By Deeba Ahmed
The Philippines finds itself under an online siege as tensions escalate in the South China Sea (SCS) with China, claims cybersecurity firm Resecurity. 
This is a post from HackRead.com Read the original post: Cyberattacks Surge 325% in Philippines Amid South China Sea Standoff

The Philippines faces a surge in cyberattacks as tensions rise in the South China Sea. Hacktivists and misinformation campaigns target government websites, spread fake news, and disrupt critical infrastructure. Learn why the Philippines is a cyberwarfare hotspot and how the country can defend itself.

Resecurity reports a 325% increase in cyberattacks targeting the country in Q1 2024 compared to the same period last year. **Cyberattacks involving hacktivist groups** and foreign misinformation campaigns have nearly tripled with multiple attacks staged by unknown threat actors in Q2 2024, combining ideological motivations with nation-state-sponsored propaganda. 

The Philippines, located near the South China Sea, is facing tensions due to China’s assertive actions and its role as a Major Non-NATO Ally (**MNNA**). The island nation’s maritime trade routes and proximity to Taiwan make it a potential staging ground for military operations in a larger conflict, prompting adversaries to disrupt the country’s infrastructure.

Resecurity **found** numerous hacktivist groups  targeting the Philippines, including the pro-China Mustang Panda, DeathNote Hackers, and Exodus Security. In February, Exodus Security staged targeted **DDoS attacks**, leaking stolen data from various countries, including the Philippines, and announced partnerships with Cyber Operation Alliance, Robin Cyber Hood, Arab Anonymous, and Sylnet Gang-SG to broaden their activities. 

In addition, local hacking groups, including Philippine Hacking University, Excommunicado, CyberMafia Philippines, Philippine Cyber Alliance, Bisaya Cyber Army, and LizardSquad Philippines, are also using hacking as a form of protest. 

Recently, threat actor “KryptonZambie” claimed to have stolen over 152 gigabytes of Philippine citizen identity card data from unnamed sources whereas the Philippine Department of Science and Technology (DoST), was targeted by a cyberattack likely orchestrated by threat actors involved in a broader misinformation campaign.

It’s noteworthy that KryptonZambie was also responsible for the data breach of the widely-used CutOut.Pro AI Tool, leading to the exposure of personal details of over 20 million users on the infamous cybercrime and hacker forum Breach Forums.

The threat actor has recently claimed responsibility for data breaches at LeadSquared, an Indian software platform, and WeRize, India’s inaugural socially distributed full-stack financial services platform. Allegedly, the stolen data amounts to over 1.3 terabytes collectively.

> 📢 The hacker behind #CutOutPro breach involving 20 million accounts now claims to have breached @LeadSquared, an Indian software platform, and @WeRize\_Official, India's first socially distributed full-stack financial services platform. The leaked data is over 1.3TB collectively. pic.twitter.com/FT0hNpPP4D
> 
> — Hackread.com (@HackRead) April 15, 2024

These groups use hacktivist-related monikers to avoid attribution and create a perception of social conflict online. They also use tactics like website defacement, data breaches, and misinformation campaigns to disrupt essential services and embarrass the government. They may also hijack government or critical infrastructure websites, steal sensitive data, and create public distrust through social media and online forums. 

Cyberattacks in the Philippines have significant implications beyond immediate disruption. They can erode public trust, escalating tensions between the country and China, and disrupt the economy by affecting critical infrastructure.

To counter these threats, the Philippines needs a multifaceted approach. This includes upgrading cybersecurity infrastructure, investing in threat intelligence, and fostering public-private partnerships.

