By Deeba Ahmed
The victim company, Gellyberry Studios, an independent game studio, developed Ethyrial: Echoes of Yore.
This is a post from HackRead.com Read the original post: Ethyrial: Echoes of Yore Hit by Ransomware, Player Accounts Deleted

As of now, no known ransomware gang has claimed responsibility for the cyberattack on Ethyrial: Echoes of Yore developers.

A devastating ransomware attack has wiped out a whopping 17,000 player accounts in the famous indie online MMORPG game Ethyrial: Echoes of Yore. The attack occurred on Friday in which all in-game items and progress got erased. 

Ethyrial: Echoes of Yore is developed by Gellyberry Studios, an independent game studio. It is a free-to-play old-school MMORPG in its early access phase on Steam. The game currently relies on monthly subscriptions and community support.

As per the official announcement from Gellyberry Studios, the attackers targeted the game’s Discord server and encrypted all data stored in the system and the local backup drive. 

“Last Friday morning, our server succumbed to a cryptographic ransomware attack. The attack systematically encrypted all data on the system/local backup drive and demanded a bitcoin ransom in exchange for decryption,” the statement read.

Attackers left a ransom demand, asking for payment in Bitcoin in exchange for data decryption. The developers have refused to pay the ransom, claiming that hackers usually deceive victims after receiving the payment.

Since the attackers compromised the backups as well, the developers had to rebuild the server and create new account and character databases. This will be a painstaking process as they had to reconstruct all the 17,000 impacted accounts manually.

The company stated they are “committed to restoring every item, level, pet, and other lost progress” as soon as the servers are restored. Furthermore, they want to compensate affected players for the issue by gifting them a complimentary premium pet.

The developers have also outlined a thorough security plan to prevent similar attacks in the future. This includes implementing decentralized backups, establishing VPN connections to their server, and introducing a whitelist for authorized IP addresses to access their server.

It is unclear who is responsible for the attack, as no specific group has come forward to claim responsibility. However, given the kind of items stolen, including character progression and virtual items, it seems unlikely that the attacker would sell the data on the Dark Web.

This isn’t the first time a game developer has suffered a ransomware attack. For example, in February 2021, game developer CD PROJEKT RED, the creator of Witcher 3, became a target of HelloKitty ransomware.

Then, in January 2023, League of Legends and Valorant creator Riot Games was threatened to pay a ransom of $10,000,000 to prevent hackers from leaking stolen source code. But unlike other instances, this time it’s the players who have been impacted instead of the company.

****_RELATED ARTICLES_****

1.  **Fake Cyberpunk 2077 Android App Delivering Ransomware**
2.  **How gamers should secure their accounts from cyber attacks**
3.  **Game giant Electronic Arts is the latest victim of massive data breach**
4.  **Android game developer EskyFun exposed 1 million gamers to hackers**
5.  **New BloodyStealer malware steals data from gamers on EA, Epic, Steam**

Ethyrial: Echoes of Yore Hit by Ransomware, Player Accounts Deleted

By Waqas
According to the threat actor, the data includes "a lot of DARPA-related military information."
This is a post from HackRead.com Read the original post: General Electric Probes Security Breach as Hackers Sell DARPA-Related Access

The security breach was announced by IntelBroker, a threat actor mostly known for data breaches against delivery and logistics companies.

A notorious hacker using the alias ‘IntelBroker’ wants to sell data apparently stolen from renowned US-based multinational corporation General Electric (GE). The hacker is marketing the data on the notorious Breach Forums.

As seen by Hackread.com, the group is claiming to have breached GE’s security and accessed data on the confidential military projects the company was working on. The group’s member is now trying to sell GE’s network access for $500 and sensitive data from DARPA, the US government’s defence R&D agency.

For your information, GE was founded around a century ago by Thomas Edison. Today, it boasts a diverse portfolio covering renewable energy, health care, and aerospace.

IntelBroker posted screenshots on X (formerly Twitter) that indicate that the threat actor is actively marketing the stolen data on popular marketplaces on Clear and Dark Web. The hacker has shared the following information in the listing:

“I previously listed access to General Electrics, but no serious buyers have actually responded to me or followed up. I am now selling the entire thing here separately, including access (SSH, SVN etc.).”

Regarding the data, the seller boasted that it comprises “a lot of DARPA-related military information, files, SQL files, documents etc.”

What the hacker posted on Breach Forums (Screenshot: Hackread.com)

In their post on the hacker forum, the threat actor wrote that they first tried to sell alleged SSH and SVN access to the company’s networks but couldn’t find suitable buyers. They are now re-attempting to sell the data to whoever wants to pay for it.

The data samples they have shared on the forum include SQL database files, aviation systems’ technical descriptions/guides, maintenance reports, and military documents.

