Hello world, first up in today's exploration of cyber security tech news: "Ukrainian hacktivists
[are hitting] Putin where it really hurts" - Russia's alcohol supply.
This is thanks to Ukraine's IT army - an international alliance of pro Ukrainian hacktivists, which
are known for using DDoS attacks to take offline Russian energy companies, banks, military
websites, and so on, generally going after important Russian infrastructure.
But now, in response to Russia's "special military operation", they've launched a "special
sobriety operation".
Taking aim at Russia's "Alcohol Accounting Information System", also known as the "EGAIS"
- now this is a government controlled system that all alcohol manufacturers and distributors
in Russia are required by law to use in order to report their alcohol sales, and they have
to do this in real time.
So if this website is down, then distributors simply cannot sell alcohol to stores.
And if there's one way to get under the skin of Russians it's to mess with their vodka,
so Ukraine's IT Army, under the command of the Ukrainian government themselves directed
the hundreds of thousands of subscribers to their telegram channel to DDoS servers associated
with this "Alcohol Accounting System".
They launched these attacks at the beginning of this month, which didn't come at a good
time for Russia - as Russia has a whole string of national holidays in early May, for which
a steady supply of vodka is no doubt essential.
And right on cue, reports started popping up in Russian media of "large-scale failure[s]"
in that "alcohol accounting system", attributed to the "IT Army of Ukraine".
And other than just making headlines, there was some real world impact, the downtime seems
to have lasted roughly 2 days, and one Russian alcohol distributor reported within this time
they "failed to upload about 70% of invoices to [the system]".
And that "warehouses of finished products [were] overflowing due to the inability to
move goods from factories to distribution centers."
In response, the Russian government has implemented IP geoblocking, preventing the service from
receiving traffic from outside Russia, dampening the attack, and bringing to an end the "special
sobriety operation".
The "IT army of Ukraine" has since moved on to attacking other Russian servers.
I'll make sure to link my previous videos on this "IT Army" below - but interestingly
I noticed the subscriber count on their Telegram channel (that they use to dish out commands)
is down from 309 thousand since my previous video, is that just due to spam accounts being
pruned, or are people losing interest in pro Ukrainian hacktivism, let me know your thoughts
in the comments.
Next up, Costa Rica - known for their national parks, volcanoes, and sloths - has declared
a national emergency.
But what for?
The culprit is ransomware.
Ransomware which in the last few weeks has crippled half a dozen Costa Rican government
agencies.
The main victim being the "Ministry of finance" which has been without digital services since
April 18th - this is a disaster for Costa Rica.
The country's customs platform outage alone has caused losses of $200 million dollars
for exporters.
And so, in the last few days the president declared a national emergency.
The group behind this string of ransomware attacks is none other than the internet's
current number 1 cyber crime gang "Conti".
And, to give you an idea of how much havoc these guys have caused in the last couple
of years, the US has a bounty of $15 million dollars on the heads of Conti.
Whereas they only have a bounty of $5 million for North Korean cyber miscreants.
Which values the downfall of Conti 3x more than that of North Korean hackers.
So, Conti stole almost 700GB of data from the Costa Ricans, which includes the source
code for government services, databases, and "historical taxpayer information considered
"sensitive"" - the gang demanded a sum of $10 million dollars in crypto from the government
in return for a promise not to release the data.
But the government "refused to even talk with the group", let alone pay the ransom.
Conti, as you can imagine, was not thrilled with this.
And has so far released almost all of the treasure trove for free, publicly on their
dark web site - which no doubt cyber cultures will descend upon to dissect, trying to somehow
profit from all the personal information contained within.
Conti also posted a message for the Costa Rican leader "all this could have been avoided
by paying, you would have made your country really safe, but you will turn to Bid0n and
his henchmen, this old fool will soon die.".
There are accusations this attack was initiated by another government, but Conti says "no
government of other countries has finalised this attack, everything was carried out by
me with a successful affiliate, my name is unc1756."
"I will definitely carry out attacks of a more serious format with a larger team, Costa
Rica is a demo version."
Now ransomware gangs will often big themselves up to sound scary, this talk of Costa Rica
being a demo version doesn't mean much.
This story is a pretty good example of just how detrimental ransomware can be, but if
you needed another example - I noticed a new post on Conti's blog, titled "For Peru", in
which they claim to have breached the "Peruvian Ministry of Finance", and have already started
leaking data.
Next up, the CIA has used their instagram page to put out a plea, calling on Russians
with access to confidential information that might help Ukraine, to come forward and submit
tips directly to the CIA.
The post was entirely in Russian, which led to some people thinking that the CIA's account
had been hacked.
But the post is legit, and other than just linking Russians to the CIA's clearnet and
darkweb site - which has been online since 2019, it does have some basic advice, like
not using your home internet connection to submit tips, and using TOR or a VPN.
Now, Instagram might seem like an odd choice to put out a plea like this, particularly
considering it's been banned in Russia for the last 2 months.
However, tens on millions of Russians are probably still using it thanks to the surge
in Russian VPN downloads ever since the invasion.
Currently the top 10 VPN apps are being downloaded 300 thousand times per day in Russia.
But that's not necessarily 300 thousand people, as it is quite common for people have multiple
VPNs, also we can't assume all those people are grabbing VPNs so they can get anti Putin
news - I imagine a good chunk of the downloads will be from people who just want to access
things like Netflix and TikTok.
But apparently many more Russians than usual are trying to get in touch with the CIA, which
is what may have prompted this post.
But this is coming from an anonymous CIA source talking to the Washington Post, so you've
got to take it with the pinchiest of salt pinches.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always, thanks for watching, you know what to do, tickle that notification bell and follow
me on the instagrams for behind the scenes content.
And I'll see you in the next video, have a good one.