By Habiba Rashid
The DDoS attack took place moments after the European Parliament voted to declare the Russian government a state sponsor of terrorism.
This is a post from HackRead.com Read the original post: Killnet Hits European Parliament Website with DDoS Attack

Staying true to its reputation of being known for relying majorly on DDoS attacks, the pro-Kremlin hacking group Killnet has struck again and this time, their target was the European Parliament website.

This DDoS attack took place after the governing body voted to declare the Russian government a state sponsor of terrorism. 

The distributed denial-of-service attack or DDoS attack took place on Wednesday afternoon European time and the website stayed down for a few hours before becoming operational again. 

It is worth noting that the DDoS attack came just days after Killnet claimed responsibility for targeting government sites in the United Kingdom and vowed to target more in the coming days.

Killnet members quickly claimed the credit for the attack shortly after and posted screenshots showing the European Parliament website was unavailable in 23 countries on Telegram. Furthermore, the text accompanying the images included a homophobic remark toward the legislative body. 

“Strap-on shelling of the server part of the official website of the European Parliament!” the group posted to its Telegram channel.

Screenshot shared by Killnet in its Telegram group.

The attacks against the European Parliament came hours after the agency adopted a resolution officially identifying Russia as a state sponsor of terrorism. It was adopted by the member states with 494 votes in favor, 58 against, and 44 abstentions.

Members of the European Parliament “highlight that the deliberate attacks and atrocities committed by Russian forces and their proxies against civilians in Ukraine, the destruction of civilian infrastructure and other serious violations of international and humanitarian law amount to acts of terror and constitute war crimes,” the declaration stated. “In light of this, they recognize Russia as a state sponsor of terrorism and as a state that ‘uses means of terrorism.’”

Since the Russo-Ukraine war began in February, Killnet has launched 76 attacks against countries supporting Ukraine. 

1.  Anti-Russian OldGremlin Gang Launches Linux Malware
2.  34 Russian Hacking Groups Stole 50 Million User Passwords
3.  New DDoS Malware ‘Chaos’ Hits Linux and Windows Devices
4.  RapperBot malware targets gaming servers with DDoS attacks
5.  DDoS App Meant to Hit Russia Infected Phones of Ukrainian Activists

I am a cyber security writer and one of my favourite games is Minecraft. I also really like obscure cat memes and during my free time, if I'm not found hanging around in Discord voice channels with my friends, I'm probably cycling and taking pictures of random cats on the street.

Killnet Hits European Parliament Website with DDoS Attack

By Deeba Ahmed
Around one hundred people have been arrested by the Metropolitan Police in the United Kingdom’s biggest-ever fraud operation.…
This is a post from HackRead.com Read the original post: Police Seize iSpoof domains as UK’s largest bank call scam is disrupted

Around one hundred people have been arrested by the Metropolitan Police in the United Kingdom’s biggest-ever fraud operation. The Scotland Yard has also shut down iSpoof domains which served as a spoofing hub for scammers.

Reportedly, through that website, scammers stole tens of millions of pounds from British citizens through fake bank phone calls. The police stated that the website was used to defraud 200,000 Brits, and at least £50 million was stolen.

In June 2021, the Scotland Yard, European law enforcement agencies, and the FBI initiated an international investigation dubbed Operation Elaborate.

Authorities now plan to contact around 70,000 victims in Briton for the investigation. These individuals fell victim to the UK’s biggest scam campaign. An extensive probe revealed that scammers paid a subscription fee to iSpoof.cc and iSpoof.me for using its technology and phone victims impersonating staff members of reputed banks like Halifax, Barclays, and NatWest.

The fraudsters tricked people into giving their bank account credentials or transferring funds. Until August, they had made 10 million fake calls through iSpoof, and around 3.5 million calls were made in the UK, out of which 350,000 calls lasted over a minute.

Authorities in the USA and Ukraine helped Scotland Yard take down this website. As per the authorities, during the campaign, scammers sometimes contacted around twenty people every minute of the day using fake identities created through iSpoof.

Seized iSpoof website (Image credit: Hackread.com)

The amount stolen from the victims is yet unknown, but authorities claim it is close to £50m. One of the victims suffered a loss of £3m, and another lost £10,000. Scammers earned around £3.2m within 20 months, investigators estimated.