Though Hackread.com could not verify the authenticity of the data, considering the hacker’s record, the claim seems credible. The same threat actor had breached the personal information of 170,000 individuals. They offered to sell it on the Dark Web after hacking the DC Health Benefit Exchange Authority (HBX) health insurance marketplace, DC Health Link, in March 2023.

Regarding the current breach, GE is investigating the data breach and will soon release an official statement to share its findings.

It is worth noting that GE has been a victim of data breaches. In 2020, the company lost employee data after a third-party provider, Canon Business Process Services, got hacked. In early 2023, GE’s ex-employee of GE, Xiaoqing Zheng, who worked at GE Power’s Schenectady plant, received a two-year sentence for conspiring to steal aviation trade secrets and sharing them with China.

For your information, the GE data is being sold on Breach Forms, the same forum where, just a couple of weeks ago, another threat actor leaked a scraped LinkedIn database with 35 million user data. Last week, the same forum witnessed the leak of a database containing the personal data of thousands of employees of the Idaho National Lab.

On the other hand, IntelBroker is recognized for targeted cyber attacks against delivery services and logistics companies. This threat actor had previously breached the US-based online grocery delivery platform, Weee!, leading to the leak of data from 1.1 million customers online.

****_RELATED ARTICLES_****

1.  **Military Satellite Access Sold on Russian Hacker Forum**
2.  **Quest Diagnostics data breach affects 12 million customers**
3.  **Top 10 vulnerable airports where your device can be hacked**
4.  **Top US aerospace services provider breach, loses 1.5 TB of data**
5.  **America’s largest diagnostics service LabCorp suffers data breach**

General Electric Probes Security Breach as Hackers Sell DARPA-Related Access

By Deeba Ahmed
Amazon and eBay have been declared the highest data-collecting platforms among all the Android shopping apps researchers examined.
This is a post from HackRead.com Read the original post: Study Finds Amazon, eBay and Afterpay as Top Android User Data Collectors

As per Atlas VPN’s research, besides Amazon, eBay, and Afterpay, other popular apps were also found to be sharing personal details and financial data with third parties.

To shop for Black Friday and Cyber Monday, most users turn to smartphones and tablets to secure the best deals. However, it is essential to be aware of potential risks, such as how various vendors collect your data, to navigate the shopping season safely.

According to the latest research conducted by the Atlas VPN team, numerous leading online shopping platforms collect sensitive user data, with some going as far as sharing this **information with third parties** without the users’ knowledge.

The platforms underwent assessment across various data collection categories, encompassing personal details, financial information, and user geolocation. The evaluated data points included the user’s name, phone number, payment method, and precise location, which were further categorized into extended data types for more in-depth analysis.

In addition, Atlas VPN researchers assessed the Google Play app profiles of the 60 most popular Android apps within the shopping category. The apps were ranked according to the number of user information data points collected.

The researchers chose apps from App Figures’ top Android shopping app charts for 2023 for their analysis. The charts comprised various apps, including shopping, buy now and pay later, and discount offer apps. Researchers have shared their list of the year’s top 15 highest-user data-collecting apps.

According to their **report**, Amazon and eBay have been declared the highest data-collecting platforms among all the Android shopping apps researchers examined. Reportedly, eBay collects 28 user data points, and Amazon collects 25.

The popular buy-now app Afterpay was the third-highest data collecting platform with 22 data points against 7 data types. It was the only identified app that didn’t just collect data but also shared sensitive data such as in-app messages, emails, SMS messages, and credit scores with third parties.

Next were Home Improvement retailer Lowe’s health retail platform iHerb and Vinted, a secondhand products marketplace. Each collected 21 data points. Chinese e-comm website Alibaba and home goods giant Home Depot collected 20 data points across 9 data types. Poshmark, another secondhand goods retailer, collected significant user data with 19 data points in 7 categories.

The rest of the apps included Nike, Wayfair, OfferUp, Craigslist, ASOS, and H&M apps, each collecting 18 data points. Among the 60 apps examined by Atlas VPN, Kohl’s app didn’t collect any data. A staggering 75% of the apps share user data with third parties. For instance, 52% and 38% of apps shared app activity, app info, and performance data, typically used to enhance user experience. 

Moreover, 58% of the apps shared personal data like names, home addresses, email IDs, and phone numbers with third parties. A whopping 25% of these apps shared device IDs or other unique identifiers for smartphones and tablets.

Around one-third, or 37%, of the apps disclosed financial data, including purchase history and payment details, whereas 28% shared location data with external sources. The extent of data sharing among Android shopping apps is alarming and a threat to user privacy.

Cybersecurity writer at Atlas VPN, Vilius Kardelis, shared his thoughts on shopping app data collection with Hackread.com, stating that:

“In today’s digital age, your personal information is being extensively collected by apps and shared with countless firms. This holiday season, approach all apps aware your data is being collected. Take the time to carefully read privacy policies, be mindful of the permissions you grant, and prioritize safe shopping practices to safeguard your personal information.”

