Russian hackers targeting US Senate email accounts: Report
A hacking group allegedly associated with the Russian government is actively targeting the US Senate's internal email system since June 2017, a cyber security firm claimed on Saturday.
January 13, 2018 4:44 PM
According to Japanese cybersecurity firm Trend Micro, this is the same group that hacked into the Democratic National Committee (DNC) in 2016. (Reuters)Earlier this week, BuzzFeed News said that “Fancy Bear” released a set of emails between International Olympic Committee (IOC) employees and third parties discussing the Russian doping conspiracy. The leaks were apparently done in a retaliation for the decision taken in December 2017, to bar Russia from participating in the Games in Pyeongchang, South Korea by the IOC.A hacking group allegedly associated with the Russian government is actively targeting the US Senate’s internal email system since June 2017, a cyber security firm claimed on Saturday. According to Japanese cybersecurity firm Trend Micro, this is the same group that hacked into the Democratic National Committee (DNC) in 2016. The hackers’ activities began in June 2017 when they attempted to compromise a lawmaker’s credentials through a phishing site designed to look like the Senate’s internal email system. “Beginning in June 2017, phishing sites were set up mimicking the ADFS (Active Directory Federation Services) of the US Senate. By looking at the digital fingerprints of these phishing sites and comparing them with a large data set that spans almost five years, we can uniquely relate them to a couple of ‘Pawn Storm’ incidents in 2016 and 2017,” the security company said in a blog post. “The real ADFS server of the U.S. Senate is not reachable on the open internet, however phishing of users’ credentials on an ADFS server that is behind a firewall still makes sense. In case an actor already has a foothold in an organization after compromising one user account, credential phishing could help him get closer to high profile users of interest,” it added. Trend Micro’s report focuses on the efforts of a hacking group called “Pawn Storm” — “an extremely active espionage actor group” more commonly known as “Fancy Bear”. Cybersecurity firm CrowdStrike has deemed the group a “Russian-based threat actor” with likely ties to Russian military intelligence, Tech Crunch reported.
According to cybersecurity firm ThreatConnect, a group with the same name “Fancy Bear” had used the same website and the same format to publish documents in 2016 that had been hacked from the World Anti-Doping Agency (WADA) in response to that agency’s finding that hundreds of Russian athletes had taken banned substances.
Last year, Trend Micro reported that “Fancy Bear” group was behind the “massive and coordinated” attack on the campaign of French President-elect Emmanuel Macron. It is the same group that is blamed for attacking the Democratic party shortly before the US election. A Russian hacker claimed in December that he can prove he hacked the DNC networks on the orders of Russia’s Federal Security Service (FSB).
A Single-Character Message Can Crash Any Apple iPhone, iPad Or Mac Thursday, February 15, 2018 A single indian tamil word crash all iPhone device Only a single character can crash your iPhone and block access to the Messaging app in iOS as well as popular apps like WhatsApp, Facebook Messenger, Outlook for iOS, and Gmail. First spotted by Italian Blog Mobile World, a potentially new severe bug affects not only iPhones but also a wide range of Apple devices, including iPads, Macs and even Watch OS devices running the latest versions of their operating software. Like previous 'text bomb' bug, the new flaw can easily be exploited by anyone, requiring users to send only a single character from Telugu—a native Indian language spoken by about 70 million people in the country. Once the recipient receives a simple message containing the symbol or typed that symbol into the text editor, the character immediately instigates crashes on iPhones, iPads, ...
New Saturn Ransomware Actively Infecting Victims A new ransomware was discovered this week by MalwareHunterTeam called Saturn. This ransomware will encrypt the files on a computer and then append the .saturn extension to the file's name. The Saturn Ransomware is being actively distributed, but at this time it is unknown what distribution methods are being used. Unfortunately, this ransomware is not decryptable at this time, but it is currently being researched for weaknesses. In the mean time, if you wish to discuss or receive help, you can use our dedicated Saturn Ransomware Help & Support topic . How Saturn Ransomware encrypts a computer When Saturn Ransomware is installed it will check to see if the victim is running in a virtual environment. If it detects that it is running under a virtual machine, it will exit the process. If it does not detect a virtual machine, Saturn will execute the following commands to delete shadow volume copies,...
Comments
Post a Comment