Follow the money: Russian Cybercriminals Drive Significant Ransomware and Cryptocurrency-based Money Laundering Activity

Russia has long been home to some of the most skilled hackers in the world. According to cybersecurity investigators like Brian Krebs, this is largely due to the country’s excellence in computer science education, combined with low economic prospects even for those who are skilled in the field. Given this background, it may not be surprising that Russia leads the way in ransomware. But the degree to which Russia-based ransomware strains dominate is quite shocking. 

Before we dive into the data, a quick explainer - we generally tie specific ransomware strains to Russian cybercriminals based on one of three criteria:

1) Evil Corp is a Russia-based cybercriminal organization that has been prolific in ransomware, and whose leadership is believed to have ties to the Russian government. 

2) The Commonwealth of Independent States (CIS) is an intergovernmental organization of Russian-speaking, former Soviet countries. Many ransomware strains contain code that prevents the encryption of files if it detects the victim’s operating system is located in a CIS country. In other cases, ransomware operators have even given over decryptors to return file access after learning they inadvertently targeted a Russian organization. We can attribute CIS-avoiding strains to Russian cybercriminals, though with a lesser degree of confidence, as some of them may be based in other CIS countries.

3) There are several other ransomware characteristics that can indicate a strain is likely based in Russia. Examples include ransomware strains that share documents and announcements in the Russian language, or whose affiliates are believed to be located in Russia with a high degree of confidence. 

Overall, roughly 74% of ransomware revenue in 2021 - over $400 million worth of cryptocurrency - went to strains we can say are highly likely to be affiliated with Russia in some way. 

Blockchain analysis combined with web traffic data also tells us that after ransomware attacks take place, most of the extorted funds are laundered through services primarily catering to Russian users.

www.chainalysis.com

Russian court fines Google $20 decillion!

A Russian court has ruled that Google owes Russian media stations around $20 decillion ($20,000,000,000,000,000,000,000,000,000,000,000) in fines for blocking their content, and the fines could get bigger.

To put that into perspective, the World Bank estimates global GDP as around $100 trillion, which is peanuts compared to the prospective fine. Google would therefore have to find more money than exists on Earth to pay Moscow - but on Tuesday fell a little short of that mark when it posted $88 billion quarterly revenue.

The bizarre amount has been calculated after a four-year court case that started after YouTube banned the ultra-nationalist Russian channel Tsargrad in 2020 in response to the US sanctions imposed against its owner. Following Putin's illegal invasion of Ukraine in 2022 more channels were added to the banned list and 17 stations are now suing the Chocolate Factory, including Zvezda (a TV channel owned by Putin's Ministry of Defence), according to local media.

"Google was called by a Russian court to administrative liability under Art. 13.41 of the Administrative Offenses Code for removing channels on the YouTube platform. The court ordered the company to restore these channels," lawyer Ivan Morozov told state media outlet TASS.

www.theregister.com

Kaspersky Labs: Warning over Russian anti-virus software

The British government has issued a fresh warning about the security risks of using Russian anti-virus software.

The National Cyber Security Centre is to write to all government departments warning against using the products for systems related to national security.

The UK cyber-security agency will say the software could be exploited by the Russian government.

Security firm Kaspersky Labs, accused in the US of being used by the Russian state for espionage, denied wrongdoing.

Kaspersky Labs is widely used by consumers and businesses across the globe, although they are not being advised to stop using the software, as well as by some parts of the UK government. Around the world, 400 million people use Kaspersky products.

In other news, Barclays has stopped offering free Kaspersky software to customers as a "precautionary decision".

www.bbc.co.uk

When Wikipedia goes horribly wrong: user creates over 200 phoney articles!

Posing as a scholar, a Chinese woman spent years writing alternative accounts of medieval Russian history on Chinese Wikipedia, conjuring imaginary states, battles, and aristocrats in one of the largest hoaxes on the open-source platform.

The scam was exposed last month by Chinese novelist Yifan, who was researching for a book when he came upon an article on the Kashin silver mine. 

Discovered by Russian peasants in 1344, the Wikipedia entry goes, the mine engaged more than 40,000 slaves and freedmen, providing a remarkable source of wealth for the Russian principality of Tver in the 14th and 15th centuries as well as subsequent regimes. The geological composition of the soil, the structure of the mine, and even the refining process were fleshed out in detail in the entry.

