By Deeba Ahmed
Do Kwon insists he is "not on the run."
This is a post from HackRead.com Read the original post: Interpol Issues Int. Arrest Warrant for Terra Stablecoin Founder Do Kwon

The International Criminal Police Organization (Interpol) has issued an international arrest warrant, also called a red notice, for Terraform Labs founder Kwon Do-Hyung, more commonly known as Do Kwon.

Interpol has requested law enforcement agencies worldwide to search and arrest Do Kwon.

“Prosecutors in Seoul said Monday in a text message the international police organization has issued a Red Notice for Do Kwon.”

Do Kwon

Do Kwon, a South Korean national, is accused of the collapse of two cryptos on the Terra ecosystem, Terra cryptocurrency (Luna) and stablecoin TerraUSD (UST), which resulted in losses of $40 billion for investors, and an investigation was launched.

For your information, Terraform Labs’ cryptocurrency LUNA and UST imploded unexpectedly in May 2022 because investors lost faith in their effectiveness. Do Kwon revived the crypto project and avoided the algorithmic stablecoin component for now. UST’s de-pegging prompted the crashing of the LUNA token because both were intertwined.

Luna token’s crashing caused the wipeout of a previously high-profile crypto hedge fund, Three Arrows Capital. These collapses impacted a large number of crypto lenders, including BlockFi.

According to Bloomberg, Reportedly, several cases have been registered against Do Kwon.

However, crypto industry experts have voiced concerns over issuing a red notice because it will set a wrong precedent. Experts claim that the notice is uncalled for since Do Kwon didn’t defraud his customers and investors knowingly. Red notices are issued for most wanted fugitives for prosecution or serving a sentence.

As per Interpol’s website, the notice will serve as a request to international law enforcement authorities to provisionally arrest the person who is to be deported or facing legal action. However, at the time of writing, no arrest warrant or red notice was displayed on Interpol’s site. You can search for a red warrant on this link.

Crypto investment fund Dragonfly’s managing partner Haseeb Qureshi stated that Terra’s criminalization is a dangerous precedent.

“Having met Do Kwon … leaving how he is a person aside … I think the criminalization of Terra is a dangerous precedent,” but he also added that he didn’t know many details.

According to the prosecutors, the accused will face charges in South Korea. South Korean prosecutors intensified their investigation against Do Kwon and accused him of non-cooperative behavior this month. They also alleged that the entrepreneur was on the run as they had ‘circumstantial evidence of escape.’

Around fifteen days back, the prosecutors confirmed that Do Kwon had fled Singapore, and that’s why an arrest warrant was issued. However, Do Kwon posted on social media that he wasn’t on the run and was interested in communicating with government agencies. He also proclaimed that his team was fully cooperating and had nothing to hide.

> I am not “on the run” or anything similar – for any government agency that has shown interest to communicate, we are in full cooperation and we don’t have anything to hide
> 
> — Do Kwon 🌕 (@stablekwon) September 17, 2022

Korean officials have accused Do Kwon and five other individuals of allegedly violating capital-market laws.

Korean prosecutors are currently trying to locate Do Kwon’s whereabouts and arrest him as soon as possible. Interpol’s arrest warrant will help them seek information from international agencies in this regard.

1.  12 Arrested as Interpol Takes Down Transnational Sextortion Ring
2.  Interpol arrests Moroccon hacker over global phishing, malware scam
3.  Austria seeks Interpol’s help to bust Bitcoin scammers who stole $115M
4.  $3.6 billion worth of Bitcoin seized from crooks tied to 2016’s Bitfinex hack

Interpol Issues Int. Arrest Warrant for Terra Stablecoin Founder Do Kwon

By Owais Sultan
With most people being online for most of the day, whether for personal reasons or work-related tasks, cybersecurity…
This is a post from HackRead.com Read the original post: Simple Yet Vital Ways to Safeguard Yourself Against Online Threats

With most people being online for most of the day, whether for personal reasons or work-related tasks, cybersecurity is more important than ever. As the internet evolves and new technologies are created, new ways of scamming people or stealing important data come up too.

Despite rather widespread awareness about the importance of cybersecurity and the prevalence of malicious online attacks, most people do little to nothing to secure themselves against these potential security threats.

Here are a few simple ways of securing yourself against malware and bad actors on the web.

