Krebs on Security

The Russian government said today it arrested 14 people accused of working for "REvil," a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin's decision to station 100,000 troops along the nation's border with Ukraine.

The Russian government said today it arrested 14 people accused of working for &#8220;REvil,&#8221; a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin&#8217;s decision to station 100,000 troops along the nation&#8217;s border with Ukraine.
<div id="attachment_55828" style="width: 778px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55828" loading="lazy" class=" wp-image-55828" src="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq.png" alt="" width="768" height="504" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq.png 1570w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-768x504.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-1536x1008.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/06/fsbhq-782x513.png 782w" sizes="(max-width: 768px) 100vw, 768px" />The FSB headquarters at Lubyanka Square, Moscow. Image: Wikipedia.</div>
The FSB <a href="http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10439388%40fsbMessage.html" target="_blank" rel="noopener">said</a> it arrested 14 REvil ransomware members, and searched more than two dozen addresses in Moscow, St. Petersburg, Leningrad and Lipetsk. As part of the raids, the FSB seized more than $600,000 US dollars, 426 million rubles (~$USD 5.5 million), 500,000 euros, and 20 &#8220;premium cars&#8221; purchased with funds obtained from cybercrime.
&#8220;The search activities were based on the appeal of the US authorities, who reported on the leader of the criminal community and his involvement in encroaching on the information resources of foreign high-tech companies by introducing malicious software, encrypting information and extorting money for its decryption,&#8221; the FSB said. &#8220;Representatives of the US competent authorities have been informed about the results of the operation.&#8221;
The FSB did not release the names of any of the individuals arrested, although a report from the Russian news agency TASS <a href="https://tass.ru/proisshestviya/13431845" target="_blank" rel="noopener">mentions two defendants</a>: Roman Gennadyevich Muromsky, and Andrey Sergeevich Bessonov. Russian media outlet RIA Novosti released video footage from some of the raids:
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/Rj4f-8ayq-Q" width="660" height="415" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
REvil is widely thought to be a reincarnation of <a href="https://krebsonsecurity.com/?s=gandcrab" target="_blank" rel="noopener">GandCrab</a>, a Russian-language ransomware affiliate program that bragged of stealing more than $2 billion when it closed up shop in the summer of 2019. For roughly the next two years, REvil&#8217;s &#8220;Happy Blog&#8221; would churn out press releases naming and shaming dozens of new victims each week. A February 2021 analysis from researchers at IBM found the REvil gang <a href="https://www.ibm.com/security/data-breach/threat-intelligence" target="_blank" rel="noopener">earned more than $120 million in 2020 alone</a>.
But all that changed last summer, when REvil associates working with another ransomware group &#8212; DarkSide &#8212; attacked Colonial Pipeline, <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">causing fuel shortages and price spikes across the United States</a>. Just months later, a multi-country law enforcement operation allowed investigators <a href="https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/" target="_blank" rel="noopener">to hack into the REvil gang&#8217;s operations and force the group offline</a>.
In November 2021, Europol <a href="https://www.europol.europa.eu/media-press/newsroom/news/five-affiliates-to-sodinokibi/revil-unplugged" target="_blank" rel="noopener">announced</a> it arrested seven REvil affliates who collectively made more than $230 million worth of ransom demands since 2019. At the same time, U.S. authorities <a href="https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/" target="_blank" rel="noopener">unsealed two indictments against a pair of accused REvil cybercriminals</a>, which referred to the men as &#8220;REvil Affiliate #22&#8221; and &#8220;REvil Affiliate #23.&#8221;
It is clear that U.S. authorities have known for some time the real names of REvil&#8217;s top captains and moneymakers. Last fall, President Biden told Putin that <a href="https://www.cnbc.com/2021/07/09/ransomware-biden-presses-putin-to-disrupt-cybercriminals-in-russia.html" target="_blank" rel="noopener">he expects Russia to act</a> when the United States shares information on specific Russians involved in ransomware activity.
So why now? Russia has amassed approximately 100,000 troops along its southern border with Ukraine, and diplomatic efforts to defuse the situation have reportedly broken down. The Washington Post and other media outlets today <a href="https://www.washingtonpost.com/national-security/russia-ukraine-invasion-sabotage-operations/2022/01/14/769314a2-754f-11ec-8ec6-9d61f7afbe17_story.html" target="_blank" rel="noopener">report</a> that the Biden administration has accused Moscow of sending saboteurs into Eastern Ukraine to stage an incident that could give Putin a pretext for ordering an invasion.
&#8220;The most interesting thing about these arrests is the timing,&#8221; said Kevin Breen, director of threat research at <a href="https://www.immersivelabs.com" target="_blank" rel="noopener">Immersive Labs</a>. &#8220;For years, Russian Government policy on cybercriminals has been less than proactive to say the least. With Russia and the US currently at the diplomatic table, these arrests are likely part of a far wider, multi-layered, political negotiation.&#8221;
President Biden has warned that Russia can expect severe sanctions should it choose to invade Ukraine. But Putin in turn has said such sanctions could cause a complete break in diplomatic relations between the two countries.
Dmitri Alperovitch, co-founder of and former chief technology officer for the security firm <a href="https://www.crowdstrike.com" target="_blank" rel="noopener">CrowdStrike</a>, called the REvil arrests in Russia &#8220;ransomware diplomacy.&#8221;
&#8220;This is Russian ransomware diplomacy,&#8221; Alperovitch said on Twitter. &#8220;It is a signal to the United States &#8212; if you don&#8217;t enact severe sanctions against us for invasion of Ukraine, we will continue to cooperate with you on ransomware investigations.&#8221;
The REvil arrests were announced as many government websites in Ukraine were <a href="https://www.nytimes.com/2022/01/14/world/europe/hackers-ukraine-government-sites.html" target="_blank" rel="noopener">defaced by hackers</a> with an ominous message warning Ukrainians that their personal data was being uploaded to the Internet. &#8220;Be afraid and expect the worst,&#8221; the message warned.
Experts say there is good reason for Ukraine to be afraid. Ukraine has long been used as the testing grounds for Russian offensive hacking capabilities. State-backed Russian hackers have been blamed for the <a href="https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/" target="_blank" rel="noopener">Dec. 23, 2015 cyberattack on Ukraine&#8217;s power grid</a> that left 230,000 customers shivering in the dark.
<div id="attachment_58124" style="width: 822px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58124" loading="lazy" class="size-full wp-image-58124" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface.jpeg" alt="" width="812" height="821" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface.jpeg 812w, https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface-768x777.jpeg 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/uadeface-782x791.jpeg 782w" sizes="(max-width: 812px) 100vw, 812px" />The warning left behind on Ukrainian government websites that were defaced in the last 24 hours. The same statement is written in Ukrainian, Russian and Polish.</div>
Russia also has been suspected of releasing <a href="https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/" target="_blank" rel="noopener">NotPetya</a>, a large-scale cyberattack initially aimed at Ukrainian businesses that ended up creating an extremely disruptive and expensive global malware outbreak.
Although there has been no clear attribution of these latest attacks to Russia, there is reason to suspect Russia&#8217;s hand, said David Salvo, deputy director of <a href="https://en.wikipedia.org/wiki/Alliance_for_Securing_Democracy" target="_blank" rel="noopener">The Alliance for Securing Democracy</a>.
&#8220;These are tried and true Russian tactics. Russia used cyber operations and information operations in the run-up to its invasion of Georgia in 2008. It has long waged massive cyberattacks against Ukrainian infrastructure, as well as information operations targeting Ukrainian soldiers and Ukrainian citizens. And it is completely unsurprising that it would use these tactics now when it is clear Moscow is looking for any pretext to invade Ukraine again and cast blame on the West in its typical cynical fashion.&#8221;

The Russian government said today it arrested 14 people accused of working for “REvil,” a particularly aggressive ransomware group that has extorted hundreds of millions of dollars from victim organizations. The Russian Federal Security Service (FSB) said the actions were taken in response to a request from U.S. officials, but many experts believe the crackdown is part of an effort to reduce tensions over Russian President Vladimir Putin’s decision to station 100,000 troops along the nation’s border with Ukraine.

The FSB headquarters at Lubyanka Square, Moscow. Image: Wikipedia.

The FSB said it arrested 14 REvil ransomware members, and searched more than two dozen addresses in Moscow, St. Petersburg, Leningrad and Lipetsk. As part of the raids, the FSB seized more than $600,000 US dollars, 426 million rubles (~$USD 5.5 million), 500,000 euros, and 20 “premium cars” purchased with funds obtained from cybercrime.
“The search activities were based on the appeal of the US authorities, who reported on the leader of the criminal community and his involvement in encroaching on the information resources of foreign high-tech companies by introducing malicious software, encrypting information and extorting money for its decryption,” the FSB said. “Representatives of the US competent authorities have been informed about the results of the operation.”
The FSB did not release the names of any of the individuals arrested, although a report from the Russian news agency TASS mentions two defendants: Roman Gennadyevich Muromsky, and Andrey Sergeevich Bessonov. Russian media outlet RIA Novosti released video footage from some of the raids:

REvil is widely thought to be a reincarnation of GandCrab, a Russian-language ransomware affiliate program that bragged of stealing more than $2 billion when it closed up shop in the summer of 2019. For roughly the next two years, REvil’s “Happy Blog” would churn out press releases naming and shaming dozens of new victims each week. A February 2021 analysis from researchers at IBM found the REvil gang earned more than $120 million in 2020 alone.
But all that changed last summer, when REvil associates working with another ransomware group — DarkSide — attacked Colonial Pipeline, causing fuel shortages and price spikes across the United States. Just months later, a multi-country law enforcement operation allowed investigators to hack into the REvil gang’s operations and force the group offline.
In November 2021, Europol announced it arrested seven REvil affliates who collectively made more than $230 million worth of ransom demands since 2019. At the same time, U.S. authorities unsealed two indictments against a pair of accused REvil cybercriminals, which referred to the men as “REvil Affiliate #22” and “REvil Affiliate #23.”
It is clear that U.S. authorities have known for some time the real names of REvil’s top captains and moneymakers. Last fall, President Biden told Putin that he expects Russia to act when the United States shares information on specific Russians involved in ransomware activity.
So why now? Russia has amassed approximately 100,000 troops along its southern border with Ukraine, and diplomatic efforts to defuse the situation have reportedly broken down. The Washington Post and other media outlets today report that the Biden administration has accused Moscow of sending saboteurs into Eastern Ukraine to stage an incident that could give Putin a pretext for ordering an invasion.
“The most interesting thing about these arrests is the timing,” said Kevin Breen, director of threat research at Immersive Labs. “For years, Russian Government policy on cybercriminals has been less than proactive to say the least. With Russia and the US currently at the diplomatic table, these arrests are likely part of a far wider, multi-layered, political negotiation.”
President Biden has warned that Russia can expect severe sanctions should it choose to invade Ukraine. But Putin in turn has said such sanctions could cause a complete break in diplomatic relations between the two countries.
Dmitri Alperovitch, co-founder of and former chief technology officer for the security firm CrowdStrike, called the REvil arrests in Russia “ransomware diplomacy.”
“This is Russian ransomware diplomacy,” Alperovitch said on Twitter. “It is a signal to the United States — if you don’t enact severe sanctions against us for invasion of Ukraine, we will continue to cooperate with you on ransomware investigations.”
The REvil arrests were announced as many government websites in Ukraine were defaced by hackers with an ominous message warning Ukrainians that their personal data was being uploaded to the Internet. “Be afraid and expect the worst,” the message warned.
Experts say there is good reason for Ukraine to be afraid. Ukraine has long been used as the testing grounds for Russian offensive hacking capabilities. State-backed Russian hackers have been blamed for the Dec. 23, 2015 cyberattack on Ukraine’s power grid that left 230,000 customers shivering in the dark.

The warning left behind on Ukrainian government websites that were defaced in the last 24 hours. The same statement is written in Ukrainian, Russian and Polish.

Russia also has been suspected of releasing NotPetya, a large-scale cyberattack initially aimed at Ukrainian businesses that ended up creating an extremely disruptive and expensive global malware outbreak.
Although there has been no clear attribution of these latest attacks to Russia, there is reason to suspect Russia’s hand, said David Salvo, deputy director of The Alliance for Securing Democracy.
“These are tried and true Russian tactics. Russia used cyber operations and information operations in the run-up to its invasion of Georgia in 2008. It has long waged massive cyberattacks against Ukrainian infrastructure, as well as information operations targeting Ukrainian soldiers and Ukrainian citizens. And it is completely unsurprising that it would use these tactics now when it is clear Moscow is looking for any pretext to invade Ukraine again and cast blame on the West in its typical cynical fashion.”

At Request of U.S., Russia Rounds Up 14 REvil Ransomware Affiliates

In a great many ransomware attacks, the criminals who pillage the victim's network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by Wazawaka, the handle chosen by a major access broker in the Russian-speaking cybercrime scene.

