Ransomware, Iranian Hackers & Pornography
Ransomware gangs have increasingly focused on high-profile targets like large corporations and government institutions in the past year, according to Europol’s Internet Organised Crime Threat Assessment 2021 report, and Covid -19 has helped to fuel the increase in cyber crime.
Europol's report offers insights into current cyber crime trends in Europe, revealed that ransomware actors have taken advantage of widespread homeworking to launch more sophisticated and targeted attacks.
The accelerated digitalisation of everyday life related to the pandemic has significantly influenced the development of a number of cyber threats, including:
- Ransomware affiliate programs enable a larger group of criminals to attack big corporations and public institutions by threatening them with multi-layered extortion methods such as DDoS attacks.
- Mobile malware evolves with criminals trying to circumvent additional security measures such as two-factor authentication.
- Online shopping has led to a steep increase in online fraud.
- Explicit self-generated sexual material is an increasing concern and is distributed for profit.
- Criminals continue to abuse legitimate services such as VPNs, encrypted communication services and crypto-currencies.
Now, Microsoft researchers have discovered that as many as six different Iranian hacker groups are behind several new waves of ransomware attacks that have been identified every six to eight weeks since the end of 2020.
The Iranian hackers are allegedly deploying ransomware to disrupt targets or to collect funds. Microsoft says that the hacking groups are persistent and prepared to use aggressive brute-force attacks to achieve their goals. According to Microsoft, the most consistent of the groups tracked by the cybersecurity firm is called Phosphorus or APT35 and they have ben tracking the group for the past two years.
Phosphorus was initially known for cyber espionage, however, the group has shifted towards ransomware attacks using Microsoft’s Windows disk-encryption tool BitLocker to encrypt victim files.
Europol have also highlighted the growing use of multi-layered extortion methods to extort service providers, financial institutions and businesses, such as DDoS attacks. Additionally, they observed that cyber-criminals have increasingly recognised the potential to attack a large number of organisations via supply chain attacks, often targeting the ‘weakest link.’ The Kaseya and SolarWinds incidents are prominent examples of this trend.
Another concerning finding in the report was an “alarming” rise in self-produced explicit material of children online.
This has been driven by increased unsupervised internet use by children in the pandemic. The authors said children were frequently lured into producing and sharing explicit material of themselves by offenders using fake identities on gaming platforms and social media sites. Additionally, some offenders recorded or captured victims performing live-streamed sexual acts for them without the victims’ knowledge.
- Other notable trends in the past year included fraudsters continuing to leverage the COVID-19 crisis and increased online shopping to scam victims.
- There has also been an evolution in mobile malware, with cyber criminals trying to find ways to circumvent additional security measures such as two-factor authentication.
Microsoft's findings suggest that the adoption of ransomware has supported Iranian hackers' efforts in espionage, disruption and destruction and to support physical operations. Their well-stocked toolbox includes ransomware, disk wipers, mobile malware, phishing, password-spray attacks, mass exploitation of vulnerabilities and supply chain attacks.
EUROPOL: ZDNet: Oodaloop: Infosecurity Magazine: BlackWeb: Microsoft:
You Might Also Read:
