By Waqas
LoanDepot identified the ransomware attack on January 4, 2024
This is a post from HackRead.com Read the original post: LoanDepot Ransomware Attack Leads to Data Breach; 17 Million Impacted

LoanDepot suffered a ransomware attack exposing the sensitive data of nearly 17 million individuals including PII data – Now, the company is offering credit monitoring and working to mitigate potential damage.

A major ransomware attack leading to a massive data breach at LoanDepot, a leading mortgage lender, has exposed the personal information of nearly 17 million individuals. In a **data breach notification** to Maine’s attorney general’s office, the company confirmed that the breach took place on January 3, 2024, and was discovered a day later on January 4.

****The Breach:****

Details surrounding the attack remain limited, but LoanDepot acknowledges unauthorized access to their systems, potentially compromising sensitive customer data. While the specific types of information exposed haven’t been confirmed, the letter sent to the **victims of the data breach** suggests it could include their full name, address, email address, financial account numbers, social security number, phone number, and date of birth.

****Impact on Individuals:****

LoanDepot estimates that approximately 16.9 million (16,924,071) individuals have been affected. This includes current and former customers, as well as individuals who inquired about loan products but ultimately did not pursue them.

The company has begun notifying affected parties through letters and emails, outlining the potential scope of the breach and offering resources to help them protect themselves.

****LoanDepot’s Response:****

LoanDepot took immediate action to contain the attack and secure their systems. They launched an investigation in collaboration with cybersecurity experts and notified law enforcement authorities. Additionally, the company has offered one year of complimentary credit monitoring and identity theft protection services to all impacted individuals.

****Uncertainties and Concerns:****

The full extent of the damage caused by this attack remains unclear. The potential for **identity theft** and financial fraud is a significant concern for millions of individuals.

LoanDepot is urging affected individuals to remain alert and take proactive steps to safeguard their personal information, including being cautious of suspicious emails or phone calls, monitoring credit reports for unauthorized activity, and considering placing a freeze on their credit files.

****Regulatory and Legal Ramifications:****

The LoanDepot data breach is likely to attract scrutiny from regulators and may lead to legal repercussions. The Federal Trade Commission (**FTC**) is responsible for enforcing data privacy regulations, and they may investigate the incident to determine if LoanDepot followed appropriate data security practices. Further, affected individuals may have legal recourse against LoanDepot for failing to protect their personal information.

For insights into the LoanDepot data breach, we reached out to **Javvad Malik**, Lead Security Awareness Advocate at KnowBe4 who stated “This breach at LoanDepot is a reminder of the far-reaching consequences of ransomware attacks and it’s concerning to see the scale and sensitivity of the data involved, particularly the inclusion of Social Security numbers, which opens up Pandora’s box of identity theft and financial fraud possibilities.”

Javvad emphasised the importance of employee training within the organisations especially those responsible for data handling. “This incident highlights the critical need for organizations, especially those handling vast amounts of personal information, to invest in strong cybersecurity measures, including threat detection, response strategies, and most importantly, providing employees with timely and relevant security awareness and training.”

****Ransomware Gangs****

While the LoanDepot data breach was confirmed in January 2024, the specific ransomware group responsible for the attack hasn’t been officially disclosed by the company or law enforcement agencies as of today, February 26, 2024.

Nevertheless, ransomware is one of the most prevalent threats to organizations of all sizes. While the United States has **vowed** to take strict measures against ransomware groups, with LockBit ransomware’s recent **demise** and **resurrection**, it is obvious that these groups are here to stay and plan to cause long-term damage.

****Moving Forward:****

While the immediate aftermath of the LoanDepot data breach is concerning, the company’s commitment to transparency and its efforts to mitigate the damage are positive steps. Individuals must remain informed, take appropriate precautions, and actively monitor their financial information to minimize the potential impact of this incident.

1.  **5 Biggest Ransomware Attacks of All Time**
2.  **Kaspersky Reveals Alarming IoT Threats, Dark Web DDoS Boom**
3.  **Ransomware Attack Disrupts Services in 18 Romanian Hospitals**
4.  **Schneider Electric Energy Giant Confirms Cactus Ransomware Attack**
5.  **Hackers Leak 2.5M Private Plane Owners’ Data in LA Intl. Airport Breach**

LoanDepot Ransomware Attack Leads to Data Breach; 17 Million Impacted

By Waqas
LockBit ransomware gang relaunches operation after law enforcement hacked its servers, threatening to target government entities more now.
This is a post from HackRead.com Read the original post: LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks

Despite arrests, infrastructure seizure and international law enforcement efforts, LockBit ransomware has resurfaced, promising robust security and threatening aggressive cyber attacks on UK and USA government sectors.

The LockBit ransomware gang has officially announced its comeback through a detailed message posted on Saturday on its newly created .onion site on the dark web.

The leader of the **LockBit ransomware**, whose identity is still unknown to authorities, admitted negligence in letting the FBI and the UK’s National Crime Agency control its servers via a PHP attack but promised backups and continued operations.

The new dark web leak site of the ransomware gang is already live and adding new alleged companies as its victims (Screenshot credit: Hackread.com)

The announcement comes only a week after the group was neutralized in **Operation Cronos**, a multinational law enforcement investigation, reportedly neutralized the ransomware gang.

