By Waqas
Chinese scammers have been creating cloned versions of legitimate websites, redirecting visitors to gambling sites.
This is a post from HackRead.com Read the original post: Chinese Scammers Exploit Cloned Websites in Vast Gambling Network

The large-scale scam campaign has been ongoing for at least two years, and the cloned websites are still operational.

Online gambling is a booming industry, and the Asia-Pacific region has become the hub of gambling in the world, with China and India leading the way. However, this unexpected rise has led to a sharp incline in illegal activities such as money laundering, online scams, and fraud.

In October 2023, Hackread reported a scam campaign discovered by CloudSEK involving Chinese scammers targeting the Indian digital payment system using illegal instant loan apps. Now, an even bigger scam has come to the fore.

According to Qurium Media, a Swedish nonprofit provider of digital security solutions, Chinese scammers have been creating cloned versions of legitimate websites, redirecting visitors to gambling sites.

It all began when MindaNews discovered a Chinese clone of their website and promptly notified Qurium. For context, MindaNews is a Philippine newspaper headquartered in Davao City and serves as the news outlet for the Mindanao Institute of Journalism.

MindaNews’ clone (mmart-inn.com) was registered in China. It had been replicating the newspaper’s content (news, photos, opinion pieces) illegally after translating it into Chinese for the past two years, the most recent translation being of content from February 2023.

Original MindaNews website (left) – Fake MindaNews website (right) – (Credit: Qurium)

“Some MindaNews authors were retained in their English names, while others were translated into Chinese. However, in general, the content is the same when translated to English,” explained MindaNews in its blog post.

The company dug deeper and found more than 500 cloned websites, many of which were of academic institutions, and all were promoting gambling services based in China. 

It is important to note that in August 2023, the Chinese APT group Bronze Starlight was reported to be using stolen Ivacy VPN certificates to sign malware targeting the Southeast Asian gambling sector. However, as of now, it remains unclear if that attack campaign was related to the ongoing website cloning attack.

The cloned websites were hosted on two /24 networks operated by the US-based, Eonix Corporation-owned ServerHub and included websites from public libraries, universities, and private businesses.

All the clones were created in September 2021 and promoted a gambling platform called ‘188bet’ (520xingyun.com/from/188bet.php) through advertisements.

These ads contained a physical address in the Isle of Man, where many other gambling firms (including Kaiyun, BetVictor, Raybet, or Manbetx) were already registered. A website 520xingyun{.}com was hosting a large number of such ads.

Moreover, all the companies were registered in July 2021 through the domain registrar Gname.com Pte. LTD, employing a white-label partnership with TGP Europe and Cube Limited. Both Cube Limited and 188bet have affiliations with the Isle of Man.

These companies served as intermediaries from Asian gaming partners. Further probing revealed that TGP Europe was based in the UK and was found guilty of social responsibility failures and anti-money laundering.

Campaign overview (Credit: Qurium)

According to Qurium’s report, Gname was involved in different WIPO cases of domains used for ads. It is worth noting that 188bet has officers in Makati, Philippines, which is a standard practice. 

> _“These Chinese gambling companies are often headquartered in nearby nations like Vietnam and the Philippines due to the fact that gambling is banned in China.”_
> 
> Qurium

So far, ServerHub has not taken any action against the client for cloning hundreds of websites, as it is still investigating the claims. As the report develops, Hackread.com will monitor the situation and provide updates to readers accordingly.

****_RELATED ARTICLES_****

1.  **Domain Squatting and Brand Hijacking: A Silent Threat**
2.  **Chinese APT Posing as Cloud Services to Spy on Cambodia**
3.  **Chinese APT spying on Vietnam military with FoundCore RAT**
4.  **Hackers attack Casino’s fish tank thermometer to obtain data**
5.  **ChatGPT Clone Apps Collecting Personal Data on iOS, Play Store**

Chinese Scammers Exploit Cloned Websites in Vast Gambling Network

By Waqas
Domain squatting can lead you to malicious websites, and it might be too late to realize what actually happened.
This is a post from HackRead.com Read the original post: Domain Squatting and Brand Hijacking: A Silent Threat to Digital Enterprises

While domain squatting opens the door to brand hijacking, it also exposes unsuspecting users and businesses to critical cybersecurity threats including phishing and malware attacks.

Domain squatting, often known as cybersquatting, involves the registration or use of a domain name to profit from a trademark belonging to someone else. For instance, a squatter might register a misspelt version of a well-known brand’s URL to misdirect their traffic – For instance, It is Google.com, not ɢoogle.com.

Similarly, brand hijacking is a form of online piracy in which an entity masquerades as a reputable brand to deceive its audience, damaging brand credibility and customer trust. According to Mimecast’s 2022 report on email security, 46% of the businesses it surveyed reported a rise in online brand spoofing and impersonation, with an average of ten incidents in 2021.

In this article, we’ll dissect these digital threats and explore strategies businesses can adopt to combat domain squatting and brand hijacking, safeguarding their online reputation.

**Understanding Domain Squatting and Brand Hijacking**

Domain squatting entails registering or buying domain names that are strikingly similar to a popular brand, intending to profit from their trademark. The squatter can create a website that visually mimics the legitimate brand’s site or can simply sit on the domain, hoping to sell it back to the rightful owner for a hefty price.

On the other hand, brand hijacking is a more deceptive practice. It involves the impersonation of a legitimate brand online to dupe users into believing they are interacting with a genuine brand. This could include creating cloned websites, leveraging phishing emails, or even exploiting social media.

