Hello world,
A US Nuclear weapons contractor has fallen victim to a ransomware attack,
and the attackers are threatening to hand the stolen data over to the Russian military,
It has emerged that Denmark helped the NSA spy on its European neighbours,
And one of the world’s largest ransomware gangs has vanished,
That’s in today’s episode of the weak web where we break down and dissect cyber security tech news.
In a worrying turn of events, a military contractor which works on US Nuclear
weapons has been the latest domino to fall in the scourge
of ransomware sweeping the interwebs. The perpetrators have even threatened
to leak captured data to rival military agencies if the victim doesn’t pay up.
The company at the center of this is Sol oriens, which in their own words is “focused on managing
advanced technologies and concepts with strong potential for military and space applications”.
They’re so high tech their website doesn’t even load. The ransomware attack seems to
have been initiated by the rEvil ransomware group, which is a Russian cybercrime gang that
was also responsible for the recent attack on the world’s largest meat supplier JBS.
Nowadays it’s standard practice for ransomware gangs to not only encrypt data locally but also
to exfiltrate it and threaten its release if the ransom remains unpaid - in this particular case
that’s very bad news, given a military contractor which works on nuclear weapons is going to house
some pretty sensitive data. We don’t know to what extent Sol oriens works on Nukes,
maybe they’re just responsible for painting the things in which
case there’s not much to worry about, but I’m guessing that isn’t the case.
When Sol oriens was asked about all this they gave the very astute and insightful response
“we recently determined that an unauthorized individual acquired certain documents from our
systems” - that’s a lot of words without managing to say much, but before you roast them, in
fairness they did go on to clarify that they “have no current indication that this incident involves
client classified or critical security-related information” which is a good sign.
However, it’s being reported that data has started to be leaked by the ransomware gang,
presumably due to non-payment of that ransom. Now I’ve trawled through rEvil’s darkweb blog,
and I can’t find this leaked data, but I’ll take the reports at face value. As
it stands the leaks are limited to payroll info, employee names and social security
numbers - which isn’t great, but then again it’s not thermonuclear warhead schematics.
There’s no evidence that rEvil is backed by the Russian government in
any way - by all accounts rEvil is in it purely for the money,
however the gang is quoted as saying “We hereby keep a right to forward
all of the relevant documentation and data to military agencies of our choice” - obviously
a direct threat to pass on the stolen data, presumably to Russian military organisations.
In international cyberespionage news Denmark has been accused of assisting the NSA in a
mission to spy on the communications of various high level European politicians,
and no this wasn’t a plot to eavesdrop on Belarussian oligarchs or something easily
justifiable, but rather an operation targeted against top level politicians in “Sweden, Norway,
France and Germany” which are of course meant to be allies of Denmark and the US.
Danish media is reporting this story which references 9 anonymous sources which have
access to classified information held by the Danish Intelligence service, which I’m not even
going to try pronouncing and just refer to it as the FE. You see, due to its geography, many
undersea cables transmitting data to and from EU countries use Denmark as a landing ground. The FE
provided access to these cables to the NSA which is accused of using special analysis software
“XKeyscore” to intercept data, specifically the text messages and phone conversations
of prominent EU politicians including that of the chancellor of Germany “Angela Merkel”.
We don’t definitively know much about “XKeyscore” other than it was developed by the NSA,
and shared with various allies, funnily enough including Germany. According to Snowden the
software is essentially big brother’s wet dream - it has the ability to “read anyone's email in
the world and track people’s movements using a digital fingerprint it builds on victims”
and that’s really just scratching the surface - it’s full capabilities would
take too much time to detail in this video, though in essence it’s a tool used to sift
through the gargantuan amounts of metadata which the NSA collects.
This whole saga codenamed "Operation Dunhammer" does have a bit of history behind it,
Snowden first spilled the beans of the gist of it way back in 2013,
whilst it caused a diplomatic row back then, nothing really came of
it and German prosecutors closed the case in 2017 due to a lack of evidence. It's only the
emergence of the new revelations implicating Denmark which has resurfaced this case.
