Group-IB
2.2K subscribers
741 photos
26 videos
2 files
527 links
Your daily source of cybersecurity news brought to you by Group-IB, one of the global industry leaders.
Download Telegram
#gib_thf #marketplace
Group-IB joins Palo Alto Networks Cortex XSOAR Marketplace

⭐️
Our Threat Hunting Framework Polygon, a Malware Detonation & Research platform, is now available on the Palo Alto Networks Cortex XSOAR Marketplace, the industry’s largest and most comprehensive security orchestration marketplace. The content pack from Group-IB on Cortex XSOAR’s Marketplace provides customers with a tool that guarantees malware detonation and behavioral analysis, and was developed by engineers with long-standing experience in investigating cybercrimes worldwide, and participating in global operations with international law enforcement, incident response, and cyberattack monitoring and attribution.

🔁 Group-IB’s THF Polygon is an integral part of the company’s ecosystem of high-powered and innovative solutions for protection against previously unknown threats and targeted attacks along with investigating and responding to cybercrimes to minimize potential consequences. Be sure to have a look at the comprehensive overview to learn more.

💬 “A robust, open ecosystem is at the heart of Cortex XSOAR,” said Rishi Bhargava, VP of Product Strategy for Cortex XSOAR at Palo Alto Networks. “We are proud to welcome Group-IB to the Cortex XSOAR Marketplace ecosystem, which has 700+ integrations that enable our customers to connect disparate security tools and data sources to enable maximum efficiency in the SOC.”
#phishing #benelux
Group-IB has assisted the Dutch National Police in the operation to apprehend alleged members of a cybercriminal group codenamed “Fraud Family”

⚔️ Our Amsterdam-based team has identified the individuals behind the Dutch-speaking syndicate that develops, sells and rents sophisticated phishing frameworks, and shared their findings with the authorities. According to the police, the operation resulted in the arrest of two suspects who are thought to be the developer and seller of the phishing frameworks distributed by the Fraud Family.

🧑‍💻 Group-IB Threat Intelligence unit has been detecting massive phishing attacks against Dutch and Belgian residents since the beginning of 2020. The fake pages detected by Group-IB Threat Intelligence & Attribution system were almost identical and disguised to look like legitimate websites of the biggest local financial organizations to trick unsuspecting victims into providing their personal and banking data.

👥 A typical attack, analyzed by Group-IB researchers, started with an email, SMS, or WhatsApp message impersonating a real financial organization. Using well-known brands, fraudsters gained users’ immediate trust. These fake notifications contained malicious links to adversary-controlled phishing websites that steal payment info.

🔁 Having analyzed the technical infrastructure and phishing templates used in these fraudulent campaigns, our researchers uncovered a massive Fraud-as-a-Service operation.

💬 Dutch Public Prosecutor, Attorney Witeke Koorn said: “Digital fraud such as phishing is a social problem that requires an integrated approach. This approach involves a joint effort between the Police, Public Prosecutors, banks, government agencies and others together for investigation, prosecution and prevention."

➡️ Click here to read the full story and make sure to check out our latest blog post for detailed technical analysis of Fraud Family’s operations.
The image illustrates Fraud Family's phishing scheme
#mou #cooperation
Group-IB and CyberPeace Institute collaborate for a safer cyberspace

Earlier this week, Group-IB and the CyberPeace Institute signed a Memorandum of Understanding (MoU) to collectively mobilize action for cyber security and to strengthen ongoing cooperation across multiple areas including:

👉Sharing of knowledge and expertise on threat hunting, digital forensics and investigations
👉Technical support for threat hunting, threat intelligence, digital forensics, Incident Response and Investigations
👉Cross-border collaboration on research and development for the protection of critical information infrastructures

🔹Nick Palmer, Head of Global Business at Group-IB welcomed the MoU agreement and had this to say: “CyberPeace Institute is one of those organizations that makes the world a better place by ridding cyber criminals of it. With an incredible team of experienced experts, NGO constituents of CyberPeace Institute receive support in analysis and post-incident investigations. As Group-IB, and our team of experts, hold near and dear investigation and attribution of cyber criminals, it is our great pleasure to support the CyberPeace Institute with our technical analysts from Threat Intelligence, Hi Tech Crime Investigations, CERT-GIB and much more. With these types of public - private partnerships we can ensure that we work together for the good of the world in the fight against cybercrime.”

🔹 The CyberPeace Institute is an independent non-governmental organization whose mission is to ensure the rights of people to security, dignity and equity in cyberspace. The Institute works in close collaboration with relevant partners to reduce the harms from cyberattacks on people’s lives worldwide. By analyzing cyberattacks, the Institute exposes their societal impact, how international laws and norms are being violated, and advances responsible behaviour to enforce cyberpeace.

