By Waqas
Elusive APT Group ‘Gelsemium’ Emerges in Rare Southeast Asian Attack, Unveils Unique Tactics. KEY FINDINGS Cybersecurity researchers at…
This is a post from HackRead.com Read the original post: Gelsemium APT Group Uses “Rare” Backdoor in Southeast Asian Attack

**Elusive APT Group ‘Gelsemium’ Emerges in Rare Southeast Asian Attack, Unveils Unique Tactics**.

****KEY FINDINGS****

*   **Gelsemium APT Resurgence:** The rarely seen APT group, Gelsemium, has reemerged in a sophisticated cyberattack targeting a Southeast Asian government entity.

*   **CL-STA-0046 Cluster:** Palo Alto Networks’ Unit 42 uncovered a unique cluster of cyber activities, labeled CL-STA-0046, indicative of Gelsemium’s covert operations.

*   **Rare Tools and Techniques:** Gelsemium leveraged a combination of rarely seen tools and tactics to infiltrate IIS servers, maintaining a clandestine presence for over six months in 2022-2023.

*   **Web Shells and Backdoors:** The threat actor behind CL-STA-0046 employed various web shells and backdoors, including OwlProxy and SessionManager, previously linked to the group’s targeting of entities in Laos.

*   **Moderate Attribution Confidence:** Unit 42 attributes CL-STA-0046 to the Gelsemium APT group with moderate confidence, shedding light on a threat entity that has remained elusive in the cybersecurity landscape.

Cybersecurity researchers at Palo Alto Network’s Unit 42 have shed light on the activities of an enigmatic APT group known as ‘Gelsemium.’ The group’s covert operations were discovered during an investigation into a Southeast Asian government’s compromised systems, labelled as ‘CL-STA-0046.’

Operating stealthily for over six months from 2022 to 2023, this clandestine cluster of attacks employed a series of rare tools and techniques, establishing a covert presence within sensitive IIS servers of a Southeast Asian government entity.

The main backdoors utilized by the threat actors were ‘OwlProxy’ and ‘SessionManager,’ an uncommon combination previously linked to targeting entities in Laos in 2020. The attribution of this activity to the Gelsemium APT group, albeit with moderate confidence, provides unprecedented insight into a threat entity that has remained elusive with only a handful of public reports to its name.

The Gelsemium APT group, operational since 2014, has gained notoriety for its diverse targeting, encompassing governments, universities, electronics manufacturers, and religious organizations, predominantly in East Asia and the Middle East. However, details about its tactics, techniques, and procedures (TTPs) have been scarce until now.

Unit 42’s analysis not only delves deep into the tools and strategies employed by this mysterious APT group but also offers a comprehensive timeline of observed operations, presenting a valuable repository of indicators for potential defenders.

Palo Alto Networks customers benefit from advanced threat protection against the identified threats through various security solutions, underscoring the importance of a robust cybersecurity posture in today’s threat landscape.

The threat actor responsible for CL-STA-0046 initiated their intrusion by deploying web shells on a compromised server. These web shells included ‘reGeorg,’ ‘China Chopper,’ and ‘AspxSpy,’ with one of the AspxSpy web shells previously linked to Iron Taurus (aka APT 27). However, this particular web shell’s public availability disqualifies it from attribution considerations.

The attackers proceeded to conduct lateral movement through SMB and performed reconnaissance commands, extracting crucial information about their target. Some instances involved the delivery of additional tools, such as ‘demo.exe,’ alongside attempts at privilege escalation using the ‘Potato Suite’ (JuicyPotato, BadPotato, and SweetPotato).

To secure their foothold, the attackers downloaded a series of tools, including ‘OwlProxy,’ ‘SessionManager,’ ‘Cobalt Strike,’ ‘SpoolFool,’ and ‘EarthWorm.’ These tools, some rarely seen in previous attacks, signify a sophisticated approach to intrusion.

‘SessionManager,’ a custom backdoor employed by the Gelsemium APT group, allows for remote command execution and file manipulation on web servers, all while utilizing the server as a proxy for communication with other network systems. This particular backdoor was previously documented in government, military, and industrial compromises.

‘OwlProxy,’ another unique tool, acts as an HTTP proxy with backdoor capabilities. Although first discovered in 2020 in an attack against the Taiwanese government attributed to Gelsemium, this variant of OwlProxy exhibits custom features that expand the actor’s proxy capabilities.