Source: Pexels

**Making unique passwords**

Repeating passwords is something a lot of people do, even if they know it’s inadvisable. Although remembering all your login credentials for all the different sites you’re on can be a herculean task, it also makes you very vulnerable to cyber-attacks. Using extremely generic passwords is also not a good idea as it makes hacking into your account very simple.

Unfortunately, masses of tech users adopt the same approach and this has been proven with research conducted by the likes of ExpressVPN into the most common passwords used globally.

With variations on terms like ‘passwort’ and popular football teams such as ‘Juventus’ highlighted as some of the most commonly used passwords in countries like Germany and Italy, it’s perhaps no surprise that confidential and sensitive information is so easily acquired by bad actors on the internet.

Use password managers that can help you keep track of all of your passwords or random term generators whenever prompted to change your passwords!

**Avoiding messages from unknown sources and unverified sites**

Phishing scams are really common and they’re getting better at what they do. These scams usually involve a fake website, which looks like a legitimate e-store or business, being used to make people enter their sensitive personal and financial information into fields present on the site.

One of the easiest ways of checking whether a site is real or not is by using URL checkers. One can never be too careful because these scams are ever evolving.

Source: Pexels

**Using multiple e-mail addresses**

Having a different email address to use to sign up for services and products is also a helpful way of ensuring your safety. Having multiple e-mail addresses makes sure that not all of your data is in one place. It can also help keep promotional messages and other spam messages with suspicious attachments separate from essential personal communication.

**Authentication and privacy settings**

A lot of sites sell your data to advertisers. Oftentimes, a company’s policy about privacy or selling of data is hidden in the fine print of user agreements, which an overwhelming majority of people do not go through at all. Sometimes, you can check your privacy settings on a site or an app and explicitly instruct them not to sell your data.

If your photos are publicly available on the internet, you should keep in mind the possibility of someone stealing them and pretending to be you or someone else. Anyone who keeps your photos without your explicit consent should be reported immediately. Turning on two-factor authentication for messaging apps is also important.

There are very simple and rather obvious ways in which you can safeguard yourself against cyber-attacks. Oftentimes, people don’t take this advice to heart, but doing so can make you a great deal safer while online!

1.  How to detect phishing images in emails
2.  The Types of Phishing Attacks and How to Dodge All of Them
3.  Scammers Leveraging Microsoft Team GIFs in Phishing Attacks
4.  9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos
5.  Hoxhunt Primed to Spread Gamified Phishing Awareness in the Enterprise

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Simple Yet Vital Ways to Safeguard Yourself Against Online Threats

By Owais Sultan
Although online fraud includes identity theft, phishing scams, and viruses, there are steps that can be taken to protect against them. Let's dig into the whats and hows of it.
This is a post from HackRead.com Read the original post: 5 Online Fraud Fighting Tips for Novices

Navigating the online sphere can be a big challenge, particularly if you are someone not overly clear on what the threats are and how to target them. If you fall into this category and want to take steps to increase your online safety and reduce the risk of fraud, here are some key tips to follow.

**1\. Stay up-to-date with the ever-changing phishing scams.**

The ways criminals try to get their hands on your information and cash are constantly evolving. Every time companies and consumers take steps to close loopholes; they come up with ever-evolving workarounds. Some scams you can fall prey to are incredibly sophisticated, meaning even the savviest individual might be convinced. They can mimic company websites exactly, fake email addresses and phone numbers, and can use sophisticated techniques to get information out of you.

As a consumer, you must stay on top of what kind of scams are being used, and you prepare yourself to look out for them. You can use many different blogs and online sites, and you can find a wealth of information on sites like Reddit and even Facebook, as well as by using Google. Arming yourself with the knowledge to weed out the crooks and protect yourself is one of the best things you can do when fighting online fraud.

**2\. Install IP lookup tools on your websites/blogs to trace bad actors and traffic (LI)**

If you have your own website or blog page, you might be aware that bad actors and bots enjoy causing trouble. This can come in the form of offensive comments, spam, or overloading your website, causing downtime and crashes. It can also mean hackers target your site to gain access and take it over.

An IP lookup tool is an excellent solution for those who are not overly tech-savvy: it allows the website owner to have oversight of each visitor to the site based on their IP address. In addition, this tool can assess the validity of an IP address, check addresses against blacklists of spammy content, and detect proxy servers, geolocation, domain, and hostname.

