A deep dive into the most interesting incident response cases of last year

In 2023, Kasperskys Global Emergency Response Team GERT participated in services around the world that allowed our experts to gain insight into various threats and techniques used by APT groups, common crimeware and, in some cases, internal adversaries. As we highlighted in our annual report, the...

Owners of 1-Time Passcode Theft Service Plead Guilty

Three men in the United Kingdom have pleaded guilty to operating otp.agency , a once popular online service that helped attackers intercept the one-time passcodes OTPs that many websites require as a second authentication factor in addition to passwords. Launched in November 2019, OTP Agency was ...

New Android Malware NGate Steals NFC Data to Clone Contactless Payment Cards

Cybersecurity researchers have uncovered new Android malware that can relay victims' contactless payment data from physical credit and debit cards to an attacker-controlled device with the goal of conducting fraudulent operations. The Slovak cybersecurity company is tracking the novel malware as...

Man certifies his own (fake) death after hacking into registry system using stolen identity

A 39-year-old man has been sentenced to 81 months in jail after hacking governments systems to fake his own death to dodge paying child support. Yes, you read that right. The press release by the US Attorneys Office, Eastern District of Kentucky, paints a detailed picture of what went down. In...

Russian Hacker Jailed 3+ Years for Selling Stolen Credentials on Dark Web

A 27-year-old Russian national has been sentenced to over three years in prison in the U.S. for peddling financial information, login credentials, and other personally identifying information PII on a now-defunct dark web marketplace called Slilpp. Georgy Kavzharadze, 27, of Moscow, Russia, plead...

Belarusian-Ukrainian Hacker Extradited to U.S. for Ransomware and Cybercrime Charges

A coalition of law enforcement agencies coordinated by the U.K. National Crime Agency NCA has led to the arrest and extradition of a Belarussian and Ukrainian dual-national believed to be associated with Russian-speaking cybercrime groups. Maksim Silnikau aka Maksym Silnikov, 38, went by the onli...

Chameleon Android Banking Trojan Targets Users Through Fake CRM App

Cybersecurity researchers have lifted the lid on a new technique adopted by threat actors behind the Chameleon Android banking trojan targeting users in Canada by masquerading as a Customer Relationship Management CRM app. "Chameleon was seen masquerading as a CRM app, targeting a Canadian...

INTERPOL Recovers $41 Million in Largest Ever BEC Scam in Singapore

INTERPOL said it devised a "global stop-payment mechanism" that helped facilitate the largest-ever recovery of funds defrauded in a business email compromise BEC scam. The development comes after an unnamed commodity firm based in Singapore fell victim to a BEC scam in mid-July 2024. It refers to...

UK Shuts Down ‘Russian Coms’ Fraud Platform Defrauding Millions

The UKs National Crime Agency has dismantled Russian Coms, a major fraud platform responsible for global financial losses.…...

U.S. Releases High-Profile Russian Hackers in Diplomatic Prisoner Exchange

In a historic prisoner exchange between Belarus, Germany, Norway, Russia, Slovenia, and the U.S., two Russian nationals serving time for cybercrime activities have been freed and repatriated to their country. This includes Roman Valerevich Seleznev and Vladislav Klyushin, who are part of a group ...

New Android Banking Trojan BingoMod Steals Money, Wipes Devices

Cybersecurity researchers have uncovered a new Android remote access trojan RAT called BingoMod that not only performs fraudulent money transfers from the compromised devices but also wipes them in an attempt to erase traces of the malware. Italian cybersecurity firm Cleafy, which discovered the...

Cybercriminals Deploy 100K+ Malware Android Apps to Steal OTP Codes

A new malicious campaign has been observed making use of malicious Android apps to steal users' SMS messages since at least February 2022 as part of a large-scale campaign. The malicious apps, spanning over 107,000 unique samples, are designed to intercept one-time passwords OTPs used for online...

Meta takes down 63,000 sextortion-related accounts on Instagram

Meta announced the take-down of 63,000 sextortion-related Instagram accounts in Nigeria alone. The action was directed against a group known as Yahoo Boys, a loosely organized set of cybercriminals that largely operate out of Nigeria and specialize in different types of scams. Meta took down a ho...

Meta Removes 63,000 Instagram Accounts Linked to Nigerian Sextortion Scams

Meta Platforms on Wednesday said it took steps to remove around 63,000 Instagram accounts in Nigeria that were found to target people with financial sextortion scams. "These included a smaller coordinated network of around 2,500 accounts that we were able to link to a group of around 20...

Managing Risk During the CrowdStrike Global Tech Outage

Managing Risk During the CrowdStrike Global Tech Outage By Mo Cashman & Trellix Advanced Research Center · July 19, 2024 Updated: July 25, 2024 How it Happened A defective content update provided by cybersecurity firm CrowdStrike caused Microsoft Windows systems to crash, disrupting airline trave...

It's best to just assume you’ve been involved in a data breach somehow

Between AT&T, all the follow-on activity from Snowflake, Microsoft Outlook, and more, its best to probably just assume at this point that your personal information has somehow been involved in a data breach. Were only halfway through 2024, and weve already seen some of the largest data breaches a...

Automated Threats Pose Increasing Risk to the Travel Industry

As the travel industry rebounds post-pandemic, it is increasingly targeted by automated threats, with the sector experiencing nearly 21% of all bot attack requests last year. That's according to research from Imperva, a Thales company. In their 2024 Bad Bot Report, Imperva finds that bad bots...

'Konfety' Ad Fraud Uses 250+ Google Play Decoy Apps to Hide Malicious Twins

Details have emerged about a "massive ad fraud operation" that leverages hundreds of apps on the Google Play Store to perform a host of nefarious activities. The campaign has been codenamed Konfety – the Russian word for Candy – owing to its abuse of a mobile advertising software development kit...

An In-Depth Look at Crypto-Crime in 2023 Part 2

In 2023, the cryptocurrency industry faced a significant increase in illicit activities, including money laundering, fraud, and ransomware attacks. Ransomware attacks were especially prevalent and profitable for attackers. However, other forms of criminal activity also saw a rise...

Thousands of UEFA Customer Credentials Sold on Dark Web

Cybercriminals targeting Euro 2024 fans & organizers! Phishing scams, illegal content sites, malware-laced apps & ticket fraud threaten the game. Learn how to protect yourself & ensure a safe Euro 2024 experience...