Monthly Archives: January 2025

FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent

Posted on

Update January 29, 14:15 EST: Seizure banners were added to the cracked[.]io, cracked[.]to, nulled [.]to, starkrdp[.]io, mysellix[.]io, and sellix[.]io, confirming that the domains had been seized in a joint law enforcement action dubbed “Operation Talent” that included authorities from the United States, Italy, Spain, Europe, France, Greece, Australia, and Romania.

“This website, as well as the information on the customers and victims of the website, has been seized by international law enforcement partners,” the banners read.

Cracked.io’s staff has released a new statement on Telegram confirming that law enforcement has seized the cracked.io domain.

“Now that everyone has more clarity on the situation, Cracked.io has been seized under operation talent with specific reasons being undisclosed,” they said.

“We are still waiting for the official court documentation from the data centre and the domain host. We will inform you guys further on those details once we have it. A sad day indeed for our community.”

Update January 29th 16:54 EST: Europol said that an operation is currently undergoing and more information will be available at a later date.

Original story below

The FBI has seized the domains for the infamous Cracked.io and Nulled.to hacking forums, which are known for their focus on cybercrime, password theft, cracking, and credential stuffing attacks.

While some of their members also engaged in ethical hacking discussions, the sites were widely regarded as a hub for cybercriminal activity.

They also hosted content related to software cracks, hacking tools like “configs” used by credential stuffing attack tools (e.g., OpenBullet and SilverBullet), and other illicit activities, including a “combo lists” marketplace with stolen credentials or databases.

When trying to open the sites, web browsers display “Error 1000. DNS points to prohibited IP” and Error 1016. Origin DNS error” messages.

Today, the FBI seized the forums’ domains and changed their name servers to ns1.fbi.seized.gov and ns2.fbi.seized.gov from their previous Cloudflare name servers.

Cracked.io’s staff published an announcement on their Telegram channel earlier today, blaming a data center issue for the ongoing access problems.

“There is an active issue in our data centre which the staff is working on. Hence services remain offline till the issue is resolved. We will get detailed report later,” they said.

“We can only hope it is resolved without further issue. No estimated time at this moment. The current status from data centre is that it may take up to 1 day.”

Today, the FBI also seized domains used by:

  • MySellIX (mysellix.io) and SellIX (sellix.io), two platforms that allowed users to create their own online stores, which threat actors also used to sell stolen data, software keys, and compromised accounts, and
  • StarkRDP (starkrdp.io), a Windows RDP virtual hosting provider that some threat actors allegedly used for credential stuffing attacks.

An FBI spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today.

While the law enforcement agency has yet to share more information about this wave of seizures, all signs point to a crackdown on platforms involved in credential stuffing and stolen account credentials.

Source: https://www.bleepingcomputer.com/news/security/fbi-seizes-crackedio-nulledto-hacking-forums-in-operation-talent/

Google takes action after coder reports ‘most sophisticated attack I’ve ever seen’

Posted on

Latest trope is tricky enough to fool even the technical crowd… almost

Google says it’s now hardening defenses against a sophisticated account takeover scam documented by a programmer last week.

Zach Latta, founder of Hack Club, told of how close he was to succumbing to voice phishers who attempted to take over his Google account.

He said: “Someone just tried the most sophisticated phishing attack I’ve ever seen. I almost fell for it. My mind is a little blown.”

The scammers called Latta, who’s based in Vermont, USA, claiming the Google Workspace team spotted an unusual login attempt from Frankfurt and that he needed to reset his account password.

The call came from 650-203-0000 (a genuine number associated with automated Google Assistant calls) and a “Google” caller ID. The scammer used the name Chloe and spoke with an American accent over a crystal clear-sounding line. Aside from Google making the call initially, all seemed well at first.

Latta remained suspicious though and asked for a genuine email sent from a Google domain to confirm the authenticity of the call. That email came from an unspoofed workspace-noreply@google.com address and even after asking if he could call the number back, Chloe seemed unfazed and said “sure,” although that was enough to prevent Latta from actually doing so.

The scam started unraveling after Chloe’s manager, “Solomon,” another American accented individual, took over the call and gave information that conflicted with that given by his colleague. One saving grace was that he was able to provide the genuine 2FA number-matching code that appeared on Latta’s device. 

