By Owais Sultan
Boosting security in any way possible has become crucial for businesses of all sizes. In today’s digital era,…
This is a post from HackRead.com Read the original post: How can Vault Vision help secure your company with passwordless login?

Boosting security in any way possible has become crucial for businesses of all sizes. In today’s digital era, businesses face a host of security risks that could have a devastating impact, and this is why it is important to ensure they take the right steps to reduce these risks.

While digital technology has helped improve business operations in many ways, it has also increased the security risks businesses face.

One of the issues that many businesses have to deal with is password logins for various accounts and apps. These days, this involves creating, remembering, and managing a huge range of passwords and details, which can be frustrating and stressful.

In addition, it means that security can be compromised by others guessing or hacking these passwords. The good news is that Vault Vision offers passwordless login solutions, eliminating the issues associated with using password authentication.

In this article, we will look at how the provider can help secure your company with passwordless login.

There are many ways in which the passwordless solutions from this provider can help your business; some of the main ones are:

**An Affordable Solution**

One of the ways this provider can help you secure your business with passwordless authentication is by providing an affordable solution. Businesses these days have to be very mindful of their spending, and it has become increasingly important to control budgets and outgoings.

Therefore, most are looking for solutions that are both affordable and suited to their needs. The passwordless platform from Vault Vision ticks these boxes, enabling you to enjoy greater efficiency, ease, and security for your business without breaking the bank.

**Boosting Security**

Following the last point, this provider can help boost security for your business through its feature-rich, passwordless authentication platform. This is something that can provide huge peace of mind for business owners and managers in today’s digital age.

We’ve all heard how easy it can be for hackers to gain access to passwords and then to accounts and apps, and this has become a real worry for many businesses. With this type of authentication platform, you don’t have to worry about your passwords falling into the wrong hands.

**Improving Efficiency**

One of the additional ways in which this solution from Vault Vision can help improve efficiency for your business. Creating, remembering, managing, and even forgetting so many passwords can be a frustrating and time-consuming process. The more accounts and apps you access online, the more passwords you will need to manage.

You cannot just have the same password for all accounts due to security risks, nor can you have weak passwords for the same reason. All of this takes time, but the platform from this provider can help.

1.  The Rise of Fileless Malware
2.  Security benefits of using a digital signature?
3.  Akeyless Empowers Enterprise Code Security
4.  Combating the Ever-Increasing Cyber Attacks in 2023
5.  Why external attack surface management is essential?

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

How can Vault Vision help secure your company with passwordless login?

By Deeba Ahmed
The LastPass password manager has suffered yet another data breach, carried out by the same attackers involved in recent previous breaches.
This is a post from HackRead.com Read the original post: LastPass Employee PC Hacked with Keylogger to Access Password Vault

Find out how the LastPass password manager has been impacted by another data breach and what steps they are taking to protect user data. Get the latest information here.

On Monday, LastPass, the company boasting over 30 million users and 85,000 business customers, confirmed that it had been attacked by the same threat actor who had previously breached its security and partially accessed encrypted login data.

**Breach Details**

LastPass, as we know it, is a prominent password management software. The company claims that one of its DevOps engineers’ PCs was hacked to exfiltrate corporate data from its cloud storage resources.

The unidentified attacker combined data stolen from the first breach in August 2022 with data from a third-party breach and a vulnerability in a third-party media software package for launching a coordinated attack.

**LastPass Data Breach Spree**

It is worth noting that LastPass has been on a data breach spree for some time now. **In January 2023**, GoTo-owned LastPass addressed a November 2022 data breach and announced that hackers had stolen customers’ encrypted data.

**In late December 2022**, LastPass announced that it had been breached again and that hackers had managed to steal user data and encrypted password vaults. **In early December 2022**, the password manager giant announced suffering yet another data breach, in which the company detected unusual activity on its cloud storage shared with GoTo.

**In August 2022**, LastPass announced yet another cyber attack, stating that hackers had managed to steal its source code; however, **no customer data was stolen**.

**How did it Happen?**

LastPass collaborated with Mandiant’s incident response team to conduct forensics and detected that the attacker targeted the DevOps engineer’s home computer, exploiting the vulnerable third-party media 3rd party media software package to obtain remote code execution capability and install a keylogger.

The attacker could steal the employee’s master password and authenticate it with MFA, after which they could access the victim’s LastPass corporate vault. It is worth noting that the victim was one of the four employees at LastPass who had access to the company’s corporate vault.