These kinds of tools can be used on their own or in conjunction with other methods to understand more about visitors to a site and to help fight back against fraud. An IP lookup tool is a great place to start for those who want to protect their websites, businesses, or other visitors.

**3\. Create secure passwords – regularly change them.**

One of the most common ways nefarious actors gain access to your accounts is not through any kind of high-tech hacking. It is done, simply by guessing your password. According to CNBC, the world’s most popular and most-used passwords are qwerty, password, 12345, and various similar combinations. Many will also use things like their maiden name, which can easily be found online, famous musicians, or footballers’ names. These can be easy for criminals to guess, mainly if they know something about the user. The other issue is that once we have a password, we don’t change it often enough.

To make matters worse, we reuse the same password across multiple platforms, meaning once a criminal has accessed one account, they can access all of them. This is a significant problem and can result in considerable losses and financial detriment to unsuspecting public members. The best way to avoid situations like this is to create secure passwords, change them regularly, and have a different one for each account.

Online password generators can create strong and unique passwords for you, which can then be used for each account. You should try and change your password every three months, four as a maximum. An easy way to remember to do this is by when you change your password to something substantial, scheduling a calendar reminder to change it three to four months in the future. This is one of the best ways to ensure your accounts remain safe and secure.

**4\. Know who is asking**

Many of us are inundated with emails, SMS, and even phone calls that ask us to reveal personal information or follow links to confirm our details. In the vast majority of cases, these will be false and created by criminals who want to trick you.

Any reputable company will not ask you to reveal personal information over the phone or via email. Furthermore, you should be wary of any communications asking you to reset your password, confirm card details, or hand over other information.

The best advice is to deal with each of these requests with suspicion. First, check the email address or number that is being sent- you can search online to see if they have been flagged as suspicious.

Also, make sure they match up with other correspondence from the company. Then, contact the company yourself via the number or email you have used to get them previously and try to verify the recent communication. If possible, send a copy to customer service or your account manager so they can let you know if it is legitimate or not. 

**5\. Protect your devices **

In 2022, most of us will have a range of electronic devices that we use to access the internet and carry out various tasks. These include mobile phones, tablets, laptops, PCs, Smart TVs, eReaders such as Kindle, smartwatches, and home assistants. Many of these devices require us to link them to email accounts, cards, and payment gateways.

We also regularly give them our personal data such as names, addresses, logins and passwords, photos, videos, mobile numbers, and even preferences. This kind of information, if it ends up in the wrong hands, can be devastating, as ICO.org notes.

It can result in identity theft, fraud, and other issues, costing a lot of time, money, and peace. To combat this, it is necessary to take steps to secure and protect your devices. For example, ensure every device you have is secured with a strong password, biometrics, and two-factor authentication. You should also be cautious about logging out of specific devices and accounts on devices when not in use.

It is also worth looking at various security software and anti-virus products that can provide additional protection to you and your data. There are many options on the market that are both easy to use and affordable. Last but not least, many devices such as mobiles, tablets, and PCs have inbuilt software that can assess security for any loopholes or imminent risks, notifying you of steps you need to take to fix them.

1.  US military personnel defrauded into losing $822m through scams
2.  170 fraudulent Android apps scamming cryptocurrency enthusiasts
3.  12 years jail for man who unlocked phones, defrauded AT&T of $200m
4.  Microsoft Warns of Evolving Toll Fraud Android Malware Draining Wallets
5.  Researchers warn of new Rug Pull scam through fraudulent crypto tokens

5 Online Fraud Fighting Tips for Novices

By Waqas
The exposed Elasticsearch server belongs to an Indian healthcare software company that has not secured the database despite being alerted.
This is a post from HackRead.com Read the original post: Covid antigen test results of 1.7m Indian and foreign nationals leaked online

An **Elasticsearch server** belonging to a healthcare software provider in India is currently exposing the Covid antigen test results of Indians and foreign nationals who traveled to or from India in the last couple of years.

It is worth noting that these tests were taken through a rapid antigen kit known as Covi-Catch. Covi-Catch is an Indian Council of Medical Research (ICMR) approved self-testing kit for COVID-19.

This was confirmed to Hackread.com by **Anurag Sen**, a prominent independent security researcher. What’s worse, the server is still exposed and publicly accessible without any security authentication or password. Originally, the server is being exposed since July, 2nd, 2022.

