The United States has indicted two Pakistani men on suspicion of operating an illegal online store that sold false identification documents on the dark web. 

Karachi residents 34-year-old Mohsin Raza and 33-year-old Mujtaba Raza were charged in a six-count federal indictment unsealed in the District of New Jersey on April 15. 

Each man is charged with conspiracy to produce and trade in false identification documents, three counts of transferring false identification documents, one count of false use of a passport, and one count of aggravated identity theft.

In 2011, the defendants allegedly set up a fraudulent e-commerce business in Karachi named at various times “SecondEye Solution” and “Forwarderz” through which they electronically produced, sold, and transferred digital versions of false documents, including government-issued ID.

According to the indictment, the business was highly lucrative, with the defendants making over $1.5m in Bitcoin transfers alone from more than 20,000 separate transactions.

The defendants allegedly advertised SecondEye’s services on at least one well-known dark net forum, claiming that customers could buy forged documents and use them to restore lost access to online accounts. 

According to the indictment, “SecondEye customers used the false SecondEye documents to defraud payment processing companies, e-commerce businesses, social media, and social networking platforms, and virtual currency exchanges, both foreign and domestic, by gaining unauthorized access to online platforms provided by such entities, often to gain access to customer accounts that previously had been revoked or suspended.”

It is further alleged that false documents created by SecondEye were used by a Russian organization accused of meddling in America’s 2016 presidential election.

“Between May 11, 2017, and September 16, 2017, a member of the Internet Research Agency LLC, a Russian organization that engaged in operations to interfere with elections and political processes, including the 2016 US presidential election, purchased multiple false identification documents from SecondEye in the names of real and fictitious US persons,” stated the Department of Justice.

“The false identification documents were later used as supporting documents for accounts previously operated by the Internet Research Agency at a social media company.”

Mohsin Raza, aka “Mohsin Raza Amiri,” and Mujtaba Raza, aka “Mujtaba Ali Lilani,” “Mujtaba Ali,” and “Mujtaba,” are currently at large. Their names have been added to the FBI’s White Collar Crimes Most Wanted website. 

America has issued a cybersecurity advisory that urges organizations to patch vulnerabilities it says are being exploited by Russian Foreign Intelligence Service (SVR) actors.

The warning was jointly issued on April 15 by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI), as the US announced new sanctions against Russia.

Titled “Russian SVR Targets US and Allied Networks,” the advisory lists five publicly known vulnerabilities and calls for network defenders to act quickly to “prevent future loss of sensitive information.”

The vulnerabilities the United States says are being exploited by SVR are CVE-2018-13379 Fortinet FortiGate VPN, CVE-2019-9670 Synacor Zimbra Collaboration Suite, CVE-2019-11510 Pulse Secure Pulse Connect Secure VPN, CVE-2019-19781 Citrix Application Delivery Controller and Gateway, and CVE-2020-4006 VMware Workspace ONE Access.

“This advisory is being released alongside the US Government’s formal attribution of the SolarWinds supply chain compromise and related cyber espionage campaign,” stated the NSA.

“We are publishing this product to highlight additional tactics, techniques, and procedures being used by SVR so that network defenders can take action to mitigate against them.”

The agency said that the SVR actors, also known as APT29, Cozy Bear, and The Dukes, are exploiting the vulnerabilities in an effort to gain access by obtaining authentication credentials.

“Mitigation against these vulnerabilities is critically important as US and allied networks are constantly scanned, targeted, and exploited by Russian state-sponsored cyber actors,” warned the NSA. 

“In addition to compromising the SolarWinds Orion software supply chain, recent SVR activities include targeting COVID-19 research facilities via WellMess malware and targeting networks through the VMware vulnerability disclosed by NSA.”

Commenting on the advisory, K2 Cyber Security co-founder and CTO Jayant Shukla said: “The easiest way to secure an organization is to keep software up to date and patched.”

He added: “Unfortunately, patching often takes organizations a significant amount of time due to testing and compliance requirements, so the sooner they can start the process the better off they will be. 

“For those applications that can be protected during runtime with newer technologies like virtual patching, organizations should implement solutions to keep these vulnerabilities from being exploited.”

Ohio PKI-as-a-Service pioneer Keyfactor and Swedish PKI solutions provider PrimeKey have announced their intention to merge.

Plans for the companies to come together under the Keyfactor brand “while committing to increased investments across all product lines” were shared on April 15. 

PrimeKey was established 19 years ago by the company’s CTO, Tomas Gustavsson, who developed an interest in computer code as a child. Today the company works with partners and customers across six continents from its headquarters in Solna, Stockholm. 

Describing how the merger would benefit customers, PrimeKey CEO Magnus Svenningson said: “Our combined solutions now give customers unparalleled deployment choices including PKI-as-a-Service, SaaS PKI (Azure, AWS, GCP), software appliance or FIPS 140–certified hardware.

“These flexible deployment options give our customers the control to operate a single pane of glass across all their machine identities in hybrid and multi-cloud environments.”

Open source software developed by PrimeKey will not be closed following the deal, which is expected to be finalized after the Swedish government approves the merger from a national security perspective.

Svenningson said: “Our EJBCA, SignServer and Bouncy Castle solutions are widely adopted by the developer community to integrate security in DevSecOps workflows and will remain open source as we continue to bring cutting-edge innovations to our enterprise customers.”

Under the terms of the merger, Svenningson will assume the roles of executive vice president (EVP) of business development and chief strategy officer (CSO) while Keyfactor’s Jordan Rackie will remain at the helm as CEO.