In a great many ransomware attacks, the criminals who pillage the victim&#8217;s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by &#8220;Wazawaka,&#8221; the hacker handle chosen by a major access broker in the Russian-speaking cybercrime scene.
<img loading="lazy" class="aligncenter wp-image-58061" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/wbrkb.jpg" alt="" width="773" height="516" />
Wazawaka has been a highly active member of multiple cybercrime forums over the past decade, but his favorite is the Russian-language community Exploit. Wazawaka spent his early days on Exploit and other forums selling distributed denial-of-service (DDoS) attacks that could knock websites offline for about USD $80 a day. But in more recent years, Wazawaka has focused on peddling access to organizations and to databases stolen from hacked companies.
&#8220;Come, rob, and get dough!,&#8221; reads a thread started by Wazawaka on Exploit in March 2020, in which he sold access to a Chinese company with more than $10 billion in annual revenues. &#8220;Show them who is boss.&#8221;
According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.
Wazawaka also said he&#8217;d teamed up with <a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener">DarkSide</a>, the ransomware affiliate group responsible for <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the six-day outage</a> at Colonial Pipeline last year that caused nationwide fuel shortages and price spikes. The U.S. Department of State has since offered a $5 million reward for information leading to the arrest and conviction of any DarkSide affiliates.
Wazawaka seems to have adopted the uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder &#8212; not privately sold to the highest bidder. In thread after thread on the crime forum XSS, Wazawaka&#8217;s alias &#8220;Uhodiransomwar&#8221; can be seen posting download links to databases from companies that have refused to negotiate after five days.
&#8220;The only and the main principle of ransomware is: the information that you steal should never be sold,&#8221; Uhodiransomwar wrote in August 2020. &#8220;The community needs to receive it absolutely free of charge if the ransom isn&#8217;t paid by the side that this information is stolen from.&#8221;
Wazawaka hasn&#8217;t always been so friendly to other cybercrooks. Over the past ten years, his contact information has been used to register numerous phishing domains intended to siphon credentials from people trying to transact on various dark web marketplaces. In 2018, Wazawaka registered a slew of domains spoofing the real domain for the Hydra dark web market. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.
&#8220;I used to steal their QIWI accounts with up to $500k in them,&#8221; Wazawaka recalled. &#8220;A dealer would never go to the cops and tell them he was selling stuff online and someone stole his money.&#8221;
<h2>WHO IS WAZAWAKA?</h2>
Wazawaka used multiple email addresses and nicknames on several Russian crime forums, but data collected by cybersecurity firm <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> show that Wazawaka&#8217;s alter egos always used one of three fairly unique passwords: 2k3x8x57, 2k3X8X57, and 00virtual.
Those three passwords were used by one or all of Wazawaka&#8217;s email addresses on the crime forums over the years, including wazawaka@yandex.ru, mixseo@mail.ru, mixseo@yandex.ru, mixfb@yandex.ru.
That last email address was used almost a decade ago to register a Vkontakte (Russian version of Facebook) account under the name Mikhail &#8220;Mix&#8221; Matveev. The phone number tied to that Vkontakte account &#8212; 7617467845 &#8212; was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia.
<a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> [an advertiser on this site] reports mixfb@yandex.ru was used to register three domains between 2008 and 2010: ddosis.ru, best-stalker.com, and cs-arena.org. That last domain was originally registered in 2009 to a Mikhail P. Matveyev, in <a href="https://en.wikipedia.org/wiki/Abakan" target="_blank" rel="noopener">Abakan, Khakassia</a>.
Mikhail Matveev is not the most unusual name in Russia, but other clues help narrow things down quite a bit. For example, early in his postings to Exploit, Wazawaka can be seen telling members that he can be contacted via the ICQ instant message account 902228.
An Internet search for Wazawaka&#8217;s ICQ number brings up a 2009 account for a Wazawaka on a now defunct discussion forum about Kopyovo-a, a town of roughly 4,400 souls in the Russian republic of Khakassia:
<img loading="lazy" class="aligncenter wp-image-58052" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza.png" alt="" width="759" height="608" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza.png 886w, https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-768x616.png 768w" sizes="(max-width: 759px) 100vw, 759px" />
<h2>MIKHAIL&#8217;S MIX</h2>
Also around 2009, someone using the nickname Wazawaka and the 902228 ICQ address started posting to Russian social media networks trying to convince locals to frequent the website &#8220;fureha.ru,&#8221; which was billed as another website catering to residents of Khakassia.
According to the Russian domain watcher 1stat.ru, fureha.ru was registered in January 2009 to the email address mix@devilart.net and the phone number +79617467845, which is the same number tied to the Mikhail &#8220;Mix&#8221; Matveev Vkontakte account.
DomainTools.com says the mix@devilart.net address was used to register two domains: one called badamania[.]ru, and a defunct porn site called tvporka[.]ru. The phone number tied to that porn site registration back in 2010 was 79235810401, also issued by MegaFon in Khakassia.
A search in Skype for that number shows that it was associated more than a decade ago with the username &#8220;matveevatanya1.&#8221; It was registered to a now 29-year-old Tatayana Matveeva Deryabina, whose Vkontakte profile says she currently resides in <a href="https://www.google.com/maps/place/Krasnoyarsk,+Krasnoyarsk+Krai,+Russia/@56.0266497,92.7253094,11z/data=!3m1!4b1!4m13!1m7!3m6!1s0x5ce34ef434f40753:0x28d30847f549720e!2sBratsk,+Irkutsk+Oblast,+Russia!3b1!8m2!3d56.2928363!4d101.7121217!3m4!1s0x5cd7afc9a1ff37e3:0xd597e1468fd647ff!8m2!3d56.0152725!4d92.8935242" target="_blank" rel="noopener">Krasnoyarsk</a>, the largest city that is closest to Abakan and Abaza.
It seems likely that Tatayana is a relative of Mikhail Matveev, perhaps even his sister. Neither responded to requests for comment. In 2009, a Mikhail Matveev from Abaza, Khakassia registered the username Wazawaka on weblancer.net, a freelance job exchange for Russian IT professionals. The Weblancer account says Wazawaka is currently 33 years old.
<img loading="lazy" class="aligncenter wp-image-58053" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail.png" alt="" width="756" height="346" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail.png 1044w, https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail-768x352.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/waza-mikhail-782x358.png 782w" sizes="(max-width: 756px) 100vw, 756px" />
In March 2019, Wazawaka explained a lengthy absence on Exploit by saying he&#8217;d fathered a child. &#8220;I will answer everyone in a week or two,&#8221; the crime actor wrote. &#8220;Became a dad &#8212; went on vacation for a couple of weeks.&#8221;
One of the many email addresses Wazawaka used was devdelphi@yandex.ru, which is tied to a more recent but since-deleted Vkontakte account for a Mikhail Matveev and used the password 2k3X8X57. As per usual, I put together a mind map showing the connections referenced in this story:
<div id="attachment_58059" style="width: 773px" class="wp-caption aligncenter"><a href="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58059" loading="lazy" class="wp-image-58059" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm.png" alt="" width="763" height="444" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm.png 1495w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm-768x447.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka-mm-782x455.png 782w" sizes="(max-width: 763px) 100vw, 763px" /></a>A rough mind map of the connections mentioned in this story.</div>
Analysts with cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> say Wazawaka&#8217;s postings on various Russian crime forums show he is proficient in many specializations, including botnet operations, keylogger malware, spam botnets, credential harvesting, Google Analytics manipulation, selling databases for spam operations, and launching DDoS attacks.
Flashpoint says it is likely Wazawaka/Mix/M1x has shared cybercriminal identities and accounts with multiple other forum members, most of whom appear to have been partners in his DDoS-for-hire business a decade ago. For example, Flashpoint points to an Antichat forum thread from 2009 where members said M1x worked on his DDoS service with a hacker by the nickname &#8220;Vedd,&#8221; who was reputedly also a resident of Abakan.
<h2>STAY  TRUE, &amp; MOTHER RUSSIA WILL HELP YOU</h2>
All of this is academic, of course, provided Mr. Wazawaka chooses to a) never leave Russia and b) <a href="https://krebsonsecurity.com/2021/05/try-this-one-weird-trick-russian-hackers-hate/" target="_blank" rel="noopener">avoid cybercrime activities that target Russian citizens</a>. In a January 2021 thread on Exploit regarding <a href="https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware/" target="_blank" rel="noopener">the arrest of an affiliate for the NetWalker ransomware program</a> and its subsequent demise, Wazawaka seems already resigned those limitations.
&#8220;Don&#8217;t shit where you live, travel local, and don&#8217;t go abroad,&#8221; Wazawaka said of his own personal mantra.
Which might explain why Wazawaka is so lackadaisical about <a href="https://krebsonsecurity.com/2021/05/the-wages-of-password-re-use-your-money-or-your-life/" target="_blank" rel="noopener">hiding and protecting his cybercriminal identities</a>: Incredibly, Wazawaka&#8217;s alter ego on the forum XSS &#8212; Uhodiransomware &#8212; still uses the same password on the forum that he used for his Vkontakte account 10 years ago. Lucky for him, XSS also demands a one-time code from his mobile authentication app.
<div id="attachment_58093" style="width: 774px" class="wp-caption aligncenter"><a href="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58093" loading="lazy" class="wp-image-58093" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa.png" alt="" width="764" height="367" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa.png 1311w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa-768x369.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/wazawaka2fa-782x376.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></a>The second step of logging into Wazawaka&#8217;s account on XSS (Uhodiransomwar).</div>
Wazawaka said NetWalker&#8217;s closure was the result of its administrator (a.k.a. &#8220;Bugatti&#8221;) getting greedy, and then he proceeds to preach about the need to periodically re-brand one&#8217;s cybercriminal identity.
&#8220;I&#8217;ve had some business with Bugatti,&#8221; Wazawaka said. &#8220;The guy got too rich and began recruiting Americans as affiliate partners. What happened now is the result. That&#8217;s okay, though. I wish Bugatti to do some rebranding and start from the beginning <img src="https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /> As for the servers that were seized, they should&#8217;ve hosted their admin panels in Russia to avoid getting their servers seized by INTERPOL, the FBI, or whatever.&#8221;
&#8220;Mother Russia will help you,&#8221; Wazawaka concluded. &#8220;Love your country, and you will always get away with everything.&#8221;
If you liked this post, you may also enjoy <a href="https://krebsonsecurity.com/2021/12/who-is-the-network-access-broker-babam/" target="_blank" rel="noopener">Who Is the Network Access Broker &#8220;Babam&#8221;?</a>

In a great many ransomware attacks, the criminals who pillage the victim’s network are not the same crooks who gained the initial access to the victim organization. More commonly, the infected PC or stolen VPN credentials the gang used to break in were purchased from a cybercriminal middleman known as an initial access broker. This post examines some of the clues left behind by “Wazawaka,” the hacker handle chosen by a major access broker in the Russian-speaking cybercrime scene.

Wazawaka has been a highly active member of multiple cybercrime forums over the past decade, but his favorite is the Russian-language community Exploit. Wazawaka spent his early days on Exploit and other forums selling distributed denial-of-service (DDoS) attacks that could knock websites offline for about USD $80 a day. But in more recent years, Wazawaka has focused on peddling access to organizations and to databases stolen from hacked companies.
“Come, rob, and get dough!,” reads a thread started by Wazawaka on Exploit in March 2020, in which he sold access to a Chinese company with more than $10 billion in annual revenues. “Show them who is boss.”
According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.
Wazawaka also said he’d teamed up with DarkSide, the ransomware affiliate group responsible for the six-day outage at Colonial Pipeline last year that caused nationwide fuel shortages and price spikes. The U.S. Department of State has since offered a $5 million reward for information leading to the arrest and conviction of any DarkSide affiliates.
Wazawaka seems to have adopted the uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder — not privately sold to the highest bidder. In thread after thread on the crime forum XSS, Wazawaka’s alias “Uhodiransomwar” can be seen posting download links to databases from companies that have refused to negotiate after five days.
“The only and the main principle of ransomware is: the information that you steal should never be sold,” Uhodiransomwar wrote in August 2020. “The community needs to receive it absolutely free of charge if the ransom isn’t paid by the side that this information is stolen from.”
Wazawaka hasn’t always been so friendly to other cybercrooks. Over the past ten years, his contact information has been used to register numerous phishing domains intended to siphon credentials from people trying to transact on various dark web marketplaces. In 2018, Wazawaka registered a slew of domains spoofing the real domain for the Hydra dark web market. In 2014, Wazawaka confided to another crime forum member via private message that he made good money stealing accounts from drug dealers on these marketplaces.
“I used to steal their QIWI accounts with up to $500k in them,” Wazawaka recalled. “A dealer would never go to the cops and tell them he was selling stuff online and someone stole his money.”
WHO IS WAZAWAKA?
Wazawaka used multiple email addresses and nicknames on several Russian crime forums, but data collected by cybersecurity firm Constella Intelligence show that Wazawaka’s alter egos always used one of three fairly unique passwords: 2k3x8x57, 2k3X8X57, and 00virtual.
Those three passwords were used by one or all of Wazawaka’s email addresses on the crime forums over the years, including wazawaka@yandex.ru, mixseo@mail.ru, mixseo@yandex.ru, mixfb@yandex.ru.
That last email address was used almost a decade ago to register a Vkontakte (Russian version of Facebook) account under the name Mikhail “Mix” Matveev. The phone number tied to that Vkontakte account — 7617467845 — was assigned by the Russian telephony provider MegaFon to a resident in Khakassia, situated in the southwestern part of Eastern Siberia.
DomainTools.com [an advertiser on this site] reports mixfb@yandex.ru was used to register three domains between 2008 and 2010: ddosis.ru, best-stalker.com, and cs-arena.org. That last domain was originally registered in 2009 to a Mikhail P. Matveyev, in Abakan, Khakassia.
Mikhail Matveev is not the most unusual name in Russia, but other clues help narrow things down quite a bit. For example, early in his postings to Exploit, Wazawaka can be seen telling members that he can be contacted via the ICQ instant message account 902228.
An Internet search for Wazawaka’s ICQ number brings up a 2009 account for a Wazawaka on a now defunct discussion forum about Kopyovo-a, a town of roughly 4,400 souls in the Russian republic of Khakassia:

MIKHAIL’S MIX
Also around 2009, someone using the nickname Wazawaka and the 902228 ICQ address started posting to Russian social media networks trying to convince locals to frequent the website “fureha.ru,” which was billed as another website catering to residents of Khakassia.
According to the Russian domain watcher 1stat.ru, fureha.ru was registered in January 2009 to the email address mix@devilart.net and the phone number +79617467845, which is the same number tied to the Mikhail “Mix” Matveev Vkontakte account.
DomainTools.com says the mix@devilart.net address was used to register two domains: one called badamania[.]ru, and a defunct porn site called tvporka[.]ru. The phone number tied to that porn site registration back in 2010 was 79235810401, also issued by MegaFon in Khakassia.
A search in Skype for that number shows that it was associated more than a decade ago with the username “matveevatanya1.” It was registered to a now 29-year-old Tatayana Matveeva Deryabina, whose Vkontakte profile says she currently resides in Krasnoyarsk, the largest city that is closest to Abakan and Abaza.
It seems likely that Tatayana is a relative of Mikhail Matveev, perhaps even his sister. Neither responded to requests for comment. In 2009, a Mikhail Matveev from Abaza, Khakassia registered the username Wazawaka on weblancer.net, a freelance job exchange for Russian IT professionals. The Weblancer account says Wazawaka is currently 33 years old.

In March 2019, Wazawaka explained a lengthy absence on Exploit by saying he’d fathered a child. “I will answer everyone in a week or two,” the crime actor wrote. “Became a dad — went on vacation for a couple of weeks.”
One of the many email addresses Wazawaka used was devdelphi@yandex.ru, which is tied to a more recent but since-deleted Vkontakte account for a Mikhail Matveev and used the password 2k3X8X57. As per usual, I put together a mind map showing the connections referenced in this story:

A rough mind map of the connections mentioned in this story.

Analysts with cyber intelligence firm Flashpoint say Wazawaka’s postings on various Russian crime forums show he is proficient in many specializations, including botnet operations, keylogger malware, spam botnets, credential harvesting, Google Analytics manipulation, selling databases for spam operations, and launching DDoS attacks.
Flashpoint says it is likely Wazawaka/Mix/M1x has shared cybercriminal identities and accounts with multiple other forum members, most of whom appear to have been partners in his DDoS-for-hire business a decade ago. For example, Flashpoint points to an Antichat forum thread from 2009 where members said M1x worked on his DDoS service with a hacker by the nickname “Vedd,” who was reputedly also a resident of Abakan.
STAY  TRUE, & MOTHER RUSSIA WILL HELP YOU
All of this is academic, of course, provided Mr. Wazawaka chooses to a) never leave Russia and b) avoid cybercrime activities that target Russian citizens. In a January 2021 thread on Exploit regarding the arrest of an affiliate for the NetWalker ransomware program and its subsequent demise, Wazawaka seems already resigned those limitations.
“Don’t shit where you live, travel local, and don’t go abroad,” Wazawaka said of his own personal mantra.
Which might explain why Wazawaka is so lackadaisical about hiding and protecting his cybercriminal identities: Incredibly, Wazawaka’s alter ego on the forum XSS — Uhodiransomware — still uses the same password on the forum that he used for his Vkontakte account 10 years ago. Lucky for him, XSS also demands a one-time code from his mobile authentication app.

The second step of logging into Wazawaka’s account on XSS (Uhodiransomwar).

Wazawaka said NetWalker’s closure was the result of its administrator (a.k.a. “Bugatti”) getting greedy, and then he proceeds to preach about the need to periodically re-brand one’s cybercriminal identity.
“I’ve had some business with Bugatti,” Wazawaka said. “The guy got too rich and began recruiting Americans as affiliate partners. What happened now is the result. That’s okay, though. I wish Bugatti to do some rebranding and start from the beginning  As for the servers that were seized, they should’ve hosted their admin panels in Russia to avoid getting their servers seized by INTERPOL, the FBI, or whatever.”
“Mother Russia will help you,” Wazawaka concluded. “Love your country, and you will always get away with everything.”
If you liked this post, you may also enjoy Who Is the Network Access Broker “Babam”?

