Category Archives: FBI

The Clop Ransomware Gang Have Struck State, Federal Agencies and Hospitals

Posted on by

It was several days ago that the first reports started to surface and as CISA/FBI issued warnings, the target list/victims continues to expand.

All attributions so far point to an Russian entity with history on this and those attributions do  not come from the Federal government but rather outside cyber expert companies across the country.

Clop ransomware gang starts extorting MOVEit data-theft victims source and expanded details

So, anyone remember when President Biden gave a list of entities that were completely off limits to cyber attacks? Remember?

Well it was exactly a year ago this month…

There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure. This directive supersedes Homeland Security Presidential Directive 7.

Click here for the full description of the list. 

Meanwhile, the victims of this cyber attack related to MoveIT and CLOT include:

Reported by TechTarget:

Illinois, Minnesota and Missouri state governments are among a growing list of organizations attacked via a critical flaw in Progress Software’s MoveIT Transfer product.

Progress Software on May 31 detailed an SQL injection bug in its managed file transfer (MFT) software MoveIt Transfer. Progress urged customers to immediately apply mitigations for the vulnerability, tracked as CVE-2023-34362, while it worked on a patch, which was released later that day. But as security vendors reported soon after, the critical bug was already under active exploitation in the wild.

A wave of organizations have disclosed data breaches in the wake of CVE-2023-34362 coming to light. Some of the early major names affected by the MoveIT flaw included the government of Nova Scotia, Canada; HR software provider Zellis; the BBC; British Airways; and British retailer Boots.

Several other organizations have disclosed compromises since that initial wave, including U.K. broadcast regulator Ofcom and networking vendor Extreme Networks. Multinational accounting firm Ernst and Young was also reportedly breached via the critical flaw. Ernst and Young did not reply to TechTarget Editorial’s request for comment, but the BBC said it received confirmation of a data breach from the firm.

Additionally Johns Hopkins University Hospital got hit as well as British Airlines. 

CNN adds information to the report:

A Russian-speaking hacking group known as CLOP last week claimed credit for some of the hacks, which have also affected employees of the BBC, British Airways, oil giant Shell, and state governments in Minnesota and Illinois, among others.

The Russian hackers were the first to exploit the vulnerability, but experts say other groups may now have access to software code needed to conduct attacks.

The ransomware group had given victims until Wednesday to contact them about paying a ransom, after which they began listing more alleged victims from the hack on their extortion site on the dark web. As of Thursday morning, the dark website did not list any US federal agencies.

The episode shows the widespread impact that a single software flaw can have if exploited by skilled criminals.

The hackers – a well-known group whose favored malware emerged in 2019 – in late May began exploiting a new flaw in a widely used file-transfer software known as MOVEit, appearing to target as many exposed organizations as they could. The opportunistic nature of the hack left a broad swath of organizations vulnerable to extortion.

Progress, the US firm that owns the MOVEit software, has also urged victims to update their software packages and has issued security advice.

The 1023 Redactions Show 17 Audio Tapes of Joe and Burisma

Posted on by

Primer:Mykola Zlochevsky, the Ukrainian owner of Burisma, was the “foreign national” involved in the alleged “criminal bribery scheme” detailed in the FBI form, and Zlochevsky referred to Joe Biden as the “big guy” during a conversation several years before the June 2020 date of the bureau document, according to sources familiar with the FBI record who described its contents to the Washington Examiner.

Hoorah again for Senator Grassley. The Director of the FBI continues to remember that Senator Grassley has seen the whole 1023 form, yes the un-redacted version. So, it appears the Republicans are going on the offense and Grassley took to the Senate floor to announce for the official record the 17 tapes that were used by the top executive at Burisma as an insurance policy. What kind of policy is unclear but for sure there was a lack of trust from the outset.

But read on…

JTN:

Iowa Republican Sen. Chuck Grassley on Monday announced that the foreign national who allegedly bribed then-former Vice President Joe Biden and his son Hunter kept recordings of his conversations with each as an “insurance policy.”

“The 1023 produced to that House Committee redacted reference that the foreign national who allegedly bribed Joe and Hunter Biden allegedly has audio recordings of his conversations with them. Seventeen total recordings,” Grassley said on the Senate floor. Fifteen audio recordings include conversations between him and Hunter Biden while two include conversations between him and Joe Biden.

“These recordings were allegedly kept as a sort of insurance policy for the foreign national in case he got into a tight spot. The 1023 also indicates that then-Vice President Joe Biden may have been involved in Burisma employing Hunter Biden,” he continued.

A source familiar with the matter told Just the News that the FD-1023 memorializes the conversation between the Burisma executive and the FBI’s confidential human source in which he told the source he was in possession of the recordings. Those recordings are not included in the record, however.

