By Waqas
According to the breach notification, 369 Elbit Systems employees got their information stolen by the attackers.
This is a post from HackRead.com Read the original post: US branch of Israeli defense contractor Elbit hit by data breach

Elbit Systems of America, which is the US branch of an Israeli defense contractor, Elbit, has confirmed that its network was targeted by cybercriminals in early June 2022. Resultantly, the personal data of its employees was stolen.

The Texas-based firm hasn’t shared many details on the data breach, but it did reveal that the attack disrupted its ‘cyber operations.’

**Incident Details**

According to the breach notification issued by the Maine attorney general’s office, the American arm of Elbit’s network has suffered a data breach. Around 369 Elbit Systems employees got their information stolen by the attackers.

As per the company, exposed data includes employee names, dates of birth, addresses, ethnicity, direct deposit information, and Social Security Numbers. The company’s spokesperson in America and any representative from its parent organization in Israel haven’t commented on the incident yet.

**Who is the Attacker?**

As per Elbit Systems of America, the investigation is still going on. At the moment, it is difficult to attribute this attack to a specific hacker, cybercrime gang, or nation-state. The company is also unsure about the objective behind this attack.  

1.  Iran-linked hackers hit Israeli, US, and EU defense tech firm
2.  Dark web hacker leaks sensitive Indian defense contractor data
3.  Meet SockDetour fileless backdoor targeting U.S. Defense contractors
4.  Hackers Posing as Women to Con Israeli Officials into Installing Malware
5.  Unknown TA2541 group attacking aviation and defense sectors since 2017

**About Elbit**

For your information, Elbit Systems is an electronics and defense tech firm. It mainly builds unmanned aerial drones, intelligence gathering, espionage, and surveillance-related systems for governments and militaries, electronic warfare systems, and similar equipment and sells it worldwide.

The company also creates surveillance software. It acquired Nice Systems’ cyber and intelligence unit in 2015 for a whopping $160 million and renamed it Cyberbit. 

As noted by TechCrunch, internet watchdog Citizen Lab’s research found that Cyberbit’s commercial spyware was used for espionage activities against Ethiopian dissidents in the USA and the UK.

This spyware could steal users’ private data from the targeted device, including passwords, screenshots, and emails. However, it is also suspected that the Ethiopian government itself ordered the spying activity.

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

US branch of Israeli defense contractor Elbit hit by data breach

By Waqas
According to the Ukraine Security Service (SSU), the hackers were selling the hacked accounts to "Russian propagandists" through the dark web.
This is a post from HackRead.com Read the original post: Ukraine Busts Pro-Russia Hackers Who Stole 30M Accounts of EU Citizens

Ukraine Security Service (SSU) has confirmed the dismantling of a cyber criminal gang that stole the personal accounts of nearly 30 million individuals in Ukraine and across Europe.

According to SSU, its cyber unit has taken down a gang of cybercriminals responsible for stealing 30 million accounts and offering the data on the dark web for sale. The department stated that the hacking group earned around UAH 14 million ($375,000) from selling these accounts.

During the search operations at the suspects’ residences, police seized several hard-magnetic disks that stored the personal data of the victims. They also seized different computer devices, such as flash drives, SIM cards, and mobile phones.

Seized material

**Hack Details**

As per initial research into the attack, the hackers breached the user accounts and sold their confidential information, including credentials and sensitive personal data, on a dark web platform via an anonymous account. They used electronic payment systems, including WebMoney, YuMoney, and Qiwi, to receive the payment for the accounts.

These services are banned in Ukraine. Furthermore, the gang of hackers included many suspects from west Ukraine’s largest city. It is unclear how many hackers were arrested and which services were attacked.

1.  Ukraine Leaks Personal Details of 620 Alleged FSB Agents
2.  IT Army of Ukraine and Anonymous hacks the Russian Yandex taxi app
3.  Ukraine Thwart Russian Industroyer 2 Malware Attack on Energy Provider
4.  Personal Data of Tens of Millions of Russians and Ukrainians Exposed Online
5.  DDoS App Meant to Hit Russia Infected Android Phones of Ukrainian Activists

**Attack Launched by “Pro-Kremlin Propagandists”**

As per the SSU’s press release, the hackers are believed to be linked with pro-Russia propagandists. They primarily targeted Ukrainian citizens and people in Europe to harvest the private information of unsuspecting users. They later sold their data on the illegal platform through numerous payment portals.