For your information, the iSpoof website was set up in December 2020 to allow users to disguise their phone numbers and pretend to be a caller from a reputed organization, mainly a tax office or bank. Scammers paid the subscription fee in bitcoin.

The website had around 59,000 users who paid subscriptions worth £150 and £5,000. The service was taken offline this week, and more than 100 suspects have been arrested, most of whom were residing in London. 40% of the victims were in the USA and 35% in Britain.

A British citizen and resident of east London, Teejai Fletcher, is suspected to be the mastermind of this scam campaign. The 34-year-old suspect was charged with fraud, participating in activities of an organized criminal group, and supplying/making articles used in fraud. The suspect is in police custody and will be presented before the court in two weeks.

1.  Indian call center seized over Amazon hacking scam
2.  World’s Largest Private Torrent Site Filelist.ro Seized
3.  WT1SHOP Cybercrime Market Seized by US and Portugal
4.  179 Dark Web vendors arrested, 500kg worth of drugs seized
5.  Domain, server of DoubleVPN used by ransomware gangs seized

Police Seize iSpoof domains as UK’s largest bank call scam is disrupted

By Deeba Ahmed
Researchers believe that the attack is ongoing, in which hackers are using malicious versions of SoftVPN, SecureVPN, and OpenVPN software.
This is a post from HackRead.com Read the original post: Bahamut Using Fake VPN Apps to Steal Android User Credentials

Bahamut is a notorious cyber-mercenary group that has been active since 2016 and is currently targeting Android devices with fake VPN apps and injecting malware to steal user credentials. The malware-laden apps were first discovered by Slovakian cybersecurity firm ESET’s Lukáš Štefanko.

**Beware of Bahamut**

ESET researchers discovered a new attack spree from the infamous cybercrime group Bahamut. The group launched malware attacks through fake Android VPN applications. Research revealed that hackers use malicious versions of SoftVPN, SecureVPN, and OpenVPN software.

In this highly targeted campaign, hackers aim to extract sensitive data from infected devices. The campaign was started on January 22. The fake VPN apps are distributed through a bogus SecureVPN website. In previous campaigns from Bahamut, the prime targets were located in the Middle East and South Asia.

**8 Variants of Spyware Apps Detected**

Researchers have identified 8 different variants of the infected apps. These contain trojanized versions of genuine VPN apps such as OpenVPN. Bahamut is offering these fake VPN apps as a service for hire.

Malicious website spreading SecureVPN and the permission it asks for upon installation (Image: ESET)

According to ESET’s blog post, attacks are launched via spear phishing messages and fake apps. Researchers believe that this campaign is still active.

Reportedly, the targets are carefully selected because the app requires the victim to enter an activation key to enable the features using a distribution vector. The activation key is designed to establish contact with the attacker-controlled server and prevents the malware from accidentally triggering after it is launched on a non-targeted device.

**How does the Attack Works?**

According to Štefanko, the fake app requests an activation key before the VPN and spyware feature is enabled. The key and URL are sent to the targeted users. After the app is activated, the hackers get remote control of the spyware and can infiltrate/harvest confidential user data.

Furthermore, hackers can spy on almost everything stored on the device, including call logs, SMS messages, device location, WhatsApp data and other encryption app data, Telegram and Signal data, etc. The victim remains unaware of the data harvesting.

“The data exfiltration is done via the keylogging functionality of the malware, which misuses accessibility services,” Štefanko said.

It is worth noting that the malicious software linked with the service and the malware-infected app wasn’t promoted on Google Play. Moreover, researchers are clueless about the initial distribution vector, but they believe it is through social media, SMS, or email.

1.  Edward Snowden urges users to stop using ExpressVPN
2.  Popular free Android VPN apps on Play Store contain malware
3.  38% of Android VPN Apps on Play Store Plagued with Malware
4.  Top 10 Android Educational Apps That Collect Most User Data
5.  Hackers Selling US Colleges VPN Credentials on Russian Forums

Bahamut Using Fake VPN Apps to Steal Android User Credentials

By Habiba Rashid
On Telegram, Killnet declared that “all medical institutions, government services, and online services” could soon be attacked.
This is a post from HackRead.com Read the original post: Pro-Russian Killnet group hits UK organizations with DDoS attacks

On November 22nd, in the early hours of the morning, Prince William’s website was reportedly attacked by a Russian hacking group Killnet. In a message posted on Telegram, Killnet stated the reason for the attack to be UK’s continued support for Ukraine.

