article thumbnail

How Did Authorities Identify the Alleged Lockbit Boss?

Krebs on Security

2011 said he was a system administrator and C++ coder. The indictment against Khoroshev says he used the hacker nickname Putinkrab , and Intel 471 says this corresponds to a username that was first registered across three major Russian cybercrime forums in early 2019. ” Putinkrab’s final post came on August 23, 2019.

article thumbnail

Kaseya Ransomware Supply-Chain Attack: What We Know So Far

Digital Shadows

On 02 July 2021, details started to emerge of a sophisticated supply-chain attack targeting Kaseya VSA, virtual system administrator software used to manage and monitor customers’ infrastructure. REvil is ransomware that was first observed in April 2019.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Russian-speaking cybercrime evolution: What changed from 2016 to 2021

SecureList

To top it off, cybercriminals make use of legitimate services that are meant to help system administrators, such as PSexec, which allows remote execution of programs. System administrators that take care of physical networks are no longer needed — with cloud services management being an easy task.

article thumbnail

Ransomware Gangs and the Name Game Distraction

Krebs on Security

REvil’s last big victim was Kaseya , a Miami-based company whose products help system administrators manage large networks remotely. REvil is widely considered a reboot of GandCrab , a prolific ransomware gang that boasted of extorting more than $2 billion over 12 months before abruptly closing up shop in June 2019.

article thumbnail

Updates from the MaaS: new threats delivered through NullMixer

Security Affairs

The Originating Malvertising Campaign According to CTI investigation on the adversary infrastructure, we were able to identify an ongoing campaign luring system administrators to install the malicious code into their machines. The module also exfiltrates 2FA secrets from Twilio’s Authy local storage.

Malware 82
article thumbnail

New York: Cyberattack Is Twitter's Fault, Let's Increase Regulation

SecureWorld News

The teens also took over Twitter accounts of several cryptocurrency companies regulated by the New York State Department of Financial Services (NYDFS). The Hackers further escalated the Twitter Hack and changed the fraud scheme by tweeting payment requests directly from overtaken cryptocurrency companies’ accounts. and 4:12 p.m.,