In his remarks, Grassley pointed to the FD-1023 form that members of the House Oversight Committee were recently permitted to view by the FBI, but noted that the bureau still redacted parts of the unclassified document.

“More than that, the FBI made Congress review a redacted unclassified document in a classified facility. That goes to show you the disrespect the FBI has for Congress,” he added (emphasis original).

The FD-1023 includes allegations from a confidential human source that the head of Burisma, a Ukrainian energy company, hired Hunter Biden to serve on its board in order to use his father’s influence to stifle an investigation from then-Ukrainian Prosecutor General Viktor Shokin into the firm. Shokin was removed from his post in 2016 and the FD-1023 indicates that two Biden family members received $5 million each for their trouble.

***

The contents of the form last week, the FD-1023 form, dated June 30, 2020, is the FBI’s interview with a “highly credible” confidential source who detailed multiple meetings and conversations he or she had with a top Burisma executive over the course of several years, starting in 2015. (Obama knew since Biden was tasked with the Ukraine portfolio)

Grassley said the recordings were “allegedly kept as a sort of insurance policy for the foreign national in case he got into a tight spot.”

“The 1023 also indicates that then-Vice President Joe Biden may have been involved in Burisma employing Hunter Biden,” Grassley said.

Grassley demanded answers on “what, if anything has the Justice Department and FBI done to investigate?”

“The Justice Department and FBI must show their work,” Grassley said. “They no longer deserve the benefit of the doubt.”

The FBI brought the document to Capitol Hill last week after House Oversight Committee Chairman James Comer subpoenaed it last month. The FBI briefed Comer and committee Ranking Member Jamie Raskin, D-Md., on the form in a SCIF on Capitol Hill, but did not turn over the document. Comer threatened to hold FBI Director Christopher Wray in contempt of Congress.

Antiquities Bust Highlights Trafficking of Cultural Heritage

Posted on by

Low risk and high profits…

From Interpol in part:

Every June and December, we highlight the most wanted works of art through a poster that is distributed to countries.

50b_WOA-poster

The Soufan Center:

Police in Italy recently broke up a major international antiquities trafficking ring, seizing more than 3,500 ancient artifacts and arresting 21 people across multiple locations, in late May. The 21 detained suspects – 30 more remain at large – face charges that include criminal conspiracy, theft, and the illegal export of goods, according to a special unit dedicated to combatting the illicit trafficking of cultural property. The investigation by the Comando Carabinieri Tutela Patrimonio Culturale, also known as the Carabinieri “Art Squad,” began last fall and uncovered several sites in southern Italy associated with the trafficking ring, including illegal dig sites and operational bases. During raids on the locations, police found ancient ceramics, jewelry, miniatures, and hundreds of bronze, gold, and silver coins dating from the 4th century B.C. to the 3rd century A.D. According to the police, the items have “inestimable historical, artistic, and commercial value.” Authorities also recovered excavation tools as well as documentation of illicit transactions in Italy and abroad. The criminal operation involved illicit actors at almost every stage of the process, including grave diggers, “fencers” (individuals who knowingly buy the stolen art to resell for a profit), and exporters (who facilitate sales of illegally sourced relics to auction houses and buyers abroad). Italy has taken a leading role on the issue of cultural heritage trafficking in the United Nations and more broadly.

The operation, which has been heralded by the Carabinieri and Italy’s Minister of Culture as a resounding success, starkly displays not only the vulnerability of ancient Italian artifacts to traffickers, but also the financial incentives that drive illicit actors to exploit cultural heritage more broadly. The estimated worth of the transnational trade in cultural heritage trafficking ranges from several hundred million to billions of dollars annually, according to the U.S. Congressional Research Service. Confidentiality, challenges in documenting provenance, the use of intermediaries, and inconsistent due diligence practices all contribute to the illegal trade. Moreover, archaeological sites and artifacts in countries with armed conflict, such as Iraq and Syria, are particularly vulnerable to trafficking and exploitation, as the chaos of war can enable illicit actors, including terrorists, to illegally obtain, circumvent due diligence practices, and, ultimately, profit from the sale of antiquities abroad. Islamic State’s exploitation of cultural heritage has helped finance the group’s activities and strengthened its ties with transnational organized crime. In response to this threat, the UN Security Council unanimously voted to adopt Resolution 2347 in 2017, warning that any trade involving ISIS, Al Nusra Front, or Al-Qaeda affiliates could cons­­­titute financial support for sanctioned entities.