Killnet said it had conducted the attack “due to the supply of high-precision missiles to Ukraine.”

Killnet on Telegram (Screenshot shared with Hackread.com by Check Point cyber security firm)

Although the website is now functioning, there are additional security checks on the connection by Cloudflare (the company that provides secure web connections) which were not present before. 

The attack appeared to be a distributed denial-of-service attack (DDoS attack) which causes a server to be overwhelmed by numerous bogus requests, usually from bot servers – something Killnet is well known for. However, this information has not been confirmed. 

Killnet also declared in a message on Telegram that “all medical institutions, Government services, and online services” could soon be attacked as well. In further posts, the group said it was targeting the websites of the London Stock Exchange, the British Army, and the Bankers’ Automated Clearing System (Bacs).

Currently, all three websites are functional however, the British Army website displayed undergoing “planned maintenance” message on Tuesday, November 22nd.

Killnet on Telegram claiming responsibility for series of DDoS attacks (Screenshot shared with Hackread.com by Check Point cyber security firm)

In a conversation with Hackread.com, Muhammad Yahya Patel, Security Evangelist at Check Point Software said “Killnet is a prolific political pro-Russian hacking group that moves targets every few weeks based on geopolitical developments. As a major player in the hacktivism space, they also suggest and define the targets for other pro-Russian groups. We have seen a 42% global increase in cyberattacks since the start of the Russia-Ukraine war, with a significant rise in state-sponsored groups. These DDoS attacks are the latest efforts from hacktivists to disrupt high-profile websites, including those of the Royal household, as part of their political agenda.”

DDoS attacks are unlikely to compromise data or systems because they simply flood the web server with too many requests so that it cannot respond in time. During the attack, the loss of connection is likely to be short-lived since web operators can identify numerous IP connections originating from the same block.

Therefore, threat actors employing this technique are unlikely to achieve any real damage because this technique is not very successful these days and most companies nowadays employ technologies to offset such attacks. 

This is not the first time Killnet has taken it upon itself to wage a cyber war due to the ongoing political situation between Ukraine and Russia. Previously, they tried to take down the Eurovision song contest. Due to not being invited, they tried to cause chaos in Italy (the host nation) but were thwarted and Ukraine went on to win the competition. 

The group also attempted to take down the online voting servers throughout the final but was unable to break through the “wide range of security measures” that Eurovision officials promised. Instead, they chose to attack several Italian institutions in the semi-final and final in Turin. 

1.  34 Russian Hacking Groups Stole 50 Million User Passwords
2.  New DDoS Malware ‘Chaos’ Hits Linux and Windows Devices
3.  RapperBot malware targets gaming servers with DDoS attacks
4.  Anti-Russian OldGremlin Ransomware Gang Launches Linux Malware
5.  DDoS App Meant to Hit Russia Infected Phones of Ukrainian Activists

I am a cyber security writer and one of my favourite games is Minecraft. I also really like obscure cat memes and during my free time, if I'm not found hanging around in Discord voice channels with my friends, I'm probably cycling and taking pictures of random cats on the street.

Pro-Russian Killnet group hits UK organizations with DDoS attacks

By Habiba Rashid
Boa was discontinued in 2005 but remained popular and is now becoming a crisis because of the complex nature of how it was built into the IoT device supply chain.
This is a post from HackRead.com Read the original post: Retired Software Exploited To Target Power Grids, Microsoft

A recent alarming report by Microsoft reveals the risks attached to common Internet of Things (IoT) devices using the discontinued Boa web server. Hackers are exploiting vulnerabilities in the software to target organizations in the energy sector.

On Tuesday, Microsoft researchers revealed in an analysis their discovery of a vulnerable open-source component in the Boa web server, used widely in a range of routers and security cameras as well as popular software development kits (SDKs).

Despite the software’s retirement in 2005, it remained popular and is now becoming a crisis because the complex nature of how it was built into the IoT device supply chain is making it difficult to mitigate the Boa flaws. 

Microsoft reports that attackers are continuing their attempts to exploit the flaws of the Boa web servers which include a high-severity information disclosure bug (CVE-2021-33558) and another arbitrary file access flaw (CVE-2017-9833). An unauthenticated attacker could exploit these vulnerabilities to obtain user credentials and leverage them for remote code execution.