It all started when Anurag scanned for **misconfigured databases on Shodan** and noted a server exposing more than 23GB worth of data to public access. Anurag said that the server belongs to a company based in Gurgaon, Haryana, India, but we would not share the name of the company in this article because the server is still exposed.

**What data is being exposed?**

Anurag’s analysis of the server revealed that the exposed records are actually Covid antigen test results, while the number of victims in the incident is over 1.7 million. These results not only comprise personal records but medical records of travelers including the following information:

*   Gender
*   Full names
*   Nationality
*   Date of birth
*   Full addresses
*   Phone numbers
*   Vote ID numbers
*   Covid test results
*   Aadhaar numbers
*   Passport numbers
*   Underlying medical conditions
*   Vaccine details (vaccine type, vaccine taken or not)

_And much more…_

The screenshot shows records of American, Canadian, and Indian citizens being exposed online (Image: Hackread.com via Anurag Sen)

**No Response from the company**

Anurag contacted the culprit company through the email address mentioned on their website. However, it has been over a week and there is no response from them. Amid this, the server is still exposed.

Although exposing sensitive data of unsuspecting users to cybercriminals is a blunder, not responding to researchers and not caring about the mess up is simply irresponsible.

**Impact**

It is yet unclear whether a third party accessed the database with malicious intent, such as ransomware gangs or threat actors. However, if it did, it would be devastating for the victim and the healthcare firm responsible for the server.

Furthermore, considering the extent and nature of the exposed data, the incident can have far-reaching implications, such as bad actors downloading the data, carrying out phishing scams, or identity theft-related fraud.

Hackers can hold the company’s server or **data for ransom** and leak it on cybercrime forums if their demands are not met. Nevertheless, the victims in this situation are travelers who trusted authorities with their personal information.

1.  **MyEasyDocs Exposed 30GB of Israeli and Indian Students’ PII Data**
2.  **Chinese Adult Site Leaking 14 Million User Details – and It’s Increasing!**
3.  **Scoop: Australian Trading Giant ACY Securities Exposed 60GB of User Data**
4.  **Major Database Mess Up Leaves Indian Fed Police, Banking Records Exposed**
5.  **Hacker Selling Shanghai Police Database with Billions of Chinese Citizen Data**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Covid antigen test results of 1.7m Indian and foreign nationals leaked online

By Deeba Ahmed
The teen was arrested from Oxfordshire and is still in police custody but his involvement in Uber and GTA hacks is unconfirmed.
This is a post from HackRead.com Read the original post: UK Teen Arrested Amid Uber and GTA 6 Hacking Saga

The City of London Police has arrested a seventeen-year-old teenager over suspicion of hacking amid the recent security breaches at Uber and Rockstar Games’ GTA 6. It is worth noting that the teen’s role in these hacks is still not confirmed.

**Arrest Details**

The teen was arrested from Oxfordshire and is still in police custody. However, the officials haven’t yet shared more details on the arrest and declined to confirm if the teen was arrested for the recent high-profile hacking incidents including Uber and Rockstar Games’ GTA 6.

According to the department’s tweet, the arrest was part of an ongoing investigation carried out in collaboration with the cybercrime unit of the National Crime Agency, UK. The police shared no other detail.

For your information, a couple of months ago, London police arrested and released 7 teens in connection with an investigation into the LAPSUS$ hacking gang.

Lapsus$ is a notorious group of teen hackers that mainly hunts for the source code of high-profile and large tech firms. Some of its previous and successful attacks include Samsung, Microsoft, Nvidia, Okta, and Ubisoft.

The Uber and GTA 6 hacker had also claimed to have access to the source code of both companies.

**Uber and Rockstar Games Hacking**

Uber hacking resulted in the halting of the company’s internal systems for some time. In contrast, Rockstar Games suffered a network intrusion that caused the leaking of unreleased footage of Grand Theft Auto 6.

The two hacks are believed to be committed by the same hacker, who’s identified as Tea Pot or “teapotuberhacker.”

Uber, on the other hand, has blamed the LAPSUS$ hackers for the breach, alleging that the attacker(s) are linked with the LAPSUS$ extortion gang that has remained active over the past year.

It must be noted that the Rockstar Games hacker also claimed responsibility for the Uber hack on his Telegram and fan-run GTA forum. It is assumed that “teapotuberhacker” is a LAPSUS$ ringleader.