Interestingly, these two practices often intersect. A domain squatter might employ brand hijacking by creating a spoofed website on the squatted domain. This synergistic exploitation escalates the damage, with the potential to tarnish the brand’s image, manipulate its customers, and eventually damage its revenue.

****The Impact of Domain Squatting and Brand Hijacking on Businesses****

The repercussions of domain squatting and brand hijacking are far-reaching and deeply damaging for businesses. Domain squatting diverts potential customers to counterfeit sites, causing a significant loss of business.

Moreover, it can inflict severe damage to a brand’s reputation as customers often struggle to differentiate between the authentic website and the squatted domain. Companies are forced to spend extensively on damage control and may also experience a drop in their SEO ranking due to the diluted web traffic.

Brand hijacking is an even greater threat, causing not only an immediate loss of customer trust but also a significant revenue dip. The legal costs associated with fighting these digital imposters can be hefty. Additionally, such attacks may lead to data theft and security breaches, increasing the potential financial burden.

These fraudulent practices can cause severe brand dilution, leading to loss of trust, which is critical for brand loyalty and growth. As Amber Johanson, Mimecast’s SVP of Global Sales Engineering, stated in an interview, “While it can take years to build strong levels of trust among your customer base, that connection can be destroyed in a matter of seconds by a single spoofed email.”

****Fighting Against Domain Squatting and Brand Hijacking****

Here are some strategies and preventive measures that businesses can rely on to prevent or limit the damage caused by these attacks:

Domain Authority, or DA, is a predictive measure by Moz that suggests a website’s likelihood of ranking on search engine results pages (SERPs). It takes into account several factors such as website age, and the quality and quantity of inbound and outbound links.

On the other hand, a backlink profile is a comprehensive catalogue of all the sites that direct web traffic back to your website, essentially serving as an indicator of your website’s credibility and influence.

Keeping an eye on these key factors is crucial, as any unanticipated shifts in DA or an upsurge of low-quality or unrelated backlinks could be warning signs of an imminent brand hijacking.

Moz, a well-known SEO tool, provides in-depth tools that enable businesses to scrutinize these vital metrics meticulously. By offering features such as DA measurement and comprehensive backlink analysis, Moz equips businesses with the necessary insights to constantly monitor the well-being of their websites.

Source: Moz

This enables quick identification and rectification of any aberrations brought on by possible hijacking or squatting attempts, thereby preserving the integrity of the brand’s online presence.

****2\. Getting Digitally Certified****

Digital certification or authentication is the process of validating the legitimacy of your brand’s online assets. In an era where mimicry is increasingly rampant, having verified digital credentials can help distinguish your brand from counterfeit replicas, instilling a sense of trust among your customers.

In the context of domain squatting and brand hijacking, getting digitally certified can serve as a proactive security measure. It equips your brand with an authenticated digital identity, which is not only difficult for hijackers to replicate but also easy for your customers to recognize.

Memcyco, a real-time website impersonation platform, offers brand protection solutions for businesses to protect themselves from impersonation attacks. Their suite of offerings includes real-time monitoring and alerting against website impersonation attempts, and warnings for customers when they unknowingly access fraudulent versions of a brand’s website.

Source: Memcyco

When it comes to digital authentication, Memcyco provides a digital watermark that reassures visitors of the site’s genuineness, fostering trust and safety. 

By investing in such preventive measures, your brand can keep a step ahead of fraudsters, fortifying its digital presence against the threats of hijacking and squatting.

****3\. Brand Monitoring****

Brand monitoring, in essence, is the continuous surveillance of your brand’s online presence to identify and respond to unauthorized brand mentions, feedback, and possible threats. This involves tracking social media interactions, online reviews, blog posts, and various other digital touchpoints to gain insights into your brand’s image.

This process helps you promptly identify unauthorized uses of your brand name or logo, counterfeit websites, or illegitimate advertisements. Doing so, enables you to respond swiftly and potentially prevent these impersonation attempts from causing significant damage to your reputation or customer trust.

****4\. Educating Your Audience****

In the battle against domain squatting and brand hijacking, consumer education can be your most potent weapon. By educating your customers to distinguish between, or to even be aware of, your authentic digital assets and fraudulent replicas, you can significantly reduce the efficacy of such cyber attacks.

Document360, a knowledge base management software, allows you to create and manage a custom knowledge base where you can share essential information about your brand and provide educational content on how to identify and report potential fraud attempts.

Source: Document360

It supports a variety of formats, including FAQs, tutorials, and guides, providing an interactive platform for your audience to learn and stay updated. This proactive step can significantly help in maintaining your brand’s integrity and customer trust.

**5\. Developing a Robust PR Strategy**

The significance of a well-planned public relations (PR) strategy can’t be understated when it comes to fortifying your brand identity and fostering trust among your audience. It allows you to maintain a consistent brand narrative and showcase your brand’s values, which in turn builds credibility and rapport with your audience. 

An effective PR strategy consistently communicates your brand’s true message and spreads awareness about the precautions taken to safeguard customer information, keeping your audience informed and alert. This can substantially reduce the chances of them falling prey to fraudulent attempts that impersonate your brand.

****6\. Taking Legal Actions****

Understanding and staying up-to-date with applicable laws is an effective strategy to combat domain squatting and brand hijacking. One such key legislation is the U.S. Anticybersquatting Consumer Protection Act (ACPA) from 1999. This law grants rights to trademark owners, enabling them to bring a lawsuit in federal court against parties who maliciously register or use a domain name mirroring their brand.