🔹“At the heart of the CyberPeace Institute’s efforts is the recognition that cyberspace is about people. We need to act collectively and collaboratively to ensure respect for people’s rights and safety. Combining our knowledge and expertise with Group-IB, this MoU is a clear signal of intent for deeper and more coordinated collaboration striving for a cyberspace at peace, for everyone, everywhere” stated Bruno Halopeau, Chief Technology Officer, CyberPeace Institute.

🔹 CyberPeace Institute’s ongoing mission includes increasing public awareness of the real-life impact of cyberattacks as well as reminding state and non-state actors of the international law and norms governing responsible behaviour in cyberspace to reduce harm and ensure the respect of the rights of people in cyberspace. This approach goes in line with one of Group-IB’s core values: zero tolerance to cybercrime, which makes us even more excited to bring our cooperation to the next level.
#pdd #education #singapore
Exciting news! We became the first cybersecurity company to join JTC’s Punggol Digital District

🤖 The district is a home to top international players in cybersecurity, blockchain, robotics and smart living solutions in Singapore.

🕴At the inaugural PDD: Connecting Smartness event held earlier today, Singapore’s Minister for Trade and Industry Mr Gan Kim Yong announced Group-IB’s move into the smart district, along with three other international heavyweights in the digital sectors.

💬 “It’s a great honor for me and my company to be part of JTC’s Punggol Digital District,” commented Group-IB CEO and founder Ilya Sachkov. “I’m sure that today marks a milestone for Singapore and the Asia-Pacific region in general as we’re inaugurating a strategic project that will be leading Singapore in the implementation of its Smart Nation Initiative and will stand at the forefront of the region’s digital transformation. I feel a special responsibility for this initiative since my company, Group-IB, is the first cybersecurity company to join this smart district and we expect a great journey ahead.”

As the first cybersecurity firm to join the initiative, we will👇

🔹Bring the expertise that we accumulated over nearly two decades
🔹Become an all-inclusive cybersecurity provider to the community, bringing, among others, our system intended for creating organization-tailored threat landscape, analyzing and attributing cyberattacks and proactive threat hunting, Threat Intelligence & Attribution, and solution for adversary-centric detection of targeted attacks and unknown threats for IT and OT environments, Threat Hunting Framework, to it.
🔹Collaborate with the Singapore Institute of Technology to develop and operate a cybersecurity testing facility in the smart district – PDD Cyberpolygon Sandzone, a tool for emulating network infrastructures of any configuration, topology or scale for both theoretical research and practical trials.
🔹Work with other players in Punggol Digital District, like the Cyber Security Agency of Singapore , the Government Technology Agency, and cybersecurity associations to turn the district into the space of advanced cybersecurity awareness and form risk-aware culture.

We are confident that our active presence will give students opportunities to apply knowledge in the real-world context through access to Group-IB’s solutions and monitoring systems 💪
#pdd #singapore
The Punggol Digital District brings together the Singapore Institute of Technology campus and JTC’s Business Park spaces within Punggol North to create Singapore’s first truly smart district.

It is envisioned to be a home for growth industries of the digital economy like cybersecurity and digital technology as well as an inclusive and green lifestyle destination for the surrounding community.

📽 Check out the video about this unique location, featuring our CEO Ilya Sachkov!
#blog #threatintelligence
The new Group-IB Threat Intelligence blog is here!

🧑‍💻 This post opens a series in which Group-IB team members will explain how to maximize the value of threat intelligence and attribution. We will showcase how to take advantage of different proprietary features of Group-IB’s Threat Intelligence & Attribution solution to provide better protection to customer assets and help them make more informed and balanced risk mitigation decisions.

Be sure to read today’s edition to find out 👇

🔹How wide is the market for breached databases
🔹How attackers use this compromised data to harm businesses and extract financial gain
🔹Which technologies are needed to detect and monitor breached credentials
🔹How to solve a number of threatening use cases with the “Breached DB” section of Group-IB Threat Intelligence & Attribution

➡️ Click here to read now!
#blog #threatintelligence #chineseapt
New Group-IB blog is live!

Our Threat Intelligence team discovered that the attacks on Russian government organisations in 2020, earlier attributed to Chinese nation state TA by SentinelOne, could have been carried out by two Chinese groups #TA428 and #TaskMasters.

Group-IB researchers analysed the toolset used in the attacks, compared it with these APTs’ arsenal seen in the past, and showed how their malware has evolved.

➡️ Click here to learn more details!
New blog post from Group-IB’s Threat Intelligence team!

Group-IB TI analysts examined Prometheus TDS — an underground service designed to distribute malicious files and redirect users to phishing and malicious sites. Prometheus TDS-operated campaigns, to distribute #Hancitor specifically, were previously described by Unit42 and McAfee researchers.