Yifan thought he’d found interesting material for a novel. Little did he know he’d stumbled upon an entire fictitious world constructed by a user known as Zhemao. It was one of 206 articles she has written on Chinese Wikipedia since 2019, weaving facts into fiction in an elaborate scheme that went uncaught for years and tested the limits of crowdsourced platforms’ ability to verify information and fend off bad actors. Read more...

www.vice.com

Russia mulls legalizing software piracy as it’s cut off from Western tech

 

Following the Russian war against Ukraine, and with sanctions against Russia starting to bite, the Kremlin is mulling ways to keep businesses and the government running. The latest is a creative twist on state asset seizures, only instead of the government taking over an oil refinery, for example, Russia is considering legalizing software piracy.

Russian law already allows for the government to authorize - “without consent of the patent holder”—the use of any intellectual property “in case of emergency related to ensuring the defense and security of the state.” The government hasn’t taken that step yet, but it may soon, according to a report from Russian business newspaper Kommersant, spotted and translated by Kyle Mitchell, an attorney who specializes in technology law. It's yet another sign of a Cyber Curtain that's increasingly separating Russia from the West.

www.arstechnica.com

Samsung brand ambassador sued for $1.6 million for using iPhone X in public

Ksenia Sobchak was hired by Samsung to market its smartphones in the country, with the Russian TV presenter, journalist, and politician contracted to use the smartphones in public. Under the terms of similar agreements between companies and influential people, they are not typically allowed to be seen using competing products in public, a rule that Sobchak broke. 

According to The Mirror, Sobchak was spotted using an iPhone X during a television interview, with the personality attempting to hide the Apple smartphone under a piece of paper while the cameras were on. Sobchak is also said to have used the iPhone X during social events in Moscow and other TV appearances, again against the contract's rules. 

Formerly dubbed the "Russian Paris Hilton," Sobchak is also rumored to be the goddaughter to President Vladimir Putin, who she ran against in elections earlier in 2018. Anatoly Sobchak, her father, was the first elected mayor of St Petersburg, and thought to have been a mentor to the president. 

The numerous sightings has led to Samsung suing Sobchak for a reported 108 million rubles (approximately $1.6 million) for breach of contract. It is unknown how much Sobchak was originally paid by Samsung, but it is likely the suit's claimed damages are far higher in value, including penalties for breaking the agreement. 

www.appleinsider.com

Still using Kaspersky software? You have been warned...

Israeli spies looked on as Russian hackers breached Kaspersky cyber-security software two years ago, US media report.

The Russians were allegedly attempting to gather data on US intelligence programs, according to the New York Times and Washington Post.

Israeli agents made the discovery after breaching the software themselves.

Kaspersky has said it was neither involved in nor aware of the situation and denies collusion with authorities.

Last month, the US government decided to stop using the Russian firm's software on its computers. The Israelis are said to have notified the US, which led to the ban on Kaspersky programs.

www.bbc.co.uk

Tests suggest Russian satellites can jam GPS on a continental scale

Russian satellites have been identified as the cause of mysterious, seconds-long bursts of GPS interference across Europe—a rare example of human-made GPS interference coming from space. But uncertainty still hangs over whether such interference is intentional and if it could be more powerfully weaponized as GPS jamming with continental reach in the future.

The discovery came from an investigation detailed in a June 2 preprint paper by Todd Humphreys and his student Zach Clements at The University of Texas at Austin, along with Argyris Kriezis at Stanford University in California. By sifting through public data from ground-based stations with global navigation satellite system (GNSS) receivers, they identified a pattern of high-powered interference lasting less than 10 seconds each time but simultaneously detectable by ground stations across Europe from Norway to Spain to Poland, and even reaching as far west as Greenland and Canada. READ MORE and/or WATCH THIS VIDEO.

www.arstechnica.com

REvil ransomware gang arrested in Russia

Authorities in Russia say they have dismantled the ransomware crime group REvil and charged several of its members.

The United States had offered a reward of up to $10m (£7.3m) for information leading to the gang members, following ransomware attacks.

Russia's intelligence bureau FSB said the group had "ceased to exist". However, it does not appear that any Russian members of the gang will be extradited to the United States.

The agency said it had acted after being provided with information about the REvil gang by the US. According to the Russian state news service Tass, REvil "developed malicious software" and "organised the theft of money from the bank accounts of foreign citizens".