1.  Microsoft and Okta Confirm Data Breach Claims by LAPSUS$
2.  Popular YouTuber Scuba Jake’s channel hacked to run crypto scam
3.  Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up
4.  Russian Hacker Exploits GTA 5 PC Mod to Install Cryptocurrency Miner
5.  Grand Theft Auto (GTA) Fan Forum Hacked; Thousands of Accounts Stolen

UK Teen Arrested Amid Uber and GTA 6 Hacking Saga

By Deeba Ahmed
According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. 
This is a post from HackRead.com Read the original post: New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

According to a new disclosure notice from the Microsoft 365 Defender Research Team, cybercriminals are increasingly targeting Microsoft Exchange servers. Their modus operandi involves abusing OAuth applications. 

**Spam Campaigns Involving Malicious OAuth Apps Detected**

Although this isn’t the first time that threat actors have targeted Exchange Server, this campaign is unique because of abusing OAuth applications. These applications are an integral part of the attack chain in this instance.

Per MS 365 Defender Research, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns.

Researchers explained that the threat actor(s) launched a credential-stuffing attack, targeting high-risk accounts where users didn’t enable multifactor authentication. The attacker then leveraged unsecured admin accounts and could gain initial access.

Afterward, the attacker created a malicious OAuth application, adding an inbound connector to the Exchange email server. Hence, the actor can send out spam emails using the target domain.

Previously, OAuth applications were abused in consent phishing attacks where attackers try to access cloud services by tricking users into allowing permission to malicious OAuth apps. Some state-sponsored actors have also abused them for C2 communications, redirections, phishing attacks, and deployment of backdoors.

**Campaign Targets Overview**

Researchers disclosed in their report that numerous organizations have been targeted in credential stuffing attacks so far. In this campaign, attackers launch attacks against administrator account that lack MFA and use them to access the victim’s cloud tenant.

This campaign mainly targets consumers and enterprise tenants, abusing weaknesses in the organization’s security mechanisms and may even lead to ransomware and other devastating attacks.

In this attack, according to Microsoft 365 Defender Research Team report, attackers run spam email campaigns, advertise for fake sweepstakes through spoofing organizations’ identities, or offer an iPhone as a prize to trick victims into signing up for long-term paid subscriptions.

The campaign uses a network of single-tenant apps installed on the compromised organization. This helps the attacker gain an identity platform to launch the attack. As soon as the campaign was disclosed, all the malicious OAuth apps were removed. Organizations must implement stringent security practices to prevent such scams. Enabling MFA should be the first line of defense against such threats.

1.  Hackers hit Microsoft Exchange Server to steal email data
2.  European Banking Authority victim in Microsoft Exchange Server hack
3.  Hackers Using Malicious IIS Extensions to Backdoor Exchange Servers
4.  It’s Google.com, not ɢoogle.com; beware of the pro-Trump spam domain
5.  Spam Campaigns Using Trickbot Banking Trojan Against Cryptocurrencies

New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

By Deeba Ahmed
Optus has denied any inside job or human error as the cause of the hack.
This is a post from HackRead.com Read the original post: Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach

Australia’s second-largest telecommunication firm, Optus, is the latest cyberattack victim, which Sydney-based tech analyst Trevor Long has regarded as the biggest breach of personal data from an Australian firm.

**Optus Hack Details**

On Thursday, Optus confirmed that its customers’ private data could be compromised in this attack since the attackers managed to access the customer identity database and opened it to other systems through the Application Programming Interface (API). The investigation is still ongoing, but Optus believes one of the networks was exposed to a test network with internet access.

According to the official press release, the information potentially exposed includes the following:

*   Names
*   Addresses
*   Dates of birth
*   Phone numbers
*   Email addresses
*   Driver’s license
*   Passport numbers.  

The company suspects intruders scraped the consumer database and possibly copied one-third of it. Optus also stated that its network was accessed from an external source. As soon as it discovered the attack, it shut down the attack before customers could suffer any harm. However, the company did advise its customers to keep tracking their accounts for unusual or fraudulent activities.

