News of the Cyber World

[kyonides]

Costa Rican president begins tenure with
ransomware national emergency declaration

Editor's Note: Hackers had also mentioned something terrible about US President Joe Biden on a memo they had published online.

The new president of Costa Rica declared a national emergency over the weekend as fallout continues from a late-April ransomware attack.

President Rodrigo Chaves Robles, who began a four-year term as president Sunday after winning the country’s April 4 election, signed the declaration on May 8 as one of his first official acts, according to local news outlet Amelia Rueda. The executive decree reads, in part, that Costa Rica is “suffering from cybercriminals, cyberterrorists” and that the decree allows “our society to respond to these attacks as criminal acts.”

Somebody calling themselves “unc1756” using the Russian-based Conti ransomware platform claimed responsibility for the April 17 attacks in a post on the Conti dark web data portal. The post indicates that 97% of the stolen data has been published so far, totaling more than 672 gigabytes of information.

The post also blames the government of Costa Rica for not paying the original $10 million ransomware demand, which outgoing President Carlos Alvarado said was an attempt to “threaten the country’s stability in a transitional situation.”

Here I am in the dire need of adding several facts to this story. First of all, Conti's initial demand was a single payment of US$30 millions. Former President Alvarado refused to make any such payment. Later on the hackers proposed the Costa Rican government could make a payment of US$10 millions instead. At the same time they  had also announced that Conti would attack private businesses for they would surely pay the ransom to keep their data "safe" (as if).

Yesterday, President Chaves declared that Costa Rican hackers  and public servitors  got to be involved in this heinous hack as well.

By the way, the hackers also made a curious statement. They said US President Joe Biden would die any time soon.

“Announcing this reward jointly with the Costa Rican government signals the commitment of the United States to support its allies against the leaders and affiliates of the Conti ransomware variant group.”

Ukrainian cybercriminal sentenced to 4 years
in U.S. prison for credential theft scheme

A Ukrainian man convicted in February of trafficking in stolen username and password credentials was sentenced to four years in federal prison Thursday, the U.S. Department of Justice announced Thursday.

Polish authorities arrested Glib Oleksandr Ivanov-Tolpintsev, 28, on Oct. 3, 2020, and extradited to the U.S. to appear in a Florida courtroom on Sept. 8, 2021. He pleaded guilty to the charges on Feb. 22, 2022.

Ivanov-Tolpinstev allegedly boasted of controlling a botnet that was capable of accessing 2,000 usernames and passwords a day, which then enabled other perpetrators to commit fraud or other crimes such as tax fraud and ransomware, prosecutors said. Between 2017 and 2019 he listed thousands of login credentials for sale on a darkweb marketplace. The scheme netted Ivanov-Tolpinstev roughly $80,000.
...
An IRS affidavit showed that a multiple email addresses associated with Ivanov-Tolpinstev were included in receipts to vape shops, while another email address was used to communicate with a dark web associate based in China.

ICE surveillance dragnet scoops up data on 3 out of 4 Americans

Annual spending by the Immigration and Customs Enforcement agency on surveillance technologies ballooned from roughly $71 million in 2008 to $388 million today, researchers at Georgetown Law’s Center for Privacy and Technology conclude in a research paper published Tuesday.

The report, which took researchers two years, shows how ICE’s surveillance and data-collection and data-sharing initiatives have expanded over the past decade into a dragnet that captures the personal data of not just immigrants, but nearly three out of four Americans.
...
Based on public records, researchers found that ICE has scanned at least a third of all adults’ driver’s licenses with facial recognition technology and is able to access the licenses of roughly 75% of adults. ICE can also locate three in four adults through their utility records.

The report demonstrates how over the past decade ICE has moved past using data collected in a law enforcement context and DMV records to data that includes child welfare data, utility bills, hospital records and other sensitive information available from data brokers to track individuals.

 I hope nobody here is going to claim that an agency that should focus its resources on immigrants should also spy the American people "for the greater good."

FBI charges Venezuelan doctor with using,
selling 'Thanos' ransomware

The FBI announced charges Monday against a Venezuelan cardiologist that the bureau said was moonlighting as a cybercriminal mastermind, both designing and using ransomware that he bragged was deployed by Iranian state-sponsored hackers.

Moises Luis Zagala Gonzalez, who also went by the user names “Nosophoros,” “Aesculapius” and “Nebuchadnezzar,” is being charged with attempted computer intrusions and conspiracy to commit computer intrusions.

According to the complaint unsealed Monday, Zagala sold and rented out his ransomware software, providing cybercriminals with extensive training on how to use his product and even set up their own ransomware gangs.

One of his tools, titled “Thanos,” allowed users to create their own custom ransomware for a licensing fee of up to $800 a month. Another product, called “Jigsaw v. 2” had a built-in “Doomsday” counter feature that erased a victim’s hard drive after multiple attempts to remove the ransomware.