1.  Chinese APT Posing as Cloud Services to Spy on Cambodia
2.  Unsecured Database Leaks 153 GB of Filipino Student, Family Data
3.  Chinese Scammers Exploit Cloned Websites in Vast Gambling Network

Cyberattacks Surge 325% in Philippines Amid South China Sea Standoff

PRESS RELEASE

Atlanta, GA - April 16, 2024 – BeyondTrust, the worldwide leader in intelligent identity and access security, today announced a definitive agreement to acquire Entitle, a pioneering privilege management solution that discovers, manages, and automates just-in-time (JIT) access and modern identity governance and administration (IGA) across the entire cloud estate. These capabilities enhance a customer’s ability to provision user access to sensitive data and cloud resources on a time-bounded and “as-needed” basis. While regulations and industry best practices are moving towards zero-standing privileges (vs. permanent privileged access as provided by traditional PAM offerings), companies have struggled to implement JIT with existing tools, particularly in cloud and hybrid environments; Entitle solves this issue with its automated provisioning workflows, self-serve access requests, and 150+ integrations across IaaS/PaaS platforms and SaaS apps.

This acquisition includes all Entitle products, employees, customers, partners, assets, and intellectual property.

BeyondTrust further solidifies its industry-leading Privilege Identity Security platform with the acquisition of Entitle, expanding beyond traditional privileged access management (PAM) to encompass dynamic, just-in-time access management across cloud, SaaS, and on-premises environments. Adding Entitle to its product portfolio enhances the capability to address the sophisticated challenges of PAM and cloud infrastructure entitlement management (CIEM) in today's cloud-centric landscape, with a unified orchestration approach that enriches the platform with advanced identity governance functionalities.

“The BeyondTrust acquisition of Entitle signifies a crucial evolution in our fight to ensure customers can protect all paths to privileges, focusing on identity-first security across all IT environments,” says Janine Seebeck, CEO of BeyondTrust. “Adopting a unified, orchestrated approach that incorporates dynamic, just-in-time access is critical for safeguarding our customers' ever-changing paths to privilege. This strategy not only reduces operational friction, but also enhances the security of the entire identity infrastructure more effectively.”

"Entitle’s JIT Access and Cloud Permissions Management solution is an emerging leader in the Identity Security market,” says Ron Nissim, CEO of Entitle. “This acquisition allows Entitle to continue to grow through BeyondTrust’s years of expertise and dominance in the PAM market - offering significant opportunities for Entitle’s team.”

“BeyondTrust’s acquisition of Entitle adds comprehensive permissions and entitlements management across cloud and SaaS platforms to the BeyondTrust Privileged Identity Security platform,” states Paul Fisher, Senior Analyst at KuppingerCole Analysts.

The Entitle solution is immediately available to all BeyondTrust customers. For more information, visit www.beyondtrust.com/products/entitle.

About BeyondTrust

BeyondTrust is the worldwide leader in intelligent identity and access security, enabling organizations to protect identities, stop threats, and deliver dynamic access. We offer the only platform with both intelligent identity threat detection and a privilege control plane that delivers zero-trust based least privilege to shrink your attack surface and eliminate security blind spots.  
BeyondTrust protects identities, access, and endpoints across your organization, while creating a superior customer experience and operational efficiencies. We are leading the charge in innovating identity-first security and are trusted by 20,000 customers, including 75 of the Fortune 100, plus a global ecosystem of partners. Learn more at www.beyondtrust.com.

BeyondTrust Acquires Entitle, Strengthening Privileged Identity Security Platform

PRESS RELEASE

Copenhagen, Denmark, April 16, 2024 – Keepit, a global leader in SaaS data backup and recovery, today announced Kim Larsen as new Chief Information Security Officer (CISO). With more than 20 years of leadership experience in IT and cybersecurity from government and the private sector, the new CISO’s areas of expertise include: business driven security; aligning corporate, digital and security strategies; risk management and threat mitigation; developing and implementing security strategies; leading through communication; and coaching. Larsen's deep government and broad private sector experience will position him to bring Keepit’s security advisory capabilities and development of future services to the next level.  

Kim Larsen is an experienced keynote speaker, negotiator, and board advisor on cyber and general security topics, with experience from a wide range of organizations, including NATO, EU, Verizon, Systematic, and a number of industry security boards. 

“It's a real pleasure to welcome Kim Larsen to the team — his deep government and broad private sector experience is exceptional, and perfectly positions him to bring Keepit’s security advisory capabilities and development of future services to the next level. Our current growth trajectory and go-to-market strategy has us engaging in conversations where his expertise is highly valuable,” says Morten Felsvang, Keepit CEO.