To a non-techie, that would likely be enough to convince a victim that it was a genuine Google staffer on the line, but Solomon’s encouragement to press the right number was the final red flag before fully determining this was a scam. 

“The thing that’s crazy is that if I followed the two ‘best practices’ of verifying the phone number and getting them to send an email to you from a legit domain, I would have been compromised,” Latta wrote.

“I understand how they were able to spoof the ‘Google’ phone call through Google Assistant, but I have no idea how they got access to important.g.co [since] g.co is a legitimate Google URL.

“[I was] literally one button press from being completely pwned. And I’m pretty technical!”

The use of g.co is crucial here. The scammer creates a Google Workspace using a g.co subdomain. G.co is a genuine Google subdomain and anyone can create a new Workspace using a g.co subdomain without having to verify that they own it.

The scammers then create an account for the victim using the Workspace and send a password reset email which comes from Google itself as is normal for a Workspace account. 

A Google spokesperson told The Register: “We’ve suspended the account behind this scam, which abused an unverified Workspace account to send these misleading emails. 

“We have not seen evidence that this is a wide-scale tactic, but we are hardening our defenses against abusers leveraging g.co references at sign-up to further protect users.”

As a reminder, Google will not call users to reset their passwords or troubleshoot account issues, so feel free to treat any incoming calls as the garbage they are.

A broader issue

Some of the details of Latta’s case align with similar tales of woe, like one told by venerable infosec journalist Brian Krebs in December about a Google account takeover that led to a half-million-dollar crypto raid.

Someone purportedly from Google support called Adam Griffin from the same 650-203-0000 number but this time it was Google Forms that was abused rather than the g.co domain. 

The Google Forms trick is a few years old now, but it’s still a convincing tool that will flummox many victims. It abuses a feature of Forms that allows attackers to send fake emails such as account compromise warnings from Google, but from a genuine Google domain that’s more likely to not get picked up as spam.

On the other end of the phone was an American-accented individual, just like in Latta’s case, who was able to guide Griffin through the account recovery process. They knew when certain popups would appear in the Gmail app, for example, also like in Latta’s case with the number matching. 

Of course, both were initiated by the scammers themselves, but again – these would likely be enough to convince the non-technical crowd of the call’s “authenticity.”

Similar scams are also hitting Apple users now too, as Krebs noted earlier this month, and the recent cases serve as constant reminders of how important it is to educate the masses about scammers’ tradecraft. 

They’re also great adverts for more modern solutions to phishing such as passkeys, the popularity of which has ballooned in the last year with the likes of Microsoft warning all users will eventually be forced into using them. Likewise, Google is a huge proponent of them too.

Source: https://www.theregister.com/AMP/2025/01/27/google_confirms_action_taken_to/

Critical zero-days impact premium WordPress real estate plugins

Posted on

The RealHome theme and the Easy Real Estate plugins for WordPress are vulnerable to two critical severity flaws that allow unauthenticated users to gain administrative privileges.

Although the two flaws were discovered in September 2024 by Patchstack, and multiple attempts were made to contact the vendor (InspiryThemes), the researchers say they have not received a response.

Also, Patchstack says the vendor released three versions since September, but no security fixes to address the critical issues were introduced. Hence, the issues remain unfixed and exploitable.

Vulnerability details

The RealHome theme and Easy Real Estate are among the most popular themes and plugins designed for use in real estate websites. According to Envanto Market data, the RealHome theme is used in 32,600 websites.

The first flaw, which impacts RealHome theme, is an unauthenticated privilege escalation problem tracked as CVE-2024-32444 (CVSS score: 9.8).

The theme allows users to register new accounts via the inspiry_ajax_register function, however, it does not properly check authorization or implement a nonce validation.

If registration is enabled on the website, attackers can arbitrarily specify their role as “Administrator” in a specially crafted HTTP request to the registration function, essentially bypassing security checks.

Once registered as an administrator, the attacker can subsequently gain full control of the WordPress site, including performing content manipulation, planting scripts, and accessing user or other sensitive data.

The flaw impacting the Easy Real Estate plugin is another unauthenticated privilege escalation issue via the social login. It’s tracked under CVE-2024-32555 (CVSS score: 9.8).

