Law enforcement operation disrupts LockBit. Alleged Raccoon Infostealer operator extradited to US.

Summary

By the CyberWire staff

At a glance.

Law enforcement operation disrupts LockBit.
Alleged Raccoon Infostealer operator extradited to US.
Apex vulnerabilities open Salesforce instances to attack.

Law enforcement operation disrupts LockBit.

A wide-ranging law enforcement operation, dubbed "Operation Cronos," has disrupted the activities of the LockBit ransomware gang. Authorities have arrested two alleged members of the gang in Poland and Ukraine, BleepingComputer reports. The operation, led by the UK's National Crime Agency, also resulted in the seizure of 34 servers and more than 200 cryptocurrency accounts tied to the gang. The US Department of Justice has unsealed indictments against two Russian nationals for their alleged involvement in LockBit attacks.

Europol said in a press release, "The UK's National Crime Agency has now taken control of the technical infrastructure that allows all elements of the LockBit service to operate, as well as their leak site on the dark web, on which they previously hosted the data stolen from victims in ransomware attacks. At present, a vast amount of data gathered throughout the investigation is now in the possession of law enforcement. This data will be used to support ongoing international operational activities focused on targeting the leaders of this group, as well as developers, affiliates, infrastructure, and criminal assets linked to these criminal activities."

The Japanese Police, the National Crime Agency, and the FBI have released decryption tools designed to help recover files encrypted by LockBit.

Secure your future with a master’s degree in cybersecurity from Penn State World Campus.

Boost your cybersecurity career with Penn State World Campus! Our online master's program delivers cutting-edge knowledge, hands-on skills, and expert insights. Benefit from flexible learning that fits your schedule, while gaining industry-relevant expertise in areas like threat detection, risk management, and ethical hacking. Join a renowned institution, be guided by industry leaders, and advance your career in the dynamic field of cybersecurity. Elevate your skills, secure your future — apply today!

Alleged Raccoon Infostealer operator extradited to US.

A Ukrainian national, Mark Sokolovsky, has been extradited to the United States from the Netherlands after being indicted for crimes related to his alleged operation of the Raccoon Infostealer malware-as-a-service, Malwarebytes reports. The US Attorney's Office of the Western District of Texas said in a press release, "In March 2022, concurrent with Sokolovsky’s arrest by Dutch authorities, the FBI and law enforcement partners in Italy and the Netherlands dismantled the digital infrastructure supporting the Raccoon Infostealer, taking its then existing version offline. Sokolovsky is charged with one count of conspiracy to commit fraud and related activity in connection with computers; one count of conspiracy to commit wire fraud; one count of conspiracy to commit money laundering; and one count of aggravated identity theft. He made his initial court appearance Feb. 9, and is being held in custody pending trial."

Fill in the cyber roles and skills gaps you actually need.

N2K’s Talent Insights solutions provide the workforce intelligence needed to take strategic action. Our workforce experts and proprietary data-analysis tools do the heavy lifting to assess and refine your cyber job roles, the competencies required, and build org charts to organize your workforce. The takeaway? Clarity on where you are, what you need, and a data-driven framework to get you there. Ready to dive in? Learn more.

Apex vulnerabilities open Salesforce instances to attack.

Researchers at Varonis have identified "high- and critical-severity vulnerabilities and misconfiguration" affecting Apex, the programming language used by Salesforce instances. The researchers note, "If exploited, the vulnerabilities can lead to data leakage, data corruption, and damage to business functions in Salesforce." Nitay Bachrach, senior security researcher at Varonis, told Dark Reading, "In some cases, the exploitation was very tricky and required techniques we developed in-house, and in others, it was a simple oversight — the guest user was just able to execute code for no reason, and that leaked sensitive data. Under the shared responsibility model, users can choose to write code, but they're also responsible for making sure it is secure. Salesforce is not responsible for Apex code...uploaded by the users to their Salesforce instances."

RSA Conference™ 2024—Where the Cybersecurity Community Unites

Cybercrime knows no bounds, and a united front is our strongest defense. At RSA Conference™ 2024, May 6 – 9, we unite in San Francisco as a cybersecurity community, fostering learning, networking, idea exchange, and exploration of cutting-edge innovations. Join us as we face the future of cybersecurity head on. Learn more and register.

Notes.

Today's issue includes events affecting Israel, Japan, the Netherlands, Poland, Russia, Ukraine, the United Kingdom, and the United States.

Attacks, Threats, and Vulnerabilities

Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns (Cisco Talos Blog) Since September 2023, we have observed a significant increase in the volume of malicious emails leveraging the Google Cloud Run service to infect potential victims with banking trojans.

Several Ukrainian media outlets attacked by Russian hackers (The Record) Russian hackers attacked several popular Ukrainian media outlets over the weekend, posting fake news related to the war.

