#award #cybersecurity
🎉We are proud to announce that Jennifer Soh, Senior Cyber Investigation Specialist, and Kristina Ivanova, Deputy Head of the Group-IB’s Cyber Investigations team in Singapore, have been featured in the list of Top 30 Women in Security ASEAN Region!
Both Kristina and Jennifer are passionate about Group-IB’s mission of fighting against cybercrime which they do on a daily basis. In their roles, they are tasked with identifying and tracking down the most advanced cybercriminals syndicates and helping national police forces in the Asia-Pacific, as well as the international law enforcement organizations, bring threat actors to justice. For instance, Kristina and Jennifer assisted in the most recent INTERPOL-led operations codenamed Falcon I, Falcon II, and Delilah.
More details 👈
🎉We are proud to announce that Jennifer Soh, Senior Cyber Investigation Specialist, and Kristina Ivanova, Deputy Head of the Group-IB’s Cyber Investigations team in Singapore, have been featured in the list of Top 30 Women in Security ASEAN Region!
Both Kristina and Jennifer are passionate about Group-IB’s mission of fighting against cybercrime which they do on a daily basis. In their roles, they are tasked with identifying and tracking down the most advanced cybercriminals syndicates and helping national police forces in the Asia-Pacific, as well as the international law enforcement organizations, bring threat actors to justice. For instance, Kristina and Jennifer assisted in the most recent INTERPOL-led operations codenamed Falcon I, Falcon II, and Delilah.
More details 👈
🔥15❤3👍1👏1
#APT
The state-sponsored hacker group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly), whose goals are cyber espionage and financial gain, has been active since at least 2007. The Group-IB Threat Intelligence team estimates that in 2021 the threat actors gained access to at least 13 organizations worldwide. While analyzing the group’s malicious campaigns, our experts uncovered interesting adversary techniques and artifacts left by the hackers that point to their origin.
Here are some highlights:
▪️The group’s targets include government and private organizations based in the US, Taiwan, India, Thailand, China, Hong Kong, Mongolia, Indonesia, Vietnam, Bangladesh, Ireland, Brunei, and the UK.
▪️APT41’s “working” days are Monday to Friday. They usually start at 10 AM and finish around 7 PM (UTC+8).
▪️As an initial vector, the group uses web applications vulnerable to SQL injection attacks.
▪️The main tool used in their campaigns is a custom Cobalt Strike Beacon.
The state-sponsored hacker group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly), whose goals are cyber espionage and financial gain, has been active since at least 2007. The Group-IB Threat Intelligence team estimates that in 2021 the threat actors gained access to at least 13 organizations worldwide. While analyzing the group’s malicious campaigns, our experts uncovered interesting adversary techniques and artifacts left by the hackers that point to their origin.
Here are some highlights:
▪️The group’s targets include government and private organizations based in the US, Taiwan, India, Thailand, China, Hong Kong, Mongolia, Indonesia, Vietnam, Bangladesh, Ireland, Brunei, and the UK.
▪️APT41’s “working” days are Monday to Friday. They usually start at 10 AM and finish around 7 PM (UTC+8).
▪️As an initial vector, the group uses web applications vulnerable to SQL injection attacks.
▪️The main tool used in their campaigns is a custom Cobalt Strike Beacon.
🔥6👎1
Group-IB
#APT The state-sponsored hacker group APT41 (aka BARIUM, Winnti, LEAD, WICKED SPIDER, WICKED PANDA, Blackfly, Suckfly), whose goals are cyber espionage and financial gain, has been active since at least 2007. The Group-IB Threat Intelligence team estimates…
#APT #FightAgainstCybercrime
Want to learn more about the notorious APT41 group? Check out our latest blog post which details how the hackers conducted reconnaissance, gained initial access, ensured persistence and moved across the network, as well as what they were looking for on the compromised devices. In the conclusion section, we give advice on how to identify the group’s infrastructure and protect yours. IT directors, heads of cybersecurity teams, SOC analysts and incident response specialists are likely to find this material useful. Read👈
If you are interested in what we do and would like to become an expert in the same field, you can take our Digital Forensics, Incident Response, and Threat Intelligence training courses. Let’s hunt together for the threats, and contribute to the fight against cybercrime — a mission worthy of a superhero. Click the link👈
Want to learn more about the notorious APT41 group? Check out our latest blog post which details how the hackers conducted reconnaissance, gained initial access, ensured persistence and moved across the network, as well as what they were looking for on the compromised devices. In the conclusion section, we give advice on how to identify the group’s infrastructure and protect yours. IT directors, heads of cybersecurity teams, SOC analysts and incident response specialists are likely to find this material useful. Read👈
If you are interested in what we do and would like to become an expert in the same field, you can take our Digital Forensics, Incident Response, and Threat Intelligence training courses. Let’s hunt together for the threats, and contribute to the fight against cybercrime — a mission worthy of a superhero. Click the link👈
❤4👍2
#phishing #0ktapus
Group-IB has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised.