Who is the Network Access Broker ‘Wazawaka?’

Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is "wormable," meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.

Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is &#8220;wormable,&#8221; meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.
<img loading="lazy" class="aligncenter wp-image-52647" src="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="746" height="545" />
Nine of the vulnerabilities fixed in this month&#8217;s Patch Tuesday received Microsoft&#8217;s &#8220;critical&#8221; rating, meaning malware or miscreants can exploit them to gain remote access to vulnerable Windows systems through no help from the user.
By all accounts, the most severe flaw addressed today is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907" target="_blank" rel="noopener">CVE-2022-21907,</a> a critical, remote code execution flaw in the &#8220;HTTP Protocol Stack.&#8221; Microsoft says the flaw affects Windows 10 and Windows 11, as well as Server 2019 and Server 2022.
&#8220;While this is definitely more server-centric, remember that Windows clients can also run http.sys, so all affected versions are affected by this bug,&#8221; said Dustin Childs from Trend Micro&#8217;s Zero Day Initiative. &#8220;Test and deploy this patch quickly.&#8221;
Quickly indeed. In May 2021, Microsoft patched a similarly critical and wormable vulnerability in the HTTP Protocol Stack; less than a week later, computer code made to exploit the flaw <a href="https://www.bleepingcomputer.com/news/security/exploit-released-for-wormable-windows-http-vulnerability/" target="_blank" rel="noopener">was posted online</a>.
Microsoft also fixed three more remote code execution flaws in Exchange Server, a technology that hundreds of thousands of organizations worldwide use to manage their email. Exchange flaws are a major target of malicious hackers. Almost a year ago, hundreds of thousands of Exchange servers worldwide were compromised by malware after attackers started mass-exploiting four zero-day flaws in Exchange.
Microsoft says the limiting factor with these three newly found Exchange flaws is that an attacker would need to be tied to the target&#8217;s network somehow to exploit them. But Satnam Narang at Tenable notes Microsoft has labeled all three Exchange flaws as &#8220;exploitation more likely.&#8221;
&#8220;One of the flaws, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21846" target="_blank" rel="noopener">CVE-2022-21846</a>, was disclosed to Microsoft by the National Security Agency,&#8221; Narang said. &#8220;Despite the rating, Microsoft notes the attack vector is adjacent, meaning exploitation will require more legwork for an attacker, unlike the ProxyLogon and ProxyShell vulnerabilities which were remotely exploitable.&#8221;
Security firm Rapid7 points out that roughly a quarter of the security updates this month address vulnerabilities in Microsoft&#8217;s Edge browser via Chromium.
&#8220;None of these have yet been seen exploited in the wild, though six were publicly disclosed prior to today,&#8221; Rapid7&#8217;s Greg Wiseman said. &#8220;This includes two Remote Code Execution vulnerabilities affecting open source libraries that are bundled with more recent versions of Windows: <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-22947" target="_blank" rel="noopener">CVE-2021-22947</a>, which affects the curl library, and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36976" target="_blank" rel="noopener">CVE-2021-36976</a> which affects libarchive.&#8221;
Wiseman said slightly less scary than the HTTP Protocol Stack vulnerability is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21840" target="_blank" rel="noopener">CVE-2022-21840</a>, which affects all supported versions of Office, as well as Sharepoint Server.
&#8220;Exploitation would require social engineering to entice a victim to open an attachment or visit a malicious website,&#8221; he said. &#8220;Thankfully the Windows preview pane is not a vector for this attack.&#8221;
Other patches include fixes for .NET Framework, Microsoft Dynamics, Windows Hyper-V, Windows Defender, and the Windows Remote Desktop Protocol (RDP). As usual, the SANS Internet Storm Center has a <a href="https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+January+2022/28230/" target="_blank" rel="noopener">per-patch breakdown by severity and impact</a>.
Standard disclaimer: Before you update Windows, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.
So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.
And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.
If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.
Update, Jan. 12, 9:02 a.m.: Apparently some of the updates Microsoft released yesterday &#8212; KB5009557 (2019) and KB5009555 (2022) &#8212; are causing something to fail on domain controllers, which then keep rebooting every few minutes. That&#8217;s according to <a href="https://old.reddit.com/r/sysadmin/comments/s21ae1/january_updates_causing_unexpected_reboots_on/" target="_blank" rel="noopener">this growing thread on Reddit</a> (hat tip to <a href="https://twitter.com/campuscodi/status/1481231994080178180" target="_blank" rel="noopener">@campuscodi</a>).

Microsoft today released updates to plug nearly 120 security holes in Windows and supported software. Six of the vulnerabilities were publicly detailed already, potentially giving attackers a head start in figuring out how to exploit them in unpatched systems. More concerning, Microsoft warns that one of the flaws fixed this month is “wormable,” meaning no human interaction would be required for an attack to spread from one vulnerable Windows box to another.

Nine of the vulnerabilities fixed in this month’s Patch Tuesday received Microsoft’s “critical” rating, meaning malware or miscreants can exploit them to gain remote access to vulnerable Windows systems through no help from the user.
By all accounts, the most severe flaw addressed today is CVE-2022-21907, a critical, remote code execution flaw in the “HTTP Protocol Stack.” Microsoft says the flaw affects Windows 10 and Windows 11, as well as Server 2019 and Server 2022.
“While this is definitely more server-centric, remember that Windows clients can also run http.sys, so all affected versions are affected by this bug,” said Dustin Childs from Trend Micro’s Zero Day Initiative. “Test and deploy this patch quickly.”
Quickly indeed. In May 2021, Microsoft patched a similarly critical and wormable vulnerability in the HTTP Protocol Stack; less than a week later, computer code made to exploit the flaw was posted online.
Microsoft also fixed three more remote code execution flaws in Exchange Server, a technology that hundreds of thousands of organizations worldwide use to manage their email. Exchange flaws are a major target of malicious hackers. Almost a year ago, hundreds of thousands of Exchange servers worldwide were compromised by malware after attackers started mass-exploiting four zero-day flaws in Exchange.
Microsoft says the limiting factor with these three newly found Exchange flaws is that an attacker would need to be tied to the target’s network somehow to exploit them. But Satnam Narang at Tenable notes Microsoft has labeled all three Exchange flaws as “exploitation more likely.”
“One of the flaws, CVE-2022-21846, was disclosed to Microsoft by the National Security Agency,” Narang said. “Despite the rating, Microsoft notes the attack vector is adjacent, meaning exploitation will require more legwork for an attacker, unlike the ProxyLogon and ProxyShell vulnerabilities which were remotely exploitable.”
Security firm Rapid7 points out that roughly a quarter of the security updates this month address vulnerabilities in Microsoft’s Edge browser via Chromium.
“None of these have yet been seen exploited in the wild, though six were publicly disclosed prior to today,” Rapid7’s Greg Wiseman said. “This includes two Remote Code Execution vulnerabilities affecting open source libraries that are bundled with more recent versions of Windows: CVE-2021-22947, which affects the curl library, and CVE-2021-36976 which affects libarchive.”
Wiseman said slightly less scary than the HTTP Protocol Stack vulnerability is CVE-2022-21840, which affects all supported versions of Office, as well as Sharepoint Server.
“Exploitation would require social engineering to entice a victim to open an attachment or visit a malicious website,” he said. “Thankfully the Windows preview pane is not a vector for this attack.”
Other patches include fixes for .NET Framework, Microsoft Dynamics, Windows Hyper-V, Windows Defender, and the Windows Remote Desktop Protocol (RDP). As usual, the SANS Internet Storm Center has a per-patch breakdown by severity and impact.
Standard disclaimer: Before you update Windows, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.
So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.
And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide.
If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.
Update, Jan. 12, 9:02 a.m.: Apparently some of the updates Microsoft released yesterday — KB5009557 (2019) and KB5009555 (2022) — are causing something to fail on domain controllers, which then keep rebooting every few minutes. That’s according to this growing thread on Reddit (hat tip to @campuscodi).

‘Wormable’ Flaw Leads January 2022 Patch Tuesday

Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency. But Norton 360 isn't alone in this dubious endeavor: Avira antivirus -- which has built a base of 500 million users worldwide largely by making the product free -- was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto.

Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers <a href="https://krebsonsecurity.com/2022/01/norton-360-now-comes-with-a-cryptominer/" target="_blank" rel="noopener">make money mining virtual currency</a>. But Norton 360 isn&#8217;t alone in this dubious endeavor: Avira antivirus &#8212; which has built a base of 500 million users worldwide largely by making the product free &#8212; was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto.
<div id="attachment_58028" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58028" loading="lazy" class=" wp-image-58028" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto.png" alt="" width="752" height="507" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto.png 1110w, https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto-768x518.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/aviracrypto-782x527.png 782w" sizes="(max-width: 752px) 100vw, 752px" />Avira Crypto</div>
Founded in 2006, <a href="https://en.wikipedia.org/wiki/Avira" target="_blank" rel="noopener">Avira Operations GmbH &amp; Co. KG</a> is a German multinational software company best known for their Avira Free Security (a.k.a. Avira Free Antivirus). In January 2021, Avira was acquired by Tempe, Ariz.-based NortonLifeLock Inc., the same company that now owns Norton 360.
In 2017, the identity theft protection company LifeLock was acquired by Symantec Corp., which was renamed to NortonLifeLock in 2019. LifeLock is now included in the Norton 360 service; Avira offers users a similar service called Breach Monitor.
Like Norton 360, Avira comes with a cryptominer already installed, but customers have to opt in to using the service that powers it. Avira&#8217;s <a href="https://support.avira.com/hc/en-us/articles/4407469485585-What-is-Avira-Crypto-" target="_blank" rel="noopener">FAQ on its cryptomining service</a> is somewhat sparse. For example, it doesn&#8217;t specify how much NortonLifeLock gets out of the deal (NortonLifeLock keeps 15 percent of any cryptocurrency mined by Norton Crypto).
&#8220;Avira Crypto allows you to use your computer&#8217;s idle time to mine the cryptocurrency Ethereum (ETH),&#8221; the FAQ explains. &#8220;Since cryptomining requires a high level of processing power, it is not suitable for users with an average computer. Even with compatible hardware, mining cryptocurrencies on your own can be less rewarding. Your best option is to join a mining pool that shares their computer power to improve their chance of mining cryptocurrency. The rewards are then distributed evenly to all members in the pool.&#8221;
NortonLifeLock hasn&#8217;t yet responded to requests for comment, so it&#8217;s unclear whether Avira uses the same cryptomining code as Norton Crypto. But there are clues that suggest that&#8217;s the case. NortonLifeLock <a href="https://www.avira.com/en/blog/avira-unveils-extended-features-with-avira-crypto-game-booster-and-breach-monitor" target="_blank" rel="noopener">announced Avira Crypto in late October 2021</a>, but multiple other antivirus products have flagged Avira&#8217;s installer as malicious or unsafe for including a cryptominer as far back as Sept. 9, 2021.
<div id="attachment_58036" style="width: 764px" class="wp-caption aligncenter"><a href="https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58036" loading="lazy" class="wp-image-58036" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt.png" alt="" width="754" height="378" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt.png 1385w, https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt-768x385.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/avira-vt-782x392.png 782w" sizes="(max-width: 754px) 100vw, 754px" /></a>Avira was detected as potentially unsafe for including a cryptominer back in Sept. 2021. Image: Virustotal.com.</div>
The above screenshot was taken on <a href="https://www.virustotal.com" target="_blank" rel="noopener">Virustotal.com</a>, a service owned by Google that scans submitted files against dozens of antivirus products. The detection report pictured was found by searching Virustotal for &#8220;ANvOptimusEnablementCuda,&#8221; a function included in the Norton Crypto mining component &#8220;Ncrypt.exe.&#8221;
Some longtime Norton customers took to NortonLifeLock&#8217;s online forum to express horror at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.
&#8220;Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,” reads a Dec. 28 thread on Norton&#8217;s forum titled &#8220;Absolutely furious.&#8221;
Others have charged that the crypto offering will end up costing customers more in electricity bills than they can ever hope to gain from letting their antivirus mine ETH. What&#8217;s more, there are hefty fees involved in moving any ETH mined by Norton or Avira Crypto to an account that the user can cash out, and many users apparently don&#8217;t understand they can&#8217;t cash out until they at least earn enough ETH to cover the fees.
In August 2021, NortonLifeLock <a href="https://investor.nortonlifelock.com/About/Investors/press-releases/press-release-details/2021/NortonLifeLock-and-Avast-to-Merge-to-Lead-the-Transformation-of-Consumer-Cyber-Safety/default.aspx" target="_blank" rel="noopener">said it had reached an agreement</a> to acquire Avast, another longtime free antivirus product that also claims to have around 500 million users. It remains to be seen whether Avast Crypto will be the next brilliant offering from NortonLifeLock.
As mentioned in this week&#8217;s story on Norton Crypto, I get that participation in these cryptomining schemes is voluntary, but much of that ultimately hinges on how these crypto programs are pitched and whether users really understand what they&#8217;re doing when they enable them. But what bugs me most is they will be introducing hundreds of millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of <a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">unique security and privacy challenges</a> that require users to “level up” their personal security practices in fairly significant ways.

Many readers were surprised to learn recently that the popular Norton 360 antivirus suite now ships with a program which lets customers make money mining virtual currency. But Norton 360 isn’t alone in this dubious endeavor: Avira antivirus — which has built a base of 500 million users worldwide largely by making the product free — was recently bought by the same company that owns Norton 360 and is introducing its customers to a service called Avira Crypto.

Avira Crypto

Founded in 2006, Avira Operations GmbH & Co. KG is a German multinational software company best known for their Avira Free Security (a.k.a. Avira Free Antivirus). In January 2021, Avira was acquired by Tempe, Ariz.-based NortonLifeLock Inc., the same company that now owns Norton 360.
In 2017, the identity theft protection company LifeLock was acquired by Symantec Corp., which was renamed to NortonLifeLock in 2019. LifeLock is now included in the Norton 360 service; Avira offers users a similar service called Breach Monitor.
Like Norton 360, Avira comes with a cryptominer already installed, but customers have to opt in to using the service that powers it. Avira’s FAQ on its cryptomining service is somewhat sparse. For example, it doesn’t specify how much NortonLifeLock gets out of the deal (NortonLifeLock keeps 15 percent of any cryptocurrency mined by Norton Crypto).
“Avira Crypto allows you to use your computer’s idle time to mine the cryptocurrency Ethereum (ETH),” the FAQ explains. “Since cryptomining requires a high level of processing power, it is not suitable for users with an average computer. Even with compatible hardware, mining cryptocurrencies on your own can be less rewarding. Your best option is to join a mining pool that shares their computer power to improve their chance of mining cryptocurrency. The rewards are then distributed evenly to all members in the pool.”
NortonLifeLock hasn’t yet responded to requests for comment, so it’s unclear whether Avira uses the same cryptomining code as Norton Crypto. But there are clues that suggest that’s the case. NortonLifeLock announced Avira Crypto in late October 2021, but multiple other antivirus products have flagged Avira’s installer as malicious or unsafe for including a cryptominer as far back as Sept. 9, 2021.

