evading suspicion.

The monetization of malware-infused proxy servers through affiliate programs poses a significant challenge. The proxy application, packaged with Inno Setup, persists through multiple mechanisms, including registry keys and scheduled tasks, enabling the proxy to continually function as a covert channel for unauthorized financial gains.

Collected information being sent to C&C server (Screenshot: AT&T Alien Labs)

The campaign’s disclosure builds upon previous findings by AT&T Alien Labs, in which macOS systems infected with AdLoad adware were repurposed as exit nodes for a vast residential proxy botnet.

This pattern potentially points to operators of AdLoad orchestrating a pay-per-install campaign. AdLoad, a notorious adware strain masquerading as legitimate applications, has been capitalizing on unsuspecting users to navigate them towards malicious websites, ultimately profiting from these schemes.

This evolving threat landscape is particularly concerning for macOS users, as the dark web has seen an exponential rise in the advertisement of information stealer strains and sophisticated tools aimed at bypassing macOS security mechanisms.

The past few years have witnessed an intensified focus on targeting macOS devices due to their growing prevalence in corporate environments, coupled with the high potential for earnings from malicious activities.

New Malware Turns Windows and macOS Devices into Proxy Nodes

By Owais Sultan
An anonymous Bitcoin wallet makes it possible to extend the level of anonymity when transferring cryptocurrencies to a…
This is a post from HackRead.com Read the original post: Benefits of Using an Anonymous Bitcoin Wallet in 2023

An anonymous Bitcoin wallet makes it possible to extend the level of anonymity when transferring cryptocurrencies to a large degree. When using an anonymous wallet, you’ll get all the same advantages as a regular wallet but with more privacy and security.

At the core of cryptocurrencies and decentralized finance is anonymity. But as crypto has grown bigger and more widespread in various areas of society, anonymity has become a concern. For obvious reasons, it can lead to unfortunate situations if everyone can be completely anonymous in financial transactions. Therefore it’s challenging to spend crypto entirely anonymously. 

Using an anonymous wallet is the best way to get the most considerable amount of anonymity. Just remember to choose one of the best anonymous Bitcoin wallets that will ensure your privacy to the greatest extent possible. These anonymous wallets, also called privacy wallets, have some advantages for crypto investors appreciating privacy.

****Enhanced security and anonymity** **

Obviously, the main point of using an anonymous Bitcoin wallet is enhanced privacy and safety. Anonymity is provided by encrypting the wallet and concealing information, such as usernames. Even though you can’t conceal your information completely due to regulations, you will be given a pseudonym that will still provide a great deal more privacy. In addition to this, anonymous Bitcoin wallets also have enhanced security when it comes to keeping your private keys safe.

Anonymous crypto wallets have all the same features as regular crypto wallets. You can customize your wallet and separate your funds. You’ll eliminate every middleman, such as banks or other financial institutes. You can store your cryptocurrencies safely and make quick, direct transfers. By choosing an anonymous one, you’re also backing the main visions of decentralized digital finance—freedom and privacy. So, by selecting an anonymous wallet, you’ll get all the same features as a regular wallet, just anonymously.

****A new decentralized financial reality****

It’s no question that cryptocurrencies will continue to grow as time goes on. The vision behind decentralized finance is appealing to people all over the world. People want sovereignty over their own funds and to keep their money safe, away from prying eyes and malicious hands. They don’t want to be controlled by centralized financial systems deciding how much their money is worth. All this, including inconvenience and privacy, is possible within the realms of the crypto world.

Benefits of Using an Anonymous Bitcoin Wallet in 2023

By Owais Sultan
The US Securities and Exchange Commission (SEC) is currently reviewing applications from several institutions for a spot Bitcoin…
This is a post from HackRead.com Read the original post: Exploring the Potential Impact of a Bitcoin Spot ETF Approval

The US Securities and Exchange Commission (SEC) is currently **reviewing** applications from several institutions for a spot Bitcoin ETF. The large financial companies to file for a spot ETF include BlackRock, 21 Shares & ARK Investment Management, VanEck, Invesco & Galaxy Digital, Valkyrie, Fidelity Investments and WisdomTree.

The potential approval of a Bitcoin spot ETF has increased investor certainty around BTC and sparked excitement about the looming possibility of a flood of investments pouring into the original cryptocurrency. This article will explore the latest Bitcoin news and the impact of a spot Bitcoin ETF approval.