For your information, on 19 February 2024, **as reported by Hackread.com**, law enforcement authorities seized LockBit’s infrastructure, including 34 servers that hosted the gang’s data leak website storing stolen data, cryptocurrency addresses, decryption keys, and the affiliate panel causing a major setback to the notorious gang.

The message from the gang’s admin which directly addressed the FBI and the NCA, revealed that servers without PHP installed in backup blogs are unaffected and will continue to release stolen data from targeted companies, even after the FBI hack, and stolen data will be published on the LockBit blog.

The admin claims that Operation Cronos was successful because of their negligence and irresponsibility in “not updating PHP settings on their servers in good time.” They denied Operation Cronos investigators’ claims regarding arresting their two alleged affiliates, the gang donating to a Crimea-based Russian propagandist (Sevastapol Colonel Cassad), and recovering a high number of decryptors. 

However, LockBit confirmed the FBI’s claim that its annual income exceeds $100m, based on data from seized cryptocurrency wallets during Operation Cronos. The group has deleted chats containing evidence of **ransomware payments**, indicating that their revenues exceed US law enforcement estimates. This demonstrates their success despite making mistakes.

The admin wrote that their victim’s admin chat panels server and blog server were running PHP 8.1.2 and were likely hacked using the **CVE-2023-3824** vulnerability. LockBit ransomware has updated its PHP server and offering rewards for finding vulnerabilities in its latest version. LockBit has moved its data leak site to a new.onion address and has targeted five victims with countdown timers to expose the stolen data.

LockBit’s message to the FBI and the NCA – Open in a new tab for a clear view (Screenshot credit: Hackread.com)

Regarding why the FBI hacked their infrastructure, the gang stated that their ransomware attack on Fulton County in January irked the authorities for posing the risk of leaking information on **Donald Trump** court cases and other “interesting things.”

LockBit claims authorities collected over 1,000 decryption keys during Operation Cronos from “unprotected decryptors,” which they defined as low-level malware builds. LockBit plans to upgrade security, manually release decryptors, host affiliate panels on multiple servers, and provide partners with access to different copies.

****RELATED ARTICLES****

1.  **FIN8 Resurfaces with New Sardonic Backdoor**
2.  **Hive Ransomware Resurfaces as Hunters International**
3.  **FBI Disrupts Chinese State-Backed Volt Typhoon’s KV Botnet**
4.  **Mirai botnet resurfaces with MooBot variant to target D-Link devices**
5.  **Nasty Mamba ransomware that encrypts entire hard drive resurfaces**

LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks

By Deeba Ahmed
META is suspending accounts of users on Facebook and Instagram, potentially linked to malicious Vietnamese activity involving META's Oculus.
This is a post from HackRead.com Read the original post: Linked Oculus Accounts Trigger Facebook and Instagram Suspension

Experiencing a sudden Facebook or Instagram account suspension? You’re not alone. Suspicious activity on Oculus accounts linked to META users is going unaddressed as META opts for suspensions instead of addressing the root cause.

Multiple posts on social media platforms like Reddit suggest a sudden rise in Facebook and Instagram account suspensions, causing frustration among users, mainly because they are clueless about why this is happening.

Many users claim their accounts were suspended without warning or explanation, leaving them unaware of the alleged violation. Users complained about seeing a suspension message from Meta that read:

“Your account was suspended because your linked Meta account doesn’t follow our rules. Log into your linked auth.oculus.com account to appeal our decision.”

Users are confused and frustrated due to Meta’s lack of transparency about suspension reasons and limited appeal options whereas the lack of communication from Meta regarding the suspensions is making it difficult to understand and address the situation.

Reddit user r/facebookdisabledme posted: “Facebook suspended my account without giving any specific reason. Trying to appeal is proving to be extremely difficult.”

Users on Facebook, Instagram, and Reddit are reporting a connection between suspensions and their linked Oculus accounts, indicating a potential security issue within the VR platform. Further probing reveals that Vietnamese hackers could be exploiting vulnerabilities in the Oculus Meta system, which was acquired by Meta in 2014.

“There were 2 logins from Vietnam into my account (I’m from Belgium). Most likely that’s why Facebook suspended the account immediately? But I didn’t get any recovery mail or explanation” user u/Mammoth\_Resolution\_7 shared on Reddit.

One user claimed the hacker linked Meta Horizon account to his Facebook and another reported linking of Meta Oculus. 

According to sources, hackers are creating Oculus Meta accounts and linking them to victims’ social media accounts, registering them as unauthorized access, which is leading to thousands of account suspensions.

For your information, Meta introduced Meta Accounts in 2022 to allow the decoupling of Quest users’ devices from their Facebook profiles. This change was deemed inevitable as it prevented users from losing access to their Oculus Meta account if their Facebook account was banned. However, multiple accounts are still linked, affecting many Facebook or Instagram accounts’ safety.

It is also worth noting that Vietnamese cybercriminals have a history of targeting META and business pages on the platform, with instances of **using DarkGate malware** to steal login credentials.

Nevertheless, META almost member addresses why it suspends user accounts. However, to avoid account suspensions, users should review Meta’s Community Standards, check for official announcements on their website or social media platforms, contact Meta Support through their official channels, and be patient and persistent in navigating the appeal process.