1.  Sensitive Data of Australian Navy’s Vessels and Fighter Jets stolen
2.  Hackers stole 738 GB of data from an Australian government agency
3.  Vietnamese man hacked Australian airport computers; stole security data
4.  Scoop: Australian Trading Giant ACY Securities Exposed 60GB of User Data
5.  Anonymous Leak 82GB of Police Emails Against Australia’s Offshore Detention

**Possibility of a Human Error?**

Optus CEO Kelly Bayer Rosmarin was asked if human error was responsible for the breach at a media briefing to which she responded:

> “I know people are hungry for details about the exact specificity of how this attack could occur, but it is the subject of criminal proceedings and so we will not be divulging details about that.”
> 
> Kelly Bayer Rosmarin, Optus CEO.

The CEO added that Optus boasts strong cyber defenses and has invested heavily in this regard, so if it can become a target of a security breach, it should be a wake-up call for all organizations.

However, Optus has denied the involvement of human error in this data breach that impacted millions of customers. The CEO also apologized to the company’s customers and said it was challenging to offer immediate advice unless the investigation was completed.

> “We are devastated to discover that we have been subject to a cyberattack that has resulted in the disclosure of our customer’s personal information to someone who shouldn’t see it.”
> 
> Kelly Bayer Rosmarin, Optus CEO.

Kelly has asked for increased vigilance across companies, governments, and customers of Optus as the Sydney-based telecom giant determines how many customers were affected by the data breach. However, it is confirmed that Optus’s voicemails, texts, payment data, and account passwords weren’t compromised in the hack.

**More TELECOM Security News**

1.  Spanish telecom giant MasMovil hit by Revil ransomware gang
2.  Telecom giant behind routing SMS discloses 5-year-long data breach
3.  Argentina’s largest telecom hacked with hackers demanding $7.5 million
4.  Hacker extracts customer data from Canadian Telecom Firm after rebuttal
5.  Croatian Police arrests minor over A1 Telecom data breach & ransom demand

Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach

By Waqas
Here's everything you want to know about Anonymous and its cyber attacks against the Iranian government for OpIran.
This is a post from HackRead.com Read the original post: OpIran – Anonymous Hits Iranian State Sites, Hacks Over 300 CCTV Cameras

In the wake of the recent Iranian government crackdown on dissent after Mahsa Amini’s death, the international hacktivist group **Anonymous** has launched a new operation against the country’s online infrastructure.

Dubbed **OpIran** (Operation Iran) by Anonymous; the hacktivists have taken down a number of top government websites and hacked over 300 security cameras in different parts of the country.

**What Happened to Mahsa Amini?**

It is worth noting that on September 16th, 2022, a 22-year-old Iranian woman named Mahsa Amini died in Tehran, Iran, under Police custody. Amini was arrested for failure to follow government-mandated forms of the Hijab.

On the other hand, authorities claim Amini died of natural causes after suffering heart failure at the police station. However, Iranians have rejected the official explanation and have taken their protests (Mahsa Amini protests (aka September 2022 Iranian protests) to the streets.

**Anonymous Stands with Protestors in Iran**

On Twitter, YourAnonNews, one of the largest social media representatives of the Anonymous movement, and several other popular Anonymous handles have confirmed their support for Iranian protesters. Thus the recent cyber attacks were carried out under the banner of OpIran.

According to Anonymous, the modus operandi of OpIran involves DDoS attacks (Distributed Denial of Service attacks), data breaches, social engineering attacks, quick tutorials on how to beat state censorship by **using the Tor browser**, and evading arrests by police.

**Anonymous Hacks Iran’s Forensic Research Center**

The first major Iranian government institution to suffer a cyberattack from Anonymous hackers is its Forensic Research Center. As seen by Hackread.com, Anonymous managed to successfully deface its domains and leak a database containing 100MB worth of data.

According to Hackread.com’s analysis, the data contains names, email addresses, logs including IP addresses of the Center’s site visitors worldwide.

A Google search for the Center’s website shows it was hacked by Anonymous (1) – The deface page left by Anonymous plays a video containing content that shows a message of support to Iranians (2) – Screenshots 3 and 4 show what is inside the database Forensic center’s database. (Credit: Waqas – Hackread.com)

**Anonymous hacked 300 Iranian CCTV cameras**

Although Anonymous is famous for its large-scale DDoS attacks and data breaches (the group proved its point during **OpRussia** during Ukraine and Russia conflict), lately, they have been going a step further by hitting the vulnerable IoT infrastructure in the targeted country.

