A SIM Swapper gets jail time after pleading guilty, youtubers are being targeted in attackers,
and REvil goes offline... again! All that coming up now on ThreatWire.
Greetings!! I’m Shannon Morse and this is ThreatWire for October 26, 2021!
This is your weekly summary of the threats to our security, privacy and Internet freedom. THANK YOU
to Mateus, Franklin, Michael1 and Dag for joining this week on Patreon. Patreon.com/ThreatWire as
always to keep this show ad free. If you want a special signed holiday card from me this year,
sign up anytime in October! You’ve got one week left! These cards are limited and
only available for supporters, so once they’re gone, they’re gone. With that, onto the news!!
A 20 year old SIM swapper pleaded guilty to aggravated identity theft after a cybercrime
partnership went bad. In this case, the SIM swapper and his accomplices had stolen
almost $17,000 from victims, but two of the criminals parted ways after a third
accomplice after discovering the third person had never paid them their part of the stolen profits.
While there are precautions consumers can take to prevent SIM swapping,
in this case a cell phone carrier employee’s credentials were accessed via a phishing
campaign targeting their login details in order to obtain phone numbers that could be stolen.
The attackers used the employee’s password to log into the company's internal network
where they were able to steal phone numbers in a SIM swapping attack. The number was used to
gain access to the victim’s cryptocurrency wallet, where they stole almost $17,000 of cryptocurrency.
The 20 year old, Bryan, suspected his accomplice, Milleson, didn’t give him his share, so he doxxed
and Swatted him. Cops showed up at Milleson’s residence, found there was no reason for the
swat team to be called, and were informed by a relative of Milleson’s that someone called
their house and claimed Milleson had stolen almost $20 grand. The Department of Justice was able to
utilize resources from the Dark Market and Digital Currency Crimes Task Force to bring Milleson to
justice in May of this year, and Bryan now faces a sentencing of two years for his involvement.
This story hits close to home because I just gave a talk
at a YouTuber event about how to protect your YouTube account from getting hijacked.
Google’s Threat Analysis Group has been researching an ongoing campaign,
first spotted back in 2019, that targets youtube creators in phishing attacks
meant to steal their passwords. The campaigns often promise a sponsorship or partnership
with a brand and ask the creator to download a file, which is actually malware. The criminals
behind these attacks seem to stem from job ads on Russian forums seeking hackers for hire, who could
use social engineering tactics and phishing emails to push malware to content creators.
The job descriptions included collecting the youtube account contact email, registering a gmail
account, send out social engineering and phishing attacks, and tricking victims into downloading the
malware. The hired hackers could earn between 25% to 70% of revenue from hijacked youtube channels.
Multiple malware variants are being used in these attacks in order to steal the targets
credentials and browser cookies, which can allow the attacker to hijack the targets youtube account
in a pass-the-cookie attack. The malware could avoid sandboxing by using enlarged files,
encrypted archives and download IP cloaking, according to a TAG Security Engineer. The attacker
can use the stolen browser cookies to pose as the victim, already authenticated in a browser, which
means they wouldn’t need to go through the login process and could circumvent a 2FA login code.
Many of the youtube accounts were used to conduct live streaming cryptocurrency scams
and sold for up to $4000 via the dark web. Google’s cybersecurity team has
cut down on phishing emails and blocked many attacks, but attackers are shifting
away from the gmail accounts towards .cz accounts, so it’s still ongoing.
Google is still investigating and reported these attacks to the FBI. Since May,
Google has restored about 4000 youtube influencer accounts that were targeted in these campaigns.
Creators should use 2FA, with hardware tokens being the best option, even though codes could
be bypassed in this specific attack scenario and never download files sent from unknown accounts.
I love it when y’all send me these adorable pictures of your pets so these are a few from
my hush puppy Patreon Alliance members. You can always support this content and
keep it ad free for as little as $2 / month, and get a slew of perks at the same time,
including that holiday card! Each alliance member gets over 10 perks as soon as you
sign up at patreon.com/threatwire. With that, now onto the third story.
REvil seems to leave and come back over and over again. It’s like watching a
tennis match between REvil ransomware gangs and the government agencies.
According to reports, law enforcement groups from several countries worked together to
disrupt the REvil ransomware group once again, taking down the group for the second time.
This came after a REvil operator shared via a cybercrime forum
that someone had taken control of the groups Tor payment portal and data leak website.
Of the two REvil operators who owned domain keys, one of them disappeared over the summer.
That operator's key was used this month to access the domain after going silent for several months,
leading the sole operator that was still active to assume the server was compromised.
Reports later confirmed the access happened by way of the US and other countries who were
forcing the domain offline. The remaining operator signed off after announcing the information about
the compromised server, and many are left to wonder if REvil will be back after this again.
REvil has struggled to get new users for their operations since their original
shutdown over the summer, so it’s believed the operation won’t come back in this format,
but could potentially resurface under a new brand and new operation.
This week I’m reviewing my in hand Google Pixel 6 Pro over at youtube.com/ShannonMorse.
Check out my channel for that video. Don't forget to like and subscribe to
this channel as well! I'm Shannon Morse, I'll see you on the Internet!