Kim Larsen started his career in the Danish National Police and subsequently spent nine years with Security and Intelligence Service (PET) where he served as delegate for the Danish government in both NATO’s and the EU’s security committees.

Moving into the private sector to act as strategic advisor on government, public and financial sector matters, and developing security organizations and partnerships in companies such as Verizon, Huawei and Systematic, he has served on the information security board of the Danish Industry confederation (DI) and Danish Council for Digital Security for 10 years. 

Backup and recovery critical components to cybersecurity

With this background, Kim Larsen has a holistic take on cybersecurity and a profound understanding of what is required and desired in organizations bolstering their IT infrastructures against cyber threats:

“I am very happy to join Keepit: Backup and recovery are critical components of a solid cybersecurity posture, and the unique Keepit solution is the answer to so many compliance and security challenges. It’s a great opportunity to work with organizations on how to retain access to their data in the face of any malign or arbitrary threats to their infrastructure,” says Kim Larsen.

The CISO points to compliance, cyber resilience, and disaster recovery best practices as three of his favorite subjects and reasons for choosing Keepit as his new stomping ground: 

“If there’s one thing we can be sure of, it’s this: We don’t know the threats we will be facing in the future. But we can make educated guesses. And based on those, we can make sure to cross the t’s and dot the i’s that we do know about. That’s why the Keepit solution is a future-proof solution: With its vendor-independent tech stack that keeps data physically and logically separate from the production environment, it’s a guarantee that customer data is always available. And with local data centers keeping data in the same regulatory regions as the organization, full compliance is assured. It really is quite unique,” states Kim Larsen. 

About Kim Larsen

Kim Larsen is Chief Information Security Officer at Keepit and has more than 20 years of leadership experience in IT and cybersecurity from government and the private sector.

Areas of expertise include business driven security, aligning corporate, digital and security strategies, risk management and threat mitigation adequate to business needs, developing and implementing security strategies, leading through communication, and coaching.

Kim Larsen is an experienced keynote speaker, negotiator, and board advisor on cyber and general security topics, with experience from a wide range of organizations, including NATO, EU, Verizon, Systematic, and a number of industry security boards.

Find Kim Larsen on LinkedIn.

Kim Larsen New Chief Information Security Officer at SaaS Data Protection Vendor Keepit

A controversial bill reauthorizing the Section 702 spy program may force whole new categories of businesses to eavesdrop on the US government’s behalf, including on fellow Americans.

The United States Senate is poised to vote on legislation this week that, for the next two years at least, could dramatically expand the number of businesses that the US government can force to eavesdrop on Americans without a warrant.

Some of the nation’s top legal experts on a controversial US spy program argue that the legislation, known as the Reforming Intelligence and Securing America Act (RISAA), would enhance the US government’s spy powers, forcing a variety of new businesses to secretly eavesdrop on Americans’ overseas calls, texts, and email messages.

Those experts include a handful of attorneys who’ve had the rare opportunity to appear before the US government’s secret surveillance court.

The Section 702 program, authorized under the Foreign Intelligence Surveillance Act, or FISA, was established more than a decade ago to legalize the government’s practice of forcing major telecommunications companies to eavesdrop on overseas calls in the wake of the September 11, 2001, terrorist attacks.

On the one hand, the government claims that the program is designed to exclusively target foreign citizens who are physically located abroad; on the other, the government has fiercely defended its ability to access wiretaps of Americans' emails and phone conversations, often years after the fact and in cases unrelated to the reasons the wiretaps were ordered in the first place.

The 702 program works by compelling the cooperation of US businesses defined by the government as “electronic communications service providers”—traditionally phone and email providers such as AT&T and Google. Members of the House Intelligence Committee, whose leaders today largely serve as lobbyists for the US intelligence community in Congress, have been working to expand the definition of that term, enabling the government to force new categories of businesses to eavesdrop on the government’s behalf.