The FSB said it had seized more than 426 million rubles (£4m), including about £440,000 worth of crypto-currency. It also seized more than 20 "premium cars" which had been purchased with the proceeds of crime.

www.bbc.co.uk

Tech news related to Putin's invasion of Ukraine

 

SecurityWeek: Twitter will put warnings on tweets sharing links to Russian state-affiliated media, the platform said Monday, as Kremlin-tied outlets are accused of spreading misinformation on Moscow's invasion of Ukraine.

Pressure is on social media giants to squelch misleading or false information about the attack, which has drawn fierce international condemnation.

Kremlin-run media outlets RT and Sputnik have both faced accusations of using false narratives in an effort to argue in favour of war.

=============

Microsoft: Several hours before the launch of missiles or movement of tanks on February 24, Microsoft’s Threat Intelligence Center (MSTIC) detected a new round of offensive and destructive cyberattacks directed against Ukraine’s digital infrastructure. We immediately advised the Ukrainian government about the situation, including our identification of the use of a new malware package (which we denominated FoxBlade), and provided technical advice on steps to prevent the malware’s success. (Within three hours of this discovery, signatures to detect this new exploit had been written and added to our Defender anti-malware service, helping to defend against this new threat.) In recent days, we have provided threat intelligence and defensive suggestions to Ukrainian officials regarding attacks on a range of targets, including Ukrainian military institutions and manufacturers and several other Ukrainian government agencies. This work is ongoing.

=============

Reuters: Germany's Enercon on Monday said a "massive disruption" of satellite connections in Europe was affecting the operations of 5,800 wind turbines in central Europe.

It said the satellite connections stopped working on Thursday, knocking out remote monitoring and control of the wind turbines, which have a total capacity of 11 gigawatt (GW).

"The exact cause of the disruption is not yet known. The communication services failed almost simultaneously with the start of the Russian invasion of Ukraine," Enercon said in a statement.

In other news, BBC reports: European gas prices have risen after the approval of the Nord Stream 2 pipeline to Germany was halted because of Russia's actions in Ukraine.

Use Kaspersky software? Time for a rethink - read this...

The German Federal Office for Information Security (BSI) warned organizations against using Kaspersky antivirus software over fears it could be exploited for cyber-espionage or launching cyberattacks amid Russia’s ongoing war in Ukraine.

While the office is not explicitly banning the use of Kaspersky software, the security agency is urging German organizations to replace products made by the Moscow-headquartered firm with alternative software from non-Russian vendors, warning that Russia’s military and intelligence activities in Ukraine, along with its threats against Europe, NATO, and Germany, means there is “a considerable risk of a successful IT attack.”

“A Russian IT manufacturer can carry out offensive operations itself, be forced to attack target systems against its will, or be spied on without its knowledge as a victim of a cyber operation, or be misused as a tool for attacks against its own customers,” the BSI said in a statement, explaining that antivirus software such as Kaspersky’s have deep system access and must maintain a permanent, encrypted and non-verifiable connection to the manufacturer’s servers. “Companies and authorities with special security interests and operators of critical infrastructures are particularly at risk,” the statement adds.

www.techcrunch.com

What is truth? Some people are arguing it should be anything they want it to be!

As the FBI’s investigation into Russian election interference reaches a fever pitch, Facebook rolled out a new News Feed alert Monday night. The bulletin told users who followed pages created by Russian trolls that those pages have been removed. And some of the affected users did not like this.

A brief search revealed that numerous people believe that this is an act of censorship by Facebook. Some users argued that they should be allowed to decide what’s “true, fake, or otherwise,” a challenge that’s bound to be a slippery slope in this era of algorithm-based confirmation bias.

Need a reality check? Truth is most often used to mean being in accord with fact or reality, or fidelity to an original or standard. What is Truth?

www.gizmodo.com

Putin’s prewar moves against U.S. tech giants laid groundwork for crackdown on free expression

Russian agents came to the home of Google’s top executive in Moscow to deliver a frightening ultimatum last September: take down an app that had drawn the ire of Russian President Vladimir Putin within 24 hours or be taken to prison.

Google quickly moved the woman to a hotel where she checked in under an assumed name and might be protected by the presence of other guests and hotel security, according to people with knowledge of the matter. The same agents - believed by company officials to be from Russia’s FSB, a successor to the KGB intelligence service - then showed up at her room to tell her the clock was still ticking...

www.msn.com

Important Microsoft patches just released: PATCH NOW!

Microsoft has just released a batch of essential security updates for users of its software. In this Patch Tuesday release, Microsoft addressed 81 new vulnerabilities – of which 27 have been given the highest rating of “critical”.