**The Pathway to Institutional Adoption**

The crypto space has been buzzing ever since the largest asset manager in the world, BlackRock, **filed** an application with the SEC for a Bitcoin spot ETF two months ago to launch the iShares Bitcoin Trust. Larry Fink, CEO of BlackRock, told viewers of the Fox Business program that “The role of crypto is digitizing gold.”

Fink spoke about Bitcoin’s utility as a store of value, comparable to gold. He said, “Instead of investing in gold as a hedge against inflation, \[or\] a hedge against the onerous problems of any one country, or the devaluation of your currency of whatever country you’re in. Let’s be clear, Bitcoin is an international asset. It’s not based on any one currency, so it can represent an asset that people can play as an alternative.”

BlackRock hopes to continue its good track record for working with regulators, as all but one of its previous 576 ETF applications have been approved.

**The Possibility of a Spot Bitcoin ETF Has Profound Implications**

**Mike Novogratz**, the founder and CEO of Galaxy Digital, joined Bloomberg Wealth to discuss the validity of Bitcoin in light of the conversion of earlier critics like Larry Fink. 

According to Novogratz, the biggest thing to happen to Bitcoin this year was Larry Fink changing his position on Bitcoin. “For the CEO of the largest asset manager in the world,” Novogratz said, “this has profound implications.” 

When asked if a spot Bitcoin ETF is a big change for the industry, Novogratz referenced the preponderance of the evidence of some 180 million people around the world that are investing their savings and storing them in Bitcoin.

“It’s a big, big deal,” Novogratz told shareholders during Galaxy’s Q2 earnings call on August 8. “It’s a big deal because both our contacts, from the Invesco side and from the BlackRock side, get you to think that this is a question of when not if — that the outside window is probably six months.”

**Bitcoin at an Inflection Point: A Changing Regulatory Environment**

**Michael Saylor**, Co-founder and Executive Chairman of MicroStrategy joined Natalie Brunell on the Coin Stories Podcast to talk about the “Groundswell of positive sentiment for Bitcoin.” The consummate Bitcoin maximalist referenced several factors for the reason he has “never been more bullish” about BTC’s future.

According to Saylor, the endorsement of Bitcoin by US presidential candidates — both Ron DeSantis and Robert F. Kennedy, Jr. have emphatically supported citizens’ right to own Bitcoin in recent months, the changing regulatory environment, and the tone and treatment of BTC in the mainstream media are contributing to an overwhelmingly positive outlook for the king of crypto.

As the deadlines approach for the SEC to make a decision on the multiple ETFs, it is more important than ever for investors and traders to monitor the latest **Bitcoin news** in the coming days and weeks to see how it will all play out.

Exploring the Potential Impact of a Bitcoin Spot ETF Approval

By Owais Sultan
Estonia’s Tallinn, renowned for its medieval aesthetic, is not typically the first name one considers when reflecting upon…
This is a post from HackRead.com Read the original post: Payoro: A Glimmer of Disruption in the Banking Sector

Estonia’s Tallinn, renowned for its medieval aesthetic, is not typically the first name one considers when reflecting upon global financial hubs. However, it would be a grave oversight to disregard the burgeoning fintech scene germinating in its cobbled lanes. The city, already celebrated as the cradle of Skype, now embraces its next tech contender: Payoro.

Since its inception in 2020, Payoro has sought to redefine the conventional banking landscape with its Banking-as-a-Service (BaaS) model. The startup’s proposition is eloquently simple: deliver hassle-free IBAN account openings to private individuals in the EU/EEA.

However, its implications in a market bogged down by red tape are profound. By ensuring that the traditionally painstaking account opening process, after mandatory KYC and AML checks, becomes straightforward, Payoro heralds a new era of consumer-centric banking in Europe.

BaaS (not Backend-as-a-Service in this case), although a contemporary buzzword, is not to be dismissed as a mere fad. Citing industry metrics, the shift from conventional banking methods to a BaaS model is gaining momentum at an impressive rate. A recent report from McKinsey anticipates the global BaaS market to burgeon, estimating its worth at $3.6 trillion by 2025. Driving this ascent is the millennial and Gen Z demand for instantaneous, digital, and efficient financial services. With an increasing demographic disillusioned with traditional banking lag, BaaS is a timely remedy.

