Author: claricehumphery

Deer.io takedown: Russian citizen jailed for selling stolen sensitive information of US citizens online

A Russian citizen have been jailed for 30 months for his role in selling stolen bank card information and other data helpful to fuel further criminal activity.

Kirill Victorovich Firsov, 30, from Moscow, acted as being the administrator of an internet site that provided stolen private data and also other services to be played with for cybercrime, a US Department of Justice release states.

One-stop cybercrime platform

As previously reported by The Daily Swig, the now-defunct website – Deer.io – hosted about 2,000 illicit internet vendors generating approximately $17 million during its seven-year operation.

It sold information including gamer account logins, and the private data of US citizens not limited to names, current addresses, cellular phone, at times Social Security numbers.

Deer.io was introduced as small as October 2013 and was turned off following Firsov’s arrest in March 2020 after an operation by which the FBI purchased 1,100 gamer accounts as well as information that is personal for over 3,600 Americans.

The prosecutor asserted that Firsov knew deer.io was selling stolen and counterfeit accounts as he built the platform.

“Also, deer.io was easily searchable, so anyone – including Firsov – could search prestashop for stolen US accounts and information,” the making reads.

“Just about the most sold stolen accounts, deer.io wasn’t cloaked in secrecy and required no special password for access, because everything was run out of Russia, and American police could gain no foothold.”

‘Sending a message’

“The FBI will pursue cybercriminals around the world market darknet (http://dawg-park.com),” said FBI Special Agent in Charge, Suzanne Turner.

“Today’s sentence sends some text – conducting criminal activity external the United States is not to mean you happen to be from reach.

“The FBI will identify and pursue criminal actors inside the cyber-sphere, where ever they operate, and work to bring these to justice in the United States court.”

US authorities are offering $10 million for world market onion information on nation-state cyber-attacks

US authorities are offering as much as $10 million in cryptocurrency for information resulting in the identification of state-sponsored cyber-attackers.

Underneath the scheme, which takes place under the Department of State’s Rewards for Justice (RFJ) program, payouts will be awarded for the identity or location of anyone who, “while acting at the direction or underneath the control of a foreign government, participates in malicious cyber activities against US critical infrastructure in violation of the Computer Fraud and Abuse Act (CFAA).

A media release states that violations include threats made during ransomware attacks, unauthorized use of a protected computer with intention to steal sensitive data, and intentionally causing damage without authorization to a protected computer.

This system has set up a reporting channel accessible on the dark web to simply help protect the safety and security of potential sources.

“Reward payments may include payments in cryptocurrency,” said the Department of State.

More information on the best way to access the Tor-based reporting channel is found in the release.

In the pipeline

The offer of an incentive comes while the US continues to see cyber-attacks against critical infrastructure which have caused chaos over the nation.

In May this season, a ransomware attack on gas supplier Colonial Pipeline cut off services to multiple states on the east coast.

Attackers leveraging DarkSide malware demanded $4.3 million in bitcoin – a sum that has been reportedly paid out by the company.

Security professionals previously told The Daily Swig that in paying ransoms, organizations risk perpetuating a “feedback loop of malicious activity” that “allows the groups to reach a better level of sophistication throughout their next attacks, whether that be via training, new tooling, purchasing credentials, or recruitment.

Kaseya denies ransomware payment since it hails ‘100% effective’decryption tool

Kaseya has denied rumors so it paid a ransom to the REvil cybercrime gang since it continues to roll out a decryptor to victims of a recently available ransomware attack.

The application supply chain attack, which began on July 2, is believed to possess affected around 1,500 organizations via the hack of IT management platform Kaseya VSA.

Kaseya revealed on July 22 that it had obtained a decryption tool from a “third party” and was working to restore the environments of impacted organizations with the help of anti-malware experts Emsisoft.

Speculation

The update sparked speculation regarding the identity of the unnamed alternative party, with Allan Liska of Recorded Future’s CSIRT team positing a disgruntled REvil affiliate, the Russian government, or that Kaseya themselves had paid the ransom.