Schneider Electric confirms data was stolen in Cactus ransomware attack (ITPro) Schneider Electric said corporate data has been stolen, but insisted that the attack on its sustainability division was an isolated incident

Israeli Aircraft Survive “Cyber-Hijacking” Attempts (Infosecurity Magazine) Hackers have attempted to divert two commercial Israeli aircraft in recent days, reports claim

Security Vulnerabilities in Apex Code Could Leak Salesforce Data (Varonis) Varonis' threat researchers identified high- and critical-severity vulnerabilities in Apex, a programming language for customizing Salesforce instances.

Security Patches, Mitigations, and Software Updates

Critical ConnectWise ScreenConnect vulnerabilities fixed, patch ASAP! (Help Net Security) Vulnerabilities in ConnectWise ScreenConnect could allow attackers to execute remote code or impact confidential data or critical systems.

Litigation, Investigation, and Law Enforcement

Maryland Busts $9.5 Million #BEC Money Laundering Ring (CyberCrime & Doing Time) A blog about cybercrime and fraud and the cases and criminals related to those crimes. BEC, scams, fraud, spam, phishing and malware

Raccoon Infostealer operator extradited to the United States (Malwarebytes) A Ukrainian national that is being accused of operating the Raccoon Infostealer in a Malware-as-a-Service has been extradited to the US.

Police arrest LockBit ransomware members, release decryptor in global crackdown (BleepingComputer) Law enforcement arrested two operators of the LockBit ransomware gang in Poland and Ukraine, created a decryption tool to recover encrypted files for free, and seized over 200 crypto-wallets after hacking the cybercrime gang's servers in an international crackdown operation.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

SO-CON Summit (Arlington, Virginia, USA, Mar 11 - 15, 2024) It will feature over 20 unique cybersecurity sessions from industry experts. They’ll be sharing new research, new open source tools, best-practices, and much more. The first day of the summit will be followed by several days of training (including red teaming, tradecraft analysis, AD security fundamentals, and much more).

Insider Risk Management Program Evaluation & Optimization Training Course (Vienna, Virginia, USA, Apr 8 - 9, 2024) The training course will be taught on April 8-9, 2024. Students will receive extensive training, knowledge and resources to help them evaluate an Insider Risk Management (IRM) Program, identify gaps and provide cost effective strategies to optimize the program. This training will provide a 360 perspective for detecting Insider Risks / Threats and also covers establishing an Employee Continuous Monitoring & Reporting Program and employee monitoring on computer systems and networks using Insider Threat Detection Tools. Our student satisfaction levels are in the exceptional range. Over 900+ individuals have attended our training courses and received ITP Manager Certificates. The Insider Threat Defense Group offers the most affordable, advanced / next generation and value packed training for IRM. This provides students with IRM training that is taught from a real world, practical and operational perspective.

Events

SANS Security East New Orleans 2024 (New Orleans, and virtual, Louisiana, USA, Feb 19 - 24, 2024) At SANS Security East New Orleans 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Spring 2024 CISSP Study Group presented by ISSA Central MD (Columbia, or virtual, Maryland, USA, Feb 20 - May 1, 2024) Our Study Group fosters a learning environment to better absorb and understand the material. This is much better than the alternative of cram it in and regurgitate it on a test immediately following. Our approach simply makes the information more useful and easier to interpret! You can attend each session in-person in Columbia, MD, or attend virtually on line.

Trellix Public Sector Cybersecurity Summit (Washington, DC, USA, Feb 27, 2024) Public sector organizations continue to face a constant barrage of sophisticated cyber threats. And with new cybersecurity mandates and guidance — from recent executive orders to the release of the 2023 National Cyber Strategy — public sector leaders must make considerable decisions about their cyber enterprise that will have lasting impacts for years to come. On top of this, the emergence of novel security capabilities built on machine learning, AI, predictive analytics and extended detection and response has given security leaders a new arsenal of tools to defend against the next sophisticated attack. Join top technology leaders from across the public sector at the Trellix Public Sector Cybersecurity Summit as they discuss emerging topics in cybersecurity like ransomware, zero trust, global security and XDR. Throughout the summit, you’ll have the opportunity to engage in conversations about how the arrival of AI will intersect with public sector cybersecurity, evolving partnerships to strengthen threat intelligence, how to navigate, take action on and go beyond new cybersecurity policy directives, and much more.

SANS Las Vegas 2024 (Las Vegas (and virtual), Nevada, USA, Mar 4 - 9, 2024) At SANS Las Vegas 2024, choose from 41 interactive courses with hands-on labs. Practice your skills and compete against your peers during NetWars Tournaments, and network with your instructor and industry colleagues in real-time. Each course includes electronic and printed books, and several courses align with GIAC certifications!

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 02.20.24