now browsing by tag
THIS WEEK, SAKS Fifth Avenue, Saks Off 5th, and Lord & Taylor department stores—all owned by The Hudson’s Bay Company—acknowledged a data breach impacting more than five million credit and debit card numbers. The culprits? The same group that’s spent the last few years pulling off data heists from Omni Hotels & Resorts, Trump Hotels, Jason’s Deli, Whole Foods, Chipotle: A mysterious group known as Fin7.
Data breaches dog consumers every day, whether they’re ordering food from Panera, or tracking their nutrition with an Under Armour app. But if you’ve particularly had your credit card number stolen from a restaurant, hotel, or retail store in the past few years, you may have experienced FIN7 up close.
While lots of criminal hacking gangs are simply out to make money, researchers regard FIN7 as a particularly professional and disciplined organization. The group—which often appears to be Russian-speaking, but hasn’t been tied to a home country—generally works on a normal business schedule, with nights and weekends off. It has developed its own malware tools and attack styles, and seems to have a well-funded research and testing division that helps it evade detection by antivirus scanners and authorities more broadly. In the Saks breach, FIN7 used “point of sale” malware—software secretly installed in the cash register transaction systems customers interact with—to lift the financial data, a signature move.
“They’re connected to almost every major point of sale breach,” says Dmitry Chorine, cofounder and CTO of Gemini Advisory, a threat intelligence firm that works with financial institutions and that first reported the Saks/Lord & Taylor breach. “From what we’ve learned over the years the group is operated as a business entity. They definitely have a mastermind, they have managers, they have money launderers, they have software developers, and they have software testers. And let’s not forget they have the financial means to stay hidden. They make at least $50 million every month. Given that they’ve been in business for many years, they probably have at least a billion dollars on hand.”
Researchers have carefully tracked FIN7 for years, identifying their tools and watching their techniques evolve and advance. And many of the observers have even gone head-to-head with the group during network attacks, learning the group’s ethos by actively sparring with it.
The anonymity of cyberspace makes it difficult to pin down exactly who commits which crimes, though, and whether they’re actually all part of the same group or simply using similar tools.
As a result, FIN7 is known by many names. Many. The “FIN7” name itself is often associated with retail and hospitality credit card number heists, while another group—perhaps another division of the same entity, or a pre-existing gang that FIN7 spun off from—focuses on targeting financial organizations to directly steal and launder money. This bank heist operation has been called Carbanak or Cobalt (after a tool called Cobalt Strike), or some variation; FIN7 is sometimes called by these names as well. The security firm Crowdstrike also has its own versions of the names, Carbon Spider and Cobalt Spider. Carbon Spider targets the retail and hospitality industries; and Cobalt Spider hits financial institutions and ATMs. Adding to the confusion, Gemini Advisory also sometimes calls FIN7 “JokerStash,” after the dark web marketplace where the group sells the credit card data is steals.
It’s a mess. But while it’s virtually impossible to know the exact breakdown, all of these actors evolved from malware campaigns between 2013 and 2015 that used the banking trojans Carberp and Anunak to attack financial institutions. “There’s definitely a relationship between what we call Carbon Spider and Cobalt Spider,” says Adam Meyers, vice president of intelligence at the security firm CrowdStrike. “There’s some overlap in the malware that’s used and there are a lot of theories. Did Carbon Spider split from Cobalt? Do they have shared tooling? Did somebody leave the group and bring some of the tools with them?”
Regardless of the name, FIN7’s effectiveness stems from a rigorous, professional approach—including devious phishing schemes that trick victims into infecting their own networks—that researchers say is more typical of nation state hacking than criminal skulduggery. The group has also demonstrated a powerful ability to quickly evolve new strategies and adapt tools. Last fall, the security firm Morphisec showed that it only took FIN7 a day to create a fileless malware attack for a newly discovered weakness in Microsoft applications.
“The feeling you get working against them on an incident response team is that they aren’t going down without a fight,” says William Peteroy, CEO of the security firm Icebrg, which has helped clients remediate FIN7 attacks. “They are very committed to getting access to certain targets, they are very committed to maintaining access to those targets, and it’s for the overall goal of pulling as much credit card data out of the environment as they can. They’re not the best-trained, best operations security people on the internet, but they are professional. They go to work in the morning and their job is to steal credit card numbers.”
Based on Icebrg’s research and firsthand experience, Peteroy sees the group’s focus on evading antivirus scans as one of its biggest assets. FIN7 constantly tests its hacking tools against malware scanners to see if they raise an alarm, and tweaks them if they do to fly under the radar for another day.
“They have a pretty incredible track record of staying one step ahead of antivirus vendors,” Peteroy says. “They do constant testing of their toolsets. You would not expect to see a technique like that from a criminal organization. But it’s really just like a business maximizing your profitability. You’re not trying to develop things that are 10 steps ahead, you’re just trying to keep one step ahead.”
So far FIN7 has largely succeeded at staying just out of reach, but it works at such a massive scale on so many heists at once that there are bound to be missteps. Just last week, Spanish police working with Europol, the FBI, and a group of other international agencies arrested what they called the “mastermind” behind Carbanak’s financial institution hacking, particularly a spree of ATM jackpotting and other money laundering. “The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity,” Steven Wilson, the head of Europol’s European Cybercrime Centre, said of the operation last week.
Though an impressive step, researchers are skeptical that the arrest will really destabilize or neuter such a robust criminal syndicate. “Someone who was using part of the tools was arrested in Spain. He may be at a higher level of the food chain, but it definitely doesn’t necessarily mean the whole group has been dismantled,” says Gemini Advisory’s Chorine. “Even if you observe the chatter on criminal forums, there’s no clear indication of who was arrested.”
So as has been the case for years now, FIN7 will likely live to steal another credit card number. Or, more likely, millions of them.
The post THE #BILLION-DOLLAR #HACKING GROUP BEHIND A #STRING OF BIG #BREACHES appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
To Purchase This Product/Services, Go To The Store Link Above Or Go To http://www.become007.com/store/ US woman Darlene Daggett had high hopes of finding her ideal partner when she took out a “CEO level” membership with an exclusive dating service. But the retired corporate spent US$150,000 (NZ$206,200) only to be sorely…
The post Woman sues international dating agency after string of bad matches appeared first on Become007.com.
View full post on Become007.com
A gymnastics coach who has represented Scotland in the Commonwealth Games has been charged with a string of sex offences against three teenage girls.
Ryan McKee, 25, is accused of engaging in sexual activity with the girls over a five-year period between March 2010 and August 2015.
McKee, from Kinning Park, Glasgow, represented Scotland in the 2010 Commonwealth Games in Delhi.
He denies the charges and is due to stand trial at Glasgow Sheriff Court in August.
Court papers claim in each of the charges that he was in the course of his employment as a gymnastics coach.
It is alleged he repeatedly kissed each of the girls, who cannot be identified.
The post Commonwealth gymnast faces string of child abuse claims appeared first on Parent Security Online.
View full post on Parent Security Online
A Santa Fe man will spend three years and four months behind bars for his role in what a judge described as an “ongoing crime wave of identity theft and fraud.” Johnny Moreno, 41, on Tuesday pleaded guilty to 14 counts stemming from a scheme to steal credit cards from mailboxes, buy electronics and sell or trade the merchandise. Moreno is one of five people charged in connection with the racket cracked open by sheriff’s office investigators last spring after a woman tried to cash counterfeit checks at Buffalo Thunder Casino & Resort using what prosecutors say was a purloined driver’s license. Authorities said the woman and an accomplice were caught with a vehicle that had been reported stolen and contained various credit cards, checks, letters, driver’s licenses as well as a Social Security card. Their arrest led to a search of the home of another alleged co-conspirator, who is scheduled to take a plea deal Wednesday. Moreno was arrested after employees at the Target store on Zafarano Drive reported to law enforcement that he used three different credit cards to buy high-dollar electronics at the store on various occasions during the course of a few weeks. Moreno and a […]
The post String of credit card thefts Man gets 4 years in prison appeared first on National Cyber Security.
View full post on National Cyber Security
hacker proof, #hackerproof
The post String of credit card thefts Man gets 4 years in prison appeared first on AmIHackerProof.com.
View full post on AmIHackerProof.com
Authorities have arrested and charged two Florida men who reportedly went on a fraudulent spending spree at Blount County stores. Alan Rivero Carrazana, 29, Hialeah, Fla., and Yasmany Ulacia Garcia, 27, Orlando, Fla., were arrested by Alcoa Police officers Friday on charges of identity theft. Carrazana has been charged with two counts of identity theft, while Garcia has been charged with three. Carrazana was being held in lieu of bonds totaling $40,000, while Garcia was being held in lieu of bonds totaling $60,000. They are scheduled to appear at 9 a.m. Oct. 15 hearings in Blount County General Sessions Court. Source: http://www.thedailytimes.com/news/florida-men-charged-in-string-of-credit-card-fraud/article_8c53696c-5356-5f22-8c6c-7a929043175d.html
For more information go to http://www.NationalCyberSecurity.com, http://www. GregoryDEvans.com, http://www.LocatePC.net or http://AmIHackerProof.com
The post Florida men charged in string of credit card fraud appeared first on National Cyber Security.
View full post on National Cyber Security
Several recent unrelated crimes in Sioux Falls all have one thing in common — they involved teenagers.
From a string of burglaries to a home invasion, it seems there’s been an uptick in teen crime over the past few weeks.
“I think during the summer we do see a little bit more crime that involves teenagers,” said Officer Sam Clemens, Sioux Falls Police Dept.
There have been three recent serious crimes involving teens.
First, an early morning home invasion in July. Police say five teenagers attempted to rob an apartment on South Louise Avenue for drugs and money.
This case, police say, is eerily similar to the 2013 Jordan Lebeau case, which ended in murder.
The post Police Address Recent String Of Teen Crimes In Sioux Falls appeared first on Parent Security Online.
View full post on Parent Security Online