Essentially, ACPA addresses those bad actors who exploit trademarks with a calculated intention to profit through registering, using, or trading domain names that could be mistaken for established or well-known brands.

****Wrapping up****

The menace of domain squatting and brand hijacking significantly undermines the stability of businesses by attacking their brand reputation and customer confidence. The first line of defence lies in comprehending the intricacies of these unscrupulous practices and their subsequent effects.

By integrating the above-mentioned measures into your cybersecurity strategy, you can secure your digital assets and decisively counter the stealthy peril of domain squatting and brand hijacking.

Domain Squatting and Brand Hijacking: A Silent Threat to Digital Enterprises

By Waqas
Casio's data breach exposed a well-known secret: no one is immune to cyberattacks - It also exposes the highly vulnerable state of databases.
This is a post from HackRead.com Read the original post: Lesson from Casio’s Data Breach: Why Database Security Still a Major Challenge for Businesses?

Database security is difficult because of the large volume of attacks, zero-day exploits, human errors, and the need for continual management of security tools.

On October 12, Japanese electronics maker Casio was the victim of a data breach. A bad actor obtained files containing sensitive information from 91,921 customers in Japan and 35,049 users from 148 other countries from which the company operates. 

The compromised database belonged to a company’s educational platform known as ClassPad. Therefore, those affected were both individuals and educational institutions.

Some of the files that hackers stole amid the breach contained sensitive information such as names, email addresses, payment methods, purchase information, and regions of residence.

Cybercriminals were able to breach the company due to the weakness in its database, later discovered within the development environment.

The company is currently investigating the attack, strengthening the security of its databases, and dealing with the aftermath of the breach.

For Casio, this marks the second major data breach of this year. In August 2023, the hacker dubbed Thrax stole and leaked 1.2 million pieces of customer data. Casio’s data breach is one of many that happened this year.

The truth is, any company can be the victim of a data breach — regardless of its IT resources, size, or whether it already has been the victim of an attack. Nothing makes a business 100% immune to potential data compromise.

Aware of the possible reputational and financial consequences of a data breach, businesses already invest a lot in security to protect one of their most important assets — data. However, the number of compromised databases remains high. Why is database security still a major struggle for companies nowadays?

****Human Errors at the Heart of Most Attacks****

To compromise the database as it happened to Casio, the hacker needs to gain initial access. In their case, the mistake happened due to operational errors within the development environment.

That oversight allowed hackers to get into the database of the educational platform. 

For most companies, the culprit of a data breach is a human mistake. It’s estimated that 95% of data breaches can be attributed to it. That is, nine out of ten data breaches happen because of human error. 

Some common ways database breaches result from human errors are:

*   Poor password practices — weak and reused credentials or password sharing
*   Deleting or corrupting the records — by accident
*   Falling for phishing schemes — clicking on the link or sending credentials to the threat actor

General workforce and phishing schemes are usually highlighted when the topic of human errors and data breaches is discussed. However, anyone can make a mistake, from developers and security experts to those working in finance or marketing.

****Large Volumes of Cyber Attacks that Compromise Data****

Over the last couple of years, businesses have been up against more data breach attempts than ever before. As mentioned, Casio had been the victim of two major data breaches within the last couple of months alone.

With a larger volume of cyberattacks that attempt to compromise data, there is a higher chance that a human mistake will result in stolen data. And that vulnerability that hasn’t yet been discovered by the company will be exploited in the attack.

We’ve already read about a lot of data breaches in the news. But keep in mind that these are only the highlights.  Many hacking incidents and data compromises go unreported.

Not every company in every sector and every country has to disclose a breach. It depends on its severity and whether they have to notify the users that their personal data has been exposed in the breach.

Since not all companies disclose a breach, their users can be at greater risk of being a victim of further data theft, phishing attempts, and even identity fraud.

****Data Protection Seeks Continual Management****

As with any other cybersecurity system, database security processes and tools have to be continually managed and improved. This is another major factor that makes data security challenging for companies — where should they even start?

For example, this could mean a company has to continually update access to protect the databases of a business. 

Suppose an employee changes their role within the company or is no longer a part of the team. Their user access has to be revoked or changed to fit the new role as soon as possible.

Then, there are flaws within the software environment. Companies need to patch them up regularly to prevent databases from being accidentally exposed in an attack.

In Casio’s case, the network security settings within the development area have been disabled. This weakness, discovered too late, opened the doors to hackers.

****Shortage of IT Professionals****

Another factor that makes database security challenging is the lack of professionals within IT and cybersecurity who specialize in data security and cybersecurity. They regularly manage the security and keep the hacker far away from the databases.

Companies that have fewer professionals are at a heightened risk of errors because those who do stay in the company have to take up large workloads. There is also more pressure and stress within understaffed and overworked IT departments.

True, in this year, there has been a surge of layoffs within the tech industry. However, IT workers also leave their jobs due to stressful environments, insufficient compensation, and lack of opportunities to grow and develop within their roles.

****Database Security Is a Work in Progress****

One vulnerability within the database is enough for the hacker to compromise the data of hundreds or even billions of sensitive user records.

The severity of financial as well as reputational damage depends on the flaw that a hacker could have exploited and how skilled is the threat actor.

While there is no one ultimate solution for reducing the chance of a data breach to zero, what most companies can do is prioritize the protection of sensitive databases.