****Surprised? Don’t be!****

Smartphone apps are designed to collect user data, and the extent and duration of this collection are subjects of debate. Contrarily, data collection and sharing constitute a lucrative business for technology giants.

**In 2021,** researchers claimed that Android sends more data to Google than iOS does to Apple. The research suggested that Android devices collect and transmit twice as much data to Google compared to iOS to Apple. However, Google refuted these findings.

In August of last year, researchers compiled a list of the 10 Android Educational Apps that collect the most user data. The list, **available here**, includes some of the most prominent and widely used Android apps globally.

****Conclusion:****

There isn’t much one can do to prevent apps from collecting data. However, if you are an Android user, consider downloading apps only after reviewing the section on the Play Store that details the data the app collects.

1.  **Fake GitHub Repos Delivering Malware as PoCs**
2.  **Google kicks out 600 malicious apps from Play Store**
3.  **Apple removed all major VPN apps from Chinese App Store**
4.  **Google removes ClearURLs Chrome extension from its store**
5.  **Google Fails To Remove “App Developer” Behind Malware Scam**

Study Finds Amazon, eBay and Afterpay as Top Android User Data Collectors

By Waqas
SiegedSec is the group responsible for the data breach at the Idaho National Laboratory (INL).
This is a post from HackRead.com Read the original post: Hackers Leak Thousands of Idaho National Lab Employees’ PII Data

According to local media, the lab has acknowledged a cyber attack resulting from a cybersecurity incident at a federally approved external vendor system.

The Idaho National Laboratory (INL) has been hacked by a group of hackers called Sieged Security (aka SiegedSec). INL, a leading US nuclear research facility, confirmed the breach on Tuesday.

The **INL** explained that on 20 November, a cybersecurity data breach occurred in a federally approved external vendor system, which the lab uses for supporting INL cloud Human Resources service.

The group, self-identifying as ‘gay furry hackers,’ publicly claimed responsibility for the breach by posting a statement on Telegram and the infamous Breach Forums.

“We’re willing to make a deal with INL. If they research creating IRL catgirls, we will take down this post,” their Telegram post read.

However, it is currently unclear what motivated this attack or persuaded SiegedSec to believe the INL has the expertise to create catgirls. For your information, **in July 2023**, SiegedSec, the same group that has now claimed responsibility for breaching the Idaho National Laboratory, also asserted its involvement in targeting NATO, leading to the leakage of sensitive details. Additionally, **in October 2023**, the group was involved in cyberattacks against Israeli Critical Industrial Control Systems (ICS).

Nevertheless, the hackers claim to have obtained a significant amount of employee data, including addresses, Social Security numbers, birth dates, employment information, and phone numbers.

“We’ve accessed hundreds of thousands of user, employee and citizen data..” the hackers added. They also claim to have sent an “announcement” to all INL’s OTBI platform users to prove their access. East Idaho News has **confirmed** the data’s authenticity after contacting INL employees.

Hackread.com has also conducted an analysis of the leaked data. In total, the leaked database is 207 MB with 43,850 email addresses, predominantly hosted on domains such as @INL.GOV, @ICP.DOE.GOV, and a few on @GMAIL.

The group wants the lab to research the possibility of creating IRL catgirls (genetically engineered catgirls), a reference to an old meme about furries and human-mutant cat hybrids.

The Idaho Falls-based INL has played a pivotal role in developing nuclear energy, and this breach is definitely a big blow to the organization. Currently, it is investigating the incident and the extent of damage with the collaboration of the Department of Homeland Security and the FBI.

In a comment to Hackread.com, Colin Little, Security Engineer at Centripetal, said “Although media surrounding this event claims that no nuclear secrets, intellectual property or R&D information was accessed or stolen, which is fortunate, it is nonetheless highly disconcerting that the staff generating that intellectual property and participating in the most advanced Nuclear Energy R&D have had their information leaked online.”

“There appears to be some controversy about whether the threat actor group who stole the data is at all politically motivated; I find this question to be irrelevant because now those who are politically motivated and would very much like to know the names and addresses of the top Nuclear Energy researchers in the US have that data as well,” Colin argued.

SiegeSec’s demands have been met with disbelief by many. Still, the group maintains that its actions aren’t motivated by a grudge against the organization, and they are just interested in knowing if creating real-life catgirls is possible.

The incident highlights the growing sophistication of cyber threats and the importance of organizations taking steps to protect their data. The release of sensitive employee data poses a serious security risk for the INL and its employees.

Nevertheless, Hackread.com can confirm that the leaked data is now being shared on several underground hacking forums, including Russian-language ones.

