By Habiba Rashid
The alleged administrator of the website selling NetWire malware has been arrested in Croatia.
This is a post from HackRead.com Read the original post: NetWire Malware Site and Server Seized, Admin Arrested

****NetWire malware has been utilized by various cybercrime groups, but its most notable use occurred in February 2022 when the ModifiedElephant APT group used the malware to plant incriminating evidence on victims’ devices.****

In a joint operation between the US Federal Bureau of Investigation (**FBI**), the European Union Agency for Law Enforcement Cooperation (**Europol**), and other international law enforcement agencies, the internet domain used to sell NetWire malware has been seized.

NetWire is a powerful tool used by cybercriminals to gain unauthorized access to computer systems and control them remotely. It’s worth noting that NetWire was used extensively in several cyberattacks, including those targeting the aviation and defence sectors **in February 2022**, thousands of global oil and gas and energy firms **in August 2017**, and attacks on the aerospace and travel sectors **in May 2021**.

In addition, NetWire was utilized in a malicious campaign last year by the ModifiedElephant APT to **plant incriminating evidence** on victims’ devices. The activities of this APT group are closely aligned with the “Indian state interests.

According to a press release from the US Attorney’s Office for the Central District of California, the seizure was part of an ongoing investigation into the sale and distribution of NetWire malware. The domain, which had been in operation since 2012, sold the malware to buyers worldwide, including individuals in the United States for their own criminal ends.

The operation to seize the domain involved the coordinated efforts of law enforcement agencies from around the world. The FBI worked with Europol, Croatia, Switzerland, and other partners to identify and track down the individuals responsible for the sale and distribution of NetWire.

The operation resulted in the seizure of the domain and the arrest of a suspect whose name has not been released by US or Croatian authorities.

NetWire malware is a type of remote access Trojan (RAT) that cybercriminals often use to gain access to a victim’s computer. Once installed, the malware allows the attacker to remotely control the computer, access sensitive information, and carry out a range of malicious activities.

The seizure of the NetWire domain is a significant development in the fight against cybercrime. It demonstrates the effectiveness of international cooperation in tackling online threats and highlights the commitment of law enforcement agencies worldwide to combat cybercrime.

The seizure notice

“By removing the NetWire RAT, the FBI has impacted the criminal cyber ecosystem,” Donald Alway, the assistant director in charge of the FBI’s Los Angeles field office, said in a **statement**.

“The global partnership that led to the arrest in Croatia also removed a popular tool used to hijack computers in order to perpetuate global fraud, data breaches and network intrusions by threat groups and cyber criminals,” Alway added.

This victory serves as a reminder that the fight against malware is far from over because cybercriminals are constantly developing new tools and techniques to evade detection. It is therefore essential that individuals and organizations take steps to protect themselves against cyber attacks by **implementing strong security measures**, such as using anti-virus software and keeping their systems up to date with the latest security patches.

1.  **Teen hires attacker to DDoS his school district**
2.  **Hive Ransomware Gang Disrupted; Domain Seized**
3.  **No prison for duo behind vDOS DDoS for hire service**
4.  **DoubleVPN’s server used by ransomware gangs seized**
5.  **NetWalker ransomware busted – funds and domain seized**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

NetWire Malware Site and Server Seized, Admin Arrested

By Waqas
Acronis has confirmed the data breach, stating that the leak does not contain login credentials.
This is a post from HackRead.com Read the original post: Cybersecurity Firm Acronis Data Breach: Hackers Leak 21GB of Data

****The hacker behind the breach of the cybersecurity and cloud protection service provider is the same individual who was behind the recent Indian HDFC bank and Acer breaches.****

A Swiss technology and cybersecurity company, Acronis, has been hit by a data breach, with over 21 GB of files and folders being leaked by a hacker known as Kernelware.

The trove of data was posted on Breach Forums on Thursday, March 9th, 2023, with no login credentials being leaked. The hacker, who was also behind the **recent Indian HDFC bank** and **Acer breaches**, claimed to have breached Acronis because “they were bored and wanted to humiliate the company.”

According to Kernelware, the leaked data includes various certificate files, command logs, system configurations, system information logs, archives of their filesystem, and python scripts for their maria.db database, backup configuration stuff, and loads of screenshots of their backup operations.

This is what the hacker had to say about the breach (Image credit: Hackread.com)  

Hackread.com also analyzed the leaked data and it can be confirmed that no login credentials were leaked in the breach. However, several files and folders showed internal images and logs from Lansing, Michigan-based web hosting firm, Liquid Web.

