#Uber #breach

Group-IB researchers have found some interesting information about the recent Uber hack. Check out our post on Medium for more details👈

#AttackSurfaceManagement #ASM

Imagine the following situation. In 2016, a marketing specialist makes an urgent request to the IT department to create a landing page with the domain name “promotionforthisproduct2016[.]com” in order to promote a product. The domain was created and soon thereafter the promotion ended. A year goes by and the IT specialist leaves the company. Two years later, the marketing specialist follows suit. In 2020, the company hires a new Chief Security Officer who is not told anything about the domain or the potentially vulnerable infrastructure that hosts it.

As people say, the Internet remembers everything — and not just the photos of Beyoncé or Barbra Streisand’s house, but any external IT assets that companies create. Assets can also be seen by threat actors, who can use vulnerabilities and weaknesses to carry out attacks.

Group-IB Attack Surface Management maps out the organization’s entire external attack surface, with an eye towards discovering shadow IT and other hidden risks. Check out our latest blog post to learn more about the solution👈

#report #banks #AttackSurfaceManagement

🏦Banks and other financial service providers are highly digitized, resulting in digital estates that are large and complex. At the same time, the global finance industry faces a hostile threat landscape. These factors lead to high levels of risk that can be difficult to manage.

To help security professionals gain a better view on industry-wide risk trends, Group-IB has created a series of reports that analyze the digital estates and attack surfaces of samples of financial services providers across 3 global regions: Latin America, Europe, and the Asia-Pacific region.

The reports provide insights on the size of the average digital footprint, risk assessments across 8 distinct issue categories, and data-driven recommendations for strengthening security posture.

Download now👈

#report #scam

As a founding partner of the Global Anti-Scam Alliance, Group-IB is committed to preventing scams and is continuously contributing to ScamAdviser.com reports in order to raise awareness and make the world a cyber safer place. In a new report titled The Global State of Scams - 2022, Group-IB's Head of Digital Risk Protection in Europe Dmitriy Tiunkin shares insights into scams and trends that are expected to emerge in the future.

Check out the full report👈

If you would like to learn more about Group-IB's approach to protecting against scams, check out our website👈

#conference #fraud

Many organizations that are victims of fraud tend to consider it a cost of doing business. If the amount of fraud losses does not damage their bottomline or is covered by insurance, then they tend not to invest in fraud mitigation. What happens when they don’t investigate the instances of fraud and how does fraud contribute to other illegal activities?

Join Group-IB and FBI at MRC Singapore - Asia-Pacific Payments and Fraud Conference on November 1! In a joint presentation titled "Are you financing organized crime or terrorists while not fighting fraud?", Group-IB’s Fraud Protection Product Marketing Manager, Julien Laurent, Melissa McBee-Anderson, Management and Program Analyst, FBI, and Brett Chabot, Assistant Legal Attaché, FBI (U.S Embassy Singapore) will talk about fraud protection and the importance of investigating and sharing fraud attacks with the authorities.

More details about the event👈

#bugbounty

The winner of PDD Connecting Smartness Bug Bounty 2.0 Contest co-organized by Group-IB is announced. Our congratulations to Lim Keat Hui Justin, a third-year SIT student majoring in information security.

The contestants’ goal was to test a prototype of a living lab network that the JTC plans to build in a new SIT Campus in the Punggol Digital District that is under construction and due for completion in 2024. Industry partners will leverage SIT as a ‘living lab,’ using the institution’s open innovation ecosystem to pilot and test their prototypes in a real-life environment.

Although the contestants found no critical vulnerabilities and did not take control of the network, Lim Keat Hui Justin was able to bypass the authorization of a network router and expose some of its technical information. A panel of judges, which included CSA, JT Consultancy & Management, and Group-IB decided to award Justin a Certificate of Achievement and $500 worth of Vouchers.

#ransomware #DeadBolt

Everything you need to know about DeadBolt ransomware in one blog post.

The Group-IB Incident Response Team investigated an incident related to a DeadBolt attack and analyzed a DeadBolt ransomware sample. Their investigation was the first full-fledged analysis of DeadBolt and included reverse-engineering the code in full to reveal the ransomware sample’s functionalities and capabilities.

Deadbolt ransomware is famous for a notorious attack on NAS manufacturer QNAP through the exploitation of a 0-day vulnerability in its software. The threat actors demanded 0.05 BTC from individual users of NAS for decrypting their data. For a ransom of 10 BTC, Deadbolt operators promised QNAP that they would share all the technical details relating to the zero-day vulnerability that they manipulated and for 50 BTC they offered to include the master key to decrypt the files belonging to QNAP’s clients who had fallen victim to the campaign.

Check out our latest blog post to learn more👈

#MajikPOS #blog

Point-of-sale (POS) malware is a type of malicious software designed to infect POS terminals for the purpose of stealing payment data stored on magnetic stripes on the back of bank cards. On April 19, 2022, the Group-IB Threat Intelligence identified a Command and Control (C2) server of the POS malware called MajikPOS.

Our experts analyzed the server and established that it also hosts a C2 administrative panel of another POS malware called Treasure Hunter, which is also used to collect compromised credit card data. After analyzing the malicious infrastructure, Group-IB researchers retrieved information about the infected devices and the credit cards compromised as a result of this campaign. Since at least February 2021, the operators have stolen more than 167,000 payment records (as of September 8, 2022), mainly from the US. According to Group-IB’s estimates, the operators could make as much as $3,340,000 if they simply decide to sell the compromised card dumps on underground forums.

Read our latest blog post to learn more about the analysis of the MajikPOS and Treasure Hunter samples 👈