The problem stems from the social login feature, which allows users to log in using their email address without verifying if it belongs to the person making the request.

As a result, if an attacker knows an admin’s email address, they can log in without needing a password. The repercussions of successful exploitation are similar to those of CVE-2024-32444.

Mitigation recommendations

As no patch has been released yet by InspiryThemes, website owners and administrators using the said theme or plugin should disable them immediately.

Restricting user registration on affected websites would also prevent unauthorized account creations, limiting the potential for exploitation.

As the problems on the two add-ons are now public, threat actors are bound to explore their potential and scan for vulnerable websites, so responding quickly to mitigate the threat is crucial at this point.

Source: https://www.bleepingcomputer.com/news/security/critical-zero-days-impact-premium-wordpress-real-estate-plugins/

Mac malware mayhem as 100 million Apple users at risk of having personal data stolen

Posted on

Apple’s Macs are generally considered more secure than Windows PCs, but they are not immune to hackers. Numerous incidents demonstrate that Macs are not impenetrable, and a new one has recently been added to the list. Security researchers have discovered a new variant of stealer malware that targets browser credentials, cryptocurrency wallets and other personal data. (The author reported on this malware in 2024 as well.) Previously, it relied on macOS browser extensions to steal data. Now, it uses phishing websites and fake GitHub repositories to target Macs, which have a user base of 100 million people.

Cybersecurity company Check Point has discovered a new variant of info-stealer malware, BanShee. Elastic Security Labs first highlighted this malware in mid-2024, noting that it operates as malware-as-a-service, a business model in which cybercriminals provide access to malicious software and related infrastructure for a fee. At that time, it was available for as much as $3,000 per month.

Check Point says this malware evolved in September after being exposed. This time, its developers had “stolen” a string encryption algorithm from Apple’s own XProtect antivirus engine, which replaced the plain text strings used in the original version. Since antivirus programs expect to see this kind of encryption from Apple’s legitimate security tools, they weren’t flagged as suspicious, allowing the BanShee to remain undetected and quietly steal data from targeted devices.

How the Mac malware operates

BanShee Stealer is a prime example of how advanced malware has become. Once it’s on a system, it gets straight to work stealing all kinds of sensitive information. It goes after data from browsers like Chrome, Brave, Edge and Vivaldi, as well as cryptocurrency wallet extensions. It even takes advantage of two-factor authentication (2FA) extensions to grab credentials. On top of that, it collects details about the device’s software and hardware, as well as the external IP address.

The Mac malware also tricks users with fake pop-ups that look like real system prompts, tricking victims into entering their macOS passwords. Once it has gathered the stolen information, BanShee exfiltrates it to command-and-control servers, using encrypted and encoded files to ensure the data remains secure.

The malware’s creators used GitHub repositories to spread BanShee. They set up fake repositories that looked like they hosted popular software, complete with stars and reviews, to seem trustworthy. These campaigns didn’t just target macOS users with BanShee. They also hit Windows users with a different malware called Lumma Stealer. Over three waves, the attackers used these fake repositories to trick people into downloading their malicious files.

5 tips to protect yourself from Mac malware

Follow these essential tips to safeguard your Mac from the latest malware threats, including the notorious BanShee Stealer.

1) Have strong antivirus software: The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. 

2) Be cautious with downloads and links: Only download software from reputable sources such as the Mac App Store or official websites of trusted developers. Be wary of unsolicited emails or messages prompting you to download or install updates, especially if they contain links. Phishing attempts often disguise themselves as legitimate update notifications or urgent messages.

3) Keep your software updated: Ensure that both macOS and all installed applications are up to date. Apple frequently releases security patches and updates that address vulnerabilities. Enable automatic updates for macOS and your apps to stay protected without having to manually check for updates. If you need more help, see my guide on keeping all your devices updated.

4) Use strong and unique passwords: To protect your Mac from malware, it’s also crucial to use strong, unique passwords for all your accounts and devices. Avoid reusing passwords across different sites or services. A password manager can be incredibly helpful here; it generates and stores complex passwords for you, making them difficult for hackers to crack.

It also keeps track of all your passwords in one place and automatically fills them in when you log into accounts, so you don’t have to remember them yourself. By reducing the number of passwords you need to recall, you’re less likely to reuse them, which lowers the risk of security breaches. Get more details about my best expert-reviewed password managers of 2025 here.

