Austin, TX, USA, 10th October 2024, CyberNewsWire

**Austin, TX, USA, October 10th, 2024, CyberNewsWire –** IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading Investigations solution used by CTI teams, security operations, fraud and risk prevention analysts, and law enforcement globally

**SpyCloud**, the leader in Identity Threat Protection, announced that its SaaS Investigations solution has been enhanced with identity analytics that illuminates the scope of digital identities and accelerates successful outcomes of complex investigations from days or hours to minutes.

SpyCloud Investigations is a powerful cybercrime and identity threat investigation solution used by analysts and investigators to discover and act on threats by navigating the world’s largest repository of recaptured breach, malware, and phishing data. It powers rapid analysis of identity exposures across organizations, VIPs and supply chains, pattern of life analysis, threat actor attribution, insider risk analysis, financial crimes research, and more.

SpyCloud Investigations now includes IDLink, the company’s advanced analytics technology that automatically delivers expanded digital identity results from a simple search query. Where a traditional threat intelligence or investigations tool may provide a small number of records directly correlated to the search input, IDLink expands the pool of results to include identity data correlated across shared usernames, emails, passwords, and PII – with flexible options around pivoting depth, confidence levels, and visualization.

Based on more than a decade’s worth of techniques and expertise developed by renowned investigators at SpyCloud, including former intelligence agency personnel, IDLink uniquely provides a more comprehensive picture of identity compromise to give analysts more avenues for investigation while reducing errors and missed data points. Organizations with fewer in-house CTI, security operations, or fraud/e-crime prevention resources now have an easy-to-use solution to expand their investigative capabilities without adding additional expertise or headcount.

> “SpyCloud Investigations is the ultimate force multiplier for security teams,” said Jason Lancaster, SpyCloud’s senior vice president of investigations. “SpyCloud’s team of investigators have decades of experience investigating cybercrimes day and night, across all manner of use cases, with public and private sector partners. We’ve spent the last year infusing this knowledge into our solution so analysts at all skill levels can reap the benefits.”

With IDLink advanced analytics now foundational to its industry-leading solution, SpyCloud Investigations offers users the ability to visualize holistic identities of exposed employees, consumers, vendors, and cybercriminal actors themselves to more quickly and comprehensively identify and act on risks – helping them achieve:

*   **Up-leveled Analyst Output**: Investigative workflows automate the process of identifying hidden identity exposures, up-levelling analysts and investigators of all skill levels, increasing team productivity, discovery, and resolution.
*   **Hidden Connections:** IDLink automatically connects the dots and rapidly pieces together a holistic view of a digital identity, in minutes instead of hours of advanced analysis previously.
*   **Attribution:** Automated analytics deliver linked exposed identity assets and records, reducing dead ends in investigations and delivering critical details about criminal actors and threats.

This announcement comes at a time when adversaries are increasingly using stolen identity data to bypass security measures and exploit exposed access. This is evidenced by large-scale infostealer malware campaigns and headline-grabbing breaches, such as the National Public Data breach, which leaked 2.7 billion identity records – including hundreds of millions of Americans’ Social Security numbers.

> “There is a vast amount of personal information in criminals’ hands,” said Jason. “SpyCloud Investigations gets that same data into the right hands, faster, to protect businesses and their users. By illuminating connections, opening up new threads to investigate, and offering unlimited queries to SpyCloud’s enriched database of breached, phished, and malware-exfiltrated data, analysts can visualize threats and act decisively, enhancing organizational resilience against cybercrime and identity threats.”

For more information about SpyCloud Investigations or to schedule a complimentary demo to explore your data, users can contact us here.

****About SpyCloud****

SpyCloud transforms recaptured darknet data to disrupt cybercrime. Its automated identity threat protection solutions leverage advanced analytics to proactively prevent ransomware and account takeover, safeguard employee and consumer accounts, and accelerate cybercrime investigations.

SpyCloud’s data from breaches, malware-infected devices, and successful phishes also powers many popular dark web monitoring and identity theft protection offerings. Customers include more than half of the Fortune 10, along with hundreds of global enterprises, mid-sized companies, and government agencies worldwide. Headquartered in Austin, TX, SpyCloud is home to more than 200 cybersecurity experts whose mission is to protect businesses and consumers from the stolen identity data criminals are using to target them now.

****Contact****

**Emily Brown**  
**REQ on behalf of SpyCloud**  
**\[email protected\]**

SpyCloud Adds Identity Analytics to Cybercrime Investigation Solution for Insider Risk

Zug, Switzerland, October 8, 2024 // Supra, the 500k TPS Layer-1 blockchain with MultiVM compatibility for MoveVM and…

Zug, Switzerland, October 8, 2024 // Supra, the 500k TPS Layer-1 blockchain with MultiVM compatibility for MoveVM and EVM dApps, unveils Supra Containers, a game-changing solution that may well eliminate the need for Layer-2s (L2), Layer-3s (L3), and AppChains.