Also, they should continually strengthen database security — and seek vulnerabilities that could lead to data breaches, such as those that affected Casio this year.

1.  **Casio China Hacked, 150,000 user accounts leaked**
2.  **Casio Electronics Taiwan Website Hacked by SaMuRai Hacker**
3.  **Human Error: Casio ClassPad Data Breach Impacting 148 Countries**
4.  **Sony Data Breach via MOVEit Vulnerability Affects Thousands in US**
5.  **Okta Breach Linked to Employee’s Google Account, Affects 134 Customers**

Lesson from Casio’s Data Breach: Why Database Security Still a Major Challenge for Businesses?

By Waqas
Plume has not confirmed the data breach but has acknowledged that the company is aware of the claims made by hackers.
This is a post from HackRead.com Read the original post: Hackers Claim Major Data Breach at Smart WiFi Provider Plume

An X (Twitter) account, operated by hackers using the handle @MonkeyInject, alleges that the breach was facilitated by a former employee of Plume.

The smart Wi-Fi service provider, Plume, has apparently fallen victim to a data breach. The perpetrators, claiming responsibility for the incident, made their announcement on the notorious Breach Forums.

This is the same forum where, in the past few days, we observed the data leak of a scraped LinkedIn user database comprising 35 million entries and two scraped databases from Chess.com.

The Palo Alto, California-based Plume is a SaaS (software-as-a-company) platform offering users AI security, smart Wi-Fi, and cloud management services, and has footprints in over 45 countries, covering 55 million homes and small businesses.

The attackers are currently claiming to have stolen over 20GB of the company’s Wi-Fi database with over 15 million lines of information. Plume, however, has not confirmed the news, stating that it is aware of the attackers’ claims and has launched an investigation to verify these claims.

What the hackers are claiming (Screenshot: Hackread.com)

At the same time, dissatisfied with Plume’s response, the hackers have released two CSV files, each containing purported data of the company’s customers and employees. As reported by Hackread.com, the first file includes email addresses, full names, countries, device details, and other information related to the alleged 26,000 customers of the company.

The second file comprises 3,086 email addresses and full names, which the hackers claim belong to Plume’s employees. A majority of the leaked email addresses are associated with the @plume.com and @plumewifi.com domains.

The alleged Plume data as seen by Hackread.com

Darren James – Senior Product Manager, Specops Software – An Outpost24 Company commented on the alleged breach adding, “Any data breach that involves the loss of personal information is always a huge concern, not just for the affected organisation, but specifically for people whose data has been stolen.”

“Although we don’t have many details on this particular breach right now, even the loss of a username or email address can open an attack vector on any site where you have also used those same details,” James emphasised.

“My advice for anyone affected by such breaches, it is imperative that they change their passwords across all platforms that use the same username as soon as possible, ideally using a password that hasn’t already been breached,” he said.

****Hackers on X (Twitter)****

The hackers have also created an X (Twitter) profile to disclose details of the attack and stolen data on their handle @MonkeyInject, which is an interesting step as hackers usually hide their identities and operate covertly. Addressing the X community, the hackers wrote that:

“We hope this message finds you well. We regret to inform you that there has been a security breach at @plume, affecting approximately 8.5 million users, all staff, application tokens, and off-site locations, particularly in Metro Manila.”

In subsequent tweets, they noted that the leak includes email addresses, first and last names, device details, IP addresses, user IDs, city, cards, carriers, and other data. The hacker provided a preview of the information on their Twitter page to legitimize their claims.

MonkeyInject also revealed that the breach was facilitated by a former employee of Plume, who left the company in 2023 but still possessed access rights, indicating Plume’s lackluster approach toward implementing robust security protocols.

The hacker on X (Screenshot: Hackread.com)

The hackers gave the company 48 hours to comply with their demands otherwise, they would disclose more data. They also encouraged Plume to improve its access control policies to prevent similar incidents.

“This lapse in access management is a critical flaw that requires immediate attention. To safeguard the integrity of the affected data and protect the privacy of our users, we kindly request @plume’s prompt compliance with our demands within the next 48 hours. Failure to do so may result in the disclosure and sharing of additional sensitive information,” the hackers tweeted.

****Stay Tuned for Updates!****

Nevertheless, Hackread.com is closely monitoring the situation, and this article will be updated accordingly, taking into account any responses from Plume and in the event that the hackers decide to leak the entire trove of data.

****_RELATED ARTICLES_****

1.  **IBM Notifies Janssen CarePath Customers of Data Breach**
2.  **Human Error: Casio ClassPad Data Breach Impacting 148 Countries**
3.  **Sony Data Breach via MOVEit Vulnerability Affects Thousands in US**

Hackers Claim Major Data Breach at Smart WiFi Provider Plume

By Owais Sultan
As of 2023, there are over 1.7 million websites using Drupal, underscoring the significance of acquiring Drupal tips…
This is a post from HackRead.com Read the original post: How To Make Drupal Migration Successful: 6 Useful Tips

As of 2023, there are over 1.7 million websites using Drupal, underscoring the significance of acquiring Drupal tips and tricks. The migration process can be crucial and challenging for newcomers.

Drupal is one of the most popular solutions for creating and personalizing websites. Today, this system is used by various businesses from different industries, from small start-ups to world-famous large enterprises. Thus, more than 1 million websites around the world are powered by Drupal.

At the same time, technology does not stand still. This means that if a business is interested in its stable development and sustainability, it is imperative to keep up with the times. Drupal, as technology, is constantly improving, providing developers with more tools to implement ideas and companies the opportunity to expand the quality of their service and customer satisfaction using a website.

