Cybercrime

Pierluigi Paganini May 01, 2021
Babuk crew announced it will stop ransomware attacks

Babuk ransomware operators shut down their affiliate program and announced to stop using ransomware, the group plans to move on data theft. Recently the Babuk ransomware operators made the headlines for the ransomware attack against the DC Police Department. Experts believe that the decision of the group to leave the ransomware practice could be the […]

Pierluigi Paganini April 30, 2021
Saving World Health Day: UNICC and Group-IB take down scam campaign impersonating the World Health Organization

UNICC and Group-IB detected and took down a massive multistage scam campaign circulating online on April 7, World Health Day. Group-IB, a global threat hunting and adversary-centric cyber intelligence company that specializes in investigating hi-tech cybercrimes, and the United Nations International Computing Centre (UNICC), detected and took down a massive multistage scam campaign circulating online on April 7, World Health Day. […]

Pierluigi Paganini April 26, 2021
Bye Bye Emotet, law enforcement pushed the uninstall code via the botnet

European law enforcement has conducted an operation aimed at performing a mass-sanitization of computers infected with the infamous Emotet Windows malware. European law enforcement agencies automatically wiped the infamous Emotet malware from infected systems across the world as part of a mass sanitization operation. Early this year, law enforcement and judicial authorities worldwide conducted a […]

Pierluigi Paganini April 18, 2021
A member of the FIN7 group was sentenced to 10 years in prison

Fedir Hladyr (35), a Ukrainian national was sentenced today to 10 years in prison for his role in the financially motivated group FIN7, aka Carbanak. The Ukrainian national Fedir Hladyr (35), aka “das” or “AronaXus,” was sentenced to 10 years in prison for having served as a manager and systems administrator for the financially motivated […]

Pierluigi Paganini April 10, 2021
Crooks abuse website contact forms to deliver IcedID malware

Microsoft researchers spotted a malware campaign abusing contact forms on legitimate websites to deliver the IcedID malware. Security experts from Microsoft have uncovered a malware campaign abusing contact forms on legitimate websites to deliver the IcedID malware. Threat actors behind the operation are using contact forms published on websites to deliver malicious links to enterprises […]

Pierluigi Paganini April 09, 2021
330K stolen payment cards and 895K stolen gift cards sold on dark web

A threat actor has sold almost 900,000 gift cards and over 300,000 payment cards on a cybercrime forum on the dark web. A crook has sold 895,000 gift cards and over 300,000 payment cards, for a total of US$38 million, on a  top-tier Russian-language hacking forum on the dark web. The criminal actor was spotted offering […]

Pierluigi Paganini April 08, 2021
Man arrested after hired a hitman on the dark web

A joint operation of Europol and the Italian Postal and Communication Police resulted in the arrest of an Italian national who hired a hitman on the dark web. Europol and the Italian Postal and Communication Police (Polizia Postale e delle Comunicazioni) arrested an Italian national as part of the “Operation Hitman” because he is suspected […]

Pierluigi Paganini April 07, 2021
Crooks use Telegram bots and Google Forms to automate phishing

Crooks increasingly often use legitimate services such as Google Forms and Telegram to obtain user data stolen on phishing websites. Group-IB, a global threat hunting and adversary-centric cyber intelligence company, has found that cybercriminals increasingly often use legitimate services such as Google Forms and Telegram to obtain user data stolen on phishing websites. Alternative ways to obtain data help cybercriminals keep […]

Pierluigi Paganini April 04, 2021
Security Affairs newsletter Round 308

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs free for you in your email box. If you want to receive the complete weekly Security Affairs Newsletter for free, including the international press, subscribe here. Experts found two flaws in Facebook for WordPress Plugin Hackers disrupted live […]

Pierluigi Paganini April 03, 2021
Evolution and rise of the Avaddon Ransomware-as-a-Service

The Avaddon ransomware operators updated their malware after security researchers released a public decryptor in February 2021. The Avaddon ransomware family first appeared in the threat landscape in February 2020, and its authors started offering it with a Ransomware-as-a-Service (RaaS) model in June, 2020. In August 2020, cybersecurity intelligence firm Kela was the first to report that […]