Liquid Web was informed by Hackread.com and is investigating the leak. On the other hand, Acronis’ CISO, Kevin Reed, confirmed the incident in a **LinkedIn post**, stating that “Based on our investigation so far, the credentials used by a single specific customer to upload diagnostic data to Acronis support have been compromised.”

Reed claimed that no other system or credential has been impacted by this incident. The company has found no evidence of any other successful attacks and the leaked data is limited to the folder of the affected customer.

The leaked data (Image credit: Hackread.com)

In a comment to Hackread.com, Matt Rider, VP of Security Engineering EMEA at **Exabeam** said “This news reinforces the importance of making sure that all bases are covered when it comes to cybersecurity, as this leak resulted from just a single employee’s credentials being compromised.”

Matt emphasised that “finding an intruder quickly is essential to stopping them in their tracks, yet most organisations struggle to know when legitimate credentials have been compromised. This is because it is impossible to detect abnormal credential use unless you have already baselined what is normal.”

This incident and other **recent cybersecurity incidents** serve as a reminder of the importance of cybersecurity measures for businesses and organizations. As technology continues to advance, the threat of cyberattacks has become more prevalent, and the consequences can be severe, including financial loss, reputational damage, and legal liabilities.

Businesses must take proactive steps to protect their data and systems by implementing robust cybersecurity measures, such as regular security assessments, employee training, network monitoring, and incident response planning. It is also crucial to stay up to date with the **latest cybersecurity trends** and best practices to address evolving threats.

Furthermore, individuals also play an important role in preventing cybersecurity incidents by being vigilant about online activities, using strong passwords, and keeping software and systems up to date. Overall, it is essential to recognize the seriousness of **cybersecurity threats** and take necessary precautions to prevent and mitigate their impact.

1.  **Chinese hackers hit Group-IB cybersecurity firm**
2.  **Cybersecurity firm exposes 5b data breach records**
3.  **Cybersecurity firm Stormshield breached; data stolen**
4.  **Cybersecurity firm CloudSEK blames rival over breach**
5.  **World’s Leading Cybersecurity Firm Kaspersky Hacked**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Cybersecurity Firm Acronis Data Breach: Hackers Leak 21GB of Data

By Waqas
It was a cross-site search (XS-Search) vulnerability that could be exploited by an attacker to obtain a user's identity. 
This is a post from HackRead.com Read the original post: Vulnerability Revealed OpenSea NFT Market Users’ Identities

****OpenSea has fixed the vulnerability by releasing a patch that restricts cross-origin communication.****

In 2022, **OpenSea** had over 1 million registered users and received more than 121 million monthly visitors to its website. This makes OpenSea not only the largest NFT marketplace but also a lucrative target for cybercriminals. Any **vulnerability on the platform** can turn into an opportunity for malicious actors and spell disaster for unsuspecting users.

One such exploitable vulnerability in the OpenSea NFT marketplace was identified by Imperva researchers.

**Vulnerability Details**

The Imperva Red Team discovered a vulnerability affecting the world’s largest NFT marketplace, OpenSea. It is a cross-site search **(XS-Search)** vulnerability that can be exploited by an attacker to obtain a user’s identity.

All the attacker needs to do is link an IP address, an email, or a browser session to a particular **NFT** (non-fungible token), thus accessing a wallet address that would reveal the user’s identity. This issue is concerning as it deanonymizes OpenSea users.

**Exploitation Mechanism**

The attacker sends their target a link via different communication channels, e.g. SMS or email. If the victim clicks on this link, valuable data such as their IP address, device details, user agent, and software versions are leaked.

The attacker can then exploit the cross-site search vulnerability to **obtain the victim’s NFT** name and associate the leaked public/NFT wallet address with this identity such as the phone number or email to which the link was first sent.

**What Causes the Issue?**

It is caused by the iFrame-resizer library’s misconfiguration, which the $13.3 billion marketplace uses. When this library is used where cross-origin communication isn’t restricted, cross-site search vulnerability occurs. OpenSea didn’t restrict it, which led to this issue.

This misconfiguration lets this flaw prevail and expose user identities. Given the fact that the NFT ecosystem is entirely anonymity-based, this kind of flaw can have serious implications for OpenSea’s business because if exploited the attacker can launch phishing attacks.

Alternatively, they may track users who have purchased the highest-value NFTs. Researchers could determine that the marketplace uses the **ElasticSearch tool** since it had advertised for ElasticSearch skills in one of its **job advertisements**.

**Watch the PoC of the vulnerability**

Video courtesy: Imperva

**Understanding a Cross-Site Search Vulnerability:**

Also called XS-Search, Cross-Site Search vulnerability is based on the **XS-Leaks** family of attacks. It is found in web apps that use query-based search mechanisms.

The vulnerability allows an attacker to obtain sensitive information from another origin simply by sending queries and identifying the difference in the search system’s behaviour with it does or doesn’t yield results. The threat actor gathers information by sending numerous queries. Basically, it can extract sensitive information from a web app.

**Has it been Fixed?**

According to a **blog post** that Imprava shared with Hackread.com, after the disclosure of the vulnerability, OpenSea fixed it quickly by releasing a patch that restricted cross-origin communication. This mitigated further exploitation of the vulnerability.

However, this does highlight the ongoing challenges businesses are facing in ensuring security in a highly complex application realm where misconfiguration could get easily overlooked and eventually exploited in decentralized applications or dApps.

With the advent and advancement of **Web3 and dApps**, hordes of new challenges have also appeared. As much as these environments have become popular, the risk of their exploitation has amplified.

Therefore, it is important to remain vigilant and detect inherent flaws and vulnerabilities in a timely manner to prevent the exploitation of these platforms.

1.  **Official Ferrari Subdomain Hijacked to Host NFT Scam**
2.  **This AI Can Generate Unique and Free Bored Ape NFTs**
3.  **Phishing: NFTs Worth $1.7M Stolen from OpenSea Users**
4.  **Hackers steal $18.7m from Animoca’s Lympo NTF market**
5.  **NFT Market OpenSea data breach- Users’ email IDs leaked**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Vulnerability Revealed OpenSea NFT Market Users’ Identities

By Habiba Rashid
The data contains personal and medical details of several members of the U.S. Congress, which are now circulating on Russian hacker forums as well as on Telegram groups.
This is a post from HackRead.com Read the original post: Hackers leak DC Health Link data with Congress Members’ details

****The data breach occurred in March 2023 on DC Health Link known for serving members of the U.S. Congress and Washington D.C. residents.****

A recent data breach is likely to affect hundreds of members of the US Congress as well as Capitol Hill staff after hackers stole personally identifiable information (PII) from DC Health Link, the online health insurance marketplace of the District of Columbia.

Hackread.com can confirm that a hacker has claimed to have leaked the stolen database on Breach Forums, a hacker forum that surfaced as an alternative to the popular and **now-seized Raidforums**.

In their post, the hacker stated that the data breach occurred in March 2023 on DC Health Link known for serving members of the U.S. Congress and Washington D.C. residents.

The hacker further stated that the total number of affected customers is around 55,000 including government staffers, politicians, members of the U.S. Congress and Senate and others. The database contains the following information:

*   Gender
*   Full names
*   Nationality
*   Date of birth
*   Phone numbers
*   Race and Ethnicity
*   Social Security Numbers
*   Home and work email addresses

Hackread.com’s founder and editor, **Waqas**, has seen and analyzed the data, revealing that the database is actually a 29 MB CSV file with a large chunk of duplicate data, totalling details of almost 35,000 individuals.

DC Health Link has confirmed that data belonging to an unspecified number of customers has been affected by a security incident. The organization stated that it is currently working with law enforcement and notifying affected customers.

The leaked data (Image credit: Hackrad.com)

The FBI on the other hand has confirmed that they are investigating the matter and working with authorities to determine the scope of the breach and identify the responsible parties.

“Currently, I do not know the size and scope of the breach, but have been informed by the Federal Bureau of Investigation (FBI) that account information and of hundreds of Member and House staff were stolen,” Chief Administrative Officer Catherine L. Szpindor said.

The hackers may have also obtained sensitive health information, such as diagnoses and treatments; however, no such information has been leaked so far. The breach is particularly concerning given the sensitive nature of the data involved and the potential risks to the individuals affected.

(Image credit: Hackrad.com)

Lawmakers and officials have expressed concern about the breach and the need for increased security measures to prevent similar incidents in the future. Some have called for **greater investment in cybersecurity** and stricter regulations to protect sensitive information. The FBI has urged anyone affected by the breach to monitor their personal information and report any suspicious activity.

**Another Day, Another Data Breach in the U.S.**

The latest data breach has hit both US government officials and unsuspecting victims, adding to the growing list of cyberattacks targeting the country. **In February** **2023**, the FBI announced that it had investigated a “contained” data breach, and prior to that, hackers leaked the FBI security platform **InfraGard’s database** online.

In addition, the **US Marshals Service** was recently targeted in a ransomware attack. In January 2023, a security researcher discovered that the **US no-fly list** had been exposed to the public, and within days, the **list was leaked** on a hacker forum.

It is worth noting that a hacker and owner of Breach Forums was able to hack **into the FBI’s email server** and send a trove of emails with bogus threats.

1.  **52 Critical Orgs Hit by Ragnar Locker Gang – FBI**
2.  **US Govt’s secret terrorist watchlist exposed online**
3.  **Hackers Who Obtained CIA emails Breach FBI Servers**
4.  **Magecart skimming attack hits 8 US government sites**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Hackers leak DC Health Link data with Congress Members’ details

By Deeba Ahmed
The researchers have been tracking the malware campaign since November 2020.
This is a post from HackRead.com Read the original post: Beware of Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer

****For now, SYS01 stealer is targeting Facebook accounts of employees working for manufacturing companies, critical government infrastructures, and other sensitive industries.****

The cybersecurity researchers at Morphisec have revealed details of an advanced **information-stealing malware** campaign which they began tracking in November 2022. They dubbed the malware SYS01 Stealer.

Researchers noted that SYS01 Stealer has been targeting critical government infrastructure and manufacturing firms’ employees. The attackers are targeting Facebook business accounts of their targets through Google ads and **fake Facebook profiles**, which promote games, cracked software, and adult content to compel their victims into downloading a malicious ZIP file.

The malicious use of Google Ads should not come as a surprise, since crooks have been abusing Google’s Ad Ecosystem for some years now. Just **a couple of weeks ago**, Google Ads were found to be spreading malware in fake messenger and browser apps.

The malware is executed on the target’s machine through DLL side-loading. The campaign was first noticed in May 2022, when it was attributed to **Zscaler’s Ducktail operation**, which was later rendered incorrect.

**Detailed analysis**

In a **blog post**, Morphisec researchers wrote that the archive has a legitimate application as a loader, which is vulnerable to DLL side-loading, and a malicious library, which drops the Inno-Setup installer through side-loading. In turn, the final payload is deployed as a PHP application, which actually contains malicious scripts that perform data exfiltration. Archive persistence is ensured through a PHP script.

It performs this task by setting a scheduled task. The main stealer script supports numerous other tasks, including letting the attacker check whether the victim is logged in and has a **Facebook account**.

Furthermore, this script also supports the downloading and execution of files from a certain URL and can upload files to the C2 server. It may also execute commands.

**What’s the Objective?**

This campaign is designed to steal sensitive details from the victims’ devices, such as cookies, login data, and personal and **business Facebook account information**. The attacker has included Rust, PHP, Python, and advanced PHP encoders to advance the delivery chain, which has helped them evade security vendors successfully for the past five months.

Infection chain

**SYS01 Similarities with other Infostealer?**

Morphisec analysis revealed that SYS01 uses the same loading techniques and lures as the **S1deload infostealer** (PDF) discovered by Bitdefender. However, it is worth noting that the final payload isn’t the same.

You can stay protected from SYS01 stealer by implementing a zero-trust policy and restricting users’ rights to download and install programs. Since this campaign is based on social engineering, users should be aware of the tricks adversaries can use against them.

**Protect Yourself**

If you are an employee at a government or critical infrastructure organization, you should watch out for malware attacks, especially on social media sites. Here are some steps on how to do so:

*   Be wary of unsolicited messages, friend requests, and links from unknown sources on social media platforms like Facebook.
*   Verify the identity of the sender before clicking on any links or downloading any attachments.
*   Install and update anti-virus software and firewalls on your device and make sure they are up-to-date with the latest security patches.
*   Use strong and unique passwords for your social media accounts and avoid reusing passwords across different accounts.
*   Enable two-factor authentication (2FA) to provide an extra layer of protection for your accounts.
*   Avoid using public Wi-Fi networks, especially when accessing sensitive information or logging into social media accounts.
*   Regularly back up important data to an external hard drive or cloud storage service.
*   Report any suspicious activity, messages or links to your organization’s IT department immediately.
*   Stay informed about the latest malware and cyber security trends by attending regular training sessions and seminars.
*   Follow your organization’s security policies and procedures, including those for social media use.

1.  **Crooks using Messenger chatbots to steal login data**
2.  **Fake Brave browser dropped malware from Google Ads**
3.  **Schoolyard Bully malware stealing Facebook credentials**
4.  **Google Ads malware wipes NFT influencer’s crypto wallet**
5.  **Mandrake Android malware stealing Facebook, crypto data**

Beware of Fake Facebook Profiles, Google Ads Pushing Sys01 Stealer

By Habiba Rashid
It turns out that the number of women on the darker side of cybersecurity is increasing, and these stats will shock you.
This is a post from HackRead.com Read the original post: Gender Diversity in Cybercrime Forums: Women Users on the Rise

****According to the report, 36% of users at Hackforums were likely women, based on their use of language, and 30% of XSS forum users, a Russian language cybercrime forum, were reportedly women.****

In recent years, there has been a shift toward increased gender equality in **underground cybercriminal forums**. This stands in stark contrast to the more male-dominated cybersecurity industry, where women continue to face significant barriers to entry and advancement.

A recently published **study** by Trend Micro pushes forward a similar finding wherein at least 30%, if not more, of cybercriminal forum users, are women. Although the methodology used makes the results of the study somewhat unreliable, the report itself recognizes this. 

Trend Micro inspected five English-language cybercrime forums: Sinister, Cracked, Breached, Hackforums, and **(now defunct and seized) Raidforum**, as well as five Russian-language sites: XSS, Exploit, Vavilon, BHF, and WWH-Club.

Since these sites are frequented by largely anonymous users, tools such as Semrush and uClassify’s Gender Analyzer V5 were used to estimate the number of female users.

According to the report, 36% of users at **Hackforums** were likely women, based on their use of language, and 30% of XSS forum users were reportedly women, based on the same analysis. At first glance, these numbers indicate that cybercriminal forums are more meritocratic than the white hat world, but this article will delve deeper to understand the reasons behind this difference. 

One reason for the gender diversity in cybercriminal forums is that these groups are often more decentralized and less hierarchical than traditional workplaces. This can make it easier for women to participate and contribute their skills without **fear of discrimination or harassment**.

It is important to understand that these forums have traditionally been male-dominated spaces where men exchange information, tools, and services related to cybercrime.

However, with the increased diversity in the cybersecurity industry over the years, more women have entered the field. As a result, there are now more women who possess the skills and knowledge necessary to participate in these forums.

But why is gender diversity not growing at an equal rate in the cybersecurity workforce? The reasons for this gender gap are complex and multifaceted. Women face a range of barriers to entry, including unconscious bias, stereotypes, and a lack of female role models and mentors in the industry. Additionally, the highly technical and male-dominated culture of cybersecurity can create a challenging environment for women to thrive.

According to a **2022 report** from Cybersecurity Ventures, women make up just 25% of the cybersecurity workforce, with even lower numbers in leadership roles. This gender gap is especially concerning, given the increasing demand for cybersecurity professionals and the potential consequences of a lack of diversity in this field.

One of the most significant reasons for the increase in the number of female users on cybercriminal forums is anonymity, which can be empowering for women who may face discrimination or harassment in the workplace.

In an **underground cybercriminal forum**, participants are judged solely on their skills and contributions, rather than their gender or other personal characteristics. This creates a level playing field where women can demonstrate their expertise and gain respect from their peers. As a result, women who seek out a gender-anonymous space have been increasingly drawn to these forums.

Lastly, the **rise of cryptocurrencies** has made it easier for women to participate in these forums. Traditionally, cybercriminals have used traditional payment methods, such as wire transfers or PayPal, to exchange money for tools and services.

Ilya Lichtenstein and his wife, Heather Morgan, were arrested in February 2022 and charged for their involvement in money laundering of funds stolen in the Bitfinex cryptocurrency hack of 2016.

Suzette Kugler, a 59-year-old US woman, was arrested for hacking the internal network of her employer, PenAir.

Valerie Gignac, a 27-year-old Canadian woman, was arrested in April 2015 for spying on people through webcams, harassing victims, and even owning a famous hacking forum with more than 35,000 members.

Eighteen-year-old Michaela Gabriella King carried out crippling DDoS attacks on her school system.

However, these methods are often difficult for women to use, as they may not have access to a bank account or a credit card. Cryptocurrencies, on the other hand, can be easily obtained and used anonymously, making it easier for women to participate in these forums.

What all of this proves is that women are not absent from the cybersecurity industry, but rather likely to be on the wrong side of it. Efforts to address gender inequality in cybersecurity are underway, with initiatives such as Women in Cybersecurity (WiCyS) and the National Cyber Security Centre’s CyberFirst Girls competition aimed at encouraging more women to pursue careers in this field.

However, progress has been slow, and it will likely take a concerted effort from the industry as a whole to truly move the needle on gender diversity. By addressing the underlying barriers to entry and fostering a more inclusive culture, we can create a more equitable and effective **cybersecurity workforce** where women with a passion for cybersecurity become a valuable part of the industry. 

1.  **Woman arrested for spying on people via webcams**
2.  **Woman hacked, leaked private pics of Selena Gomez**
3.  **Woman hacked airline network, busted through VPN logs**
4.  **Female DDoS attacker charged with crippling school system**
5.  **Husband and wife ransomware operators arrested in Ukraine**

Gender Diversity in Cybercrime Forums: Women Users on the Rise

By Deeba Ahmed
Security firm ESET’s cybersecurity researchers have shared their analysis of the world’s first UEFI bootkit being used in…
This is a post from HackRead.com Read the original post: BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows

Security firm ESET’s cybersecurity researchers have shared their analysis of the world’s first UEFI bootkit being used in the wild, which can bypass Secure Boot on fully-updated UEFI systems. It can even bypass it on fully-updated Windows 10 and 11 versions.

**ESET’s Deep-Dive Analysis of UEFI Bootkit**

According to researchers, there is no indication of who created this bootkit or its name, so they concluded that it corresponds to the BlackLotus bootkit. This bootkit has been promoted in underground cybercrime forums since 2022 for $5,000, with an additional $200 for updates.

**Understanding BlackLotus Capabilities**

BlackLotus is written in assembly and C programming languages, so developers can insert a suite of powerful features into an 80kb file. It not only disables Secure Boot but many other OS security mechanisms, including Hypervisor-protected Code Integrity (HVCI), BitLocker, and Windows Defender.

This bootkit can run on fully-updated systems running Windows 11 with UEFI Secure Boot enabled. It targets the firmware’s low-level chain called the Unified Extensible Firmware Interface (UEFI). This complex chain is responsible for booting modern computers. The UEFI bridges the computer’s firmware with the OS while serving as an OS itself.

Since the UEFI is located in the SPI-connected flash storage chip present on the computer’s motherboard, it is extremely hard to inspect or patch it. The difference between the way BlackLotus targets UEFI and other bootkits like MoonBounce, CosmicStrand, and MosaicRegressor is that these target the UEFI firmware stored in the flash storage chip whereas BlackLotus targets the software in the EFI system partition.

**How Does BlackLotus Defeats Secure Boot?**

It is achieved by exploiting a vulnerability found in all supported versions of Microsoft Windows and patched in January 2022. It is tracked as **CVE-2022-21894**. This is a logic flaw, dubbed “Baton Drop” by the researcher who discovered it, which can be exploited for removing Secure Boot functions entirely from the boot sequence when the PC starts.

Threat actors can easily exploit this flaw to obtain keys for BitLocker, which encrypts hard drives. For BlackLotus creators, this flaw has proven immensely useful because, despite being patched, the vulnerable signed binaries haven’t yet been added to the UEFI revocation list, which alerts about untrusted boot files.

**According to researchers**, hundreds of vulnerable bootloaders are currently in use, and if these signed binaries are revoked, it would render millions of devices useless. That’s why fully updated devices are still vulnerable because threat actors can replace patched software with vulnerable, old software.

**Why UEFI Bootkits are a Threat?**

UEFI bootkits are powerful threats because the UEFI has complete control over the operating system’s boot process. That is how it can disable various OS security mechanisms and deploy its own kernel-mode and user-mode payloads in early OS startup stages. This lets the attackers stealthily operate and gain high privileges.

**How the Bootkit is Deployed?**

The way this bootkit is deployed is unclear, but the attack chain involves an installer component that writes files to the EFI system partition and disables HVCI and BitLocker, after which it reboots the host.

BlackLotus disables protection solutions to deploy a kernel driver, which protects against the bootkit file deletion, and an HTTP loader. Conversely, the bootloader establishes communication with the control server and executes the payload.

1.  **New Python Malware Hits Windows Devices**
2.  **ElectroRat hits MacOS, Windows, Linux devices**
3.  **96% of New Malware in 2022 Targeted Windows**
4.  **Chinese Hackers Hide Malware in Windows Logo**
5.  **LodaRAT Windows malware hits Android Phones**
6.  **OpenAI’s ChatGPT Creates Polymorphic Malware**

BlackLotus UEFI bootkit Can Bypass Secure Boot on Windows

By Deeba Ahmed
Currently, scammers are using DBatLoader malware loader to distribute Remcos RAT to businesses and institutions across Eastern Europe. 
This is a post from HackRead.com Read the original post: Phishing Attack Uses UAC Bypass to Drop Remcos RAT Malware

****The phishing attack commences by sending malicious emails disguised as financial files, such as invoices.****

The cybersecurity researchers at SentinelOne have observed a new phishing campaign in which attackers are abusing the Windows User Account Control (UAC) bypass to distribute the DBatLoader and **Remcos RAT malware**. The primary targets of this campaign are organizations in Eastern Europe.

**New Phishing Campaign Delivering Remcos RAT**

According to SentinelOne, scammers are using DBatLoader malware loader to distribute Remcos RAT to businesses and institutions across **Eastern Europe**. The attackers use emails that seem to have come from authentic sources, such as reputed institutions in their target regions, to lure victims.

When they are successful in luring users into clicking on the malicious link included in the email’s content, the attackers easily leverage the malware loader, bypass Windows UAC, and drop Remcos RAT.

**How Does the Attack Occur?**

The attack commences by sending **phishing emails** disguised as financial files, such as invoices. These emails include a tar.lz archive containing the DBatLoader executable.

The phishing email as seen by SentinelOne

When the victim checks this email, they are lured into opening the DBatLoader’s initial stage payload, which is disguised as a LibreOffice, PDF, or MS Office document. Once this is done, the second-stage payload is retrieved from Google Drive or Microsoft OneDrive, one of which has been active for at least a month.

“When a user decompresses the attachment and runs the executable within, DBatLoader downloads and executes an obfuscated second-stage payload data from a public cloud location,” said SentinelOne’s Aleksandar Milenkoski.

According to SentinelOne’s **blog post**, the RAT is loaded only when DBatLoader executes a Windows batch script through a Windows UAC evasion technique involving **DLL hijacking** and mocking trusted directories. Through easinvoker.exe, Windows automatically elevates the process without issuing a UAC prompt when located in a trusted directory—the mock %SystemRoot%System32 directory.

**About Remcos RAT and DBatLoader**

DBatLoader abuses public cloud infrastructure for hosting its malware-loading capabilities. Remcos is a feature-rich RAT, which is frequently used by cybercriminals in espionage campaigns and is typically distributed via phishing emails.

Ukrainian CERT recently reported about **Remcos-based phishing campaigns** targeting state institutions for conducting espionage. In this instance, the attackers used password-protected archives as malicious email attachments.

This malware can collect keystrokes, video, audio, screenshots, and device or system-related information. Moreover, it can also deliver additional malware to the system.

1.  **New Python Malware Hits Windows Devices**
2.  **ElectroRat hits MacOS, Windows, Linux devices**
3.  **96% of New Malware in 2022 Targeted Windows**
4.  **Chinese Hackers Hide Malware in Windows Logo**
5.  **LodaRAT Windows malware hits Android Phones**
6.  **OpenAI’s ChatGPT Creates Polymorphic Malware**

Phishing Attack Uses UAC Bypass to Drop Remcos RAT Malware

By Waqas
While HDFC Bank has denied any data breach, its subsidiary, HDB Financial Services, has confirmed there was a cybersecurity-related incident which is being investigated.
This is a post from HackRead.com Read the original post: Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary

****The hacker behind the HDFC Bank subsidiary breach was also behind the Acer Inc. data breach that took place a couple of days ago.****

A hacker using the alias Kernelware has leaked 7.5 GB of customer data belonging to HDB Financial Services, a subsidiary of India’s largest private bank, HDFC Bank.

It is worth noting that Kernelware is the same hacker **who breached Acer Inc**. and leaked 160 GB worth of data on a hacker forum just a few days ago. Acer has now confirmed the breach.

As for the HDFC’s breach, the data was posted on the hacker forum ‘Breached forum’ and contains over 72 million entries. For your information, Breachforums is an infamous forum that surfaced as an alternative to the popular and **now-seized Raidforums**.

**Leaked Data**

As analysed by Hackread.com, the leaked data includes personal information such as full names, dates of birth, phone numbers, and email addresses. It also contains employment information, loan details, transaction methods, processing fees, bank names and branches, credit scores, and Experian scores.

Analysis of the leaked records shows personal details of loan seekers have been leaked online (Image credit: Hackread.com)

Other data leaked include dealer names, transaction logs, margin money logs, general asset logs, LOS IDs, loyalty card numbers, employee codes, and other miscellaneous information. The leak has raised concerns about data privacy and the need for stronger security measures to protect sensitive customer information.

While HDFC Bank denies any data leak from their end, analysis reveals that the data belongs to HDB Financial Services, and the leaked data was of HDB’s consumers who had applied for loans between May 2022 and February 2023.

This is what the hacker had to say about the breach (Image credit: Hackread.com)

HDB Financial has confirmed the company experienced a cybersecurity-related incident and investigations are underway. The Indian Computer Emergency Response Team (CERT-IN) is also aware of the issue.

The leak of such a large amount of sensitive customer data has raised concerns about data privacy and cybersecurity. The incident highlights the importance of robust security measures to prevent unauthorized access to customer data. Companies need to take steps to secure their systems and ensure the safety of customer information.

The latest data breach comes just weeks after the **RailYatri hack**, in which the personal details of over 31 million travellers were leaked online.

1.  **Hackers selling 13TB of Domino’s India data**
2.  **Hackers leak millions of Airtel India user data**
3.  **Hackers leak 9 million Indian job seekers’ data**
4.  **Hacker claims to steal 8.2TB of MobiKwik data**
5.  **India’s COVID-19 surveillance tool leaked user data**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Hacker Leaks 73M Records from Indian HDFC Bank Subsidiary

By Owais Sultan
As technology continues to evolve, the need for businesses to focus more on cybersecurity is becoming increasingly important…
This is a post from HackRead.com Read the original post: Why do Businesses Need to Focus More on Cybersecurity

As technology continues to evolve, the need for businesses to focus more on cybersecurity is becoming increasingly important and more people are starting to look into **cyber security bootcamps** to learn and be safer online. The reality is that cyber-attacks are no longer a rarity and can have devastating consequences for any business. 

The fact of the matter is that businesses do not have their own data that needs to be safeguarded. That said, most companies today process a lot of consumers’ data and sensitive information on a daily basis. Therefore, not just business data is at potential risk. Moreover, it’s no secret that cyber attacks are more frequent and more sophisticated than ever before. Hackers are no longer targeting big corporations **but small businesses** and startups as well. 

Pretty much anyone is fair game, especially companies that don’t have proper security measures in place and are vulnerable to data breaches. And as you may already know, any type of data is valuable to hackers as it can be sold to interested parties on the open market somewhere online. With that in mind, let’s have a look at why businesses need to focus more on cybersecurity. 

**The risks of not prioritizing cybersecurity for businesses**

Cybersecurity is an essential part of any business, regardless of its size or industry. Unfortunately, many businesses fail to **prioritize cybersecurity** and this can have serious consequences. For starters, a data breach can lead to the loss of sensitive customer information, which can result in financial losses and reputational damage. 

Not only that but cybercriminals may be able to access confidential company information such as trade secrets, intellectual property and consumer-sensitive information. This could not only ruin a company’s reputation but also put it out of business entirely. Furthermore, if a hacker gains access to a company’s network they may be able to install malicious software that could cause disruption or even **shut down operations completely**. 

Not to mention that this leaves businesses vulnerable to ransomware attacks where hackers demand payment in exchange for restoring access to their systems. All these risks demonstrate why it is so important for businesses to take cybersecurity seriously and invest in measures that will protect their networks from potential threats.

**The value of investing in proactive cybersecurity measures**

Investing in proactive cybersecurity measures is vital for any business, regardless of size or industry. As mentioned before, cybersecurity threats are **constantly evolving** and becoming more sophisticated, so it’s important to stay ahead of the curve by investing in the latest technologies and solutions. 

That said, many people are deciding to opt for cyber security bootcamps so they can get proper education and skills that can help them with future employment. So there’s no shortage of experts in the market, companies just have to hire them. Also, proactive measures can help protect your data from malicious actors, as well as reduce the risk of a data breach or other cyber attack. 

A good example of this is penetration testing where a data breach is simulated to identify potential risks and weaknesses in the company’s network or security measures. A data breach may happen sooner or later so it’s better to prepare for it than to sit idly by and hope that hackers will avoid your company for some reason. 

**Types of cyberattacks and Impact on businesses**

Cyber attacks come in many different forms, and each type of attack can have a unique impact on businesses. The most common types of cyberattacks are malware, phishing, ransomware, distributed denial-of-service **(DDoS) attacks**, and SQL injection. 

Hackers use different methods and different types of attacks to gain access to company data or at least, leave a backroom open for future breaches. That said, the most common type of attack is phishing scams. It’s much easier for hackers to try and fool unwary employees than it is for them to launch a full-scale attack on a company’s defences directly. 

Phishing and social engineering scams are much more effective and subtle ways of breaching a network as many companies neglect to invest in employee education regarding cybersecurity. This way, hackers gain access to company files and networks without anyone noticing they did so. After that, they will either leech information or prepare something much worse depending on their motives. 

Businesses need to prioritize cybersecurity to protect their data and systems from malicious online threats. Investing in the right security measures is essential for any business that wants to stay safe and secure in the digital world so modern businesses must focus on cybersecurity more. 

1.  **How to use AI in cybersecurity?**
2.  **5 Top Cybersecurity Threats to Businesses**
3.  **Benefits of video surveillance in your business**
4.  **Cybersecurity firms need real-time collaboration tool**
5.  **Cybersecurity automation: How can businesses benefit**

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Source

HackRead