Marc Zwillinger, a private attorney who has twice appeared before the FISA Court of Review, wrote last week that the RISAA legislation expands the definition of “electronic communications service provider” (ECSR) to include data centers and commercial landlords—businesses, he says, that “merely have access to communications equipment in their physical space.” According to Zwillinger, RISAA may also ensnare anyone “with access to such facilities and equipment, including delivery personnel, cleaning contractors, and utilities providers.”

Zwillinger had earlier criticized the ECSR language this year, leading House lawmakers to amend the text to explicitly exclude certain types of businesses, including hotels.

Zwillinger noted in response that the need for those exclusions is proof enough that the text is overly broad; an exception that merely serves to prove that the rule exists: “The breadth of the new definition is obvious from the fact that the drafters felt compelled to exclude such ordinary places such as senior centers, hotels, and coffee shops,” he wrote. “But for these specific exceptions, the scope of the new definition would cover them—and scores of businesses that did not receive a specific exemption remain within its purview.”

This analysis quickly flooded inboxes on Capitol Hill last week, with some Hill staffers and privacy experts quietly dubbing the ECSR language the “Stasi amendment,” a reference to the East German secret police force notorious for infiltrating industry and forcing German citizens to spy on one another.

Digital rights groups have pointed to Zwillinger’s assessment while lobbying US senators this week to vote against the RISAA. “While the Department of Justice wants us to believe that this is simply about addressing data centers, that is no justification for exposing cleaning crews, security guards, and untold scores of other Americans to secret Section 702 directives,” says Sean Vitka, policy director at Demand Progress, which has taken to calling the ECSR text the “Make Everyone A Spy provision.”

In an interview with _The New York Times_ on Tuesday, Jim Himes, a Democrat from Connecticut, decried comparisons between the ECSR text and the East German secret police, saying critics of the provision were “massively exaggerating” the 702 program's domestic reach.

The Senate is expected to vote on RISAA on Wednesday, though a few procedural hurdles remain. A two-thirds majority vote will be needed to get the bill to the floor, and another two-thirds majority is required to prevent privacy defenders from filibustering the bill. Once those hurdles are cleared, however, a simple majority is needed to send the FISA reauthorization bill to the White House.

There is almost zero chance of US president Joe Biden rejecting the bill. The administration has spent months sending top lieutenants to the Hill to champion its cause. Biden’s support for the 702 program stands in stark contrast to the views of his campaign rival, former president Donald Trump, who last week commanded his supporters in Congress to “KILL FISA.”

Ron Wyden, the senior US senator from Oregon, argues that RISAA represents “one of the most dramatic and terrifying expansions of government surveillance authority in history.” A leading privacy hawk in Congress, Wyden joined the Senate Intelligence Committee just prior to the 9/11 attacks and has served for more than two decades.

The US House of Representatives passed RISAA last week in a 273–147 vote. An amendment aimed at requiring the Federal Bureau of Investigation to obtain search warrants before accessing wiretaps on US citizens was rejected after a vote on the amendment ended in a tie.

Members of the House Intelligence Community allied with the Biden White House and its spy agencies to defeat the amendment in what multiple House sources referred to as a “campaign of fear.” An hour before the vote on Friday, Himes openly threatened US lawmakers supporting the warrant requirement, claiming that if it passed, he’d ensure those lawmakers face the brunt of the blame in the wake of any future terrorist attacks.

“If we turn off the ability of the government to query US person data, the consequences will be known soon,” Himes said. “And we will audit why what happened happened. And accountability will be visited.”

For years, the US government has claimed that it would be impossible to estimate the number of Americans who are being eavesdropped on under Section 702. While statistics on the program are difficult to come by, it is known to have captured hundreds of millions of individual calls, texts, and emails while in the process of targeting only a few million individuals. (The FBI claims that, following a series of recent internal reforms, the 702 program now targets fewer than 300,000 individuals per year.)

While Section 702 is hailed as a powerful tool against terrorism, cybercrime, and drug trafficking, US spy agencies are likewise authorized to target foreigners on the basis that they’re believed to receive or possess “foreign intelligence information,” an ambiguous term legal experts argue could extend to a virtually unlimited number of activities with any number of tenuous ties to “foreign affairs.”