The propagandists purchased these accounts to spread chaos and panic in the region through disinformation campaigns and to encourage wide-scale destabilization in Ukraine through fake news.

> “Suspects impersonated ordinary people to spread disinformation about the socio-political situation in Ukraine and the EU.”
> 
> Ukrainian Security Service

**More Dark Web News**

1.  What Are Dark Web Search Engines and How to Find Them?
2.  8 Online Best Dark Web Search Engines for Tor Browser (2022)
3.  DeepDotWeb admin pleads guilty to money laundering, kickbacks
4.  142 Million MGM Resorts Records Leaked on Telegram for Free Download
5.  CIA Wants Russians to Share Secrets with the Agency via its Darknet Site

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Ukraine Busts Pro-Russia Hackers Who Stole 30M Accounts of EU Citizens

By Deeba Ahmed
Do Kwon insists he is "not on the run."
This is a post from HackRead.com Read the original post: Interpol Issues Int. Arrest Warrant for Terra Stablecoin Founder Do Kwon

The International Criminal Police Organization (Interpol) has issued an international arrest warrant, also called a red notice, for Terraform Labs founder Kwon Do-Hyung, more commonly known as Do Kwon.

Interpol has requested law enforcement agencies worldwide to search and arrest Do Kwon.

“Prosecutors in Seoul said Monday in a text message the international police organization has issued a Red Notice for Do Kwon.”

Do Kwon

Do Kwon, a South Korean national, is accused of the collapse of two cryptos on the Terra ecosystem, Terra cryptocurrency (Luna) and stablecoin TerraUSD (UST), which resulted in losses of $40 billion for investors, and an investigation was launched.

For your information, Terraform Labs’ cryptocurrency LUNA and UST imploded unexpectedly in May 2022 because investors lost faith in their effectiveness. Do Kwon revived the crypto project and avoided the algorithmic stablecoin component for now. UST’s de-pegging prompted the crashing of the LUNA token because both were intertwined.

Luna token’s crashing caused the wipeout of a previously high-profile crypto hedge fund, Three Arrows Capital. These collapses impacted a large number of crypto lenders, including BlockFi.

According to Bloomberg, Reportedly, several cases have been registered against Do Kwon.

However, crypto industry experts have voiced concerns over issuing a red notice because it will set a wrong precedent. Experts claim that the notice is uncalled for since Do Kwon didn’t defraud his customers and investors knowingly. Red notices are issued for most wanted fugitives for prosecution or serving a sentence.

As per Interpol’s website, the notice will serve as a request to international law enforcement authorities to provisionally arrest the person who is to be deported or facing legal action. However, at the time of writing, no arrest warrant or red notice was displayed on Interpol’s site. You can search for a red warrant on this link.

Crypto investment fund Dragonfly’s managing partner Haseeb Qureshi stated that Terra’s criminalization is a dangerous precedent.

“Having met Do Kwon … leaving how he is a person aside … I think the criminalization of Terra is a dangerous precedent,” but he also added that he didn’t know many details.

According to the prosecutors, the accused will face charges in South Korea. South Korean prosecutors intensified their investigation against Do Kwon and accused him of non-cooperative behavior this month. They also alleged that the entrepreneur was on the run as they had ‘circumstantial evidence of escape.’

Around fifteen days back, the prosecutors confirmed that Do Kwon had fled Singapore, and that’s why an arrest warrant was issued. However, Do Kwon posted on social media that he wasn’t on the run and was interested in communicating with government agencies. He also proclaimed that his team was fully cooperating and had nothing to hide.

> I am not “on the run” or anything similar – for any government agency that has shown interest to communicate, we are in full cooperation and we don’t have anything to hide
> 
> — Do Kwon 🌕 (@stablekwon) September 17, 2022

Korean officials have accused Do Kwon and five other individuals of allegedly violating capital-market laws.

