article thumbnail

FIN7 cybercrime gang creates fake cybersecurity firm to recruit pentesters for ransomware attacks

Security Affairs

FIN7 is a Russian criminal group that has been active since mid-2015, it focuses on restaurants, gambling, and hospitality industries in the US to harvest financial information that was used in attacks or sold in cybercrime marketplaces. SecurityAffairs – hacking, cyber security). ” concludes the report.

article thumbnail

Who and What is Behind the Malware Proxy Service SocksEscort?

Krebs on Security

Proxy services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they make it difficult to trace malicious traffic to its original source. SocksEscort began in 2009 as “ super-socks[.]com com , segate[.]org

Malware 203
Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Meet the Administrators of the RSOCKS Proxy Botnet

Krebs on Security

.” The DOJ’s statement doesn’t mention that RSOCKS has been in operation since 2014, when access to the web store for the botnet was first advertised on multiple Russian-language cybercrime forums. Kloster says he’s worked in many large companies in Omsk as a system administrator, web developer and photographer.

article thumbnail

FBI and CISA published a new advisory on AvosLocker ransomware

Security Affairs

AvosLocker affiliates use legitimate software and open-source remote system administration tools to compromise the victims’ networks. This joint CSA updates the advisory published by the US Government on March 17, 2022.

article thumbnail

A member of the FIN7 group was sentenced to 10 years in prison

Security Affairs

The Ukrainian national Fedir Hladyr (35), aka “das” or “AronaXus,” was sentenced to 10 years in prison for having served as a manager and systems administrator for the financially motivated group FIN7 , aka Carbanak. ” concludes DoJ.

article thumbnail

Caketap, a new Unix rootkit used to siphon ATM banking data

Security Affairs

Mandiant researchers discovered a new Unix rootkit named Caketap, which is used to steal ATM banking data, while investigating the activity of the LightBasin cybercrime group (aka UNC1945 ). Experts spotted a new Unix rootkit, called Caketap, that was used to steal ATM banking data.

Banking 128
article thumbnail

LockBit ransomware group claims to have hacked Bridgestone Americas

Security Affairs

“Bridgestone Americas are currently investigating a potential information security incident. All we do is provide paid training to system administrators around the world on how to properly set up a corporate network. We are only interested in money for our harmless and useful work.

Hacking 93