While attempting to paint the program as merely a threat to Americans who communicate with Hamas, ISIS, or other designated terrorist groups, House Intelligence Committee chairman Mike Turner did little to reject claims last week that the 702 program can also be aimed at foreign dignitaries and politicians of allied European nations. Notably, the US does not recognize any foreign citizen abroad as having privacy rights, and US spy agencies may freely target them without congressional approval. The 702 program exists because the government relies on US businesses to implement its wiretaps and ensnares Americans’ communications in the process.

Much of the criticism aimed at the 702 program stems from revelations in a declassified court filing last year that describes rampant abuse by agents of the FBI, which is known to have scoured the wiretap database for information on tens of thousands of American protesters, journalists, political donors, and at least one sitting member of Congress.

The FBI has implemented a number of internal policies in recent years designed to limit lower-ranking FBI employees from unilaterally authorizing searches that target Americans—reforms that Turner and other spy agency surrogates claim are sufficient to stave off future abuse.

The program’s critics, meanwhile, say relying on the FBI to internally police itself is a mistake, pointing to decades of surveillance abuses and political intelligence gathering carried out in clear violation of US law.

US Senate to Vote on a Wiretap Bill That Critics Call ‘Stasi-Like’

Recent analysis shows that enterprises need to think about the impact on security budgets and resources as they adopt new AI-based applications.

Source: Absolute Security Cyber Resilience Risk Index 2024

Enterprises assessing their readiness for artificial intelligence (AI) transformation have to ensure they have devices capable of running AI-enabled applications. A recent analysis by Absolute Security found that the majority of organizations need to update or replace their systems to be AI-ready. Deployments of this size can have significant implications on their cybersecurity risk and resiliency, Absolute Security states.

"Absolute Security Cyber Resilience Risk Index 2024" assesses the state of cyber resilience for global enterprises. The index is based on telemetry from millions of mobile and hybrid PCs running Absolute Security's firmware-based agents. To determine AI-readiness, Absolute Security analyzed over 4 million devices running Windows 10 or 11 to determine how many of them had a minimum of 32 GB of RAM. According to the index, 92% didn't meet the basic requirements needed to efficiently handle modern AI applications.

Absolute Security based the assessment on whether enterprise PCs are capable of supporting AI applications on the recommendation that PCs should be equipped with a minimum of 32 GB of RAM and have either a stand-alone graphics processing unit (GPU) or an integrated neural processing unit (NPU).

"Huge investments in AI-capable endpoint fleets have the potential to divert budget and human resources away from critical IT and security priorities that can leave gaps in security and risk policies," Absolute Security says.

The concern isn't just about diverting resources; Absolute Security notes that new devices being added to the environment can also add complexity. Organizations are already struggling to keep up with patching and making sure the right security controls are in place. New devices could mean defining new controls or adjusting workflows to make sure they are being patched.

While there is a marked improvement between 2023 and 2024, Absolute Security found that organizations are still lagging behind with patches. Most industries continue to run weeks or months behind in complying with their own patching policies, although Windows 11 devices seem to be faring better than Windows 10, the company said.

**About the Author(s)**

Enterprise Endpoints Aren't Ready for AI

By Waqas
Hacker "IntelBroker" claims to have breached Space-Eyes, a geospatial intelligence firm, exposing US national security data. Authorities investigate the claim that could impact sensitive government operations.
This is a post from HackRead.com Read the original post: IntelBroker Claims Space-Eyes Breach, Targeting US National Security Data

Space-Eyes website

The notorious hacker operating under the alias “IntelBroker” claims to have breached the cyber infrastructure of Space-Eyes, a Miami-based geospatial intelligence firm. In a message posted on **Breach Forums**, IntelBroker boasted a swift intrusion, taking only “around 10-15 minutes” to access sensitive data.