“The known CVEs impacting such components can allow an attacker to collect information about network assets before initiating attacks and to gain access to a network undetected by obtaining valid credentials. In critical infrastructure networks, being able to collect information undetected prior to the attack allows the attackers to have a much greater impact once the attack is initiated, potentially disrupting operations that can cost millions of dollars and affect millions of people,” Microsoft said.

Microsoft’s initial discovery of the vulnerable component was made while it was investigating a suspended Indian electric grid intrusion. This followed a report in 2021 by the threat intelligence company Recorded Future detailing that a Chinese threat group was targeting operational assets within India’s power grid.

In April 2022, the firm published a new report describing attacks from another Chinese state-sponsored threat actor using IoT devices to gain a foothold on operational technology (OT) networks, used to monitor and control physical industrial systems. 

Needless to say, the damage caused by this vulnerable component could be immense since Microsoft has identified one million internet-exposed Boa server components globally over the span of one week.

Another major concern is the fact that due to often being included in popular SDKs, the presence of a Boa server in a product is unknown by many of the users. Realtek SDK is one example of a software development kit that is provided to companies that make routers, access points, and other gateway devices and includes the Boa web server. 

Microsoft warns about the supply chain risk posed by flaws in widely-used network components as it continues to witness attacks targeting Boa vulnerabilities. 

1.  Microsoft Warns of Evolving Toll Fraud Android Malware
2.  Microsoft warns of Hackers Using Malicious IIS Extensions
3.  Microsoft Office Most Exploited Software in Malware Attacks
4.  New Spam Attack Abusing OAuth Apps to Target MS Exchange
5.  Scammers Leveraging Microsoft Team GIFs in Phishing Attacks

I am a cyber security writer and one of my favourite games is Minecraft. I also really like obscure cat memes and during my free time, if I'm not found hanging around in Discord voice channels with my friends, I'm probably cycling and taking pictures of random cats on the street.

Retired Software Exploited To Target Power Grids, Microsoft

By Deeba Ahmed
Russian hacking groups primarily using Telegram are on a password stealing spree and so far have targeted users on Amazon, Steam, and Roblox.
This is a post from HackRead.com Read the original post: 34 Russian Hacking Groups Stole 50 Million User Passwords

Group-IB security researchers have warned about an ongoing password-stealing spree initiated by Russian-speaking hacking groups. According to the Singapore-based cybersecurity giant, thirty-four groups were detected using off-the-shelf info stealers to target unsuspecting users. Here are more details of their findings.

**Russian Hackers Stealing Passwords**

Cybersecurity firm Group-IB states that the 34 Russian hacking groups are distributing information-stealing malware and offering them in stealer-as-a-service. The hackers mainly offer Redline and Racoon info stealers to steal passwords from Roblox and Steam gaming accounts.

The hackers also target users to steal PayPal and Amazon credentials, users’ payment records, and crypto wallet information. The attackers found their victims through Russian Telegram groups.

**How does the Attack Works?**

In their report shared with Hackread.com, Group-IB revealed that scammers use websites impersonating reputed companies, and victims are tricked into downloading malicious files. This is achieved by embedding links to download malware into popular games’ video reviews on YouTube, lucky draws and lotteries on social media platforms, and mining software of NFT files on various forums.

Once the info stealer invades the device, it collects data from browsers and transmits it to the attacker. The stolen data can include gaming account credentials, social media, email services, crypto-wallet info, and bank card details.

**How Many Devices Have Been Infected?**

Reportedly, within the first seven months of 2022, these groups managed to infect more than 890,000 user devices and stole over 50 million passwords. Researchers reviewed 34 Telegram groups the hackers used to launch their attacks and learned that targets are pretty extensive as they have targeted users across 111 countries. But their prime targets were countries including the following:

*   USA
*   India
*   Brazil
*   Germany
*   Indonesia

Each group has around 200 active members. So far, the stolen data comprises 16% of PayPal and 13% of Amazon passwords, which makes these the most targeted platforms in this campaign. Apart from these, hackers have targeted EpicGames, Steam, and Roblox.

Most of the groups are well-organized. Primarily they are involved in automated scam-as-a-service attacks. Researchers noted that the perpetrators are low-level cybercriminals previously involved in phishing campaigns like Classicscam.

