Category: A Little Sunshine

Auto Added by WPeMatico

Late last year, security researchers made a startling discovery: Kremlin-backed disinformation campaigns were bypassing moderation on social media platforms by leveraging the same malicious advertising technology that powers a sprawling ecosystem of online hucksters and website hackers. A new report on the fallout from that investigation finds this dark ad tech industry is far more…

Proxy Services Feast on Ukraine’s IP Address Exodus

June 5, 2025

Image: Mark Rademaker, via Shutterstock. Ukraine has seen nearly one-fifth of its Internet space come under Russian control or sold to Internet address brokers since February 2022, a new study finds. The analysis indicates large chunks of Ukrainian Internet address space are now in the hands of shadowy proxy and anonymity services that are nested…

U.S. Sanctions Cloud Provider ‘Funnull’ as Top Source of ‘Pig Butchering’ Scams

May 29, 2025

Image: Shutterstock, ArtHead. The U.S. government today imposed economic sanctions on Funnull Technology Inc., a Philippines-based company that provides computer infrastructure for hundreds of thousands of websites involved in virtual currency investment scams known as “pig butchering.” In January 2025, KrebsOnSecurity detailed how Funnull was being used as a content delivery network that catered to…

Pakistan Arrests 21 in ‘Heartsender’ Malware Service

May 28, 2025

Authorities in Pakistan have arrested 21 individuals accused of operating “Heartsender,” a once popular spam and malware dissemination service that operated for more than a decade. The main clientele for HeartSender were organized crime groups that tried to trick victim companies into making payments to a third party, and its alleged proprietors were publicly identified…

Oops: DanaBot Malware Devs Infected Their Own PCs

May 22, 2025

The U.S. government today unsealed criminal charges against 16 individuals accused of operating and selling DanaBot, a prolific strain of information-stealing malware that has been sold on Russian cybercrime forums since 2018. The FBI says a newer version of DanaBot was used for espionage, and that many of the defendants exposed their real-life identities after…

KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS

May 20, 2025

KrebsOnSecurity last week was hit by a near record distributed denial-of-service (DDoS) attack that clocked in at more than 6.3 terabits of data per second (a terabit is one trillion bits of data). The brief attack appears to have been a test run for a massive new Internet of Things (IoT) botnet capable of launching…

Breachforums Boss to Pay $700k in Healthcare Breach

May 15, 2025

In what experts are calling a novel legal outcome, the 22-year-old former administrator of the cybercrime community Breachforums will forfeit nearly $700,000 to settle a civil lawsuit from a health insurance company whose customer data was posted for sale on the forum in 2023. Conor Brian Fitzpatrick, a.k.a. “Pompompurin,” is slated for resentencing next month…

Pakistani Firm Shipped Fentanyl Analogs, Scams to US

May 7, 2025

A Texas firm recently charged with conspiring to distribute synthetic opioids in the United States is at the center of a vast network of companies in the U.S. and Pakistan whose employees are accused of using online ads to scam westerners seeking help with trademarks, book writing, mobile app development and logo designs, a new…

xAI Dev Leaks API Key for Private SpaceX, Tesla LLMs

May 1, 2025

An employee at Elon Musk’s artificial intelligence company xAI leaked a private key on GitHub that for the past two months could have allowed anyone to query private xAI large language models (LLMs) which appear to have been custom made for working with internal data from Musk’s companies, including SpaceX, Tesla and Twitter/X, KrebsOnSecurity has learned.…

Alleged ‘Scattered Spider’ Member Extradited to U.S.

April 30, 2025

A 23-year-old Scottish man thought to be a member of the prolific Scattered Spider cybercrime group was extradited last week from Spain to the United States, where he is facing charges of wire fraud, conspiracy and identity theft. U.S. prosecutors allege Tyler Robert Buchanan and co-conspirators hacked into dozens of companies in the United States…

DOGE Worker’s Code Supports NLRB Whistleblower

April 23, 2025

A whistleblower at the National Labor Relations Board (NLRB) alleged last week that denizens of Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of data from the agency’s sensitive case files in early March. The whistleblower said accounts created for DOGE at the NLRB downloaded three code repositories from GitHub. Further investigation into one…