Avira was detected as potentially unsafe for including a cryptominer back in Sept. 2021. Image: Virustotal.com.

The above screenshot was taken on Virustotal.com, a service owned by Google that scans submitted files against dozens of antivirus products. The detection report pictured was found by searching Virustotal for “ANvOptimusEnablementCuda,” a function included in the Norton Crypto mining component “Ncrypt.exe.”
Some longtime Norton customers took to NortonLifeLock’s online forum to express horror at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.
“Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,” reads a Dec. 28 thread on Norton’s forum titled “Absolutely furious.”
Others have charged that the crypto offering will end up costing customers more in electricity bills than they can ever hope to gain from letting their antivirus mine ETH. What’s more, there are hefty fees involved in moving any ETH mined by Norton or Avira Crypto to an account that the user can cash out, and many users apparently don’t understand they can’t cash out until they at least earn enough ETH to cover the fees.
In August 2021, NortonLifeLock said it had reached an agreement to acquire Avast, another longtime free antivirus product that also claims to have around 500 million users. It remains to be seen whether Avast Crypto will be the next brilliant offering from NortonLifeLock.
As mentioned in this week’s story on Norton Crypto, I get that participation in these cryptomining schemes is voluntary, but much of that ultimately hinges on how these crypto programs are pitched and whether users really understand what they’re doing when they enable them. But what bugs me most is they will be introducing hundreds of millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of unique security and privacy challenges that require users to “level up” their personal security practices in fairly significant ways.

500M Avira Antivirus Users Introduced to Cryptomining

Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers' computers. Norton's parent firm says the cloud-based service that activates the program and enables customers to profit from the scheme -- in which the company keeps 15 percent of any currencies mined -- is "opt-in," meaning users have to agree to enable it. But many Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, "Dude, where's my crypto?"

Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers&#8217; computers. Norton&#8217;s parent firm says the cloud-based service that activates the program and allows customers to profit from the scheme &#8212; in which the company keeps 15 percent of any currencies mined &#8212; is &#8220;opt-in,&#8221; meaning users have to agree to enable it. But many Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, &#8220;Dude, where&#8217;s my crypto?&#8221;
<img loading="lazy" class="aligncenter wp-image-57997" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto.png" alt="" width="761" height="488" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto.png 1048w, https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto-768x493.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/nortoncrypto-782x502.png 782w" sizes="(max-width: 761px) 100vw, 761px" />
Norton 360 is owned by Tempe, Ariz.-based NortonLifeLock Inc. In 2017, the identity theft protection company LifeLock was acquired by Symantec Corp., which was renamed to NortonLifeLock in 2019 (LifeLock is now included in the Norton 360 service).
According to <a href="https://community.norton.com/en/forums/faq-norton-crypto" target="_blank" rel="noopener">the FAQ posted on its site</a>, &#8220;Norton Crypto&#8221; will mine <a href="https://en.wikipedia.org/wiki/Ethereum" target="_blank" rel="noopener">Ethereum</a> (ETH) cryptocurrency while the customer&#8217;s computer is idle. The FAQ also says Norton Crypto will only run on systems that meet certain hardware and software requirements (such as an NVIDIA graphics card with at least 6 GB of memory).
&#8220;Norton creates a secure digital Ethereum wallet for each user,&#8221; the FAQ reads. &#8220;The key to the wallet is encrypted and stored securely in the cloud. Only you have access to the wallet.&#8221;
NortonLifeLock began offering the mining service in July 2021, and <a href="https://www.bleepingcomputer.com/news/cryptocurrency/norton-360-antivirus-now-lets-you-mine-ethereum-cryptocurrency/" target="_blank" rel="noopener">early news coverage of the program</a> did not immediately receive widespread attention. That changed on Jan. 4, when <a href="https://boingboing.net/" target="_blank" rel="noopener">Boing Boing</a> co-editor Cory Doctorow <a href="https://twitter.com/doctorow/status/1478479483585933312">tweeted</a> that NortonCrypto would run by default for Norton 360 users.
<img loading="lazy" class="aligncenter size-full wp-image-57995" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/cdtweet.png" alt="" width="588" height="402" />
NortonLifeLock says Norton Crypto is an opt-in feature only and is not enabled without user permission.
&#8220;If users have turned on Norton Crypto but no longer wish to use the feature, it can be disabled by temporarily shutting off &#8216;tamper protection&#8217; (which allows users to modify the Norton installation) and deleting NCrypt.exe from your computer,&#8221; NortonLifeLock said in a written statement. However, many users <a href="https://www.digitaltrends.com/computing/no-easy-way-to-uninstall-norton-crypto/" target="_blank" rel="noopener">have reported difficulty removing the mining program</a>.
From reading user posts on the Norton Crypto community forum, it seems some longtime Norton customers were horrified at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.
&#8220;How on Earth could anyone at Norton think that adding crypto mining within a security product would be a good thing?,&#8221; reads <a href="https://community.norton.com/en/comment/8518793#comment-8518793" target="_blank" rel="noopener">a Dec. 28 thread</a> titled &#8220;Absolutely furious.&#8221;
&#8220;Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,&#8221; the post reads. &#8220;The product people need firing. What&#8217;s the next &#8216;bright idea&#8217;? Norton Botnet? &#8216; And I was just about to re-install Norton 360 too, but this has literally has caused me to no longer trust Norton and their direction.&#8221;
It&#8217;s an open question whether Norton Crypto users can expect to see much profit from participating in this scheme, at least in the short run. Mining cryptocurrencies basically involves using your computer&#8217;s spare resources to help validate financial transactions of other crypto users. Crypto mining causes one&#8217;s computer to draw more power, which can increase one&#8217;s overall electricity costs.
&#8220;Norton is pretty much amplifying energy consumption worldwide, costing their customers more in electricity use than the customer makes on the mining, yet allowing Norton to make a ton of profit,&#8221; <a href="https://twitter.com/VickerySec/status/1478937736325197824" target="_blank" rel="noopener">tweeted</a> security researcher Chris Vickery. &#8220;It&#8217;s disgusting, gross, and brand-suicide.&#8221;
Then there&#8217;s the matter of getting paid. Norton Crypto lets users withdraw their earnings to an account at cryptocurrency platform CoinBase, but as Norton Crypto&#8217;s FAQ rightly points out, there are coin mining fees as well as transaction costs to transfer Ethereum.
&#8220;The coin mining fee is currently 15% of the crypto allocated to the miner,&#8221; the FAQ explains. &#8220;Transfers of cryptocurrencies may result in transaction fees (also known as &#8220;gas&#8221; fees) paid to the users of the cryptocurrency blockchain network who process the transaction. In addition, if you choose to exchange crypto for another currency, you may be required to pay fees to an exchange facilitating the transaction. Transaction fees fluctuate due to cryptocurrency market conditions and other factors. These fees are not set by Norton.&#8221;
Which might explain why so many Norton Crypto users have taken to the community&#8217;s online forum to complain they were having trouble withdrawing their earnings. Those gas fees are the same regardless of the amount of crypto being moved, so the system simply blocks withdrawals if the amount requested can&#8217;t cover the transfer fees.
<div id="attachment_58016" style="width: 770px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58016" loading="lazy" class=" wp-image-58016" src="https://krebsonsecurity.com/wp-content/uploads/2022/01/bc-nc.png" alt="" width="760" height="552" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/bc-nc.png 815w, https://krebsonsecurity.com/wp-content/uploads/2022/01/bc-nc-768x559.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/bc-nc-782x569.png 782w" sizes="(max-width: 760px) 100vw, 760px" />Norton Crypto. Image: Bleeping Computer.</div>
I guess what bothers me most about Norton Crypto is that it will be introducing millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of unique security and privacy challenges that require users to &#8220;level up&#8221; their personal security practices in fairly significant ways.
Several of my elder family members and closest friends are longtime Norton users who renew their subscription year after year (despite my reminding them that it&#8217;s way cheaper just to purchase it again each year as a new user). None of them are particularly interested in or experts at securing their computers and digital lives, and the thought of them opening CoinBase accounts and navigating that space is terrifying.
Big Yellow is not the only brand that&#8217;s cashing in on investor fervor over cryptocurrencies and hoping to appeal to a broader (or maybe just older) audience: The venerable electronics retailer RadioShack, which relaunched in 2020 as an online-focused brand, now says it plans to chart a future as a cryptocurrency exchange.
&#8220;RadioShack’s argument is basically that as a very old brand, it’s primed to sell old CEOs on cryptocurrency,&#8221; <a href="https://www.theverge.com/2021/12/22/22849943/radioshack-defi-cryptocurrency-radio-token-launch" target="_blank" rel="noopener">writes</a> Adi Robertson for The Verge.
&#8220;Too many [cryptocurrency companies] focused on speculation and not enough on making the ‘old-school’ customer feel comfortable,” the company’s website states, claiming that the average &#8220;decision-making&#8221; corporate CEO is 68 years old. &#8220;The older generation simply doesn’t trust the new-fangled ideas of the Bitcoin youth.&#8221;

Norton 360, one of the most popular antivirus products on the market today, has installed a cryptocurrency mining program on its customers’ computers. Norton’s parent firm says the cloud-based service that activates the program and allows customers to profit from the scheme — in which the company keeps 15 percent of any currencies mined — is “opt-in,” meaning users have to agree to enable it. But many Norton users complain the mining program is difficult to remove, and reactions from longtime customers have ranged from unease and disbelief to, “Dude, where’s my crypto?”

Norton 360 is owned by Tempe, Ariz.-based NortonLifeLock Inc. In 2017, the identity theft protection company LifeLock was acquired by Symantec Corp., which was renamed to NortonLifeLock in 2019 (LifeLock is now included in the Norton 360 service).
According to the FAQ posted on its site, “Norton Crypto” will mine Ethereum (ETH) cryptocurrency while the customer’s computer is idle. The FAQ also says Norton Crypto will only run on systems that meet certain hardware and software requirements (such as an NVIDIA graphics card with at least 6 GB of memory).
“Norton creates a secure digital Ethereum wallet for each user,” the FAQ reads. “The key to the wallet is encrypted and stored securely in the cloud. Only you have access to the wallet.”
NortonLifeLock began offering the mining service in July 2021, and early news coverage of the program did not immediately receive widespread attention. That changed on Jan. 4, when Boing Boing co-editor Cory Doctorow tweeted that NortonCrypto would run by default for Norton 360 users.

NortonLifeLock says Norton Crypto is an opt-in feature only and is not enabled without user permission.
“If users have turned on Norton Crypto but no longer wish to use the feature, it can be disabled by temporarily shutting off ‘tamper protection’ (which allows users to modify the Norton installation) and deleting NCrypt.exe from your computer,” NortonLifeLock said in a written statement. However, many users have reported difficulty removing the mining program.
From reading user posts on the Norton Crypto community forum, it seems some longtime Norton customers were horrified at the prospect of their antivirus product installing coin-mining software, regardless of whether the mining service was turned off by default.
“How on Earth could anyone at Norton think that adding crypto mining within a security product would be a good thing?,” reads a Dec. 28 thread titled “Absolutely furious.”
“Norton should be DETECTING and killing off crypto mining hijacking, not installing their own,” the post reads. “The product people need firing. What’s the next ‘bright idea’? Norton Botnet? ‘ And I was just about to re-install Norton 360 too, but this has literally has caused me to no longer trust Norton and their direction.”
It’s an open question whether Norton Crypto users can expect to see much profit from participating in this scheme, at least in the short run. Mining cryptocurrencies basically involves using your computer’s spare resources to help validate financial transactions of other crypto users. Crypto mining causes one’s computer to draw more power, which can increase one’s overall electricity costs.
“Norton is pretty much amplifying energy consumption worldwide, costing their customers more in electricity use than the customer makes on the mining, yet allowing Norton to make a ton of profit,” tweeted security researcher Chris Vickery. “It’s disgusting, gross, and brand-suicide.”
Then there’s the matter of getting paid. Norton Crypto lets users withdraw their earnings to an account at cryptocurrency platform CoinBase, but as Norton Crypto’s FAQ rightly points out, there are coin mining fees as well as transaction costs to transfer Ethereum.
“The coin mining fee is currently 15% of the crypto allocated to the miner,” the FAQ explains. “Transfers of cryptocurrencies may result in transaction fees (also known as “gas” fees) paid to the users of the cryptocurrency blockchain network who process the transaction. In addition, if you choose to exchange crypto for another currency, you may be required to pay fees to an exchange facilitating the transaction. Transaction fees fluctuate due to cryptocurrency market conditions and other factors. These fees are not set by Norton.”
Which might explain why so many Norton Crypto users have taken to the community’s online forum to complain they were having trouble withdrawing their earnings. Those gas fees are the same regardless of the amount of crypto being moved, so the system simply blocks withdrawals if the amount requested can’t cover the transfer fees.

Norton Crypto. Image: Bleeping Computer.

I guess what bothers me most about Norton Crypto is that it will be introducing millions of perhaps less savvy Internet users to the world of cryptocurrency, which comes with its own set of unique security and privacy challenges that require users to “level up” their personal security practices in fairly significant ways.
Several of my elder family members and closest friends are longtime Norton users who renew their subscription year after year (despite my reminding them that it’s way cheaper just to purchase it again each year as a new user). None of them are particularly interested in or experts at securing their computers and digital lives, and the thought of them opening CoinBase accounts and navigating that space is terrifying.
Big Yellow is not the only brand that’s cashing in on investor fervor over cryptocurrencies and hoping to appeal to a broader (or maybe just older) audience: The venerable electronics retailer RadioShack, which relaunched in 2020 as an online-focused brand, now says it plans to chart a future as a cryptocurrency exchange.
“RadioShack’s argument is basically that as a very old brand, it’s primed to sell old CEOs on cryptocurrency,” writes Adi Robertson for The Verge.
“Too many [cryptocurrency companies] focused on speculation and not enough on making the ‘old-school’ customer feel comfortable,” the company’s website states, claiming that the average “decision-making” corporate CEO is 68 years old. “The older generation simply doesn’t trust the new-fangled ideas of the Bitcoin youth.”

Norton 360 Now Comes With a Cryptominer

KrebsOnSecurity.com celebrates its 12th anniversary today! Maybe "celebrate" is too indelicate a word for a year wracked by the global pandemics of COVID-19 and ransomware. Especially since stories about both have helped to grow the audience here tremendously in 2021. But this site's birthday also is a welcome opportunity to thank you all for your continued readership and support, which helps keep the content here free to everyone.