One of the flaws (CVE-2017-8759) addressed by Microsoft’s patches is a previously unknown vulnerability in the .Net framework. The zero-day vulnerability was being actively exploited in attacks which targeted Russian-speaking users with poisoned Word documents that served up a version of the FinFisher spyware.

Also of note is that Microsoft has revealed it has pushed out a fix for the newly-announced BlueBorne exploits (CVE-2017-8628), which could allow an attacker to initiate a Bluetooth connection to a targeted device without the user’s knowledge, and open opportunities for man-in-the-middle (MITM) attacks.

As always: make sure your computing devices are fully patched up to date.

www.hotforsecurity.bitdefender.com

Facebook's action plan against foreign (Russian) election interference

We are committed to protecting legitimate political discussion within our community and fighting foreign interference in elections. That's why we are taking steps to increase Facebook's transparency and security.

Strengthening Enforcement

Investing in operations: We're improving our systems to keep activity on Facebook authentic. This includes hiring 10,000 people including ad reviewers, engineers and security experts and combining their skills with advances in AI and machine learning to identify and remove content violations and fake accounts.

Updating our policies: We're updating our policy to block ads from Pages that repeatedly share stories marked as false by third-party fact-checking organizations.

Increasing Transparency

Sharing 3,000 ads with Congress: We're actively collaborating with government authorities and other technology companies to identify common threats and stop foreign interference.

Making advertising more transparent: We're building new tools to make it clearer who is paying for political ads, and we're making it possible for you to click a link and see the ads a Page is running, even ones not targeted to you. In addition, anyone purchasing US election ads will now be required to confirm who they are.

Supporting an Informed Community

Fighting false news: We're committed to preventing the spread of false news by removing economic incentives for spammers, building new products, and helping people make more informed decisions about what to read, trust and share.

Reducing clickbait: We've made updates so that you see fewer clickbait stories in your News Feed.

www.facebook.com

Royal Mail hit by Russia-linked ransomware attack

 

Severe disruption to Royal Mail's overseas deliveries has been caused by ransomware linked to Russian criminals, the BBC has been told.

The cyber-attack has affected the computer systems Royal Mail uses to despatch deliveries abroad. Royal Mail has been warning customers since Wednesday of disruption due to a "cyber-incident". Its latest advice is for people not to try to send international letters and parcels until the issue is resolved.

Ransomware is malicious computer software that encrypts data and locks up systems. The ransomware used in the attack is "Lockbit", according to a source close to the investigation. Computer security firms say the software has been developed and used by criminal gangs with links to Russia.

www.bbc.co.uk

FBI tells router users to reboot now to kill malware infecting 500k devices

The FBI is advising users of consumer-grade routers and network-attached storage devices to reboot them as soon as possible to counter Russian-engineered malware that has infected hundreds of thousands devices.

Researchers from Cisco’s Talos security team first disclosed the existence of the malware on Wednesday. The detailed report said the malware infected more than 500,000 devices made by Linksys, Mikrotik, Netgear, QNAP, and TP-Link. Known as VPNFilter, the malware allowed attackers to collect communications, launch attacks on others, and permanently destroy the devices with a single command. The report said the malware was developed by hackers working for an advanced nation, possibly Russia, and advised users of affected router models to perform a factory reset, or at a minimum to reboot.

www.arstechnica.com

Beer Day Britain is almost here: June 15th!

 

Beer Day Britain is an annual celebration on June 15th for all beer lovers and it celebrates all beer including traditional ales, mainstream lagers, and limited edition craft beer – with alcohol and with no alcohol – and everything in between no matter where it is brewed or who owns the brewing company.

June 15th is significant because that is also the date Magna Carta was sealed in 1215. The great charter mentions ale in Article 35: ‘Let there be throughout our kingdom a single measure for wine and a single measure for ale and a single measure for corn…..’

Ale was so important in England in 1215 that it was cited in one of the most significant legal documents in history.  Today beer and pubs are still central to British life and seven out of 10 drinks sold in a pub are beer.

