Dark Web | Business Upturn

Lockbit claims resurgence after global police takedown

Eesha Chakraborty — Tue, 27 Feb 2024 03:17:29 +0000

In a surprising turn of events, the notorious cybercrime group Lockbit, known for its use of ransomware to extort victims, claims to be operational again following a recent international takedown effort by law enforcement agencies.

Earlier in February, a coordinated operation led by the United Kingdom’s National Crime Agency (NCA) targeted Lockbit. This unprecedented effort resulted in arrests, indictments, and the seizure of the group’s infrastructure, effectively taking them offline.

However, in a recent statement, Lockbit asserts that they have restored their servers and are back in business. They claim their “backup blogs,” which are believed to be alternative platforms for leaking stolen data from victims, were unaffected by the takedown due to their use of a different programming language. This statement, posted on a newly established dark website, further asserts that stolen data leaks will continue.

The NCA, however, disputes Lockbit’s claims. They maintain that the group remains “completely compromised” and emphasize their ongoing efforts to disrupt Lockbit’s activities. Additionally, they acknowledge the possibility of the group attempting to rebuild and regroup, highlighting the vast amount of intelligence gathered about Lockbit and its associates.

While the group claims partial functionality, the effectiveness of the police operation and the extent of Lockbit’s capabilities are still under investigation. Cybersecurity experts continue to advise organizations to remain vigilant and implement robust defenses against the ever-present threat of ransomware attacks.

India’s Biggest Data Leak! Aadhaar data of 81.5 Cr Indians leaked on dark web, claims report

Uddeshya Thakur — Tue, 31 Oct 2023 17:12:17 +0000

The biggest data leak so far has come to light in the country. The data of 81.5 crore Indians available with the Indian Council of Medical Research (ICMR) has been leaked. According to a report by US-based cybersecurity firm Resecurity, personally identifiable information of about 815 million i.e. 81.5 crore Indians has been leaked on the dark web.

According to the report, data including name, phone number, address, Aadhaar, passport information is available for sale online. “On October 9, a thread actor identified as ‘pwn0001’ posted a thread on the breach forum showing access to 815 million ‘Indian Citizen Aadhaar and Passport’ records,” Resecurity wrote in a blogpost.

⚠️ India Biggest Data Breach

Unknown hackers have leaked the personal data of over 800 million Indians Of COVID 19.

The leaked data includes:

* Name
* Father's name
* Phone number
* Other number
* Passport number
* Aadhaar number
* Age#DataBreach #dataleak #CyberSecurity pic.twitter.com/lUaJS9ZPDr

— Shivam Kumar Singh (@MrRajputHacker) October 30, 2023

The company also said that investigators from its HUMINT unit, who contacted the thread actor, learned that they were willing to sell the entire Aadhaar and Indian passport database for $80,000. ICMR is aware of this data leak.

Sources confirmed to News18 that the epicentre of leakage has not been identified as parts of the Covid-19 test data go to the National Informatics Centre (NIC), ICMR and Ministry of Health.

Cyber security & resilience framework released by SEBI for MIIs

Dixita Hazarika — Tue, 29 Aug 2023 16:05:28 +0000

According to the Securities and Exchange Board of India (SEBI) guidelines that was released on August 29, stock exchanges, clearing corporations, depositories and other such market infrastructure institutions (MIIs), have been asked to maintain regularly updated “gold images” of critical systems if they need to be rebuilt and to engage with Dark Web monitoring services to check for any brand abuse or data leak.

A circular titled “Guidelines for MIIs regarding Cyber security and Cyber resilience” was released where it was stated by SEBI about maintaining these “gold images” entails having image “templates” “that include a preconfigured operating system (OS) and associated software applications that can be quickly deployed to rebuild a system, such as a virtual machine or server”.

Due to the increasing interdependence in the market, the guidelines have been released. The circular stated that with the change in market dynamics in the Indian Securities markets, the interdependence among the MIIs had seen significant increase and considering the interconnectedness and interdependency of the MIIs to carry out their functions, the cyber risk of any given MII was no longer limited to the MII’s owned or controlled systems, networks and assets.

Other guidelines out of the total of 28 include maintaining encrypted backups of data offline and regularly testing those backups monthly to ensure confidentiality, integrity and availability. Explore the option of keeping backup hardware in a segregated environment to rebuild systems in the event that MII operations cannot be run from both the primary data center (PDC) and disaster recovery (DRS). and regular business continuity exercises to check the readiness of the organization and effectiveness of existing security measures against ransomware attacks at the ground level.

On domain controllers (DCs), the circular said that DCs are often used by “threat actors” as a “staging point to spread ransomware network-wide”.

Therefore, in order to secure these controllers, MIIs need to ensure that DCs are patched as and when patch is released and it must be reviewed on a quarterly basis; MIIs should make sure that no installation of unnecessary software takes place on DCs, as these can be leveraged to run arbitrary code on the system; MIIs should ensure that access to DCs should be restricted to the administrators group and the users within this group should be given different access stages; MIIs should also ensure that DC host firewalls are configured for preventing direct internet access; and for known Active Directory Domain Controller abuse attacks, MIIs should undertake the penetration testing activity (internal and external). Weaknesses should be rectified on topmost priority.

BigBasket faces cyber attack: Data of 2 crore users on sale for Rs 30 lakh

Shalmali Bhagwat — Sun, 08 Nov 2020 09:41:45 +0000

Grocery e-commerce platform BigBasket has faced a cyber attack which could have potentially leaked details of around its 2 crore users, as reported by cyber intelligence firm Cyble. The company has filed a police complaint with the cyber cell unit in Bengaluru and is currently verifying claims made by cyber experts.

Cyble claimed that the breach occurred on October 30, 2020, and it has already informed the management of BigBasket about it. It has reported that a hacker had put a price of around 30 lakh rupees on data belonging to BigBasket. “In the course of our routine dark web monitoring, the research team at Cyble found the database of Big Basket for sale in a cyber crime market, being sold for over USD 40,000. The leak contains a database portion; with the table name ‘member_member’. The size of the SQL file is about 15 GB, containing close to 20 million user data,” Cyble said in its blog. It further disclosed the nature of data put on sale includes names, email IDs, password hashes, contact numbers (mobile and phone), addresses, date of birth, location, and IP addresses of login among many others.

“A few days ago, we learnt about a potential data breach at BigBasket and are evaluating the extent of the breach and authenticity of the claim in consultation with cybersecurity experts and finding immediate ways to contain it. We have also lodged a complaint with the Cyber Crime Cell in Bengaluru and intend to pursue this vigorously to bring the culprits to book,” BigBasket said in a statement. The company has already assured the customers that they hold their privacy and confidentiality supreme and are confident that the financial data is completely secure as they do not store details associated with financial transactions like credit card details etc. “We have a robust information security framework that employs best-in-class resources and technologies to manage our information. We will continue to proactively engage with best-in-class information security experts to strengthen this further,” BigBasket said.

The Bengaluru-based company is backed by Alibaba Group, Mirae Asset-Naver Asia Growth Fund, and the UK government-owned CDC group.