****_RELATED ARTICLES_****

1.  **Quest Diagnostics data breach affects 12 million customers**
2.  **Top 10 vulnerable airports where your device can be hacked**
3.  **Top US aerospace services provider breach, loses 1.5 TB of data**
4.  **America’s largest diagnostics service LabCorp suffers data breach**

Hackers Leak Thousands of Idaho National Lab Employees’ PII Data

By Deeba Ahmed
Check Point Research Reports New Million-Dollar Rug Pull Scam with a Fake Token Factory.
This is a post from HackRead.com Read the original post: Scammers Exploit Crypto Hype with Fake Token Factory, Stealing Millions

The scam involves creating fake tokens, adding money to the liquidity pool to create a sense of legitimacy about these tokens, and arranging fake trades to make it appear as if genuine buying and selling were occurring.

Check Point Research team has discovered a new type of scamming operation leveraging a fake token factory to steal millions of dollars from innocent users. Check Point’s Threat Intel blockchain system identified a malicious wallet address that has been involved in “blacklisted activities.”

Researchers then started monitoring the activities linked with the wallet address and found that this address operated forty (40) different rug pulls, and so far, the scammers have stolen 1 million USD.

The scam involves creating fake tokens, adding money to the liquidity pool to create a sense of legitimacy about these tokens, and arranging fake trades to make it appear as if genuine buying and selling were occurring.

Then, the scammers pump up the token’s volume to create an allusion that it is in high demand. This is done to attract buyers. Then, they take the money from the liquidity pool once the token has lured sufficient investors. Researchers explained the scam with an example in their technical blog published on 21 November 2023.

“For example, the token name GROK 2.0, possibly derived from a well-known AI system (X GROK), is intended to attract buyers.”

The scammer used two smart contracts to trade and pump up the token volume. It is worth noting that the function (0x521da65d) is used for selling/buying tokens for the first smart contract. It has been executed 226 times for just this token.

For the second smart contract, the scammers used another address (0x4b2a0290e41623fbfeb5f6a0ea52dc261b65e29b) and executed the function (0xf029e7cf) to boost the token’s volume artificially. From their liquidity pool, the scammer has removed funds 81 times.

For your information, Rug Pull scams are like exit scams, where developers make fraudulent promises and exit right after stealing investors’ funds.

This Rug Pull incident highlights the importance of staying vigilant and informed in the ever-evolving crypto landscape. Investors should be aware of the tactics employed by scammers and conduct thorough due diligence before making any investments.

Check Point is committed to safeguarding the crypto community and actively monitoring domains associated with the identified scammer’s wallet address. Hackread.com will update readers when the company discloses more details on this scam.

Scammers Exploit Crypto Hype with Fake Token Factory, Stealing Millions

By Deeba Ahmed
Telekopye Toolkit was previously identified in August 2023 as being leveraged for a phishing scam by Russian cybercriminals.
This is a post from HackRead.com Read the original post: Telekopye Toolkit Used as Telegram Bot to Scam Marketplace Users

The scam primarily targets popular Russian online marketplaces like YULA or OLX, but ESET researchers also observed non-Russian targets, including eBay, Sbazar, Jófogás, and BlaBlaCar.

In their latest report, ESET researchers have disclosed their findings on the Telekopye toolkit that simplifies online scamming for individuals with limited technical expertise. This is a follow-up report. The company shared **a preliminary analysis** on Telekopye in August 2023.

Researchers have delved deeper into the onboard process of the scammers to unearth the wicked scamming operation, including the explanation of different scam scenarios they are using to deceive users.

****About Telekopye** **Toolkit****

Telekopye Toolkit is implemented as a **Telegram bot** and helps cyber criminals scam unsuspecting users in online marketplaces. This tool allows scammers to create phishing websites, fabricate fake screenshots, and transmit emails, SMS messages, etc.

As per ESET telemetry, Telekopye Toolkit is operational and under active development. The scammers call their victims Mammoths, and ESET has assigned scammers the name Neanderthals.

****How Are Scammers Recruited?****

Research reveals that scammers (ESET researchers have named the scammers utilizing Telekopye Toolkit as Neanderthals) are recruited via advertisements distributed across different online channels, mainly underground forums. These ads are designed to defraud online marketplace users.

Interested Neanderthals have to complete an application form and answer key questions about their previous experience in this kind of work. Existing group members approve them with relevant ranks and give them full access to Telekopye’s functionalities.

Forum recruiting Neanderthals (left) – Example of phishing links created by Telekopye toolkit (right) – Screenshot credit: ESET

**Scam Scenarios:**

In a **blog post,** ESET researchers identified three different scam scenarios.