**BaaS – Competitors Galore**

This lucrative backdrop presents an ample playing field for Payoro, but the competition is fierce. Giants like SolarisBank, Starling Bank, and ClearBank have already carved significant niches in the BaaS sphere. Their advantage lies in their early market entry, vast resources, and established customer trust.

However, Payoro’s distinction stems from its keen insight into the EU/EEA regulatory (PDF) landscape and demographics. The company’s strategic localization of its services, combined with a broader European vision, positions it as a formidable contender in the regional BaaS ecosystem.

Estonia’s choice of Payoro’s birthplace is hardly incidental. This nation has astutely crafted a reputation as a fertile ground for digital innovation. Through initiatives like the e-residency program and an overarching commitment to digitalization, Estonia offers startups the requisite infrastructure and governmental backing, making it an ideal launchpad for fintech endeavours like Payoro.

Yet, as is the narrative with most startups attempting to disrupt established norms, challenges are inevitable. Payoro, while pioneering, must be wary of the pitfalls that come with innovation in a sensitive sector like finance. Constant innovation remains the mandate. In an industry that’s continually evolving, Payoro’s success will be contingent on its ability to stay ahead, offer value, and diversify its services.

**The Case for Trust**

The more pressing concern, however, is trust. In an age where data breaches make headlines and consumers grow increasingly wary of digital solutions, establishing and maintaining trust becomes paramount. Financial data, being among the most sensitive, demands rigorous cybersecurity measures. Moreover, Payoro’s transparent adherence to the stringent EU/EEA regulations becomes not just a legal necessity but also a cornerstone of its brand promise.

For keen market watchers, Payoro offers a captivating case study. As traditional banking edifices grapple with the winds of digital change, BaaS providers like Payoro seem primed to capitalize on the emerging gaps. Their model, which seeks to divorce banking services from their traditional confines and present them on user-friendly digital platforms, is emblematic of the democratization of finance.

In conclusion, Payoro is not merely Estonia’s latest fintech entrant; it’s a testament to where the global banking pulse is trending. For an industry that often finds itself at the crossroads of tradition and innovation, BaaS providers like Payoro illuminate the path forward. And as this Baltic prodigy embarks on its ambitious journey, the financial sector waits with bated breath, anticipating the ripples it’s poised to create in the vast ocean of global finance.

Payoro: A Glimmer of Disruption in the Banking Sector

By Owais Sultan
At its core, web scraping involves automatically extracting data from websites, enabling individuals and organizations to obtain valuable…
This is a post from HackRead.com Read the original post: Overcoming web scraping blocks: Best practices and considerations

At its core, web scraping involves automatically extracting data from websites, enabling individuals and organizations to obtain valuable data for analysis, research, and other purposes. However, this seemingly simple process does not come without its hurdles because many websites implement measures to block or limit automated activities.

Avoiding blocks in web scraping can be a relevant challenge and can prevent web scrapers from accessing the data they need or cause them to receive inaccurate or incomplete data.

****Common challenges in web scraping****

Web scraping can encounter various challenges that make it difficult or impossible to access data from websites. Some of the common challenges are these:

*   **CAPTCHAs:** they are tests designed to differentiate between human users and automated bots. They usually require the user to solve a puzzle, enter a code, or click on some images. CAPTCHAs can prevent web scrapers from accessing the website or submitting requests. For example, Google uses reCAPTCHA to gate its search engine to automated queries.
*   **IP address restrictions and rate limiting:** Websites often impose restrictions on the number of requests from a single IP address or implement rate limiting to prevent abuse and overloading of their servers. These limitations can hinder the efficiency and scalability of web scraping operations.
*   **Anti-scraping technologies and techniques:** Websites deploy various anti-scraping technologies and techniques specifically designed to detect, deter, or disrupt web scraping activities. This includes methods, such as encryption, obfuscation, fingerprinting, or honeypot traps, to detect and prevent web scrapers from accessing or extracting data from websites.
*   **Dynamic websites and AJAX content loading challenge:** With the advent of dynamic web technologies like AJAX, websites now load content asynchronously, making traditional scraping techniques inadequate. Scrapers need to deal with dynamically generated content, which often requires rendering JavaScript on the client side.

****Considerations to avoid getting blocked****

To avoid getting blocked and ensure a smooth web scraping experience, you should consider and implement the following best practices:

****Use a good programming language with robust capabilities for diverse web scraping scenarios****

The choice of programming language can affect the overall web scraping experience. You should use a programming language that has robust capabilities for handling various web scraping scenarios, such as parsing HTML, rendering JavaScript, sending requests, managing cookies, handling errors, and more.