<img loading="lazy" class="aligncenter wp-image-57982" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/12street.png" alt="" width="760" height="441" /> 
KrebsOnSecurity.com celebrates its 12th anniversary today! Maybe &#8220;celebrate&#8221; is too indelicate a word for a year wracked by the global pandemics of COVID-19 and ransomware. Especially since stories about both have helped to grow the audience here tremendously in 2021. But this site&#8217;s birthday also is a welcome opportunity to thank you all for your continued readership and support, which helps keep the content here free to everyone.
More than seven million unique visitors came to KrebsOnSecurity.com in 2021, generating some 12 million+ pageviews and leaving almost 8,000 comments. We also now have nearly 50,000 subscribers to <a href="https://krebsonsecurity.com/subscribe/" target="_blank" rel="noopener">our email newsletter</a>, which is still just a text-based (non-HTML) email that goes out each time a new story is published here (~2-3 times a week).
Back when this site first began 12 years ago, I never imagined it would attract such a level of engagement. Before launching KrebsOnSecurity, I was a tech reporter for washingtonpost.com. For many years, The Post&#8217;s website was physically, financially and editorially separate from what the dot-com employees affectionately called &#8220;The Dead Tree Edition.&#8221; When the two newsrooms finally merged in 2009, my position was eliminated.
Happily, the blog I authored for four years at washingtonpost.com &#8212; Security Fix &#8212; had attracted a sizable readership, and it seemed clear that the worldwide appetite for in-depth news about computer security and cybercrime would become practically insatiable in the coming years.
Happier still, The Post offered a severance package equal to six months of my salary. Had they not thrown that lifeline, I doubt I&#8217;d have had the guts to go it alone. But at the time, my wife basically said I had six months to make this &#8220;blog thing&#8221; work, or else find a &#8220;real job.&#8221;
God bless her eternal patience with my adopted occupation, because KrebsOnSecurity has helped me avoid finding a real job for a dozen years now. And hopefully they let me keep doing this, because at this point I&#8217;m certainly unqualified to do much else.
I&#8217;d be remiss if I didn&#8217;t take this opportunity to remind Dear Readers that advertisers do help keep the content free here to everyone. For security and privacy reasons, KrebsOnSecurity does not host any third-party content on this site &#8212; and this includes the ad creatives, which are simply images or GIFs vetted by Yours Truly and served directly from krebsonsecurity.com.
That&#8217;s a long-winded way of asking: If you regularly visit KrebsOnSecurity.com with an ad blocker, please consider adding an exception for this site.
Thanks again, Dear Readers. Please stay safe, healthy and alert in 2022. See you on the other side!

More than seven million unique visitors came to KrebsOnSecurity.com in 2021, generating some 12 million+ pageviews and leaving almost 8,000 comments. We also now have nearly 50,000 subscribers to our email newsletter, which is still just a text-based (non-HTML) email that goes out each time a new story is published here (~2-3 times a week).
Back when this site first began 12 years ago, I never imagined it would attract such a level of engagement. Before launching KrebsOnSecurity, I was a tech reporter for washingtonpost.com. For many years, The Post’s website was physically, financially and editorially separate from what the dot-com employees affectionately called “The Dead Tree Edition.” When the two newsrooms finally merged in 2009, my position was eliminated.
Happily, the blog I authored for four years at washingtonpost.com — Security Fix — had attracted a sizable readership, and it seemed clear that the worldwide appetite for in-depth news about computer security and cybercrime would become practically insatiable in the coming years.
Happier still, The Post offered a severance package equal to six months of my salary. Had they not thrown that lifeline, I doubt I’d have had the guts to go it alone. But at the time, my wife basically said I had six months to make this “blog thing” work, or else find a “real job.”
God bless her eternal patience with my adopted occupation, because KrebsOnSecurity has helped me avoid finding a real job for a dozen years now. And hopefully they let me keep doing this, because at this point I’m certainly unqualified to do much else.
I’d be remiss if I didn’t take this opportunity to remind Dear Readers that advertisers do help keep the content free here to everyone. For security and privacy reasons, KrebsOnSecurity does not host any third-party content on this site — and this includes the ad creatives, which are simply images or GIFs vetted by Yours Truly and served directly from krebsonsecurity.com.
That’s a long-winded way of asking: If you regularly visit KrebsOnSecurity.com with an ad blocker, please consider adding an exception for this site.
Thanks again, Dear Readers. Please stay safe, healthy and alert in 2022. See you on the other side!

Happy 12th Birthday, KrebsOnSecurity.com!

A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent "SIM swaps," scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities.

A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent &#8220;SIM swaps,&#8221; scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities.
<img loading="lazy" class="aligncenter wp-image-40415" src="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="759" height="383" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 759px) 100vw, 759px" />
Truglia <a href="https://krebsonsecurity.com/wp-content/uploads/2021/12/trugliaadmission.png" target="_blank" rel="noopener">admitted</a> to a New York federal court that he let a friend use his account at crypto-trading platform Binance in 2018 to launder more than $20 million worth of virtual currency stolen from Michael Terpin, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.
Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court. In May 2019, the jury awarded Terpin a $75.8 million judgment against Truglia. In January 2020, a New York grand jury <a href="https://krebsonsecurity.com/wp-content/uploads/2021/12/trugliaIndictment.pdf" target="_blank" rel="noopener">criminally indicted Truglia</a> (PDF) for his part in the crypto theft from Terpin.
A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their mobile device has been damaged or lost, or when they are switching to a different phone that requires a SIM card of another size.
<div id="attachment_57927" style="width: 308px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57927" loading="lazy" class=" wp-image-57927" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/truglia.png" alt="" width="298" height="249" />Nicholas Truglia, holding bottle. Image: twitter.com/erupts</div>
But fraudulent SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone controlled by the scammers. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many financial institutions and online services rely on text messages to send users a one-time code for multi-factor authentication.
Compounding the threat, many websites let customers reset their passwords merely by clicking a link sent via SMS to the mobile phone number tied to the account, meaning anyone who controls that phone number can reset the passwords for those accounts.
Reached for comment, Terpin said his assailant got off easy.
&#8220;I am outraged that after nearly four years and hundreds of pages of evidence that the best the prosecutors could recommend was a plea bargain for a single, relatively minor count of the unauthorized use of a Binance exchange account, when all the evidence points toward Truglia being one of two masterminds of a wide-ranging criminal conspiracy to steal crypto from me and others,&#8221; Terpin told KrebsOnSecurity.
Terpin said public court records already show Truglia bragging about stealing his funds and using it to finance a lavish lifestyle.
&#8220;He at the very least withdrew 100 bitcoin (worth $1.6 million at the time and nearly $5 million today) from my theft into his wallet at a separate, US-based exchange, and then moved or spent it,&#8221; Terpin said. &#8220;The fact is that the intentional theft of $24 million, whether taken at the point of a gun in a bank or through a SIM card swap, is a major felony. Truglia should be prosecuted to the fullest extent of the law.&#8221;
<div id="attachment_57938" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57938" loading="lazy" class=" wp-image-57938" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/trugliaplane.png" alt="" width="745" height="686" />Nicholas Truglia, showing off a diamond-studded Piaget watch while aboard a private jet. Image: twitter.com/erupts.</div>
Terpin also is waging an ongoing civil lawsuit against 18-year-old Ellis Pinsky, who&#8217;s accused of working with Truglia as part of a SIM swapping crew that has stolen more than $100 million in cryptocurrency. According to Terpin, Pinsky was 15 when he took part in the $24 million 2018 SIM swap, but he returned $2 million worth of cryptocurrency after being confronted by Terpin&#8217;s investigators.
&#8220;On the surface, Pinsky is an &#8216;All American Boy,'&#8221; Terpin&#8217;s civil suit charges. &#8220;The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.&#8221;
&#8220;Despite their wholesome appearances, Pinsky and his other cohorts are in fact evil computer geniuses with sociopathic traits who heartlessly ruin their innocent victims’ lives and gleefully boast of their multi-million-dollar heists,&#8221; the lawsuit continues. &#8220;Pinsky is reputed to have used his ill-gotten gains to purchase multi-million-dollar watches and is known to go on nightclub sprees at high end clubs in New York City, and Truglia rented private jets and played the part of a dashing playboy with young women pampering him.&#8221;
Pinksy could not be immediately reached for comment. But a review of the latest filings in the lawsuit show that Pinsky&#8217;s attorneys stopped representing him because he no longer had the funds to pay for their services. The most recent entry in the New York Southern District&#8217;s docket asks the court to give Pinsky additional time to seek counsel, and hints that barring that he may end up representing himself.
<div id="attachment_57929" style="width: 756px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57929" loading="lazy" class=" wp-image-57929" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/pinsky.png" alt="" width="746" height="448" />Ellis Pinsky, in a photo uploaded to his social media profile.</div>
Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">REACT task force</a>, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities <a href="https://nypost.com/2018/11/20/man-hacked-into-silicon-valley-execs-phones-to-steal-cryptocurrency-cops/" target="_blank" rel="noopener">arrested Truglia</a> on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from Robert Ross, a San Francisco father of two who later went on to found the victim advocacy website <a href="https://www.stopsimcrime.org" target="_blank" rel="noopener">stopsimcrime.org</a>.
According to <a href="https://nypost.com/2018/11/20/man-hacked-into-silicon-valley-execs-phones-to-steal-cryptocurrency-cops/" target="_blank" rel="noopener">published reports</a>, Truglia and his accomplices also perpetrated SIM swaps against the CEO of the blockchain storage service 0Chain; hedge-funder Myles Danielson, vice president of Hall Capital Partners; and Gabrielle Katsnelson, the co-founder of the startup SMBX.
Truglia is currently slated to be sentenced in April 2022 for his guilty plea in New York. He faces a maximum sentence of up to 20 years in prison.
Erin West, deputy district attorney for Santa Clara County, told KrebsOnSecurity that SIM swapping remains a major problem. But she said many of the victims they&#8217;re now assisting are relatively new cryptocurrency investors for whom a SIM swapping attack can be financially devastating.
&#8220;Originally, the SIM swap targets were the early adopters of crypto,&#8221; West said. &#8220;Now we&#8217;re seeing a lot more of what I would call normal people trying their hand at crypto, and that makes a lot more people a target. It makes people who are unfamiliar with their personal security online vulnerable to hackers whose entire job is to figure out how to part people from their money.&#8221;
West said REACT continues to train state and local law enforcement officials across the country on how to successfully investigate and prosecute SIM swapping cases.
&#8220;The good news is our partners across the nation are learning how to conduct these cases,&#8221; she said. &#8220;Where this was a relatively new phenomenon three years ago, other smaller jurisdictions around the country are now learning how to prosecute this crime.&#8221;
All of the major wireless carriers let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">corrupt</a> <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">mobile store employees</a>.
For some tips on how to minimize your chances of becoming the next SIM swapping victim, check out the “What Can You Do?” section at <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">the conclusion of this story</a>.

A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. Nicholas Truglia was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent “SIM swaps,” scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities.

Truglia admitted to a New York federal court that he let a friend use his account at crypto-trading platform Binance in 2018 to launder more than $20 million worth of virtual currency stolen from Michael Terpin, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.
Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court. In May 2019, the jury awarded Terpin a $75.8 million judgment against Truglia. In January 2020, a New York grand jury criminally indicted Truglia (PDF) for his part in the crypto theft from Terpin.
A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their mobile device has been damaged or lost, or when they are switching to a different phone that requires a SIM card of another size.

Nicholas Truglia, holding bottle. Image: twitter.com/erupts

But fraudulent SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone controlled by the scammers. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many financial institutions and online services rely on text messages to send users a one-time code for multi-factor authentication.
Compounding the threat, many websites let customers reset their passwords merely by clicking a link sent via SMS to the mobile phone number tied to the account, meaning anyone who controls that phone number can reset the passwords for those accounts.
Reached for comment, Terpin said his assailant got off easy.
“I am outraged that after nearly four years and hundreds of pages of evidence that the best the prosecutors could recommend was a plea bargain for a single, relatively minor count of the unauthorized use of a Binance exchange account, when all the evidence points toward Truglia being one of two masterminds of a wide-ranging criminal conspiracy to steal crypto from me and others,” Terpin told KrebsOnSecurity.
Terpin said public court records already show Truglia bragging about stealing his funds and using it to finance a lavish lifestyle.
“He at the very least withdrew 100 bitcoin (worth $1.6 million at the time and nearly $5 million today) from my theft into his wallet at a separate, US-based exchange, and then moved or spent it,” Terpin said. “The fact is that the intentional theft of $24 million, whether taken at the point of a gun in a bank or through a SIM card swap, is a major felony. Truglia should be prosecuted to the fullest extent of the law.”

Nicholas Truglia, showing off a diamond-studded Piaget watch while aboard a private jet. Image: twitter.com/erupts.

Terpin also is waging an ongoing civil lawsuit against 18-year-old Ellis Pinsky, who’s accused of working with Truglia as part of a SIM swapping crew that has stolen more than $100 million in cryptocurrency. According to Terpin, Pinsky was 15 when he took part in the $24 million 2018 SIM swap, but he returned $2 million worth of cryptocurrency after being confronted by Terpin’s investigators.
“On the surface, Pinsky is an ‘All American Boy,'” Terpin’s civil suit charges. “The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.”
“Despite their wholesome appearances, Pinsky and his other cohorts are in fact evil computer geniuses with sociopathic traits who heartlessly ruin their innocent victims’ lives and gleefully boast of their multi-million-dollar heists,” the lawsuit continues. “Pinsky is reputed to have used his ill-gotten gains to purchase multi-million-dollar watches and is known to go on nightclub sprees at high end clubs in New York City, and Truglia rented private jets and played the part of a dashing playboy with young women pampering him.”
Pinksy could not be immediately reached for comment. But a review of the latest filings in the lawsuit show that Pinsky’s attorneys stopped representing him because he no longer had the funds to pay for their services. The most recent entry in the New York Southern District’s docket asks the court to give Pinsky additional time to seek counsel, and hints that barring that he may end up representing himself.

Ellis Pinsky, in a photo uploaded to his social media profile.

Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the REACT task force, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities arrested Truglia on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from Robert Ross, a San Francisco father of two who later went on to found the victim advocacy website stopsimcrime.org.
According to published reports, Truglia and his accomplices also perpetrated SIM swaps against the CEO of the blockchain storage service 0Chain; hedge-funder Myles Danielson, vice president of Hall Capital Partners; and Gabrielle Katsnelson, the co-founder of the startup SMBX.
Truglia is currently slated to be sentenced in April 2022 for his guilty plea in New York. He faces a maximum sentence of up to 20 years in prison.
Erin West, deputy district attorney for Santa Clara County, told KrebsOnSecurity that SIM swapping remains a major problem. But she said many of the victims they’re now assisting are relatively new cryptocurrency investors for whom a SIM swapping attack can be financially devastating.
“Originally, the SIM swap targets were the early adopters of crypto,” West said. “Now we’re seeing a lot more of what I would call normal people trying their hand at crypto, and that makes a lot more people a target. It makes people who are unfamiliar with their personal security online vulnerable to hackers whose entire job is to figure out how to part people from their money.”
West said REACT continues to train state and local law enforcement officials across the country on how to successfully investigate and prosecute SIM swapping cases.
“The good news is our partners across the nation are learning how to conduct these cases,” she said. “Where this was a relatively new phenomenon three years ago, other smaller jurisdictions around the country are now learning how to prosecute this crime.”
All of the major wireless carriers let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or corrupt mobile store employees.
For some tips on how to minimize your chances of becoming the next SIM swapping victim, check out the “What Can You Do?” section at the conclusion of this story.

NY Man Pleads Guilty in $20 Million SIM Swap Theft

Microsoft, Adobe, and Google all issued security updates to their products today. The Microsoft patches include six previously disclosed security flaws, and one that that is already being actively exploited. But this month's Patch Tuesday is being overshadowed by the "Log4Shell" 0-day exploit in a popular Java library that web server administrators are now racing to find and patch amid widespread exploitation of the flaw.