****1.** **Seller Scam****

In this scam, attackers pose as sellers and entice users into purchasing items that don’t exist. Suppose the victim expresses interest in buying the item. In that case, the seller lures them into making an online payment and gives them a phishing website link, which appears as a legitimate payment portal. But this website solicits the victim’s banking credentials or credit card details (may even provide balance information) and transfers the data to the scammers. Sellers internally refer to this scam as 1.0.

****2\. Buyer Scam****

This scam is referred to as 2.0. Attackers pose as buyers in this scam and target their victims after comprehensive research. They express interest in an item and claim to have paid through the provided platform. They send the victim a Telekopye Toolkit-created SMS or email containing a link to a phishing website. The victim is persuaded to click this link to receive the payment from the platform. The remaining method is similar to the seller scam.

****3\. Refund****

This scenario entails Neanderthals creating a situation where the Mammoth expects a refund. The scammer sends them a phishing email with a link to a phishing website. This email can be sent to victims the scammers haven’t contacted before or used in combination with the seller scam. They exploit the greed of victims who want this non-existent refund. In seller scams, when the victims don’t receive the goods, they are again scammed by Neanderthals via refund phishing emails.

Every Neanderthal had to join a group where they communicated the rules and manuals and another channel where transaction logs were stored. Telekopye Toolkit attackers refer to law enforcement and researchers as rats and try to stick to their rules.

The scam primarily targets popular Russian online marketplaces like YULA or OLX, but ESET researchers also observed non-Russian targets, including eBay, Sbazar, Jófogás, and BlaBlaCar.

If you are a Telegram user, there are several ways to protect yourself from such bots including the following:

*   **Be wary of unexpected messages and links.** If you receive a message from someone you don’t know, or if you receive a link that seems suspicious, don’t click on it. Instead, report the message or link to Telegram.
*   **Never give out your personal information to a Telegram bot.** This includes your name, address, phone number, email address, and password.
*   **Be careful about what you download from Telegram bots.** Only download files from bots that you trust.
*   **Keep your Telegram app up to date.** Telegram releases security updates regularly, so make sure you have the latest version installed.
*   **Report any suspicious activity to Telegram.** If you think you may have been scammed by a Telegram bot, report it to Telegram immediately.

****_RELATED ARTICLES_****

1.  **RIG Exploit Toolkit Distributing CeidPageLock Malware**
2.  **Telegram and Discord Bots Delivering Infostealing Malware**
3.  **New credit card skimmers channel funds through Telegram**
4.  **New Phishing Attack Spoofs Microsoft 365 Authentication System**
5.  **Chinese APT Slid Fake Signal and Telegram Apps onto Official App Stores**

Telekopye Toolkit Used as Telegram Bot to Scam Marketplace Users

By Owais Sultan
Altcoins, or alternative cryptocurrencies, diversify the crypto landscape, offering investors options beyond Bitcoin and influencing market dynamics. Their…
This is a post from HackRead.com Read the original post: How Altcoins Influence The World of Crypto

Altcoins, or alternative cryptocurrencies, diversify the crypto landscape, offering investors options beyond Bitcoin and influencing market dynamics. Their innovation and competition contribute to the evolution and maturation of the broader cryptocurrency ecosystem.

Alternative coins, or just shortly called altcoins, are a new trend in the crypto world. Evolving from the success of Bitcoin, these guys became an important part of the digital economic systems.

From their versatility and uniqueness to utility, there are many interesting things hidden behind the simple name of altcoins, and today, LI.FI is introducing you to the beginning, rise and bright future of altcoins. Let’s dive into it!

****The genesis and evolution of altcoins****

The term “altcoin” is derived from “alternative coin”. The name represents many different cryptocurrencies that were introduced thanks to Bitcoin. 

Although it was a revolutionary project that sky-rocketed digital economics and created a big online trading trend, some individuals saw potential outside of it. That’s when the altcoins jumped on the scene. Their goal was clear – to give people everything Bitcoin wasn’t designed to. 

Altcoins forever changed the concept of cryptocurrency. Thanks to it, we don’t just see digital cash when discussing crypto. The most famous altcoin is Ethereum. It introduced smart contracts and levelled up the security systems of DeFi. Celer Network gave us cbridge, and Monero gave us a privacy-oriented coin, Monero.

These coins operate on varied blockchain technologies and consensus mechanisms, representing the versatility and adaptability of cryptocurrencies. As a result, the altcoin market has become a colourful and dynamic component of digital finance, continuously evolving with new ideas and innovations.

****Altcoins in today’s crypto marketplace****

In the current cryptocurrency market, altcoins contribute significantly to the market’s diversity and liquidity. While some altcoins aim to function as digital currencies for daily transactions, others are designed to support specific blockchain-based applications and systems. Since there are so many different altcoins, investors can move away from Bitcoin and find potential hidden treasures in different currencies.