Supra Containers offer builders the freedom of dedicated L2s and AppChains without the high infrastructure costs, fragmented liquidity, or complex security issues, marking the beginning of a new era for dApps and on-chain development. 

****Navigating the L2 Maze: Liquidity, Composability, and Security****

Builders have turned to L2s and L3s to overcome congestion and scalability bottlenecks they faced on Layer-1s. However, they soon ran into their own set of problems: fragmented liquidity, broken composability, and the need to bootstrap network security. Supra Containers eliminate these barriers by providing developers with the ability to create dedicated execution space for their dApps (DappSpace) that leverage the full power of Supra’s high-performance Layer-1.

****Supra Containers: Access Seamless Composability and Shared Liquidity****

Supra Containers offer the flexibility of L2s — such as dedicated compute or execution space, customizable governance, and freedom to create your own token economies — without the downsides. Builders no longer need to spend time and resources bootstrapping network security, validators, or complex bridging systems. Supra’s L1 node network secures every Container, ensuring that developers can focus entirely on building innovative dApps, not infrastructure.

Supra Containers are fully composable and integrate seamlessly with Supra’s ecosystem and other Containers, preserving atomic smart contract transactions and thus allowing dApps to interact effortlessly. Unlike L2s, where fractured liquidity becomes a big demerit, Supra Containers can share liquidity across the entire Supra L1 network — ensuring smooth operations and access to a unified pool of assets.

****Built-In Services and MultiVM Ecosystem Compatibility****

Supra Containers also come with an in-built, vertically integrated stack of critical blockchain services such as Oracle price feeds, on-chain verifiable randomness, cross-chain communication, and automation, which Supra L1 natively offers. In contrast to L2 app chains, where Oracle and bridge integrations can be costly and complex, Containers provide these features natively, cutting down on costs otherwise spent on integrating these external infrastructures. 

Supra is also MultiVM compatible, which means that developers from ecosystems such as MoveVM, EVM, and soon SolanaVM will be able to immediately deploy dApps on their own Supra Containers without the need for complex migrations. This flexibility allows developers from other ecosystems to tap into the 500k TPS throughput and sub-second consensus latency of Supra Layer-1 — ushering in a new generation of scalable, efficient, and interoperable dApps and Containers.

****Every Supra Container Can Be an Entire Ecosystem****

The potential for Supra Containers extends far beyond individual dApps. Developers can even build entire ecosystems within their custom environment, deploying multiple dApps and smart contracts within their Container. They can also attract other projects to deploy within their infrastructure.

For example, a gaming studio can launch a Container as an ecosystem of decentralized games with unique token incentives, all the while benefiting from Supra’s shared security and liquidity. They could even gate their Container using their on-chain passes or NFTs, and use the same utility token across multiple games in their Container ecosystem, or even in other Containers.

Joshua Tobkin, CEO of Supra, explains: “With Supra Containers, we’re not just simplifying dApp development — this might eliminate most needs for L2s and AppChains. Developers now have the freedom to launch their ecosystems with full control over governance and token economies, while enjoying the security, composability, and shared liquidity of Supra’s Layer-1 infrastructure.”

Supra Containers are a paradigm shift, offering developers a faster, cheaper, and more efficient way to build powerful dApps and their custom economies. By providing dedicated execution space, customizable governance, and tokens — without the trade-offs of traditional AppChains — Supra is transforming the way blockchain applications are developed.

****About Supra****

Supra is a high-throughput Blockchain with vertically integrated native Oracle price feeds, on-chain randomness, cross-chain communications, and automation. They’ve also introduced Containers, offering developers dedicated customizable DappSpace on Supra L1. With access to 500k TPS throughput and sub-second consensus latency of Supra, Containers bring the sovereignty benefits of AppChains and L2s together with the security, composability, and shared liquidity of Supra’s next-gen Layer-1 blockchain.

Developers can create, scale, and customize their dApps on Supra Containers — all without needing external services or validators. Supra is also MultiVM compatible (MoveVM and EVM, SolanaVM coming soon), enabling builders from all ecosystems to build a new generation of highly scalable, composable, and interoperable Containers and Super dApps.

Supra Redefines the Layer-2 Debate with “Supra Containers” – Is This the End of L2s?

Trojan.AutoIt.1443 targets 28,000 users, spreading via game cheats and office tools. This cryptomining and cryptostealing malware bypasses antivirus…

Trojan.AutoIt.1443 targets 28,000 users, spreading via game cheats and office tools. This cryptomining and cryptostealing malware bypasses antivirus detection by using fake system components and file injection techniques.

Cybersecurity researchers at Doctor Web or Dr.Web have discovered a new cyber attack targeting thousands of users across Russia and neighbouring countries with Trojan.AutoIt.1443.

This campaign uses trojans disguised as office programs, game cheats, and online trading bots, infecting computers with **cryptomining and cryptostealing malware**. The attack also exploits fake system components, scripting tools, and file injection techniques to spread its malicious code.