Korean prosecutors are currently trying to locate Do Kwon’s whereabouts and arrest him as soon as possible. Interpol’s arrest warrant will help them seek information from international agencies in this regard.

1.  12 Arrested as Interpol Takes Down Transnational Sextortion Ring
2.  Interpol arrests Moroccon hacker over global phishing, malware scam
3.  Austria seeks Interpol’s help to bust Bitcoin scammers who stole $115M
4.  $3.6 billion worth of Bitcoin seized from crooks tied to 2016’s Bitfinex hack

Interpol Issues Int. Arrest Warrant for Terra Stablecoin Founder Do Kwon

By Owais Sultan
With most people being online for most of the day, whether for personal reasons or work-related tasks, cybersecurity…
This is a post from HackRead.com Read the original post: Simple Yet Vital Ways to Safeguard Yourself Against Online Threats

With most people being online for most of the day, whether for personal reasons or work-related tasks, cybersecurity is more important than ever. As the internet evolves and new technologies are created, new ways of scamming people or stealing important data come up too.

Despite rather widespread awareness about the importance of cybersecurity and the prevalence of malicious online attacks, most people do little to nothing to secure themselves against these potential security threats.

Here are a few simple ways of securing yourself against malware and bad actors on the web.

Source: Pexels

**Making unique passwords**

Repeating passwords is something a lot of people do, even if they know it’s inadvisable. Although remembering all your login credentials for all the different sites you’re on can be a herculean task, it also makes you very vulnerable to cyber-attacks. Using extremely generic passwords is also not a good idea as it makes hacking into your account very simple.

Unfortunately, masses of tech users adopt the same approach and this has been proven with research conducted by the likes of ExpressVPN into the most common passwords used globally.

With variations on terms like ‘passwort’ and popular football teams such as ‘Juventus’ highlighted as some of the most commonly used passwords in countries like Germany and Italy, it’s perhaps no surprise that confidential and sensitive information is so easily acquired by bad actors on the internet.

Use password managers that can help you keep track of all of your passwords or random term generators whenever prompted to change your passwords!

**Avoiding messages from unknown sources and unverified sites**

Phishing scams are really common and they’re getting better at what they do. These scams usually involve a fake website, which looks like a legitimate e-store or business, being used to make people enter their sensitive personal and financial information into fields present on the site.

One of the easiest ways of checking whether a site is real or not is by using URL checkers. One can never be too careful because these scams are ever evolving.

Source: Pexels

**Using multiple e-mail addresses**

Having a different email address to use to sign up for services and products is also a helpful way of ensuring your safety. Having multiple e-mail addresses makes sure that not all of your data is in one place. It can also help keep promotional messages and other spam messages with suspicious attachments separate from essential personal communication.

**Authentication and privacy settings**

A lot of sites sell your data to advertisers. Oftentimes, a company’s policy about privacy or selling of data is hidden in the fine print of user agreements, which an overwhelming majority of people do not go through at all. Sometimes, you can check your privacy settings on a site or an app and explicitly instruct them not to sell your data.

If your photos are publicly available on the internet, you should keep in mind the possibility of someone stealing them and pretending to be you or someone else. Anyone who keeps your photos without your explicit consent should be reported immediately. Turning on two-factor authentication for messaging apps is also important.

There are very simple and rather obvious ways in which you can safeguard yourself against cyber-attacks. Oftentimes, people don’t take this advice to heart, but doing so can make you a great deal safer while online!

1.  How to detect phishing images in emails
2.  The Types of Phishing Attacks and How to Dodge All of Them
3.  Scammers Leveraging Microsoft Team GIFs in Phishing Attacks
4.  9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos
5.  Hoxhunt Primed to Spread Gamified Phishing Awareness in the Enterprise

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Simple Yet Vital Ways to Safeguard Yourself Against Online Threats

By Owais Sultan
Although online fraud includes identity theft, phishing scams, and viruses, there are steps that can be taken to protect against them. Let's dig into the whats and hows of it.
This is a post from HackRead.com Read the original post: 5 Online Fraud Fighting Tips for Novices

Navigating the online sphere can be a big challenge, particularly if you are someone not overly clear on what the threats are and how to target them. If you fall into this category and want to take steps to increase your online safety and reduce the risk of fraud, here are some key tips to follow.