**LastPass’s Official Statement**

In its official **statement**, GoTo-owned LastPass explained the findings of its investigation, which read:

> “The threat actor pivoted from the first incident, which ended on August 12, 2022, but was actively engaged in a new series of reconnaissance, enumeration, and exfiltration activities aligned to the cloud storage environment spanning from August 12, 2022, to October 26, 2022.”
> 
> LastPass

The attacker possessed the decrypted vault, so they exported entries, including decryption keys. With these keys, the attacker accessed a shared cloud storage environment where the company had stored customer vault backups and encryption keys in **Amazon S3 buckets**.

According to LastPass, the decryption keys enabled the attacker to steal AWS S3 LastPass production backups, critical database backups, and cloud-based storage resources.

1.  **PasswordState password manager drop malware**
2.  **Password managers’ flaws let hackers extract passwords**
3.  **Kaspersky Password Manager open to brute-force attack**
4.  **Abine Blur Password Manager exposed data of 2.4M users**
5.  **Critical vulnerabilities found in popular Password Managers**

LastPass Employee PC Hacked with Keylogger to Access Password Vault

By Waqas
At this moment, it is unclear which group is responsible for the ransomware attack.
This is a post from HackRead.com Read the original post: US Marshals Service Hit By Major Ransomware Attack

In response to the ransomware attack, the Marshals Service disconnected the affected system, and the Department of Justice initiated a forensic investigation.

The US Marshals Service, the agency responsible for federal prisoners and fugitives, has fallen victim to a ransomware attack that has compromised a computer system containing sensitive information.

The incident, which occurred on February 17, 2023, resulted in the theft of personal information belonging to targets of investigations, third parties, and certain US Marshals employees, according to a spokesperson for the service.

Drew Wade, the spokesperson for the US Marshals Service, said that the affected system contained “law enforcement sensitive information, including returns from legal process, administrative information, and personally identifiable information pertaining to subjects of USMS investigations.”

In response to the ransomware attack, the Marshals Service disconnected the affected system, and the Department of Justice initiated a forensic investigation.

The Justice Department has since confirmed that the ransomware attack constitutes a “major incident.” This term is used when a hack is significant enough that it requires a federal agency to notify Congress. The US Marshals Service has not revealed the identity of the attackers or their motives.

A senior official who is familiar with the matter **told** CNN that no data relating to the witness protection program was obtained during the incident. However, it is unclear whether any other sensitive information was stolen. The Justice Department’s investigation into the ransomware attack is ongoing.

In a comment to Hackread.com, Ryan McConechy, senior consultant at **Barrier Networks** said, “The US Marshals Service is one of America’s highest ranking law enforcement authorities, and it possesses highly sensitive information related to national security, witness protection programs and convicted felons._”_

“The information obtained in this breach will be highly sensitive and could be used in extortion, sold onto nation-state actors, or even put the safety of US citizens at risk if their personal information, like address details, are exposed,_”_ Ryan warned.

“Hardening systems to improve cyber resilience must be the priority, including using strong, unique passwords, implementing MFA and Zero Trust principles, using Privileged Access Management (PAM) to protect key accounts, deploying layered security to prevent lateral movement, and training employees regularly on phishing and cybercrime,” Ryan advised.

This is not the first major cyberattack on a US federal law enforcement agency this month. **Earlier in February**, the FBI was forced to contain malicious activity on part of its computer network, which was reportedly used in investigations of images of child sexual exploitation. It is not known whether the two incidents are related.

**In December 2022**, hackers leaked the FBI InfraGard database online. InfraGard is an FBI-launched security program to develop physical and cyber threat information-sharing collaborations with the private sector.

**In November 2021**, hackers managed to access the FBI’s server to send fake email threats. The FBI acknowledged the unauthorized access over the weekend, revealing that spam emails had been sent from the agency’s email server to thousands of organizations.

1.  **Hackers post data of thousands of Federal agents**
2.  **Avast found backdoor in US Federal Agency Network**
3.  **Top US Federal Agencies Hacked by Russian Hackers**
4.  **Hackers access domain controller of US Federal network**
5.  **Federal agency hacked leveraging compromised credentials**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

US Marshals Service Hit By Major Ransomware Attack

By Waqas
The free Mortal Kombat ransomware decryptor is now available for victims to recover their encrypted files without having to pay the ransom.
This is a post from HackRead.com Read the original post: Bitdefender Releases Free MortalKombat Ransomware Decryptor

Protect your files with the free universal MortalKombat ransomware decryptor released by Bitdefender. Safeguard your computer against this dangerous malware and restore your files with ease. Get your free decryptor now.