In the case of Russia, as **reported by Hackread.com**, Anonymous managed to hack over 400 security cameras across the country while sending almost 10 million texts to Russian citizens to raise awareness about the conflict.

In the latest, Anonymous has claimed to have compromised 300 security camera installations by exploiting a 5.4 severity score vulnerability.

Iranian CCTV cameras apparently controlled by Anonymous

This however is not the first time when hackers have hacked into CCTV cameras in Iran. **In August last year**, hackers from Edaalate Ali (Ali’s Justice or Ali’s Court) group breached the computer system and security cameras at a prison facility in northern Tehran and leaked live footage of grim conditions and grave human rights violations taking place in the prison.

**Anonymous DDoS Attacks on Iranian Sites**

Since launching OpIran, Anonymous has carried out a series of DDoS attacks against Iranian state institutions. Some of these include the following:

*   National Government Portal of Iran (Iran.gov.ir)
*   The official website of the Central Bank of Iran (Cbi.ir)
*   The official website of the Government Spokesman Office (Dolat.ir)
*   The official website of Ali Khamenei, the Supreme Leader of Iran (Khamenei.ir)
*   The official website of the Iranian State media agency IRIB News Agency (Iribnews.ir)

_and the list goes on…_

At the time of writing, all the above-mentioned domains were offline.

For now, it remains to be seen how effective Anonymous’ latest operation will be. However, it is clear that the group is determined to continue its fight against what it sees as an oppressive regime.

1.  Saudi-Iran: Proxy Wars Escalate To Direct Cyber Attacks
2.  Iran’s Largest Steel Producer Hit By Crippling Cyberattack
3.  Israeli Security Camera Systems targeted by Pro-Hezbollah Hackers
4.  Anonymous & its affiliates hacked 90% of Russian exposed databases
5.  Anonymous hacks unsecured printers to send anti-war messages in Russia

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

OpIran – Anonymous Hits Iranian State Sites, Hacks Over 300 CCTV Cameras

By Deeba Ahmed
The malware campaign is ongoing and one of its targets was ICICI bank in India.
This is a post from HackRead.com Read the original post: Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones

Microsoft 365 Defender Research Team has published its findings on a new version of a previously reported info-stealer Android malware, highlighting that threat actors continuously evolve their attack spectrum.

**Research Findings**

According to Microsoft researchers, the malware is delivered in a currently active SMS campaign and masqueraded as a banking rewards app. The campaign’s primary targets are Indian bank customers. It starts with threat actors sending out messages containing a URL that basically lures the recipient into downloading the malware.

Upon user interaction, it displays a splash screen with the bank logo and proceeds to ask the user to enable specific permissions for the app.

The infection chain starts with an SMS message requesting the recipient to claim a reward from an Indian bank. This message contains a malicious link redirecting the user to downloading a fake banking rewards application. This app is detected as: “TrojanSpy:AndroidOS/Banker.O”

The app’s C2 server is linked to 75 different malicious APKs, all of which are based on open-source intelligence. The research team identified many other campaigns targeting Indian bank customers, including:

*   Icici\_points.apk
*   Icici\_rewards.apk
*   SBI\_rewards.apk
*   Axisbank\_rewards.apk

Their research revolved around icici\_rewards.apk, represented as ICICI Rewards. The malicious link inside the SMS message installs the APK on the recipient’s mobile device. After installation, a splash screen displaying the bank logo asks the user to enable specific permissions for the app.

Fake bank SMS with a malicious link – Malicious app asking for permission – Malicious app asking for user data

**Malware Analysis**

According to Microsoft’s blog post, what makes this new version different is the inclusion of additional RAT (remote access trojan) capabilities. Moreover, this malware is highly obfuscated. Its RAT capabilities allow attackers to intercept critical device notifications, for instance, incoming messages, and also try to capture 2FA messages that the user needs to access banking/financial apps.

The malware can steal all SMS messages and other data, such as OTP (one-time-password) PII (personally identifiable information), to help steal sensitive information for email accounts.

The malware runs in the background, using MainActivity, AutoStartService, and RestartBroadCastReceiverAndroid features to carry out its routines and ensures these keep running to maintain persistence on the mobile device.

The MainActivity (launcher activity) is launched first to display the splash screen and then calls OnCreate() method for checking the device’s internet connection. It also records the malware installation timestamp. Permission\_Activity launched permission requests and later called AutoStartService, the malware’s main handler, and login\_kotak.