**1\. Stay up-to-date with the ever-changing phishing scams.**

The ways criminals try to get their hands on your information and cash are constantly evolving. Every time companies and consumers take steps to close loopholes; they come up with ever-evolving workarounds. Some scams you can fall prey to are incredibly sophisticated, meaning even the savviest individual might be convinced. They can mimic company websites exactly, fake email addresses and phone numbers, and can use sophisticated techniques to get information out of you.

As a consumer, you must stay on top of what kind of scams are being used, and you prepare yourself to look out for them. You can use many different blogs and online sites, and you can find a wealth of information on sites like Reddit and even Facebook, as well as by using Google. Arming yourself with the knowledge to weed out the crooks and protect yourself is one of the best things you can do when fighting online fraud.

**2\. Install IP lookup tools on your websites/blogs to trace bad actors and traffic (LI)**

If you have your own website or blog page, you might be aware that bad actors and bots enjoy causing trouble. This can come in the form of offensive comments, spam, or overloading your website, causing downtime and crashes. It can also mean hackers target your site to gain access and take it over.

An IP lookup tool is an excellent solution for those who are not overly tech-savvy: it allows the website owner to have oversight of each visitor to the site based on their IP address. In addition, this tool can assess the validity of an IP address, check addresses against blacklists of spammy content, and detect proxy servers, geolocation, domain, and hostname.

These kinds of tools can be used on their own or in conjunction with other methods to understand more about visitors to a site and to help fight back against fraud. An IP lookup tool is a great place to start for those who want to protect their websites, businesses, or other visitors.

**3\. Create secure passwords – regularly change them.**

One of the most common ways nefarious actors gain access to your accounts is not through any kind of high-tech hacking. It is done, simply by guessing your password. According to CNBC, the world’s most popular and most-used passwords are qwerty, password, 12345, and various similar combinations. Many will also use things like their maiden name, which can easily be found online, famous musicians, or footballers’ names. These can be easy for criminals to guess, mainly if they know something about the user. The other issue is that once we have a password, we don’t change it often enough.

To make matters worse, we reuse the same password across multiple platforms, meaning once a criminal has accessed one account, they can access all of them. This is a significant problem and can result in considerable losses and financial detriment to unsuspecting public members. The best way to avoid situations like this is to create secure passwords, change them regularly, and have a different one for each account.

Online password generators can create strong and unique passwords for you, which can then be used for each account. You should try and change your password every three months, four as a maximum. An easy way to remember to do this is by when you change your password to something substantial, scheduling a calendar reminder to change it three to four months in the future. This is one of the best ways to ensure your accounts remain safe and secure.

**4\. Know who is asking**

Many of us are inundated with emails, SMS, and even phone calls that ask us to reveal personal information or follow links to confirm our details. In the vast majority of cases, these will be false and created by criminals who want to trick you.

Any reputable company will not ask you to reveal personal information over the phone or via email. Furthermore, you should be wary of any communications asking you to reset your password, confirm card details, or hand over other information.

The best advice is to deal with each of these requests with suspicion. First, check the email address or number that is being sent- you can search online to see if they have been flagged as suspicious.

Also, make sure they match up with other correspondence from the company. Then, contact the company yourself via the number or email you have used to get them previously and try to verify the recent communication. If possible, send a copy to customer service or your account manager so they can let you know if it is legitimate or not. 

**5\. Protect your devices **

In 2022, most of us will have a range of electronic devices that we use to access the internet and carry out various tasks. These include mobile phones, tablets, laptops, PCs, Smart TVs, eReaders such as Kindle, smartwatches, and home assistants. Many of these devices require us to link them to email accounts, cards, and payment gateways.

We also regularly give them our personal data such as names, addresses, logins and passwords, photos, videos, mobile numbers, and even preferences. This kind of information, if it ends up in the wrong hands, can be devastating, as ICO.org notes.

It can result in identity theft, fraud, and other issues, costing a lot of time, money, and peace. To combat this, it is necessary to take steps to secure and protect your devices. For example, ensure every device you have is secured with a strong password, biometrics, and two-factor authentication. You should also be cautious about logging out of specific devices and accounts on devices when not in use.