According to Space-Eyes’ website, it caters exclusively to government agencies and organizations, including the Department of Justice, Department of Homeland Security, various branches of the US Armed Forces, and crucial intelligence bodies like the National Geospatial-Intelligence Agency (NGA). The alleged breach, if true, will have significant repercussions for US national security.

As per IntelBroker’s claims, the stolen data comprises “highly confidential documents about Space-Eyes’ services for national security within the US government.” The depth and character of the data are exceedingly sensitive, containing confidential discussions, correspondences, and profiles concerning the national security of the United States, along with individuals and ships denied entry into the United States or are sectioned under US law.

IntelBroker announcing their hack on Breach Forums (Screenshot credit: Hackread.com)

****Detailed on Sectioned Cyber Crime and APT Groups****

Hackread.com’s analysis also uncovers that certain leaked files are already in the public domain, such as those found **on the US Treasury website**. These files include a roster of sanctioned or blacklisted cybercrime groups, among them the North Korean government-backed Lazarus Group and APT-C-26, as well as individual hackers like Bassterlord and INVESTORLIFE1.

Additionally, the data includes records of discussions concerning figures linked to terrorism, details that Hackread.com refrains from disclosing due to privacy and security concerns. It’s noteworthy to mention that the personal data within the leaked records belongs to individuals worldwide. Below is the comprehensive breakdown of the data:

*   Full names
*   Phone numbers
*   Company names
*   Job descriptions
*   Email addresses (26,493)
*   Some Password Hashes
*   Complete location data including coordinates and addresses (Country, State, postcode, etc).

On the left is the public data from the US Treasury website included in the leak – On the left is a list of email addresses leaked in the alleged data breach (Screenshot credit: Hackread.com)

This breach mirrors IntelBroker’s recent previous data breach, during which the hacker obtained sensitive documents and **data from Acuity Inc.**, a US Federal contractor headquartered in Reston, Virginia.

Initially, Acuity and the US government dismissed the data breach. However, when the **hacker released additional data**, alleging it belonged to “The Five Eyes,” both parties acknowledged the breach.

****Space-Eyes Yet to Respond – Hacker Claims They Still Have the Access!****

Space-Eyes has not yet released an official statement regarding the alleged breach. However, CISA has been notified about the alleged breach. Should either authority respond, we will provide updates to this article.

On the other hand, IntelBroker told Hackread.com that Space-Eyes was an easy target and they breached the company directly without involving any third party. Nevertheless, this is a developing story, expect an update soon!

1.  US Marshals Service Data Sold on Russian Hacker Forum
2.  IntelBroker Hacker Leak Partial Facebook Marketplace Database
3.  Hackers Claim Data Breach at Staffing Giant Robert Half, Sell Data
4.  Military Satellite Access Sold on Russian Hacker Forum for $15,000
5.  Hackers Leak 2.5M Private Plane Owners’ Data Linked to LA Intl. Airport

IntelBroker Claims Space-Eyes Breach, Targeting US National Security Data

A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal.
While the original shortcoming was discovered and patched by the Lighttpd maintainers way back in August 2018 with version 1.4.51, the lack of a CVE identifier or an advisory meant that

Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw

A Russian-language cyberattack campaign impersonates legitimate game operations to spread various cross-platform infostealers.

Source: Stockphoto Graph via Shutterstock

A Russian threat actor is peppering game developers with fraudulent Web3 gaming projects that drop multiple variants of infostealers on both MacOS and Windows devices.

The ultimate goal of the campaign appears to be defrauding victims and stealing their cryptocurrency wallets, according to Recorded Future's Insikt Group, which discovered the malicious activity.

The extensive Russian-language campaign mimics legitimate projects by using slight alterations in project names and branding — even going so far as to have multiple fake social-media accounts impersonating the projects to make them seem authentic, according to a report published online.

In the attack, the main webpage of a project offers or links to installation files for the purported "game" software, ostensibly for use by developers. However, these files instead deliver either Atomic macOS Stealer for Intel- or ARM-based devices; Rhadamanthys; or RisePro, depending on the victim's operating system.