Microsoft, Adobe, and Google all issued security updates to their products today. The Microsoft patches include six previously disclosed security flaws, and one that is already being actively exploited. But this month&#8217;s Patch Tuesday is overshadowed by the &#8220;Log4Shell&#8221; 0-day exploit in a popular Java library that web server administrators are now racing to find and patch amid widespread exploitation of the flaw.
<img loading="lazy" class="aligncenter wp-image-56287" src="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="764" height="538" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 764px) 100vw, 764px" />
Log4Shell is the name picked for a critical flaw disclosed Dec. 9 in the popular logging library for Java called &#8220;log4j,&#8221; which is included in a huge number of Java applications. Publicly released exploit code allows an attacker to force a server running a vulnerable log4j library to execute commands, such as downloading malicious software or opening a backdoor connection to the server.
According to researchers at Lunasec, many, many services are vulnerable to this exploit.
&#8220;Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable,&#8221; Lunasec <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/" target="_blank" rel="noopener">wrote</a>. &#8220;Anybody using Apache Struts is likely vulnerable. We&#8217;ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach. An extensive list of responses from impacted organizations has been compiled <a href="https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592" target="_blank" rel="noopener">here</a>.&#8221;
&#8220;If you run a server built on open-source software, there’s a good chance you are impacted by this vulnerability,&#8221; said Dustin Childs of Trend Micro&#8217;s Zero Day Initiative. &#8220;Check with all the vendors in your enterprise to see if they are impacted and what patches are available.&#8221;
Part of the difficulty in patching against the Log4Shell attack is identifying all of the vulnerable web applications, said Johannes Ullrich, an incident handler and blogger for the SANS Internet Storm Center. &#8220;Log4Shell will continue to haunt us for years to come. Dealing with log4shell will be a marathon,&#8221; Ullrich said. &#8220;Treat it as such.&#8221; SANS has <a href="https://isc.sans.edu/forums/diary/RCE+in+log4j+Log4Shell+or+how+things+can+get+bad+quickly/28120/" target="_blank" rel="noopener">a good walk-through</a> of how simple yet powerful the exploit can be.
John Hultquist, vice president of intelligence analysis at Mandiant, said the company has seen Chinese and Iranian state actors leveraging the log4j vulnerability, and that the Iranian actors are particularly aggressive, having taken part in ransomware operations that may be primarily carried out for disruptive purposes rather than financial gain.
&#8220;We anticipate other state actors are doing so as well, or preparing to,&#8221; Hultquist said. &#8220;We believe these actors will work quickly to create footholds in desirable networks for follow-on activity, which may last for some time. In some cases, they will work from a wish list of targets that existed long before this vulnerability was public knowledge. In other cases, desirable targets may be selected after broad targeting.&#8221;
Researcher Kevin Beaumont had a more lighthearted take on Log4Shell <a href="https://twitter.com/GossiTheDog/status/1470787395805192199" target="_blank" rel="noopener">via Twitter</a>:
&#8220;Basically the perfect ending to cybersecurity in 2021 is a 90s style Java vulnerability in an open source module, written by two volunteers with no funding, used by large cybersecurity vendors, undetected until Minecraft chat got pwned, where nobody knows how to respond properly.&#8221;
The Cybersecurity and Infrastructure Security Agency (CISA) has joined with the FBI, National Security Agency (NSA) and partners abroad in publishing <a href="https://www.cisa.gov/uscert/ncas/alerts/aa21-356a" target="_blank" rel="noopener">an advisory</a> to help organizations mitigate Log4Shell and other Log4j-related vulnerabilities.

A half-dozen of the vulnerabilities addressed by Microsoft today earned its most dire &#8220;critical&#8221; rating, meaning malware or miscreants could exploit the flaws to gain complete, remote control over a vulnerable Windows system with little or no help from users.
The Windows flaw already seeing active exploitation is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43890" target="_blank" rel="noopener">CVE-2021-43890</a>, which is a &#8220;spoofing&#8221; bug in the Windows AppX installer on Windows 10. Microsoft says it is aware of attempts to exploit this flaw using specially crafted packages to implant malware families like <a href="https://krebsonsecurity.com/?s=Emotet" target="_blank" rel="noopener">Emotet</a>, <a href="https://krebsonsecurity.com/?s=trickbot" target="_blank" rel="noopener">Trickbot</a>, and <a href="https://www.proofpoint.com/us/blog/threat-insight/bazaflix-bazaloader-fakes-movie-streaming-service" target="_blank" rel="noopener">BazaLoader</a>.
Kevin Breen, director of threat research for Immersive Labs, said <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43905" target="_blank" rel="noopener">CVE-2021-43905</a> stands out of this month&#8217;s patch batch.
&#8220;Not only for its high <a href="https://www.techtarget.com/searchsecurity/definition/CVSS-Common-Vulnerability-Scoring-System" target="_blank" rel="noopener">CVSS score</a> of 9.6, but also because it’s noted as &#8216;exploitation more likely&#8217;,&#8221; Breen observed.
Microsoft also patched <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43883" target="_blank" rel="noopener">CVE-2021-43883</a>, an elevation of privilege vulnerability in Windows Installer.
&#8220;This appears to be a fix for a patch bypass of <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379" target="_blank" rel="noopener">CVE-2021-41379</a>, another elevation of privilege vulnerability in Windows Installer that was reportedly fixed in November,&#8221; Satnam Narang of Tenable points out. &#8220;However, researchers discovered that fix was incomplete, and a proof-of-concept was made public late last month.&#8221;
Google issued five security fixes for Chrome, including one rated critical and three others with high severity. If you’re browsing with Chrome, keep a lookout for when you see an “Update” tab appear to the right of the address bar. If it’s been a while since you closed the browser, you might see the Update button turn from green to orange and then red. Green means an update has been available for two days; orange means four days have elapsed, and red means your browser is a week or more behind on important updates. Completely close and restart the browser to install any pending updates.
Also, Adobe issued patches to correct more than 60 security flaws in <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">a slew of products,</a> including Adobe Audition, Lightroom, Media Encoder, Premiere Pro, Prelude, Dimension, After Effects, Photoshop, Connect, Experience Manager and Premiere Rush.
Standard disclaimer: Before you update Windows, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.
So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.
And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.
If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.
Additional reading:
<a href="https://isc.sans.edu/forums/diary/Microsoft+December+2021+Patch+Tuesday/28132/" target="_blank" rel="noopener">SANS ISC listing</a> of each Microsoft vulnerability patched today, indexed by severity and affected component.

Microsoft, Adobe, and Google all issued security updates to their products today. The Microsoft patches include six previously disclosed security flaws, and one that is already being actively exploited. But this month’s Patch Tuesday is overshadowed by the “Log4Shell” 0-day exploit in a popular Java library that web server administrators are now racing to find and patch amid widespread exploitation of the flaw.

Log4Shell is the name picked for a critical flaw disclosed Dec. 9 in the popular logging library for Java called “log4j,” which is included in a huge number of Java applications. Publicly released exploit code allows an attacker to force a server running a vulnerable log4j library to execute commands, such as downloading malicious software or opening a backdoor connection to the server.
According to researchers at Lunasec, many, many services are vulnerable to this exploit.
“Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable,” Lunasec wrote. “Anybody using Apache Struts is likely vulnerable. We’ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach. An extensive list of responses from impacted organizations has been compiled here.”
“If you run a server built on open-source software, there’s a good chance you are impacted by this vulnerability,” said Dustin Childs of Trend Micro’s Zero Day Initiative. “Check with all the vendors in your enterprise to see if they are impacted and what patches are available.”
Part of the difficulty in patching against the Log4Shell attack is identifying all of the vulnerable web applications, said Johannes Ullrich, an incident handler and blogger for the SANS Internet Storm Center. “Log4Shell will continue to haunt us for years to come. Dealing with log4shell will be a marathon,” Ullrich said. “Treat it as such.” SANS has a good walk-through of how simple yet powerful the exploit can be.
John Hultquist, vice president of intelligence analysis at Mandiant, said the company has seen Chinese and Iranian state actors leveraging the log4j vulnerability, and that the Iranian actors are particularly aggressive, having taken part in ransomware operations that may be primarily carried out for disruptive purposes rather than financial gain.
“We anticipate other state actors are doing so as well, or preparing to,” Hultquist said. “We believe these actors will work quickly to create footholds in desirable networks for follow-on activity, which may last for some time. In some cases, they will work from a wish list of targets that existed long before this vulnerability was public knowledge. In other cases, desirable targets may be selected after broad targeting.”
Researcher Kevin Beaumont had a more lighthearted take on Log4Shell via Twitter:
“Basically the perfect ending to cybersecurity in 2021 is a 90s style Java vulnerability in an open source module, written by two volunteers with no funding, used by large cybersecurity vendors, undetected until Minecraft chat got pwned, where nobody knows how to respond properly.”
The Cybersecurity and Infrastructure Security Agency (CISA) has joined with the FBI, National Security Agency (NSA) and partners abroad in publishing an advisory to help organizations mitigate Log4Shell and other Log4j-related vulnerabilities.

A half-dozen of the vulnerabilities addressed by Microsoft today earned its most dire “critical” rating, meaning malware or miscreants could exploit the flaws to gain complete, remote control over a vulnerable Windows system with little or no help from users.
The Windows flaw already seeing active exploitation is CVE-2021-43890, which is a “spoofing” bug in the Windows AppX installer on Windows 10. Microsoft says it is aware of attempts to exploit this flaw using specially crafted packages to implant malware families like Emotet, Trickbot, and BazaLoader.
Kevin Breen, director of threat research for Immersive Labs, said CVE-2021-43905 stands out of this month’s patch batch.
“Not only for its high CVSS score of 9.6, but also because it’s noted as ‘exploitation more likely’,” Breen observed.
Microsoft also patched CVE-2021-43883, an elevation of privilege vulnerability in Windows Installer.
“This appears to be a fix for a patch bypass of CVE-2021-41379, another elevation of privilege vulnerability in Windows Installer that was reportedly fixed in November,” Satnam Narang of Tenable points out. “However, researchers discovered that fix was incomplete, and a proof-of-concept was made public late last month.”
Google issued five security fixes for Chrome, including one rated critical and three others with high severity. If you’re browsing with Chrome, keep a lookout for when you see an “Update” tab appear to the right of the address bar. If it’s been a while since you closed the browser, you might see the Update button turn from green to orange and then red. Green means an update has been available for two days; orange means four days have elapsed, and red means your browser is a week or more behind on important updates. Completely close and restart the browser to install any pending updates.
Also, Adobe issued patches to correct more than 60 security flaws in a slew of products, including Adobe Audition, Lightroom, Media Encoder, Premiere Pro, Prelude, Dimension, After Effects, Photoshop, Connect, Experience Manager and Premiere Rush.
Standard disclaimer: Before you update Windows, please make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.
So do yourself a favor and backup before installing any patches. Windows 10 even has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.
And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see this guide.
If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.
Additional reading:
SANS ISC listing of each Microsoft vulnerability patched today, indexed by severity and affected component.

Microsoft Patch Tuesday, December 2021 Edition

The accounting firm PricewatersCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland's public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousand of outdated Windows 7 systems, and that the health system's IT administrators failed to respond to multiple warning signs that a massive attack was imminent.