Of the 34 groups, 23 use Redline and 8 use Raccoon and three use custom-made malware. They usually rent the malware from the dark web for as low as $150 to $200 a month. As per Group-IB’s estimate, the stolen data could be worth around $6 million.

“The popularity of schemes involving stealers can be explained by the low entry barrier. Beginners do not need to have advanced technical knowledge as the process is fully automated and the worker’s only task is to create a file with a stealer in the Telegram bot and drive traffic to it. For victims whose computers become infected with a stealer, however, the consequences can be disastrous” researchers concluded.

**What is Scam-as-a-service**

Scam-as-a-service is a type of online fraud that allows criminals to easily set up and manage their own scams. By using readily available tools and services, scammers can quickly launch phishing, social engineering, and other types of attacks without having to invest in the development of their own malicious software or infrastructure.

The rise of scam-as-a-service has made it easier than ever for criminals to defraud individuals and businesses. While traditional scams require a significant investment of time and money to set up, scam-as-a-service providers make it possible for even amateur criminals to launch sophisticated attacks.

Scam-as-a-service is particularly concerning because it enables criminals toconduct their activities with relative anonymity and without having to establish a physical presence.

1.  Fake Tor Browser Installer Spreading Malware Via YouTube
2.  2K Games Help Desk Platform Hacked to Spread Info-stealer
3.  QBot Malware Exploiting Windows Calculator to hack Devices
4.  Hackers Selling US Colleges VPN Credentials on Russian Forums
5.  Ukraine Thwart Russian Industroyer 2 Malware on Energy Provider

34 Russian Hacking Groups Stole 50 Million User Passwords

By Waqas
The data was collected by Tridas eWriter operated by now-defunct Tempa, Florida-based The Tridas Group LLC.
This is a post from HackRead.com Read the original post: Medical Software Firm exposes vulnerable children’s sensitive data

Security researcher Jeremiah Fowler in collaboration with Website Planet’s team of researchers discovered an unprotected database containing more than 16,000 records. What’s worse, the misconfigured database contained sensitive personally identifiable information (PII) of thousands of children.

Fowler noted that the misconfigured database contained highly sensitive PII, including the names of parents and children, dates of birth, patient ID numbers, physical address, special needs, school attended, medical diagnoses, and social/behavioral problems’ history.

**What Information was Included in the Database?**

Researchers reviewed a sample of 1,000 records to determine who owned the data and informed them about the exposed database. As per their findings, each record they reviewed had some form of PII related to children.

The records were unique as per the Patient ID number, and the data appears to be fairly recent. In the database, children’s records were categorized with tags, including the following:

1.  Attention Difficulties
2.  Behavior Difficulties
3.  Autism Symptoms
4.  Emotional Issues
5.  Social Inter Concerns
6.  Learning Problems
7.  Development Delay

However, according to Website Planet’s report, a surprising aspect of the discovery what that the records included a summary/questionnaire explaining the condition of their child. This was a detailed overview as parents explained their child’s challenges and situations that validated that their child needed medical assistance.

Exposed information (Website Planet)

Such information should only be accessible to medical experts, but it was publicly accessible through a misconfigured IP indicating the host domain, login portal, and data location.

**Who Owns the Database?**

Further probe revealed that the data was linked to an online interview system called Tridas eWriter. The Tridas Group LLC based in Tempa, Florida operated this system. This company offers software for schools and parents for diagnostic management of children with Autism, ADHD, learning challenges, and similar disorders.

“Tridas eWriter provides secure, HIPAA compliant online questionnaires and it generates a detailed report that organizes the data in an easy-to-read format to facilitate the diagnosis and management of these complex challenges,” the company’s website read.

Researchers believe that the records were collected from Tridas eWriter questionnaires, filled out by parents before booking the initial evaluation appointment of their children. As per the Tridas Center website, it was closed on 31 December 2019.

However, researchers at Website Planet notified the Tridas Group LLC about the exposed database, and access to it was restricted immediately.

**Potential Risks**

Exposure to such sensitive health records entails a range of risks and can put the safety of children and their families in danger. The exposed data can be used for medical extortion or in phishing, social engineering scams, and even ransomware attacks that could have led to data encryption.

Threat actors may insert malicious code or detect vulnerabilities to launch future cyberattacks. Medical records are the most sensitive and crucial part of the exposed information as it belongs to children’s health, and scammers may exploit them for a long time.