"The targeted nature of this campaign suggests that threat actors may perceive Web3 gamers as having a more acute vulnerability to social engineering, due to an assumed trade-off in cyber hygiene — meaning that Web3 gamers may have fewer protections in place against cybercrime — in the pursuit of profit," according to the report.

That profit comes in the form of cryptocurrency, as the actor is primarily targeting developers' crypto wallets with the intent of compromising those wallets. Web3 gaming refers to online games such as Axie Infinity and MixMob that are built on blockchain technology, which can result in financial gain for players who earn various cryptocurrencies.

"As wallet compromise continues to be the biggest threat in both Web3 and cryptocurrency security … we assess that wallet compromise is likely the end goal of this campaign," according to Insikt Group. Attackers also can use credentials harvested from the malicious activity "for an array of unauthorized account accesses," according to the report.

Indeed, the report outlines several social media reports of game developers falling victim to the scam and having their crypto wallets drained, including one who lost about 2.5 Ethereum, or about $8,000.

**Setting a Trap Through Impersonation**

The attack campaign comes in the form of what's called "trap phishing," whereby malicious actors duplicate and deploy Web3 project lookalikes.

Insikt researchers began investigating the malicious activity after Web3 smart contract auditor CertiK described a project in January called Astration that used fake job openings and non-fungible token NFT offerings to lure game developers into a trap-phishing campaign that spread infostealers.

The fraudulent project duplicated and recreated nearly all of the social media accounts associated with a legit project called Alteration, including reposting social-media content from legitimate accounts, establishing a direct copy of the project's Discord server, and delivering two types of malware.

Upon further research, Insikt found five additional fraudulent gaming projects, three of which were serving malicious files communicating with the same command-and-control (C2) server as those obtained from the Astration project, as well as two that were no longer active but were found to be similar to the active scams. Purported game names associated with the active projects were ArgonGame, DustFighter, and CosmicWay Reboot, while games associated with the inactive projects were Crypterium World and Myth Island.

Overall, the threat actors are delivering the campaign via "a resilient infrastructure, allowing them to quickly adapt by rebranding or shifting focus upon detection," according to Insikt.

**Maintain Vigilance to Mitigate Risk**

Insikt highlighted the necessity for both individuals and organizations to maintain continuous vigilance against threats and adopt mitigation strategies against campaigns that use phishing as an initial entry point. To that end, the group offered a number of mitigations in its report as well as included a list of indicators of compromise.

One is to provide comprehensive training to users — especially those involved in Web3 gaming or related industries — to recognize social engineering tactics associated with trap phishing. Game developers in particular should "scrutinize the legitimacy of Web3 projects advertised on social media," according to the report.

Organizations also should educate users on the well-known risks associated with downloading software from unverified sources and the importance of verifying the authenticity of project websites before installation.

Endpoint protection solutions updated with the latest threat intelligence — such as antivirus software that are capable of detecting and blocking known infostealer variants like Atomic, Stealc, Rhadamanthys, and RisePro — also can help organizations avoid compromise.

Organizations should also deploy multi-platform security measures to protect against malware infections across both macOS and Windows devices, including firewalls, intrusion detection systems, and endpoint detection and response (EDR) solutions, according to Insikt.

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

Web3 Game Developers Targeted in Crypto Theft Scheme

Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn't a plot from the latest cyber-thriller; it's actually been a reality for years now. How this will change – in a positive or negative direction – as artificial intelligence (AI) takes on

AI Copilot: Launching Innovation Rockets, But Beware of the Darkness Ahead

By Uzair Amir
Worried about prying eyes? We explain how messenger apps keep your chats confidential with features like encryption & multi-factor authentication.  Learn about security risks & emerging technologies for a safer digital future.
This is a post from HackRead.com Read the original post: Texting Secrets: How Messenger Apps Guard Your Chats

In today’s digital age, conversations are more online than face-to-face; hence, we must be careful with our messages. The widely used **messenger applications** designed for modern communication have advanced greatly in ensuring that our chat remains confidential. However, what measures are taken by such systems to keep our conversations safe from any malicious activity?

