Media Coverage

Recently, Proofpoint researchers have been tracking the massive Smominru botnet, the combined computing power of which has earned millions of dollars for its operators. With the help of abuse.ch and the ShadowServer Foundation, we conducted a sinkholing operation to determine the botnet size and location of the individual nodes. The botnet includes more than 526,000 infected Windows hosts, most of which we believe are servers. These nodes are distributed worldwide but we observed the highest numbers in Russia, India, and Taiwan.

A Paris-based online advertising company was hacked, and its infrastructure used to deliver malicious JavaScript code to online stores, code that was designed to steal payment card details entered in checkout pages. Last year, one group that RiskIQ tracked as Magecart Group 5, pioneered this tactic and was responsible for hacks at 12 third-party companies, hacks through which Group 5 delivered its malicious card stealing code to thousands of online store. Now, RiskIQ says that a new group, which they’re tracking as Magecart Group 12, appears to have copied Group 5’s modus operandi and has breached Adverline to exploit its infrastructure in a similar fashion. RiskIQ says it’s been working with AbuseCH and the ShadowServer Foundation to take down Group 12’s server infrastructure, which appears to have been set up two months before the Adverline hack, in September 2018.

Notorious British hacker-for-hire jailed for cyber attacks on a Liberian telco after an international criminal justice operation. British cyber criminal Daniel Kaye has been jailed for two years and eight months for attacks that took Liberia offline and severely disrupted a Liberian telecommunications provider, resulting in losses estimated at tens of millions of dollars.

A British cyber criminal has been sentenced to two years and eight months for conducting attacks that disrupted a Liberian telecommunications provider, resulting in losses estimated at tens of millions of US dollars. The 30-year-old expert hacker was hired by a senior official at Cellcom, a rival Liberian network provider, and paid a monthly retainer. From September 2016, Kaye used his own Mirai botnet, made up of a network of infected Dahua security cameras, to carry out consistent attacks on Lonestar. In November 2016, the traffic from Kaye’s botnet was so high in volume that it disabled internet access across Liberia.

With a heavy assist from private-sector cybersecurity and tech organizations, the FBI has dismantled a highly complex fraud network responsible for generating billions upon billions of fake online ad placements.In conjunction with the takedown, the U.S. Department of Justice yesterday announced a 13-count indictment filed against eight individuals, each a resident of either Russia, Ukraine or Kazakhstan. Charges include wire fraud, money laundering conspiracy, aggravated identity theft, and conspiracy to commit computer intrusions. Collectively known as 3ve (pronounced “Eve”), the cybercriminal operation had fraudulently earned at least $36 million in ad view revenues since 2014, largely with the help of global botnets composed of machines infected with either Kovter or Boaxxe/Miuref malware.

The FBI, Google, and 20 tech industry partners have collaborated to take down a giant cyber-criminal network involved in generating fake ad views and clicks that have been used to defraud ad networks and advertisers for the past four years and make millions in illicit revenue for the scheme’s perpetrators. Some of the infosec and ad industry’s biggest players were invited, such as Microsoft, ESET, Symantec, Proofpoint, Trend Micro, F-Secure, Malwarebytes, CenturyLink, MediaMath, White Ops, Amazon, Adobe, Trade Desk, Oath, The Shadowserver Foundation, and the National Cyber-Forensics and Training Alliance.

Last year, we identified one of the most complex and sophisticated ad fraud operations we have seen to date, working with cyber security firm White Ops, and referred the case to law enforcement. Today, the U.S. Attorney’s Office for the Eastern District of New York announced criminal charges associated with this fraud operation. This takedown marks a major milestone in the industry’s fight against ad fraud, and we’re proud to have been a key contributor.

In a brand new RiskIQ and Flashpoint joint report, ‘Inside Magecart,‘ we build a timeline of the Magecart phenomenon from the inception of digital credit-card skimming—its evolution from a Cart32 shopping cart software backdoor to Magecart’s current all-out assault on e-commerce that compromises thousands of sites directly and via breaches of third-party suppliers. We’ll also profile the six leading Magecart groups along with notable related unclassified threat groups, highlighting their skimmers, tactics, targets, and what makes them unique. As we felt it was not our position to ingest this data, we partnered with two non-commercial organizations, AbuseCH and Shadowserver, which perform the sinkholing and reporting. We are merely a data provider; they do the heavy lifting.

A joint report released today by cyber-security firms RiskIQ and Flashpoint provides a 60-page deep technical dive into the activities of several cyber-criminal groups that have been active in the past three years hacking online stores to secretly log and steal payment card details entered inside checkout forms. The report refers to these hacks and cyber-criminal groups using the term Magecart. RiskIQ, the company that’s been tracking most of these attacks since 2015, says it’s currently working with AbuseCH and the Shadowserver Foundation to take down the server infrastructure of most of these groups.

National Vulnerability Databases (NVDs) can be slow and miss things. Use these sources to supplement your threat and vulnerability intelligence efforts.