#cybersecurity #tips
It is important to follow the cyber safety rules and stay vigilant. However, it is also important to know what to do if you are a victim of cybercrime. Here's a set of recommendations on what steps to take if you've been scammed.
It is important to follow the cyber safety rules and stay vigilant. However, it is also important to know what to do if you are a victim of cybercrime. Here's a set of recommendations on what steps to take if you've been scammed.
🔥4
#MaliBot #trojan
👑 Flubot is dead, and the new evil is detected and crowned, the first of his name – MaliBot. MaliBot malware, usually disguised as a cryptocurrency mining application, targets Android devices and uses overlay attacks to outfox MFA/2FA, capture messages and SMS, and steal banking and crypto credentials.
MaliBot operators harness a variety of distribution campaigns: they promote cryptocurrency applications in the form of APKs that victims are supposed to download and install manually; they clone real projects like TheCryptoApp (1M+ downloads on Google Play Store); operators also use smishing (SMS phishing) and other methods to multiply their chances to succeed.
There are at least two major countermeasures to leverage against such fraud attacks. Check out our new blog post to learn more👈
And also take a look at this live demonstration of how Group-IB Fraud Protection stops MaliBot or other similar threats.
👑 Flubot is dead, and the new evil is detected and crowned, the first of his name – MaliBot. MaliBot malware, usually disguised as a cryptocurrency mining application, targets Android devices and uses overlay attacks to outfox MFA/2FA, capture messages and SMS, and steal banking and crypto credentials.
MaliBot operators harness a variety of distribution campaigns: they promote cryptocurrency applications in the form of APKs that victims are supposed to download and install manually; they clone real projects like TheCryptoApp (1M+ downloads on Google Play Store); operators also use smishing (SMS phishing) and other methods to multiply their chances to succeed.
There are at least two major countermeasures to leverage against such fraud attacks. Check out our new blog post to learn more👈
And also take a look at this live demonstration of how Group-IB Fraud Protection stops MaliBot or other similar threats.
👍5🔥5👏1
#award #cybersecurity
🎉We are proud to announce that Jennifer Soh, Senior Cyber Investigation Specialist, and Kristina Ivanova, Deputy Head of the Group-IB’s Cyber Investigations team in Singapore, have been featured in the list of Top 30 Women in Security ASEAN Region!
Both Kristina and Jennifer are passionate about Group-IB’s mission of fighting against cybercrime which they do on a daily basis. In their roles, they are tasked with identifying and tracking down the most advanced cybercriminals syndicates and helping national police forces in the Asia-Pacific, as well as the international law enforcement organizations, bring threat actors to justice. For instance, Kristina and Jennifer assisted in the most recent INTERPOL-led operations codenamed Falcon I, Falcon II, and Delilah.
More details 👈
🎉We are proud to announce that Jennifer Soh, Senior Cyber Investigation Specialist, and Kristina Ivanova, Deputy Head of the Group-IB’s Cyber Investigations team in Singapore, have been featured in the list of Top 30 Women in Security ASEAN Region!
Both Kristina and Jennifer are passionate about Group-IB’s mission of fighting against cybercrime which they do on a daily basis. In their roles, they are tasked with identifying and tracking down the most advanced cybercriminals syndicates and helping national police forces in the Asia-Pacific, as well as the international law enforcement organizations, bring threat actors to justice. For instance, Kristina and Jennifer assisted in the most recent INTERPOL-led operations codenamed Falcon I, Falcon II, and Delilah.
More details 👈
🔥15❤3👍1👏1
#APT
The state-sponsored hacker group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly), whose goals are cyber espionage and financial gain, has been active since at least 2007. The Group-IB Threat Intelligence team estimates that in 2021 the threat actors gained access to at least 13 organizations worldwide. While analyzing the group’s malicious campaigns, our experts uncovered interesting adversary techniques and artifacts left by the hackers that point to their origin.
Here are some highlights:
▪️The group’s targets include government and private organizations based in the US, Taiwan, India, Thailand, China, Hong Kong, Mongolia, Indonesia, Vietnam, Bangladesh, Ireland, Brunei, and the UK.
▪️APT41’s “working” days are Monday to Friday. They usually start at 10 AM and finish around 7 PM (UTC+8).
▪️As an initial vector, the group uses web applications vulnerable to SQL injection attacks.
▪️The main tool used in their campaigns is a custom Cobalt Strike Beacon.
The state-sponsored hacker group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly), whose goals are cyber espionage and financial gain, has been active since at least 2007. The Group-IB Threat Intelligence team estimates that in 2021 the threat actors gained access to at least 13 organizations worldwide. While analyzing the group’s malicious campaigns, our experts uncovered interesting adversary techniques and artifacts left by the hackers that point to their origin.
Here are some highlights:
▪️The group’s targets include government and private organizations based in the US, Taiwan, India, Thailand, China, Hong Kong, Mongolia, Indonesia, Vietnam, Bangladesh, Ireland, Brunei, and the UK.
▪️APT41’s “working” days are Monday to Friday. They usually start at 10 AM and finish around 7 PM (UTC+8).
▪️As an initial vector, the group uses web applications vulnerable to SQL injection attacks.
▪️The main tool used in their campaigns is a custom Cobalt Strike Beacon.
🔥6👎1
Group-IB
#APT The state-sponsored hacker group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly), whose goals are cyber espionage and financial gain, has been active since at least 2007. The Group-IB Threat Intelligence team estimates…
#APT #FightAgainstCybercrime
Want to learn more about the notorious APT41 group? Check out our latest blog post which details how the hackers conducted reconnaissance, gained initial access, ensured persistence and moved across the network, as well as what they were looking for on the compromised devices. In the conclusion section, we give advice on how to identify the group’s infrastructure and protect yours. IT directors, heads of cybersecurity teams, SOC analysts and incident response specialists are likely to find this material useful. Read👈
If you are interested in what we do and would like to become an expert in the same field, you can take our Digital Forensics, Incident Response, and Threat Intelligence training courses. Let’s hunt together for the threats, and contribute to the fight against cybercrime — a mission worthy of a superhero. Click the link👈
Want to learn more about the notorious APT41 group? Check out our latest blog post which details how the hackers conducted reconnaissance, gained initial access, ensured persistence and moved across the network, as well as what they were looking for on the compromised devices. In the conclusion section, we give advice on how to identify the group’s infrastructure and protect yours. IT directors, heads of cybersecurity teams, SOC analysts and incident response specialists are likely to find this material useful. Read👈
If you are interested in what we do and would like to become an expert in the same field, you can take our Digital Forensics, Incident Response, and Threat Intelligence training courses. Let’s hunt together for the threats, and contribute to the fight against cybercrime — a mission worthy of a superhero. Click the link👈
❤4👍2
#phishing #0ktapus
Group-IB has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised.
The campaign was codenamed 0ktapus by Group-IB researchers due to the impersonation of a popular Identity and Access Management service. The vast majority of the victims are located in the United States and use Okta’s Identity and Access Management services.
Group-IB Threat Intelligence team uncovered and analyzed the attackers’ phishing infrastructure, including phishing domains, the phishing kit as well as the Telegram channel controlled by the threat actors to drop compromised information.
Group-IB has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised.
The campaign was codenamed 0ktapus by Group-IB researchers due to the impersonation of a popular Identity and Access Management service. The vast majority of the victims are located in the United States and use Okta’s Identity and Access Management services.
Group-IB Threat Intelligence team uncovered and analyzed the attackers’ phishing infrastructure, including phishing domains, the phishing kit as well as the Telegram channel controlled by the threat actors to drop compromised information.
🔥3👍1👎1
Group-IB
#phishing #0ktapus Group-IB has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised.…
#phishing #0ktapus
The primary goal of the threat actors was to obtain Okta identity credentials and two-factor authentication codes from users of the targeted organizations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organization.
The Group-IB team found that the threat actor managed to steal 9,931 user credentials, including 3,129 records with emails, and 5,441 records with MFA codes.
Out of 136 victim organizations that Group-IB was able to identify, 114 companies are in the USA. Most companies on the victims’ list are providing IT, software development, and cloud services.
Want to learn more about 0ktapus campaign and get a list of the indicators of compromise, more insights into the investigation, as well as some recommendations on how to mitigate such attacks? Check out our latest blog post👈
The primary goal of the threat actors was to obtain Okta identity credentials and two-factor authentication codes from users of the targeted organizations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organization.
The Group-IB team found that the threat actor managed to steal 9,931 user credentials, including 3,129 records with emails, and 5,441 records with MFA codes.
Out of 136 victim organizations that Group-IB was able to identify, 114 companies are in the USA. Most companies on the victims’ list are providing IT, software development, and cloud services.
Want to learn more about 0ktapus campaign and get a list of the indicators of compromise, more insights into the investigation, as well as some recommendations on how to mitigate such attacks? Check out our latest blog post👈
🔥6👍3❤1
#cybersecurity #AiteNovarica
We are proud to announce that Group-IB has been named the largest and most experienced Incident Response Retainer (IRR) provider in Aite-Novarica’s recent Impact Report on IRR market players.
Group-IB’s IRR program is based on the company’s track record in responding to cyber incidents for 19 years, involving over 1,300 investigations across 60 countries, and racking up 70,000 hours of hands-on IR experience. According to the Aite-Novarica report, this experience makes Group-IB an outlier seven times over. Group-IB has over 150 active retainer clients, including the top 30 largest banks and financial services firms globally.
Check out the report to learn more👈
We are proud to announce that Group-IB has been named the largest and most experienced Incident Response Retainer (IRR) provider in Aite-Novarica’s recent Impact Report on IRR market players.
Group-IB’s IRR program is based on the company’s track record in responding to cyber incidents for 19 years, involving over 1,300 investigations across 60 countries, and racking up 70,000 hours of hands-on IR experience. According to the Aite-Novarica report, this experience makes Group-IB an outlier seven times over. Group-IB has over 150 active retainer clients, including the top 30 largest banks and financial services firms globally.
Check out the report to learn more👈
🔥5👎1