This is how we come to Drupal migration. The main reason why Drupal migration is an important step is that you can ensure the longest life expectancy of your site, as well as make it more functional with this approach.

In addition, security is among the top priorities for online businesses. Therefore, ignoring system updates means that your website may not receive critical security updates.

Although migrating to newer versions of Drupal often occurs without problems or particular difficulties, it is still a process worth paying attention to and planning. Migrating to another version of Drupal is not only about launching an update but also the APIs, modules, and other core elements that your website includes.

In other words, ensuring that your website does not lose its functionality due to migration and continues to work correctly is essential. Let’s take a look at tips that may help you plan your migration to a new version of Drupal.

**Tips For Drupal Migration **

Businesses are encouraged to consider upgrading to the latest version of Drupal for several reasons, the main ones being additional features, improved security, and higher website performance.

Sometimes migration can be challenging, but if you plan the process well, migrating to a new version of Drupal can be done efficiently and with no problems in most cases.

Here are some tips on how to make migration to the latest version of the system convenient and smooth:

**Plan Your Migration **

The first and most important step is planning. It is essential to have a clear migration strategy before starting the process.

To do this, you need to conduct a thorough analysis to determine the scope of migration and understand how best to complete it. Factors to consider when drawing up a plan include:

*   workload assessment
*   setting migration deadlines
*   defining migration stages
*   website functionality assessment
*   possible impact of migration on the website

It is critical to clearly understand the specifics of how your website functions and to have a migration implementation plan. The more detailed and thoughtful your plan is, the better, as this will avoid unforeseen problems and delays in the process, thereby ensuring a successful and smooth transition of the website to the new version of Drupal.

**Make A Backup**

Before making any changes, you should always make a backup first. This is a necessary step that should not be ignored because something may always go wrong in the process, so it is essential that you have an “extra life” and can get back to where you started. Therefore, make sure you have copies of all website files and data before the migration process.

In addition, keep a backup copy of the website and its elements in a safe place, which you can also easily access if necessary. Only after you have made a backup can you make changes and experiment with the features of Drupal and your website.

**Assess The Existing Modules**

Conceptually, Drupal is a system that relies heavily on modules and themes. Due to this approach, Drupal expands the functionality of the system and provides new features.

However, this feature of the system may lead to the fact that some of the modules or themes you use on your website may be incompatible with the new version of Drupal. This is why it is essential to assess existing modules and themes before starting the migration process. This will give you time to replace some models or find other alternatives.

**Drupal Core Update**

This is the essential step in the migration process. For the migration to be successful and smooth, it is critical to update the system core first.

Therefore, before starting the process, use a tool like the Drupal Upgrade Status module. Its job is to identify issues and dependencies that may affect or hinder the migration of your website to a new version of Drupal.

Thus, update the core first and only then proceed with the system’s changes.

**Test The Website**

After updating your website, be sure to fully test the website for errors and evaluate its performance.

Factors to consider first include:

*   Website features and elements
*   Content and its display on the website
*   Website forms, modules, and themes
*   Third-party integrations and APIs
*   User accounts and data

To test a website, you can use the Drupal Functional Testing module. This tool automates the testing process and can quickly find and report errors.

**Train The Team **

Migrating to a new version of Drupal means that some of the features and modules may work differently. Therefore, be sure to train your team and explain to them the new features and capabilities of the system that they can use from this moment.

This step should not be ignored, as understanding how the new version of Drupal works will allow your team to use the system effectively and avoid mistakes.

Learn more about migration processes and Drupal views data export at ElevatedThird.

****_RELATED ARTICLES_****

1.  **5 WordPress Security Solutions with Free SSL Certificates**
2.  **Critical Vulnerability in Drupal CMS Used for Cryptomining**
3.  **How to perform a website security check- Here are 6 tools**
4.  **How can I protect myself from hackers if I want to start a blog?**
5.  **Leading, effective, and powerful tools for identifying site visitors**

How To Make Drupal Migration Successful: 6 Useful Tips 

By Waqas
The FBI arrested the operator of the IPStorm botnet, a Russian-Moldovan national, in Spain.
This is a post from HackRead.com Read the original post: Operator of Major Proxy Botnet ‘IPStorm’ Arrested, Pleads Guilty in US

The IPStorm botnet targeted Windows, Linux, Mac, and Android devices and claimed victims in Asia, Europe, North America, and South America.

A Russian-Moldovan national has pleaded guilty to operating an illegal botnet proxy service called IPStorm, responsible for infecting thousands of internet-connected devices worldwide.

Sergei Makinin, 32, of Moscow, Russia, was arrested by the F.B.I. with the cooperation of law enforcement authorities in Spain and Bitdefender, which provided cybersecurity consulting, resources, and guidance to track the suspect.

Makinin pleaded guilty to “three counts of violating 18 U.S.C. § 1030(a)(5)(A) Fraud and Related Activity in Connection with Computers,” in a district court in Puerto Rico as per the U.S. Department of Justice press release.

Makinin was suspected of running an extensive botnet-for-rent operation called Interplanetary Storm (IPStorm) used for illegal activities from June 2019 through December 2022. Bitdefender first documented the operation in a research paper in October 2020.

The botnet targeted Windows, Linux, Mac, and Android devices and claimed victims in Asia, Europe, North America, and South America. IPStorm anonymized its users’ internet traffic, allowing them to conduct malicious activities such as hacking, identity theft, and fraud.