Beyond the financial incentive, illicit actors have targeted and exploited cultural heritage to further their agendas – either by validating their narratives or providing financial gain – and to marginalize and stigmatize communities. The 2001 destruction of the Bamiyan Buddhas by the Taliban, the 2014 destruction of the Sukur cultural landscape in Nigeria by Boko Haram, Islamic State’s destruction of historical and cultural sites and works of art in Palmyra, Syria, and the destruction of mausoleums in Timbuktu, Mali, by Ansar Dine and al-Qaeda in the Islamic Mahgreb all exemplify how terrorist groups target cultural heritage to strengthen their narratives. In doing so, these groups may seek to destroy a community’s collective cultural identity by targeting sites that the attackers might deem idolatrous to validate their own narrative, or they may target sites that are an integral part of the cultural or religious life of the community to subjugate their victims. Under the Rome Statute, these actions constitute war crimes. They have been prosecuted as such by the International Criminal Court. In 2016­­, a case was brought against a member of Ansar Dine for intentionally directing attack against religious and historic buildings in Timbuktu. In post-conflict contexts, the destruction of cultural heritage can hinder post-conflict recovery and peacebuilding efforts.

Russia’s illegal invasion of Ukraine highlights the role that state actors can play in the destruction of cultural heritage, and how the tactic can be used to obliterate a community’s collective identity. As of May 31, 2023, the UN Educational, Scientific, and Cultural Organization (UNESCO) had verified that over 250 sites in Ukraine had been damaged, with over 150 partially or totally destroyed, since the beginning of the invasion. These sites include religious sites, museums, monuments, libraries, and an archive. A 2022 New York Times investigation previously identified 339 cultural sites that sustained substantial damage, both as collateral damage and as a result of intentional targeting by Russian soldiers or pro-Russian separatists. Ukraine’s minister of culture, Oleksandr Tkachenko, told reporters last fall that almost 40 museums in Ukraine have been looted of artifacts by Russian soldiers. One of the looted items, a 1,500-year-old tiara dating back to the rule of Attila the Hun, is one of the world’s rarest and most valuable artifacts. By targeting cultural heritage in the conflict, Moscow appears to be intentionally working to eliminate Ukrainian cultural identity. According to the UN Special Rapporteur in the field of cultural rights, Alexandra Xanthaki, the invasion’s aim has been not merely the capture of territory, but “a gradual destruction of a whole cultural life.” She also said that “one of the justifications of the war is that Ukrainians don’t have a distinct cultural identity.” Particularly since the lead-up to the war and in the year since, Russian President Vladimir Putin has repeatedly called Ukrainian nationhood and culture a fiction, claiming the country is rightful Russian territory that was improperly given statehood during the Soviet era. Russian state media has published propaganda calling for Ukraine’s total elimination. The role of state actors in the destruction of cultural heritage further complicates protection efforts, as states have often facilitated prevention, advocacy, documentation, and transitional justice efforts, and, as UN Security Council Resolution 2347 stresses, have the primary responsibility to protect their cultural heritage.

 

China Warning to America, Prepare to Live off the Land

Posted on by

It is a major cyber attack discovered by Microsoft. It was discovered while we were all watching that ‘silly spy balloon’ as Biden called it. The attack is called Volt Typhoon, so be on notice America. The Biden White House has said nothing….

Microsoft has uncovered stealthy and targeted malicious activity focused on post-compromise credential access and network system discovery aimed at critical infrastructure organizations in the United States. The attack is carried out by Volt Typhoon, a state-sponsored actor based in China that typically focuses on espionage and information gathering. Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.

Volt Typhoon has been active since mid-2021 and has targeted critical infrastructure organizations in Guam and elsewhere in the United States. In this campaign, the affected organizations span the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. Observed behavior suggests that the threat actor intends to perform espionage and maintain access without being detected for as long as possible.

To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign, relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.

***

Dark Reading in part published the following:

China-sponsored threat actors have managed to establish persistent access within telecom networks and other critical infrastructure targets in the US, with the observed purpose of espionage — and, potentially, the ability down the line to disrupt communications in the event of military conflict in the South China Sea and broader Pacific.

The first signs of compromise emerged in telecom networks in Guam, according to a New York Times report ahead of the findings being released. The National Security Agency discovered those intrusions around the same time that the Chinese spy balloon was making headlines for entering US airspace, according to the report. It then enlisted Microsoft to further investigate, eventually uncovering a widespread web of compromises across multiple sectors, with a particular focus on air, communications, maritime, and land transportation targets.

A Shadow Goal? Laying Groundwork for Disruption

The discovery of the activity is playing out against the backdrop of the US’ frosty relations with Beijing; the two superpowers have stalled in their diplomacy since the shooting down of the balloon, and has worsened amidst fears that Russia’s invasion of Ukraine could spur China to do the same in Taiwan.

In the event of a military crisis, a destructive cyberattack on US critical infrastructure could disrupt communications and hamper the country’s ability to come to Taiwan’s aid, the Times report pointed out. Or, according to John Hultquist, chief analyst at Mandiant Intelligence – Google Cloud, a disruptive attack could be used as a proxy for kinetic action.