The theory that the universal decryptor key became available because of police force action was strengthened on July 13 once the dark web domains related to REvil abruptly went offline.

However, world market onion some experts also said it absolutely was likely that this was a prelude to REvil, whose other notable scalps include Travelex and meat supplier JBS, rebranding itself in a bid to dodge law enforcement.

Non-disclosure agreement

The cybercrime outfit was believed to have initially demanded a payment of $70 million from Kaseya, before lowering the asking price to $50 million.

Kaseya, which has reportedly granted organizations use of the decryptor contingent on signing a non-disclosure agreement, addressed rumors that it had paid a ransom in a record yesterday (July 26):

Recent reports have suggested which our continued silence on whether Kaseya paid the ransom may encourage additional ransomware attacks, but nothing could possibly be further from our goal. While each company must make a unique decision on whether to pay for the ransom, Kaseya decided after consultation with experts not to negotiate with the criminals who perpetrated this attack and we have not wavered from that commitment. As a result, we’re confirming in no uncertain terms that Kaseya did not pay a ransom – either directly or indirectly through an alternative party – to acquire the decryptor.

Kaseya said that “the decryption tool has proven 100% capable of decrypting files that were fully encrypted in the attack&rdquo ;.

It added: “We continue to provide the decryptor to customers that request it, and we encourage all our customers whose data might have been encrypted during the attack to touch base to your contacts at Kaseya&rdquo ;.

More zero-days

The other day, meanwhile, security researchers from the business that unearthed the zero-day Kaseya vulnerabilities exploited by REvil disclosed a trio of additional zero-day flaws in another Kaseya product.

The Dutch Institute for Vulnerability Disclosure (DIVD) advised users of cloud-based Kaseya Unitrends, which can be acquired being an add-on for Kaseya VSA, to not expose the service to the net until a patch was released.

Also a week ago, Huntress Labs released a blog post speculating on why the compromise of 60 upstream, managed supplier customers via a fake software update hadn’t had a lot more calamitous consequences.

Dismissing the indisputable fact that Kaseya’s system shutdown was the primary reason, security researcher John Hammond pondered, among other potential reasons, whether threat actors had learned “from previous incidents (like Colonial Pipeline) that a much larger impact might invite government intervention?”

Deer.io takedown: Russian citizen jailed for selling stolen information that is personal of US citizens online

A Russian citizen continues to be jailed for 30 months for his role in selling stolen credit card information as well as other data utilized to fuel further criminal activity.

Kirill Victorovich Firsov, 30, from Moscow, acted for the reason that administrator of a website that provided stolen information that is personal and other services to be used for cybercrime, a US Department of Justice release states.

One-stop cybercrime platform

As previously reported by The Daily Swig, the now-defunct website – Deer.io – hosted an estimated 2,000 illicit online shops generating approximately $17 million during its seven-year operation.

It sold information including gamer account logins, and also the private data of US citizens not tied to names, current addresses, numbers, possibly at times Social Security numbers.

Deer.io was already released who are only October 2013 and was power down following Firsov’s arrest in March 2020 after an operation during which the FBI purchased 1,100 gamer accounts as well as private data for more than 3,600 Americans.

The prosecutor asserted that Firsov knew deer.io was selling stolen and counterfeit accounts as he built the platform.

“Also, deer.io was easily searchable, so anyone – including Firsov – could search the platform for stolen US accounts and data,” the making reads.

“Just about the most sold stolen accounts, deer.io had not been cloaked in secrecy and required no special password for access, because everything was exhaust Russia, and American police officers could gain no foothold.”

‘Sending a message’

“The FBI will pursue cybercriminals around the world market onion,” said FBI Special Agent in Charge, Suzanne Turner.

“Today’s sentence sends a communication – conducting criminal activity from the outside the United States is not to mean you might be outside of reach.

“The FBI will identify and pursue criminal actors inside cyber-sphere, wherever they operate, and work to bring these phones justice in a very United States court.”