While full of potential, the altcoin market has its set of challenges. Most altcoins do not match Bitcoin in terms of market capitalization. This often leads to greater sensitivity to market shifts and more pronounced fluctuations in value. This environment offers a double-edged sword for investors. The potential for significant financial gains is there, but so is the risk of notable losses. 

Additionally, the altcoin sector is characterised by its constant change. New tokens appear frequently, while others gradually lose relevance. We recommend you keep a constant eye on the events in the crypto world. This way you won’t miss the hot deals or big drops, and it will help you in choosing the best altcoins.

****Conclusion****

In wrapping up, it’s clear that altcoins represent more than just alternatives to Bitcoin. They are a dynamic and integral component of the broader cryptocurrency ecosystem, representing innovation and presenting a diverse range of digital financial solutions. 

Altcoins open up new doors to investors. They are a great way to escape the mainstream currencies and explore new innovations in the world of crypto. Keeping up with the news of the community and the market will be of great help for navigating these waters, as they will serve as a compass to the new good deals.

For those engaged in the world of cryptocurrencies, exploring the depths of altcoins is crucial to successfully maneuvering through this diverse and ever-evolving domain.

****_RELATED ARTICLES_****

1.  **Could Bitcoin Be The Future Of DeFi?**
2.  **The Different Ways to Mine Cryptocurrency**
3.  **What is Cloud Mining and How Does it Work?**
4.  **ETH Exchange Rate Expectations for 2023-2025**
5.  **We Need Smarter Smart Contracts To Prevent DeFi Hacks**
6.  **Investing in Ethereum Blockchain-based JasmyCoin: Guide**

How Altcoins Influence The World of Crypto

By Deeba Ahmed
Patches for all affected versions of Apache ActiveMQ have been released, and clients are strongly advised to upgrade their systems.
This is a post from HackRead.com Read the original post: Kinsing Crypto Malware Targets Linux Systems via Apache ActiveMQ Flaw

Active since 2020, the resurgence of the Kinsing malware poses a significant threat to Linux-based systems, infiltrating servers and rapidly spreading across networks.

Cybersecurity researchers at Trend Micro have identified cybercriminals exploiting a critical vulnerability in Apache ActiveMQ (CVE-2023-46604) to infect Linux systems with the **Kinsing malware** (also known as h2miner). This vulnerability enables attackers to execute arbitrary code on affected systems, installing cryptocurrency miners and rootkits.

****What is Kinsing Malware?****

The Kinsing malware poses a significant threat to Linux-based systems, infiltrating servers and rapidly spreading across networks. It exploits vulnerabilities in web applications or misconfigured container environments to gain access, specifically targeting Linux systems. Its primary objectives include cryptocurrency mining, such as Bitcoin, and establishing persistence on the infected host.

Interestingly, the malware detects and eradicates competing cryptocurrency miners, targeting processes, active network connections, and crontabs that exploit vulnerabilities like **WebLogic** or **Log4Shell**. This strategic approach allows the malware to gain complete control of the system’s resources.

Furthermore, it ensures persistence by adding a cronjob to download and execute its malicious bootstrap script every minute, ensuring the latest malicious Kinsing binary is consistently available on the infected host.

“Kinsing doubles down on its persistence and compromise by loading its rootkit in /etc/ld.so.preload, which completes a full system compromise,” researchers noted.

Recently, attackers using Kinsing malware have utilized high-profile vulnerabilities like CVE-2023-4911 (**Looney Tunables**).

Image: Trend Micro

****About the Vulnerability****

Since early November 2023, Trend Micro researchers observed that CVE-2023-46604 is being exploited. It is a critical severity vulnerability **assigned** a CVSS score of 9.8. The vulnerability stems from OpenWire commands failing to validate throwable class type, thus enabling RCE.

“When the marshaller fails to validate the class type of a Throwable, it inadvertently allows the creation and execution of instances of any class. This opens the door to remote code execution (RCE) vulnerabilities, enabling attackers to execute arbitrary code on the affected server or application,” Trend Micro researchers explained in a **blog post**.

Apache ActiveMQ is a popular open-source message and integration platform written in Java. It implements message-oriented middleware (**MOM**) and facilitates communication between different applications. It offers different features, including OpenWire, STOMP, and Jakarta Messaging (JMS). OpenWire is a binary protocol designed for MOM and serves as the native wire format for ActiveMQ. It offers several benefits, such as bandwidth efficiency and support for various message types.

****How Does the Attack Work?****

The Kinsing malware exploits the CVE-2023-46604 vulnerability discovered in Apache ActiveMQ, which enables remote code execution (RCE). The vulnerability allows attackers to execute arbitrary code on the impacted system. After gaining access to the vulnerable server and executing the Kinsing binary, it becomes possible to install rootkits and cryptominers, steal sensitive data, disrupt operations, and install malware.