5) Use two-factor authentication (2FA): Enable 2FA for your important accounts, including your Apple ID, email and any financial services. This adds an extra step to the login process, making it harder for attackers to gain access even if they have your password.

Key takeaway

No device is immune to cyberattacks when a human operator is involved. Take the BanShee Stealer, for example. It managed to target Macs not due to weak cybersecurity measures by Apple but because it successfully tricked users into installing it and granting the required permissions. Most breaches, hacks and other cyberattacks stem from human error. This highlights the importance of maintaining basic cybersecurity hygiene. It’s crucial to know what you’re downloading, ensure it’s from a trusted source and carefully review the permissions you grant to any online service or application.

Source: https://www.foxnews.com/tech/mac-malware-mayhem-100-million-apple-users-risk-having-personal-data-stolen

Cyber Threats Amid Disaster: California Fires Spark New Phishing Scams

Posted on

As California grapples with devastating wildfires, communities rally to protect lives and property. Unfortunately, these disasters also serve as fertile ground for cybercriminals seeking to exploit chaos and uncertainty. The Veriti Research team has identified alarming trends in phishing scams linked to the ongoing disaster, highlighting the need for heightened cybersecurity awareness during these vulnerable times.

Key Findings from Veriti Research

1. Emergence of Suspicious Domains In just 72 hours, Veriti Research identified multiple newly registered domains linked to the California fires. These domains include:

  • malibu-fire[.]com
  • fire-relief[.]com
  • Calfirerestoration[.]store
  • fire-evacuation-service[.]com
  • Lacountyfirerebuildpermits[.]com
  • Pacificpalisadesrecovery[.]com
  • boca-on-fire[.]com
  • palisades-fire[.]com
  • palisadesfirecoverage[.]com

We can see in the above list few topics that might be use by the attackers: California Restoration, Re-build Permits, Fire coverage and more.

These domains exhibit patterns typical of phishing campaigns. Some aim to mimic official services like fire evacuation assistance, while others target specific localities, such as Malibu and Pacific Palisades. Early indications suggest these sites are being prepared to host fraudulent activities, including phishing attacks, fake donation requests, and malicious downloads.

2. Tactics Used by Hackers Hackers often capitalize on disaster-related fears and uncertainties. In this case, they are:

  • Registering domains with names that resemble legitimate services or agencies.
  • Using these domains to distribute phishing emails, urging users to click on fraudulent links.
  • Employing social engineering techniques to create a sense of urgency, such as fake donation drives or critical safety alerts.

One example is a subdomain suggesting a phishing attempt designed to lure victims under the guise of fire-related assistance. Such tactics prey on people’s goodwill and desire to support recovery efforts.

Veriti’s research has not yet identified email campaigns utilizing these phishing domains. However, we are monitoring them daily to ensure timely reporting.

Hackers understand that individuals in or near affected areas are more likely to interact with what seems like a relevant resource, making these attacks more effective.

The California wildfires underscore the dual tragedy of natural disasters and cyber exploitation. As hackers continue to refine their techniques, awareness and vigilance are critical in preventing against their attacks. By understanding the methods and tools used by cybercriminals, individuals and organizations can take proactive steps to minimize the risks. 

The Veriti Research team remains committed to uncovering and neutralizing such threats, empowering communities to focus on recovery without the added burden of cybercrime.

Source: https://veriti.ai/blog/california-fires-spark-new-phishing-scams/

Hackers hide malware into website images to go unnoticed

Posted on

Multiple groups are using the same infection chain to deliver different infostealers

  • Researchers say criminals are hiding malware in images hosted on reputable websites
  • At least two different groups were seen deploying two types of infostealers
  • The campaigns abuse an ancient Excel flaw, HP Wolf Security claims

Hackers are hiding malware in website images to go unnoticed and compromise as many computers as possible, experts have warned.

A new Threat Insights Report from HP Wolf Security, based on data from millions of endpoints, claims there are currently large campaigns active spreading VIP Keylogger and 0bj3ctivityStealer. Since the same techniques and loaders are used in both, the researchers suspect two groups are using the same malware kits to deliver different payloads.