**Malware Delivery and Execution**

The infection begins when unsuspecting users click on fraudulent links shared on platforms like GitHub and YouTube. These links lead to downloads of password-protected archives that can bypass basic antivirus scans. Once the password is entered, a sequence of files and scripts is extracted, which makes the malware installation possible.

YouTube videos involved in the malicious campaign (Credit: Dr.Web)

According to Dr.Web’s technical blog post, the infection relies on several key components to carry out its malicious activities. One of these is UnRar.exe, a legitimate program used to open RAR files. However, alongside it are scripts named Iun.bat and Uun.bat, which work behind the scenes to schedule tasks that set up the malware and erase any evidence afterwards.

Another important part of the attack is hidden within files called ShellExt.dll and UTShellExt.dll. These files, although seemingly harmless, actually trigger a malicious script disguised as a regular system tool. This script is written in AutoIt, a programming language typically used for automating tasks on Windows, but here, it’s being exploited to help the malware blend in and avoid detection.

**The Malware’s Operations**

Once activated, the malware scans for any debugging tools that may interrupt its execution. If no debugging software is detected, it proceeds to establish network access through the Ncat network utility, executing additional files to cement its presence within the system. It also manipulates the system registry, employing the Image File Execution Options (IFEO) technique to achieve persistence.

The IFEO technique allows developers to debug applications by redirecting system processes to other executables. However, in this campaign, cybercriminals exploit this functionality to execute malicious code every time system services or even trusted applications like Chrome or Edge update. This trick gives the malware control over critical system functions.

**Cryptomining and Cryptostealing**

The malware performs two main malicious tasks: cryptomining and cryptostealing. First, it uses a file called DeviceId.dll, disguised as part of the .NET framework, to install a cryptomining program known as **SilentCryptoMiner**. This program quietly runs on infected computers, using their processing power to generate cryptocurrency for the attackers without the user’s knowledge.

Second, it employs a file named 7zxa.dll, which looks like it belongs to the legitimate 7-Zip program, but actually contains a **“clipper” tool**. This tool monitors the clipboard for cryptocurrency wallet addresses, swapping them with the attackers’ addresses to divert funds.

So far, this technique has allowed the hackers to steal over $6,000. Both of these malicious files are hidden within the system by injecting them into the Windows Explorer process. This sneaky method, known as Process Hollowing (very similar to **Process Doppelgänging**), allows the malware to run unnoticed, leading to multiple instances of the Explorer process running at the same time, which is a sign of infection.

It is also worth noting that the infection chain of Trojan.AutoIt.1443 is similar to a recently discovered variant of **Lua malware**, which is distributed as an installer or a ZIP archive, often disguised as game cheats or other gaming-related tools.

**Widespread Impact and Prevention Measures**

This campaign has affected over 28,000 users, primarily in Russia but also in nearby countries such as Belarus, Kazakhstan, and Turkey. Most victims were tricked into installing pirated software, emphasizing the risks of downloading software from untrusted sources.

To protect against such threats, users are advised to:

*   **Use reliable antivirus solutions.**
*   **Download software only from trusted sources.**
*   **Regularly update security software to detect the latest threats.**
*   **Avoid using pirated programs, as they often come bundled with malicious files.**

As malware attacks become more advanced, unsuspected users need to stay alert and follow safe computing practices to avoid getting infected. Since cybercriminals are always finding new ways to attack, it’s important for users to stay up to date on the latest threats and security tips to protect their systems. Stay informed and follow Hackread.com for more.

1.  **Fake League of Legends Download Ads Drop Lumma Stealer**
2.  **Global malspam targets hotels, spreading Redline, Vidar stealers**
3.  **Fake Windows site dropped Redline malware as Windows 11 upgrade**
4.  **Fake CAPTCHA Verification Pages Spreading Lumma Stealer Malware**
5.  **Ransomware Hidden as a Game: Kransom’s Attack Via DLL Side-Loading**

New Crypto Trojan.AutoIt.1443 Hits 28,000 Users via Game Cheats, Office Tool

Abu Dhabi, UAE, October 9, 2024 – Dragonz Lab, a Web3 gaming studio originating from the UK, today…

**Abu Dhabi, UAE, October 9, 2024** – Dragonz Lab, a Web3 gaming studio originating from the UK, today announced a $9 million funding round led by Syndicate Capital Limited Partnership Fund (LPF), a venture fund specializing in Web3, Blockchain, and AI investments, playing a role as a community builder to foster the development of digital economy.

This strategic equity investment aims to enhance the development of Dragonz Land, a utility-driven Play-2-Earn game, promoting digital property rights and the Web3 ecosystem.

Through Syndicate Capital LPFs support, Dragonz Lab plans to use the funds to further develop _Dragonz Land’s_ ecosystem, which already boasts a base of over 5.3 million monthly active users, to enhance the game’s features such as PvP tournaments, strategic guild collaborations and customer loyalty program. 