****Impacted versions****

Apache ActiveMQ versions 5.18.0 before 5.18.3, 5.17.0 before 5.17.6, and 5.16.0 before 5.16.5 are vulnerable to this attack. Apache ActiveMQ has **released** patches for all affected versions. Users are advised to update their ActiveMQ installations as soon as possible. In addition, keep OpenWire disabled if not required, restrict access to ActiveMQ management interfaces and isolate ActiveMQ deployments through network segmentation to stay protected.

Ken Dunham, Director of Cyber Threat at Foster City, Calif.-based **Qualys**, a disruptive cloud-based IT, security and compliance solutions provider, shared with Hackread.com that there’s a dire need for proper configuration of the cloud platform.

“The main takeaway I get here is around how the cloud is rarely configured properly and malware is exploiting that. We don’t want to allow malware like this to be proof of poor configurations and lack of security in our systems, especially around lateral movement tools, tactics and procedures (TTPs) used by the group.”

Dunham noted that Kinsing has been a significant threat **since 2020**.

“Kinsing has successfully preyed upon poorly authenticated and configured cloud Docker containers dating back to 2020, then performing lateral movement attempts leveraging brute force attacks,“ Dunham explained.

**Irfan Asrar**, Director, of Malware and Threat Research at Qualys, told Hackread.com that researchers have discovered a major gap in the cloud.

“This discovery highlights a major gap in the cloud not commonly defended against; most web apps/cloud infrastructure are not scanning for malware in their cloud infrastructure, mostly just attempting to screen web traffic, which allows the Kinsing malware to take advantage and gain persistency. I see this gap being taken advantage of in the future by other groups.”

****_RELATED ARTICLES_****

1.  **Fake Super Mario 3 Installers Drop Crypto Miner, Data Stealer**
2.  **Microsoft Azure Exploited to Create Undetectable Cryptominer**
3.  **Hackers actively exploiting 0-day in Ubiquitous Apache Log4j tool**
4.  **Golang malware infecting Windows, Linux servers with XMRig miner**
5.  **Nitrokod Crypto Miner Hiding in Fake Microsoft, Google Translate Apps**

Kinsing Crypto Malware Targets Linux Systems via Apache ActiveMQ Flaw

By Deeba Ahmed
The culprit behind these callback phishing attacks, known as Silent Ransom Group (SRG), is also identified as Luna Moth.
This is a post from HackRead.com Read the original post: FBI Alert: Silent Ransom Group Utilizes Callback Phishing for Network Hacks

Callback phishing messages come as unclickable images, creating a sense of urgency and providing a phone number.

The Federal Bureau of Investigation (FBI) has released an advisory for industry awareness after observing a rise in the exploitation of vulnerabilities in “vendor-controlled **remote access to casino servers**, third-party vendors and services.” The advisory also highlighted emerging ransomware initial access trends

Ransomware actors are reportedly targeting “smaller, tribal casinos” via gaming vendors to encrypt servers and compromise sensitive PII (personally identifiable information) of employees and patrons. To elevate network permissions, adversaries use legitimate system management tools. In this regard, the bureau pointed out Silent Ransom Group’s (SRG) activities.

As per the FBI’s **advisory** (PDF), this group, also known as Luna Moth, has been conducting callback phishing attacks. The attack involves tricking victims into clicking phishing links disguised as urgent account notifications.

When the victim calls the phone number, the ransomware operators instruct them to download legitimate system management tools through an email link. The group then uses these tools to install other legitimate but repurposed tools to perform malicious activities. SRG compromises local files and network-shared drives to exfiltrate data and then demands a ransom.

Knowbe4’s data-driven defence evangelist, Roger Grimes, has **explained** how callback phishing works in a detailed blog post, explaining that it is a “cunning form of phishing.” In this tactic, the attackers use phone numbers instead of URLs to trick unsuspecting victims, which makes it different from conventional phishing scams.

Callback phishing messages come as unclickable images, creating a sense of urgency and providing a phone number. Recipients are urged to call on the number, and are connected to overseas call centers or, as pointed out by the FBI, may lead to the attacker’s call center.

“The ultimate goal of callback phishing, whether perpetrated by ransomware groups or generic scammers, is to persuade the victim to install malicious software,” Grimes noted.

Advanced callback techniques don’t rely on custom backdoors or trojans anymore. Attackers now use semi-legitimate or legitimate remote access programs often used by admins and users to manage computers. Once exploited, these programs allow remote attackers to install additional malicious software, scripts, and screen monitoring capabilities.

In generic callback scams, scammers lure victims into transferring money, which the attackers steal. Such scams are gaining traction because they can **evade anti-phishing content filters**. After all, these appear as a single image, so text-based analysis becomes ineffective.