Some popular programming languages for web scraping are Python and JavaScript. Each of these languages has its strengths and weaknesses in web scraping, and you should choose one that suits your needs and preferences.

For example, Python is widely used for extracting data because it has an intuitive syntax, a rich set of libraries, and a large community of developers. Meanwhile, JavaScript, being the language of the web, has various features and libraries that help in handling complex dynamically-rendered content or performing concurrent operations.

****Rotate user-agent****

User-Agent is a string that contains information about the user’s operating system, browser, and device that is making the request to the website. Websites can use User-Agent to detect and block web scrapers that repeatedly use the same or incorrect User-Agent.

To avoid detection and blocking, you should rotate your user agent frequently and use different user agents that mimic real browsers or devices. You can use libraries, such as Fake UserAgent for Python, to generate random user agents.

There are libraries and tools available for rotating the User Agent in Python, JavaScript, and other languages, allowing you to automate User-Agent rotation and ensuring that each request appears to come from a different user.

****Rotate IP addresses and use proxies****

An IP address is a unique identifier representing the location and network of the device requesting a website. Websites can track and limit the number of requests coming from a single IP address. Some websites may also impose geo-restrictions, limiting user access from specific regions. When running a web scraper that typically makes hundreds or thousands of requests, you can quickly hit the rate limit or even get blocked, frustrating your web scraping efforts.

To overcome IP-based restrictions, you should automate IP address rotation by changing the IP address with each request or distributing the scraping load across multiple IPs. Using a tool like ZenRows, you can implement this with minimal effort.

****Utilize headless browsers and handle JavaScript-rendered content****

Headless browsers are browsers that can operate without a graphical user interface. Headless browsers like Puppeteer and Selenium allow you to interact with and render dynamic content like a real browser.

This way, you can dynamically load and interact with JavaScript-rendered content, scrape data from dynamically generated pages, and navigate websites that rely heavily on client-side rendering.

****Moderate crawl rate and frequency****

Excessive crawl rates and high frequencies can strain a website’s server resources, leading to slow loading times, increased server load, and potentially getting blocked. To avoid that, you should moderate your crawl rate and frequency according to the website’s size, complexity, and nature of the data. You can also implement random delays between requests or use tools such as Scrapy to automatically control and adjust the frequency of your requests.

Overcoming web scraping blocks: Best practices and considerations

By Waqas
Data is indeed useful in cybersecurity. Many tools or platforms harness data in various forms including threat intelligence,…
This is a post from HackRead.com Read the original post: Data Fabric: The Intricate Shield Against Evolving Cyber Threats

Data Fabric: The Intricate Shield Against Evolving Cyber Threats

By Owais Sultan
The State of the Virtual CISO 2023” report, conducted by Global Surveys on behalf of Cynomi, reveals critical insights into MSPs and MSSPs’ recent shift towards vCISO services. 
This is a post from HackRead.com Read the original post: Cynomi Study Reveals Number of MSPs Providing Virtual CISO Services Will Grow Fivefold By Next Year

Cynomi Study Reveals Number of MSPs Providing Virtual CISO Services Will Grow Fivefold By Next Year

By Habiba Rashid
A new report from Jon DiMaggio, Chief Security Strategist at Analyst1, “Ransomware Diaries: Volume 3 - LockBit’s Secrets'' exposes LockBit's activities, their targets, and the challenges they've been facing.
This is a post from HackRead.com Read the original post: LockBit Ransomware Gang in Decline, May Be Compromised, Report

*   LockBit’s leadership vanished for two weeks in August 2023. This suggests that the gang may have been compromised or that there was internal conflict.

*   LockBit has been unable to consistently publish victim data. This has led to victims refusing to pay ransoms and affiliates leaving the program.

*   LockBit’s updated infrastructure is not as effective as it claims to be. This is evidenced by the fact that LockBit is still struggling to publish victim data.

*   LockBit’s affiliates are leaving for its competitors. This is because LockBit is not providing the support and resources that affiliates need.

*   LockBit ransomware gang missed its most recent release date. This suggests that the gang is struggling to develop new ransomware variants.

*   LockBit wants to steal ransomware from its rivals. This is a sign that LockBit is desperate and is willing to resort to unethical tactics to stay ahead of the competition.