The consulting firm PricewaterhouseCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland&#8217;s public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousands of outdated Windows 7 systems, and that the health system&#8217;s IT administrators failed to respond to multiple warning signs that a massive attack was imminent.
<div id="attachment_57865" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57865" loading="lazy" class=" wp-image-57865" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/hsetimeline.png" alt="" width="757" height="518" />PWC&#8217;s timeline of the days leading up to the deployment of Conti ransomware on May 14.</div>
Ireland&#8217;s Health Service Executive (HSE), which operates the country&#8217;s public health system, got hit with <a href="https://www.cisa.gov/uscert/ncas/alerts/aa21-265a" target="_blank" rel="noopener">Conti ransomware</a> on May 14, 2021. A timeline in the report (above) says the initial infection of the &#8220;patient zero&#8221; workstation happened on Mar. 18, 2021, when an employee on a Windows computer opened a booby-trapped Microsoft Excel document in a phishing email that had been sent two days earlier.
Less than a week later, the attacker had established a reliable backdoor connection to the employee&#8217;s infected workstation. After infecting the system, &#8220;the attacker continued to operate in the environment over an eight week period until the detonation of the Conti ransomware on May 14, 2021,&#8221; the report states.
According to <a href="https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf" target="_blank" rel="noopener">PWC&#8217;s report</a> (PDF), there were multiple warnings about a serious network intrusion, but those red flags were either misidentified or not acted on quickly enough:
<ul>
<li>On Mar. 31, 2021, the HSE&#8217;s antivirus software detected the execution of two software tools commonly used by ransomware groups &#8212; <a href="https://www.secureworks.com/blog/detecting-cobalt-strike-cybercrime-attacks" target="_blank" rel="noopener">Cobalt Strike</a> and <a href="https://www.secureworks.com/blog/detecting-cobalt-strike-cybercrime-attacks" target="_blank" rel="noopener">Mimikatz</a> &#8212; on the Patient Zero Workstation. But the antivirus software was set to monitor mode, so it did not block the malicious commands.&#8221;</li>
<li>On May 7, the attacker compromised the HSE&#8217;s servers for the first time, and over the next five days the intruder would compromise six HSE hospitals. On May 10, one of the hospitals detected malicious activity on its Microsoft Windows Domain Controller, a critical &#8220;keys to the kingdom&#8221; component of any Windows enterprise network that manages user authentication and network access.</li>
<li>On 10 May 2021, security auditors first identified evidence of the attacker compromising systems within Hospital C and Hospital L. Hospital C’s antivirus software detected Cobalt Strike on two systems but failed to quarantine the malicious files.</li>
<li>On May 13, the HSE&#8217;s antivirus security provider emailed the HSE&#8217;s security operations team, highlighting unhandled threat events dating back to May 7 on at least 16 systems. The HSE Security Operations team requested that the Server team restart servers.</li>
</ul>
By then it was too late. At just after midnight Ireland time on May 14, the attacker executed the Conti ransomware within the HSE. The attack <a href="https://cyberlaw.ccdcoe.org/wiki/Health_Service_Executive_ransomware_attack_(2021)" target="_blank" rel="noopener">disrupted services at several Irish hospitals</a> and resulted in the near complete shutdown of the HSE&#8217;s national and local networks, forcing the cancellation of many outpatient clinics and healthcare services. The number of appointments in some areas dropped by up to 80 percent.&#8221;
Conti initially demanded USD $20 million worth of virtual currency in exchange for a digital key to unlock HSE servers compromised by the group. But perhaps in response to the public outcry over the HSE disruption, Conti reversed course and gave the HSE the decryption keys without requiring payment.
Still, the work to restore infected systems would take months. The HSE ultimately enlisted members of the Irish military to bring in laptops and PCs to help restore computer systems by hand. It wasn&#8217;t until September 21, 2021 that the HSE declared 100 percent of its servers were decrypted.
As bad as the HSE ransomware attack was, the PWC report emphasizes that it could have been far worse. For example, it is unclear how much data would have been unrecoverable if a decryption key had not become available as the HSE’s backup infrastructure was only periodically backed up to offline tape.
The attack also could have been worse, the report found:
<ul>
<li>if there had been intent by the Attacker to target specific devices within the HSE environment (e.g. medical devices);</li>
<li>if the ransomware took actions to destroy data at scale;</li>
<li>if the ransomware had auto-propagation and persistence capabilities, for example by using an exploit to propagate across domains and trust-boundaries to medical devices (e.g. the EternalBlue exploit used by the WannaCry and NotPetya15 attacks);</li>
<li>if cloud systems had also been encrypted such as the COVID-19 vaccination system</li>
</ul>
The PWC report contains numerous recommendations, most of which center around hiring new personnel to lead the organization&#8217;s redoubled security efforts. But it is clear that the HSE has an enormous amount of work ahead <a href="https://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/" target="_blank" rel="noopener">to grow in security maturity</a>. For example, the report notes the HSE&#8217;s hospital network had over 30,000 Windows 7 workstations that were deemed end of life by the vendor.
&#8220;The HSE assessed its cybersecurity maturity rating as low,&#8221; PWC wrote. &#8220;For example, they do not have a CISO or a Security Operations Center established.&#8221;
PWC also estimates that efforts to build up the HSE&#8217;s cybersecurity program to the point where it can rapidly detect and respond to intrusions are likely to cost &#8220;a multiple of the HSE&#8217;s current capital and operation expenditure in these areas over several years.&#8221;
<div id="attachment_29580" style="width: 1081px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-29580" loading="lazy" class="size-full wp-image-29580" src="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png" alt="" width="1071" height="743" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png 1071w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-285x198.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-600x416.png 600w" sizes="(max-width: 1071px) 100vw, 1071px" />One idea of a &#8220;security maturity&#8221; model.</div>
In June 2021, the HSE&#8217;s director general said the recovery costs for the May ransomware attack <a href="https://www.bankinfosecurity.com/irish-ransomware-attack-recovery-cost-estimate-600-million-a-16931" target="_blank" rel="noopener">were likely to exceed USD $600 million</a>.
What&#8217;s remarkable about this incident is that the HSE is publicly funded by the Irish government, and so in theory it has the money to spend (or raise) to pay for all these ambitious recommendations for increasing their security maturity.
That stands in stark contrast to the healthcare system here in the United States, where the single biggest impediment to doing security well continues to be lack of making it a real budget priority. Also, most healthcare organizations in the United States are private companies that operate on razor-thin profit margins.
I know this because in 2018 I was asked to give the keynote at an annual gathering of the Healthcare Information Sharing and Analysis Group (H-ISAC), an industry group centered on sharing information about cybersecurity threats. I almost didn&#8217;t accept the invitation: I&#8217;d written very little about healthcare security, which seemed to be dominated by coverage of whether healthcare organizations complied with the letter of the law in the United States. That compliance centered on the <a href="https://www.cdc.gov/phlp/publications/topic/hipaa.html#:~:text=The%20Health%20Insurance%20Portability%20and,the%20patient's%20consent%20or%20knowledge." target="_blank" rel="noopener">Health Insurance Portability and Accountability Act</a> (HIPAA), which prioritizes protecting the integrity and privacy of patient data.
To get up to speed, I interviewed over a dozen of the healthcare security industry&#8217;s best and brightest minds. A common refrain I heard from those interviewed was that if it was security-related but didn&#8217;t have to do with compliance, there probably wasn&#8217;t much chance it would get any budget.
Those sources unanimously said that however well-intentioned, it&#8217;s not clear that the &#8220;protect the data&#8221; regulatory approach of HIPPA was working from an overall threat perspective. According to <a href="https://www.healthcareitnews.com/news/biggest-healthcare-data-breaches-2021" target="_blank" rel="noopener">HealthcareIT News</a>, more than 40 million patient records have been compromised in incidents reported to the federal government in 2021 so far alone.
During my 2018 talk, I tried to emphasize the primary importance of being able to respond quickly to intrusions. Here&#8217;s a snippet of what I told that H-ISAC audience:
<blockquote>&#8220;The term &#8216;Security Maturity&#8217; refers to the street smarts of an individual or organization, and this maturity generally comes from making plenty of mistakes, getting hacked a lot, and hopefully learning from each incident, measuring response times, and improving.
Let me say up front that all organizations get hacked. Even ones that are doing everything right from a security perspective get hacked probably every day if they’re big enough. By hacked I mean someone within the organization falls for a phishing scam, or clicks a malicious link and downloads malware. Because let’s face it, it only takes one screw up for the hackers to get a foothold in the network.
Now this is in itself isn’t bad. Unless you don&#8217;t have the capability to detect it and respond quickly. And if you can&#8217;t do that, you run the serious risk of having a small incident metastasize into a much larger problem.
Think of it like the medical concept of the &#8216;Golden Hour:&#8217; That short window of time directly following a traumatic injury like a stroke or heart attack in which life-saving medicine and attention is likely to be most effective. The same concept holds true in cybersecurity, and it&#8217;s exactly why so many organizations these days are placing more of their resources into incident response, instead of just prevention.&#8221;</blockquote>
The United States&#8217; somewhat decentralized healthcare system means that many ransomware outbreaks tend to be limited to regional or local healthcare facilities. But a well-placed ransomware attack or series of attacks could inflict serious damage on the sector: A <a href="https://www2.deloitte.com/us/en/insights/industry/health-care/hospital-mergers-acquisition-trends.html" target="_blank" rel="noopener">December 2020 report from Deloitte</a> says the top 10 health systems now control a 24 percent market share and their revenue grew at twice the rate of the rest of the market.
In October 2020, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/" target="_blank" rel="noopener">broke the story</a> that the FBI and U.S. Department of Homeland Security had obtained chatter from a top ransomware group which warned of an &#8220;imminent cybercrime threat to U.S. hospitals and healthcare providers.&#8221; Members associated with the Russian-speaking ransomware group known as Ryuk had discussed plans to deploy ransomware at more than 400 healthcare facilities in the United States.
Hours after that piece ran, I heard from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours.
&#8220;I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?&#8221; I asked the source.
&#8220;It&#8217;s more like one a day,&#8221; the source confided.
In all likelihood, the HSE will get the money it needs to implement the programs recommended by PWC, however long that takes. I wonder how many U.S.-based healthcare organizations could say the same.

The consulting firm PricewaterhouseCoopers recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland’s public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousands of outdated Windows 7 systems, and that the health system’s IT administrators failed to respond to multiple warning signs that a massive attack was imminent.

PWC’s timeline of the days leading up to the deployment of Conti ransomware on May 14.

Ireland’s Health Service Executive (HSE), which operates the country’s public health system, got hit with Conti ransomware on May 14, 2021. A timeline in the report (above) says the initial infection of the “patient zero” workstation happened on Mar. 18, 2021, when an employee on a Windows computer opened a booby-trapped Microsoft Excel document in a phishing email that had been sent two days earlier.
Less than a week later, the attacker had established a reliable backdoor connection to the employee’s infected workstation. After infecting the system, “the attacker continued to operate in the environment over an eight week period until the detonation of the Conti ransomware on May 14, 2021,” the report states.
According to PWC’s report (PDF), there were multiple warnings about a serious network intrusion, but those red flags were either misidentified or not acted on quickly enough:
On Mar. 31, 2021, the HSE’s antivirus software detected the execution of two software tools commonly used by ransomware groups — Cobalt Strike and Mimikatz — on the Patient Zero Workstation. But the antivirus software was set to monitor mode, so it did not block the malicious commands.”
On May 7, the attacker compromised the HSE’s servers for the first time, and over the next five days the intruder would compromise six HSE hospitals. On May 10, one of the hospitals detected malicious activity on its Microsoft Windows Domain Controller, a critical “keys to the kingdom” component of any Windows enterprise network that manages user authentication and network access.
On 10 May 2021, security auditors first identified evidence of the attacker compromising systems within Hospital C and Hospital L. Hospital C’s antivirus software detected Cobalt Strike on two systems but failed to quarantine the malicious files.
On May 13, the HSE’s antivirus security provider emailed the HSE’s security operations team, highlighting unhandled threat events dating back to May 7 on at least 16 systems. The HSE Security Operations team requested that the Server team restart servers.
By then it was too late. At just after midnight Ireland time on May 14, the attacker executed the Conti ransomware within the HSE. The attack disrupted services at several Irish hospitals and resulted in the near complete shutdown of the HSE’s national and local networks, forcing the cancellation of many outpatient clinics and healthcare services. The number of appointments in some areas dropped by up to 80 percent.”
Conti initially demanded USD $20 million worth of virtual currency in exchange for a digital key to unlock HSE servers compromised by the group. But perhaps in response to the public outcry over the HSE disruption, Conti reversed course and gave the HSE the decryption keys without requiring payment.
Still, the work to restore infected systems would take months. The HSE ultimately enlisted members of the Irish military to bring in laptops and PCs to help restore computer systems by hand. It wasn’t until September 21, 2021 that the HSE declared 100 percent of its servers were decrypted.
As bad as the HSE ransomware attack was, the PWC report emphasizes that it could have been far worse. For example, it is unclear how much data would have been unrecoverable if a decryption key had not become available as the HSE’s backup infrastructure was only periodically backed up to offline tape.
The attack also could have been worse, the report found:
if there had been intent by the Attacker to target specific devices within the HSE environment (e.g. medical devices);
if the ransomware took actions to destroy data at scale;
if the ransomware had auto-propagation and persistence capabilities, for example by using an exploit to propagate across domains and trust-boundaries to medical devices (e.g. the EternalBlue exploit used by the WannaCry and NotPetya15 attacks);
if cloud systems had also been encrypted such as the COVID-19 vaccination system
The PWC report contains numerous recommendations, most of which center around hiring new personnel to lead the organization’s redoubled security efforts. But it is clear that the HSE has an enormous amount of work ahead to grow in security maturity. For example, the report notes the HSE’s hospital network had over 30,000 Windows 7 workstations that were deemed end of life by the vendor.
“The HSE assessed its cybersecurity maturity rating as low,” PWC wrote. “For example, they do not have a CISO or a Security Operations Center established.”
PWC also estimates that efforts to build up the HSE’s cybersecurity program to the point where it can rapidly detect and respond to intrusions are likely to cost “a multiple of the HSE’s current capital and operation expenditure in these areas over several years.”

One idea of a “security maturity” model.

In June 2021, the HSE’s director general said the recovery costs for the May ransomware attack were likely to exceed USD $600 million.
What’s remarkable about this incident is that the HSE is publicly funded by the Irish government, and so in theory it has the money to spend (or raise) to pay for all these ambitious recommendations for increasing their security maturity.
That stands in stark contrast to the healthcare system here in the United States, where the single biggest impediment to doing security well continues to be lack of making it a real budget priority. Also, most healthcare organizations in the United States are private companies that operate on razor-thin profit margins.
I know this because in 2018 I was asked to give the keynote at an annual gathering of the Healthcare Information Sharing and Analysis Group (H-ISAC), an industry group centered on sharing information about cybersecurity threats. I almost didn’t accept the invitation: I’d written very little about healthcare security, which seemed to be dominated by coverage of whether healthcare organizations complied with the letter of the law in the United States. That compliance centered on the Health Insurance Portability and Accountability Act (HIPAA), which prioritizes protecting the integrity and privacy of patient data.
To get up to speed, I interviewed over a dozen of the healthcare security industry’s best and brightest minds. A common refrain I heard from those interviewed was that if it was security-related but didn’t have to do with compliance, there probably wasn’t much chance it would get any budget.
Those sources unanimously said that however well-intentioned, it’s not clear that the “protect the data” regulatory approach of HIPPA was working from an overall threat perspective. According to HealthcareIT News, more than 40 million patient records have been compromised in incidents reported to the federal government in 2021 so far alone.
During my 2018 talk, I tried to emphasize the primary importance of being able to respond quickly to intrusions. Here’s a snippet of what I told that H-ISAC audience:
“The term ‘Security Maturity’ refers to the street smarts of an individual or organization, and this maturity generally comes from making plenty of mistakes, getting hacked a lot, and hopefully learning from each incident, measuring response times, and improving.
Let me say up front that all organizations get hacked. Even ones that are doing everything right from a security perspective get hacked probably every day if they’re big enough. By hacked I mean someone within the organization falls for a phishing scam, or clicks a malicious link and downloads malware. Because let’s face it, it only takes one screw up for the hackers to get a foothold in the network.
Now this is in itself isn’t bad. Unless you don’t have the capability to detect it and respond quickly. And if you can’t do that, you run the serious risk of having a small incident metastasize into a much larger problem.
Think of it like the medical concept of the ‘Golden Hour:’ That short window of time directly following a traumatic injury like a stroke or heart attack in which life-saving medicine and attention is likely to be most effective. The same concept holds true in cybersecurity, and it’s exactly why so many organizations these days are placing more of their resources into incident response, instead of just prevention.”

The United States’ somewhat decentralized healthcare system means that many ransomware outbreaks tend to be limited to regional or local healthcare facilities. But a well-placed ransomware attack or series of attacks could inflict serious damage on the sector: A December 2020 report from Deloitte says the top 10 health systems now control a 24 percent market share and their revenue grew at twice the rate of the rest of the market.
In October 2020, KrebsOnSecurity broke the story that the FBI and U.S. Department of Homeland Security had obtained chatter from a top ransomware group which warned of an “imminent cybercrime threat to U.S. hospitals and healthcare providers.” Members associated with the Russian-speaking ransomware group known as Ryuk had discussed plans to deploy ransomware at more than 400 healthcare facilities in the United States.
Hours after that piece ran, I heard from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours.
“I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?” I asked the source.
“It’s more like one a day,” the source confided.
In all likelihood, the HSE will get the money it needs to implement the programs recommended by PWC, however long that takes. I wonder how many U.S.-based healthcare organizations could say the same.

Inside Ireland’s Public Healthcare Ransomware Scare

A 31-year-old Canadian man has been arrested and charged with fraud in connection with numerous ransomware attacks against businesses, government agencies and private citizens throughout Canada and the United States. Canadian authorities describe him as "the most prolific cybercriminal we've identified in Canada," but so far they've released few other details about the investigation or the defendant. Helpfully, an email address and nickname apparently connected to the accused offer some additional clues.

