By Waqas
The IntelBroker hacker has claimed responsibility for the breach.
This is a post from HackRead.com Read the original post: Hackers Leak 2.5M Private Plane Owners’ Data Linked to LA Intl. Airport Breach

IntelBroker informed Hackread.com that they successfully executed the data breach by exploiting a vulnerability within one of the CRM systems utilized by the Los Angeles International Airport.

The notorious hacker known as IntelBroker is making headlines once again with a daring alleged breach targeting one of the United States’ most critical organizations: the Los Angeles International Airport.

In a bold move, IntelBroker claims to have breached the database of the Los Angeles International Airport, making off with a trove of confidential user data belonging to private plane owners – The breach, according to the hacker, took place in February 2024.

It is important to note that no customer or traveller data is involved in this breach. However, the incident has apparently resulted in the compromise of a significant 2.5 million records, including sensitive information such as:

*   Full names
*   CPA numbers
*   Email addresses (1.9 million emails – total 15,8000 emails after removing duplicates).
*   Company names
*   Plane model numbers
*   Tail numbers (Refers to an identification number painted on an aircraft tail).

Data analysed by Hackread.com

The breach was publicly disclosed by IntelBroker on the notorious hacker and cybercrime platform Breach Forums, adding another high-profile hack to their already extensive. Notable targets of IntelBroker’s previous hacks include the Weee! Grocery platform, General Electric, Staffing Giant Robert Half, and a recent data leak involving a partial Facebook Marketplace database.

Upon learning of the breach, Hackread.com promptly reached out to IntelBroker, who confirmed their involvement and provided limited insight into their methods. According to IntelBroker, they exploited a vulnerability in the airport’s Customer Relationship Management (CRM) system (CRM system) to gain unauthorized access to the database, highlighting the critical need for organizations to strengthen their cybersecurity measures in the face of growing threats from skilled hackers like IntelBroker.

The screenshot below, obtained from Breach Forums, displays the listing of the data breach. It is important to highlight that the breach details attribute the hack to a user named “kwillsy.” However, in a statement to Hackread.com, IntelBroker clarified that “kwillsy” is not associated with the breach, and they take full responsibility for the hack.

Screenshot credit: Hackread.com

Hackread.com has contacted the relevant authorities at the LA Airport, and this article will be updated accordingly pending their response.

****Increasing Data Breaches****

During the initial months of 2024, there has been a marked surge in data breaches impacting various sectors, encompassing both corporate entities and governmental bodies. Last week, Infosys disclosed a breach that affected more than 57,000 Bank of America customers.

In earlier weeks of the same month, two prominent US insurance firms, Washington National Insurance Company and Bankers Life and Casualty Company, reported breaches linked to SIM-swapping incidents, impacting over 66,000 customers collectively.

In January, Jason’s Deli encountered a significant breach, exposing the personal details of over 344,000 users due to a successful credential-stuffing attack. Concurrently, hackers targeted Indian ISP Hathway, compromising the personal information and KYC records of over 4 million unsuspecting customers.

****RELATED ARTICLES****

1.  **23andMe blames its users for the massive data breach**
2.  **AnyDesk Urges Password Change Amid Security Breach**
3.  **Defunct Ambulance Service Data Breach Impacts 1 Million**
4.  **Los Angeles Traffic Sign hacked with an awesome message**
5.  **Cloudflare Hacked After State Actor Leverages Okta Breach**
6.  **RingGo Owner EasyPark Hit by Data Breach, User Data Stolen**

Hackers Leak 2.5M Private Plane Owners’ Data Linked to LA Intl. Airport Breach

By Uzair Amir
The world of cryptocurrency is unpredictable yet lucrative. Understanding the workings and creation of crypto is a topic…
This is a post from HackRead.com Read the original post: The Future of MATIC and What to Expect in 2024

The world of cryptocurrency is unpredictable yet lucrative. Understanding the workings and creation of crypto is a topic for another day, as it involves technical processes such as mining, which utilizes specialized hardware and software to add transactions to the Blockchain.

Bullrun, which took place in 2021, was a bit tricky for many traders out there. Some coins went up in price. Some cryptos fell. The value for MATIC decreased by approximately 11% in 2022. However, it went up by around 6% in 2023.

What will happen next with this coin? Will it keep increasing its price? Is it the right time to exchange MATIC for ATOM? Or will it eventually go down again in its value? Well, the honest answer to these questions is that nobody knows for sure.

However, in this article, we will dig deeper into predictions regarding the value of MATIC for the next 5 and 10 years. Are you ready to explore these intriguing insights? Let’s dive in.

Here, it is important to explain that MATIC, often referred to as Polygon, is a Layer 2 scaling solution built on top of the Ethereum blockchain. Its primary purpose is to address the scalability issues that Ethereum currently faces, such as high transaction fees and slow processing times.

****How Much Will Polygon Cost in 2024?** **

Experts from Changelly.com assume that the Polygon value will grow in 2024. Some analysts say that the minimum price for MATIC in 2024 will be 1.16 USD per 1 coin. At the same time, the prediction of the maximum value reveals that MATIC could cost 1.32 USD per coin. 

In January 2024, it can go up a little bit. Its value is likely to be 0.867 USD. Polygon is still expected to grow slowly in February, March, and April. Most probably, it’ll cost 1.03 USD in May. In September, it’ll be available for 1.20 USD. Finally, at the end of the year, Polygon will reach the point of 1.32 USD per 1 coin.   

****What Will Happen in 2028?** **

Different experts share different opinions regarding this. Let’s check them one by one. 

*   According to Coinpedia, the highest possible value of Polygon will be 6.504 per coin. At the same time, crypto pros from this site share their opinion on the lowest possible cost of MATIC in 2028. They believe it is going to be 5.666 USD.
*   What about the prediction made by AMBCrypto? These guys think the cost of this crypto will be somewhere between $5.10 and $5.45 per 1 coin in 2028. These will be the minimum and the maximum prices accordingly. 
*   Cryptonewsz has a different estimation. They believe the value of MATIC will be somewhere around $4.93. They assume that it will be able to go up to $6.23 in the best-case scenario. Its average price is going to be $5.07. 
*   The next comes the prediction from Changelly. They state people will trade Polygon for approximately $5.07 per 1 coin in 2028. In their opinion, $6.23 per 1 coin will be the highest amount of money people want to pay for Polygon. On the other hand, $4.93 will be the lowest possible price. 
*   Finally, Gov Capital has no rough numbers to share regarding the MATIC value prediction in 2028. However, they believe MATIC could be worth $1.237 in 5 years.

Thus, as you can see, most predictions tell us that the average MATIC cost in 2028 will be either $5 or $5.66. With such uncertainty, many traders will want to stick to stablecoins and exchange BTC for USDT. 

****What Will be the Price for MATIC in 2033?** **

 Let’s wrap this up with the prediction for 2033. What is going to happen to Polygon in 2033? That’s an intriguing question to explore. In fact, during our research, we’ve discovered that not so many sites are willing to make such long-term predictions. 

Coindataflow is the only site that has made such estimates for 2033. They believe that the price of Poygon will grow by a staggering 2311.21% in the best-case scenario! Thus, it will be worth $12.55 in 2023. 

****Final Words****

In this short blog, we’ve covered all the major predictions for Polygon prices for the next year. We’ve also explored estimates of how much it could cost in 2028 and 2033. Hopefully, now you are well-versed in this regard. However, we always underline the importance of doing your own research. It’s also good to be very cautious when it comes to finances.

_**Disclaimer:** This article is for informational purposes only and should not be considered financial advice. Please consult with a qualified financial professional before making any investment decisions._

****RELATED ARTICLES****

1.  **The Rise of Blockchain Gaming and Secure Marketplaces**
2.  **Investing in Ethereum Blockchain-based JasmyCoin: Guide**
3.  **Signal21 Beta Bridges Gap in Blockchain Intelligence Services**

The Future of MATIC and What to Expect in 2024

By Uzair Amir
Signal21, Inc., a blockchain intelligence and data analysis platform, has announced its beta launch marking a significant milestone…
This is a post from HackRead.com Read the original post: Signal21 Beta Launch Bridges Gap in Blockchain Intelligence Services

Signal21, Inc., a blockchain intelligence and data analysis platform, has announced its beta launch marking a significant milestone within the domain of blockchain technology. Signal21 is known for providing blockchain data and intelligence services to businesses and individuals. The company offers a variety of features, including the following:

*   **Market data:** Track cryptocurrency prices, volumes, and market trends.
*   **On-chain analytics:** Analyze on-chain data to identify investment opportunities and track market activity.
*   **Compliance tools:** Help businesses comply with anti-money laundering (AML) and know-your-customer (KYC) regulations.
*   **Research reports:** Get insights from industry experts on the latest trends in the blockchain space.

****Signal21 and Bitcoin Economy****

The Bitcoin ecosystem has witnessed an unprecedented surge in activity following the Ordinals phenomenon, emphasizing the critical need for reliable on-chain data across various Bitcoin layers and projects.

In response to this demand, Signal21 claims to have emerged as a solution, offering a centralized hub for Bitcoin research and data aggregation. Signal21 aims to bridge the gap by providing comprehensive information on Bitcoin L1, Bitcoin L2s, and Bitcoin Dapps, catering to the evolving needs of the growing Bitcoin community.

Furthermore, the recent success of the Bitcoin ETF has propelled institutional investors into the Bitcoin space, with many acquiring substantial amounts of Bitcoin. In light of this development, Signal21 positions itself as a guiding beacon for institutional investors, offering assistance in navigating the complexities of the Bitcoin domain.

By leveraging its powerful insights and sophisticated tools, Signal21 aims to empower institutional investors to explore various avenues for utilization and yield generation on their Bitcoin investments. As the Bitcoin market continues to evolve, Signal21 stands ready to support individual and institutional players in maximizing their potential within this dynamic ecosystem.

In a blog post published February 23, 2024, Jonathan Sadlowe Co-founder & CEO at Signal21 stated that “Signal21 brings on-chain data across the layers of the Bitcoin Economy into one place, and empowers two distinct customer segments: Bitcoin investors and Bitcoin builders.”

****Blockchain and Signal21****

Blockchain technology offers transparency and immutability, meaning data is readily available for all participants and cannot be tampered with. However, raw data on the blockchain can be vast and complex, making it difficult to understand and derive meaningful insights. This is where companies like Signal21 enter to provide essential insights and tools for navigating the decentralized space.

As blockchain networks grow, comprehensive data analytics becomes increasingly crucial. These platforms offer real-time information about transactions, network activity, and smart contract interactions, enabling informed decision-making and risk management.

Moreover, they support research and development efforts by supplying valuable data for analyzing trends, identifying opportunities, and optimizing blockchain protocols. Overall, a robust blockchain data and intelligence platform enhances transparency, efficiency, and innovation within the blockchain domain.

Signal21 Beta Launch Bridges Gap in Blockchain Intelligence Services

By Deeba Ahmed
In 2024, over 60 countries worldwide are holding elections. The most significant threat to the integrity of these elections? Deepfake videos, readily accessible on the dark web and Telegram, with prices ranging from as low as $2 to $100.
This is a post from HackRead.com Read the original post: Deepfake Threat: $2 Deceptive Content Undermines Election Integrity

Deepfake technology poses a significant threat to the upcoming US elections as it is not just a technological challenge but a manifestation of a broader deception mechanism, explained Check Point Research (CPR).

In its latest report, cybersecurity researchers at Check Point Research team highlighted the dangers posed by the widespread availability of artificial intelligence-based technologies, particularly deepfake, in encouraging electoral fraud.

Researchers cited deepfake technology as a significant threat to the authenticity of the electoral process due to features like voice cloning that can manipulate voters and sabotage the entire process. The technology is cheap, accessible to anyone with an internet connection, and untraceable, which hinders election security given the ongoing challenges in legislating against these technologies.

**Deepfake** technology allows users to create “fabricated audiovisual content,” which poses a threat to public opinion and democratic institutions, researchers noted. With over 3,000 repositories on GitHub and hundreds of channels on Telegram (at least 400-500), deepfake services range from automated bots to personalized services. Pricing varies from $2 per video to $100 for multiple attempts, making it affordable to commission deceptive content.

Recent incidents of damage caused by deepfake technology highlight its growing threat. **In February 2024**, an Asian company fell victim to scammers who impersonated the company’s CFO during an online meeting, resulting in a loss of over $25 million.

On platforms like YouTube, deepfake technology is being exploited by scammers to perpetrate crypto scams. Verified channels have been targeted **to steal millions of dollars worth of crypto**, with deepfakes of prominent figures such as Elon Musk, Bill Gates, Ripple’s CEO Brad Garlinghouse, Michael J. Saylor, and others being used to deceive unsuspecting viewers.

**In June 2023**, deepfake technology was utilized to disseminate fabricated video messages from President Putin. Similarly, **in 2022**, a deepfake video of Ukrainian President Zelensky went viral, urging Ukrainians to surrender.

Despite efforts to combat deepfakes, such as the launch of **McAfee’s tool MockingBird**, which boasts a 90% accuracy rate in detecting malicious content, the potential damage from deepfake technology remains considerable and, in many cases, irreversible.

“The potential for election fraud through the adept use of artificial intelligence and deepfake technologies, orchestrated by a clandestine network operating from the shadows, leaving no digital fingerprints” Check Point Research Team wrote in the **blog post** published on 22 February 2024.

Researchers noted that an underground network of actors can manipulate public perception and undermine democratic integrity through deepfakes. The anonymity of this technology makes it difficult to hold anyone accountable. **Traditional cybersecurity measures** are insufficient as the threat lies in the entire ecosystem of deception it enables, including bots, fake accounts, and anonymized services.

**Voice cloning**, a subset of deepfake technology that uses machine learning and artificial intelligence to replicate a person’s voice with remarkable accuracy, is particularly effective in spreading misinformation. It allows the creation of convincing fake audio clips and is particularly effective in spreading misinformation, as incidents involving robocalls with fabricated messages from political leaders have already been observed.

For instance, a robocall featuring fake US President **Joe Biden voice warning** New Hampshire voters not to cast their ballots would cost from $10 to several hundred dollars depending on the level of accuracy and technological efficacy required.

To protect democratic processes from deepfakes, a multifaceted approach involving legislative measures, public awareness, technological solutions, and international cooperation is needed, including enhanced digital literacy and collaboration between technology companies and law enforcement, researchers concluded.

1.  **Website uses AI to create utterly realistic human faces**
2.  **Fake Voicemails Target Users, 1000 Attacks in 14 Days**
3.  **Scammers Weaponize Google Forms in New BazarCall Attack**
4.  **Scammers Made Deepfake AI Hologram of Binance Executive**
5.  **Building Defense Toolbox: Tools, Tactics to Combat Cyber Threats**

Deepfake Threat: $2 Deceptive Content Undermines Election Integrity

Microsoft has released an open access automation framework called PyRIT (short for Python Risk Identification Tool) to proactively identify risks in generative artificial intelligence (AI) systems.
The red teaming tool is designed to "enable every organization across the globe to innovate responsibly with the latest artificial intelligence advances," Ram Shankar Siva Kumar, AI red team

Microsoft Releases PyRIT - A Red Teaming Tool for Generative AI

The US Congress was preparing to vote on a key foreign surveillance program last week. Then a wild Russian threat appeared.

A decision by US House Intelligence Committee (HPSCI) chair Mike Turner to sound the alarm over space-based Russian military research was far more extraordinary than previously reported.

A WIRED review of an internal messaging system used by the United States Congress shows that HPSCI rarely sends members invites to review classified documents and has not—in at least 15 years—alarmed lawmakers by announcing an “urgent” threat against the United States.

The Dear Colleague system is widely used by congressional committees and lawmakers individually to circulate internal memos, invites, and other announcements. This week, WIRED obtained all messages sent House-wide by HPSCI since 2009. Copies of Dear Colleague messages sent since then are backed up by the system. The source of the messages was granted anonymity because their disclosure was not authorized.

The messages reveal that only on a handful of occasions has HPSCI sent letters informing members of classified documents available for review. Of those, none had previously demanded “urgent” attention.

The urgency with which Turner and other HPSCI members characterized the disclosure—only later revealed to concern Russian military research—has been downplayed by fellow lawmakers and Biden administration officials. As a result, criticism has fallen on Turner over the announcement, which generated a slew of provocative headlines and gave life to vague concerns by US officials over the protection of classified sources and methods.

A _Washington Post_ headline that remains visible to users on Google wildly declares: “U.S. officials say Russia has deployed a nuclear weapon in space.” Covering the story for CNN, national security reporter Jim Sciutto was far more tempered, telling TV viewers: “This is something that Russia is experimenting with, looking into designing. This is not a clear and present danger.”

Democratic representative Seth Moulton, who serves on the Armed Services Committee, lambasted Turner during the same CNN segment, labeling him an “intelligence leaker.” Moulton added that two years had passed since he’d first been briefed on the Russian research. “I haven’t had a problem keeping it a secret,” he said.

WIRED reported on Friday that sources on Capitol Hill had begun accusing Turner and his Democratic counterpart on HPSCI, Jim Himes, of issuing the disclosure to influence a vote happening simultaneously to reauthorize a controversial surveillance program, Section 702 of the Foreign Intelligence Surveillance Act (FISA). Turner and Himes, after both signing the “Dear Colleague” message the night before, failed to appear at a Rules Committee hearing on Wednesday just as news of the Russian threat went viral.

House speaker Mike Johnson abruptly canceled the vote shortly after, under what sources describe as intense pressure from Turner.

HSCPI spokesperson Jeff Naft—who did not respond to an inquiry prior to WIRED’s story on Friday—later refuted the allegation, calling the implication of ties between the surveillance vote and the Russian intel “way off base.”

The spokesperson said it was a screenshot of HPSCI’s Dear Colleague letter—posted by reporters online less than a day after it was sent—that forced Turner to issue a press release about the supposed Russian threat.

Turner’s press release notably went further than HPSCI’s letter, pressing US president Joe Biden to personally “declassify all information” concerning the threat. The next day, Turner issued a second statement declaring he’d worked closely “with the Biden administration” before notifying Congress. Naft, the HPSCI spokesperson, clarified by email that Turner had worked with the Office of the Director of National Intelligence on the language describing the threat contained in the Dear Colleague letter. (Naft stressed Turner had “NEVER” stated he’d cooperated with the White House.)

Turner’s second statement added that HPSCI had voted 23–1 to make the disclosure. According to the committee’s own rules, a vote is not required to bring classified material to the attention of the chairmen and ranking members of other committees; only House-wide alerts require a vote. It is unclear which HPSCI member voted against the disclosure, as no official roll call was taken.

A senior congressional source tells WIRED the Dear Colleague letter was always destined to cause panic. It is widely understood that the letters are not a secure form of communication and are often disclosed to reporters and others working off the Hill.

Only four times in the past decade and a half, according to WIRED’s review of the system, has HPSCI used a Dear Colleague letter to draw attention to classified material—outside of routine budgetary concerns.

The first such message is dated March 2009 and pertains to two classified Central Intelligence Agency (CIA) reports. The subject of the reports is undeclared. A second letter was issued by HPSCI and signed by former congressperson Devin Nunes on January 10, 2017, informing members of a classified report on “Russian activities and intentions in the recent US election.”

Neither letter is marked urgent.

A third letter informing members about the option to review classified material is dated February 24, 2010; however, it makes clear the material was made available at the request of the intelligence community (IC). It is one of numerous letters in which HPSCI is seen lobbying on the spy agencies’ behalf—in this case, to support a renewal of the 9/11-era USA PATRIOT Act, today defunct due to a lack of support in Congress.

A plurality of HPSCI’s Dear Colleague letters are aimed at whipping support for bills that reauthorize or advance US spy powers. Others urge lawmakers to vote against legislation that would enhance Americans’ privacy protections. One such letter reads simply: “Don’t Handcuff the FBI and Intelligence Community.”

Six other letters are invitations to classified briefings held by intelligence agencies. HPSCI routinely acts as a mediator between the agencies and members of Congress, arranging briefings and other events on the intelligence community’s behalf.

HPSCI sent an additional three Dear Colleagues letters the morning after its “urgent” warning about Russia went out: Each asked members to support various amendments to a FISA bill during an upcoming vote that HPSCI’s chair was, simultaneously, working to get called off.

Sources told WIRED that Johnson’s decision to delay the vote on FISA came amid a sudden threat by Turner to kill the bill the moment it got to the floor. Turner was motivated to stop the bill’s progress at any cost, they said, due to the growing odds of a rival committee passing amendments of their own—to dramatically curtail the FBI’s domestic surveillance abilities.

_Updated 2/22/2024, 3:55 pm EST: Clarified the procedural requirements for bringing classified information to the attention of members of the House of Representatives._

Leak Reveals the Unusual Path of ‘Urgent’ Russian Threat Warning

Fake news, disinformation, misinformation – whatever label you want to put on it – will not just go away if one election in the U.S. goes one way or the other.

Thursday, February 22, 2024 14:00

When we talk about the term “fake news,” most people likely picture a certain person who made the term infamous. 

And when we talk about misinformation and disinformation, many will remember the “Russian troll farms” that popped up during the 2016 U.S. presidential election and were unmasked and shut down during former president Barack Obama’s final days in office. 

But a few recent actions from TikTok, the most popular online social media platform, show that the problem of spreading misinformation and disinformation goes far beyond the borders of the U.S. 

TikTok announced last week it was launching in-app “election centres” to help combat misinformation and inform users of facts when they view videos about elections in European Union nations. This includes 27 unique apps that all use the country’s native language.  

In a statement on their site, the social media company said this effort is to “ensure people can easily separate fact from fiction.” 

Part of me can’t help but wonder if this wasn’t a problem of the company’s own creation after they allowed misinformation about the COVID-19 global pandemic to spread rapidly and use an algorithm that enhances “controversial” videos about different international brands. But I can certainly hope that these election centres provide more context than the little info box Twitter launched a while ago.  

I think this is important to note, though, that this problem just goes beyond American culture. Fake news, disinformation, misinformation – whatever label you want to put on it – will not just go away if one election in the U.S. goes one way or the other. It is an issue that is spreading on all platforms in all countries. 

I’ve been at fault in the past for just wanting to put the blame on Twitter. While they have been one of the worst offenders of allowing misinformation on their site, they are far from the only offenders or the only platform where users can spread this time of misinformation, even if they are doing it by accident. 

Just like any other platform, it’s easy for someone on TikTok to simply “share” or “like” someone else’s video if they find it compelling without giving it a second thought. Your friends and family are likely spreading misinformation on their feeds without even knowing it or doing it with any malicious intent. Regardless of where you live in the world, this is likely true. 

It’s amplified in the U.S. because our political theater is such that when something happens, everyone else on the world stage notices it. I can’t say that folks in the U.S. are necessarily invested in the national elections in Greece.  

But if misinformation is allowed to spread during the Greek elections, it’s going to spread to U.S. presidential elections. Once the infrastructure is in place for disinformation to flourish on a platform, it’s nearly impossible to get rid of, no matter the topic.  

**The one big thing **

Google Cloud Run is currently being abused in high-volume malware distribution campaigns, spreading several banking trojans such as Astaroth (aka Guildma), Mekotio and Ousaban to targets across Latin America and Europe. The volume of emails associated with these campaigns has significantly increased since September 2023 and we continue to regularly observe new email distribution campaigns. We have observed all three malware families being delivered during the same timeframe from the same storage bucket within Google Cloud. 

**Why do I care? **

Some of the highest volume campaigns recently observed were being used to deliver the Astaroth, Mekotio, and Ousaban banking trojans to victims largely located in Latin American countries. We have also observed lower volume campaign victims located throughout Europe and North America, which may indicate less geographically focused targeting by threat actors moving forward. For example, the current variant of Astaroth targets more than 300 institutions across 15 Latin American countries. 

**So now what? **

Talos has released new ClamAV signatures and Snort rules to protect against these various banking trojans. Our researchers have also alerted Google of this activity so that they may address it internally on Cloud Run. 

**Top security headlines of the week **

**Poland is launching a formal investigation into whether its former government leaders misused the Pegasus spyware.** Parliament created a coalition to see if the Law and Justice (PiS) government, previously the ruling party of Poland, used the controversial spyware to track and target its political opponents. Current ruling leaders used a promise of an investigation as one of their top campaign platforms. Meanwhile, NSO Group, the creators of Pegasus, have reportedly created a new one-click exploit called “MMS Fingerprint” that it offers as an infection tool for the spyware. MMS Fingerprint allows Pegasus users to learn a great deal about a target Blackberry, iPhone or Android device by sending a specially crafted Multimedia Messaging Service (MMS) message. A contract between an NSO Group reseller and a customer in Ghana exposed the information, including a promise that MMS Fingerprint required “No user interaction, engagement, or message opening ... to receive the device fingerprint.” (Politico, DarkReading) 

**The spyware startup Variston is reportedly shrinking and is preparing to completely close.** Variston is known for launching spyware that can target iPhones, Android devices and some PCs. A disgruntled employee reportedly leaked information about the company and the zero-day exploits they used to Google’s Threat Analysis Group, which allowed Google to unmask the operation. This eventually led to several employees and developers leaving Variston. Variston, founded in 2018, previously used three zero-day vulnerabilities to target Apple devices, including a campaign in March 2023 to target iPhones in Indonesia. Reporters and researchers have yet to find who, exactly, Variston sold their services and technology to, though former employees have said some of the spyware was sent to the United Arab Emirates. (Tech Crunch, Google) 

**Volt Typhoon, a large APT based in China, is reportedly still exfiltrating sensitive information on operational technology (OT) networks.** Volt Typhoon has been known to target organizations in the communications, manufacturing, utility, IT and education sectors across the globe, though it’s recently become more noteworthy for its targeting of critical networks in the U.S. A new report from cybersecurity firm Dragos says that it spotted Volt Typhoon conducting scanning activities against electric companies between November and December 2023. Volt Typhoon is traditionally known for espionage and data theft on behalf of the Chinese government. But Dragos also says that the actor has also recently infiltrated a large U.S. city's emergency services network, as well as critical infrastructure networks in Africa. The report states that the OT data stolen may cause “unintended disruption to critical industrial processes or provide the adversary with crucial intelligence to aid in follow-up offensive tool development or attacks against ICS networks.” (SecurityWeek, The Register) 

**Can’t get enough Talos? **

*   Talos Takes Ep. #172: Case study: How Talos IR helped a healthcare tech company avoid a ransomware attack 
*   How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity 
*   Network infrastructure was a prime target for cyber threats in 2023 
*   Russian APT Turla Wields Novel Backdoor Malware Against Polish NGOs 
*   Turla hackers backdoor NGOs with new TinyTurla-NG malware 

**Upcoming events where you can find Talos **

**S4x24** **(March 4 - 27)** 

Miami Beach, Florida 

_To protect themselves during Russian aggression, the Ukrainian military utilizes electronic warfare to blanket critical infrastructure to defeat radar and GPS-guided smart munitions. This has the unintended consequence of disrupting GPS synchrophasor clock measurements and creating service outages on an already beleaguered and damaged transmission electric grid. Joe Marshall from Talos’ Strategic Communications team will tell an incredible story of how a group of engineers and security professionals from a diverse coalition of organizations came together to solve this electronic warfare GPS problem in an unconventional technical way, and helped stabilize parts of the transmission grid of Ukraine._ 

**RSA** **(May 6 - 9)** 

_San Francisco, California_ 

**Most prevalent malware files from Talos telemetry over the past week **

**SHA 256:** 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507    
**MD5:** 2915b3f8b703eb744fc54c81f4a9c67f    
**Typical Filename:** VID001.exe    
**Claimed Product:** N/A    
**Detection Name:** Win.Worm.Coinminer::1201 

**SHA 256:** 6d167aee7013d61b0832937773cd71d77493a05d6ffb1849bdfb1477622e54c2   
**MD5:** 36503fd339663027f5909793ea49ccbc   
**Typical Filename:** telivy\_agent\_2.3.1.exe   
**Claimed Product:** N/A    
**Detection Name:** W32.File.MalParent

**SHA 256:** a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91    
**MD5:** 7bdbd180c081fa63ca94f9c22c457376   
**Typical Filename:** c0dwjdi6a.dll   
**Claimed Product:** N/A    
**Detection Name:** Trojan.GenericKD.33515991 

**SHA 256:** 5616b94f1a40b49096e2f8f78d646891b45c649473a5b67b8beddac46ad398e1      
**MD5:** 3e10a74a7613d1cae4b9749d7ec93515      
**Typical Filename:** IMG001.exe      
**Claimed Product:** N/A      
**Detection Name:** Win.Dropper.Coinminer::1201 

**SHA 256:** 59f1e69b68de4839c65b6e6d39ac7a272e2611ec1ed1bf73a4f455e2ca20eeaa     
**MD5:** df11b3105df8d7c70e7b501e210e3cc3     
**Typical Filename:** DOC001.exe     
**Claimed Product:** N/A     
**Detection Name:** Win.Worm.Coinminer::1201

TikTok’s latest actions to combat misinformation shows it’s not just a U.S. problem

More and more ransomware gangs are using RMM tools in their attacks.

One of the most alarming trends our ThreatDown Intelligence team has noticed lately is the increased exploitation of legitimate Remote Monitoring and Management (RMM) tools by ransomware gangs in their attacks.

RMM software, such as AnyDesk, Atera, and Splashtop, are essential for IT administrators to remotely access and manage devices within their networks. Unfortunately, ransomware gangs can also exploit these tools to penetrate company networks and exfiltrate data, effectively allowing them to “live off the land”.

In this post, we will delve into how ransomware gangs use RMM tools, identify the most exploited RMM tools, and discuss how to detect and prevent suspicious RMM tool activity using Application Block and Endpoint Detection and Response (EDR).

**How ransomware gangs utilize RMM tools**

Ransomware gangs exploit Remote Monitoring and Management (RMM) tools through one of three main strategies:

1.  **Gaining initial access via preexisting RMM tools**: As RMM tools typically require credentials for system access, attackers can exploit weak or default RMM credentials and vulnerabilities to gain unauthorized access to a network.
2.  **Installing RMM tools post-infection**: Once inside a network, ransomware attackers can install their own RMM tools to maintain access and control, setting the stage for a ransomware attack. For example, the ThreatDown Intelligence team noted a case where ransomware attackers exploited an unpatched VMWare Horizon server to install Atera.
3.  **Hybrid approach**: Attackers can use a slew of different social engineering scams, such as technical support scams or malvertising, to trick employees into installing RMM tools onto their own machines, enabling both initial access and a mechanism for ransomware deployment. The Barclays banking scam we wrote about in February 2024 is an example of this approach.

**Top RMM tools exploited by ransomware gangs**

The following RMM tools are commonly used by both ransomware gangs to oversee and control IT infrastructure remotely.

*   **Splashtop**: A remote access and support solution tailored for businesses, MSPs, and educational institutions. Exploited by the ransomware gangs CACTUS, BianLian, ALPHV, Lockbit.
*   **Atera**: An integrated RMM tool for MSPs that offers remote access, monitoring, and management. Exploited by Royal, BianLian, ALPHV.
*   **TeamViewer**: A software for remote access and support. Exploited by BianLian.
*   **ConnectWise**: A suite that includes solutions for remote support, management, and monitoring. Exploited by Medusa.
*   **LogMeIn**: Provides secure remote access to computers from any location for IT management and support. Exploited by Royal.
*   **SuperOps**: An MSP platform that combines RMM, PSA, and other IT management features. Exploited by CACTUS.

Nearly all of the ten ransomware gangs have included one of the above RMM tools in their attacks.

**Preventing RMM ransomware attacks with Application Block and EDR**

To prevent ransomware gangs from misusing RMM tools, businesses can adopt two strategies: blocking unnecessary RMM tools using application blocking software and utilizing EDR to detect suspicious RMM tool activity.

For instance, by employing applications like ThreatDown’s Application Block, businesses can prevent the use of non-essential RMM applications.

For necessary tools, such as AnyDesk, the EDR/MDR layers within ThreatDown Bundles can offer an additional layer of protection in case of an infection.

Consider a real example where ransomware attackers used AnyDesk to establish a Command and Control (C&C) server. In one case, a threat actor infiltrated a customers environment by exploiting an unpatched server with open ports exposed to the internet. AnyDesk was installed by the threat actor afterward, as indicated in the EDR alert below. Such activity is typical of what our Threat Intel teams observe just before the widespread encryption carried out in ransomware attacks.

EDR detecting malicious RMM tool usage, with relevant MITRE techniques

After investigating the alert, however, a customer can quickly isolate the affected endpoint to prevent encryption. Alternatively, the ThreatDown MDR service can identify the alert and offer guidance on remediation.

**Stop ransomware RMM attacks today**

Much like other Living Off the Land tools designed to facilitate IT administration, RMM tools are now double-edged swords.

Whether using RMM tools for initial access, post-infection ransomware deployment, or a combination of the two, ransomware attackers are upping the sophistication of their attacks. However, with ThreatDown, organizations can effectively curtail the abuse of RMM tools through technologies like Application Block and EDR.

Discover the difference with ThreatDown Bundles and elevate your organization’s defense against cyber threats. Get in touch for a free trial and experience the benefits of a simplified, yet robust, security framework.

 Why ransomware gangs love using RMM tools—and how to stop them 

A new data leak that appears to have come from one of China's top private cybersecurity firms provides a rare glimpse into the commercial side of China's many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage campaigns to the nation's burgeoning and highly competitive cybersecurity industry.

A new data leak that appears to have come from one of China’s top private cybersecurity firms provides a rare glimpse into the commercial side of China’s many state-sponsored hacking groups. Experts say the leak illustrates how Chinese government agencies increasingly are contracting out foreign espionage campaigns to the nation’s burgeoning and highly competitive cybersecurity industry.

A marketing slide deck promoting i-SOON’s Advanced Persistent Threat (APT) capabilities.

A large cache of more than 500 documents published to GitHub last week indicate the records come from **i-SOON**, a technology company headquartered in Shanghai that is perhaps best known for providing cybersecurity training courses throughout China. But the leaked documents, which include candid employee chat conversations and images, show a less public side of i-SOON, one that frequently initiates and sustains cyberespionage campaigns commissioned by various Chinese government agencies.

The leaked documents suggest i-SOON employees were responsible for a raft of cyber intrusions over many years, infiltrating government systems in the United Kingdom and countries throughout Asia. Although the cache does not include raw data stolen from cyber espionage targets, it features numerous documents listing the level of access gained and the types of data exposed in each intrusion.

Security experts who reviewed the leaked data say they believe the information is legitimate, and that i-SOON works closely with China’s Ministry of Public Security and the military. In 2021, the Sichuan provincial government named i-SOON as one of “the top 30 information security companies.”

“The leak provides some of the most concrete details seen publicly to date, revealing the maturing nature of China’s cyber espionage ecosystem,” said **Dakota Cary**, a China-focused consultant at the security firm **SentinelOne**. “It shows explicitly how government targeting requirements drive a competitive marketplace of independent contractor hackers-for-hire.”

Mei Danowski is a former intelligence analyst and China expert who now writes about her research in a Substack publication called Natto Thoughts. Danowski said i-SOON has achieved the highest secrecy classification that a non-state-owned company can receive, which qualifies the company to conduct classified research and development related to state security.

i-SOON’s “business services” webpage states that the company’s offerings include public security, anti-fraud, blockchain forensics, enterprise security solutions, and training. Danowski said that in 2013, i-SOON established a department for research on developing new APT network penetration methods.

APT stands for Advanced Persistent Threat, a term that generally refers to state-sponsored hacking groups. Indeed, among the documents apparently leaked from i-SOON is a sales pitch slide boldly highlighting the hacking prowess of the company’s “APT research team” (see screenshot above).

i-SOON CEO Wu Haibo, in 2011. Image: nattothoughts.substack.com.

The leaked documents included a lengthy chat conversation between the company’s founders, who repeatedly discuss flagging sales and the need to secure more employees and government contracts. Danowski said the CEO of i-SOON, **Wu Haibo** (“Shutdown” in the leaked chats) is a well-known first-generation red hacker or “Honker,” and an early member of Green Army — the very first Chinese hacktivist group founded in 1997. Mr. Haibo has not yet responded to a request for comment.

In October 2023, Danowski detailed how i-SOON became embroiled in a software development contract dispute when it was sued by a competing Chinese cybersecurity company called **Chengdu 404**. In September 2021, the **U.S. Department of Justice** unsealed indictments against multiple Chengdu 404 employees, charging that the company was a facade that hid more than a decade’s worth of cyber intrusions attributed to a threat actor group known as “APT 41.”

Danowski said the existence of this legal dispute suggests that Chengdu 404 and i-SOON have or at one time had a business relationship, and that one company likely served as a subcontractor to the other.

“From what they chat about we can see this is a very competitive industry, where companies in this space are constantly poaching each others’ employees and tools,” Danowski said. “The infosec industry is always trying to distinguish \[the work\] of one APT group from another. But that’s getting harder to do.”

It remains unclear if i-SOON’s work has earned it a unique APT designation. But **Will Thomas**, a cyber threat intelligence researcher at Equinix, found an Internet address in the leaked data that corresponds to a domain flagged in a 2019 Citizen Lab report about one-click mobile phone exploits that were being used to target groups in Tibet. The 2019 report referred to the threat actor behind those attacks as an APT group called **Poison Carp.**

Several images and chat records in the data leak suggest i-SOON’s clients periodically gave the company a list of targets they wanted to infiltrate, but sometimes employees confused the instructions. One screenshot shows a conversation in which an employee tells his boss they’ve just hacked one of the universities on their latest list, only to be told that the victim in question was not actually listed as a desired target.

The leaked chats show i-SOON continuously tried to recruit new talent by hosting a series of hacking competitions across China. It also performed charity work, and sought to engage employees and sustain morale with various team-building events.

However, the chats include multiple conversations between employees commiserating over long hours and low pay. The overall tone of the discussions indicates employee morale was quite low and that the workplace environment was fairly toxic. In several of the conversations, i-SOON employees openly discuss with their bosses how much money they just lost gambling online with their mobile phones while at work.

Danowski believes the i-SOON data was probably leaked by one of those disgruntled employees.

“This was released the first working day after the Chinese New Year,” Danowski said. “Definitely whoever did this planned it, because you can’t get all this information all at once.”

SentinelOne’s Cary said he came to the same conclusion, noting that the Protonmail account tied to the GitHub profile that published the records was registered a month before the leak, on January 15, 2024.

China’s much vaunted Great Firewall not only lets the government control and limit what citizens can access online, but this distributed spying apparatus allows authorities to block data on Chinese citizens and companies from ever leaving the country.

As a result, China enjoys a remarkable information asymmetry vis-a-vis virtually all other industrialized nations. Which is why this apparent data leak from i-SOON is such a rare find for Western security researchers.

“I was so excited to see this,” Cary said. “Every day I hope for data leaks coming out of China.”

That information asymmetry is at the heart of the Chinese government’s cyberwarfare goals, according to a 2023 analysis by **Margin Research** performed on behalf of the **Defense Advanced Research Projects Agency** (DARPA).

“In the area of cyberwarfare, the western governments see cyberspace as a ‘fifth domain’ of warfare,” the Margin study observed. “The Chinese, however, look at cyberspace in the broader context of information space. The ultimate objective is, not ‘control’ of cyberspace, but control of information, a vision that dominates China’s cyber operations.”

The National Cybersecurity Strategy issued by the White House last year singles out China as the biggest cyber threat to U.S. interests. While the United States government does contract certain aspects of its cyber operations to companies in the private sector, it does not follow China’s example in promoting the wholesale theft of state and corporate secrets for the commercial benefit of its own private industries.

**Dave Aitel**, a co-author of the Margin Research report and former computer scientist at the **U.S. National Security Agency**, said it’s nice to see that Chinese cybersecurity firms have to deal with all of the same contracting headaches facing U.S. companies seeking work with the federal government.

“This leak just shows there’s layers of contractors all the way down,” Aitel said. “It’s pretty fun to see the Chinese version of it.”

New Leak Shows Business Side of China’s APT Menace

By Uzair Amir
Eastern Europe is swiftly rising to prominence in the software development outsourcing sector. This ascendance is marked not…
This is a post from HackRead.com Read the original post: Top Software Development Outsourcing Trends

Eastern Europe is swiftly rising to prominence in the software development outsourcing sector. This ascendance is marked not only by its combination of cost-effectiveness and 1.3 million unparalleled talent but also by the attention it’s receiving from major companies.

Tech giants such as Google, Apple, Microsoft, and successful startups like Spotify and Slack have recognized the potential and established developer teams in the region. And what is the key to the successful establishment of a software development team in Eastern Europe?

At Alcor, we specialize in IT recruitment in EE and Latin America, concentrating primarily on middle, senior, and C-level positions. We cater to IT product companies eager to hire talent from countries like Poland, Romania, and other parts of Eastern Europe. Our commitment to bridging talent needs has positioned us as a go-to for organizations keen on leveraging the region’s tech expertise.

For a more comprehensive insight into IT outsourcing to Eastern Europe, read this article that provides a deeper dive into the region’s growing significance.

****Eastern Europe: The Undisputed IT Outsourcing Hub****

Projected global IT spending is set to reach an astonishing $4.5 trillion by 2023, as per Gartner’s recent forecast. This elevates the importance for businesses to derive maximum value from every penny spent. Validating this trend, 60% of technology companies are turning towards outsourcing partners for a certain portion of their software development needs.

While India and China have been historical leaders in IT outsourcing, there’s a notable drift towards Eastern Europe. This is driven by various factors, chief among them being the pressing concerns over Intellectual Property Rights in countries like China, accompanied by communication barriers and significant time differences. According to a comprehensive study, the Eastern European IT industry is set to grow annually by 7.84%, reaching an impressive $15.70bn by 2027. 

Several factors contribute to this shift:

*   Quality Over Quantity: Eastern Europe is gaining traction due to its emphasis on quality, ensuring that projects aren’t just completed but stand out in a competitive global market.
*   Cultural and Temporal Proximity: Eastern Europe’s closeness to Western European and North American markets means fewer time zone issues and cultural barriers. This streamlines communication and ensures smoother project executions.
*   Educated Workforce: Having over 300 higher education institutions that provide STEM programs (most of which are among the QS World University Rankings 2023), the region has plenty of highly qualified software developers.

But, what are the most significant software development trends in EE?

****A Flourishing IT Landscape in Eastern Europe****

Eastern Europe, encompassing nations such as Poland, Romania, Ukraine, Czech Republic, Hungary, Slovakia, Bulgaria, and Estonia, is swiftly emerging as a heavyweight in the international IT arena. The region’s allure is grounded in a blend of advantageous tax regimes, burgeoning IT advancements, and a vast reservoir of adept professionals. Initiatives from governments, like backing for startups and the proliferation of tech parks and innovation centers, amplify this attraction, spotlighting Eastern Europe as a potential IT powerhouse.

However, it’s the region’s multifaceted technical prowess that truly differentiates it. Poland, for example, is distinguished for its expertise in languages like JavaScript, Java, Python, and TypeScript. Romania excels with skills in PHP, C#, Java, and C++. The Czech Republic showcases deep knowledge in areas such as JavaScript, Java, PHP, and C#. Neighbouring countries like Hungary and Slovakia further enrich the tech tapestry, with commendable skills in areas spanning JavaScript, HTML/CSS, Python, Java, and PHP.

****Understanding the Tax Landscape: Poland, Romania, Bulgaria, and Ukraine****

Bulgaria stands out with its straightforward tax system. Both corporate and personal income taxes are set at a uniform rate of 10%. This simplicity is attractive to many businesses and professionals looking for clarity in fiscal matters.

Poland presents a more nuanced tax structure. CIT is typically 19%, but a reduced rate of 9% is available for smaller entities, barring certain exceptions. Individuals, on the other hand, pay 12% for income up to PLN 120,000. Beyond this threshold, they’re taxed at 32%. Additionally, high earners with an income surpassing PLN 1 million face a solidarity surcharge of 4%.

In Romania, companies face a corporate tax of 16%, while individuals are charged a 10% personal income tax. Ukraine, meanwhile, sets its corporate tax at 18%. The personal income tax is relatively low, standing at 5% for the majority, though there are specific exceptions to this rate.

****Prioritizing Cybersecurity in Outsourcing****

In an age where data breaches and cyber threats loom large, outsourcing shouldn’t be just about getting the job done but also about ensuring it’s done securely. However, IT outsourcing does not always let businesses reach complete security. There are cases when clients risk or even lose their intellectual property rights if they don’t sign an IT rights transfer agreement with their IT outsourcing firm. If they cooperate with IT recruitment or R&D providers, though, this never happens. Meanwhile, Eastern Europe, with its strong emphasis on IT education and rigorous data protection laws (GDPR), ensures that businesses aren’t just given quality work but also the peace of mind that their data remains secure.

****The Talent Over Cost Paradigm****

Although affordability is a compelling consideration, the genuine essence of value is in work quality. In the corporate realm, there’s an escalating recognition that, while trimming expenses is advantageous, skimping on talent could have long-term repercussions. This mindset is evident in Eastern Europe’s recruitment strategies, emphasizing the skills and versatility of professionals over mere hourly compensation.

Moreover, IT recruitment & R&D services companies like Alcor are setting the gold standard in IT recruitment services. Prioritizing talent ensures a symbiotic relationship where businesses get top-tier solutions, and developers get a conducive environment that nurtures their skills.

Such vendors offer IT businesses access to pre-vetted talents with their guarantee of quick and efficient hiring. Plus, software developers hired via such agencies go through a pre-screening interview stage, which boosts the overall quality of candidates. Such practices ensure businesses stay ahead of technological advances and market demands.

****Navigating the IT Talent Retention Challenge****

The global IT landscape isn’t just grappling with the complexities of outsourcing; it’s contending with a deeper issue of employee retention. As highlighted by a recent Gartner survey, a mere 29% of IT professionals express a solid intention to stick with their current roles. In the outsourcing model, frequent project shifts can sometimes make developers feel detached, leading to a decreased perception of value in their work. This transience often prompts them to seek new job opportunities.

Conversely, product-based companies tend to have a different dynamic. Here, developers aren’t just part of the solution-making process but are integral to business growth. Their roles and contributions directly influence their career trajectories and earnings. This sense of purpose and alignment with the company’s growth often translates to higher job satisfaction and longer tenure.

Tag

#intel