“With callback phishing, the entire message is one big picture. Many anti-phishing content filters cannot “read” the text on the picture.”

“Second, none of the anti-phishing content filters will read the phone number and then be able to determine if it is malicious or not…. So, basically, the entire phishing scam comes in as a single picture file, containing few to no clues about whether the request is malicious.”

The FBI suggests that users and organizations should regularly maintain offline data backups and ensure it is encrypted and immutable so that it cannot be altered or deleted. Moreover, periodic reviewing of the security posture of third-party vendors and external software/hardware is crucial to protect data from being exploited in suspicious activities.

Organizations can ALSO protect themselves from the SRG by implementing the following security measures:

*   Keep data backups offline and encrypted
*   Regularly update software and operating systems
*   Have a plan for responding to ransomware attacks
*   Implement strong password policies and multi-factor authentication
*   Educate employees about callback phishing attacks and how to avoid them

****_RELATED ARTICLES_****

1.  **FBI warns of ProLock ransomware with enhanced capabilities**
2.  **FBI and NCSC Warn of Foreign Cyberattacks on US Space Sector**
3.  **FBI Warns of Extortionists Stealing Plastic Surgery Data for Ransom**
4.  **FBI warns of ransomware attacks against Food and Agriculture sectors**
5.  **FBI warns of hackers mailing malicious USB drives to spread ransomware**
6.  **US Military Personnel Hit by Unsolicited Smartwatches Linked to Data Breaches**

FBI Alert: Silent Ransom Group Utilizes Callback Phishing for Network Hacks

By Waqas
The vulnerability is dubbed Randstorm, impacting browser-generated wallets created between 2011 and 2015. 
This is a post from HackRead.com Read the original post: Outdated Wallets Threatening Billions in Crypto Assets

Researchers have identified vulnerabilities in legacy storage systems containing Bitcoin. However, the company asserts that other cryptocurrencies, including Dogecoin, and stablecoins such as Litecoin and Zcash, may also be at risk.

After an exhaustive 22-month-long investigation, cybersecurity firm Unciphered has revealed in its latest report that up to $2.1 billion in cryptocurrency could be at risk because of a vulnerability in how old wallets were generated using BitcoinJS and derivative projects.

The vulnerability is dubbed Randstorm, impacting browser-generated wallets created between 2011 and 2015. It has impacted millions of digital currency wallets, claimed Unciphered.

These wallets could be exposed to crypto theft as the company believes adversaries can exploit the issue to generate private keys and use them to steal the funds stored in the impacted wallets.

“The source of the vulnerability is the SecureRandom() function found in the JSBN javascript library, combined with weaknesses that existed in major browser implementations of Math.random(). BitcoinJS utilized the JSBN library until March 2014,” the company explained in its report. “Other projects incorporated early versions of BitcoinJS for the generation of Bitcoin and other cryptocurrency wallets,” the report read.

The company believes that numerous blockchain projects could be affected. Unciphered discovered the issues in old storages holding Bitcoin, but the company believes other cryptocurrencies, including Dogecoin and stablecoins, such as Litecoin and Zcash, could be impacted.

Unciphered didn’t disclose more details on the vulnerability. However, it has been confirmed that millions have been alerted to the issue. The company recommended that investors transfer their funds to new wallets.

“If you are an individual who has generated a self-custody wallet using a web browser before 2016, you should consider moving your funds to a more recently created wallet generated by trusted software”, the company noted.

However, not all wallets could be impacted similarly because the issue exploits different aspects of a digital currency. It is also difficult to determine the exact time frame for the issue except that it impacts the wallets generated between 2011 and 2015.

The company also confirmed that the vulnerability was exploitable, but the amount of work required to exploit wallets varies considerably. For example, wallets generated in 2014 are hard to compromise compared to those generated in 2012.

Unciphered has released a technical write-up to help wallet providers, and developers understand and fix the issue. BitcoinJS is aware of the issue and posted an advisory on their GitHub page, asking users of the BitcoinJS ecosystem to audit and verify underlying code for suitability and validity.

The list shared by Unciphered shows the projects derived from release notes in various BitcoinJS releases

Unciphered’s report highlights the importance of protecting your cryptocurrency assets. Always store funds in secure wallets and be aware of the risks associated with old wallets. Using strong passwords, enabling multiple verification mechanisms, and storing your private keys offline are crucial to securing your wallets.

****_RELATED ARTICLES_****

1.  Crypto Scammers Exploit Gaza Crisis in Donation Scam
2.  We Need Smarter Smart Contracts To Prevent DeFi Hacks
3.  New MortalKombat Ransomware Attack Aiming for Crypto Wallets
4.  Scammers Use Fake Ledger App on Microsoft Store to Steal $800K
5.  8,000 Solana Wallets Drained Millions Worth of Crypto in Cyberattack

Source

HackRead