It is also worth looking at various security software and anti-virus products that can provide additional protection to you and your data. There are many options on the market that are both easy to use and affordable. Last but not least, many devices such as mobiles, tablets, and PCs have inbuilt software that can assess security for any loopholes or imminent risks, notifying you of steps you need to take to fix them.

1.  US military personnel defrauded into losing $822m through scams
2.  170 fraudulent Android apps scamming cryptocurrency enthusiasts
3.  12 years jail for man who unlocked phones, defrauded AT&T of $200m
4.  Microsoft Warns of Evolving Toll Fraud Android Malware Draining Wallets
5.  Researchers warn of new Rug Pull scam through fraudulent crypto tokens

5 Online Fraud Fighting Tips for Novices

By Waqas
The exposed Elasticsearch server belongs to an Indian healthcare software company that has not secured the database despite being alerted.
This is a post from HackRead.com Read the original post: Covid antigen test results of 1.7m Indian and foreign nationals leaked online

An **Elasticsearch server** belonging to a healthcare software provider in India is currently exposing the Covid antigen test results of Indians and foreign nationals who traveled to or from India in the last couple of years.

It is worth noting that these tests were taken through a rapid antigen kit known as Covi-Catch. Covi-Catch is an Indian Council of Medical Research (ICMR) approved self-testing kit for COVID-19.

This was confirmed to Hackread.com by **Anurag Sen**, a prominent independent security researcher. What’s worse, the server is still exposed and publicly accessible without any security authentication or password. Originally, the server is being exposed since July, 2nd, 2022.

It all started when Anurag scanned for **misconfigured databases on Shodan** and noted a server exposing more than 23GB worth of data to public access. Anurag said that the server belongs to a company based in Gurgaon, Haryana, India, but we would not share the name of the company in this article because the server is still exposed.

**What data is being exposed?**

Anurag’s analysis of the server revealed that the exposed records are actually Covid antigen test results, while the number of victims in the incident is over 1.7 million. These results not only comprise personal records but medical records of travelers including the following information:

*   Gender
*   Full names
*   Nationality
*   Date of birth
*   Full addresses
*   Phone numbers
*   Vote ID numbers
*   Covid test results
*   Aadhaar numbers
*   Passport numbers
*   Underlying medical conditions
*   Vaccine details (vaccine type, vaccine taken or not)

_And much more…_

The screenshot shows records of American, Canadian, and Indian citizens being exposed online (Image: Hackread.com via Anurag Sen)

**No Response from the company**

Anurag contacted the culprit company through the email address mentioned on their website. However, it has been over a week and there is no response from them. Amid this, the server is still exposed.

Although exposing sensitive data of unsuspecting users to cybercriminals is a blunder, not responding to researchers and not caring about the mess up is simply irresponsible.

**Impact**

It is yet unclear whether a third party accessed the database with malicious intent, such as ransomware gangs or threat actors. However, if it did, it would be devastating for the victim and the healthcare firm responsible for the server.

Furthermore, considering the extent and nature of the exposed data, the incident can have far-reaching implications, such as bad actors downloading the data, carrying out phishing scams, or identity theft-related fraud.

Hackers can hold the company’s server or **data for ransom** and leak it on cybercrime forums if their demands are not met. Nevertheless, the victims in this situation are travelers who trusted authorities with their personal information.

1.  **MyEasyDocs Exposed 30GB of Israeli and Indian Students’ PII Data**
2.  **Chinese Adult Site Leaking 14 Million User Details – and It’s Increasing!**
3.  **Scoop: Australian Trading Giant ACY Securities Exposed 60GB of User Data**
4.  **Major Database Mess Up Leaves Indian Fed Police, Banking Records Exposed**
5.  **Hacker Selling Shanghai Police Database with Billions of Chinese Citizen Data**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Covid antigen test results of 1.7m Indian and foreign nationals leaked online

By Deeba Ahmed
The teen was arrested from Oxfordshire and is still in police custody but his involvement in Uber and GTA hacks is unconfirmed.
This is a post from HackRead.com Read the original post: UK Teen Arrested Amid Uber and GTA 6 Hacking Saga

The City of London Police has arrested a seventeen-year-old teenager over suspicion of hacking amid the recent security breaches at Uber and Rockstar Games’ GTA 6. It is worth noting that the teen’s role in these hacks is still not confirmed.