Countries targeted by IPStorm botnet based on the number of victims (Credit: Bitdefender)

In his guilty plea, Makinin admitted that he and his accomplices ran IPStorm from 2015 to 2019 and successfully compromised over 40,000 devices using the IPStorm malware and 23,000 “highly anonymous” proxies. The domains used by Makinin is the scam were proxx.io and proxx.net.

The IPStorm malware allowed Makinin hijack the devices and use them as a proxy. Cybercriminals preferred the service because it was inexpensive, easy to use, and effectively anonymized their internet traffic. Makinin also admitted to developing/distributing malware for infecting the devices, earning $550,0000, and laundering the money.

Makinin is the first to be charged in connection with IPStorm. He faces up to 10 years in prison and will have to forfeit the cryptocurrency wallets linked with the scam. The sentencing is yet to be scheduled. Meanwhile, the F.B.I. and DoJ will continue to investigate the service.

Prices offered by Makinin (Screenshot credit: Hackread.com)

Commenting on this development is the operation’s lead researcher and Bitdefender’s Investigation and Forensics Unit’s senior director, Alexandru Catalin Cosoi. Cosoi shared with Hackread.com that IPStorm was a “complex” botnet rented by cybercriminals for various nefarious activities:

“The Interplanetary Storm botnet was complex and used to power various cybercriminal activities by renting it as a proxy as a service system over infected IoT devices. Our initial research back in 2020 uncovered valuable clues to the culprit behind its operation, and we are extremely pleased it helped lead to arrests,” Cosio explained.

“This investigation is another primary example of law enforcement and the private cybersecurity sector working together to shut down illegal online activities and bring those responsible to justice.”

Makinin’s conviction is a significant victory for law enforcement in the fight against cybercrime. Botnet proxy services remain a serious threat because they are used to committing cybercrimes. This development sends a strong message to other cybercriminals that they will be held accountable for their actions sooner or later.

****_RELATED ARTICLES_****

1.  **Russian Cybercriminal Pleads Guilty to Operating Kelihos Botnet**
2.  **Man whose DDoS attacks took down entire country’s Internet jailed**
3.  **Luminosity RAT author pleads guilty to creating, selling hacking tool**
4.  **2 Russians charged in Mt. Gox Bitcoin heist, BTC-e money laundering**
5.  **No Prison for Student who Developed Spam Botnet to Pay College Fee**

Operator of Major Proxy Botnet ‘IPStorm’ Arrested, Pleads Guilty in US

By Deeba Ahmed
As per cybersecurity researchers at Proofpoint, the APT group TA402 operates in support of Palestinian espionage objectives, with a primary focus on intelligence collection.
This is a post from HackRead.com Read the original post: Pro-Palestinian TA402 APT Using IronWind Malware in New Attack

The recently discovered IronWind malware is distributed via email attachments, cleverly disguised as official correspondence related to the “Economic Cooperation Program with the Countries of the Gulf Cooperation Council 2023-2024.”

Proofpoint cybersecurity researchers have discovered a **new phishing campaign** against Israeli entities, launched by a Middle Eastern APT group, TA402. Proofpoint has been monitoring TA402’s activities since 2020.

The group is also known as Gaza Cybergang, Molerats, WIRTE, and Frankenstein. Researchers agree that TA402 is a pro-Palestinian threat actor targeting Israel for intelligence gathering. The **group had previously been identified** using Facebook, Google Drive, and Dropbox to propagate malware

“TA402 operates in support of Palestinian espionage objectives with a focus on intelligence collection.” This aligns with earlier reports published by Proofpoint on this specific threat actor.”

The company’s latest report, authored by Joshua Miller and the Proofpoint Threat Research Team, revealed that the attackers used a novel initial access downloader dubbed IronWind in this campaign.

IronWind malware is written in the **Go programming language**. After getting deployed, it allows attackers to load additional malware, such as remote access trojans or keyloggers, to steal sensitive data.

Proofpoint researchers found that the attackers are targeting individuals and organizations linked to the Israeli government or military institutions. The campaign started in July 2023 and continued until October 2023. TA402 has consistently engaged in targeted activities and strongly focused on Middle Eastern and North African entities.

Using the labyrinthine infection chain IronWinds indicates that the threat actors have become more sophisticated in their choice of attack mechanisms and are focusing on evading security measures.

The group used a compromised Ministry of Foreign Affairs email account to target Middle Eastern government officials in this phishing campaign. The email message had an economic-themed social engineering lure that read:

“برنامج التعاون الإقتصادي مع دول مجلس التعاون الخليجي 2023-2024″ (Translation: Economic cooperation program with the countries of the Gulf Cooperation Council 2023-2024,”) the **blog post** revealed.

What’s interesting is that TA402 used three different delivery methods between July and October. This includes Dropbox links and XLL and RAR file attachments. Each variation leads to the downloading of a DLL containing the multifunctional malware. The email **delivered a Dropbox** link in July, from where a malicious Microsoft PowerPoint Add-in (PPAM) file was downloaded.

This file contained a macro, which dropped three files- version.dll (IronWind), timeout.exe (IronWind sideloader), and gatherNetworkInfo.vbs. When IronWind is sideloaded, the downloader sends an HTTP GET request to a known TA402 C2 domain (theconomicsnet) hosted on 191.101.78189. 