Britain has a dynamic brewing scene and an unmatched heritage in spreading the love and knowledge of beer around the world.  More styles of beer first brewed in Britain are now brewed overseas than those of any other brewing nation. These include India Pale Ale, Pale Ale, Porter, Stout, Imperial Russian Stout, Mild, Bitter, Barley Wine, Brown Ale, and Scotch Ale. READ MORE & Cheers!

https://www.beerdaybritain.co.uk/

Pink Floyd - Hey Hey Rise Up (feat. Andriy Khlyvnyuk of Boombox)

Here is the official video for 'Hey Hey Rise Up', Pink Floyd’s new Ukraine fundraiser feat Andriy Khlyvnyuk of Boombox. Stream / download at http://pinkfloyd.lnk.to/HeyHeyRiseUp

'Hey Hey Rise Up', released in support of the people of Ukraine, sees David Gilmour and Nick Mason joined by long time Pink Floyd bass player Guy Pratt and Nitin Sawhney on keyboards, all accompanying an extraordinary vocal by Andriy Khlyvnyuk of Ukrainian band Boombox. All proceeds go to Ukrainian Humanitarian Relief.

This is the first new original music that they have recorded together as a band since 1994’s The Division Bell.

The track uses Andriy’s vocals taken from his Instagram post of him in Kyiv’s Sofiyskaya Square singing ‘The Red Viburnum In The Meadow’, a rousing Ukrainian protest song written during the first world war. The title of the Pink Floyd track is taken from the last line of the song which translates as ‘Hey, hey, rise up and rejoice’.  The song’s opening choral parts are by Ukrainian VERYOVKA Folk Song and Dance Ensemble.

Gilmour, who has a Ukrainian daughter-in-law and grandchildren says: “We, like so many, have been feeling the fury and the frustration of this vile act of an independent, peaceful democratic country being invaded and having its people murdered by one of the world's major powers”.

Gilmour explains how he came to know Andriy and his band Boombox. “In 2015, I played a show at Koko in London in support of the Belarus Free Theatre, whose members have been imprisoned. Pussy Riot and the Ukrainian band, Boombox, were also on the bill. They were supposed to do their own set, but their singer Andriy had visa problems, so the rest of the band backed me for my set - we played Wish You Were Here for Andriy that night. Recently I read that Andriy had left his American tour with Boombox, had gone back to Ukraine, and joined up with the Territorial Defense. Then I saw this incredible video on Instagram, where he stands in a square in Kyiv with this beautiful gold-domed church and sings in the silence of a city with no traffic or background noise because of the war. It was a powerful moment that made me want to put it to music.” 

While writing the music for the track, David managed to speak with Andriy from his hospital bed in Kyiv where he was recovering from a mortar shrapnel injury. “I played him a little bit of the song down the phone line and he gave me his blessing. We both hope to do something together in person in the future.” 

Speaking about the track Gilmour says, “I hope it will receive wide support and publicity. We want to raise funds for humanitarian charities, and raise morale. We want express our support for Ukraine and in that way, show that most of the world thinks that it is totally wrong for a superpower to invade the independent democratic country that Ukraine has become.”

The video for ‘Hey Hey Rise Up’ was filmed by acclaimed director Mat Whitecross and shot on the same day as the track was recorded. David Gilmour “We recorded the track and video in our barn where we did all our Von Trapped Family live streams during lockdown. It's the same room that we did the 'Barn Jams' with Rick Wright back in 2007. Janina Pedan made the set in a day and we had Andriy singing on the screen while we played, so the four of us had a vocalist, albeit not one who was physically present with us.”

The artwork for the track features a painting of the national flower of Ukraine, the sunflower, by the Cuban artist, Yosan Leon. The cover of the single is a direct reference to the woman who was seen around the world giving sunflower seeds to Russian soldiers and telling them to carry them in their pockets so that when they die, sunflowers will grow.

LYRICS:
Oyu luzi chervona kalyna pokhylylasya,
Chohos' nasha slavna Ukrayina zazhurylasya.
A my tuyu chervonu kalynu pidiymemo,
A my nashu slavnu Ukrayinu, hey-hey, rozveselymo!

Oh, in the meadow a red kalyna has bent down low,

For some reason, our glorious Ukraine is in sorrow.

And we'll take that red kalyna and we will raise it up,

And we shall cheer up our glorious Ukraine, hey - hey!

www.youtube.com

'Very high level of confidence' Russia used Kaspersky software for devastating NSA leaks

Three months after U.S. officials asserted that Russian intelligence used popular antivirus company Kaspersky to steal U.S. classified information, there are indications that the alleged espionage is related to a public campaign of highly damaging NSA leaks by a mysterious group called the Shadow Brokers.

U.S. investigators “now believe that those manuals [leaked by Shadow Brokers] may have been obtained using Kaspersky to scan computers on which they were stored.”

www.yahoo.com