_Dragonz Land_ combines unique NFT cards with dynamic gameplay and community engagement. Players can buy, collect, level up, and trade cards across 16 distinct factions while earning in-game tokens through tapping and completing various tasks.

“Partnering with Syndicate Capital LPF represents a huge leap forward for the Dragonz ecosystem,” said Andy Chen, Representative of Co-General Partner of Syndicate Capital LPF and Board Member of Dragonz Lab.

“Being the frontier and market leader in the Web3 spaces, our expertise in building ecosystems around loyalty programs aligns with our vision to create a sustainable and engaging gaming environment. This strategic investment and synergy will bolster our game development while providing our users with innovative  digital assets and digital property rights to increase user acquisition and retention in the Web3 spaces.”

The game, available on both mobile and desktop via Telegram, utilizes blockchain for secure transactions and true ownership of digital assets. Syndicate Capital LPF is targeting the burgeoning tap game market, as many titles have struggled to retain traction.

The move marks the frontier Asian VC fund from the Web2 space to invest in a Web3 Play-2-Earn game. _Dragonz Land_ stands out for its engaging gameplay combined with a successful revenue model, including in-game purchases and upgrades for ultimate users or digital property owners. 

“Dragonz Land represents the future of gaming and Web3 more broadly, combining our success in customer loyalty programs as well as the excitement of GameFi, innovative blockchain technology, and a successful revenue model” said Dr. Albert Yip, Chairman of Syndicate Capital Group.

“As a Web3 builder, we are thrilled to support this project, providing our expertise to boost the Dragonz ecosystem and produce synergy with our other digital loyalty programs such as Asia Top, which is one of our flagship portfolio companies of Syndicate Capital LPF .”

The project is set to deliver its tokenomics and additional features in the coming months, reinforcing its commitment to continually growing its user base and community engagement.

****About Dragonz Land****

Dragonz Land is a Trading Card Game where players buy, collect, merge, and evolve NFT cards to increase their power, rarity, and value. The cutting edge Web3 MTG style trading card game is implemented into a tap-to-earn using features like claiming Game Cards and NFTs, KOL/Heroes guilds.

****About Syndicate Capital Group****

Syndicate Capital Group is the Investor Champion and Corporate Champion of Global Fast Track, aiming to support the fintech and CBDC initiatives globally. It is the Co-General Partner of Syndicate Capital LPF which is a Web3 venture fund with a special focus for investments in the digital economy. Syndicate Capital Group is a Web3 investor of the investors network at Cyberport that is positioned as the Web3 Hub in Hong Kong.

****Media Contact****

*   Franky Kas
*   PR Manager
*   \[email protected\]

1.  What is Blockchain Gaming and its Play-to-Earn Model?
2.  The Rise of Blockchain Gaming and Secure Marketplaces
3.  Atari Asteroids Hack Sparks Blockchain Gaming Transparency Debate

Dragonz Lab Secures $9M from Syndicate Capital to Boost ‘Dragonz Land’ Ecosystem

The Sui Foundation supports native USDC on the Sui network with $120M in liquidity, marking the 3rd largest…

The Sui Foundation supports native USDC on the Sui network with $120M in liquidity, marking the 3rd largest USDC supply. NAVI integrates USDC on day 1, enhancing capital efficiency and user experience.

**New York, US, October 9, 2024** – The Sui Foundation recently announced support for native USDC on the Sui network. As the inaugural and top DeFi & liquidity protocol on Sui, NAVI announced that it will integrate Circle’s native USDC asset on DAY 1. 

With $120M in USDC liquidity, this constitutes the 3rd largest USDC supply in the industry, next to Aave and Compound. The integration of Circle’s USDC stablecoin directly into the Sui network enhances capital efficiency and improves the user experience across the ecosystem. 

This move strengthens Sui’s standing in the blockchain industry, enhancing user experience and promoting wider adoption of the Sui ecosystem through NAVI fully supporting native USDC with a suite of in-application migration features and a capital-efficient native USDC Liquidity Pool, including native USDC liquidity support, flash loan capabilities, among other functionalities.

As more blockchain networks adopt USDC, with Sui being the latest, the role of permissionless composability has fueled the rapid expansion of new applications and blockchain networks by leveraging existing open technologies.

****Native vs Bridged USDC on Sui****

The introduction of native USDC to the Sui network simplifies transaction processes and enhances liquidity within the ecosystem. Users will now have the ability to access USDC directly on Sui, streamlining workflows and increasing overall value for participants. 

Moreover, with the adoption of Cross-Chain Transfer Protocol (CCTP), users can eliminate delays typically associated with bridge withdrawals, thereby establishing a new standard for blockchain efficiency.

Native USDC offers distinct advantages compared to bridged USDC (wUSDC). Native issuance guarantees that the asset is fully reserved and can always be redeemed 1:1 for US dollars. This adds a layer of trust for developers and users alike, who can rely on the integrity of the underlying asset.

