By Cyber Newswire
ELLIO and ntop partnership to boost high-speed network traffic monitoring with real-time data on opportunistic scans, botnets, and…
This is a post from HackRead.com Read the original post: ELLIO and ntop Partnership Enhances Real-Time Network Traffic Monitoring

ELLIO and ntop partnership to boost high-speed network traffic monitoring with real-time data on opportunistic scans, botnets, and mass attacks.

ELLIO, a provider of real-time, highly accurate intelligence for filtering unwanted network traffic and cybernoise, and ntop, a provider of open-source and commercial high-speed traffic monitoring applications, have announced a partnership to enhance visibility into malicious traffic originating from opportunistic scans and attacks within the network traffic monitoring tool ntopng.

By integrating a highly accurate and real-time ELLIO: Feed, ntopng’s users gain deeper insights into their network traffic through real-time information on sources of mass exploitation, botnet activity and opportunistic attacks, even before traditional rule-based detections are available.

In modern cybersecurity traffic analysis, the challenge is to anticipate problems before they happen. Blocklists are effective for blocking attackers, but they require high-quality, frequently updated data that is immune to False Positives.

> _“We’ve been using the ELLIO: Feed in live production, and it has proven highly effective at spotting threats. Compared to other security solutions such as IDSs, ELLIO doesn’t require constant supervision and handles zero-day attacks better. Thus, we’ve partnered with ELLIO to bring their technology to the ntop user community.”_
> 
> Luca Deri -Founder ntop

> _“Obtaining reliable and up-to-date information about mass exploits, botnets, and other widespread attacks is crucial for cybersecurity. These attacks easily disrupt normal network operations, affect service availability and performance, and overwhelm security teams.”_
> 
> Vlad Iliushin – CEO ELLIO

****Free trial for all ntopng users****

ntopng users with the latest version can enjoy a 30-day free trial of ELLIO: Feed integration by visiting this address.

****ELLIO: Feed improves visibility into malicious traffic originating from opportunistic scans and attacks within ntopng traffic monitoring tool****

ELLIO: Feed is a threat list that is dynamically updated every minute and contains an average of up to 200,000 IP addresses currently associated with attackers, scans, and other malicious mass exploitation activities on the Internet.

This database is constantly regenerated to ensure users have the most up-to-date information on emerging threats. ELLIO’s threat feed is supported by a powerful combination of an extensive internet sensor network operated by ELLIO, advanced ML algorithms, and real-time data processing. This mechanism enables highly reliable and fully automated threat detection delivery.

ntopng is a network traffic monitoring tool that provides a web-based interface for real-time analysis and visualization of network usage. It helps users understand network performance, detect issues, and improve security by offering insights into traffic patterns, protocols, and active hosts.

****About ntop****

ntop is an engineering-driven company that provides software for network traffic analysis, capture-to-disk and traffic generation applications optimizing the performance of Commercial Off-The-Shelf (COTS) hardware.

As a recognized leader in its field, ntop has become an industry-standard application, serving a diverse customer base that spans from individuals to key players in networking. For more information, users can visit ntop.

****About ELLIO****

ELLIO Technology is a cybersecurity company, that streamlines cybersecurity teams’ focus on critical incidents by eliminating alerts from generic attacks and cybernoise distractions. With its extensive network of internet sensors and honeypots, ELLIO collects and analyzes internet traffic, and identifies attack data while tagging exploits and vulnerabilities.

Through their advanced ML engine, real-time data processing and in-depth research, ELLIO enables organizations to gain a clearer picture of cyber security attacks and incidents. ELLIO provides reliable and fully automated filtering of cyber noise and generic attacks at the network perimeter. It helps reduce “alert fatigue,” the overload caused by too many alerts and events in SIEM and SOAR tools.

**Contact**

*   **Jana Tom**
*   **PR Relationships**
*   **ELLIO**
*   **\[email protected\]**

ELLIO and ntop Partnership Enhances Real-Time Network Traffic Monitoring

By Waqas
ShinyHunters hacking group has claimed to have breached Ticketmaster, stealing the personal data of 560 million users. The…
This is a post from HackRead.com Read the original post: Hackers Claim Ticketmaster Data Breach: 560M Users’ Info for Sale at $500K

ShinyHunters hacking group has claimed to have breached Ticketmaster, stealing the personal data of 560 million users. The 1.3 TB of stolen data also includes payment details. Learn more about this major cybersecurity incident and its implications.

The notorious hacker group ShinyHunters has claimed to have breached the security of Ticketmaster-Live Nation, compromising the personal data of a whopping 560 million users. This massive 1.3 terabytes of data, is now being offered for sale on Breach Forums for a one-time sale for $500,000.

**The Breach: Details and Implications**

ShinyHunters has allegedly accessed a treasure trove of sensitive user information, including full names, addresses, email addresses, phone numbers, ticket sales and event details, order information, and partial payment card data. Specifically, the compromised payment data includes customer names, the last four digits of card numbers, expiration dates, and even customer fraud details.

ShinyHunters on Breach Forums claiming Ticketmaster data breach (Screenshot: Hackread.com)

The data breach, if confirmed, could have severe implications for the affected users, leading to potential **identity theft**, financial fraud, and further cyber attacks. The hacker group’s bold move to put this data on sale goes on to show the growing menace of cybercrime and the increasing sophistication of these cyber adversaries.

****ShinyHunters’ Sophistication and Recent Activities****

ShinyHunters is no stranger to the hacking and cybercrime world. The group is known for its high-profile data breaches and is also the owner and administrator of Breach Forums, a notorious platform for cybercrime activities.

Despite the FBI’s recent efforts to shut down the forum, ShinyHunters managed to reclaim the seized domain, showcasing their technical prowess and resilience against law enforcement actions. This, as reported by Hackread.com, not only resulted in the return of Breach Forums to the dark web but also saw its revival on the clearnet, using the original domain.

**Communication and Response**

In an exclusive communication with Hackread.com, ShinyHunters revealed that they have attempted to contact Ticketmaster regarding the breach but have yet to receive a response. Hackread.com has reached out to Ticketmaster for a comment, and the article will be updated with any responses or official statements from the company.

****A Troubled Cybersecurity Past****

This isn’t Ticketmaster’s first encounter with cybersecurity issues. On January 26, 2023, the company admitted that ticket sales for Taylor Swift’s concerts were disrupted by a bot-driven attack, highlighting vulnerabilities in their ticketing system.

Furthermore, back in January 2021, Ticketmaster was found guilty of hacking into a rival company, Songkick, to obtain confidential information. This criminal activity led to a $10 million settlement paid to the victim company, underscoring a pattern of cybersecurity and ethical challenges faced by Ticketmaster over the years.

Users are advised to monitor their financial accounts closely, change passwords, and remain alert about potential phishing attempts. Companies like Ticketmaster must prioritize transparency and swift communication with their users to mitigate the damage and restore trust.

_Stay tuned to Hackread.com for the latest updates on this developing story._

1.  68% of US Websites Exposed to Bot Attacks
2.  Minted confirms data breach as Shiny Hunters sell its database
3.  ShinyHunters hacker leaks 5.22GB worth of Mashable database
4.  AT&T breach ShinyHunters selling AT&T database with 70M SSN
5.  ShinyHunters leak database of Indian wedding portal WedMeGood

Hackers Claim Ticketmaster Data Breach: 560M Users’ Info for Sale at $500K

ShinyHunters hacking group has claimed to have breached Ticketmaster, stealing the personal data of 560 million users. The 1.3 TB of stolen data also includes payment details. Learn more about this major cybersecurity incident and its implications.

The notorious hacker group ShinyHunters has claimed to have breached the security of Ticketmaster-Live Nation, compromising the personal data of a whopping 560 million users. This massive 1.3 terabytes of data, is now being offered for sale on Breach Forums for a one-time sale for $500,000.

**The Breach: Details and Implications**

ShinyHunters has allegedly accessed a treasure trove of sensitive user information, including full names, addresses, email addresses, phone numbers, ticket sales and event details, order information, and partial payment card data. Specifically, the compromised payment data includes customer names, the last four digits of card numbers, expiration dates, and even customer fraud details.

ShinyHunters on Breach Forums claiming Ticketmaster data breach (Screenshot: Hackread.com)

The data breach, if confirmed, could have severe implications for the affected users, leading to potential **identity theft**, financial fraud, and further cyber attacks. The hacker group’s bold move to put this data on sale goes on to show the growing menace of cybercrime and the increasing sophistication of these cyber adversaries.

****ShinyHunters’ Sophistication and Recent Activities****

ShinyHunters is no stranger to the hacking and cybercrime world. The group is known for its high-profile data breaches and is also the owner and administrator of Breach Forums, a notorious platform for cybercrime activities.

Despite the FBI’s recent efforts to shut down the forum, ShinyHunters managed to reclaim the seized domain, showcasing their technical prowess and resilience against law enforcement actions. This, as reported by Hackread.com, not only resulted in the return of Breach Forums to the dark web but also saw its revival on the clearnet, using the original domain.

**Communication and Response**

In an exclusive communication with Hackread.com, ShinyHunters revealed that they have attempted to contact Ticketmaster regarding the breach but have yet to receive a response. Hackread.com has reached out to Ticketmaster for a comment, and the article will be updated with any responses or official statements from the company.

****A Troubled Cybersecurity Past****

This isn’t Ticketmaster’s first encounter with cybersecurity issues. On January 26, 2023, the company admitted that ticket sales for Taylor Swift’s concerts were disrupted by a bot-driven attack, highlighting vulnerabilities in their ticketing system.

Furthermore, back in January 2021, Ticketmaster was found guilty of hacking into a rival company, Songkick, to obtain confidential information. This criminal activity led to a $10 million settlement paid to the victim company.

That’s not all. Last week, on Thursday, May 23, 2024, the US Justice Department (DoJ) sued Live Nation-Ticketmaster for monopolizing markets across the live concert industry. The lawsuit highlights a pattern of cybersecurity and ethical challenges faced by Ticketmaster over the years.

Users are advised to monitor their financial accounts closely, change passwords, and remain alert about potential phishing attempts. Companies like Ticketmaster must prioritize transparency and swift communication with their users to mitigate the damage and restore trust.

_Stay tuned to Hackread.com for the latest updates on this developing story._

1.  68% of US Websites Exposed to Bot Attacks
2.  Minted confirms data breach as Shiny Hunters sell its database
3.  ShinyHunters hacker leaks 5.22GB worth of Mashable database
4.  AT&T breach ShinyHunters selling AT&T database with 70M SSN
5.  ShinyHunters leak database of Indian wedding portal WedMeGood

By Waqas
Check Point reports hackers are targeting its VPN as the company releases new security measures to prevent unauthorized…
This is a post from HackRead.com Read the original post: Hackers Target Check Point VPNs, Security Fix Released

Check Point reports hackers are targeting its VPN as the company releases new security measures to prevent unauthorized access. Enhance your VPN security with multi-factor authentication and Check Point’s latest solutions.

Over recent months, cybercriminals have increasingly targeted remote-access VPN environments, using them as entry points to infiltrate enterprises. These attackers aim to identify valuable assets and users within organizations, exploiting vulnerabilities to establish persistence on critical enterprise systems.

The Israel-based cybersecurity giant Check Point has observed a troubling trend of compromised VPN solutions across various cybersecurity vendors. Specifically, Check Point’s monitoring has detected unauthorized access attempts targeting its VPNs available for Windows and macOS customers globally

According to the company’s report shared with Hackread.com ahead of publishing on May 27, 2024. By May 24, 2024, a small number of login attempts using outdated VPN local accounts, which relied solely on password-based authentication, were identified.

In response, Check Point assembled specialized teams comprising Incident Response, Research, Technical Services, and Product professionals to investigate these and other potential threats. Through customer notifications and comprehensive analysis, these teams discovered similar unauthorized access attempts within 24 hours among a few potential customers.

It is important to mention that relying on password-only authentication is a significant security risk. Check Point strongly advises against using this method for network infrastructure login. To counteract these unauthorized remote access attempts, Check Point has released a preventative solution.

**Enhancing VPN Security: Recommendations from Check Point**

1.  **Audit Local Accounts**: Review your local accounts to determine their usage and identify any unauthorized access.
2.  **Disable Unused Accounts**: If local accounts are not in use, it is best to disable them to eliminate potential entry points for attackers.
3.  **Implement Multi-Factor Authentication (MFA)**: For local accounts that are necessary and currently rely on password-only authentication, add layer of security, such as certificates, to enhance IT security.
4.  **Deploy Check Point’s Solution**: Check Point customers should deploy the newly released solution on their Security Gateways. This measure will automatically prevent unauthorized access attempts on VPNs using password-only authentication.

****Industry Expert’s Insight****

Venky Raju, Field CTO at ColorTokens, emphasizes the urgency for organizations to transition from legacy VPNs to Zero Trust Network Access (ZTNA) solutions. He notes, _“_This is a stark reminder for organizations to make urgent plans to shift from legacy VPNs to ZTNA solutions._“_

_“_ZTNA solutions have several advantages over VPNs, chief of which is that ZTNA inherently limits what the end user can access using the principles of least privilege. Additionally, ZTNA solutions better integrate with the enterprise’s identity management system, reducing the risk of compromised passwords or misconfiguration,_”_ Raju advises.

1.  NSA, CISA Release Guidelines to Secure VPNs
2.  Hackers dump login data of Fortinet VPN users in plain-text
3.  Ivanti VPN Flaws Exploited to Spread KrustyLoader Malware
4.  Chinese Hackers Stole Ivacy VPN Certificate To Sign Malware
5.  Akira Ransomware Targets Businesses via Exploited CISCO VPNs

Hackers Target Check Point VPNs, Security Fix Released

By Waqas
A tale of emerging cybercrime and embarrassment for the world's premier law enforcement agency.
This is a post from HackRead.com Read the original post: Breach Forums Return to Clearnet and Dark Web Despite FBI Seizure

Breach Forums returns to the clearnet and dark web just two weeks after the FBI seized its infrastructure and arrested two administrators. One of the admins, ShinyHunters, regained domains despite the FBI’s efforts, highlighting significant operational setbacks and security lapses.

The notorious cybercrime and hacking forum, Breach Forums, has returned to the clearnet and dark web just two weeks after the FBI seized its entire infrastructure. The FBI arrested two administrators in the process.

The operation began on May 15, 2024, when the FBI seized all domains belonging to Breach Forums in a coordinated international effort. The next day, Hackread.com published an exclusive report revealing how ShinyHunters, the hacker and main administrator of Breach Forums, managed to regain the seized domain from right under the nose of the FBI by contacting the Hong Kong-based domain registrar, NiceNIC.

Breach Forums domain urging users to register to view its content (Screenshot: Hackread.com)

****But how did ShinyHunters regain the clearnet domains?****

While the forum has adopted a new domain for the dark web, as the original could not be regained from the FBI, it is back online with the original clearnet domain (breachforums.st). Other associated clearnet domains, including escrow.breachforums.st, breached.in, and two other parked domains, have also been regained from the FBI’s seizure.

ShinyHunters shared an email claiming it was an official conversation between an FBI computer scientist from the agency’s Cyber Division and NiceNIC, the domain registrar. The email, seen by Hackread.com, provides an in-depth background into the incident and how the hacker admin regained access to the seized domains.

****The FBI’s Email****

According to the letter, the FBI’s Cyber Division conducted an operation on May 15, 2024, against Breach Forums, seizing several domains, including breachforums.st, hosted by NiceNIC. The domains were seized legally via a court-ordered warrant.

However, a few hours after the seizure, the breachforums.st domain was returned to the original owner, ShinyHunters, and the FBI’s NiceNIC account, registered as “bf\_fbi,” was suspended.

The FBI then requested NiceNIC to reactivate their account and return the seized domains, citing NiceNIC’s terms of service, which prohibit the promotion of cybercrime. The agency urged that if the domains could not be returned, the nameservers should be changed to FBI-owned servers or the domains should be suspended to prevent further harm.

NiceNIC’s response to the FBI remains unknown. However, the fact that the domain has returned in its original form suggests that the company did not comply with the FBI’s request.

****Email Conversation****

Here is the email conversation as seen by Hackread.com: (Note: The name of the FBI agent has been removed from the email due to security and privacy reasons).

FBI Mail to Registrar: 

I'm a Computer Scientist within the FBI's Cyber Division, and I'm one of the primary point-of-contacts for any domain operations for the FBI. Earlier this week, on May 15th, 2024, the FBI had conducted an operation against the illicit forum and marketplace 'BreachForums'. 

Some public cybersecurity outlets caught wind of the actions, and posted articles on the domain seizure and subsequent splash page. On the morning of the operation, the FBI seized control of a few domains associated with BreachForums, including breachforums.st and others, that were hosted by NiceNic. We were able to lawfully seize them by serving a court-ordered seizure warrant on an account owner located in the United States. 

All of the websites that we seized from the account were dedicated to the theft, sale, and sharing of data stolen from victims around the world. Ultimately, our efforts to take down BreachForums were done to prevent any further damage done by the website to countless victims globally.

However, a few hours after the seizure of the domains, around May 15th at 9PM PST, we noticed that the breachforums.st domain was released from our custody and given back to the original threat actor. We also noticed that we were unable to log into our official FBI account at NiceNic, which was registered with the email \[email protected\] (username: bf\_fbi), leading us to believe that the account was suspended.

As such, I was wanting to provide some additional context around the situation to hopefully overturn the account suspension, in addition to returning the lawfully-seized domains back to the FBI NiceNic account.

Additionally, within your domain registration terms of service, you reference that the services will not be used to "promote hacking, cracking, or other cyber crimes or activities", which is a common activity found within and associated with BreachForums. 

If the domains cannot be returned to the FBI, we would kindly request that the nameservers be changed to FBI-owned nameservers or suspended via a clientHold to prevent further harm in accordance to your terms of service. The NiceNic account which currently holds the domains, 'vincenzotroia', has actively disregarded and broken your service agreements by continuing to host these domains.

I look forward to hearing back from you - we would all really appreciate any help or guidance that you might be able to provide on the situation.

Respectfully,

S\*\*\*

****Embarrassing Situation for The FBI****

The situation is quite embarrassing for the FBI. Despite their efforts to seize the domains of Breach Forums and take down its infrastructure, the fact that the forum was able to quickly regain its original clearnet domains highlights several issues including operational setbacks, security lapses, public perception, and legal and procedural concerns.

This also explains why, despite two weeks having passed, the FBI or the DoJ has not published press releases detailing the seizure. Nevertheless, this situation is a win-win for cybercriminals, but the next move from the FBI and other law enforcement agencies involved in the operation will be crucial to watch.

1.  New Soap2day Domains Emerge Despite Legal Challenges
2.  Data Breach at New BreachForums: 4,000 members’ data leaked
3.  AT&T breach? ShinyHunters selling AT&T database with 70M SSN
4.  FBI Seizes RaidForums, Arrests Alleged Founder Diogo Santos Coelho
5.  BreachForums Owner Pompompurin Gets 20-Year Supervised Sentence

Breach Forums Return to Clearnet and Dark Web Despite FBI Seizure

By Cyber Newswire
Cary, United States, 28th May 2024, CyberNewsWire
This is a post from HackRead.com Read the original post: INE Security Enables CISOs to Secure Board Support for Cybersecurity Training

If there is a single theme circulating among Chief Information Security Officers (CISOs) right now, it is the question of how to get stakeholders on board with more robust cybersecurity training protocols.

There are key points debated about why you should provide cybersecurity training to your IT professionals, like the alarming increase in cyberattacks (an increase of 72% over the all-time high in 2021, according to the Identity Theft Research Center’s 2023 Data Breach Report), or the rapid evolution in technology, creating a constant game of catch-up.

But it isn’t a question of ”if” an organization will be targeted, but “when.” CISOs are increasingly anxious because while they realize the axe will fall on them when the inevitable breach occurs, securing boardroom support for heavy investment in preventative measures, like training, is challenging in a world where revenue is demanded each dollar spent.

“The path to securing the boardroom’s buy-in is more complex than simply having the right statistics and studies on paper,” says Dara Warn, the CEO of INE Security, a global cybersecurity training and certification provider. “To bridge the gap between CISOs and stakeholders, CISOs must adopt a strategic approach that combines financial impact data, relevant case studies, and compelling narratives. Framing cybersecurity training as an essential investment rather than an optional expense is critical.”

****The Human Factor in Cybersecurity****

Cybersecurity is not just about technology; it’s about people. Human error remains one of the leading causes of security breaches. A study by Verizon in their 2023 Data Breach Investigations Report found that 68% of breaches involved a human element, such as social engineering, misuse of privileges, or simple mistakes. This highlights the importance of equipping employees with the knowledge and skills to recognize and respond to potential threats.

****Case Study: Capital One Data Breach****

In 2019, Capital One experienced a data breach that exposed the personal information of over 100 million customers. The breach was caused by a misconfigured web application firewall, which allowed an attacker to access sensitive data stored on Amazon Web Services (AWS). This incident underscores the importance of training employees on cloud security practices and the proper configuration of security tools. In response, Capital One enhanced its cybersecurity training programs to include cloud security, emphasizing the need for regular audits and configuration checks. This case illustrates how specialized training can prevent costly breaches and protect sensitive data.

****The ROI of Cybersecurity Training****

Investing in cybersecurity training is not just a defensive measure; it’s a strategic investment that can yield significant returns. A well-trained workforce, not just security awareness but the SOC and networking teams, can serve as the first line of defense against cyber threats, reducing the likelihood of breaches and minimizing potential damages. According to the Ponemon Institute’s 2023 Cost of Data Breach Report, organizations with extensive incident response planning and testing programs saved $1.49 million compared to those with lower levels.

****Case Study: Maersk NotPetya Attack****

In 2017, shipping giant Maersk was hit by the NotPetya malware, which spread rapidly through its global network, causing a complete shutdown of its IT systems. The attack was initiated by a compromised software update, exploiting poor cybersecurity hygiene and a lack of employee training on identifying malicious software. The incident cost Maersk over $300 million in losses.

In response, Maersk implemented a comprehensive cybersecurity training program focusing on recognizing malicious software, securing software updates, and responding to cyber incidents. This case highlights the necessity of training employees on the latest cyber threats and best practices.

****Crafting a Compelling Narrative for the Boardroom****

The company’s financial data and case studies are important to secure, but communicating that to the boardroom remains a challenge for CISOs. To get the message across, CISOs must also craft a compelling narrative that resonates with the board members. Here are some key strategies:

****1\. Speak the Board’s Language****

Board members are often more attuned to financial metrics and business outcomes than technical jargon. CISOs should frame cybersecurity training as a business enabler that protects the organization’s bottom line. Highlighting the potential financial losses from breaches and the ROI of training programs can make a compelling case.

****2\. Use Real-World Examples****

Real-world case studies, like the attacks on Maersk NotPetya and Capital One, can illustrate the tangible impact of cybersecurity training. These examples provide relatable scenarios that underscore the importance of investing in employee education.

****3\. Leverage Data and Statistics****

Presenting data from reputable sources can lend credibility to the argument. Statistics that demonstrate the prevalence of human error in breaches and the financial benefits of training can be powerful tools in persuading the board.

****4\. Emphasize Regulatory Compliance****

Regulatory requirements, such as GDPR and CCPA, mandate stringent data protection measures. Failure to comply can result in hefty fines and reputational damage. Emphasizing how cybersecurity training can help meet these regulatory requirements can be an effective angle to secure board buy-in.

****5\. Highlight Competitive Advantage****

In an increasingly competitive market, robust cybersecurity measures can be a differentiator. Companies known for their strong security posture are more likely to attract and retain customers. CISOs can highlight how a comprehensive training program can enhance the organization’s reputation and competitive edge.

****Overcoming Common Objections****

Board members may raise objections regarding the cost and time required for cybersecurity training. CISOs should be prepared to address these concerns with data-driven arguments and strategic insights.

****Cost Concerns****

While the initial investment in training programs may seem significant, CISOs can emphasize the long-term cost savings from preventing breaches. According to the Ponemon Institute, the average cost of a data breach in 2023 was $4.45 million. Investing in training can mitigate these costs by reducing the likelihood and severity of breaches.

****Time Constraints****

Board members may worry about the time employees will spend on training. CISOs can advocate for flexible, modular training programs that allow employees to learn at their own pace without disrupting productivity. Additionally, emphasizing the efficiency of targeted training programs can alleviate concerns about time investment.

CISOs are key players in protecting their organizations from cyber threats. Getting the boardroom to buy into an investment in cybersecurity training is no easy task, but utilizing some of these strategies can make it more successful. Including these steps in the process of communicating your needs to stakeholders will help secure the support and resources needed to roll out effective training programs and ultimately better safeguard the organization’s digital and physical assets. The stakes are high, and having all stakeholders on the same team is critical to the long-term success and security of an organization.

****About INE Security****

INE Security is the premier provider of online technical training and cybersecurity certifications. Harnessing the world’s most powerful hands-on lab platform, cutting-edge technology, global video distribution network, and world-class instructors, INE is the top training choice for Fortune 500 companies worldwide, and for IT professionals looking to advance their careers. INE’s suite of learning paths offers an incomparable depth of expertise across cybersecurity, cloud, networking, and data science. INE is committed to delivering advanced technical training, while also lowering the barriers worldwide for those looking to enter and excel in an IT career.

**Contact**

**Press Team**  
**INE**  
**\[email protected\]**

INE Security Enables CISOs to Secure Board Support for Cybersecurity Training

By Deeba Ahmed
Trellix research exposes the dangers of fake antivirus websites disguised as legitimate security software but harbouring malware. Learn…
This is a post from HackRead.com Read the original post: Fake Antivirus Sites Spread Malware Disguised as Avast, Malwarebytes, Bitdefender

Trellix research exposes the dangers of fake antivirus websites disguised as legitimate security software but harbouring malware. Learn how to identify these scams and protect yourself from threats like identity theft and ransomware attacks.

Imagine searching online for an antivirus program to protect your computer, only to stumble upon a website that infects your device with information stealers. This is the deceptive tactic employed by fake antivirus (AV) sites, a growing threat detailed in Trellix’s research titled “A Catalog of Hazardous AV Sites – A Tale of Malware Hosting.”

****Deception Disguised as Security****

In April 2024, Trellix Advanced Research Center team members discovered several fake antivirus sites hosting sophisticated malicious files like APK, EXE, and Inno setup installers. These sites are used to distribute SpyNote trojan, Lumma malware, and StealC malware. The malware hosts include avast-securedownload.com, bitdefender-app.com, and malwarebytes.pro.

****Avast-securedownload.com:****

It hosts a sophisticated APK called Avast.apk that delivers SpyNote Trojan, which can install and delete packages, read call logs, SMS, contacts, storage data, phone state, and more. It also has a recorder, touch activity tracker, and update capabilities.

****Bitdefender-app.com:****

This website delivers a zip file with an EXE named “setup-win-x86-x64.exe.zip” with a discreet TLS callback function. It delivers Lumma malware, targeting sensitive information like PC name, username, HWID, screen resolution, CPU, installed memory, running process, login data, history, cookies, tokens, and user profile information.

****Malwarebytes.pro:****

The website delivers RAR files containing legitimate DLLs, Inno Setup, and StealC infostealing malware. The contents are compressed in gzip and transferred to the attacker’s C2 server. The stolen information includes account tokens, Steam tokens, saved card details, system profiles, Telegram logins, running process names, installed browser lists, and common system information.

****Malicious Binaries****

According to Trellix’s blog post, researchers also discovered a binary called AMCoreDat.exe, which facilitates the deployment of stealer malware. The attacker uses a sophisticated method to obfuscate the payload, stealing victim information, including PC name, username, browsing history, cookies, tokens, etc., and sends it to a C2 server.

Fake Avast, Malwarebytes and Bitdefender sites reported by Trellix

****Possible Dangers****

Unaware users, seeking to safeguard their devices, get easily tricked into downloading malicious software disguised as antivirus programs because these sites appear professional, complete with logos, fake testimonials, and urgency-inducing language about potential threats.

The consequences of falling victim to these scams can be severe, including identity theft, financial loss, sensitive data breaches, ransomware attacks and potentially hefty ransom demands.

Researchers suspect these website addresses are distributed by malicious advertising and SEO poisoning strategies. To mitigate risks, it is recommended to follow security measures like using strong cybersecurity solutions, avoiding pirated software, and verifying software legitimacy with your end-point provider.

1.  Malicious Android Apps Masked as Anti-virus Software
2.  Fake Popular Software Ads Deliver MadMxShell Backdoor
3.  Fake Skype, Zoom, Google Meet Sites Spread Multiple RATs
4.  Hackers steal source code of top anti-virus firms to sell online
5.  Fake LastPass Password Manager App Lurks on iOS App Store

Source

HackRead