“In both campaigns, attackers hid the same malicious code in images on file hosting websites like archive.org, as well as using the same loader to install the final payload,” the researchers explained. “Such techniques help attackers circumvent detection, as image files appear benign when downloaded from well-known websites, bypassing network security like web proxies that rely on reputation.”

Throwing GenAI into the mix

The attack starts with a phishing email pretending to be an invoice, or purchase order. The attachment is usually an Excel document designed to exploit CVE-2017-11882, an ancient bug in the Equation Editor, to download a VBScript file.

Alex Holland, Principal Threat Researcher in the HP Security Lab, said phishing kits, paired with Generative AI (GenAI) tools, have significantly lowered the barrier to entry, exacerbating the ever-present risk of malware: “This allows groups to concentrate on tricking their targets and picking the best payload for the job – for instance by targeting gamers with malicious cheat repositories.”

Discussing GenAI, the researchers said miscreants are using it to create malicious HTML documents. They also identified an XWorm remote access trojan (RAT) campaign initiated by HTML smuggling, which contained malicious code that downloads and runs the malware.

The loader was quite obviously written by an AI, they added, since it included a line-by-line description and the design of the HTML page.

Both VIP Keylogger and 0bj3ctivityStealer are infostealer malware which record, and exfiltrate, sensitive information such as passwords, cryptocurrency wallet information, sensitive files, and more.

Source: https://www.techradar.com/pro/security/hackers-hide-malware-into-website-images-to-go-unnoticed

FTC orders GoDaddy to fix poor web hosting security practices

Posted on

See also:
GoDaddy slapped with wet lettuce for years of lax security and ‘several major breaches’

The Federal Trade Commission (FTC) will require web hosting giant GoDaddy to implement basic security protections, including HTTPS APIs and mandatory multi-factor authentication, to settle charges that it failed to secure its hosting services against attacks since 2018.

FTC says the Arizona-based company’s claims of reasonable security practices also misled millions of web-hosting customers because GoDaddy was instead “blind to vulnerabilities and threats in its hosting environment” due to its failings to implement standard security tools and practices.

“Millions of companies, particularly small businesses, rely on web hosting providers like GoDaddy to secure the websites that they and their customers rely on,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection.

“The FTC is acting today to ensure that companies like GoDaddy bolster their security systems to protect consumers around the globe.”

According to the FTC’s complaint, GoDaddy’s unreasonable security practices included failing to use multi-factor authentication (MFA), manage software updates, log security-related events, segment its network, monitor for security threats (including by failing to use software that could actively detect threats from its many logs), and use file integrity monitoring.

The company also failed to inventory and manage assets, assess risks to its website hosting services, and secure connections to services that provide access to consumer data.

Lax security practices led to multiple breaches

The FTC says that, between 2019 and 2022, these data security failures led to several major security breaches, resulting in threat actors gaining access to customers’ websites and data.

For instance, in February 2023, the hosting giant disclosed that unknown attackers stole source code and installed malware on compromised servers after breaching its cPanel shared hosting environment in a multi-year breach.

The company said it only discovered the breach in early December 2022 after receiving customer complaints that their websites were being used to redirect to unknown domains.

GoDaddy also revealed at the time that security breaches disclosed in November 2021 and March 2020 were also linked to this campaign.

The November 2021 breach affected 1.2 million Managed WordPress customers. Attackers hacked into GoDaddy’s hosting environment using a compromised password and obtained email addresses, WordPress Admin passwords, sFTP and database credentials, and SSL private keys from some clients.

Following the March 2020 breach, GoDaddy notified 28,000 customers that an attacker used their web hosting credentials to connect via SSH in October 2019.

Mandatory MFA for employees and customers

According to a proposed settlement order, the FTC will require GoDaddy to establish a robust information security program and prohibits the company from misleading customers about its security protections. The order also mandates that GoDaddy hire an independent third-party assessor to conduct biennial reviews of its information security program.

The company is also required to add mandatory MFA for all customers, employees, and contractors’ staff “to any Hosting Service supporting tool or asset, including connecting to any database” and “at least one method that does not require the customer to provide a telephone number, such as by integrating authentication applications or allowing the use of security key.”

In December, the FTC also ordered Marriott International and Starwood Hotels to implement a robust data security program following failures that led to massive data breaches in 2014 and 2018, exposing over 340 million guest records.