1.  Op protected childhood: 113 online child predators arrested
2.  Storybooks for children app FarFaria exposed data of 3M users
3.  Leaky Server Exposing Scraped Data of 150,000 Mastodon Users
4.  Neopets Suffers Second Data Breach as 69 Million Accounts are Stolen
5.  Japanese Healthcare Firm ‘Doctors Me’ Exposed Images of 12,000 Patients

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Medical Software Firm exposes vulnerable children’s sensitive data

By Deeba Ahmed
Pig butchering is a scam where threat actors lure innocent investors into giving up their crypto assets and sending them to the attackers. 
This is a post from HackRead.com Read the original post: US DoJ Seizes 7 Domains used in Pig Butchering Cryptocurrency Scam

The US Department of Justice (DoJ) has announced the seizure of seven domains used in an extensive pig butchering cryptocurrency scam. The announcement came on Monday, according to which the scam was run between May and August 2022, and attackers raked in more than $10 million from five victims.

**Scam Details**

For your information, pig butchering or Sha Zhu Pan is a scam where threat actors lure innocent investors into giving up their crypto assets and sending them to the attackers. Scammers find their targets through dating apps, SMS messages, and social media platforms. They befriend their victim and quickly initiate a serious relationship to build trust and trick them into investing cryptocurrency in a fake app.

As soon as the actors receive the money, they vanish and steal it, causing “significant losses for the victim,” DoJ’s press release read. The seized domains all impersonated the Singapore International Monetary Exchange.

After the funds are transferred to the attacker’s wallet address, the cryptocurrencies are moved through several private wallets and swapping platforms to hide the trail.

Court records indicated that five victims were targeted during the abovementioned timeline, all based in the USA and tricked using the seven seized domains.

**Evolving Attack Tactics a Cause of Concern!**

In a press release, the Department of Justice pointed out that pig butchering fraud reveals the extent threat actors are willing to go to lure their targets and claim their funds. They use various techniques, from emotional manipulation to friendship, to develop genuine feelings in the victim before exploiting them for crypto.

This may lead to losses of millions of dollars along with lasting emotional trauma. These scams are successful because of the intimate conversations between the scammer and the target. It can also be called romance fraud.

1.  Hundreds of Websites and Piracy Apps Seized
2.  5 dating apps caught leaking millions of user-sensitive data
3.  How to spot online dating scams and their never-ending fakery
4.  Database mess-up leaks 882 GB of ecommerce & dating sites data
5.  $3.6 billion of Bitcoin seized from crooks tied to 2016’s Bitfinex hack

US DoJ Seizes 7 Domains used in Pig Butchering Cryptocurrency Scam

By Habiba Rashid
According to Bitdefender, most of the malicious apps were aimed at users in Italy and the United Kingdom.
This is a post from HackRead.com Read the original post: SharkBot Banking Trojan Returns to Google Play Store

SharkBot banking trojan, as we know it, has been targeting Android devices for a while now. What appears to have become a trend was recently identified by Bitdefender when they found a trove of malicious apps in the official Google Play Store that pushed aggressive unwanted ads which could potentially lead to more serious attacks.

This finding was not surprising since, in the last few months, malicious apps have begun to be distributed directly from the official store which makes people inclined to believe that they’re safe. 

Through their real-time behavioral technology designed to detect softwares acting suspiciously, the research team at Bitdefender uncovered apps downloaded from Google Play acting as droppers for SharkBot banking trojan a short while after being installed. 

> “The Google Play Store would likely detect a trojan banker uploaded to their repository, so criminals resort to more covert methods. One way is with an app, sometimes legitimate with some of the advertised features, that doubles as a dropper for more insidious malware,”.
> 
> Bitdefender

The apps that Bitdefender found were disguised as file managers, which allows them to easily request and gain permission from the user to install external packages. What adds to their disguise and allows them to evade detection is that the malicious behavior is activated to a restricted pool of users and Google Play apps only need the functionality of a file manager to install another app. 

One of the identified apps is called X-File Manager which installs SharkBot samples with the label \_File Manager, tricking the user into believing that an update for the app needs to be installed before using it. 

What’s interesting in this case is that they target users depending on their location and most users who have downloaded the apps are either primarily from the United Kingdom or Italy. Furthermore, the developer profile on Google Play is also only visible to users from Italy or the United Kingdom. The page cannot be accessed without specifying the country code. 

Bitdefender’s technical writeup also revealed that the application performed anti-emulator checks and targeted users from Great Britain and Italy by verifying if the SIM ISO corresponded with IT or GB. It also checks if one of the targeted banking applications has been installed on the user’s device. 

The app has been removed from Google Play at the time of writing but is available on other websites. Similar malicious apps identified by Bitdefender include FileVoyager and LiteCleaner M. 

1.  SandStrike Spyware Infecting Android Devices through VPN Apps
2.  VirusTotal Reveals Apps Most Exploited by Hackers to Spread Malware
3.  New Dropper Apps on Play Store Targeting Banking and Crypto Wallets
4.  Fake Antivirus Apps on Play Store Loaded with SharkBot Banking Trojan
5.  Malicious Security App on Play Store Caught Dropping SharkBot Malware

I am a cyber security writer and one of my favourite games is Minecraft. I also really like obscure cat memes and during my free time, if I'm not found hanging around in Discord voice channels with my friends, I'm probably cycling and taking pictures of random cats on the street.

SharkBot Banking Trojan Returns to Google Play Store

By Deeba Ahmed
The partnership enables developers to create safe, upgradeable, and scalable dApps on the Sui blockchain.
This is a post from HackRead.com Read the original post: Ankr Confirms Providing RPC to Sui Blockchain

Ankr has announced to become the first Remote Procedure Call (RPC) provider to the Sui blockchain. For your information, Ankr is among the world’s largest Web3 infrastructure providers, whereas in the blockchain spectrum, Sui is a step-function advancement that’s been designed to meet the needs of crypto’s next billion users.

With this partnership, Ankr has become the RPC provider of choice to over 39 blockchains and testnets. This includes BNB Chain, Ethereum, Avalanche, Solana, and Polygon.

The new development came a month after Ankr launched its free Blockchain explorer tool called Chainscanner. The tool lets users search for transaction data, addresses, smart contracts, and much more.

**What Difference Does it Make for Sui Users?**

It will help strengthen the global Sui network since Ankr will provide a geo-distributed and decentralized Sui RPC comprising many independent nodes that run worldwide to ensure reliable connection and low latency.

Developers can easily access the Sui Testnet Community and Premium RPCs now. Furthermore, they can make request calls and receive information mirroring the results they would get by running a full node. The partnership enables developers to create safe, upgradeable, and scalable dApps on the Sui blockchain.

Ankr’s product head, Josh Neuroth, stated that the new technology and move-based development on Sui, along with Ankr’s easy connectivity to the blockchain, helps produce a building environment that’s intuitive and easy enough to encourage a wide range of new developers and projects.

“We are very excited to support Sui so Web3 developers can build faster on what is shaping up to be a promising new ecosystem,” Neuroth added.

**What is Sui?**

It is a permissionless Layer-1 blockchain that allows creators and developers to create Web3 experiences for the next billion users. Developed by Mysten Labs, Sui is horizontally scalable to support an extensive range of dApp development with unrivaled speed but at a low cost.

It is the first-ever platform that offers users a general-purpose blockchain that ensures high throughput, rich on-chain assets, instant settlement speeds, and user-friendly web3 experiences.

Sui uses the proof-of-stake mechanism and is based on the Move programming language. It can process more than 120,000 transactions per second and attracts a wide array of DeFi protocols, DEXs, NFT projects, launchpads, wallets, and social platforms.

**What is Ankr’s RPC?**

The Testnet RPC from Ankr connects wallets, dApps, and command-line interfaces with the Sui blockchain. It is like a messenger or blockchain router communicating on-chain information between the dApp, Sui nodes, and end-users.

This makes the execution of necessary transactions such as transactions, obtaining ownership information, and populating wallet balances smooth and convenient. After the Sui mainnet goes live, Ankr will add support for additional features, docs, and tools so that Web3 developers can streamline building.

1.  We Need Smarter Smart Contracts To Prevent DeFi Hacks
2.  How Decentralized Apps Shaping the Future of the Internet
3.  Trust Wallet Launches Browser Extension Wallet for Desktop
4.  AllianceBlock Debuts Trustless ID Verification Service For Dapps
5.  Yield Monitor Integrates The DeFiChain Blockchain Into Its Database

Source

HackRead