Meta should provide clear communication and address concerns promptly and transparently, as it is crucial for users to understand the specific reason for their account suspension and to be patient and persistent in their efforts to reach out to them.

1.  **Vietnamese Group Hacks and Sells Bedroom Camera Footage**
2.  **Vietnamese man hacked Aussie airport systems; stole security data**
3.  **Fake ChatGPT and AI pages on Facebook are spreading infostealers**
4.  **New Phishing Scam Hooks META Businesses with Trademark Threats**
5.  **Provocative Facebook Ads Leveraged to Deliver NodeStealer Malware**

Linked Oculus Accounts Trigger Facebook and Instagram Suspension

By Deeba Ahmed
Avast Hit with $16.5 Million Fine, Settles with FTC Over Deceptive Data Practices, Forced to Delete User Information
This is a post from HackRead.com Read the original post: Avast Fined Millions for Selling User Browsing Data

Avast, a popular antivirus software, has been fined $16.5 million for selling user browsing data despite claims of protecting privacy. The FTC accused them of misleading users and selling sensitive information without consent. Avast agreed to settle, stop selling data, and delete user information.

The US Federal Trade Commission (FTC) has imposed a $16.5 million fine on Avast Limited, **Avast Software,** and Jumpshot for deceiving users by claiming its software would eliminate web tracking but doing the tracking itself.

It is worth noting that, the Prague, Czech Republic-based anti-malware and cybersecurity vendor stored the data indefinitely and sold it without consumers’ consent or notice while promising users exemplary privacy protection.

This development reflects the continuation of the FTC’s crackdown on companies involved in deceptive data privacy practices. In January 2024, it reached a **settlement** with Outlogic to prevent selling information for tracking user locations and **banned** InMarket from selling precise user locations.

The FTC’s Director of Consumer Protection, Samuel Levine, criticized Avast’s bait-and-switch surveillance tactics for violating consumer privacy.

In its complaint, available **here** (PDF), the FTC revealed that cybersecurity software company Avast collected consumers’ browsing information through its browser extensions and antivirus software, including Avast Extensions, Avast Secure Browser, Avast Mobile Software, and Avast Desktop Software. The FTC accused Avast of selling its data to over 100 third parties via Jumpshot.

For your information, in 2013, Avast acquired competitor Jumpshot, rebranded as an analytics company, and sold browsing information collected from consumers from 2014 to 2020 through it. The FTC accused Jumpshot of offering products that enabled user tracking and associating browsing histories with third-party information.

Jumpshot entered a contract with Omnicom, offering an “All Clicks Feed” for 50% of customers in the US, UK, Mexico, Australia, Canada, and Germany, and earned millions in gross revenues. Avast’s dubious data privacy practices were exposed in 2020 in a joint investigation, leading to the **shutdown of Jumpshot**.

Reportedly, the company collected data on religious beliefs, health concerns, political views, locations, and financial status from 2014 to 2020. The FTC found Avast failed to adequately anonymize browsing information despite the company claiming otherwise.

FTC also discovered that Avast sold data with unique identifiers for each browser, which exposed crucial data like visited websites, timestamps, user location, and the type of device and browser.

Avast agreed to settle the case with the FTC, paying $16.5 million. The order also requires Avast to stop selling or licensing browsing data to advertisers, delete all data obtained by Jumpshot, and notify affected customers of the sale.

How Jumpshot functioned

Avast’s spokesperson, Jeff Monney, reaffirmed the company’s commitment to protecting and empowering users’ digital lives, citing disagreement on the allegations while opting for a settlement.

Data privacy violations can lead to significant financial consequences for companies like Avast, including fines, lawsuits, lost business, reputational damage, and negative press coverage. Regulatory bodies enforce data privacy laws and can sue companies, resulting in further financial losses and legal costs, as evident in Avast’s case.

****RELATED ARTICLES****

1.  **HelloFresh Fined £140,000 for 80 Million Spam Messages**
2.  **Unreleased Music Stolen and Sold on Dark Web: Hacker Fined**
3.  **Google Incognito Mode: New Disclaimer Reveals Data Tracking**
4.  **Meta Fined €265 million in Facebook Data Scraping Case in the EU**
5.  **Sephora Fined $1.2 Million for Breaching CCPA and Selling User Data**
6.  **Apple and Samsung fined millions for slowing down old smartphones**

Avast Fined Millions for Selling User Browsing Data

By Owais Sultan
British Virgin Islands, 26 February 2024 – Friendzone, the sustainable and scalable Web3 platform redefining Social Finance (SocialFi)…
This is a post from HackRead.com Read the original post: Friendzone Launches Social Monetization on Polygon PoS for 5,000+ Waitlisted Users

**_British Virgin Islands, 26 February 2024_** – Friendzone, the sustainable and scalable Web3 platform redefining Social Finance (SocialFi) on the blockchain, has officially launched on the Polygon Proof-of-Stake network. The launch of the Social Capital Marketplace is the first of many key milestones for Friendzone in its mission to become the number #1 social media **dApp** in the Web3 industry. 

Friendzone is an entirely novel decentralized protocol that marries the engagement of traditional social media with the unique financial rewards enabled by **Web3 technology**, paving the way for the creation of more empowering online communities. In this way, Friendzone is much more than just another SocialFi platform.