“The merger with PrimeKey amplifies the performance of the combined businesses across product offerings, distribution channels, expertise for our customers and large open source communities,” said Rackie. 

The CEO attributed Keyfactor’s 50% year-over-year growth to industry’s need to prevent loss of brand reputation, business outages, and fines by proactively securing the identity of every machine before disaster strikes. 

Rackie said: “Now more than ever, enterprises must operate in a zero-trust world, and machine identity management can no longer be ignored as part of an identity and access management (IAM) strategy.” 

The transaction is expected to close within the next 90 days.

Nearly half (44%) of UK remote workers have had monitoring software installed by their employer, but the trend is pushing many into more insecure practices, Kaspersky has warned.

Around a year after the pandemic forced a majority of UK employees to work-from-home, the Russian AV vendor polled 2000 full-time staff to understand levels of trust among managers and employees.

Monitoring software can be an important bulwark against non-compliant and risky user behavior, especially given the large percentage of incidents that are caused by human error. Kaspersky cited monitoring of email, internet, app and phone usage as well as location tracking as increasingly common for employers to deploy on remote endpoints.

However, a third (32%) of workers polled for the study said that the use of monitoring tools would make them less trusting of their manager or team leader, and a similar number (30%) said they would be upset at the invasion of their privacy. Around a quarter (23%) said they would be concerned about potential access to their personal information via this software.

Yet even the perception that they are being watched may ironically force remote workers into more risky online behavior.

A quarter (24%) of employees polled said they use personal devices to avoid being spied on, while almost one-third (31%) said they would be likely to do so more often for work if they knew they were being monitored.

Some said they would raise a formal complaint with an independent body (26%), or even leave their current job (24%) if they found out they were being monitored.

Kaspersky principal security researcher warned that if organizations’ risk management of remote workers goes too far, there could be damaging consequences.

“Employees working on their own devices creates shadow IT, which presents an immense risk to businesses. With more than 90% of all cyber breaches caused by human error, companies must have complete oversight of how their IT systems and hardware are being used by remote workforces, and so must carefully balance their monitoring activities,” he argued.

“Without knowing what devices are potentially in contact with a business’s data systems, IT and cybersecurity teams have great difficulty anticipating how company data can be potentially compromised, sold on, or even held for ransom.”

Google has added an extra 30-day period to its vulnerability disclosure cycle to allow customers more time to fix vulnerabilities before technical details are released.

The tech giant’s Project Zero team is a prolific researcher of industry vulnerabilities, and maintains a strict 90-day policy of public vulnerability disclosure after vendor notification, in order to pressure firms to issue patches quicker.

“In practice however, we didn’t observe a significant shift in patch development timelines,” explained manager Tim Willis yesterday. “And we continued to receive feedback from vendors that they were concerned about publicly releasing technical details about vulnerabilities and exploits before most users had installed the patch. In other words, the implied timeline for patch adoption wasn’t clearly understood.”

The extra 30-day grace period before details are released will apply only to bugs that are fixed within the initial 90-day period. If an issue remains unpatched after 90 days, technical details are published immediately.

Google also added the 30-day period to patches for bugs being actively exploited in-the-wild against users. If an issue remains unpatched after seven days, technical details are published immediately, but if it’s fixed within a week, those details will now be published 30 days after the patch.

Willis maintained that early release of the details surrounding each bug ultimately benefits the defensive community and helps protect users, but he acknowledged that it also risks inviting opportunistic attacks.

“Moving to a ‘90+30’ model allows us to decouple time to patch from patch adoption time, reduce the contentious debate around attacker/defender trade-offs and the sharing of technical details, while advocating to reduce the amount of time that end users are vulnerable to known attacks,” he concluded.

The threat actors behind the infamous Trickbot botnet have been at work again, firing highly customized phishing emails targeting Slack and BaseCamp users with loader malware, according to Sophos.

The British security vendor’s principal researcher, Andrew Brandt, explained that the campaign first appeared in January.

Malicious emails contained links to malware payloads hosted on the cloud storage services provided by popular collaboration tools like Slack.

“The emails also inserted the names of both the recipient and their employer into the messages, in an attempt to convince their enterprise recipients to download and execute the Trojan payloads temporarily hosted in those legitimate websites,” Brandt explained.

“When a target was convinced to open the documents tied to the spam email, their computer quickly became infected with BazarLoader, which itself acts primarily as a delivery mechanism for other malware. With a focus on targets in large enterprises, BazarLoader could potentially be used to mount a subsequent ransomware attack.”

Sophos also detected a second, more convoluted, campaign from the same actors, dubbed “BazarCall.” The spam message claims that the recipient’s free trial is ending and gives them a number to call in order to avoid paying for a renewal.

“In this later form of attack, only people who called the telephone number were given a URL, and instructed to visit the website where they could unsubscribe from these notifications,” said Brandt.

“The well-designed and professional looking websites bury an ‘unsubscribe’ button in a page of frequently asked questions. Clicking that button delivers a malicious Office document (either a Word doc or an Excel spreadsheet) that, when opened, infects the computer with the same BazarLoader malware.”

Sophos tied the campaigns to Trickbot via shared command and control (C2) infrastructure and the method of injecting malicious payloads into running processes, which it said it similar to Trickbot’s “injectDLL” module.

Although not as sophisticated as Trickbot, the BazarLoader malware appears to be in development and could be a new way for the gang to target high-value businesses going forward, Sophos said.