LockBit, a prominent but infamous ransomware gang that has wreaked havoc across numerous industries, recently vanished from the cybercriminal scene, leaving affiliates and partners in a state of uncertainty. However, their reemergence after a brief hiatus has raised questions about their operational integrity.

A new report from Jon DiMaggio, Chief Security Strategist at Analyst1, “**Ransomware Diaries: Volume 3 – LockBit’s Secrets**” exposes LockBit’s activities, their targets, and the challenges they’ve been facing.

Dimaggio delved deep into LockBit’s operations and uncovered critical shortcomings within the gang’s modus operandi. In his extensive report, the researcher has highlighted LockBit’s struggles with data publication, deteriorating affiliate partnerships, and a lack of timely support responses. DiMaggio believes LockBit may have been compromised.

In 2022, LockBit reigned as the foremost ransomware group and Ransomware-as-a-Service (RaaS) provider globally. In a shift from traditional ransomware groups, LockBit’s unique approach involves maintaining the ransomware’s functionality, leasing access to it, and assisting affiliates in deploying attacks.

The model has enabled LockBit to foster a wide network of attackers, resulting in diverse tactics, techniques, and procedures employed during ransomware incidents. Affiliates employing the LockBit RaaS model have targeted entities spanning various sectors, including finance, education, healthcare, and government, leaving no industry immune to its malicious grip.

However, Lockbit’s reputation as a ransomware group has taken a serious hit following a series of events that DiMaggio’s exposé of the gang reveals. Earlier this year, they successfully breached and compromised Royal Mail, the United Kingdom’s largest postal service provider, and Maximum Industries.

The gang went on to **claim to breach** an aerospace manufacturing company with connections to SpaceX. But they failed to publish the data? This, too, after numerous claims that the data will be publicly available if ransomware demands were not met.

LockBit did the same in April 2023 when it **announced compromising Darktrace**, a British cybersecurity company. The claims were investigated and quickly dismissed by the company, and researchers never saw the claimed data. Instead, publicly available photos of Darktrace founder Poppy Gustafsson were published by the gang.

Photos of Poppy Gustafsson published by LockBit as proof of hack (Screenshot: Hackread.com)

Intriguingly, LockBit has started to rely on empty threats and propaganda to pressure victims into paying the ransom, even though it struggles with publishing victim data consistently due to backend limitations and bandwidth issues. This strategy, coupled with a strong narrative on criminal forums, is an attempt to maintain LockBit’s reputation which frankly, everyone can see through.

Not to mention, instead of the usual roster of legitimate victims, LockBit populated its site with entirely fictitious company names and websites, such as “1.com” and “123.com.” The situation took a funnier twist when LockBit issued a deadline for these fabricated entities to pay a relatively modest $60,000 ransom or face the publication of their nonexistent data.

A threat intelligence company casts doubt on the claims of the LockBit ransomware gang.

The abnormality of the situation became apparent to keen observers. First, the choice of victims itself raised eyebrows – LockBit was demanding an unusually low ransom, inconsistent with their usual greedy demands. Cybersecurity analysts noted that if this had been a genuine case, LockBit would have typically demanded a much larger sum.

Seeing LockBit’s dramatic antics and failure to live up to expectations, affiliate partners, essential for LockBit’s operations, are increasingly dissatisfied due to the gang’s struggles with data hosting and communication.

The research indicates that many affiliates have left LockBit’s program in favour of its competitors, driven by frustrations with unresolved support queries and the gang’s inability to deliver on its data publication promises.

The gang’s use of the secure communication application **Tox** has led to a growing issue of prolonged wait times for affiliates seeking support. LockBit’s high volume of attacks and expanding partner network has overwhelmed its communication infrastructure, resulting in **frustrated affiliates** struggling to obtain timely responses to critical queries.

While LockBit has hinted at the possibility of implementing a ticketing system, challenges in ensuring security and confidentiality remain a significant obstacle.

LockBit’s supposed commitment to innovation is challenged by its inability to release significant ransomware updates. Despite their previous successes with LockBit Red and LockBit Black, recent attempts at an update have fallen short, and the gang was found to be using outdated or stolen ransomware from other criminal groups. 

According to DiMaggio, the once-feared LockBit ransomware gang appears to be grappling with a cascade of issues, from faulty data publishing and strained communication to outdated ransomware variants and attempts to acquire competitors’ technology.