**Arrest Details**

The teen was arrested from Oxfordshire and is still in police custody. However, the officials haven’t yet shared more details on the arrest and declined to confirm if the teen was arrested for the recent high-profile hacking incidents including Uber and Rockstar Games’ GTA 6.

According to the department’s tweet, the arrest was part of an ongoing investigation carried out in collaboration with the cybercrime unit of the National Crime Agency, UK. The police shared no other detail.

For your information, a couple of months ago, London police arrested and released 7 teens in connection with an investigation into the LAPSUS$ hacking gang.

Lapsus$ is a notorious group of teen hackers that mainly hunts for the source code of high-profile and large tech firms. Some of its previous and successful attacks include Samsung, Microsoft, Nvidia, Okta, and Ubisoft.

The Uber and GTA 6 hacker had also claimed to have access to the source code of both companies.

**Uber and Rockstar Games Hacking**

Uber hacking resulted in the halting of the company’s internal systems for some time. In contrast, Rockstar Games suffered a network intrusion that caused the leaking of unreleased footage of Grand Theft Auto 6.

The two hacks are believed to be committed by the same hacker, who’s identified as Tea Pot or “teapotuberhacker.”

Uber, on the other hand, has blamed the LAPSUS$ hackers for the breach, alleging that the attacker(s) are linked with the LAPSUS$ extortion gang that has remained active over the past year.

It must be noted that the Rockstar Games hacker also claimed responsibility for the Uber hack on his Telegram and fan-run GTA forum. It is assumed that “teapotuberhacker” is a LAPSUS$ ringleader.

1.  Microsoft and Okta Confirm Data Breach Claims by LAPSUS$
2.  Popular YouTuber Scuba Jake’s channel hacked to run crypto scam
3.  Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up
4.  Russian Hacker Exploits GTA 5 PC Mod to Install Cryptocurrency Miner
5.  Grand Theft Auto (GTA) Fan Forum Hacked; Thousands of Accounts Stolen

UK Teen Arrested Amid Uber and GTA 6 Hacking Saga

By Deeba Ahmed
According to Microsoft 365 Defender Research Team, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns. 
This is a post from HackRead.com Read the original post: New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

According to a new disclosure notice from the Microsoft 365 Defender Research Team, cybercriminals are increasingly targeting Microsoft Exchange servers. Their modus operandi involves abusing OAuth applications. 

**Spam Campaigns Involving Malicious OAuth Apps Detected**

Although this isn’t the first time that threat actors have targeted Exchange Server, this campaign is unique because of abusing OAuth applications. These applications are an integral part of the attack chain in this instance.

Per MS 365 Defender Research, in an incident they analyzed, malicious OAuth applications were deployed on compromised cloud tenants, and eventually, attackers took over Exchange servers to carry out spam campaigns.

Researchers explained that the threat actor(s) launched a credential-stuffing attack, targeting high-risk accounts where users didn’t enable multifactor authentication. The attacker then leveraged unsecured admin accounts and could gain initial access.

Afterward, the attacker created a malicious OAuth application, adding an inbound connector to the Exchange email server. Hence, the actor can send out spam emails using the target domain.

Previously, OAuth applications were abused in consent phishing attacks where attackers try to access cloud services by tricking users into allowing permission to malicious OAuth apps. Some state-sponsored actors have also abused them for C2 communications, redirections, phishing attacks, and deployment of backdoors.

**Campaign Targets Overview**

Researchers disclosed in their report that numerous organizations have been targeted in credential stuffing attacks so far. In this campaign, attackers launch attacks against administrator account that lack MFA and use them to access the victim’s cloud tenant.

This campaign mainly targets consumers and enterprise tenants, abusing weaknesses in the organization’s security mechanisms and may even lead to ransomware and other devastating attacks.

In this attack, according to Microsoft 365 Defender Research Team report, attackers run spam email campaigns, advertise for fake sweepstakes through spoofing organizations’ identities, or offer an iPhone as a prize to trick victims into signing up for long-term paid subscriptions.