The campaign was codenamed 0ktapus by Group-IB researchers due to the impersonation of a popular Identity and Access Management service. The vast majority of the victims are located in the United States and use Okta’s Identity and Access Management services.
Group-IB Threat Intelligence team uncovered and analyzed the attackers’ phishing infrastructure, including phishing domains, the phishing kit as well as the Telegram channel controlled by the threat actors to drop compromised information.
Group-IB has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised.
The campaign was codenamed 0ktapus by Group-IB researchers due to the impersonation of a popular Identity and Access Management service. The vast majority of the victims are located in the United States and use Okta’s Identity and Access Management services.
Group-IB Threat Intelligence team uncovered and analyzed the attackers’ phishing infrastructure, including phishing domains, the phishing kit as well as the Telegram channel controlled by the threat actors to drop compromised information.
🔥3👍1👎1
Group-IB
#phishing #0ktapus Group-IB has discovered that the recently disclosed phishing attacks on the employees of Twilio and Cloudflare were part of the massive phishing campaign that resulted in 9,931 thousand accounts of over 130 organizations being compromised.…
#phishing #0ktapus
The primary goal of the threat actors was to obtain Okta identity credentials and two-factor authentication codes from users of the targeted organizations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organization.
The Group-IB team found that the threat actor managed to steal 9,931 user credentials, including 3,129 records with emails, and 5,441 records with MFA codes.
Out of 136 victim organizations that Group-IB was able to identify, 114 companies are in the USA. Most companies on the victims’ list are providing IT, software development, and cloud services.
Want to learn more about 0ktapus campaign and get a list of the indicators of compromise, more insights into the investigation, as well as some recommendations on how to mitigate such attacks? Check out our latest blog post👈
The primary goal of the threat actors was to obtain Okta identity credentials and two-factor authentication codes from users of the targeted organizations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organization.
The Group-IB team found that the threat actor managed to steal 9,931 user credentials, including 3,129 records with emails, and 5,441 records with MFA codes.
Out of 136 victim organizations that Group-IB was able to identify, 114 companies are in the USA. Most companies on the victims’ list are providing IT, software development, and cloud services.
Want to learn more about 0ktapus campaign and get a list of the indicators of compromise, more insights into the investigation, as well as some recommendations on how to mitigate such attacks? Check out our latest blog post👈
🔥6👍3❤1
#cybersecurity #AiteNovarica
We are proud to announce that Group-IB has been named the largest and most experienced Incident Response Retainer (IRR) provider in Aite-Novarica’s recent Impact Report on IRR market players.
Group-IB’s IRR program is based on the company’s track record in responding to cyber incidents for 19 years, involving over 1,300 investigations across 60 countries, and racking up 70,000 hours of hands-on IR experience. According to the Aite-Novarica report, this experience makes Group-IB an outlier seven times over. Group-IB has over 150 active retainer clients, including the top 30 largest banks and financial services firms globally.
Check out the report to learn more👈
We are proud to announce that Group-IB has been named the largest and most experienced Incident Response Retainer (IRR) provider in Aite-Novarica’s recent Impact Report on IRR market players.
Group-IB’s IRR program is based on the company’s track record in responding to cyber incidents for 19 years, involving over 1,300 investigations across 60 countries, and racking up 70,000 hours of hands-on IR experience. According to the Aite-Novarica report, this experience makes Group-IB an outlier seven times over. Group-IB has over 150 active retainer clients, including the top 30 largest banks and financial services firms globally.
Check out the report to learn more👈
🔥5👎1
#webinar
Imagine a huge wave of phishing emails hit your company. How can you be sure that no one opened malicious attachments or links? And what would be the consequences if this happened?
Detonation is the answer. Join our webinar "Having doubts? Detonate! Malware detonation use cases", where we will discuss the preparation of detonation environment, advantages and ways to use detonation in real practice.
Save the date: September 13 at 11 AM (GMT+1) / 2 PM (GMT + 4)
Register 👈
Imagine a huge wave of phishing emails hit your company. How can you be sure that no one opened malicious attachments or links? And what would be the consequences if this happened?