****Native USDC on NAVI****

In its pursuit to provide the highest level of asset composability on the Sui network, the NAVI Protocol will fully integrate native USDC as a lending and borrowing liquidity pool. As part of a broader ecosystem initiative, NAVI aims to incentivize users to transition away from bridged USDC and adopt native USDC entirely.

NAVI Protocol is committed to delivering the best possible experience for lending and borrowing, which includes the integration of native USDC, fully backed by US dollars and redeemable on a 1:1 basis. The upcoming migration plan is expected to accelerate the adoption of native USDC, thereby contributing to the growth and improvement of the Sui DeFi ecosystem.

A comprehensive migration plan will be shared in the coming days, outlining the steps necessary for a seamless transition.

****About Circle****

Circle is building the largest, most widely used stablecoin network so billions around the world can access digital dollars for payments and liquidity. The company currently manages USDC, the #2 stablecoin by market cap. It combines the power and stability of US Dollars with the speed of the internet, setting the groundwork for a new global and decentralized financial system. 

****About NAVI Protocol****

NAVI is the inaugural liquidity protocol native to the Sui network. It seeks to establish the cornerstone for chains based on the Move system and aspires to be the premier liquidity protocol in the Sui DeFi ecosystem.

****Media Contact****

*   Ivan Djordjevic
*   Marketing Lead
*   \[email protected\]

Sui to Make Native USDC Available Through NAVI Protocol

Cybercriminals exploit disaster relief efforts to target vulnerable individuals and organizations in Florida, compromising the integrity of relief…

Cybercriminals exploit disaster relief efforts to target vulnerable individuals and organizations in Florida, compromising the integrity of relief efforts. Learn more about FEMA claim scams, phishing attacks, and malicious files disguised as FEMA documents.

As Florida recovers from Hurricane Helene and braces for Hurricane Milton, a Category 5 storm expected to hit Tampa on October 9, 2024, a new challenge emerges in the online world: Cybercriminals are taking advantage of the disaster victims and relief organizations, exploiting the confusion and urgency of the moment for financial gain.

Veriti, a cybersecurity research firm, recently uncovered three disturbing cybersecurity threats that have surfaced amid the disastrous situation. These scams, which target both individuals and organizations, involve fraudulent Federal Emergency Management Agency (**FEMA**) claims, phishing campaigns, and malware disguised as legitimate FEMA documents.

****Phishing Using FEMA****

While FEMA claims scamming is a direct attack on disaster victims, phishing campaigns are another method cybercriminals are using to exploit the hurricane’s aftermath. Veriti researchers have reported a spike in newly registered domains that appear to be linked to hurricane relief efforts.

These websites, with names like **hurricane-helene-relief(.)com** and **hurricanehelenerelief(.)com**, are designed to trick users into providing sensitive data such as Social Security numbers and financial information.

These fake websites often create a sense of urgency, offering immediate relief or grant opportunities, which makes victims more likely to fall for the scam. The phishing campaigns are typically carried out via email, where recipients are directed to these **fraudulent sites** under the guise of applying for aid. Once victims enter their personal information, the attackers either sell the data or use it for financial fraud.

****Fake FEMA Assistance Providers****

According to Veriti’s **blog post** shared with Hackread.com ahead of publishing on Tuesday, October 8, cybercriminals are posing as FEMA assistance providers and creating fake FEMA claims to steal personal information and disaster relief funds from vulnerable storm survivors.

One such cybercrime forum is BlackBones, where scammers have openly shared strategies for tricking victims, with one user going by the alias “brokedegenerate” even posting detailed instructions on how to submit fraudulent FEMA claims.

****Malware in FEMA Documents****

Cybercriminals are also disguising malware as legitimate FEMA documents, adding an extra layer of danger for those seeking aid. In one instance, a file called fema\_grants\_manager\_user\_manual.pdf was uploaded to **VirusTotal**, a virus-scanning service. While it appeared to be a legitimate FEMA document related to disaster recovery, Veriti researchers discovered that it contained malicious code.

The file, which referenced official FEMA grant systems like the Grants Manager and Grants Portal, aimed to lure users into trusting it. However, hidden within the document was a malicious payload that would redirect users to a suspicious website, infecting their systems with malware. Although no active infections have been reported yet, the existence of such files indicates that cybercriminals are ready to strike whenever disaster relief efforts are in full swing.

Nevertheless, as Florida residents work to rebuild their homes and lives after Hurricane Helene, cybercriminals are grabbing the opportunity to take advantage of the situation. Staying aware of these threats and taking steps to protect yourself can help keep these scams from making an already tough situation worse.