The campaign uses a network of single-tenant apps installed on the compromised organization. This helps the attacker gain an identity platform to launch the attack. As soon as the campaign was disclosed, all the malicious OAuth apps were removed. Organizations must implement stringent security practices to prevent such scams. Enabling MFA should be the first line of defense against such threats.

1.  Hackers hit Microsoft Exchange Server to steal email data
2.  European Banking Authority victim in Microsoft Exchange Server hack
3.  Hackers Using Malicious IIS Extensions to Backdoor Exchange Servers
4.  It’s Google.com, not ɢoogle.com; beware of the pro-Trump spam domain
5.  Spam Campaigns Using Trickbot Banking Trojan Against Cryptocurrencies

New Spam Attack Abusing OAuth Apps to Target Microsoft Exchange Servers

By Deeba Ahmed
Optus has denied any inside job or human error as the cause of the hack.
This is a post from HackRead.com Read the original post: Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach

Australia’s second-largest telecommunication firm, Optus, is the latest cyberattack victim, which Sydney-based tech analyst Trevor Long has regarded as the biggest breach of personal data from an Australian firm.

**Optus Hack Details**

On Thursday, Optus confirmed that its customers’ private data could be compromised in this attack since the attackers managed to access the customer identity database and opened it to other systems through the Application Programming Interface (API). The investigation is still ongoing, but Optus believes one of the networks was exposed to a test network with internet access.

According to the official press release, the information potentially exposed includes the following:

*   Names
*   Addresses
*   Dates of birth
*   Phone numbers
*   Email addresses
*   Driver’s license
*   Passport numbers.  

The company suspects intruders scraped the consumer database and possibly copied one-third of it. Optus also stated that its network was accessed from an external source. As soon as it discovered the attack, it shut down the attack before customers could suffer any harm. However, the company did advise its customers to keep tracking their accounts for unusual or fraudulent activities.

1.  Sensitive Data of Australian Navy’s Vessels and Fighter Jets stolen
2.  Hackers stole 738 GB of data from an Australian government agency
3.  Vietnamese man hacked Australian airport computers; stole security data
4.  Scoop: Australian Trading Giant ACY Securities Exposed 60GB of User Data
5.  Anonymous Leak 82GB of Police Emails Against Australia’s Offshore Detention

**Possibility of a Human Error?**

Optus CEO Kelly Bayer Rosmarin was asked if human error was responsible for the breach at a media briefing to which she responded:

> “I know people are hungry for details about the exact specificity of how this attack could occur, but it is the subject of criminal proceedings and so we will not be divulging details about that.”
> 
> Kelly Bayer Rosmarin, Optus CEO.

The CEO added that Optus boasts strong cyber defenses and has invested heavily in this regard, so if it can become a target of a security breach, it should be a wake-up call for all organizations.

However, Optus has denied the involvement of human error in this data breach that impacted millions of customers. The CEO also apologized to the company’s customers and said it was challenging to offer immediate advice unless the investigation was completed.

> “We are devastated to discover that we have been subject to a cyberattack that has resulted in the disclosure of our customer’s personal information to someone who shouldn’t see it.”
> 
> Kelly Bayer Rosmarin, Optus CEO.

Kelly has asked for increased vigilance across companies, governments, and customers of Optus as the Sydney-based telecom giant determines how many customers were affected by the data breach. However, it is confirmed that Optus’s voicemails, texts, payment data, and account passwords weren’t compromised in the hack.

**More TELECOM Security News**

1.  Spanish telecom giant MasMovil hit by Revil ransomware gang
2.  Telecom giant behind routing SMS discloses 5-year-long data breach
3.  Argentina’s largest telecom hacked with hackers demanding $7.5 million
4.  Hacker extracts customer data from Canadian Telecom Firm after rebuttal
5.  Croatian Police arrests minor over A1 Telecom data breach & ransom demand

Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach

By Waqas
Here's everything you want to know about Anonymous and its cyber attacks against the Iranian government for OpIran.
This is a post from HackRead.com Read the original post: OpIran – Anonymous Hits Iranian State Sites, Hacks Over 300 CCTV Cameras

In the wake of the recent Iranian government crackdown on dissent after Mahsa Amini’s death, the international hacktivist group **Anonymous** has launched a new operation against the country’s online infrastructure.