****End-to-End Encryption****

This security measure ensures that messages are decrypted only by the intended users. With end-to-end encryption, decryption is only possible by the receiver – the third party cannot intercept or **eavesdrop on the message**.

WhatsApp and Telegram are some chat applications that employ this encryption to secure user chat. Encryption of messages occurs “at the end” with the sender, and it can only be decrypted when it reaches the intended receiver “at the other end”; therefore creating a problem even for the messaging companies that would wish to decrypt and read the messages.

****Security Measures Beyond Encryption****

*   **Two-Factor Authentication (2FA):** To improve security, two-factor authentication requires users to enter a code that is sent to their mobile phone apart from the usual login details. This makes it much safer against unauthorized hackers when passwords get stolen to send **messenger hacked** links and gain access to sensitive accounts.
*   **Biometric Authentication:** Messenger applications can benefit from convenient and safe biometric authentication options like fingerprint and facial recognition. Through the use of individual biological attributes, it guarantees that only the authorized user can unlock their conversations.
*   **Secure Messaging Protocols:** Messenger applications are built on secure messaging protocols (like the Signal Protocol or the Off-the-Record Messaging protocol), enabling encrypted communication channels among different individuals. These protocols ensure that the message remains private even during any attack on the network.

****Challenges and Vulnerabilities********Phishing Attacks****

The security of messenger apps is still seriously threatened by **phishing attacks** when cybercriminals make efforts to deceive people and disclose their login details as well as other important data. Mitigation of this risk requires education as well as awareness about phishing techniques.

**Messenger app security** is also at risk from social engineering tactics like impersonation or manipulation. People must stay alert and suspicious of any odd messages or friend requests coming from unfamiliar ones; rather, they must confirm that the sender is who they claim to be before giving out any confidential data.

****Device Security Risks****

Messenger app communication may be unsafe due to weaknesses in device security, such as malware or **insecure Wi-Fi networks**. To prevent this, it is important to have regular software updates, antivirus software and secure network connections.

****Emerging Technologies in Chat Security****

*   **Quantum Cryptography:** Quantum mechanics is used in quantum cryptography to ensure that data is stored in quantum states, resulting in high levels of safety. Although it is still being considered as an attempt, quantum cryptography provides a potential solution to secure messaging encryption.
*   **Blockchain-Based Messaging Platforms:** With blockchain technology, it becomes possible to have messaging systems which do not centralize message data but rather store it across a distributed network, making it almost impossible for someone to corrupt or prevent certain messages from passing through. The **blockchain messaging applications** enhance safety as well as confidentiality through open and unchangeable message logs.
*   **AI-Powered Threat Detection:** In messenger applications today, there is a growing trend of utilizing artificial intelligence as well as machine learning algorithms to identify and deal with security threats. These systems analyze user activities, messages exchanged, as well as network flow metadata to detect, prevent and respond immediately to any breaches of security.

****Balancing Security and Usability****

Although it is important to have strong security systems, messenger applications need to balance between security and ease of use to be convenient. The flow of messages must not be disrupted, and there should be no negative impact on user experience as a result of complicated security protocols.

****The Future of Secure Messaging****

The landscape of chat security will change with advancing technology. The security of messenger applications will be improved by developments in **encryption algorithms**, authentication mechanisms, and threat detection technologies to guarantee that our conversations remain confidential and safe within cyberspace.

To promote secure communication, it is crucial to educate people on how they can stay safe and why privacy matters. Messaging platforms take part in user awareness programs that emphasize risks posed by hackers and promote preventative security steps.

The security of our conversations is very important at a time when digital communication is dominant. Many security features are used by messaging applications such as end-to-end encryption, biometric authentication, etc., to protect our conversations against any threats.

Nonetheless, the pace at which cyber threats change and develop means that new forms of securing chats must be continuously created. To achieve this, we have to keep on guard and adopt new technologies so that our conversations will stay private and safe.

1.  Zama Secures $73M Series A Lead for Homomorphic Encryption
2.  WhatsApp Encryption Explained — “Everything is not what it seems”
3.  Encrypted Email Service ProtonMail Supports Physical Security Keys

Tag

#intel