Overall, the report paints a picture of a ransomware gang that is in decline. LockBit is facing a number of challenges, including technical problems, internal conflict, and competition from other ransomware gangs. It is likely that LockBit will continue to lose ground in the coming months.

**RELATED ARTICLES**

1.  Cyber Security Firm Mandiant Denies Hacking Claims By LockBit
2.  Accenture claims to fight off LockBit ransomware gang with backup
3.  LockBit ransomware gang claims PayBito crypto exchange as new victim

LockBit Ransomware Gang in Decline, May Be Compromised, Report

By Habiba Rashid
Emergence of Gigabud Banking Trojan Threatens Financial Institutions Globally.
This is a post from HackRead.com Read the original post: New Gigabud Android RAT Bypasses 2FA, Targets Financial Orgs

*   **New Malware Variant:** Gigabud introduces a fresh wave of sophisticated cyber danger.

*   **Global Operation:** Gigabud has targeted at least 25 companies, financial institutions, and government departments across several countries.

*   **Bypasses 2FA:** Gigabud malware can adeptly circumvent two-factor authentication (2FA).

*   **Targets Financial Giants:** Financial institutions face a growing threat from Gigabud’s focused attacks.

*   **Gigabud family:** Gigabud.Loan variant presents itself as a fake loan application, luring victims with promises of low-interest loans.

*   **Emerging Cyber Risk:** The rise of Gigabud underscores the evolving landscape of financial cyber threats.

A new banking trojan named Gigabud has emerged as a formidable adversary, posing a persistent danger to financial institutions worldwide. Originating as an Android Remote Access Trojan (**RAT**), Gigabud first came to the attention of security experts in September 2022 when it targeted a Thailand-based financial organization and its customers across the Asia-Pacific region.

Group-IB’s experts, in response to a customer’s request, undertook a comprehensive analysis of the malware to decode its intricate tactics. The defining feature of Gigabud is its cautious approach to executing malicious actions.

Unlike conventional malware that acts immediately upon infiltration, Gigabud waits for user authorization within the malicious application, a strategy that makes it notably elusive. Instead of relying on HTML overlay attacks, Gigabud employs screen recording to gather sensitive information, further complicating its detection.

One standout feature of Gigabud is its use of accessibility services, which allows it to perform actions on the victim’s device remotely. This capability, known as “TouchAction,” enables the attacker to perform gestures on the user’s device, giving them the power to evade defence mechanisms, including two-factor authentication (**2FA**).

Gigabud RAT has targeted at least 25 companies, financial institutions, and government departments across several countries, aiming to mimic their identities and deceive users.

Researchers also uncovered a parallel threat within the Gigabud family: Gigabud.Loan. This variant presents itself as a fake loan application, luring victims with promises of low-interest loans. Once users engage with the app, they are coerced into providing sensitive personal information, which can later be exploited by the threat actors.

Gigabud.Loan’s modus operandi involves impersonating fictional financial institutions from various countries, such as Thailand, Indonesia, and Peru.

The distribution strategy for both Gigabud.RAT and Gigabud.Loan centers around phishing websites. These websites are disseminated through tactics like “smishing,” where victims are sent misleading messages via instant messengers, SMS, or social networks, leading them to malicious links. In certain cases, the malware is even delivered directly through messages on platforms like **WhatsApp**.

Watch as Group-IB’s researchers looks into Gigabud RAT

Over the course of 2022 to 2023, Group-IB’s researchers detected over 400 Gigabud RAT samples and more than 20 Gigabud.Loan samples using advanced hunting techniques. 

To counteract the threat posed by Gigabud, **Group-IB suggests** a multi-pronged defence strategy. Organizations should prioritize proactive monitoring of user sessions, prioritize client education on safe online practices, and employ digital protection tools.

Users, in turn, are advised to exercise caution when clicking on links, refrain from downloading risky apps, and utilize **reliable VPNs** on public Wi-Fi networks.

**RELATED ARTICLES**

1.  FakeTrade Android Malware Attack Steals Crypto Wallet Data
2.  Android banking malware distributed with fake Google reCAPTCHA
3.  New Android banking malware Xenomorph found in Play Store apps
4.  Experts concerned over emergence of Android banking trojan S.O.V.A.
5.  Iranian Stalkerware ‘Spyhide’ Steals Data from 60,000 Android Devices

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Source

HackRead