“These operations are aggressive and potentially dangerous, but they don’t necessarily indicate attacks are looming,” he said in an emailed statement. “A far more reliable indicator for [a] destructive and disruptive cyberattack is a deteriorating geopolitical situation. A destructive and disruptive cyberattack is not just a wartime scenario either. This capability may be used by states looking for alternatives to armed conflict.”

Andersen Air Force Base in Yigo, Guam Anderson Air Foce Base/source

Dubbing such preparations “contingency intrusions,” he added that China is certainly not alone in conducting them — although notably, China-backed APTs are typically far more focused on cyber espionage than destruction.

“Over the last decade, Russia has targeted a variety of critical infrastructure sectors in operations that we do not believe were designed for immediate effect,” Hultquist noted. “Chinese cyber threat actors are unique among their peers in that they have not regularly resorted to destructive and disruptive cyberattacks. As a result, their capability is quite opaque.”

An Observed Focus on Stealth & Spying

To achieve initial access, Volt Typhoon compromises Internet-facing Fortinet FortiGuard devices, a popular target for cyberattackers of all stripes (Microsoft is still examining how they’re being breached in this case). Once inside the box, the APT uses the device’s privileges to extract credentials from Active Directory account and authenticate to other devices on the network. Read more here. 

Migrants in America Causing Collapse of Law Enforcement

Posted on by

These sanctuary governors and mayors are arguing the wrong point. It is not so much about where to house these people and re-shipping them to other locations, but rather the scandal should be to tell the entire illegal immigrant operation that there is nothing in America to come to that is better than what they left. Consider just how much money these people spend to come here and the deadly traveling just to get beyond our borders. Are these people coming to anything better in the long term than what they left? Do they really want to work in slaughter houses, work farms in disgusting living conditions? Do they really want to be trafficked in the sex trade industry?

Ah, but read on to see a Chicago police station and consider how it is in expensive hotels across the country where we have no idea of their names, ages or even their history, no visas, no passports and no documents at all. How can law enforcement even begin to deal with this considering all the other existing crime across the country….

A huge hat tip to Rebecca Brannon!

New footage shows a Chicago police station filled with mattresses and dozens of illegal migrants, as the city struggles to house the hundreds of border crossers arriving there each day.

Officials in Chicago have said they cannot afford to rent hotel rooms for the more than 8,000 migrants who have arrived in their city and have pushed for more federal funds to cover costs.

Due to the lack of available shelters, some migrants have turned to police stations for a safe place to sleep.

The migrant-housing crisis in Chicago follows last week’s end to the Trump-era COVID-19 border restriction known as Title 42, which allowed U.S. authorities to send migrants back to Mexico without giving them a chance to seek asylum.

Tens of thousands of people hurried to cross the border illegally into the U.S. before President Joe Biden implemented a strict new asylum policy to replace Title 42.

In the shocking footage posted by photojournalist Rebecca Brannon, dozens and dozens of migrants are seen sitting on and around mattresses in a Chicago police station.

Brannon reported that many of the migrants have slept and eaten on the floors, which has placed a strain on the law enforcement officers whose day-to-day jobs have been made more difficult by their presence.

Small children were seen running around and an alley sits full of trash produced by the migrants.

Chicago already has a serious violent crime problem, with its new influx of migrants likely to further strain budgets desperately-needed to try and make the city safer.

More than 8,000 migrants have arrived in Chicago since August, which is when southern states started to bus asylum seekers north. Texas Gov. Greg Abbott sent migrants to the Democrat-led cities to help ease the burden on border towns.

‘To provide much-needed relief to our overrun border communities, Texas began busing migrants to sanctuary cities such as your ‘Welcoming City,’ along with Washington, DC, New York City, and Philadelphia, with more to come. Until Biden secures the border to stop the inflow of mass migration, Texas will continue this necessary program,’ Abbott noted in a letter earlier this month.

Migrants been sent to cities such as Chicago, Philadelphia and New York. Migrants have also arrived in Washington, DC, with buses stopping outside the home of Vice President Kamala Harris.

Despite the Chicago’s obvious overcrowding issue, new Mayor Brandon Johnson, a progressive Democrat who assumed office Monday, said in his inauguration speech that in Chicago, ‘there’s enough room for everyone.’

Johnson’s affirmed commitment to welcoming migrants to Chicago follows his predecessor – Lori Lightfoot’s decision to declare a state of emergency earlier this month, calling migrant arrivals a ‘humanitarian crisis’ and pushing for increased federal aid.

Chicago officials have said they expect a $53 million shortfall without additional aid because of the cost from housing migrants.

‘We’re in May, and we haven’t received any funding from FEMA,’ Chicago budget director Susie Park recently told the City Council, according to the Chicago Sun-Times. ‘The need is great. A lot of requests are coming in. New York is probably asking for $1 billion. There is a lot of need.’