SMS campaign attack flow

> This malware’s continuing evolution highlights the need to protect mobile devices. Its wider SMS stealing capabilities might allow attackers to the stolen data to further steal from a user’s other banking apps. Its ability to intercept one-time passwords (OTPs) sent over SMS thwarts the protections provided by banks’ two-factor authentication mechanisms, which users and institutions rely on to keep their transactions safe.
> 
> Microsoft 365 Defender Research Team

To mitigate the threat, Android device users should disable the Unknown Sources option to prevent app installation from unverified sources. And they must rely on credible mobile security solutions to detect malicious apps.

1.  SpyNote Trojan (RAT); Yet Another Bad News for Android Users
2.  BRATA Android malware factory resets phones after stealing funds
3.  New MaliBot Android Malware Found Stealing Personal, Banking Data
4.  Fake Netflix, WhatsApp, Facebook Android Apps Contain SpyNote RAT
5.  New Russian Android Malware Tracks GPS Location and Spies on Victims

Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones

By Owais Sultan
Whenever a coin, stock, or market goes down you’ll have a lot of people blurting “I knew it…
This is a post from HackRead.com Read the original post: Is This The Crypto Winter or a Huge Discount?

Whenever a coin, stock, or market goes down you’ll have a lot of people blurting “I knew it was a bubble” or “I told you so.” This is human nature, this is something skeptical people do and have been doing forever. In contrast, fresh new investors then jump in blindly, while not doing research or educating themselves on the matter.

**What is even Crypto Winter?**

As the name implies, crypto winter is a period of time when the cryptocurrency market takes a significant downturn. This can be caused by various factors, such as regulatory uncertainty or a lack of mainstream adoption. During these times, investors may lose confidence in the market and sell off their assets, leading to further declines.

Crypto winter can be a difficult time for those involved in the market, but it can also present opportunities. For example, during periods of decline, new investors may be able to buy assets at lower prices. Additionally, companies may be more willing to accept crypto as payment during these times.

Overall, crypto winter can be seen as a natural part of the market cycle. While it can be challenging, it can also offer opportunities for those who are willing to weather the storm.

**What’s Next?**

But are we actually in an accumulation phase or is the market going to zero? Firstly, it is important to look at the data. Bitcoin or the crypto market has been annually going up every single year ever since it came into existence back in 2009.

Something the regular stock is not able to do. So does it look like the market or Bitcoin is going to zero? No, not really. However, that said, this might be the first time that we see the market close after a year with a mild loss.

This is something Bitcoin or the market have never done before – dropping below all the support lines or predictions of everyone, showing that what investors are dealing with is new.

The blockchain and the crypto market is still quite new despite their age saying otherwise.

So, with everyone’s predictions being wrong, does this make them question if it’s all, indeed, a bubble or rug pull? While a project like a blockchain is not a rug pull, coins on the blockchain market may as well be.

That’s why educating yourself on the matter is so vital to ever make it as an investor. Educating yourself on secure wallets and cryptocurrency is important to make sure your funds remain secure from malicious threat actors. Education is, in fact, something that separates a good user/investor from a great one.

**Should I pour my life savings into crypto now?**

Well, doing things like pouring your life savings into a crypto investment or any investment, for that matter, is not a smart move. Everyone knows that a market or an investment can go up and down regularly depending on the market or assets’ performance.

So, nothing in the finance world is ever certain. Since crypto investments are still unregulated, security risks are quite real. Of course, blockchain technology itself cannot be tampered with yet, but that doesn’t mean that someone can’t hack your e-wallet.

Rather than risking it all, educating yourself about crypto security and investment strategies might be more suited for you if you would ever consider something like using your life savings as investment capital.

It’s one thing to make a bad call and lose your investment but it’s something entirely different to have your investment stolen by hackers and having no authorities to complain to. That’s why every experienced investor protects their investment by using diversification and proper cybersecurity measures in case of crypto investments.

Featured/Top Image Via: Flickr

1.  The Lessons to Learn from Nomad Crypto Hack
2.  The Benefits Of Blockchain In The Travel Industry
3.  The Advantages of a More Secure and Safer Blockchain
4.  How Will Blockchain Technology Revolutionize Logistics?
5.  Naoris Protocol Will Use Blockchain To Plug Web3 Security Gaps

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.