It represents a paradigm shift that not only recognizes social media presence and influence but rewards it in tangible and monetizable ways. It promises to redefine the social media industry as a place where every interaction can potentially generate value, empowering content creators and users alike to monetize their online experiences seamlessly. 

The launch on Polygon PoS coincides with the closure of a significant funding round led by angel investors including Kain Warwick (Founder of Synthetix), Kieran Warwick (Founder of Illuvium), Danny Wilson (CFO of Illuvium), Thomas Aslanian (Product & Token Lead of Immutable), Anton Buenavista (Founding Team Pendle Finance), Jackson Chan (Co-Founder of PHD Capital) and many other incredible angels with experience at Synthetix, Pendle Finance, Bybit, Metastreet Labs and Renzo Protocol.

Alongside the round, which brings Friendzone’s total amount raised to more than USD 750,000, the startup is pleased to welcome the aforementioned investors, plus TN Lee (Co-Founder of Pendle Finance) and John Park (Partner at Sparklabs) to its growing advisory board. 

Although Friendzone is competing in an increasingly crowded SocialFi space, its platform is differentiated from others through its nuanced incentive and protocol design. Friendzone is uniquely focused on overcoming the scalability and liquidity challenges that have hampered the growth of first-generation SocialFi platforms, setting it up to become the first protocol of its kind to go mainstream. 

Friendzone has designed its protocol economics around an adaptive bonding curve that takes into account market feedback in real-time, ensuring that its token valuation is always fair, with continuous access for both small and large networks. Through this mechanism, it promotes sustained engagement and network growth without being constrained by the accessibility and liquidity bottlenecks that have held back alternative SocialFi protocols. 

With its custom creator controls, Friendzone empowers everyone to be a creator with the ability to customize their social media activity and create tailored offerings ranging from public events to private groups, where they can set terms and prices that better reflect the value they provide.

Besides the purchase and sale of its “Creator Chips”, Friendzone incorporates a staking feature into its tokenomics model that takes into account both the quantity and duration of the user’s stake. It’s inspired by Curve’s veCRV model and aims to ensure a more equitable distribution of each creator’s revenue, incentivizing network users to actively contribute to the success of every creator with a share of their rewards. 

Through these novel innovations, Friendzone promises to transcend the emotional incentives of traditional social media networks by integrating powerful financial incentives enabled only with crypto, amplifying its network effects to enhance user engagement and fairly reward participation on the platform and all integrated decentralized applications existing today. 

****A Progressive Rollout****

Friendzone has generated enormous interest before its launch on Polygon PoS, with more than 5,000 whitelisted users signed up. To ensure stability during its incentivized beta rollout, the protocol is capping the number of users allowed onto the network in batches of 1000. The plan is to progressively onboard more users as the project demonstrates its worth and evolves from its beta stage, where it will be closely monitored for bugs and refined to provide an optimal user experience. 

The initial 1000 users selected to participate in the launch can now head to X, formerly known as Twitter, to claim their Friendzone handles, which will be the same as their X handles.

During the initial launch period, Friendzone will also integrate a new points system into its protocol, enabling early adopters who beta test the product to begin accumulating points to enhance their rewards and reputations on the platform. 

“We are immensely proud to launch Friendzone with the support of the Polygon ecosystem, a collaboration that marks a significant milestone in our journey. The Polygon PoS Network’s exceptional scalability, speed, and security offer the perfect foundation for Friendzone, enabling us to redefine social media engagement and monetization in the Web3 space.

The commitment to innovation and the success of projects built on Polygon PoS is unparalleled. This strategic relationship is a testament to our shared vision of empowering users and creators in a disruptive decentralized digital economy.” said Kevin Lu, CEO & Co-Founder of Friendzone.

Friendzone is delighted to bring its collaboration with the Polygon ecosystem to the next level, tapping into its powerful ecosystem and leveraging its expertise to explore new use cases and accelerate innovation in the SocialFi space. Friendzone is poised to unleash new dynamics and explore uncharted waters on Polygon PoS as it seeks to bring more value to users in the nascent decentralized social media industry. 

The Polygon ecosystem has already distinguished itself in the blockchain arena with its strong ethos of innovation and a litany of unparalleled strategic brand collaborations, making it an ideal landing spot for Friendzone. The protocol’s integration with the Polygon network enables it to make plans toward tapping into an innovative zkEVM-based Layer-2 architecture that will be instrumental in accelerating its growth as it scales its network and expands its user base.

The Polygon networks are home to some of the most dynamic and diverse ecosystems of groundbreaking dApps and communities in the blockchain world, providing further opportunities to collaborate, innovate and bring SocialFi into the mainstream. 

“Friendzone represents the first of its kind in the SocialFi space, pioneering a new era of social media that rewards engagement with real value. We are proud to have Friendzone build on Polygon PoS and to work closely with their team to achieve our mutual goals. Their innovative approach to integrating social interactions with value incentives sets a new standard in the industry. This collaboration underscores Polygon’s dedication to supporting groundbreaking projects that push the boundaries of what’s possible in Web3 and beyond.” said SungMo Park, Head of BD APAC at Polygon Labs.

Today’s launch and funding round represents the first of many milestones to come for Friendzone, laying the groundwork for a truly interoperable protocol that will provide a scalable foundation to support the monetization layer of on-chain social graphs. 