In August, the attacker included an XLL file in the email, which loaded IronWind. In October, the attacker sent an **RAR attachment** containing a renamed version of tabcal.exe to sideload the downloader instead of using the PPAM file. The same month, TA402 used the Gaza war conflict for the first time as a lure in emails.

TA402 has avoided using cloud services like Dropbox API, which Proofpoint had noticed in its activities in 2021 and 2022, and used attacker-controlled C2 infrastructure.

TA402 APT’s infection chain from November 2021 to January 2022 and infection chain in July 2023 campaign (Credit: Proofpoint)

This is a serious threat, and organizations must take steps to protect themselves. They should implement **cybersecurity awareness training for employees**, keep their systems up to date, and be on the lookout for suspicious activity. Hackread.com is tracking the activities of TA402 and will post updates as they become available.

****_RELATED ARTICLES_****

1.  **Hackers Target Israeli Rocket Alert App Users with Spyware**
2.  **Iran’s Scarred Manticore Targets Middle East with LIONTAIL Malware**
3.  **Deadglyph Backdoor Linked to Stealth Falcon APT in the Middle East**
4.  **Hackers Send Fake Rocket Alerts to Israelis via Hacked Red Alert App**
5.  **Hacktivists Trageting Critical ICS Infrastructure in Israel and Palestine**
6.  **Gelsemium APT Group Uses “Rare” Backdoor in Southeast Asian Attack**

Pro-Palestinian TA402 APT Using IronWind Malware in New Attack

By Waqas
Omegle was founded on March 25, 2009.
This is a post from HackRead.com Read the original post: Video Chat Website Omegle Permanently Shuts Down

Omegle’s founder Brooks Leif K-Brooks, cited the rampant misuse of the platform by pedophiles and other criminals as a major factor in the decision to shut it down.

Omegle, a widely used video chat website that allows users to connect randomly with strangers, ceased operations on November 8, 2023. The closure was announced by founder Leif K-Brooks, who said that operating the website was “no longer sustainable, financially nor psychologically.”

Brooks cited the rampant misuse of the platform by paedophiles and other criminals as a major factor in the decision to shut it down. In recent years, Omegle has been mentioned in more than 50 cases (**1** & **2**) against paedophiles, and the site has been criticized by child protection organizations for its lack of safety features.

Brooks also said that the stress and expense of fighting the misuse of Omegle was too much to bear. “Frankly, I don’t want to have a heart attack in my 30s,” he **said** in a statement on the website.

Statement from Omegle founder Leif K-Brooks (Click or open in new tab to enlarge)

At the time of closure, **according to** Help Mama, Omegle had a user base of 235 million active users on a weekly basis. The platform maintained a strong daily presence, with 3.35 million users engaging actively each day.

Breaking down the numbers further, Omegle sustained hourly traffic of 139,880 active users, drawing in a consistent stream of 2,331 users every minute. The platform’s appeal was evident in its rapid growth, welcoming 39 new visitors every second.

Geographically, a significant portion of Omegle’s user demographic hailed from the United States, constituting 29.93% of the total user base. These statistics highlight the widespread and continuous engagement that Omegle enjoys on a global scale.

However, the closure of Omegle is a loss for many people who used the platform to connect with new friends and strangers from all over the world. The platform also played a vital role in YouTube and TikTok prank culture. Yet, it is also a reminder of the dangers of online anonymity and the challenges of keeping online platforms safe for users.

Alternatives to Omegle include Chatroulette, Chatrandom, and Tinychat. These platforms offer similar features to Omegle, but they have also been criticized for their lack of safety features. Users should be cautious when using any online platform that allows them to connect with strangers.

****_RELATED ARTICLES_****

1.  **9 risky apps that you need to monitor on your kids’ smartphone**
2.  **Microsoft’s new tool detects & reports pedophiles from online chats**
3.  **Operation Narsil – INTERPOL Busts Decade-Old Child Abuse Network**
4.  **How chat platforms are using Machine Learning for content moderation?**
5.  **Anonymous shut down thousands of Dark Web sites for hosting child porn**

Video Chat Website Omegle Permanently Shuts Down

By Waqas
Abrax666 AI Chatbot is being boasted by its developer as a malicious alternative to ChatGPT, claiming it's a perfect multitasking tool for both ethical and unethical activities.
This is a post from HackRead.com Read the original post: Malicious Abrax666 AI Chatbot Exposed as Potential Scam

As of now, based on the information regarding the sale of the Abrax666 AI Chatbot, cybersecurity researchers are of the opinion that the chatbot is most likely a scam.

As of late October 2023, cybercriminals have been advertising a new malicious AI chatbot called Abrax666 on the **dark web** and underground hacking forums. The developer of the Abrax666 AI chatbot has been boasting about the chatbot claiming it to be a perfect multitasking tool for ethical and unethical activities.

Currently, the pricing structure of the Abrax666 AI chatbot is €299 per month, and €2499 per year, while its source code is available for sale for €4999, however, according to cybersecurity researchers at SlashNext, the Abrax666 chatbot is likely to be fake, and could be an attempt to scam buyers.

Abrax666 Chatbot’s listing (Screenshot credit: Hackread.com)

It is worth noting that after the launch of OpenAI’s ChatGPT chatbot, cybercriminals attempted to exploit it for malicious purposes. In particular, Russian hackers **tried** to leverage the chatbot to create malware and phishing pages. While there was **some success**, to escalate their efforts, cybercriminals launched their own malicious chatbots, including **WormGPT** and **FraudGPT**.