Marriott settled with the FTC in October 2014 and agreed to pay $52 million to 49 states to resolve claims related to these data breaches.

Update January 17, 08:28 EST: GoDaddy sent the following statement after the article was published:

GoDaddy has a long history of offering innovative products to our web hosting customers. We are focused on protecting our customers’ data and websites, and we invest significant resources in technologies, tools and talent to help safeguard systems and information. We are constantly improving our security capabilities and have already implemented a number of the requirements in the settlement agreement with the FTC. Notably, the resolution of this matter includes no admission of fault and no monetary penalties. We expect minimal financial impact associated with complying with the terms of the agreement with the FTC. We plan to continue to invest in our defenses to address evolving threats and help keep our customers, their websites and their data safe.

Source: https://www.bleepingcomputer.com/news/security/ftc-orders-godaddy-to-fix-poor-web-hosting-security-practices/

See also:
GoDaddy slapped with wet lettuce for years of lax security and ‘several major breaches’

Apple users facing new security risks after critical USB component hacked

Posted on

Fortunately, exploiting the issue is not as easy as it sounds

The ACE3 USB-C controller, a proprietary Apple technology used for charging and data transfer for iPhones, Macs, and other devices, can be hacked to allow malicious actors to run unauthorized activities. Exploiting this vulnerability to do actual damage is a bit of a stretch, though.

At the recent 38th Chaos Communication Congress took place in Hamburg, Germany, white hat hacker Thomas Roth demonstrated hacking this critical component. He reverse-engineered the ACE3 controller, exposing the internal firmware and communication protocols. He then reprogrammed the controller, which gave him the ability to bypass security checks, inject malicious commands, and run other unauthorized actions.

Roth said the vulnerability stems from insufficient safeguards in the firmware of the controller, which would allow a threat actor to gain low-level access, then be used to emulate trusted accessories, and more.

Attack complexity

Roth said he notified Apple of the issue, but the company said the bug was too complex to exploit.

He seems to agree with this assessment, as speaking to Forbes, Roth said Apple, “saw the attack complexity and said that they don’t see it as a threat – I agree with that sentiment but wanted to at least have reported it!”

“This is essentially foundational research, the first steps that are needed to find other attacks on the chip,” Roth concluded.

It doesn’t mean the security industry should completely ignore, or forget about Roth’s findings, as it could have major implications for Apple device security, since ACE3’s integrations with internal systems means compromising it could potentially lead to further attacks.

In any case, the Android ecosystem is not affected by this flaw.

Source: https://www.techradar.com/pro/security/apple-users-facing-new-security-risks-after-critical-usb-component-hacked

Justice Department and FBI Conduct International Operation to Delete Malware Used by China-Backed Hackers

Posted on

Court-Authorized Operation Removes PlugX Malware from Over 4,200 Infected U.S. Computers

The Justice Department and FBI today announced a multi-month law enforcement operation that, alongside international partners, deleted “PlugX” malware from thousands of infected computers worldwide. As described in court documents unsealed in the Eastern District of Pennsylvania, a group of hackers sponsored by the People’s Republic of China (PRC), known to the private sector as “Mustang Panda” and “Twill Typhoon,” used a version of PlugX malware to infect, control, and steal information from victim computers.

According to court documents, the PRC government paid the Mustang Panda group to, among other computer intrusion services, develop this specific version of PlugX. Since at least 2014, Mustang Panda hackers then infiltrated thousands of computer systems in campaigns targeting U.S. victims, as well as European and Asian governments and businesses, and Chinese dissident groups. Despite previous cybersecurity reports, owners of computers still infected with PlugX are typically unaware of the infection. The court-authorized operation announced today remediated U.S.-based computers infected with Mustang Panda’s version of PlugX.    

“The Department of Justice prioritizes proactively disrupting cyber threats to protect U.S. victims from harm, even as we work to arrest and prosecute the perpetrators,” said Assistant Attorney General Matthew G. Olsen of the Justice Department’s National Security Division. “This operation, like other recent technical operations against Chinese and Russian hacking groups like Volt Typhoon, Flax Typhoon, and APT28, has depended on strong partnerships to successfully counter malicious cyber activity. I commend partners in the French government and private sector for spearheading this international operation to defend global cybersecurity.”

“Leveraging our partnership with French law enforcement, the FBI acted to protect U.S. computers from further compromise by PRC state-sponsored hackers,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “Today’s announcement reaffirms the FBI’s dedication to protecting the American people by using its full range of legal authorities and technical expertise to counter nation-state cyber threats.”

“This wide-ranging hack and long-term infection of thousands of Windows-based computers, including many home computers in the United States, demonstrates the recklessness and aggressiveness of PRC state-sponsored hackers,” said U.S. Attorney Jacqueline Romero for the Eastern District of Pennsylvania. “Working alongside both international and private sector partners, the Department of Justice’s court-authorized operation to delete PlugX malware proves its commitment to a ‘whole-of-society’ approach to protecting U.S. cybersecurity.”

“The FBI worked to identify thousands of infected U.S. computers and delete the PRC malware on them. The scope of this technical operation demonstrates the FBI’s resolve to pursue PRC adversaries no matter where they victimize Americans,” said Special Agent in Charge Wayne Jacobs of the FBI Philadelphia Field Office.

The international operation was led by French law enforcement and Sekoia.io, a France-based private cybersecurity company, which had identified and reported on the capability to send commands to delete the PlugX version from infected devices. Working with these partners, the FBI tested the commands, confirmed their effectiveness, and determined that they did not otherwise impact the legitimate functions of, or collect content information from, infected computers. In August 2024, the Justice Department and FBI obtained the first of nine warrants in the Eastern District of Pennsylvania authorizing the deletion of PlugX from U.S.-based computers. The last of these warrants expired on Jan. 3, 2025, thereby concluding the U.S. portions of the operation. In total, this court-authorized operation deleted PlugX malware from approximately 4,258 U.S.-based computers and networks.

The FBI, through the victims’ internet service providers, is providing notice to U.S. owners of Windows-based computers affected by this court-authorized operation.

The FBI’s Philadelphia Field Office and Cyber Division, the U.S. Attorney’s Office for the Eastern District of Pennsylvania, and the National Security Cyber Section of Justice Department’s National Security Division led the domestic disruption operation. This operation would not have been successful without the valuable collaboration of to the Cyber Division of the Paris Prosecution Office, French Gendarmerie Cyber Unit C3N, and Sekoia.io.

The FBI continues to investigate Mustang Panda’s computer intrusion activity. If you believe you have a compromised computer or device, please visit the FBI’s Internet Crime Complaint Center (IC3). You may also contact your local FBI field office directly. The FBI strongly encourages the use of anti-virus software as well as the application of software security updates to help prevent reinfection.

Source: https://www.justice.gov/opa/pr/justice-department-and-fbi-conduct-international-operation-delete-malware-used-china-backed

EFF’s The Breachies 2024: The Worst, Weirdest, Most Impactful Data Breaches of the Year

Posted on

Every year, countless emails hit our inboxes telling us that our personal information was accessed, shared, or stolen in a data breach. In many cases, there is little we can do. Most of us can assume that at least our phone numbers, emails, addresses, credit card numbers, and social security numbers are all available somewhere on the internet.

But some of these data breaches are more noteworthy than others, because they include novel information about us, are the result of particularly noteworthy security flaws, or are just so massive they’re impossible to ignore. For that reason, we are introducing the Breachies, a series of tongue-in-cheek “awards” for some of the most egregious data breaches of the year.

If these companies practiced a privacy first approach and focused on data minimization, only collecting and storing what they absolutely need to provide the services they promise, many data breaches would be far less harmful to the victims. But instead, companies gobble up as much as they can, store it for as long as possible, and inevitably at some point someone decides to poke in and steal that data.

Once all that personal data is stolen, it can be used against the breach victims for identity theft, ransomware attacks, and to send unwanted spam. The risk of these attacks isn’t just a minor annoyance: research shows it can cause psychological injury, including anxiety, depression, and PTSD. To avoid these attacks, breach victims must spend time and money to freeze and unfreeze their credit reports, to monitor their credit reports, and to obtain identity theft prevention services.

This year we’ve got some real stinkers, ranging from private health information to—you guessed it—credit cards and social security numbers.

The Winners

Source: https://www.eff.org/deeplinks/2024/12/breachies-2024-worst-weirdest-most-impactful-data-breaches-year#effector