****About Friendzone****

Friendzone is the premier social Web3 platform introducing real-time adaptive pricing and native reward distribution to ensure fair and dynamic value exchange, tailored to a creator’s reputation and community support. The platform is the first to incentivize sustained engagement and offers creators extensive control over content monetization, promoting a robust and inclusive digital circular economy at scale.

Friendzone is supported by a dedicated team of core contributors and advisors from industry-leading entities such as Synthetix, Band Protocol, Koinly, Immutable, Pendle Finance, Cyball, and Sparklabs.

1.  **GAM3S.GG Raises $2M to Grow Web3 Gaming Superapp**
2.  **Particle Network’s Intent-Centric Approach Aims and Secure Web3**
3.  **Web3 Needs A Decentralized Infrastructure That IPFS Cannot Deliver**
4.  **Signal21 Beta Launch Bridges Gap in Blockchain Intelligence Services**
5.  **READYgg Gets Web2 Players into Web3 in Partnership with Aptos Labs**

Friendzone Launches Social Monetization on Polygon PoS for 5,000+ Waitlisted Users

By cyberwire
Brea, California, February 26th, 2024, Cyberwire – The current large surge in cyber threats has left many organizations…
This is a post from HackRead.com Read the original post: ThreatHunter.ai Halts 100s of Attacks: Battling Ransomware & Nation-State Cyber Threats

**Brea, California, February 26th, 2024, Cyberwire** – The current large surge in cyber threats has left many organizations grappling for security so ThreatHunter.ai is taking decisive action. Recognizing the critical juncture at which the digital world stands, ThreatHunter.ai is now offering its cutting-edge cybersecurity services free of charge to all organizations for 30 days, irrespective of their current cybersecurity measures. 

James McMurry, Founder of ThreatHunter.ai, reflects on the situation’s urgency: “In the past 48 hours alone, we have stopped hundreds of actual attacks and performed mitigations for our customers. Yet, the frequency and sophistication of these attacks are escalating at an alarming rate. Our mission is clear: to extend our protective reach to every organization in need, ensuring that the digital frontier is safe for all.”

Drawing on recent events and the resilient nature of cyber threats, as highlighted in an insightful piece on the LockBit ransomware saga, it’s evident that the cybersecurity landscape is more volatile than ever. The LockBit group’s audacity in bouncing back after a significant takedown operation underlines the persistent and evolving threat posed by cybercriminals. 

ThreatHunter.ai, with its elite team of threat hunters, engineers, and cybersecurity experts, employs the ARGOS platform to provide real-time threat detection and mitigation. Our AI and ML-driven technologies have been pivotal in safeguarding organizations from the ever-evolving tactics of cyber adversaries.

“We see the problem getting larger, with cyber threats becoming more sophisticated by the day. Offering our services for free for 30 days is our way of bolstering the defences of organizations across the globe. It’s a call to action for everyone, and to show that ThreatHunter.ai is much more than all the MDRs offering automated alerts, we actually will stop threats, and how our team operates as part of our customers’ cyber team,” McMurry emphasizes.

This initiative is not just about offering a temporary solution; it’s about raising awareness and driving home the point that in the face of rising cyber threats, complacency is not an option.

Organizations interested in taking advantage of ThreatHunter.ai’s complimentary 30-day services are encouraged to reach out immediately. Together, we can turn the tide against the cyber threats that loom large over our connected world.

****About ThreatHunter.ai****

ThreatHunter.ai is at the forefront of cybersecurity, specializing in real-time detection, analysis, and mitigation of cyber threats. Powered by the innovative ARGOS platform, our approach combines advanced AI and ML technologies with the expertise of the industry’s most skilled professionals. We are dedicated to defending the digital infrastructure against the complex landscape of cyber threats, ensuring peace of mind for businesses and governments worldwide.

ThreatHunter.ai, a 100% Service-Disabled Veteran Owned Small Business, is a leading provider of AI-driven threat-hunting solutions. Its advanced machine learning algorithms and expert analysis help organizations detect, identify, and respond to cyber threats. Its solutions are designed to supplement existing security resources and provide a fresh perspective on how to address today’s complex cyber threats.

Don’t miss the opportunity to safeguard your organization with the unparalleled cybersecurity protection offered by ThreatHunter.ai. Visit our website at www.threathunter.ai to explore our unique approach, learn more about our cutting-edge solutions, and discover how we can empower your business to stay ahead of cyber threats.

To speak with our experts or schedule a personalized demo, reach out to our sales team at \[email protected\] or call 714.515.4011. Take action today and ensure the security and resilience of your digital infrastructure.

****Contact****

*   **Lydia Coulter**
*   **Marketing and Media Manager**
*   **ThreatHunter.ai**
*   **7145154011**
*   **\[email protected\]**

ThreatHunter.ai Halts 100s of Attacks: Battling Ransomware & Nation-State Cyber Threats

By Waqas
Friend or Foe?
This is a post from HackRead.com Read the original post: Russian Ministry Software Backdoored with North Korean KONNI Malware

Discover the latest cybersecurity revelation: KONNI malware, linked to North Korean cyber operations, targets the Russian Ministry of Foreign Affairs. Learn about the sophisticated tactics and geopolitical implications

German cybersecurity firm DCSO has discovered a malware sample uploaded to VirusTotal in January 2024, believed to be part of North Korea-linked activity targeting the Russian Ministry of Foreign Affairs (MID). The malware is believed to be **KONNI**, a North Korean nexus tool used since 2014.

KONNI, first **discovered in 2014**, is associated with the Democratic People’s Republic of Korea (DPRK)-nexus actors like Konni Group and TA406. The malware has unique stealer functionality and remote administration capability. It’s installed in an MSI file, with C2 servers encrypted with AES-CTR, and a CustomAction for detection and payload selection.

In the latest discovery, researchers noted that KONNI’s command set remains unchanged, allowing operators to execute commands, upload/download files, specify sleep intervals, communicate via HTTP, and compress file extensions into .CAB archives.

> #ShortAndMalicious  
> Our researchers recently discovered an installer for the mandatory 🇷🇺Russian tax filling software "Spravki BK" (Справки БК) which was backdoored with #KONNI malware, generally attributed to 🇰🇵North Korean threat actors. 1/5
> 
> — DCSO CyTec (@DCSO\_CyTec) October 17, 2023

Interestingly, the sample **DCSO analyzed** was delivered via a backdoored Russian language software installer, similar to a previously observed KONNI delivery technique. The sample was for a tool called “Statistika KZU”, which is believed to be intended for internal use within the Russian MID. The software is used for relaying annual report files from overseas consular posts to the MID’s Consular Department via a secure channel.

Additionally, two user manuals were found in the backdoored installer, detailing the installation and usage of the “Statistika KZU” program. The first manual explains installing the program on an administrative account, providing minimum software requirements and screenshots.

The second 22-pager manual, “StatRKZU\_Pyкoвoдcтвo,” outlines how to use the software for generating annual report files on KZU consular activities, including templates for calculating registered and detained citizens.

The MID’s software, identified as “GosNIIAS” (a Russian federal research institute primarily involved in aerospace research), was tested offline and found legitimate. Despite no direct correlations between GosNIIAS and Statistika KZU, references to contracts were found, including a procurement order for automated system maintenance and data protection software.

This discovery comes amid increasing geopolitical proximity between Russia and the DPRK, following Russia’s renewed invasion of Ukraine in 2022.

****Russia and North Korea’s Cyber Standoff****

This is not the first time Russia and North Korea have made collective headlines over cybersecurity threats. **In August 2023**, the world witnessed another significant incident when “elite North Korean hackers” affiliated with OpenCarrot and the Lazarus group breached NPO Mashinostroyeniya, a key Russian missile developer. This breach, lasting for at least five months, revealed the alarming capabilities and determination of the attackers.

****Previous Use of KONNI Backdoor****

KONNI has been used in many cyberespionage campaigns targeting Russian agencies. FortiGuard Labs discovered a KONNI malware campaign **in November 2023**, targeting Windows systems through Word documents with malicious macros. Malwarebytes researchers **discovered** a campaign in mid-2021 using Russian language lures concerning Russian-Korean trade and economic issues and a meeting of a Russian-Mongolian intergovernmental commission.

An unknown hacking group **targeted** North Korean organizations using KONNI Malware in 2017. Three campaigns were identified back then- two by Talos Intelligence, a Cisco-owned cybersecurity firm, and the third reported by Cylance security firm.

For insights into this, we reached out to John Bambenek, President at Bambenek Consulting, who emphasised that “It is not uncommon for intelligence agencies to spy even on their putative allies, if for nothing else, for insights to either strengthen the relationship or to identify and mitigate threats.”

Mr. Bambenek highlighted that “The use of a backdoor in software used almost exclusively by the Russian Foreign Ministry stands out and shows that the DPRK did their research here for a particular hook into their victims and is, ironically, a more targeted and precise adaptation of the approach Russian intelligence used with **NotPetya**.”

“Espionage has a couple of nuances where sometimes you want more sophisticated tools and for some attacks, you want narrow and simpler tools. For espionage, you want long-term persistent infection and sophisticated and interactive tools provide defenders more opportunities for detection. It’s not uncommon to see tools used for espionage that lack some of the obfuscation commonly observed in **cybercrime tools**,” he added.

****RELATED ARTICLES****

1.  **Gone: Russian Central Bank hacked; $31 million stolen**
2.  **2 Russian Industrial Firms Hacked, 112GB of Data Leaked**
3.  **Anonymous Leaks 128 GB of Data from Russian ISP Convex**
4.  **Elite North Korean Hackers Breach Russian Missile Developer**
5.  **Anonymous Hacks Central Bank of Russia; Leaks 28GB of Data**

Russian Ministry Software Backdoored with North Korean KONNI Malware

By Waqas
The IntelBroker hacker has claimed responsibility for the breach.
This is a post from HackRead.com Read the original post: Hackers Leak 2.5M Private Plane Owners’ Data Linked to LA Intl. Airport Breach

IntelBroker informed Hackread.com that they successfully executed the data breach by exploiting a vulnerability within one of the CRM systems utilized by the Los Angeles International Airport.

The notorious hacker known as IntelBroker is making headlines once again with a daring alleged breach targeting one of the United States’ most critical organizations: the Los Angeles International Airport.

In a bold move, IntelBroker claims to have breached the database of the Los Angeles International Airport, making off with a trove of confidential user data belonging to private plane owners – The breach, according to the hacker, took place in February 2024.

It is important to note that no customer or traveller data is involved in this breach. However, the incident has apparently resulted in the compromise of a significant 2.5 million records, including sensitive information such as:

*   Full names
*   CPA numbers
*   Email addresses (1.9 million emails – total 15,8000 emails after removing duplicates).
*   Company names
*   Plane model numbers
*   Tail numbers (Refers to an identification number painted on an aircraft tail).

Data analysed by Hackread.com

The breach was publicly disclosed by IntelBroker on the notorious hacker and cybercrime platform Breach Forums, adding another high-profile hack to their already extensive. Notable targets of IntelBroker’s previous hacks include the Weee! Grocery platform, General Electric, Staffing Giant Robert Half, and a recent data leak involving a partial Facebook Marketplace database.

Upon learning of the breach, Hackread.com promptly reached out to IntelBroker, who confirmed their involvement and provided limited insight into their methods. According to IntelBroker, they exploited a vulnerability in the airport’s Customer Relationship Management (CRM) system (CRM system) to gain unauthorized access to the database, highlighting the critical need for organizations to strengthen their cybersecurity measures in the face of growing threats from skilled hackers like IntelBroker.

The screenshot below, obtained from Breach Forums, displays the listing of the data breach. It is important to highlight that the breach details attribute the hack to a user named “kwillsy.” However, in a statement to Hackread.com, IntelBroker clarified that “kwillsy” is not associated with the breach, and they take full responsibility for the hack.

Screenshot credit: Hackread.com

Hackread.com has contacted the relevant authorities at the LA Airport, and this article will be updated accordingly pending their response.

****Increasing Data Breaches****

During the initial months of 2024, there has been a marked surge in data breaches impacting various sectors, encompassing both corporate entities and governmental bodies. Last week, Infosys disclosed a breach that affected more than 57,000 Bank of America customers.

In earlier weeks of the same month, two prominent US insurance firms, Washington National Insurance Company and Bankers Life and Casualty Company, reported breaches linked to SIM-swapping incidents, impacting over 66,000 customers collectively.

In January, Jason’s Deli encountered a significant breach, exposing the personal details of over 344,000 users due to a successful credential-stuffing attack. Concurrently, hackers targeted Indian ISP Hathway, compromising the personal information and KYC records of over 4 million unsuspecting customers.

****RELATED ARTICLES****

1.  **23andMe blames its users for the massive data breach**
2.  **AnyDesk Urges Password Change Amid Security Breach**
3.  **Defunct Ambulance Service Data Breach Impacts 1 Million**
4.  **Los Angeles Traffic Sign hacked with an awesome message**
5.  **Cloudflare Hacked After State Actor Leverages Okta Breach**
6.  **RingGo Owner EasyPark Hit by Data Breach, User Data Stolen**

Hackers Leak 2.5M Private Plane Owners’ Data Linked to LA Intl. Airport Breach

By Uzair Amir
The world of cryptocurrency is unpredictable yet lucrative. Understanding the workings and creation of crypto is a topic…
This is a post from HackRead.com Read the original post: The Future of MATIC and What to Expect in 2024

The world of cryptocurrency is unpredictable yet lucrative. Understanding the workings and creation of crypto is a topic for another day, as it involves technical processes such as mining, which utilizes specialized hardware and software to add transactions to the Blockchain.

Bullrun, which took place in 2021, was a bit tricky for many traders out there. Some coins went up in price. Some cryptos fell. The value for MATIC decreased by approximately 11% in 2022. However, it went up by around 6% in 2023.

What will happen next with this coin? Will it keep increasing its price? Is it the right time to exchange MATIC for ATOM? Or will it eventually go down again in its value? Well, the honest answer to these questions is that nobody knows for sure.

However, in this article, we will dig deeper into predictions regarding the value of MATIC for the next 5 and 10 years. Are you ready to explore these intriguing insights? Let’s dive in.

Here, it is important to explain that MATIC, often referred to as Polygon, is a Layer 2 scaling solution built on top of the Ethereum blockchain. Its primary purpose is to address the scalability issues that Ethereum currently faces, such as high transaction fees and slow processing times.

****How Much Will Polygon Cost in 2024?** **

Experts from Changelly.com assume that the Polygon value will grow in 2024. Some analysts say that the minimum price for MATIC in 2024 will be 1.16 USD per 1 coin. At the same time, the prediction of the maximum value reveals that MATIC could cost 1.32 USD per coin. 

In January 2024, it can go up a little bit. Its value is likely to be 0.867 USD. Polygon is still expected to grow slowly in February, March, and April. Most probably, it’ll cost 1.03 USD in May. In September, it’ll be available for 1.20 USD. Finally, at the end of the year, Polygon will reach the point of 1.32 USD per 1 coin.   

****What Will Happen in 2028?** **

Different experts share different opinions regarding this. Let’s check them one by one. 

*   According to Coinpedia, the highest possible value of Polygon will be 6.504 per coin. At the same time, crypto pros from this site share their opinion on the lowest possible cost of MATIC in 2028. They believe it is going to be 5.666 USD.
*   What about the prediction made by AMBCrypto? These guys think the cost of this crypto will be somewhere between $5.10 and $5.45 per 1 coin in 2028. These will be the minimum and the maximum prices accordingly. 
*   Cryptonewsz has a different estimation. They believe the value of MATIC will be somewhere around $4.93. They assume that it will be able to go up to $6.23 in the best-case scenario. Its average price is going to be $5.07. 
*   The next comes the prediction from Changelly. They state people will trade Polygon for approximately $5.07 per 1 coin in 2028. In their opinion, $6.23 per 1 coin will be the highest amount of money people want to pay for Polygon. On the other hand, $4.93 will be the lowest possible price. 
*   Finally, Gov Capital has no rough numbers to share regarding the MATIC value prediction in 2028. However, they believe MATIC could be worth $1.237 in 5 years.

Thus, as you can see, most predictions tell us that the average MATIC cost in 2028 will be either $5 or $5.66. With such uncertainty, many traders will want to stick to stablecoins and exchange BTC for USDT. 

****What Will be the Price for MATIC in 2033?** **

 Let’s wrap this up with the prediction for 2033. What is going to happen to Polygon in 2033? That’s an intriguing question to explore. In fact, during our research, we’ve discovered that not so many sites are willing to make such long-term predictions. 

Coindataflow is the only site that has made such estimates for 2033. They believe that the price of Poygon will grow by a staggering 2311.21% in the best-case scenario! Thus, it will be worth $12.55 in 2023. 

****Final Words****

In this short blog, we’ve covered all the major predictions for Polygon prices for the next year. We’ve also explored estimates of how much it could cost in 2028 and 2033. Hopefully, now you are well-versed in this regard. However, we always underline the importance of doing your own research. It’s also good to be very cautious when it comes to finances.

_**Disclaimer:** This article is for informational purposes only and should not be considered financial advice. Please consult with a qualified financial professional before making any investment decisions._

****RELATED ARTICLES****

1.  **The Rise of Blockchain Gaming and Secure Marketplaces**
2.  **Investing in Ethereum Blockchain-based JasmyCoin: Guide**
3.  **Signal21 Beta Bridges Gap in Blockchain Intelligence Services**

The Future of MATIC and What to Expect in 2024

By Uzair Amir
Signal21, Inc., a blockchain intelligence and data analysis platform, has announced its beta launch marking a significant milestone…
This is a post from HackRead.com Read the original post: Signal21 Beta Launch Bridges Gap in Blockchain Intelligence Services

Signal21, Inc., a blockchain intelligence and data analysis platform, has announced its beta launch marking a significant milestone within the domain of blockchain technology. Signal21 is known for providing blockchain data and intelligence services to businesses and individuals. The company offers a variety of features, including the following:

*   **Market data:** Track cryptocurrency prices, volumes, and market trends.
*   **On-chain analytics:** Analyze on-chain data to identify investment opportunities and track market activity.
*   **Compliance tools:** Help businesses comply with anti-money laundering (AML) and know-your-customer (KYC) regulations.
*   **Research reports:** Get insights from industry experts on the latest trends in the blockchain space.

****Signal21 and Bitcoin Economy****

The Bitcoin ecosystem has witnessed an unprecedented surge in activity following the Ordinals phenomenon, emphasizing the critical need for reliable on-chain data across various Bitcoin layers and projects.

In response to this demand, Signal21 claims to have emerged as a solution, offering a centralized hub for Bitcoin research and data aggregation. Signal21 aims to bridge the gap by providing comprehensive information on Bitcoin L1, Bitcoin L2s, and Bitcoin Dapps, catering to the evolving needs of the growing Bitcoin community.

Furthermore, the recent success of the Bitcoin ETF has propelled institutional investors into the Bitcoin space, with many acquiring substantial amounts of Bitcoin. In light of this development, Signal21 positions itself as a guiding beacon for institutional investors, offering assistance in navigating the complexities of the Bitcoin domain.

By leveraging its powerful insights and sophisticated tools, Signal21 aims to empower institutional investors to explore various avenues for utilization and yield generation on their Bitcoin investments. As the Bitcoin market continues to evolve, Signal21 stands ready to support individual and institutional players in maximizing their potential within this dynamic ecosystem.

In a blog post published February 23, 2024, Jonathan Sadlowe Co-founder & CEO at Signal21 stated that “Signal21 brings on-chain data across the layers of the Bitcoin Economy into one place, and empowers two distinct customer segments: Bitcoin investors and Bitcoin builders.”

****Blockchain and Signal21****

Blockchain technology offers transparency and immutability, meaning data is readily available for all participants and cannot be tampered with. However, raw data on the blockchain can be vast and complex, making it difficult to understand and derive meaningful insights. This is where companies like Signal21 enter to provide essential insights and tools for navigating the decentralized space.

As blockchain networks grow, comprehensive data analytics becomes increasingly crucial. These platforms offer real-time information about transactions, network activity, and smart contract interactions, enabling informed decision-making and risk management.

Moreover, they support research and development efforts by supplying valuable data for analyzing trends, identifying opportunities, and optimizing blockchain protocols. Overall, a robust blockchain data and intelligence platform enhances transparency, efficiency, and innovation within the blockchain domain.

Source

HackRead