A 31-year-old Canadian man has been arrested and charged with fraud in connection with numerous ransomware attacks against businesses, government agencies and private citizens throughout Canada and the United States. Canadian authorities describe him as &#8220;the most prolific cybercriminal we&#8217;ve identified in Canada,&#8221; but so far they&#8217;ve released few other details about the investigation or the defendant. Helpfully, an email address and nickname apparently connected to the accused offer some additional clues.
<div id="attachment_57827" style="width: 292px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57827" loading="lazy" class="wp-image-57827" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/philbertapril2016.png" alt="" width="282" height="284" />Matthew Philbert, in 2016.</div>
Matthew Philbert of Ottawa, Ontario was charged with fraud and conspiracy in a joint law enforcement action by Canadian and U.S. authorities dubbed &#8220;Project CODA.&#8221; The Ontario Provincial Police (OPP) on Tuesday <a href="https://twitter.com/OPP_News/status/1468294251867824129" target="_blank" rel="noopener">said</a> the investigation began in January 2020 when the U.S. Federal Bureau of Investigation (FBI) contacted them regarding ransomware attacks that were based in Canada.
&#8220;During the course of this investigation, OPP investigators determined an individual was responsible for numerous ransomware attacks affecting businesses, government agencies and private individuals throughout Canada as well as cyber-related offenses in the United States,&#8221; reads an OPP statement.
&#8220;A quantity of evidentiary materials was seized and held for investigation, including desktop and laptop computers, a tablet, several hard drives, cellphones, a Bitcoin seed phrase and a quantity of blank cards with magnetic stripes,&#8221; the statement continues.
The <a href="https://krebsonsecurity.com/wp-content/uploads/2021/12/PhilbertIndictment.pdf" target="_blank" rel="noopener">U.S. indictment of Philbert</a> (PDF) is unusually sparse, but it does charge him with conspiracy, suggesting the defendant was part of a group. In an interview with KrebsOnSecurity, OPP Detective Inspector Matt Watson declined to say whether other defendants were being sought in connection with the investigation, but said the inquiry is ongoing.
&#8220;I will say this, Philbert is the most prolific cybercriminal we&#8217;ve identified to date in Canada,&#8221; Watson said. &#8220;We&#8217;ve identified in excess of a thousand of his victims. And a lot of these were small businesses that were just holding on by their fingernails during COVID.&#8221;
<h2>A DARK CLOUD</h2>
There is a now-dormant Myspace account for a Matthew Philbert from Orleans, a suburb of Ottawa, Ontario. The information tied to the Myspace account matches the age and town of the defendant. The Myspace account was registered under the nickname &#8220;Darkcloudowner,&#8221; and to the email address dark_cl0ud6@hotmail.com.
A search in <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> on that email address reveals multiple domains registered to a Matthew Philbert and to the Ottawa phone number 6138999251 [DomainTools is a frequent advertiser on this site]. That same phone number is tied to a Facebook account for a 31-year-old Matthew Philbert from Orleans, who describes himself as a self-employed &#8220;broke bitcoin baron.&#8221;
Mr. Philbert did not respond to multiple requests for comment.
According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, that dark_cl0ud6@hotmail.com address has been used in conjunction with the handle &#8220;DCReavers2&#8221; to register user accounts on a half-dozen English-language cybercrime forums since 2008, including <a href="https://krebsonsecurity.com/?s=hackforums" target="_blank" rel="noopener">Hackforums</a>, Blackhatworld, and Ghostmarket.
Perhaps the earliest and most important cybercrime forum DCReavers2 frequented was Darkode, where he was among the first two-dozen members. Darkode was <a href="https://krebsonsecurity.com/2015/07/the-darkode-cybercrime-forum-up-close/" target="_blank" rel="noopener">taken down in 2015 as part of an FBI investigation sting operation</a>, but screenshots of the community saved by this author show that DCReavers2 was already well known to the Darkode founders when his membership to the forum was accepted in May 2009.
<div id="attachment_57823" style="width: 739px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57823" loading="lazy" class="size-full wp-image-57823" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/DCmemberlist.png" alt="" width="729" height="670" />DCReavers2 was just the 22nd account to register on the Darkode cybercrime forum.</div>
Most of DCReavers&#8217;s posts on Darkode appear to have been removed by forum administrators early on (likely at DCReavers&#8217; request), but the handful of posts that survived the purge show that more than a decade ago DCReavers2 was involved in running botnets, or large collections of hacked computers.
&#8220;My exploit pack is hosted there with 0 problems,&#8221; DCReaver2 <a href="https://krebsonsecurity.com/wp-content/uploads/2021/12/dcreavers2-dk.png" target="_blank" rel="noopener">says</a> of a shady online provider that another member asked about in May 2010.
Searching the Web on &#8220;DCreavers2&#8221; brings up <a href="https://www.exposedbotnets.com/2012/05/remember-h1t3mlo.html" target="_blank" rel="noopener">a fascinating chat conversation</a> allegedly between DCReavers2 and an individual in Australia who was selling access to an &#8220;<a href="https://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/" target="_blank" rel="noopener">exploit kit</a>,&#8221; commercial crimeware designed to be stitched into hacked or malicious sites and exploit a variety of Web-browser vulnerabilities for the purposes of installing malware of the customer’s choosing.
In that 2009 chat, indexed by the researchers behind the website exposedbotnets.com, DCReavers2 uses the Dark_Cl0ud6 email address and actually shares his real name as Matthew Philbert. DCReavers2 also says his partner uses the nickname &#8220;The Rogue,&#8221; which corresponds to a former Darkode administrator who was the second user ever registered on the forum (see screenshot above).
In that same conversation, DCReavers2 discusses managing a botnet built on ButterFly Bot. Also known as &#8220;Mariposa,&#8221; ButterFly was a plug-and-play malware strain that allowed even the most novice of would-be cybercriminals to set up a global operation capable of harvesting data from thousands of infected PCs, and using the enslaved systems for crippling attacks on Web sites. The ButterFly Bot kit sold for prices ranging from $500 to $2,000.
<div id="attachment_1451" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-1451" loading="lazy" class=" wp-image-1451" src="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png" alt="" width="761" height="419" srcset="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png 962w, https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM-300x165.png 300w" sizes="(max-width: 761px) 100vw, 761px" />An advertisement for the ButterFly Bot.</div>
The author of ButterFly Bot &#8212; Slovenian hacker Matjaz &#8220;Iserdo&#8221; Skorjanc &#8212; was Darkode&#8217;s original founder back in 2008. Arrested in 2010, Skorjanc was sentenced to nearly five years in prison for selling and supporting Mariposa, which was used to compromise millions of Microsoft Windows computers.
Upon release from prison, Skorjanc became chief technology officer for NiceHash, a cryptocurrency mining service. In December 2017, $52 million worth of Bitcoin <a href="https://krebsonsecurity.com/2017/12/former-botmaster-darkode-founder-is-cto-of-hacked-bitcoin-mining-firm-nicehash/" target="_blank" rel="noopener">mysteriously disappeared from NiceHash coffers</a>. In October 2019, Skorjanc was <a href="https://krebsonsecurity.com/2019/10/mariposa-botnet-author-darkcode-crime-forum-admin-arrested-in-germany/" target="_blank" rel="noopener">arrested in Germany</a> in response to a U.S.-issued international arrest warrant for his extradition.
The <a href="https://krebsonsecurity.com/wp-content/uploads/2021/12/skorjanc2018indict.pdf" target="_blank" rel="noopener">indictment</a> (PDF) tied to Skorjanc&#8217;s 2019 arrest also names several other alleged founding members of Darkode, including Thomas &#8220;Fubar&#8221; McCormick, a Massachusetts man who was allegedly one of the last administrators of Darkode. Prosecutors say McCormick also was a reseller of the Mariposa botnet, the <a href="https://krebsonsecurity.com/?s=zeus+trojan" target="_blank" rel="noopener">ZeuS banking trojan</a>, and a bot malware he allegedly helped create called &#8220;Ngrbot.&#8221; The U.S. federal prosecution against Skorjanc and McCormick is ongoing.
At the time the FBI dismantled Darkode in 2015, the Justice Department said that out of 800 or so crime forums worldwide, Darkode was the most sophisticated English-language forum, and that it represented &#8220;one of the gravest threats to the integrity of data on computers in the United States and around the world.&#8221;
Some of Darkode&#8217;s core members were either customers or sellers of various &#8220;locker&#8221; kits, which were basically web-based exploits that would lock the victim&#8217;s screen into a webpage spoofing the FBI or Justice Department and warning that victims had been caught accessing child sexual abuse material. Victims who agreed to pay a &#8220;fine&#8221; of several hundred dollars worth of GreenDot prepaid cards could then be rid of the PC locker program.
<div id="attachment_57824" style="width: 768px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57824" loading="lazy" class=" wp-image-57824" src="https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker.png" alt="" width="758" height="544" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker.png 1198w, https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker-768x551.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker-782x561.png 782w" sizes="(max-width: 758px) 100vw, 758px" />A 2012 sales thread on Darkode for Rev Locker.</div>
In many ways, lockers were the precursors to the modern cybercrime scourge we now know as ransomware. The main reason lockers never took off as an existential threat to organizations worldwide was that there is only so much money locker users could reasonably demand via GreenDot cards.
But with the ascendance and broader acceptance of virtual currencies like Bitcoin, suddenly criminal hackers could start demanding millions of dollars from victims. And it stands to reason that a great many Darkode members who were never caught have since transitioned from lockers, exploit kits and GreenDot cards to doing what every other self-respecting cybercrook seems to be involved with these days: Locking entire companies and industries for ransomware payments.
One final observation about the Philbert indictment: It&#8217;s good to see the Canadian authorities working closely with the FBI on important cybercrime cases. Indeed, this investigation is remarkable for that fact alone. For years I&#8217;ve been wondering aloud why more American cybercriminals don&#8217;t just move to Canada, because historically there has been almost no probability that they will ever get caught &#8212; let alone prosecuted there. With any luck, this case will be the start of something new.

A 31-year-old Canadian man has been arrested and charged with fraud in connection with numerous ransomware attacks against businesses, government agencies and private citizens throughout Canada and the United States. Canadian authorities describe him as “the most prolific cybercriminal we’ve identified in Canada,” but so far they’ve released few other details about the investigation or the defendant. Helpfully, an email address and nickname apparently connected to the accused offer some additional clues.

Matthew Philbert, in 2016.

Matthew Philbert of Ottawa, Ontario was charged with fraud and conspiracy in a joint law enforcement action by Canadian and U.S. authorities dubbed “Project CODA.” The Ontario Provincial Police (OPP) on Tuesday said the investigation began in January 2020 when the U.S. Federal Bureau of Investigation (FBI) contacted them regarding ransomware attacks that were based in Canada.
“During the course of this investigation, OPP investigators determined an individual was responsible for numerous ransomware attacks affecting businesses, government agencies and private individuals throughout Canada as well as cyber-related offenses in the United States,” reads an OPP statement.
“A quantity of evidentiary materials was seized and held for investigation, including desktop and laptop computers, a tablet, several hard drives, cellphones, a Bitcoin seed phrase and a quantity of blank cards with magnetic stripes,” the statement continues.
The U.S. indictment of Philbert (PDF) is unusually sparse, but it does charge him with conspiracy, suggesting the defendant was part of a group. In an interview with KrebsOnSecurity, OPP Detective Inspector Matt Watson declined to say whether other defendants were being sought in connection with the investigation, but said the inquiry is ongoing.
“I will say this, Philbert is the most prolific cybercriminal we’ve identified to date in Canada,” Watson said. “We’ve identified in excess of a thousand of his victims. And a lot of these were small businesses that were just holding on by their fingernails during COVID.”
A DARK CLOUD
There is a now-dormant Myspace account for a Matthew Philbert from Orleans, a suburb of Ottawa, Ontario. The information tied to the Myspace account matches the age and town of the defendant. The Myspace account was registered under the nickname “Darkcloudowner,” and to the email address dark_cl0ud6@hotmail.com.
A search in DomainTools on that email address reveals multiple domains registered to a Matthew Philbert and to the Ottawa phone number 6138999251 [DomainTools is a frequent advertiser on this site]. That same phone number is tied to a Facebook account for a 31-year-old Matthew Philbert from Orleans, who describes himself as a self-employed “broke bitcoin baron.”
Mr. Philbert did not respond to multiple requests for comment.
According to cyber intelligence firm Intel 471, that dark_cl0ud6@hotmail.com address has been used in conjunction with the handle “DCReavers2” to register user accounts on a half-dozen English-language cybercrime forums since 2008, including Hackforums, Blackhatworld, and Ghostmarket.
Perhaps the earliest and most important cybercrime forum DCReavers2 frequented was Darkode, where he was among the first two-dozen members. Darkode was taken down in 2015 as part of an FBI investigation sting operation, but screenshots of the community saved by this author show that DCReavers2 was already well known to the Darkode founders when his membership to the forum was accepted in May 2009.

DCReavers2 was just the 22nd account to register on the Darkode cybercrime forum.

Most of DCReavers’s posts on Darkode appear to have been removed by forum administrators early on (likely at DCReavers’ request), but the handful of posts that survived the purge show that more than a decade ago DCReavers2 was involved in running botnets, or large collections of hacked computers.
“My exploit pack is hosted there with 0 problems,” DCReaver2 says of a shady online provider that another member asked about in May 2010.
Searching the Web on “DCreavers2” brings up a fascinating chat conversation allegedly between DCReavers2 and an individual in Australia who was selling access to an “exploit kit,” commercial crimeware designed to be stitched into hacked or malicious sites and exploit a variety of Web-browser vulnerabilities for the purposes of installing malware of the customer’s choosing.
In that 2009 chat, indexed by the researchers behind the website exposedbotnets.com, DCReavers2 uses the Dark_Cl0ud6 email address and actually shares his real name as Matthew Philbert. DCReavers2 also says his partner uses the nickname “The Rogue,” which corresponds to a former Darkode administrator who was the second user ever registered on the forum (see screenshot above).
In that same conversation, DCReavers2 discusses managing a botnet built on ButterFly Bot. Also known as “Mariposa,” ButterFly was a plug-and-play malware strain that allowed even the most novice of would-be cybercriminals to set up a global operation capable of harvesting data from thousands of infected PCs, and using the enslaved systems for crippling attacks on Web sites. The ButterFly Bot kit sold for prices ranging from $500 to $2,000.

An advertisement for the ButterFly Bot.

The author of ButterFly Bot — Slovenian hacker Matjaz “Iserdo” Skorjanc — was Darkode’s original founder back in 2008. Arrested in 2010, Skorjanc was sentenced to nearly five years in prison for selling and supporting Mariposa, which was used to compromise millions of Microsoft Windows computers.
Upon release from prison, Skorjanc became chief technology officer for NiceHash, a cryptocurrency mining service. In December 2017, $52 million worth of Bitcoin mysteriously disappeared from NiceHash coffers. In October 2019, Skorjanc was arrested in Germany in response to a U.S.-issued international arrest warrant for his extradition.
The indictment (PDF) tied to Skorjanc’s 2019 arrest also names several other alleged founding members of Darkode, including Thomas “Fubar” McCormick, a Massachusetts man who was allegedly one of the last administrators of Darkode. Prosecutors say McCormick also was a reseller of the Mariposa botnet, the ZeuS banking trojan, and a bot malware he allegedly helped create called “Ngrbot.” The U.S. federal prosecution against Skorjanc and McCormick is ongoing.
At the time the FBI dismantled Darkode in 2015, the Justice Department said that out of 800 or so crime forums worldwide, Darkode was the most sophisticated English-language forum, and that it represented “one of the gravest threats to the integrity of data on computers in the United States and around the world.”
Some of Darkode’s core members were either customers or sellers of various “locker” kits, which were basically web-based exploits that would lock the victim’s screen into a webpage spoofing the FBI or Justice Department and warning that victims had been caught accessing child sexual abuse material. Victims who agreed to pay a “fine” of several hundred dollars worth of GreenDot prepaid cards could then be rid of the PC locker program.

A 2012 sales thread on Darkode for Rev Locker.

In many ways, lockers were the precursors to the modern cybercrime scourge we now know as ransomware. The main reason lockers never took off as an existential threat to organizations worldwide was that there is only so much money locker users could reasonably demand via GreenDot cards.
But with the ascendance and broader acceptance of virtual currencies like Bitcoin, suddenly criminal hackers could start demanding millions of dollars from victims. And it stands to reason that a great many Darkode members who were never caught have since transitioned from lockers, exploit kits and GreenDot cards to doing what every other self-respecting cybercrook seems to be involved with these days: Locking entire companies and industries for ransomware payments.
One final observation about the Philbert indictment: It’s good to see the Canadian authorities working closely with the FBI on important cybercrime cases. Indeed, this investigation is remarkable for that fact alone. For years I’ve been wondering aloud why more American cybercriminals don’t just move to Canada, because historically there has been almost no probability that they will ever get caught — let alone prosecuted there. With any luck, this case will be the start of something new.