Whistleblower: DOGE Siphoned NLRB Case Data

April 21, 2025

A security architect with the National Labor Relations Board (NLRB) alleges that employees from Elon Musk‘s Department of Government Efficiency (DOGE) transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network activity. The NLRB whistleblower said the unusual large data outflows coincided with…

Funding Expires for Key Cyber Vulnerability Database

April 15, 2025

A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common Vulnerabilities and Exposures (CVE) program — which is traditionally funded each…

Trump Revenge Tour Targets Cyber Leaders, Elections

April 14, 2025

President Trump last week revoked security clearances for Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA) who was fired by Trump after declaring the 2020 election the most secure in U.S. history. The White House memo, which also suspended clearances for other security professionals at Krebs’s employer SentinelOne, comes as…

China-based SMS Phishing Triad Pivots to Banks

April 10, 2025

China-based purveyors of SMS phishing kits are enjoying remarkable success converting phished payment card data into mobile wallets from Apple and Google. Until recently, the so-called “Smishing Triad” mainly impersonated toll road operators and shipping companies. But experts say these groups are now directly targeting customers of international financial institutions, while dramatically expanding their cybercrime…

Cyber Forensic Expert in 2,000+ Cases Faces FBI Probe

April 4, 2025

A Minnesota cybersecurity and computer forensics expert whose testimony has featured in thousands of courtroom trials over the past 30 years is facing questions about his credentials and an inquiry from the Federal Bureau of Investigation (FBI). Legal experts say the inquiry could be grounds to reopen a number of adjudicated cases in which the…

How Each Pillar of the 1st Amendment is Under Attack

March 30, 2025

“Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.” -U.S. Constitution, First Amendment. Image: Shutterstock, zimmytws. In an address…

When Getting Phished Puts You in Mortal Danger

March 27, 2025

Many successful phishing attacks result in a financial loss or malware infection. But falling for some phishing scams, like those currently targeting Russians searching online for organizations that are fighting the Kremlin war machine, can cost you your freedom or your life. The real website of the Ukrainian paramilitary group “Freedom of Russia” legion. The…

Arrests in Tap-to-Pay Scheme Powered by Phishing

March 21, 2025

Authorities in at least two U.S. states last week independently announced arrests of Chinese nationals accused of perpetrating a novel form of tap-to-pay fraud using mobile devices. Details released by authorities so far indicate the mobile wallets being used by the scammers were created through online phishing scams, and that the accused were relying on…

DOGE to Fired CISA Staff: Email Us Your Personal Data

March 19, 2025

A message posted on Monday to the homepage of the U.S. Cybersecurity & Infrastructure Security Agency (CISA) is the latest exhibit in the Trump administration’s continued disregard for basic cybersecurity protections. The message instructed recently-fired CISA employees to get in touch so they can be rehired and then immediately placed on leave, asking employees to…

Feds Link $150M Cyberheist to 2022 LastPass Hacks

March 7, 2025

In September 2023, KrebsOnSecurity published findings from security researchers who concluded that a series of six-figure cyberheists across dozens of victims resulted from thieves cracking master passwords stolen from the password manager service LastPass in 2022. In a court filing this week, U.S. federal agents investigating a spectacular $150 million cryptocurrency heist said they had…

Who is the DOGE and X Technician Branden Spikes?

March 6, 2025

At 49, Branden Spikes isn’t just one of the oldest technologists who has been involved in Elon Musk’s Department of Government Efficiency (DOGE). As the current director of information technology at X/Twitter and an early hire at PayPal, Zip2, Tesla and SpaceX, Spikes is also among Musk’s most loyal employees. Here’s a closer look at…

Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab

February 28, 2025

One of the most notorious providers of abuse-friendly “bulletproof” web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab, KrebsOnSecurity has learned. Security experts say the Russia-based service provider Prospero OOO (the triple O is the Russian version of “LLC”) has long been a…

Trump 2.0 Brings Cuts to Cyber, Consumer Protections

February 23, 2025

One month into his second term, President Trump’s actions to shrink the government through mass layoffs, firings and withholding funds allocated by Congress have thrown federal cybersecurity and consumer protection programs into disarray. At the same time, agencies are battling an ongoing effort by the world’s richest man to wrest control over their networks and…

How Phished Data Turns into Apple & Google Wallets

February 18, 2025

Carding — the underground business of stealing, selling and swiping stolen payment card data — has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovation from cybercrime groups in China is breathing new…

Nearly a Year Later, Mozilla is Still Promoting OneRep

February 13, 2025

In mid-March 2024, KrebsOnSecurity revealed that the founder of the personal data removal service Onerep also founded dozens of people-search companies. Shortly after that investigation was published, Mozilla said it would stop bundling Onerep with the Firefox browser and wind down its partnership with the company. But nearly a year later, Mozilla is still promoting it…

Teen on Musk’s DOGE Team Graduated from ‘The Com’

February 7, 2025

Wired reported this week that a 19-year-old working for Elon Musk‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so. As today’s story explores, the DOGE teen is a…

Experts Flag Security, Privacy Risks in DeepSeek AI App

February 6, 2025

New mobile apps from the Chinese artificial intelligence (AI) company DeepSeek have remained among the top three “free” downloads for Apple and Google devices since their debut on Jan. 25, 2025. But experts caution that many of DeepSeek’s design choices — such as using hard-coded encryption keys, and sending unencrypted user and device data to…

Who’s Behind the Seized Forums ‘Cracked’ & ‘Nulled’?

February 4, 2025

The FBI joined authorities across Europe last week in seizing domain names for Cracked and Nulled, English-language cybercrime forums with millions of users that trafficked in stolen data, hacking tools and malware. An investigation into the history of these communities shows their apparent co-founders quite openly operate an Internet service provider and a pair of…

FBI, Dutch Police Disrupt ‘Manipulaters’ Phishing Gang

January 31, 2025

The FBI and authorities in The Netherlands this week seized dozens of servers and domains for a hugely popular spam and malware dissemination service operating out of Pakistan. The proprietors of the service, who use the collective nickname “The Manipulaters,” have been the subject of three stories published here since 2015. The FBI said the…

Infrastructure Laundering: Blending in with the Cloud

January 30, 2025

Image: Shutterstock, ArtHead. In an effort to blend in and make their malicious traffic tougher to block, hosting firms catering to cybercriminals in China and Russia increasingly are funneling their operations through major U.S. cloud providers. Research published this week on one such outfit — a sprawling network tied to Chinese organized crime gangs and…

A Tumultuous Week for Federal Cybersecurity Efforts

January 27, 2025

Image: Shutterstock. Greg Meland. President Trump last week issued a flurry of executive orders that upended a number of government initiatives focused on improving the nation’s cybersecurity posture. The president fired all advisors from the Department of Homeland Security’s Cyber Safety Review Board, called for the creation of a strategic cryptocurrency reserve, and voided a…

MasterCard DNS Error Went Unnoticed for Years

January 22, 2025

The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to register the domain and prevent…

Chinese Innovations Spawn Wave of Toll Phishing Via SMS

January 16, 2025

Residents across the United States are being inundated with text messages purporting to come from toll road operators like E-ZPass, warning that recipients face fines if a delinquent toll fee remains unpaid. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes…

A Day in the Life of a Prolific Voice Phishing Crew

January 7, 2025

Besieged by scammers seeking to phish user accounts over the telephone, Apple and Google frequently caution that they will never reach out unbidden to users this way. However, new details about the internal operations of a prolific voice phishing gang show the group routinely abuses legitimate services at Apple and Google to force a variety…

U.S. Army Soldier Arrested in AT&T, Verizon Extortions

December 30, 2024

Federal authorities have arrested and indicted a 20-year-old U.S. Army soldier on suspicion of being Kiberphant0m, a cybercriminal who has been selling and leaking sensitive customer call records stolen earlier this year from AT&T and Verizon. As first reported by KrebsOnSecurity last month, the accused is a communications specialist who was recently stationed in South…

Web Hacking Service ‘Araneida’ Tied to Turkish IT Firm

December 19, 2024

Cybercriminals are selling hundreds of thousands of credential sets stolen with the help of a cracked version of Acunetix, a powerful commercial web app vulnerability scanner, new research finds. The cracked software is being resold as a cloud-based attack tool by at least two different services, one of which KrebsOnSecurity traced to an information technology…

How to Lose a Fortune with Just One Bad Click

December 18, 2024

Image: Shutterstock, iHaMoo. Adam Griffin is still in disbelief over how quickly he was robbed of nearly $500,000 in cryptocurrencies. A scammer called using a real Google phone number to warn his Gmail account was being hacked, sent email security alerts directly from google.com, and ultimately seized control over the account by convincing him to…

How Cryptocurrency Turns to Cash in Russian Banks

December 11, 2024

A financial firm registered in Canada has emerged as the payment processor for dozens of Russian cryptocurrency exchanges and websites hawking cybercrime services aimed at Russian-speaking customers, new research finds. Meanwhile, an investigation into the Vancouver street address used by this company shows it is home to dozens of foreign currency dealers, money transfer businesses,…

Why Phishers Love New TLDs Like .shop, .top and .xyz

December 3, 2024

Phishing attacks increased nearly 40 percent in the year ending August 2024, with much of that growth concentrated at a small number of new generic top-level domains (gTLDs) — such as .shop, .top, .xyz — that attract scammers with rock-bottom prices and no meaningful registration requirements, new research finds. Meanwhile, the nonprofit entity that oversees…

Hacker in Snowflake Extortions May Be a U.S. Soldier

November 26, 2024

Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake, but a third suspect — a prolific hacker known as Kiberphant0m — remains at large and continues to publicly extort victims. However, this person’s identity may not remain a secret for long:…

Feds Charge Five Men in ‘Scattered Spider’ Roundup

November 21, 2024

Federal prosecutors in Los Angeles this week unsealed criminal charges against five men alleged to be members of a hacking group responsible for dozens of cyber intrusions at major U.S. technology companies between 2021 and 2023, including LastPass, MailChimp, Okta, T-Mobile and Twilio. A visual depiction of the attacks by the SMS phishing group known…

An Interview With the Target & Home Depot Hacker

November 14, 2024

In December 2023, KrebsOnSecurity revealed the real-life identity of Rescator, the nickname used by a Russian cybercriminal who sold more than 100 million payment cards stolen from Target and Home Depot between 2013 and 2014. Moscow resident Mikhail Shefel, who confirmed using the Rescator identity in a recent interview, also admitted reaching out because he…

FBI: Spike in Hacked Police Emails, Fake Subpoenas

November 9, 2024

The Federal Bureau of Investigation (FBI) is urging police departments and governments worldwide to beef up security around their email systems, citing a recent increase in cybercriminal services that use hacked police email accounts to send unauthorized subpoenas and customer data requests to U.S.-based technology companies. In an alert (PDF) published this week, the FBI…

A Little Sunshine, AdsPro, Aimed Global, Global Security News, Ne'er-Do-Well News, Web Fraud 2.0

A Little Sunshine, Amazon, Europe, Global Security News, Russia's War on Ukraine, Time to Patch, Web Fraud 2.0

A Little Sunshine, Amazon, Europe, Funnull, Global Security News, infrastructure laundering, Ivan Neculiti, Lazarus Group, Microsoft, Ne'er-Do-Well News, Silent Push, Stark Industrires Solutions Ltd, Suncity Group, Web Fraud 2.0, Yuri Neculiti, Zach Edwards

A Little Sunshine, Asia Pacific, BreachForums, Cipriani & Warner, Conor Brian Fitzpatrick, Data Breaches, Global Security News, Jill Fertel, mark rasch, Ne'er-Do-Well News, Nonstop Health, Pompompurin, RaidForums, Unit 221B

0ktapus, A Little Sunshine, Ahmed Elbadawy, Caesars, DoorDash, Evans Osiebo, Global Security News, Group-IB, Joel Evans, lastpass, Mailchimp, MGM, Ne'er-Do-Well News, Noah Urban, North America, Okta, Ransomware, Scattered Spider, SIM Swapping, Twilio, Tyler Robert Buchanan, Tylerb

A Little Sunshine, Amazon, Andrew P. Bakaj, CNN, Cybersecurity and Infrastructure Security Agency, Daniel J. Berulis, doge, GitHub, Global Security News, Lasharn Hamilton, Latest Warnings, Microsoft Azure, NPR, NxGen, president trump, SpaceX, The Coming Storm, Tim Bearese, US-CERT

A Little Sunshine, Common Vulnerabilities and Exposures, Corellium, CVE, CVE Numbering Authorities, Global Security News, Latest Warnings, Matt Tait, MITRE, The Coming Storm

A Little Sunshine, Computer Forensic Services, fbi, Felician University, Global Security News, HarvardX, Kimberly Hanlon, Mark Lanterman, mark rasch, North America, Perkins Coie LLP, Sean Harrington, Stephen Allwine, The Coming Storm, U.S. Secret Service, Unit 221B, Upsala College

A Little Sunshine, Artem Tamoian, DuckDuckGo, Freedom of Russia legion, Global Security News, Russia's War on Ukraine, Russian Volunteer Corps, Silent Push, Stark Industries Solutions Ltd, Yandex, Zach Edwards

A Little Sunshine, Android, Apple Pay, Asia Pacific, Bernie Lyon, CSIS Security Group, Ford Merrill, Global Security News, Google Apple, Ne'er-Do-Well News, SecAlliance, tap-to-pay fraud, The Coming Storm, Z-NFC

A Little Sunshine, Chris Larsen, Data Breaches, fbi, Global Security News, Karim Toubba, lastpass breach, Nick Bax, Ripple, Taylor Monahan, U.S. Secret Service, ZachXBT

A Little Sunshine, Alfa Bank, BEARHOST, Global Security News, GootLoader, Interisle Consulting Group, Intrinsec, Kaspersky Lab, Kentik, Ne'er-Do-Well News, North America, Prospero OOO, Ransomware, Securehost, Silent Push, SocGholish, spamhaus, The Coming Storm, Zach Edwards

A Little Sunshine, All About Skimmers, Andy Chandler, Apple, Asia Pacific, CSIS Security Group, Ford Merrill, ghost tap, Global Security News, Google, Grant Smith, imessage, M3AAWG, RCS, Resecurity, SecAlliance, smishing, The Coming Storm, ThreatFabric, Web Fraud 2.0, ZNFC

A Little Sunshine, Dimitiri Shelest, Firefox, Global Security News, mozilla, Mozilla Monitor Plus, Nuwber, OneRep, Radaris

A Little Sunshine, Andrew Hoog, app transport security, Apple, Artificial Intelligence, bytedance, china, deepseek, DeepSeek AI, Global Security News, iOS, Latest Warnings, NowSecure, The Coming Storm, Volcengine

A Little Sunshine, akam.ne, akam.net, Akamai, awsdns-06.ne, az.mastercard.com, Azure, Bugcrowd, CloudFlare, Global Security News, Google, How to Break Into Security, Mastercard, Philippe Caturegli, Seralys

@chenlun, A Little Sunshine, Asia Pacific, CSIS Security Group, EZDriveMA, fbi, Ford Merrill, Global Security News, ic3, imessage, Latest Warnings, Lighthouse, MassDOT, North Texas Toll Authority, RCS, SecAlliance, smishing, SMS phishing, Sunpass, The Toll Roads, Web Fraud 2.0

A Little Sunshine, Allison Nixon, Cameron John Wagenius, Connor Riley Moucka, Global Security News, Judische, Kiberphant0m, Ne'er-Do-Well News, North America, Unit 221B

(650) 203-0000, A Little Sunshine, Coinbase, Daniel from Google, Gemini AI, Global Security News, Google Assistant, Google Docs, Google Forms, Google Photos, Graham Cluely, Junseth, Latest Warnings, Minecraft, Ne'er-Do-Well News, SwanCoin, Trezor, Web Fraud 2.0

A Little Sunshine, Ahmed Hossam Eldin Elbadawy, Evans Onyeaka Osiebo, Global Security News, Joel Martin Evans, Joeleoli, Kingbob, lastpass, Mailchimp, Namecheap, Ne'er-Do-Well News, Noah Michael Urban, ogusers, Okta, Oktapus, Scattered Spider, SIM Swapping, Sosa, T-Mobile, Twilio, Tylerb

A Little Sunshine, emergency data request, fake EDR, fbi, Global Security News, Kodex, Latest Warnings, Matt Donahue, North America, pwnstar, The Coming Storm, Web Fraud 2.0