Law enforcement disrupts Redline and Meta malware operations.

Summary

By the CyberWire staff

At a glance.

Law enforcement disrupts Redline and Meta malware operations.
US agencies debunk election disinformation attributed to Russia.
TeamTNT exploits exposed Docker daemons to deploy malware.

Law enforcement disrupts Redline and Meta malware operations.

The Dutch National Police, working with the US FBI and other international law enforcement partners, have seized servers used by the Redline and Meta infostealers, BleepingComputer reports. The operation, called "Operation Magnus," also resulted in the seizure of data tied to the operators and developers of the malware, making future prosecutions likely. The authorities claim to have gained access to the malware operations' source code, including "license servers, REST-API services, panels, stealer binaries, and Telegram bots."

A dedicated website for the operation has a timer implying that more details will be released tomorrow morning.

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

US agencies debunk election disinformation attributed to Russia.

The Bucks County Board of Elections in Pennsylvania has issued an announcement debunking a video that purported to show individuals opening and destroying Bucks County mail-in votes for Trump, CyberScoop reports. The Board stated, "The envelope and materials depicted in this video are clearly not authentic materials belonging to or distributed by the Bucks County Board of Elections."

The US Office of the Director of National Intelligence (ODNI), the FBI, and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint statement assessing that "Russian actors manufactured and amplified" the video. The agencies added, "This Russian activity is part of Moscow’s broader effort to raise unfounded questions about the integrity of the US election and stoke divisions among Americans, as detailed in prior ODNI election updates. In the lead up to election day and in the weeks and months after, the IC expects Russia to create and release additional media content that seeks to undermine trust in the integrity of the election and divide Americans."

Save 30% on N2K Cyber & IT practice tests

In celebration of Cybersecurity Awareness Month, N2K is offering a 30% discount on all N2K practice tests with promo code "SECURE30". Choose from our vast exam prep library that includes top vendors like AWS, CompTIA, ISC2, Microsoft, and more. Get access to simulated exams, custom quizzes, e-flashcards, and more. Whether you're gearing up for a certification exam or looking to enhance your skills, now is the perfect time to invest in your cybersecurity journey. Visit n2k.com/certify to find your cert and save 30% with promo code “SECURE30” today.

TeamTNT exploits exposed Docker daemons to deploy malware.

Aqua has published a report on a hacking campaign by the TeamTNT threat actor. The researchers state, "In this campaign, TeamTNT is leveraging native capabilities in cloud environments by appending compromised Docker instances to a Docker Swarm and utilizing Docker Hub to store and distribute their malware. They are also renting the victims’ computational power to third parties, effectively earning money indirectly from cryptomining without the hassle of managing it themselves. In addition, they have adopted new hacking tools by replacing their traditional Tsunami backdoor with the stealthier Sliver malware."

The group is using a tool called the "Docker Gatling Gun" to scan millions of IP addresses for exposed Docker ports.

Notes.

Today's issue includes events affecting China, the Netherlands, Russia, and the United States.

Attacks, Threats, and Vulnerabilities

FBI, CISA investigating China-linked telecom hacks following reports of intrusions on Trump, Harris phones (The Record) The agencies said they are “investigating the unauthorized access to commercial telecommunications infrastructure by actors affiliated with the People’s Republic of China.”

New Windows Driver Signature bypass allows kernel rootkit installs (BleepingComputer) Attackers can downgrade Windows kernel components to bypass security features such as Driver Signature Enforcement and deploy rootkits on fully patched systems.

Products, Services, and Solutions

Veriff Launches FaceBlock for Startups & SMBs: Enhancing Fraud Prevention with Advanced Security (Veriff) Veriff introduces FaceBlock for its Self-Serve product, offering startups and SMBs enhanced fraud prevention by identifying suspected repeat fraudsters and strengthening security measures.

Limited Time: Free Dark Web Reports Revealing Information On Dark Web (Quadrant Security) Reports Enable Organizations To Understand Their Threat Profile And Take Proactive Measures Against Exposure

Litigation, Investigation, and Law Enforcement

Delta sues CrowdStrike for $500 million in damages caused by airline cancelations (The Independent) ‘The havoc that was created deserves, in my opinion, to be fully compensated for,’ Delta’s CEO said in an interview

Russia sentences REvil ransomware members to over 4 years in prison (BleepingComputer) Russia has sentenced four members of the REvil ransomware operation to over 4 years in prison for distributing malware and illegal circulation of means of payment.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Events

CISO Confidential: AMA with CSaaS Security Leaders (Virtual, Oct 29, 2024) October is Cybersecurity Awareness Month, and what better way to stay in the know than by hearing directly from leading security experts? Join industry CSOs from the Information Technology - Information Sharing Analysis Center’s Critical SaaS Special Interest Group for an AMA rundown on all things security.

Pacific Hackers Conference (Mountain View, California, USA, Nov 2, 2024) Pacific Hacker Conference is an information security and hacking conference that gathers the brightest minds in cybersecurity and hacking from Silicon Valley and beyond. Focusing on cutting-edge techniques, research, and developments, we aim to create an environment where knowledge is shared and connections are made. Our audience ranges from security professionals, researchers, and ethical hackers to industry decision-makers. We keep the conference small, allowing us to provide what other Cons leave out.

SecureWorld Seattle (Bellevue, Washington, USA, Nov 6 - 7, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 12-18 CPE credits through 30+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Beyond Earth Symposium (Washington, DC, USA, Nov 12 - 13, 2024) The acceleration of space innovations that will enable space migration is outpacing public policy and international law regimes. Beyond Earth Institute’s mission is to create a policy and legal framework to support the robust development of an in-space economy and the expansion of human civilization beyond Earth. At the Beyond Earth Symposium 2024, we will wrestle with the critical current issues of the day and delve into the bleeding edge issues that must be moved to the center of international debate. What we do in a post-ISS era is an urgent, immediate concern. Policies that can foster the creation of a lunar-based economy are equally important. Let’s be bold together! Join stakeholders from across the industry, government, and international sector for this third annual Beyond Earth Symposium. Momentum is building to transform policy and legal landscape to enable a space migration future. Dare to be part of this work.

SecureWorld Midwest Virtual Conference (Virtual, Nov 13, 2024) Join with cybersecurity professionals for training and information sharing through an interactive online experience. Earn 6 CPE credits learning from nationally recognized industry leaders. The agenda offers 12+ educational presentations, including panel discussions, breakout sessions, and keynotes. Connect with your peers in the Networking Lounge, enter to win prizes, and see demos and resources from top solution vendors in the Exhibitor Hall.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 10.28.24

At a glance.

Law enforcement disrupts Redline and Meta malware operations.

US agencies debunk election disinformation attributed to Russia.

TeamTNT exploits exposed Docker daemons to deploy malware.

Notes.

Attacks, Threats, and Vulnerabilities

Products, Services, and Solutions

Litigation, Investigation, and Law Enforcement

Events