The attackers attempted to execute ‘Artifactd.exe,’ a Cobalt Strike beacon, and ‘EarthWorm,’ a SOCKS tunneler. These tools aimed to facilitate communication with their command and control servers.

Additionally, ‘SpoolFool,’ a local privilege escalation (LPE) proof of concept (PoC), was employed to exploit CVE-2022-21999 (Windows Print Spooler Elevation of Privilege Vulnerability) to create a local administrator user.

Unit 42’s attribution of CL-STA-0046 activities to the Gelsemium APT group is supported by the unique combination of tools, particularly ‘SessionManager’ and ‘OwlProxy.’ This combination has only been publicly associated with the Gelsemium APT group. The victimology aligns with Gelsemium’s past targets in Southeast Asia.

The screenshot shows the process tree Cobalt Strike, the Potato Suite, SpoolFool and EarthWorm (Unit 24)

The emergence of the Gelsemium APT group in a rare Southeast Asian attack underscores the need for heightened security measures, continuous monitoring, and proactive threat intelligence sharing among government bodies and affected industries in the region.

By adopting a multilayered defence approach and staying informed about evolving threats, organizations can fortify their cybersecurity against persistent adversaries like Gelsemium.

1.  Crypto Discord Communities Targeted by Malicious Bookmarks
2.  Fake PoC Script Tricks Researchers into Downloading VenomRAT
3.  Threat actors using CAPTCHA to evade phishing, malware detection
4.  Siemens ALM 0-Day Vulnerabilities Posed Full Remote Takeover Risk

Gelsemium APT Group Uses “Rare” Backdoor in Southeast Asian Attack

By Owais Sultan
In today’s rapidly evolving digital landscape, businesses are increasingly embracing client-centric strategies to cater to the ever-changing needs…
This is a post from HackRead.com Read the original post: Fortifying Customer Connections: Cybersecurity in Client-Centric Tech

In today’s rapidly evolving **digital landscape**, businesses are increasingly embracing client-centric strategies to cater to the ever-changing needs and preferences of their customers. This customer-centric approach has emerged as the linchpin of modern business strategies, reshaping industries across the board.

However, as businesses pivot towards client-centricity, they find themselves navigating treacherous waters in the domain of cybersecurity. This article delves deeper into the delicate balance between delivering client-centric tech and safeguarding sensitive customer data, exploring hypothetical case studies that exemplify the importance of this equilibrium.

****Client-Centric Tech: The Backbone of Modern Businesses****

Client-centric tech isn’t just a buzzword; it’s the core element reshaping businesses and industries. At its essence, client-centric tech entails personalizing products, services, and interactions to cater to the unique preferences and requirements of individual customers.

In a world oversaturated with options, personalization is the ticket to standing out. From e-commerce platforms offering product recommendations based on browsing history to chatbots providing real-time customer support, to a dedicated **client portal**, client-centric tech permeates every facet of business.

****Better branding and differentiation****

It empowers companies to differentiate themselves in a crowded marketplace, enhance customer satisfaction, and nurture enduring relationships.

Imagine an online fashion retailer that harnesses client-centric tech to its fullest potential. By meticulously analyzing a customer’s previous purchases, style preferences, and even social media activity, this retailer crafts a shopping experience that feels tailor-made.

This not only enhances the customer’s shopping journey but also significantly bolsters the retailer’s sales. However, this high level of personalization relies on the collection and processing of extensive customer data, which creates a vulnerable target for cybercriminals.

****The Vulnerabilities of Client-Centric Tech****

Ironically, the very attributes that make client-centric tech enticing, such as in-depth data collection and analysis, also expose businesses to cybersecurity risks.

In a world where data is akin to a precious commodity, hackers are **increasingly targeting companies** that collect and store customer information. The more data a business accumulates, the more alluring it becomes to cybercriminals.

Envision a hypothetical scenario where a client-centric tech platform accumulates a wealth of user data, including personal information, transaction history, and location data. A breach in such a system could unleash a torrent of problems, including identity theft and financial fraud for customers, and significant damage to the business’s reputation.

This underscores the pressing need for robust cybersecurity measures to safeguard sensitive customer data and uphold trust in client-centric tech.

****The Need for Robust Cybersecurity Measures****

The cybersecurity landscape is in a constant state of flux, and the risks associated with client-centric tech are no exception. As businesses strive to provide personalized experiences to their customers, they must simultaneously prioritize cybersecurity to protect both their clients and their own interests.

Effective cybersecurity goes beyond merely installing firewalls and antivirus software. It involves cultivating a security-conscious culture throughout the organization, from top-level executives to front-line employees. Cybersecurity is no longer relegated to the IT department; it has become a business imperative that necessitates a holistic approach.

****Balancing Client-Centricity and Cybersecurity****

So, how can businesses strike the delicate balance between client-centricity and cybersecurity? It commences with integrating security into the very DNA of client-centric tech. The adoption of secure-by-design principles ensures that cybersecurity is a fundamental consideration right from the inception of product development, rather than being an afterthought.

****A couple of examples****

Consider a client-centric software development team that incorporates security practices from the project’s inception. They conduct **regular vulnerability assessments**, implement robust encryption techniques to shield customer data, and offer comprehensive training and education programs to sensitize employees to potential threats.

This proactive approach not only substantially mitigates the risk of security breaches but also allows the business to continue providing personalized experiences.

****Case Studies: Exemplifying Success in Client-Centric Cybersecurity****

Let’s delve into a few hypothetical case studies to vividly illustrate the paramount importance of **client-centric cybersecurity**. In the first scenario, a client-centric e-commerce platform diligently enforces encryption and access controls to safeguard customer payment information.

In the second case, a hypothetical financial institution proactively employs multi-factor authentication and real-time fraud detection to secure its client-centric mobile banking app. In the third case, a fictitious retail giant adopts advanced threat intelligence systems to identify and mitigate potential cyber threats targeting its client-centric loyalty program.

While these cases are hypothetical, they underscore the practical steps that businesses can take to secure customer data while delivering client-centric tech solutions. These examples serve as blueprints for organizations aiming to prioritize cybersecurity without compromising their client-centric approach.

****The Future of Client-Centric Tech and Cybersecurity****

As technology continues to advance, and businesses increasingly pivot toward client-centric strategies, the interplay between cybersecurity and client-centricity will become even more intricate. Emerging technologies such as artificial intelligence, **the Internet of Things, and 5G** will present both opportunities and challenges.

Businesses that adeptly embrace these technologies while simultaneously prioritizing cybersecurity will be poised to thrive in this dynamic landscape.

In conclusion, client-centric tech has emerged as a driving force in modern business, redefining customer engagement. However, this transformation should not come at the cost of cybersecurity.

By implementing robust cybersecurity measures, adopting a proactive approach, and nurturing a culture of security, businesses can fortify customer connections in the client-centric tech era. In a world where digital transformation continues to accelerate, the ability to deliver personalized experiences while safeguarding customer data will serve as the cornerstone of successful businesses in the 21st century.

****FAQ: Cybersecurity in Client-Centric Tech********Q: What is client-centric tech, and why is it important for businesses today?****

**A:** Client-centric tech refers to strategies and technologies that prioritize tailoring products, services, and interactions to meet the specific preferences and needs of individual customers. It is crucial for businesses as it enhances customer satisfaction, fosters loyalty, and allows companies to stand out in a competitive market by delivering personalized experiences.

****Q: How does client-centric tech make businesses vulnerable to cybersecurity threats?****

**A:** Client-centric tech involves extensive data collection and analysis to personalize experiences. The more data a business collects, the more attractive it becomes to cyber criminals. Hackers often target companies that store valuable customer information, making client-centric businesses more susceptible to data breaches and cyberattacks.

****Q: What are the potential consequences of a cybersecurity breach in a client-centric tech environment?****

**A:** The consequences of a cybersecurity breach can be severe. Customers may experience identity theft, financial fraud, and loss of trust in the business. Additionally, the business itself can face reputational damage, legal liabilities, and financial losses.

****Q: How can businesses balance client-centricity and cybersecurity effectively?****

**A:** Balancing client-centricity and cybersecurity requires a proactive approach. Implementing secure-by-design principles, conducting regular vulnerability assessments, and educating employees about potential threats are essential steps. Additionally, fostering a security-conscious culture throughout the organization is crucial.

****RELATED ARTICLES****

1.  Cybersecurity for Startups: Best Tips and Strategies
2.  Schools Are the Most Targeted Industry by Ransomware Gangs
3.  Insider Threat Awareness Month: Protecting Business from Within
4.  10 Top DDoS Attack Protection and Mitigation Companies in 2023
5.  Strategic IT Staff Augmentation: A Roadmap for C-Level Executives

Fortifying Customer Connections: Cybersecurity in Client-Centric Tech

By Deeba Ahmed
New BBTok Banking Trojan Variant Emerges in Latin America: Check Point Research.
This is a post from HackRead.com Read the original post: BBTok Malware Returns, Targeting Over 40 Banks in Brazil and Mexico

**KEY FINDINGS**

*   **Check Point Research shared details of a newly discovered BBTok banking trojan variant.**

*   **This malicious variant can spoof the interfaces of over 40 Banks in Brazil and Mexico.**

*   **The malware operator aims to compromise PCs and steal bank card numbers or 2FA authentication codes.**

*   **Phishing emails serve as the primary lure in this campaign, where attackers have used sophisticated techniques to make them believable and relied on multiple file types, including ISO, ZIP, LNK, DOCX, JS and XLL, to distribute BBTok.**

*   **The campaign is still active, targeting Brazilian and Mexican users through multi-layered geo-fencing.**

BBTok malware, first detected in 2020, has resurfaced in a brand-new, far more sinister avatar mainly targeting users in Latin America, reported Check Point Research’s cybersecurity researchers in their latest blog post published on 20 September 2020.

Researchers claim that since 2020, they have observed significant improvement in the TTPs (techniques, tactics, and procedures) adopted by BBTok malware operators as they have added multiple obfuscation layers and downloaders. This helps them avoid detection.

For your information, BBTok malware is a banking malware. Its new variant replicates the interfaces of over 40 banks, all located in Mexico and Brazil. The campaign involves a unique infection chain with a combination of LOLBins (living off the land binaries). Hundreds of users have been targeted so far in this active campaign.

This is a financially motivated campaign where attackers send phishing emails to unsuspecting users in Brazil and Mexico to lure them into entering the two-factor authentication codes of their bank accounts or giving away payment card numbers.

A malicious link in that email contains a .LNK file that initiates the infection chain, deploys the malware, and launches a decoy document. Further probing revealed that attackers maintain diverse infection chains for different Windows OS versions.

These chains use many file types to deploy malware, including ISO, ZIP, LNK, DOCX, JS and XLL. A rare feature of this attack is that a custom server-side application generates unique payloads for every victim after identifying their location and OS.

BBTok malware allows its operators to execute remote commands and inhabits almost all signature banking trojan capabilities, apart from replicating the interfaces of Latin American banks. Some of the banks it targets include Citibank, Scotiabank, Banco Itaú and HSBC.

These fake interfaces are designed so cleverly that victims cannot detect foul play and willingly enter their security codes or token numbers for 2FA, after which it is quite easy for attackers to hijack their bank accounts. Sometimes, the victims may be lured to enter payment card data.

Fake interfaces embedded within the BBTok Banker and Database with victims’ information (Images: CPR)

Regarding this new threat, Check Point’s threat intelligence group manager, Sergey Shykevich, stated that banking malware remains a significant issue of concern in Latin America because its primary objective is to steal the victim’s financial details.

“While worldwide we see a consistent trend of multipurpose malware which is able to do a variety of different activities (stealing data and credentials, pushing ransomware, etc.), in Latin America we still see a dominance of banking malware which only goal is to steal victims’ financial information.”

“Cyberattacks have increased 8% this year and show no signs of slowing down. We urge everyone to stay vigilant and be wary of suspicious emails with attached files and pay extra attention to where they enter their banking credentials and payment card information,” Shykevich noted.

BBTok banking malware is a product of fileless attacks that took place in Latin America back in 2020 and features a broad range of functionalities, including killing/enumerating processes, clipboard content manipulation, keyboard/mouse control, and trademark banking malware features such as simulating fake login interfaces.

It has continually been evolving, making it essential to adopt necessary security practices to avoid becoming victims of phishing attacks. Ignore password resetting emails if you cannot recall any attempts to change passwords, note the email’s content and sender before opening, and avoid sharing credentials on any platform without verifying the web address.

**RELATED ARTICLES**

1.  Payoro: A Glimmer of Disruption in the Banking Sector
2.  Hackers using Google Sites to spread banking malware
3.  Brazilian Hackers Hit Portuguese Banks in Malware Attack
4.  SpyNote Spyware Returns with SMS Phishing Against Banks
5.  Brazil’s Escort Service Exposes Millions of Escort, Client Data

BBTok Malware Returns, Targeting Over 40 Banks in Brazil and Mexico

By Waqas
Meet new Proton CAPTCHA from Proton AG, a custom-built CAPTCHA system designed to thwart bots and spammers. Proton…
This is a post from HackRead.com Read the original post: Proton CAPTCHA: New Privacy-First CAPTCHA Defense Against Bots

Meet new Proton CAPTCHA from Proton AG, a custom-built CAPTCHA system designed to thwart bots and spammers.

Proton AG, a Swiss technology company known for its privacy-orientated products like ProtonMail and ProtonVPN, has unveiled an innovative solution that pledges to redefine online security. Meet Proton CAPTCHA, a custom-built CAPTCHA system.

CAPTCHAs, designed to thwart bots and spammers, are crucial for defending websites. However, Proton found existing options lacking, prompting the development of their own CAPTCHA system with a unique focus on privacy and accessibility.

****Privacy Takes Center Stage****

In a blog post, the company revealed that Proton CAPTCHA sets itself apart with a privacy-first approach, ensuring full GDPR compliance and eliminating reliance on external services. More importantly, it’s the world’s first CAPTCHA with censorship-resistant technologies, tailored to meet the unique needs of users in regions with restricted internet access.

****Features that Set Proton CAPTCHA Apart****

*   **Multi-Layered Defense**: Proton CAPTCHA employs a dual defence strategy. It combines visual challenges with computational proof of work, creating multiple barriers to deter attackers.

*   **Adaptive Difficulty**: The system adapts to suspicious behaviour. For instance, if a user struggles with visual CAPTCHAs, the computational proof of work becomes more challenging, slowing down potential bots.

*   **Enhanced Accessibility**: Users with visual impairments can still verify themselves through computational proof of work, offering an alternative to traditional CAPTCHAs.

*   **Proof of Work**: To protect against attacks, Proton CAPTCHA includes proof of work as an additional line of defence. This dissuades bots from exploiting the CAPTCHA system itself.

*   **Variety of Challenges**: Proton CAPTCHA introduces fun and engaging challenge types, making the CAPTCHA experience more enjoyable for users. Challenges include a beam alignment game and intuitive 2D puzzles.

Proton CAPTCHA has already been deployed to millions of users, completely replacing traditional CAPTCHAs for sign-up and login processes. According to the company, their goal is to continually refine CAPTCHA technology, reducing inconvenience for genuine users while making it increasingly formidable for attackers.

1.  New AI tool aims to make CAPTCHA a thing of the past
2.  10 Top DDoS Attack Protection & Mitigation Companies in 2023
3.  Google ReCaptcha flaw lets bots bypass audio captcha challenge
4.  unCAPTCHA algorithm can Crack Google’s AI System reCAPTCHA
5.  Android banking malware distributed with fake Google reCAPTCHA
6.  “ProtonMail Contacts” world’s first encrypted contacts manager is here

Proton CAPTCHA: New Privacy-First CAPTCHA Defense Against Bots

By Waqas
Tel Aviv-based firm OTORIO's cybersecurity research team identified and reported these vulnerabilities.
This is a post from HackRead.com Read the original post: Siemens ALM 0-Day Vulnerabilities Posed Full Remote Takeover Risk

****KEY FINDINGS****

*   **Two 0-day vulnerabilities in Siemens Automation License Manager (ALM) could allow attackers to execute code remotely on target systems.**

*   **The vulnerabilities could be exploited to take control of industrial systems, such as those used in manufacturing and power generation.**

*   **Siemens has released security advisories for the vulnerabilities and is working on a fix.**

*   **Users are advised to upgrade to the latest version of ALM or apply the workarounds provided in the advisories.**

*   **The vulnerabilities highlight the importance of keeping industrial systems up-to-date and secure.**

The cybersecurity researchers at OTORIO discovered multiple 0-day vulnerabilities in Siemens ALM (Automation License Manager), a crucial component of Siemens software products used to manage licenses for various industrial solutions. The impact of these vulnerabilities is far-reaching, affecting systems such as PCS 7, TIA Portal, STEP 7, SIMATIC HMI, SIMOTION, SIMATIC NET, SINAMICS, and SIMOCODE.

****The Alarming Discovery****

OTORIO Research first alerted Siemens to these vulnerabilities last year, highlighting their severity, particularly because ALM is enabled by default on all PCS 7 servers they tested. Earlier this year, they detailed the potential attack vectors associated with these vulnerabilities, emphasizing the urgency of patching or mitigating them. This warning was essential because the successful exploitation of these vulnerabilities could result in significant damage.

In their latest disclosure, OTORIO provides additional technical details that shed light on these vulnerabilities, helping stakeholders better understand and enhance the security of affected systems.

****Understanding ALM’s Role****

Siemens ALM, while often bundled with other Siemens products during installation, is a separate entity that requires independent attention from users. It operates on a client-server architecture, communicating over TCP port 4410. The service component runs with SYSTEM privileges and manages licenses on the system, while users can connect to it locally or remotely through the client application.

Authentication is not mandatory, but some operations are restricted to remote connections. Default operations are considered safe, which means there are no built-in security measures for communication between the ALM client and server.

****Vulnerabilities Unveiled****

One of the critical vulnerabilities, identified as CVE-2022-43513, allows malicious actors to move files within the target machine. This could potentially lead to license issues due to inadequate path verification. However, the real danger comes from another vulnerability, CVE-2022-43514, which enables attackers to bypass path sanitization.

This vulnerability permits arbitrary file movement between the target machine and an arbitrary network share controlled by the attacker, ultimately granting them SYSTEM-level privileges on the target system.

****Executing Remote Code****

The exploitation of these vulnerabilities can lead to remote code execution (RCE), achieved through multiple file rename and move operations. Attackers can replace and restart the ALM service executable, effectively taking control of the affected system.

Watch as OTORIO researchers demonstrate ALM remote code execution

****Mitigation and Hardening****

Given the widespread impact of these vulnerabilities, immediate mitigation is critical. Users are strongly advised to update to the latest version of the Automation License Manager. Additionally, implementing additional security precautions and following Siemens’ hardening guidelines is recommended. Users should consider disabling the ALM remote connection option, even if it’s enabled by default, to further enhance security.

In conclusion, the vulnerabilities in Siemens ALM serve as a reminder of the importance of cybersecurity in critical industrial systems. Prompt action is necessary to prevent potential exploitation, and users are encouraged to follow best practices and hardening guidelines to safeguard their systems.

1.  Crit.IX: Flaws in Honeywell Experion DCS Risk Critical Industries
2.  WinRAR users update your software as 0-day vulnerability is found
3.  Controller-level flaws let hackers physically damage moving bridges

Siemens ALM 0-Day Vulnerabilities Posed Full Remote Takeover Risk

By Deeba Ahmed
The International Criminal Court (ICC), which tries suspects of war crimes and crimes against humanity, confirmed the breach in a brief tweet on Twitter.
This is a post from HackRead.com Read the original post: International Criminal Court (ICC) Confirms Cybersecurity Incident

According to the organization, suspicious activity was noted last week, but it refrained from sharing details on this security breach.

The International Criminal Court (ICC) has confirmed that its IT network’s security was breached last week. It is suspected that the breach might have exposed details of current ICC cases and classified details on witnesses. Many potential suspects can benefit from the information.

The war crime tribunal, headquartered in The Hague, Netherlands, posted a brief statement on X, explaining that unusual, suspicious activity was detected in its information systems, and the organization immediately launched efforts to respond to this “cybersecurity incident” in order to mitigate its impact.

The post also read that the ICC has deployed “additional response and security measures” in cooperation with its host country’s relevant authorities. It aims to strengthen its cybersecurity mechanisms, such as focusing more on incorporating cloud-based technologies. The ICC sought support from all stakeholders and member states to help enhance its institutional resilience amidst “challenging circumstances.”

Reuters reported that currently, ICC prosecutors are investigating seventeen cases in Afghanistan, the Philippines, Uganda, Ukraine, and Venezuela. The ICC shocked everyone back in March 2023 when it issued an arrest warrant for Russian Premier Vladimir Putin. He could not participate in several international conferences, including the Brics summit held recently in Johannesburg, to avoid arrest by ICC member states.

There’s an indication that the ICC has remained on the radar of cybercriminals and state-sponsored spies. In June 2022, a Russian spy, identified as Sergey Vladimirovich Cherkasov, was exposed by Dutch intelligence officials.

According to the Department of Justice (DoJ), Cherkasov posed as a Brazilian intern and was trying to access the ICC’s network while, in reality, he was planted by the Russian military intelligence service, the GRU. The current incident further strengthens the suspicion that ICC is being targeted. Therefore, the organization should improve its IT infrastructure to prevent such attacks.

International Criminal Court (ICC) Confirms Cybersecurity Incident

By Deeba Ahmed
International Law Enforcement Cooperates to Disrupt Dark Web Drug Trade.
This is a post from HackRead.com Read the original post: Finnish Dark Web Marketplace PIILOPUOTI Seized

****KEY FINDINGS****

*   **Finnish Customs, with the support of Europol, Eurojust, and international partners, has successfully taken down the infamous PIILOPUOTI dark web marketplace.**

*   **PIILOPUOTI was a Finnish-language platform known for selling/smuggling narcotics, paraphernalia, and other illegal commodities in large quantities.**

*   **The marketplace was operating sneakily via the encrypted TOR network and was used to perform illegal drug trade anonymously.**

*   **Finnish authorities started an investigation in collaboration with law enforcement agencies from Lithuania and Germany. The criminal investigation against this platform will continue.**

Finnish Customs (Tuli), with the support of Europol, Eurojust, and international partners, has successfully taken down the infamous PIILOPUOTI dark web marketplace. This platform was popular among cybercriminals and was involved in illegal drug sales since 18 May 2022. The marketplace’s servers and contents have been seized, but it is unclear whether any arrests were made.

The seizure has taken place just before the annual Dark Web Conference that will take place on 4 and 5 October at Europol headquarters. At this event, more than 180 investigators from all over the world will come together to discuss the latest developments and criminal activity trends on the dark web.

Europol stated in its press release that this is a “significant victory” against dark web platforms. Drugs were smuggled into Finland and other parts of the world from this marketplace. 

It was a Finnish-language platform known for selling/smuggling narcotics, paraphernalia, and other illegal commodities in large quantities. Cybersecurity firm Bitdefender cooperated with the authorities in seizing the marketplace.

“This successful action by the Finnish Customs was supported, among others, by the German Federal Criminal Office (Bundeskriminalamt) and the Lithuanian Criminal Police Bureau (Lietuvos kriminalinės policijos biuras). Europol’s European Cybercrime Centre coordinated the international activity and provided operational support and technical expertise,” Europol informed in its press release.

Finnish authorities stated that the website was operating sneakily via the encrypted TOR network and was used to perform illegal drug trade anonymously. They started an investigation in collaboration with law enforcement agencies from Lithuania and Germany. The marketplace name (PIILOPUOTI) is a Finnish language term, which, in English, means “the hidden shop.” Finnish police said that criminal investigation against this platform will continue.

Bitdefender’s senior director of the Investigation and Forensics Unit, Alexandru Catalin Cosoi, stated that this operation shows that collaborative efforts can help disrupt well-organized illegal platforms like PIILOPUOTI, and the seizure serves as a warning for other criminals who believe they can evade the law by operating anonymously.

It is worth noting that international law enforcement agencies have been hunting down dark web marketplaces for a long time, and the efforts seem to have intensified lately. In 2020, authorities managed to seize the Finnish language market Sipulimarket. At that time, Sipulimarket was the only Finnish language marketplace on the dark web.

In February of this year, Genesis Market’s clear net domain was seized; however, its dark web domain was operational and offered for sale in July 2023. Nevertheless, despite authorities’ efforts to take down dark web markets and their criminal empires, new ones like the Styx market, which specializes in money laundering and identity theft, continue to emerge.

**RELATED ARTICLES**

1.  Student Ran Germany’s Largest Dark Web Market DiDW
2.  8 Online Best Dark Web Search Engines for Tor Browser
3.  179 Dark Web vendors arrested, 500kg worth of drugs seized
4.  Domain, server of DoubleVPN used by ransomware gangs seized

Finnish Dark Web Marketplace PIILOPUOTI Seized

By Waqas
Schools are often understaffed and have limited resources to invest in cybersecurity.
This is a post from HackRead.com Read the original post: Schools Are the Most Targeted Industry by Ransomware Gangs

Schools Are the Most Targeted Industry by Ransomware Gangs

By Owais Sultan
The decentralized identity startup, cheqd, unveils Credential Payments, blending financial incentives with self-sovereign identity measures. cheqd, a startup…
This is a post from HackRead.com Read the original post: cheqd’s Recent Rollout Focuses on Monetizing Digital Identity

cheqd’s Recent Rollout Focuses on Monetizing Digital Identity

By Owais Sultan
If you want your online store to be successful, you need to choose dedicated server hosting. Here are…
This is a post from HackRead.com Read the original post: The Benefits of Dedicated Server Hosting for Online Retail

Source

HackRead