1.  Hackers Dropping Malware in Fake “terror alert” Emails
2.  FEMA leaks sensitive details of 2.3 million disaster survivors
3.  Online Scam Alert Associated with the Nepal Earthquake Disaster
4.  Hackers Sending Fake Ebola Virus reports in emails with Malware
5.  Fancy Bears Hacked MH17 crash investigators with phishing attack

Scammers Hit Florida Hurricane Victims with Fake FEMA Claims, Malware Files

Pro-Ukrainian hacktivists from DumpForums claim to have breached Russian cybersecurity giant Dr.Web, stealing over 10 TB of sensitive…

Pro-Ukrainian hacktivists from DumpForums claim to have breached Russian cybersecurity giant Dr.Web, stealing over 10 TB of sensitive data, including internal projects, client databases, and critical infrastructure access.

DumpForums, a pro-Ukrainian hacktivist forum, claims to have breached Dr.Web, a Russian cybersecurity company and antivirus solutions provider. As a result, hackers have announced stealing over 10 TB of internal, customer/client data, Hackread.com can exclusively confirm.

The attack dates back to Saturday, September 14th, when Dr.Web (also known as Doctor Web, Doctor Web Ltd., and Company Doctor Web) identified that it had suffered a cyberattack. After investigating, the Russian cybersecurity giant published a brief blog post on September 17, 2024, revealing that the company was targeted in a cyberattack aimed at its “resources.” At that time, Doctor Web claimed that it had “prevented the attack in a timely manner” and that no user data was accessed or stolen.

However, as Hackread.com’s research team discovered, on the morning of October 8th, 2024, DumpForums hacktivists used their Telegram account to announce and claim responsibility for the September attack. The hacktivists’ Telegram post contradicted what Doctor Web had stated about the hack in September.

The screenshot shows Dr.Web’s Telegram post (left) and DumpForums’ post on the right. The original Russian-language screenshots have been translated into English using Yandex AI Image Translator (Credit: Hackread.com).

****DumpForums Hacktivists Claim Dr.Web’s Infrastructure Hack****

According to the post, the hacktivists stated they had hacked the infrastructure of Dr.Web, adding that they infiltrated the company’s local network after planning everything in advance. After that, they systematically hacked more servers and resources “within just a few days.”

Additionally, the hackers claimed to have hacked and extracted data from Dr.Web’s corporate GitLab server, where internal developments and projects were stored, including the corporate email server, Confluence, Redmine, Jenkins, Mantis, and RocketChat.

The hackers also claimed to have accessed and downloaded the entire client/user database, which they had already leaked on their official forum.

To further authenticate their claims, the hackers provided several dumps of databases from internal resources such as ldap.dev.drweb.com, vxcube.drweb.com, bugs.drweb.com, antitheft.drweb.com, and rt.drweb.com, among others.

****Accessing Dr.Web’s domain controller?****

What’s even more concerning are the claims from the hacktivists that they gained control of Dr.Web’s domain controller, a critical part of the company’s infrastructure. The domain controller manages authentication and access to all systems within a network. By compromising it, the attackers would have had unlimited access to the entire network, allowing them to continuously extract massive amounts of sensitive data.

This level of control reportedly enabled them to remain undetected for a month while siphoning off around 10 terabytes of data. The group also pointed out Dr.Web’s alleged poor security, stating that they spent an “entire month” in the system while the company continued selling products to secure others.

It is important to note that Hackread.com has reached out to Dr.Web regarding the claims made by DumpForums hacktivists, and this article will be updated accordingly.

****Ukraine and Russia Cyberwarfare****

It is also worth noting that DumpForums is known for attacking critical Russian infrastructure. In June 2022, the same group was behind the hack and defacement of the Russian Ministry of Construction, Housing, and Utilities. The hackers also stole the ministry’s entire database and demanded 0.5 BTC as ransom to prevent the data from being leaked online.

Nevertheless, the cyber warfare between Russia and Ukraine is gaining new momentum. Hackers from both countries have been targeting each other’s critical infrastructure since the conflict began on February 24, 2022.

According to Ukraine’s State Service of Special Communications and Information Protection (SSSCIP), there has been a significant shift in Russian cyber operations against Ukraine in the first half of 2024. The new strategy marks a departure from previous broad-spectrum attacks to a more targeted approach focusing on Ukraine’s military and defence sectors.

On the other hand, Ukrainian hackers have been quite active over the past few months. Some of their claimed cyberattacks include targeting banks and shutting down ATMs in Russia, targeting the government sector and damaging petabytes of data, crippling the country’s tax system, and other actions.

1.  Ukrainian Hacktivists Trick Russian Military Wives for Personal Info
2.  Protestware Uses npm Packages to Call for Peace in Gaza, Ukraine
3.  Ukraine Hacks Russia’s Aviation Agency, Claims “Aviation Cannibalism”
4.  57,000 Kaspersky Fan Club Forum User Data Leaked in Hosting Breach
5.  Ukrainian Hackers Breach Email of APT28 Leader, Who’s Wanted by FBI

DumpForums Claim 10TB Data Breach at Russian Cybersecurity Firm Dr.Web

Morphisec Threat Labs uncovers sophisticated Lua malware targeting student gamers and educational institutions. Learn how these attacks work…

Morphisec Threat Labs uncovers sophisticated Lua malware targeting student gamers and educational institutions. Learn how these attacks work and how to stay protected.