Cybersecurity company Bitdefender has recently announced the release of a new decryptor for the **MortalKombat ransomware**. The decryptor is now available for download and can help victims of ransomware to recover their encrypted files without having to pay the ransom.

**According to** Bitdefender, they have been monitoring the MortalKombat ransomware family since its emergence online in January 2023. MortalKombat is a type of Xorist ransomware that spreads through phishing emails and targets exposed RDP (Remote Desktop Protocol) instances.

MortalKombat’s ransom note

Once installed on the victim’s computer, the malware gets planted through the BAT Loader. This loader is known to deliver the **Laplas Clipper malware** as well, causing further damage to the system.

The MortalKombat ransomware encrypts all files on the infected system, including those in the trash bin and virtual machine files. It also corrupts Windows Explorer, deletes folders and files from the start-up menu, and disables the Run Command.

The financially motivated ransomware targets cryptocurrency wallets on the device and monitors the computer’s clipboard for cryptocurrency wallet addresses. If one is found, it is sent to the attacker’s server, where a Clipper bot creates a lookalike address owned by the hacker and then replaces the clipboard entry.

With the release of this new decryptor, victims of the MortalKombat ransomware can now restore their files for free. This is a significant development in the fight against ransomware, which has become an increasingly common threat to individuals and businesses alike.

Bitdefender’s new tool can help to prevent victims from having to pay the ransom and supports the wider effort to stop cyber criminals from profiting from their malicious activities. The availability of the decryptor underscores the importance of backing up files and implementing robust security measures to protect against ransomware attacks.

Overall, this new decryptor represents a significant step forward in the ongoing battle against ransomware, and Bitdefender’s efforts to combat the MortalKombat ransomware family are to be commended.

As the **threat of ransomware continues** to evolve and become more sophisticated, the cybersecurity community must continue to develop new tools and strategies to keep pace with cybercriminals.

1.  **Free Decryptor to LockerGoga Ransomware Victims**
2.  **CISA Offers Recovery Tool for ESXiArgs Ransomware**
3.  **Avast Releases Free Decryptor for BianLian Ransomware**
4.  **Universal decryptor key for Sodinokibi, REvil ransomware**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Bitdefender Releases Free MortalKombat Ransomware Decryptor

By Deeba Ahmed
What's worse, in the new campaign, ChromeLoader malware evades detection by security software.
This is a post from HackRead.com Read the original post: Fake ROBLOX and Nintendo game cracks drop ChromeLoader malware

Beware of fake ROBLOX, Steam and Nintendo game cracks that may contain the ChromeLoader malware. Learn more about the threat and how to protect your device from this malicious software.

The cybersecurity researchers at AhnLab Security Emergency response Center (ASEC) have discovered a new ChromeLoader malware campaign in which hackers managed to bypass antivirus programs and other cybersecurity mechanisms. This campaign is dubbed uncommon due to the file type attackers have used to evade detection.

**Hackers Using VHD Files As Popular Games Cracks**

According to AhnLab researchers, the ChromeLoader malware campaign is distributed via VHD (virtual hard disk) files, which is a different choice because, usually, ISO optical disc image format files are used in such campaigns.

However, in this case, attackers have used VHD files, which are distributed with filenames that seem like cracks or hacks for Steam and Nintendo games. The objective is to modify browser settings by infecting web browsers, such as Google Chrome, and diverting traffic to bogus advertising websites. A VHD file can be easily mounted on a Windows device and works with most virtualization software as well.

One of the malicious websites (Screenshot credit: ACSE)

“When a VHD file is downloaded through this process, the user can easily mistake the malicious VHD file for a game-related program,” ASEC researchers said. “Disguising malware as game hacks and crack programs is a method employed by many threat actors,” researchers said in a blog post.

**What is ChromeLoader?**

ChromeLoader, also known as ChromeBack and Choziosi, surfaced first as a browser-hijacking credential stealer in January 2022. In May 2022, ChromeLoader malware was pushed into pirated games and QR codes.

Eventually, it evolved into a multi-faceted, potent threat capable of stealing sensitive user data, deploying ransomware, and dropping decompression bombs.

ChromeLoader can also conduct click fraud by leveraging browser extensions to monetize clicks. Many of its new versions can invade both macOS and Windows devices. The shift from ISO to VHD files indicates that ChromeLoader has undergone another round of upgrades.

**Numerous Websites Promoting Fake Game Cracks/Hacks**

Researchers noticed that several malicious websites were marketing cracked versions of famous games, including the following:

*   ROBLOX
*   Elden Ring
*   Dark Souls 3
*   Need for Speed
*   Mario Kart 8 Deluxe
*   Super Mario Odyssey
*   Call of Duty and more
*   Red Dead Redemption 2
*   The Legend of Zelda: Breath of the Wild

Additionally, software versions such as Adobe Photoshop and Microsoft Office are also marketed in this campaign.

Although the malicious websites hosting fraudulent game hacks and software versions have been taken offline, gamers and unsuspecting users should beware of this campaign.

Instead of downloading the game, they may receive ChromeLoader malware that can launch unwanted ads on their devices and steal credentials from web browsers and other saved data.

Users looking for pirated video game hacks and software are the key targets of attackers, who are lured into downloading VHD files from compromised websites appearing in search results.

1.  Malicious pirated games disable Windows Defender
2.  This malware hides in VPN, pirated security software
3.  Pirated software drop cryptomining malware on Macbook
4.  Pirated Version of Fire and Fury Book Loaded with Malware
5.  Inmates pirated movies from computers built with spare parts

Fake ROBLOX and Nintendo game cracks drop ChromeLoader malware

By Waqas
Here’s a rundown of the impact of new cybersecurity regulations as they are applied to the medical device industry. 
This is a post from HackRead.com Read the original post: How New Cybersecurity Regulations Are Shaping the Medical Device Industry

Discover how the latest cybersecurity regulations are influencing the medical device industry. Learn about the measures manufacturers are taking to meet compliance requirements, enhance device security, and protect patient data. Stay ahead of the curve with insights into the evolving landscape of medical device cybersecurity.

Given its direct effect on health and life, the medical industry is subject to stringent regulations. Governments worldwide exercise some form of control over medical products and services.

However, the regulations don’t appear to be as agile as they should be in light of the growing cyber threats on web-connected medical equipment and other digital devices used in healthcare.

Medical devices that connect to the internet and to other gadgets have been in use for quite some time, but it’s only in the past couple of years that regulators have paid attention to the serious threats hounding modern medical hardware. Better late than never as some would say—it’s good to see policymakers stepping up their game to ensure the secure use or operation of medical equipment.

Here’s a rundown of the impact of new cybersecurity regulations as they are applied to the medical device industry. 

The passage of the United States 2023 Omnibus Bill comes with the expansion of the US Food and Drug Administration’s authority over medical device security. This expanded authority gives the FDA the power to set cybersecurity requirements for medical devices and requires all device manufacturers to demonstrate that their products meet these requirements.

This legislation provides the FDA with additional funding and statutory powers that significantly impact the medical device industry. Before the FDA’s updated authority, cybersecurity for medical devices was more of an auxiliary or supplemental concern. It was evaluated separately and not with the same urgency accorded to other device safety concerns.

The FDA’s new powers allow it to compel device manufacturers to implement a product development framework that meets security requirements. Devices will not be made available to customers unless they are secure.

Device makers will be required to monitor and address postmarket cybersecurity vulnerabilities, develop processes to provide reasonable cybersecurity assurance, submit a software bill of materials (SBOM), and comply with other requirements set by the FDA. Security is now part of the safety evaluation of devices.

The 2023 Omnibus Bill defines the devices to be covered by the FDA’s expanded authority as something that meets any of the following conditions: having software/firmware in it, the ability to connect to the internet, and the potential to be affected by cyber threats or attacks. This means that a vast range of devices will be covered and unscrupulous manufacturers will have a hard time circumventing FDA scrutiny.

All these bode well for patient safety, but many device makers will likely regard it as onerous. The changes they need to implement in their product development and monitoring processes mean additional costs. They also mean a slower time to market. 

**CISA’s push for secure-by-design policy: compulsory security throughout the product life cycle**

The Cybersecurity and Infrastructure Security Agency (CISA) of the United States is pushing for the adoption of “secure-by-design” and “secure-by-default” policies among technology manufacturers, which include advanced medical device makers.

The agency attempts to address the fixation of most companies to get their products out to the market as quickly as possible, disregarding crucial safety concerns especially when it comes to cybersecurity. 

CISA also seeks to make organizations develop voluntary performance goals that match the specific needs and environments they are dealing with. These specific performance objectives allow organizations to have a better grasp of the threat landscape and how they can improve their products to stop or mitigate the impact of cyber attacks.

Moreover, CISA plans to encourage enterprises to be security-conscious through a government-sanctioned acknowledgement or praise for compliant organizations. The agency also plans to take advantage of the US IT procurement capacity to reward businesses that embrace the secure-by-design policy with favourable procurement deals.

CISA does not have a lot of regulatory authority, but it is capable of influencing organizations to become security-aware and capable of adapting to the changing needs in the field of medical device security. It plays two major roles: serving as the operational lead for Federal Cybersecurity and working as the national coordinator for critical infrastructure security and resilience. 

**EU Medical Device Regulation: systematized device security**

In 2020, the European Union introduced regulations to address medical device cybersecurity threats. These regulations are collectively known as the Medical Device Regulation (MDR) framework aims to ensure that all medical devices imported into the EU are of high quality and guaranteed safety. 

MDR supplants the EU Medical Device Directive (MDD), which has been in place for nearly a quarter of a century. MDR is a mandatory requirement for all medical devices that enter the EU market. It sets a product classification system, clinical evaluation process, EUDAMED mechanisms, and supply chain guidelines to ensure medical device security and safety.

The European Union is one of the biggest markets for medical devices. MDR has been in effect for more than a year now. Its implementation has shown that it is possible to exercise effective regulation to ensure patient safety and security against cyber assailants. Its new requirements for medical device imports leave no room for run-of-the-mill device makers. It forces everyone to systematically integrate cybersecurity across the product development lifecycle

**Japan’s MHLW guidelines: information sharing with healthcare providers and patients**

Japan has been at the forefront of medical device cybersecurity regulations in Asia. The country’s Ministry of Health, Labour, and Welfare (MHLW) announced in 2020 new guidelines regarding medical device security. These guidelines require medical device manufacturers to implement a cybersecurity management system and conduct regular risk assessments. They also ask manufacturers to provide information on the security of medical devices to healthcare providers and patients.

The MHLW guidelines are notable for their emphasis on information sharing. All relevant parties are informed about the security of medical device products. This is important in establishing trust and encouraging everyone to play a role in making sure that the medical devices available in the market are secure and unlikely to be compromised by threat actors.

**How industries are responding**

It’s safe to say that there have been no objections from the medical tech sector, at least nothing explicit. Some in the tech industry have openly welcomed the new regulations. Google, for one, expressed support for the efforts to raise cybersecurity standards in mobile and IoT gadgets.

New medical device regulations do not only mean improved medical device effectiveness and patient safety. They also promote the development of new solutions to help device makers keep up with the new security requirements efficiently. They create opportunities for innovative companies, especially when it comes to addressing new cybersecurity needs.

Israeli medical software provider MedDev Soft, for example, offers solutions that simplify and accelerate software development and regulatory compliance for medical products. Californian startup Medcrypt offers cryptography, monitoring, and vulnerability management solutions for medical device makers. 

Another Israeli company, Sternum, takes a different approach and offers integrated on-device endpoint security that helps with cyber regulations. The main advantage of this particular solution is that it can be used to easily retrofit existing devices. Sternum is responsible for the security of the pacemakers of Medtronic, for example.

Recent cyber attacks on healthcare organizations have highlighted the importance of cybersecurity regulations for medical devices. Device manufacturers, the tech industry in general, and cybersecurity firms acknowledge the need to bolster defenses in line with the US Cybersecurity and Infrastructure Security Agency’s recent pronouncements on the state of healthcare cybersecurity.

**In conclusion**

Recent cyber attacks on healthcare organizations have highlighted the importance of cybersecurity regulations for medical devices. There may have been no significant incidents of cyber attacks that sought to harm individuals by hacking into their connected medical devices. However, it is better to anticipate the attacks than to be caught flatfooted.

New regulations are shaping the medical device industry, especially when it comes to the safety and security aspects. These regulations greatly benefit patients, but they are also a welcome development for the cybersecurity industry. Security firms have been developing new solutions to help organizations comply more easily while ensuring honest-to-goodness medical device security.

1.  Importance Of Medical Alert Devices
2.  Intel chip flaw left medical devices vulnerable
3.  AI firm exposes sensitive medical records online
4.  Drastic Implication of Unpatchd Medical Devices
5.  Ransomware attack on US healthcare debt collector

How New Cybersecurity Regulations Are Shaping the Medical Device Industry

By Deeba Ahmed
The PureCrypter malware is targeting government entities in North America and the Asia-Pacific region.
This is a post from HackRead.com Read the original post: PureCrypter Malware Targets Governments Through Discord

PureCrypter delivers multiple types of malware and info-stealers, including Redline Stealer, Eternity, AgentTesla, Philadelphia Ransomware, and Blackmoon.

The cybersecurity researchers at Menlo Labs discovered an unknown threat actor exploiting an evasive malware campaign operated through Discord. In their campaign, the prime victims are government entities in North America and Asia-Pacific.

According to researchers, the attackers in this campaign are delivering the PureCrypter downloader, and their primary targets are government entities. The threat actor uses a compromised non-profit organization’s domain as their C2 center to deliver a second payload.

Researchers noticed that in this campaign, PureCrypter delivers multiple types of malware and info-stealers, including Redline Stealer, AgentTesla, Philadelphia Ransomware, and Blackmoon.

**How Was the Campaign Discovered?**

Researchers wrote that they became suspicious after detecting that Menlo’s Cloud Security Platform had blocked archive files, which were password-protected, across numerous government customers across the North American and Asia-Pacific regions.

The attacks start with a phishing email that contains a malicious link to Discord. This URL launches a password-protected ZIP file containing the .NET malware downloader PureCrypter, which downloads a secondary payload from the attackers’ C2 infrastructure. 

The sample Menlo Labs analyzed downloaded AgentTesla, a widely used RAT and info stealer that can steal browser-based passwords, take screenshots, and log keystrokes after establishing a connection with an FTP server located in Pakistan.

On the other hand, victim data is stored on this server, which was observed in another campaign using OneNote to deliver malware.

> “The FTP server appears to have been taken over and the leaked credentials for the domain were found online, thus suggesting that the threat actors used these credentials to gain access to the server.”
> 
> Menlo Labs

**What is PureCrypter?**

PureCrypter is a malware downloader capable of distributing a wide range of ransomware, malware, and information stealers. It was first detected in June 2022. Its creator, PureCoder, offers it for $59 per month or a one-time payment of $245 for life.

The developer recently expanded its features to include PureLogs logger and info stealer, which can steal data from crypto wallets, web browsers, and email clients, for just $99 a year or lifetime access for $99.

1.  Telegram and Discord Bots drop Malware
2.  Google Ads Malware Wipes Crypto Wallet
3.  Teen “Hackers” on Discord Selling Malware
4.  Hackers drop NjRAT in “Earth Bogle” attack
5.  Malware targets Discord users to steal data

PureCrypter Malware Targets Governments Through Discord

By Waqas
Rupert Murdoch's News Corp revealed a data breach in 2022, but it turns out that hackers had been in the media giant's network two years prior.
This is a post from HackRead.com Read the original post: News Corp: Hackers sat undetected on its network for 2 years

News Corp previously blamed hackers linked to China for the cyber attack, with the intention of gathering intelligence to benefit China’s interests.

In February 2022, News Corp, the giant media and publishing company, disclosed a data breach revealing that its journalists had been targeted in a software supply chain attack.

Now, the company has shared additional information stating that the breach actually occurred in February 2020, meaning hackers sat on its network for two years without being noticed. The cybersecurity firm to assist News Corp at that time was Google-owned Mandiant.

In a breach notification, the company said that the threat actors behind the breach accessed its email and document storage system, used by multiple News Corp businesses. Personal and health information of affected employees was accessed, but the company stated that it does not appear that the activity was focused on exploiting personal information.

> Based on the investigation, News Corp understands that, between February 2020 and January 2022, an unauthorized party gained access to certain business documents and emails from a limited number of its personnel’s accounts in the affected system, some of which contained personal information.
> 
> News Corp

The breach impacted a number of News Corp news outlets, including The Wall Street Journal, the New York Post and its U.K. news operations. Among the personal information accessed were names, dates of birth, social security numbers, driver’s license numbers, passport numbers, financial account information and medical and health insurance information.

News Corp has previously stated that the attackers were linked to China and were likely involved in espionage activities to collect intelligence to benefit China’s interests.

In October 2022, the New York Post revealed that it had been hacked after its website and Twitter account were used to publish offensive content targeting multiple U.S. politicians. The newspaper later revealed that the incident was caused by one of its own employees who was fired after their involvement was discovered.

News Corp’s properties include a number of high-profile news outlets such as Dow Jones, FOX News, The Sun, and MarketWatch, among others. It is worth noting that in March 2019, the Dow Jones made headlines for leaking a “screening list” comprising sensitive information about terrorists, criminals, and shady businesses.

In April 2022, FOX News exposed thirteen million records online. The fifty-eight gigabytes worth of information included internal records, PII (personally identifiable information) of the company’s employees, and much more. These records remained open to public access before the company was alerted about the incident.

In a comment to Hackread.com, Julia O’Toole, CEO of MyCena Security Solutions, said that “It is astounding that News Corp has only discovered this highly important piece of information one year after the breach was first announced, and it puts employees at a much greater risk of financial fraud and identity theft._”_

Julia stressed that “Given that the attackers had two years of access before they were identified, this means they most likely got away with more information than was first realised, and with no one knowing it was stolen, they wouldn’t have been on high alert for potential attacks.”

“The suspected groups behind cyber espionage campaigns will generally always use phishing to gain an initial foothold on an organisation. Knowing it provides the greatest chance of success, they will target employees with realistic phishing emails in a bid to steal their user credentials so they can access the corporate network, carry out reconnaissance, and steal data,” warned Julia.

1.  Iran’s Fars News Agency website hacked
2.  Media Giant Guardian Hit By Ransomware Attack
3.  Anonymous Hacks Russian Media Censoring Agency
4.  Windows, Linux and macOS Hit by Chinese APT Group
5.  APT41 hackers spying on texts with MessageTap Malware

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

News Corp: Hackers sat undetected on its network for 2 years

By Waqas
The suspects are allegedly involved in hacking, issuing threats, stealing data, laundering money, and extorting
This is a post from HackRead.com Read the original post: Ethical hacker among 3 arrested for blackmail and ransomware attacks

The ethical hacker reportedly works for the Dutch security organization, the Dutch Institute for Vulnerability Disclosure (DIVD).

Amsterdam’s cybercrime police arrested three individuals suspected of **launching ransomware attacks** against businesses in the Netherlands and worldwide. The suspects are allegedly involved in hacking, issuing threats, stealing data, laundering money, and extorting. These criminals extorted small and large businesses worldwide after hacking into their networks, generating €2.5 million.

**Suspects Details**

The detainees are all young males aged between 18 and 21. They were arrested on January 23rd, 2023 and are accused of stealing the private information of tens of millions of users from their targeted networks and blackmailing the victims for ransom.

The 21-year-old hailed from Zandvoort and was in contact with an 18-year-old suspect from Rotterdam; the third, also 18, was arrested in Naaldwijk. One of the suspects is an **ethical hacker** who works for the Dutch security organization, the Dutch Institute for Vulnerability Disclosure (**DIVD**).

The accused are detained in restrictive custody and can only contact their lawyer. The accused arrested in Zandvoort had 45,000 euros in cash and 550,000 euros worth of Bitcoin. Reportedly, the accused used Bitcoin to launder €2.5 million.

**Stolen Data**

**According to** Dutch media, thousands of businesses were targeted, including online stores, social media networks, training and educational institutions, software firms, hotels, and critical infrastructure and services-related entities.

Moreover, the accused damaged property worth millions of euros. The stolen data includes names, addresses, dates of birth, phone numbers, credit card numbers, passwords, bank account details, license plate numbers, passport data, and citizen identification numbers. The victims paid large sums to the hackers, sometimes as much as €700,000. 

**Investigations**

The investigation was launched in March 2021 by the Amsterdam Police Cybercrime Division after receiving a report from a prominent Dutch firm. The firm reported that its computer systems had been hacked and a trove of data had been stolen.

Dutch police **noted** that private and sensitive data had been stolen, and national and international businesses had become victims of hacking and data theft.

One of the victim organizations is Ticketcounter, which sells amusement park and zoo tickets online. Troy Hunt of **HaveIbeenPwned** also tweeted about the Ticketcounter data breach on March 1st, 2021.

> I've spent a bunch of time talking to Ticketcounter over the last week, and this is a really tough situation for them. The exposed database was human error; one bad mistake made in August last year that's now come back to bite them nearly 7 months on. https://t.co/u4xrMZDpGZ
> 
> — Troy Hunt (@troyhunt) March 1, 2021

Other victims include a reputed educational institution and a meal-delivery service. Further probing revealed that the hackers had invaded the computer systems of their targets and sent a threatening email, asking the victims to pay a **ransom in Bitcoin**; otherwise, they would destroy the company’s digital infrastructure or leak the data online. Many victims paid the ransom.

“According to what we know so far, the demand ranges from more than €100,000 to €700,000 and, in addition, the stolen information has often already been sold online,” investigators revealed.

**Dutch Police Tackle Cybercrime**

Although cybercrime in the Netherlands, like any other country, has increased in recent years, Dutch authorities are known for playing a major role in tackling it locally and globally. In fact, Dutch police were behind the shutdown and seizure of the infamous and one of the **largest dark web marketplaces Hansa**.

**Back in April 2020**, Dutch authorities took down 15 DDoS-for-hire services. It took them merely one week to complete the operation. Most recently, **in October 2022**, Dutch police were even able to successfully trick the Deadbolt ransomware gang into sharing decryption keys.

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Ethical hacker among 3 arrested for blackmail and ransomware attacks

By Deeba Ahmed
A group of hackers going by the online handle of "CH01" has taken responsibility for defacing at least 32 Russian websites to mark a protest over the one-year anniversary of the Russian invasion of Ukraine.
This is a post from HackRead.com Read the original post: Hackers Deface Russian Websites on Ukraine Invasion Anniversary

The group also announced launching a cyber war against the Russian government.

Hackers hacked and defaced at least 32 Russian websites and uploaded a video showing the Kremlin on Fire. The incident happened on the anniversary of the Ukraine invasion. The exact number of defaced websites is still unknown; it is also unclear how the hackers defaced them.

A group of hackers going by the online handle of “CH01” took responsibility for the attack, stating that it was to show solidarity with the “entire civilized world, in order to restore justice and the triumph of the forces of light and goodness.”

**More Context**

*   Anonymous sent 7m texts to Russians; hacked security cams
*   Anonymous hacked 90% of Russian misconfigured databases
*   Anonymous hacked Russian TV, streaming services for Ukraine
*   Anonymous hacks Russian printers to send anti-war messages
*   Anonymous hacked Russian Yandex taxi app causing traffic jam

In its messages on the Telegram app, the hackers called Russia a dictatorial regime that invaded a “strong and independent Ukraine.” In a message translated from the Russian language via the Telegram translation bot, the hackers said:

> Hacker group CH01, in solidarity with the entire civilized world, in order to restore justice and the triumph of the forces of light and good, on the anniversary of the terrorist invasion of dictatorial Russia in a strong and independent Ukraine, we declare cyber war to the dictatorship and totalitarianism and idiocy of Putin’s criminal regime.
> 
> CH01

The hackers also played a song by a renowned Russian rock band from the 1980s called Kino, whose lyrics were freedom-based. A QR code is also part of the video that redirects to a Telegram channel, where the hackers claimed responsibility for the attack. CH01 has created a Twitter account and posted a video on the social media app, too.

> The oracle says that all evil will loose and all good will live forever. we are CH01 hacker group, on behalf of all free world, will fight against putintrrorist and all dictators.  
> Let the prophecy come true#CH01 #putinterorist #oracle #prophecy #cyberwar #freedom pic.twitter.com/1sKfkMqmXB
> 
> — CH01 (@\_CH\_01\_) February 24, 2023

As Ukraine’s invasion by Russia marked its anniversary, Ukrainian President Volodymyr Zelensky released a statement claiming that this will be the year of their “invincibility” and “victory.”

This is not the only cyber attack that Russian cyber infrastructure has suffered on the anniversary of the Ukraine invasion. On February 23, 2023, Anonymous hacktivists hacked into several radio stations across Russia and defaced the ongoing transmission with announcements about fake missile alerts.

**More Hacktivist News**

1.  Is Hacktivism Good or Bad?
2.  Muslim Hacktivists Hack ISIS website
3.  Hacktivists leak 1.7TB of Cellebrite data
4.  Does Hacktivism Really Equal Terrorism?

Source

HackRead