March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – APT-C-23 or AridViper Threat Group – Active IOCs
April 7, 2022
Rewterz Threat Advisory – CVE-2022-0778 – OpenSSL Flaw Affecting Palo Alto Devices
April 8, 2022
Rewterz Threat Alert – APT-C-23 or AridViper Threat Group – Active IOCs
April 7, 2022
Rewterz Threat Advisory – CVE-2022-0778 – OpenSSL Flaw Affecting Palo Alto Devices
April 8, 2022
Severity
Medium
Analysis Summary
Germany’s Federal Criminal Police Office or the Bundeskriminalamt (BKA) and the Central Office for Combating Cybercrime (ZIT) announced sanctions against Russia-based darknet market Hydra. ZIT, along with the U.S. law enforcement authorities conducted the investigation that lead to the seizure of Hydra. Hydra mostly specialized in the sale of narcotics along with data sales like credit card information and other online services. Countries such as Russia, Belarus, Kazakhstan, and Ukraine were the leading participants. Hydra’s annual sales in 2020 amounted to 1.23 billion euros. The platform had 17 million costumers and 19,000 or more seller accounts.
“The Frankfurt am Main Public Prosecutor’s Office – Central Office for Combating Cybercrime ( ZIT ) – and the Federal Criminal Police Office ( BKA ) today, Tuesday, secured the server infrastructure in Germany of the world’s largest illegal Darknet marketplace “Hydra Market” and thus closed it.” reads the announcement published by the German BKA. “Bitcoins amounting to currently the equivalent of approx. EUR 23 million were seized, which are attributed to the marketplace.”
The US Treasury’s Office of Foreign Assets Control (OFAC) also has announced sanctions against Hydra and Garantex, which is an Estonian crypto exchange. Germany was able to seize $25 million in bitcoin. Recently, Virtual Currency Exchanges CHATEX and SUEX have also been sanctioned.
Impact
- File Encryption
- Data Exfiltration
- Credential Theft
- Financial Loss
Remediation
- Logging – Log your eCommerce environment’s network activity and web server activity.
- Passwords – Ensure that general security policies are employed including: implementing strong passwords, correct configurations, and proper administration security policies.
- Admin Access – limit access to administrative accounts and portals to only relevant personnel and make sure they are not publicly accessible.
- WAF – Web defacement must be stopped at the web application level. Therefore, set up a Web Application Firewall with rules to block suspicious and malicious requests.
- Patch – Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Secure Coding – Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
- 2FA – Enable two-factor authentication.
- Antivirus – Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using a multi-layered protection is necessary to secure vulnerable assets