The cybersecurity researchers at Morphisec Threat Labs have uncovered and thwarted multiple variants of Lua malware specifically targeting the educational sector. These attacks exploit the popularity of **Lua-based gaming engine supplements**, which are widely used by student gamers. Even more concerning, the malware campaigns were observed targeting unsuspecting users globally including across North America, South America, Europe, Asia, and Australia.

The malware strain was first reported in March 2024 (do not confuse Lua malware with the infamous **Luabot DDoS malware** identified in 2016). Over the past months, the delivery methods of Lua malware have changed to become simpler, possibly to evade detection mechanisms. Instead of using compiled Lua bytecode, which can easily raise suspicion, the malware is now frequently delivered through obfuscated Lua scripts.

****Malicious ZIP Files****

The malware is typically distributed in the form of an installer or a ZIP archive and often disguised as game cheats or other gaming-related tools, making it particularly lucrative to students who are searching for ways to enhance their gaming experience.

According to Morphisec Threat Labs’ detailed technical **blog post** shared with Hackread.com ahead of publishing on Tuesday, when a user downloads the infected file, typically from platforms like GitHub, they receive a ZIP archive containing four key components: Lua51.dll: A runtime interpreter for Lua, Compiler.exe: A lightweight loader, Obfuscated Lua Script: The malicious code and Launcher.bat: A batch file that executes the Lua script.

Upon execution, the batch file runs the Compiler.exe, which loads the Lua51.dll and interprets the obfuscated Lua script. This script then establishes communication with a Command and Control (C2) server, sending detailed information about the infected machine. The C2 server responds with tasks, which can be categorized into two types: Lua Loader Tasks: Actions such as maintaining persistence or hiding processes. Task Payloads: Instructions to download and configure new payloads.

Attack flow (Via Morphisec Threat Labs)

****Lua Malware and SEO Poisoning****

The delivery techniques used in these attacks include **SEO poisoning**, where search engine results are manipulated to lead users to malicious websites. For instance, advertisements for popular cheating script engines like Solara and Electron, often associated with Roblox, have been found to direct users to GitHub repositories hosting various Lua malware variants. These repositories frequently use github.com/user-attachments push requests to distribute the malware.

****Additional InfoStealer Like Redline****

The infection chain does not end with Lua malware infection. The malware ultimately leads to the deployment of infostealers, notably Redline Infostealers. For your information, infostealers like **Redline, Vidar and Formbook** are gaining prominence as the harvested credentials are sold on the dark web **especially ChatGPT credentials**, opening the door to more attacks in the future.

SEO poisoning in action (Via Morphisec Threat Labs)

****Watch Out Students and Gamers****

Gamers, educational institutions, and students should be cautious of Lua and other malware threats by avoiding downloads from untrustworthy sources. Keeping security software up to date and informing users about the **cybersecurity risks of downloading game cheats** and unverified content can help reduce the chances of these attacks.

1.  **Fake League of Legends Download Ads Drop Lumma Stealer**
2.  **Global malspam targets hotels, spreading Redline, Vidar stealers**
3.  **Fake Windows site dropped Redline malware as Windows 11 upgrade**
4.  **Fake CAPTCHA Verification Pages Spreading Lumma Stealer Malware**
5.  **Ransomware Hidden as a Game: Kransom’s Attack Via DLL Side-Loading**

Lua Malware Targeting Student Gamers via Fake Game Cheats

San Francisco, CA, 8th October 2024, CyberNewsWire

**San Francisco, CA, October 8th, 2024, CyberNewsWire**

Partnership aims to help businesses eliminate vulnerable attack surfaces and provide a more streamlined user experience.

**Badge Inc****.**, the award-winning privacy company enabling Identity without Secrets™, today announced a partnership with CyberArk and the public release of its integration in the CyberArk Marketplace.

According to the CyberArk website: The Badge CyberArk Identity integration allows specified users to authenticate into CyberArk Identity and its downstream apps and services, using Badge. This enables user-centric privacy, allowing users to issue and revoke digital identity and keys on-demand using biometrics and/or other factors.

The blog post mentions that privileged users hold highly sensitive access credentials and face an ever-increasing threat surface. This has made these users and their credentials prime targets for cyber-attacks. By leveraging Badge’s technology to eliminate the storage of user credentials, organizations benefit unprecedented security, while maintaining a great user experience.

> Archit Lohokare, CyberArk’s GM for Workforce Solutions, “CyberArk is excited to partner with Badge and offer this new integration. It is an important step forward in our mission to deliver comprehensive identity security solutions across all identities and all environments. Badge’s expertise in eliminating stored secrets and removing friction in difficult use cases complements our identity security platform.”

**Integration to CyberArk Marketplace**

Badge and CyberArk are launching a new integration that: 

1.  Enables unprecedented multi-factor authentication experience across all channels, including new and shared devices,
2.  Offers next-generation privacy technology and a more streamlined user experience to customers
3.  Brings phishing-resistant authentication to account recovery workflows.