In the latest report, SlashNext’s cybersecurity researcher Daniel Kelley highlighted several red flags indicating how the Abrax666 AI chatbot could be a scam despite the big claims. The chatbot is being sold by a threat actor using the alias Abrax on a notorious Russian-language forum where the rule of sale includes sellers depositing some amount of money to initiate the sales process.

However, Abrax not only did not deposit the funds but also refused to allow interested parties to review the chatbot before making a purchase. One potential buyer using the alias ‘SocketSilence’ stated that Abrax failed to provide any evidence of whether they have sold the chatbot previously or if it actually works.

(Screenshot credit: Hackread.com)

Despite video demonstrations shared by the seller, the authenticity of the chatbot’s capabilities remains in question. The videos, according to Kelley, do not exhibit standard AI chatbot behaviour and appear more like a standard tool.

“The only potentially credible evidence that has caused us to slightly defer our verdict here, are videos being circulated by ‘Abrax’ that allegedly show the AI chatbot in use,” Daniel explained in a **blog post**.

“However, even these videos do not appear to showcase the standard output one would expect from an AI chatbot of this nature. The output appears to look more like a standard tool that is not capable of real-time communication and does not accept prompts but arguments and flags instead,” the researcher added.

Abrax’s attempt to sell the chatbot on other cybercrime forums resulted in the removal of the threat, possibly due to administrators detecting malicious intent. Furthermore, the topic initiated by Abrax was locked by forum administrators at the time of writing.

One of the admins cautioned Abrax about their claims (Screenshot credit: Hackread.com).

Overall, the SlashNext report casts doubt on the legitimacy of the Abrax666 AI chatbot, cautioning potential buyers against its advertised capabilities. However, if the seller provides evidence that their product is legitimate and aligns with the claims they have made, it could likely change the minds of researchers.

****_RELATED ARTICLES_****

1.  **DarkBERT: Enhancing Cybersecurity Efforts on the Dark Web**
2.  **Chinese Scammers Use Fake Loan Apps for Money Laundering**
3.  **Fake Ledger App on Microsoft Store to Stole $800,000 in Crypto**

Malicious Abrax666 AI Chatbot Exposed as Potential Scam

By Deeba Ahmed
The global operation also led to the arrest of eight individuals, including the alleged mastermind.
This is a post from HackRead.com Read the original post: Police Dismantle Phishing-as-a-Service Platform BulletProftLink

BulletProftLink, a prolific phishing-as-a-service (PhaaS) and initial access broker (IAB) operation was operating since 2015.

In a significant blow to the cybercrime community, Malaysian police have dismantled BulletProftLink, a prolific phishing-as-a-service (PhaaS) and initial access broker (IAB) operation.

The seizure was a result of a collaborative effort between the Royal Malaysian Police, the Australian Federal Police, and the FBI. The authorities arrested eight individuals on 6 November, 2023 including the platform’s alleged mastermind and a software engineer.

Additionally, security agencies also seized cryptocurrency wallets containing approx. $213,000, apart from jewellery, servers, payment cards, and computers.

BulletProftLink, a prolific **phishing-as-a-service** (PhaaS) and initial access broker (IAB) operation was operating since 2015. It served thousands of threat actors with tools and resources to conduct phishing attacks through its extensive collection of phishing templates (over 300), including login pages for prominent services like DHL, Microsoft Office, Naver, and financial institutions.

Some of these pages were hosted on legit cloud services such as Google Cloud and Microsoft Azure. It also aided attackers in **bypassing MFA** (multi-factor authentication) protections by offering the **Evilginx2** reverse-proxying tool that could lead to Adversary-in-the-Middle phishing attacks.

**According to** Malaysian police, the platform had become intensely active since 2018, and that’s when it came to their radar. Since its inception, BulletProftLink has attracted over 8000 clients, many of whom paid up to $2,000/month for accessing credential logs regularly. Malicious actors preferred it for buying stolen accounts to conduct frauds and cyberattacks.

“From our investigations, not only the syndicate has compromised websites those of financial and education institutions, and official government sites in Australia, but they are also involved with the selling of stolen credentials,” stated Royal Malaysian Police’s inspector general, Sri Razarudin Husain.

This platform remained a key source for cybercriminals to infiltrate corporate networks, conduct reconnaissance, and laterally move towards valuable targets. Intel471, a threat intelligence platform, was monitoring the platform’s activities, and the following screenshot has been captured from their **coverage** of the event.

The screenshot reveals phishing templates for various platforms that were previously accessible on the BulletProofLink website.

The authorities haven’t yet disclosed the identities of the **arrested individuals**. As per cyber threat intelligence professionals, a threat actor, AnthraxBP, could be linked to the platform, and certain operational mistakes from BulletProftLink could have led to its dismantling.

The authorities have taken down multiple domains of the platform. Its closure is certainly a huge victory against cybercriminals because BulletProftink had remained a crucial source of stolen credentials for threat actors. Now that it is out of the picture, cybercriminals will need to look for alternative sources to gain initial access to corporate networks.

1.  **NetWire Malware Site and Server Seized, Admin Arrested**
2.  **Ragnar Locker Ransomware Gang Dismantled, Key Suspect Arrested**
3.  **SSNDOB Cybercrime Marketplace Seized in Intl. Coordinated Operation**
4.  **INTERPOL Dismantles Infamous ’16shop’ Phishing-as-a-Service Platform**
5.  **EvilProxy Phishing Kit Targets Microsoft Users via Indeed.com Vulnerability**