₦airaland Forum

Talkingboy:
PROFESSOR LAI MUHAMMED



OVER TO YOU SIR

Papiikush:
Pussý has always been the downfall of men.

Iamwrath:
Restructuring ...... And the Northerlands have played a high hand already , what will FlatPobs do now ?

softwerk(f): 3:04pm
I love Muslim women so much. They do not display nudity like their counterparts cool

But I learnt some of them are VERY good in bed angry

One of my Muslim female friends told me that her best style is horse-riding.

Just imagine wearing hijab and horse riding one Alhaji grin
(Quote) (Report) 3 Likes (Like) 1 Share (Share)

Homeboiy(m): 3:16pm
To fúck Muslim girls they sweet


just raise hijab up n insert
if people come u hide inside hijab

That year for KD sha
(Quote) (Report) 5 Likes (Like) 1 Share (Share)

Franzinni:
This Western people have found an easy scapegoat to pin all cyber crimes on.... How many Yahoo boys Sabi c++?

Dlordsamurai:
Everything that the mother have should be left alone..
she did not kidnap anybody, its not a crime for a mother to take money from her son..
Evans should face the music alone...
Even if she knew about her son, is not a guarantee that she must be held responsible for her son's sins..
Evans is mature so every decision he makes is his own doing.

Each day, countless of security researchers are fighting the good fight in an effort to help companies remove malware from infected computers and servers. These researchers have to go through numerous hoops to get their message across to the proper person inside companies or government organizations who are allowed or can remove these infections from affected devices.Most of their efforts remain hidden to the casual person, and very few get the credit they deserve for the monumental work they put in on a daily basis.

The silent war researchers wage against cyber-crooks
We'll be taking a look today at a group of researchers that during the past few months have been reporting malware-infected computers to relevant authorities in countries all over the globe. This team is formed by MalwareHunter, Daniel Gallagher, and a security researcher that goes online only by the name of Guido.

For the past few months, using data they search and find on VirusTotal, this group has been identifying malware campaigns, tracking down malware C&C servers, and rummaging through countless of data stolen from infected computers. The group identifies the entity that was infected by malware, usually off-the-shelf commercial keyloggers and remote access trojans, and attempts to contact the company. These contact attempts usually happen via email and Twitter, directly with the company. If the company is unresponsive, and a vast majority of these infected entities are, the group reaches out to local CERT teams and sometimes law enforcement.

Victims include multinationals, politicians, SMBs
Their efforts have unearthed countless of malware infections, including at companies that have yearly profits bigger than most countries. Furthermore, they found malware on the computer of a Prime Minister from a country they were asked not to name.

Despite these high profile targets, most of the time, the group finds malware at smaller companies, which don't have the financial resources to set up a cyber-security department or even hire trained cyber-security professionals.

For example, this is just one of the many Twitter threads where the group shares intelligence on the targets they find, and which they can't get in contact with. The group places this information online in the hopes the company eventually sees it, or someone else with better contacts can lend a helping hand.

Most of these campaigns are carried out by Nigerian hackers
According to MalwareHunter, who spoke with Bleeping Computer in a Twitter conversation, most of these attacks are carried out by groups of hackers based in Nigeria. MalwareHunter puts the number at "about 65-70%" of all the campaigns they find. Those that know how the cyber-security landscape has evolved in recent years will not be surprised. Nigerian cyber-crooks have evolved from the silly email scams they were pulling in the 90s and early 2000s to using more complex tools and tactics.

Nowadays, these groups of Nigerian hackers, called "yahoo boiz," "waya waya" or "G-work" in their local communities, are using clever spear-phishing emails to trick victims into installing keyloggers and RATs. This trend of evolution in the Nigerian cybercrime landscape was noticed by the SecureWorks team last August, and detailed in more depth in a report called "Wire Wire: A West African Cyber Threat." Similarly, this week, Kaspersky also discovered a group of Nigerian hackers targeting industrial companies from the metallurgy, electric power, construction, engineering and other sectors. The group Kaspersky wrote about in a blog post yesterday uses the same tactics detailed by SecureWorks last year, and observed by MalwareHunter and his friends this year.

From email 419 tax scams to RATs and keyloggers
These Nigerian groups aren't extremely sophisticated, but merely take advantage of free or commercial high-grade hacking tools to carry out more intrusive attacks than they did in previous years.

Basically, the proliferation of hacking tools in recent years has helped previously unskilled spammers to elevate their "hacking" game to new heights of complexity and efficiency.

Kaspersky and MalwareHunter list these tools as common amongst these groups: ZeuS, Pony (FareIT), LokiBot, Luminosity RAT, NetWire RAT, HawkEye, ISR Stealer, iSpy keylogger, NanoCore, and Agent Tesla.

All are keyloggers and RATs that allow an attacker easy access to infected PCs. The groups usually use this access to collect data about targets, which they sell online or use to carry out BEC scams (tricking companies into sending money to bank accounts under their control).

Based only on the data he found on malware C&C servers, MalwareHunter estimates that these hacking groups have stolen between 4 and 5 TBs of data, which contains personally identifiable information from hundreds of thousands of users, from over 1,200 companies. The stolen data belongs guests of hotels, patients of hospitals, clients of travel agencies, business contacts, and many more. Most of the stolen data are small files, such as contracts, Excel spreadsheets, and other small files that hackers can use for reconnaissance. Based on screenshots of hacked computers, MalwareHunter estimates that the hackers have access to petabytes of data, including sensitive CAD design files, private software packages, and other proprietary data.

Poor OpSec exposes the real identities of many of these hackers
Despite using potent hacking tools, these groups often fail to protect their real identities, leaving a trail of clues that many times has led researchers to the attackers' real email accounts and Facebook profiles. The researchers have shared the identities of some of these hackers on their Twitter timelines, but which we'll not be linking due to legal issues. One researcher who helped MalwareHunter and friends on some investigations claims to have compiled a list of 50+ profiles on suspected hackers, detailed with Facebook profiles, geolocation info, pictures, phone numbers, and other data. Despite the efforts of researchers to inform compromised companies, the research group says that authorities have not started an investigation on any of these individuals based on the data they supplied.

Researchers are having a hard time notifying victims
As ironic as it sounds, researchers are having a hard time convincing companies that they need to remove malware from infected PCs, let alone persuade them to file legal complaints. Researchers say that some CERT teams are more responsive than others. For example, CERTs in Jamaica, Denmark, Finland, Armenia, and the Netherlands have responded to their alerts and coordinated with infected companies to remove victims. It's been slower or complete silence with CERTs from Saudi Arabia, UAE, India, and Portugal.

"Lots of people told us CERTs and companies do not take us seriously because the alerts are free," said MalwareHunter about their recent efforts. "Some colleagues said this can be a reason some months ago, but that time I didn't really wanted to believe it. Now, as people repeat that, I have to." Although they had little success so far, researchers say they will continue to hunt down malware command and control servers, track down victims, and notify the infected companies.

Nigerian cybercriminals targeting industrial firms have stolen a slew of sensitive technical drawings, network diagrams, cost estimates, and project plans already this year. The data, exfiltrated by a cocktail of different spyware programs, wasn’t stolen from just executives, but also operators, engineers, designers and architects.

The thefts stem from a series of Business Email Compromise (BEC) attacks. In total, researchers with Kaspersky Lab said this week they’ve seen over 500 companies – mostly in the industrial and transportation sector – from 50 countries hit by strategic phishing messages over the past several months. A report by the company’s Industrial Control Systems Cyber Emergency Response Team broke down the phishing attacks on Thursday.

A map, published alongside the report, suggests corporations in the Middle East (the United Arab Emirates in particular), Russia, Germany, and India have been the hardest hit. Like most BEC attacks, the attacks begin with phony but authentic looking emails, complete with attachments named “Energy & Industrial Solutions W.L.L_pdf,” and so on. All the emails came with .RTF files armed with either an old Microsoft Word exploit – CVE-2015-1641, or macros and OLE objects that trigger the download of additional malicious files. Data sniffing malware, packed both with VB and .NET packers, from eight different families – including ZeuS, Pony, LokiBot, and a variety of RATs – were also used in the attacks, Kaspersky Lab said Thursday.

While it’s clear what’s been taken, it’s unclear exactly who’s behind the campaign. Researchers hint it’s either one group using different malware families or different groups working in tandem, using the same command and control setup to distribute their wares.

In some instances the attackers were able to gain access to websites belonging to the companies they targeted in order to host malware on their servers and use them as their C+C. In other cases attackers managed to secure access to email accounts of company employees and send malicious emails and attachments to executives at other companies.

When they couldn’t infiltrate their victims’ sites or emails to spread malware, the attackers set up C+C domains to mimic the actual name of the company targeted, or blended of the site’s legitimate name and its top-level domain. The attackers didn’t do much to cover their tracks. The bulk of the domains, according to researchers, were registered to Nigerian residents. Once a corporate machine has been compromised, the sky’s the limit for the attackers. The report claims they can carry out man-in-the-middle attacks, take screenshots of correspondence, redirect messages from the victim’s mailbox and track internal transactions by the company.

Researchers with the firm reported seeing screenshots of diagrams, mockups of electrical and information networks, and Autodesk AutoCAD projects on some command and control servers. The data is technical in nature and could likely be used to carry out future attacks, Kaspersky Lab suggests. “There is no need for the attackers to collect this kind of data in order to perpetrate their phishing scams. So what do they do with this information? Is the collection accidental, or intentional – perhaps commissioned by a third party?” Maria Garnaeva, senior security researcher, Critical Infrastructure Threat Analysis, Kaspersky Lab said.

“So far, we have not seen any of the information stolen by Nigerian cybercriminals on the black market. However, it is clear that, for the companies being attacked, in addition to the direct financial loss, a Nigerian phishing attack poses other, possibly more serious, threats.”

While these types of attacks aren’t necessarily new, Kaspersky Lab researchers said they observed a significant uptick in attacks focusing on industrial corporations in October 2016. The attacks have been ongoing and are “unlikely to end any time soon,” the report asserts.

The attacks supplement statistics recently released by the U.S. government. The FBI said in May that BEC schemes had grown a whopping 2,370 percent in the last two years.

The report, released via the FBI’s Internet Crime Complaint Center (IC3), said that since late 2013 businesses have lost more than $5.3 billion. Of that, $3 billion came at the hands of Nigerian phishers, the FBI said. Most of those funds were ultimately funneled to banks in China and Hong Kong via wire transfers and phony tax form scams.

Researchers with Dell SecureWorks, who in the past have displayed an aptitude for analyzing these kind of scams, described at the RSA Conference earlier this year how they managed to derail one. The researchers, Joe Stewart and James Bettke, posed as an executive, gained the trust of one fraudster, and successfully had several mule accounts tied to the attacker frozen, mitigating potential extensive future loss.

Stewart said at the time it’d be helpful if there was some sort of centralized repository for reporting these kinds of attacks.

“There’s no shortage of people who recognize these things and string them along. The problem is that there’s no central place to report these accounts and get them shut down,” Stewart said. “Some of these guys have accounts in every country. Try to find the right contact at a particular bank in a particular country and tell them that they have accounts used by fraudsters. There’s no easy way to do it. There needs to be someone leading the effort and the charge.”