Group-IB researchers determined that the very same pattern was used to distribute #Campo Loader, #IcedID, #QBot, #SocGholish, and #BuerLoader. Group-IB discovered at least 3,000 targets of separate malware campaigns that make use of the same scheme.

By analyzing the malware distribution campaigns, Group-IB's suggested that it was possible for them to be carried out using the same MaaS solution. This assumption proved correct after Group-IB found offers to sell Prometheus TDS on underground forums.

More details in our blog post ➡️ https://bit.ly/3yuXneD
#ransomware
It's alive: the story behind the BlackMatter ransomware strain

⚔️The summer of 2021 brought not only hot weather, but also hot news from the world of ransomware. In late May, DoppelPaymer used a marketing trick and renamed its new ransomware to Grief (Pay OR Grief). Moreover, in June-July hacker groups DarkSide and REvil disappeared from the radars after the notorious attacks against Colonial Pipeline and Kaseya, respectively. By the end of July, a new player called BlackMatter entered the ransomware market. Is BlackMatter really new to the scene, however?

🕵️‍♀️Andrey Zhdanov, an expert in proactive search for cyber threats at Group-IB, has already analyzed one of the samples of the new ransomware program BlackMatter and came to the conclusion that in terms of code and functionality, it is suspiciously very similar to the tools of infamous groups DarkSide and REvil. All the details are in our blog.
#Ransomware
Comparing BlackMatter, DarkSide and REvil: spot the difference

☝️And now about the most important conclusions of our fresh study. As a result of the analysis of the new ransomware program sample, Group-IB experts revealed clear links between BlackMatter, DarkSide and REvil samples. The legacy of DarkSide seems to be the most apparent. For the specific details, check our table 👈

🎯 It is still impossible to say for sure whether the same development team was behind all the three ransomware strains. However, it is obvious that the vacant seat was quickly filled: DarkSide and REvil were replaced by an equally sophisticated BlackMatter. All the details are in our blog.
#links #cardshops

Bold ad campaign: AWC joins illicit carding business by offering 1 Mln compromised cards for free

🖥On August 2, Group-IB Threat Intelligence & Attribution system detected an unconventional post on several carding forums. A user, nicknamed AW_cards posted links to a file containing 1 million pieces of stolen payment records. The file offered for free contained compromised card details from over 1,000 banks in more than 100 countries, including India, Mexico, the US, Australia, Brazil, and etc.

🕵️‍♀️The post immediately sparked Group-IB researchers' interest, because cybercriminals in the carding community rarely offer so many cards for free. It's especially unusual for a previously unknown market player. The analysis of the file revealed that this huge batch of compromised cards had not appeared on other underground forums.

💰Further research revealed that the post was nothing but a very bold ad to scale up the user base of newly established card shop All World Cards, which joined the carding market in May 2021. Group-IB researchers found out that the alleged owners of the card shop had launched a massive promo campaign in the underground to advertise their new platform, which, in addition to a huge database giveaway, included a writing contest for other cybercriminals with a cash prize of USD 15,000.

🎯This post analyzes the latest 1 mln stolen bank card record database as well as the short history of the All World Cards card shop and the activity of its alleged owners who are most likely not the newbies of the carding business. All the details are in our fresh blog
#GIB_TIA #threatintelligence

Group-IB is honored to announce it has been named one of the leaders in the global cyber threat intelligence market by Frost & Sullivan, an international research & consulting firm.

According to “Frost Radar: Global Cyber Threat Intelligence Market, 2021,” Group-IB with its proprietary Threat Intelligence & Attribution (TI&A) platform is one of the most innovative threat intelligence vendors and the third-largest one, enjoying an over 15-percent share of the global market. Frost & Sullivan analysts particularly highlighted the growth rate of the company, having noted its average revenue growth of 72% in the course of the past three years.

“Group-IB is rapidly gaining mindshare in the cybersecurity industry and threat intelligence community,” the report read. “Group-IB recognizes the importance of tackling cybercrime for public security and forms partnerships with law enforcement agencies and non-governmental and intergovernmental organizations worldwide. Such initiatives contribute to Group-IB's recognition as a trusted intelligence provider.”

Read more -> https://bit.ly/2VK8yCf
#GIB_TIA #threatintelligence

Why Tailored Threat Intelligence?


From the new Group-IB threat intelligence blog post you will learn why tailored threat intelligence is the key to making a corporate CTI program effective and how to move away from irrelevant generic feeds to:

- Custom Threat hunting rules
- Tailored threat landscape
- Tailored reports and research

Click here to learn more: https://bit.ly/3s7Z3II