> “We’re proud to partner with CyberArk. This integration represents a pivotal step forward in the quest to defeat cyber threats targeting privileged accounts. Stored privileged credentials are a high-target vulnerability, and eliminating this weak point is a big step forward. It also underscores the importance of innovative cybersecurity solutions and demonstrates how advancements in technology can be leveraged to enhance security measures across the board,” said Dr. Tina P. Srivastava, Badge Co-founder. “By addressing the vulnerabilities associated with traditional authentication methods like passwords, organizations can protect their most critical assets more effectively, ensuring that their ‘keys to the kingdom’ remain out of reach from cyber adversaries.”

As cyber threats evolve, so are the approaches to cybersecurity. Together, Badge and CyberArk are helping businesses eliminate vulnerable attack surfaces and provide a more streamlined user experience.

**About CyberArk** 

CyberArk is the global leader in identity security. Centered on intelligent privilege controls, CyberArk provides the most comprehensive security offering for any identity – human or machine – across business applications, distributed workforces, hybrid cloud environments and throughout the DevOps lifecycle. The world’s leading organizations trust CyberArk to help secure their most critical assets.

**About Badge**

Badge enables privacy-preserving authentication to every application, on any device, without storing user secrets or PII. Badge’s patented technology allows users to derive private keys on the fly using their biometrics and factors of choice without the need for hardware tokens or secrets. Badge was founded by field-tested cryptography PhDs from MIT and is venture-backed by tier 1 investors. Customers and partners include top Fortune companies across healthcare, banking, retail, and services. To learn more: **www.badgeinc.com****.**

**Contact**

**Media Contact**  
**John O’Brien**  
**SBS Comms**  
**\[email protected\]**

Badge and CyberArk Announce Partnership to Redefine Privacy in PAM and Secrets Management

The Storm-1575 group is known for frequently rebranding its phishing infrastructure. Recently, ANY.RUN analysts identified the deployment of…

The Storm-1575 group is known for frequently rebranding its phishing infrastructure. Recently, ANY.RUN analysts identified the deployment of new login panels, which are part of the threat actor’s ongoing efforts to compromise users’ Microsoft and Google accounts.

****Storm-1575’s New Login Panels****

Through analysis of their features, the team was able to link login panels to Storm-1575. Among other things, the panels share:

*   Phishing domains 
*   Random panel page headers
*   Use of website templates to mask servers 
*   Panel token verification request, the same font, and the panel URL 

_Comparison of Storm-1575’s phishkits_

The panels also have their distinctive features:

*   **Target Accounts**: Microsoft vs. Google 
*   **Verification**: Cloudflare for Microsoft, arithmetic CAPTCHA for Google 
*   **Encryption**: Strong AES CryptoJS for Microsoft, weak obfuscation for Google

The findings confirm that these panels are operated by Storm-1575, a group that previously used the same infrastructure with other phishing platforms such as DadSec, Phoenix Panel, and Rockstar2FA Portal.

****How to Proactively Discover New Storm-1575 Attacks****

To stay ahead of Storm-1575’s latest phishing tactics, cybersecurity professionals can use ANY.RUN’s Threat Intelligence Lookup. 

This powerful platform offers a centralized repository of threat data from ANY.RUN’s malware sandbox sessions, enable users to investigate emerging threats with access to indicators of compromise, network activity, and file behaviours. 

One example of Storm-1575’s phishing infrastructure is the domain menlologistics.com. By submitting this domain to the TI Lookup platform, users can uncover key details about its malicious activity.

_Search by the domain name in ANY.RUN TI Lookup_

A search query for **domainName:”menlologistics.”** revealed 4 associated IP addresses and 69 sandbox sessions in ANY.RUN, most of which were linked to phishing activities.

Analysts can also investigate by threat name using **threatName:”storm1575″**, granting direct access to any recorded session where this threat was detected in the ANY.RUN sandbox.

_Search by the threat name in ANY.RUN TI Lookup_

This integration between TI Lookup and the sandbox provides a comprehensive view of the threat landscape, enabling users to review real-time phishing tactics and infrastructure in action.

****ANY.RUN Threat Intelligence Portal****

If you’re looking to enhance your threat intelligence capabilities, explore ANY.RUN’s TI portal to gain deeper insights into the world of cyber threats and strengthen your defences.

Test ANY.RUN’s Threat Intelligence Lookup to see how it can improve your threat-hunting efforts.

1.  Analysis of Top Infostealers: Redline, Vidar and Formbook
2.  PythonAnywhere Cloud Platform Abused for Hosting Ransomware
3.  Tycoon and Storm-1575 Linked to Phishing Attacks on US Schools
4.  ANY.RUN Upgrades Threat Intelligence to Identify Emerging Threats
5.  StormBamboo APT Targets ISPs, Spreads Malware via Software Updates

Source

HackRead