Detonation is the answer. Join our webinar "Having doubts? Detonate! Malware detonation use cases", where we will discuss the preparation of detonation environment, advantages and ways to use detonation in real practice.
Save the date: September 13 at 11 AM (GMT+1) / 2 PM (GMT + 4)
Register 👈
👍2🔥2👎1
#phishing #Steam #CERT
Fraudsters have been creating hundreds of phishing resources mimicking Steam online gaming platform, but most of these websites looked half-baked and users easily spotted a fake.
A new threat emerged out of nowhere, and its name was browser-in-the-browser. Using the browser-in-the-browser phishing technique, hackers create a fake browser window on a phishing resource, which at first glance is indistinguishable from the authentic one. Threat actors decided to take advantage of the fact that Steam uses a pop-up window for user authentication instead of a new tab.
Since browser-in-the-browser technology poses a significant risk to users, Group-IB CERT-GIB specialists decided to analyze it in detail using an example of a phishing kit located on a resource that mimics Steam. Check out our new blog post👈
Fraudsters have been creating hundreds of phishing resources mimicking Steam online gaming platform, but most of these websites looked half-baked and users easily spotted a fake.
A new threat emerged out of nowhere, and its name was browser-in-the-browser. Using the browser-in-the-browser phishing technique, hackers create a fake browser window on a phishing resource, which at first glance is indistinguishable from the authentic one. Threat actors decided to take advantage of the fact that Steam uses a pop-up window for user authentication instead of a new tab.
Since browser-in-the-browser technology poses a significant risk to users, Group-IB CERT-GIB specialists decided to analyze it in detail using an example of a phishing kit located on a resource that mimics Steam. Check out our new blog post👈
🔥4👎1
#cybersecurity #bootcamp
Group-IB took part in Security bootcamp 2022 in Vietnam! For the 10th time the event brought together numerous cyber security experts from across the country. Nam Le, Incident Response and Digital Forensics Analyst, and Anh Le, Business Development Manager, attended the bootcamp and happily provided Group-IB’s expertise. Le Phuong Nam shared a forensic case in his presentation "A money heist".
Thanks for such an amazing event! Sharing the latest knowledge and skills helps cybersecurity community to fight against cyber crime.
Group-IB took part in Security bootcamp 2022 in Vietnam! For the 10th time the event brought together numerous cyber security experts from across the country. Nam Le, Incident Response and Digital Forensics Analyst, and Anh Le, Business Development Manager, attended the bootcamp and happily provided Group-IB’s expertise. Le Phuong Nam shared a forensic case in his presentation "A money heist".
Thanks for such an amazing event! Sharing the latest knowledge and skills helps cybersecurity community to fight against cyber crime.
🔥14❤1👎1
#scam #crypto
💸Crypto giveaway scams continue to soar: Group-IB has noted a fivefold increase in the number of domains used for crypto giveaway scams that involve fake YouTube streams in the first half of 2022. In addition to Vitalik Buterin, Elon Musk, and other crypto celebs, scammers started exploiting the name of Nayib Bukele, the president of Salvador.
Since Group-IB’s first report on the scheme, crypto giveaway scams evolved into an illicit market segment with multiple services that aim to facilitate fraudulent operations. According to Group-IB, 63% of the new fraudulent domain names were registered with Russian registrars, but the fake websites are primarily designed to target English and Spanish-speaking crypto investors in the US and other countries.
In the first six months of 2022, CERT-GIB identified more than 2,000 domains registered explicitly to be used as fake promotion websites.
Want to learn more? Check out our website👈
💸Crypto giveaway scams continue to soar: Group-IB has noted a fivefold increase in the number of domains used for crypto giveaway scams that involve fake YouTube streams in the first half of 2022. In addition to Vitalik Buterin, Elon Musk, and other crypto celebs, scammers started exploiting the name of Nayib Bukele, the president of Salvador.
Since Group-IB’s first report on the scheme, crypto giveaway scams evolved into an illicit market segment with multiple services that aim to facilitate fraudulent operations. According to Group-IB, 63% of the new fraudulent domain names were registered with Russian registrars, but the fake websites are primarily designed to target English and Spanish-speaking crypto investors in the US and other countries.
In the first six months of 2022, CERT-GIB identified more than 2,000 domains registered explicitly to be used as fake promotion websites.
Want to learn more? Check out our website👈
👍6❤2👎1🔥1