Dubbed **OpIran** (Operation Iran) by Anonymous; the hacktivists have taken down a number of top government websites and hacked over 300 security cameras in different parts of the country.

**What Happened to Mahsa Amini?**

It is worth noting that on September 16th, 2022, a 22-year-old Iranian woman named Mahsa Amini died in Tehran, Iran, under Police custody. Amini was arrested for failure to follow government-mandated forms of the Hijab.

On the other hand, authorities claim Amini died of natural causes after suffering heart failure at the police station. However, Iranians have rejected the official explanation and have taken their protests (Mahsa Amini protests (aka September 2022 Iranian protests) to the streets.

**Anonymous Stands with Protestors in Iran**

On Twitter, YourAnonNews, one of the largest social media representatives of the Anonymous movement, and several other popular Anonymous handles have confirmed their support for Iranian protesters. Thus the recent cyber attacks were carried out under the banner of OpIran.

According to Anonymous, the modus operandi of OpIran involves DDoS attacks (Distributed Denial of Service attacks), data breaches, social engineering attacks, quick tutorials on how to beat state censorship by **using the Tor browser**, and evading arrests by police.

**Anonymous Hacks Iran’s Forensic Research Center**

The first major Iranian government institution to suffer a cyberattack from Anonymous hackers is its Forensic Research Center. As seen by Hackread.com, Anonymous managed to successfully deface its domains and leak a database containing 100MB worth of data.

According to Hackread.com’s analysis, the data contains names, email addresses, logs including IP addresses of the Center’s site visitors worldwide.

A Google search for the Center’s website shows it was hacked by Anonymous (1) – The deface page left by Anonymous plays a video containing content that shows a message of support to Iranians (2) – Screenshots 3 and 4 show what is inside the database Forensic center’s database. (Credit: Waqas – Hackread.com)

**Anonymous hacked 300 Iranian CCTV cameras**

Although Anonymous is famous for its large-scale DDoS attacks and data breaches (the group proved its point during **OpRussia** during Ukraine and Russia conflict), lately, they have been going a step further by hitting the vulnerable IoT infrastructure in the targeted country.

In the case of Russia, as **reported by Hackread.com**, Anonymous managed to hack over 400 security cameras across the country while sending almost 10 million texts to Russian citizens to raise awareness about the conflict.

In the latest, Anonymous has claimed to have compromised 300 security camera installations by exploiting a 5.4 severity score vulnerability.

Iranian CCTV cameras apparently controlled by Anonymous

This however is not the first time when hackers have hacked into CCTV cameras in Iran. **In August last year**, hackers from Edaalate Ali (Ali’s Justice or Ali’s Court) group breached the computer system and security cameras at a prison facility in northern Tehran and leaked live footage of grim conditions and grave human rights violations taking place in the prison.

**Anonymous DDoS Attacks on Iranian Sites**

Since launching OpIran, Anonymous has carried out a series of DDoS attacks against Iranian state institutions. Some of these include the following:

*   National Government Portal of Iran (Iran.gov.ir)
*   The official website of the Central Bank of Iran (Cbi.ir)
*   The official website of the Government Spokesman Office (Dolat.ir)
*   The official website of Ali Khamenei, the Supreme Leader of Iran (Khamenei.ir)
*   The official website of the Iranian State media agency IRIB News Agency (Iribnews.ir)

_and the list goes on…_

At the time of writing, all the above-mentioned domains were offline.

For now, it remains to be seen how effective Anonymous’ latest operation will be. However, it is clear that the group is determined to continue its fight against what it sees as an oppressive regime.

1.  Saudi-Iran: Proxy Wars Escalate To Direct Cyber Attacks
2.  Iran’s Largest Steel Producer Hit By Crippling Cyberattack
3.  Israeli Security Camera Systems targeted by Pro-Hezbollah Hackers
4.  Anonymous & its affiliates hacked 90% of Russian exposed databases
5.  Anonymous hacks unsecured printers to send anti-war messages in Russia

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism