Analysts warn that the attack group, now known as ‘Earth Centaur,’ is honing its attacks to go after transportation and government agencies.

It’s similar to Lazarus’s Manuscrypt malware, but the new spyware is splattering itself onto government organizations and ICS in a non-Lazarus-like, untargeted wave of attacks.

The new tool manipulates Windows Registry in unique ways to evade security detections and is likely being used by ransomware groups for initial network access.

Log4j is being exploited by all sorts of attackers, all over the Internet:

At that point it was reported that there were over 100 attempts to exploit the vulnerability every minute. “Since we started to implement our protection we prevented over 1,272,000 attempts to allocate the vulnerability, over 46% of those attempts were made by known malicious groups,” said cybersecurity company Check Point.

And according to Check Point, attackers have now attempted to exploit the flaw on over 40% of global networks.

And a second vulnerability was found, in the patch for the first vulnerability. This is likely not to be the last.

Cybercriminals make people uneasy about the safety of their identity and online accounts. McAfee is your partner who’ll work tirelessly to restore your confidence in your online activities. Check out this roundup of privacy protection, identity protection, and device security best practices to boost your confidence in the safety of your personal information and technology. 

Privacy Protection 

Privacy protection means keeping the information you’d rather keep to yourself from getting in the hands of advertisers, cybercriminals, and nefarious groups seeking to use your personal details for their benefit. To boost your online privacy, all it takes is a few thoughtful additions to your daily browsing, email, and social media routine.  

First, think carefully about your social media habits. Do you post everything about your day and childhood, pin your location, and share photos of documents that include your full name, birthday, or address? You may want to consider cutting back on what you broadcast on the internet, especially if your account is public for anyone to view. Unfortunately, while your friends and family may love your status updates, cybercriminals love them more. After only minutes of snooping, cybercriminals can glean enough personal details about you to impersonate you or target a social engineering attempt at you. To keep your private information private, limit what you share on social media and pare down your follower and friend lists to only people you know in real life. 

Another way to protect your privacy is to use a virtual private network (VPN). A VPN allows you to remain completely anonymous online, scrambling your location and your connection. Some users may swear by incognito mode for safe browsing; however, only a VPN can ensure your privacy is protected. Incognito mode, also known as private mode, deletes your browsing history, cookies, and site data on your device once you log out of a session. While incognito mode prevents someone from snooping on your browsing history if they gain access to your device, you’re still vulnerable to cyber criminals intruding on your sensitive transactions.   

A VPN is especially important when you’re logged on to a public network, like those in coffee shops, libraries, and transportation hubs. Cybercriminals often lurk on non-password-protected Wi-Fi networks and eavesdrop on people paying bills or online shopping to steal their credentials. 

You should also invest in antivirus software, and turn on automatic updates so you can be confident that you are always running the most secure, recent version. McAfee Total Protection Ultimate is an all-in-one service that protects your personal information and privacy. It also includes premium antivirus software, safe browsing, and a VPN. 

Identity Protection 

Another type of online security you need is protection against identity theft. Identity theft is a broad term that can apply to the following unfortunate situations: 

• Synthetic identity fraud. This most common type of identity theft occurs when a criminal steals a Social Security Number and ascribes it to a totally new identity. 
• New account fraud. New account fraud happens when a criminal successfully steals personal identifiable information (PII) and financial information and uses a victim’s excellent credit score to open new credit cards, utility accounts, cellphone accounts, etc. 
• Account takeover fraud. Account takeover fraud means that a cybercriminal steals banking credentials and then adds themselves as authorized users, meaning that they get a credit card tied to the victim’s banking account. Luckily, this type of fraud is on the way out, thanks to the prevalence of EMV chip readers. 
• Medical identity theft. Medical identity thieves impersonate patients to gain access to their prescription medications and have their medical treatments paid for by the identity theft victim. 
• Business identity theft. Often targeted at small business owners, business identity theft is when a cybercriminal attempts to open new credit lines in the business’ name or sends customers phony bills and collects the payments themselves. 

In each case, the consequences can be a hassle to deal with and may even affect your finances, credit score, and ability to secure loans, a mortgage, or future credit cards. One way to keep your identity secure is to guard your PII carefully. Never give out your Social Security Number unless it’s absolutely necessary and never share it over email. Also, stay on top of the news and take action immediately if a company that houses your PII is breached by a cybersecurity attack. That way you can quickly take action to hopefully protect your account. 

Sometimes, you do everything right and a cybercriminal still gets their hands on your PII, like through a breach at a company with which you have an account. You may want to invest in an identity protection service that provides dark web monitoring and alerts you to unusual activity that could indicate identity theft.  

McAfee Identity Protection Service is easy to set up and offers extensive monitoring of over 60 types of PII. McAfee notifies identity theft victims up to 10 months sooner than similar identity monitoring services and grants $1 million in ID theft coverage to help you get back on your feet if a cybercriminal steals your identity. 

Device Security 

Device security covers the actions you take to keep your physical devices safe from thieves and harmful software, like viruses and malware.  

The first step to keeping your laptops, tablets, and smartphones safe is to know where your devices are at all times and never let anyone you don’t know to use them. Password-protect your devices, so in the case, you leave your laptop in a taxi or forget your phone at a coffee shop, you know that your information stored within is inaccessible. Back up your files frequently so if you do lose a device and have to wipe it remotely, you don’t lose all your photos or work documents. 

Another component of device security is defending against malicious software. Viruses and malware can make their way onto your devices through several avenues, including sketchy websites, dishonest downloads, phishing schemes, and clicking on ads. Be careful on what you click on and use common sense when visiting websites that look untrustworthy. 

McAfee Total Protection prevents, scans, detects, and deletes viruses and malware from your devices. McAfee antivirus provides real-time, 24/7 threat protection plus a 100% guarantee that it’ll remove viruses from your devices. Additionally, McAfee Web Advisor is a free option that alerts you when you visit potentially risky sites, so you can be more confident in your browsing and downloading. 

The post Privacy, Identity, and Device Protection: Why You Need to Invest in All Three appeared first on McAfee Blogs.

A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent “SIM swaps,” scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities.

Truglia admitted to a New York federal court that he let a friend use his account at crypto-trading platform Binance in 2018 to launder more than $20 million worth of virtual currency stolen from Michael Terpin, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.

Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court. In May 2019, the jury awarded Terpin a $75.8 million judgment against Truglia. In January 2020, a New York grand jury criminally indicted Truglia (PDF) for his part in the crypto theft from Terpin.

A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their mobile device has been damaged or lost, or when they are switching to a different phone that requires a SIM card of another size.

But fraudulent SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone controlled by the scammers. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many financial institutions and online services rely on text messages to send users a one-time code for multi-factor authentication.

Compounding the threat, many websites let customers reset their passwords merely by clicking a link sent via SMS to the mobile phone number tied to the account, meaning anyone who controls that phone number can reset the passwords for those accounts.

Reached for comment, Terpin said his assailant got off easy.

“I am outraged that after nearly four years and hundreds of pages of evidence that the best the prosecutors could recommend was a plea bargain for a single, relatively minor count of the unauthorized use of a Binance exchange account, when all the evidence points toward Truglia being one of two masterminds of a wide-ranging criminal conspiracy to steal crypto from me and others,” Terpin told KrebsOnSecurity.

Terpin said public court records already show Truglia bragging about stealing his funds and using it to finance a lavish lifestyle.

“He at the very least withdrew 100 bitcoin (worth $1.6 million at the time and nearly $5 million today) from my theft into his wallet at a separate, US-based exchange, and then moved or spent it,” Terpin said. “The fact is that the intentional theft of $24 million, whether taken at the point of a gun in a bank or through a SIM card swap, is a major felony. Truglia should be prosecuted to the fullest extent of the law.”

Terpin also is waging an ongoing civil lawsuit against 18-year-old Ellis Pinsky, who’s accused of working with Truglia as part of a SIM swapping crew that has stolen more than $100 million in cryptocurrency. According to Terpin, Pinsky was 15 when he took part in the $24 million 2018 SIM swap, but he returned $2 million worth of cryptocurrency after being confronted by Terpin’s investigators.

“On the surface, Pinsky is an ‘All American Boy,’” Terpin’s civil suit charges. “The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.”

“Despite their wholesome appearances, Pinsky and his other cohorts are in fact evil computer geniuses with sociopathic traits who heartlessly ruin their innocent victims’ lives and gleefully boast of their multi-million-dollar heists,” the lawsuit continues. “Pinsky is reputed to have used his ill-gotten gains to purchase multi-million-dollar watches and is known to go on nightclub sprees at high end clubs in New York City, and Truglia rented private jets and played the part of a dashing playboy with young women pampering him.”

Pinksy could not be immediately reached for comment. But a review of the latest filings in the lawsuit show that Pinsky’s attorneys stopped representing him because he no longer had the funds to pay for their services. The most recent entry in the New York Southern District’s docket asks the court to give Pinsky additional time to seek counsel, and hints that barring that he may end up representing himself.

Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the REACT task force, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities arrested Truglia on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from Robert Ross, a San Francisco father of two who later went on to found the victim advocacy website stopsimcrime.org.

According to published reports, Truglia and his accomplices also perpetrated SIM swaps against the CEO of the blockchain storage service 0Chain; hedge-funder Myles Danielson, vice president of Hall Capital Partners; and Gabrielle Katsnelson, the co-founder of the startup SMBX.

Truglia is currently slated to be sentenced in April 2022 for his guilty plea in New York. He faces a maximum sentence of up to 20 years in prison.

Erin West, deputy district attorney for Santa Clara County, told KrebsOnSecurity that SIM swapping remains a major problem. But she said many of the victims they’re now assisting are relatively new cryptocurrency investors for whom a SIM swapping attack can be financially devastating.

“Originally, the SIM swap targets were the early adopters of crypto,” West said. “Now we’re seeing a lot more of what I would call normal people trying their hand at crypto, and that makes a lot more people a target. It makes people who are unfamiliar with their personal security online vulnerable to hackers whose entire job is to figure out how to part people from their money.”

West said REACT continues to train state and local law enforcement officials across the country on how to successfully investigate and prosecute SIM swapping cases.

“The good news is our partners across the nation are learning how to conduct these cases,” she said. “Where this was a relatively new phenomenon three years ago, other smaller jurisdictions around the country are now learning how to prosecute this crime.”

All of the major wireless carriers let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or corrupt mobile store employees.

For some tips on how to minimize your chances of becoming the next SIM swapping victim, check out the “What Can You Do?” section at the conclusion of this story.

DHS Launches Bug Bounty Program

Grindr Fined €6.5m for Selling User Data Without Explicit Consent

UK’s New Cyber Strategy Designed to Boost Position as “Global Cyber Power”

“It is important that as a society, we take this threat seriously”

Web App Attacks Surge 251% in Two Years