According to Snowden, then vice president Joe Biden was quote
"deeply involved in this scandal the first time around" - it’ll be interesting to see if this
opens any rifts. The NSA hasn't commented on these new revelations,
European leaders have called it “unacceptable” and “scandalous” among various things,
just words really, not much in the way of action. However, maybe the reason we’re not seeing much
in the way of action is because no country is innocent when it comes to eavesdropping.
In fact Germany was accused in 2015 of helping the NSA spy on certain EU companies - one of which,
Airbus, filed a criminal complaint against “persons unknown” over the incident.
In addition, the UK’s GCHQ was implicated in “Operation socialist”,
the mission which Snowden described as the “first documented example to show
one EU member state mounting a cyber attack on another” saw UK government spies hack into the
Belgian telecom company Belgacom, now rebranded proximus. Sophisticated malware was installed
on Belgacom’s computer systems, masquerading as Microsoft software whilst covertly stealing data.
Leaked presentation slides marked top secret detail the objectives of
the mission - the aim seems to have been to gain a foothold in Belgacom,
which handles communication links with much of the world as this leaked GCHQ screenshot shows.
Point being everyone seems to be spying on eachother,
and of course the cases I’ve mentioned in this segment are really only the tip of the iceberg.
There’s going to be a whole lot more going on that we’ll never hear about.
A world top 10 ransomware gang has mysteriously vanished. In the early hours of last Friday,
news website bleepingcomputer received an anonymous email,
pretending to be from the FBI, the email contained a link to a zip file
which contained 2934 decryption keys mapping to victims of the Avaddon ransomware.
The keys were tested against a virtual machine encrypted with the malware to verify
their authenticity, and they worked. Following this, Avaddon’s dark web site has since become
inaccessible - Avaddon formerly used this website to host the data of victims which refused to
pay their ransom. It kinda sounds like someone infiltrated Avaddon, stole the decryption keys
and demolished the website, though upon further inspection that doesn’t appear to be the case.
Bleepingcomputer reports that “ransomware negotiation firms and incident responders
saw a mad rush by Avaddon over the past few days to finalize ransom payments from existing unpaid
victims” and that Avaddon has been accepting ransom counteroffers without any pushback-
this is highly unusual, and all points to Avaddon having circled
a date on their calendar on which they wanted to wind down their operations.
But why quit at such a moment? After all ransomware is a good money maker,
Avaddon themselves is one of the largest ransomware groups out there,
they emerged in the world’s top 10 ransomware groups in Q3 last year
and must be making bank. We can only speculate on why they’ve decided to shut up shop.
A fair guess is that the increasing heat from law enforcement was a big deciding factor. As I
covered in a previous video, the US is starting to fight cybercrime in a similar manner to terrorism,
with a newly established dedicated taskforce based in Washingtown entrusted with co-ordinating
investigations of large scale cybercrime. Avaddon may have understandably come to the conclusion
that now is a good time to give up the trade, they are probably stacked with bitcoin at this point,
might as well just take the W and move on, rather than risk being caught in an upcoming
international cyber crime sting, and end up being thrown in prison for a decade or two.
The ransomware surge we’re seeing now will likely come to an end or at least a lull at
some point for one reason or another, best end on a high whilst you can rather than be
caught in its demise. Avaddon isn’t the first ransomware gang to withdraw from the space,
a while ago I covered fonixcrypter’s exit - they also released a trove of decryption keys for free
as well as an apology to all of their victims, signing off with an Einstein quote.
No such gesture from Avaddon, I suppose if you want to disappear quietly,
best not give people a reason to remember you - which would explain Avaddon’s muted retirement,
with no formal send off other than an anonymous email to an organisation
they know has the ability to propagate the decryption keys,
in a bid to pacify anyone who has a still outstanding grudge against them.
If you enjoy this kind of video make sure to help me out by tickling the like button for the youtube
AI as well as turn on those sub notifications. If you’re looking for something to watch next,
go check out my previous video on how embarrassing vulnerabilities in Huawei
products went unfixed for months even after Huawei was warned about them.
If you get a lot of value from this series of videos do consider becoming a channel member,
as always sources will be linked in the video description,
stay tuned for more hacking videos, have a good one.