Masked Actors

Team TNT: Could you be unknowingly mining for crypto?

Send us Fan Mail [https://www.buzzsprout.com/2489886/fan_mail/new] Cryptocurrency promised huge potential for investors. But it’s cybercriminals who are reaping the benefits. From multimillion-dollar ransomware payouts to borderless money laundering, cryptocurrency has quietly become the fuel powering a global cybercrime economy. As regulation evolves across multiple jurisdictions, gaps, inconsistencies, and the borderless nature of crypto continue to give criminal threat actors a simple workaround: move somewhere the rules don’t reach. This has created opportunities for cybercrime that groups such as TeamTNT have been quick to exploit. In this episode of Masked Actors, Group-IB’s Gary Ruddell and Nick Palmer are joined by Erica Stanford, Digital Asset, Crypto and AI Specialist at law firm CMS. She reveals the shadowy infrastructure and trail of crypto-enabled cybercrime that keeps hacking gangs like TeamTNT moving. By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world. Subscribe to learn more about Group-IB's top 10 Masked Actors [https://www.group-ib.com/masked-actors/]  - and stay one step ahead in the fight against cybercrime. FOLLOW GROUP-IB * Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFRjd1VxMGswcjk1MmtfdXI5SzVDZUNkcmRXd3xBQ3Jtc0trREZaYXZrNG9WTm14bFpOM0c4a2FjS1ZkRkJyZl9sODlWNUd4S2ROcW5MR1p3ZXZtSnhTMjIzRUgzT1gxMkdjaG1kMl9SaldBSUlxLThMd3o0TTQwdnlYZDluYU1iVUZaMW05WFZSNlhta1hVNGdpZw&q=https%3A%2F%2Fwww.x.com%2FGroupIB_TI&v=wYcEakee-gs] * Group-IB on X:  https://www.x.com/GroupIB [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXdYS3R0TkpQSTIyNVFQd0NseDlDcTZiRDZPUXxBQ3Jtc0ttX3lSb0FrVjhBVFg0WDZyVDdRSlpmdUZaUHhkUmNaaWZKV2c1YWQ3ZUd6N2JHMk5JMDBucTJqdzhUOGc4SGtRa2VQTGtPUVd0ZGZpMUp0VW1LeWhXYWw5NS1acXpwNHRpV3YzSDNpSWNPQ3RKNnZOSQ&q=https%3A%2F%2Fwww.x.com%2FGroupIB&v=wYcEakee-gs] * Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib [https://www.linkedin.com/company/group-ib] * Group-IB on Facebook: https://www.facebook.com/groupibHQ/  [https://www.facebook.com/groupibHQ/] * Group-IB on Instagram: ... [https://www.instagram.com/groupibhq/]

Boolka: The evolution of a cybercriminal enterprise

Send us Fan Mail [https://www.buzzsprout.com/2489886/fan_mail/new] If evolution has taught humanity anything, it’s that adaptation is key to survival. As prey develop camouflage techniques, predators get faster, sturdier, and better at detection. Now this game of cat and mouse is taking over the digital world.  All cybergangs are on a cycle of relentless adaptation – but a group that stands out from all the rest is Boolka, innovating near-constantly since it first landed on the cybercriminal scene in 2022. Its primary goal is to steal user data across high traffic websites – from usernames, passwords and even credit card information, and sell it for profit on the dark web.  Group-IB’s Gary Ruddell and Nick Palmer are joined by Joel Fromont, Senior Manager of the EMEA Security Specialists Solutions Architect team at AWS, where they discuss how commercially minded adversaries innovate to stay active and avoid detection, how businesses can effectively respond to such a constantly moving target, and what steps can be taken by users to protect themselves online.  By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world. Subscribe to learn more about Group-IB's top 10 Masked Actors [https://www.group-ib.com/masked-actors/]  - and stay one step ahead in the fight against cybercrime. FOLLOW GROUP-IB * Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFRjd1VxMGswcjk1MmtfdXI5SzVDZUNkcmRXd3xBQ3Jtc0trREZaYXZrNG9WTm14bFpOM0c4a2FjS1ZkRkJyZl9sODlWNUd4S2ROcW5MR1p3ZXZtSnhTMjIzRUgzT1gxMkdjaG1kMl9SaldBSUlxLThMd3o0TTQwdnlYZDluYU1iVUZaMW05WFZSNlhta1hVNGdpZw&q=https%3A%2F%2Fwww.x.com%2FGroupIB_TI&v=wYcEakee-gs] * Group-IB on X:  https://www.x.com/GroupIB [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXdYS3R0TkpQSTIyNVFQd0NseDlDcTZiRDZPUXxBQ3Jtc0ttX3lSb0FrVjhBVFg0WDZyVDdRSlpmdUZaUHhkUmNaaWZKV2c1YWQ3ZUd6N2JHMk5JMDBucTJqdzhUOGc4SGtRa2VQTGtPUVd0ZGZpMUp0VW1LeWhXYWw5NS1acXpwNHRpV3YzSDNpSWNPQ3RKNnZOSQ&q=https%3A%2F%2Fwww.x.com%2FGroupIB&v=wYcEakee-gs] * Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib [https://www.linkedin.com/company/group-ib] * Group-IB on Facebook: https://www.facebook.com/groupibHQ/  [https://www.facebook.com/groupibHQ/] * Group-IB on Instagram: ... [https://www.instagram.com/groupibhq/]

Brain Cipher: What happens when national infrastructure comes under strike?

Send us Fan Mail [https://www.buzzsprout.com/2489886/fan_mail/new] Indonesia, June 2024 - 210 critical government agencies were crippled in one fell swoop. Immigration services were in disarray; customs officers locked out of critical systems and travellers left stranded in airport and ferry terminals facing delays that would continue for a full week. The culprit? Brain Cipher, a ransomware group barely a week old, which demanded a huge sum of $8M from Indonesia’s National Data Centre, bringing local government services to their knees. The chaos that followed lingers as a potent reminder of the widespread disruption across an entire nation that can stem from a single attack. Join Group-IB’s Gary Ruddell and Nick Palmer as they talk to Jennifer Soh, Cyber Investigation Lead for APAC at Group-IB, exploring what motivates cyber criminals to target national infrastructure, and what happens when the pillars that hold up our modern digital society - from government and defence to energy- are struck by cyber-attacks. Episode links: Group-IB's Top 10 Masked Actors [https://www.group-ib.com/masked-actors/] Deciphering the Brain Cipher Ransomware [https://www.group-ib.com/blog/brain-cipher-ransomware/]Patch or Peril: A Veeam vulnerability incident [https://www.group-ib.com/blog/estate-ransomware/] By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world. Subscribe to learn more about Group-IB's top 10 Masked Actors [https://www.group-ib.com/masked-actors/]  - and stay one step ahead in the fight against cybercrime. FOLLOW GROUP-IB * Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFRjd1VxMGswcjk1MmtfdXI5SzVDZUNkcmRXd3xBQ3Jtc0trREZaYXZrNG9WTm14bFpOM0c4a2FjS1ZkRkJyZl9sODlWNUd4S2ROcW5MR1p3ZXZtSnhTMjIzRUgzT1gxMkdjaG1kMl9SaldBSUlxLThMd3o0TTQwdnlYZDluYU1iVUZaMW05WFZSNlhta1hVNGdpZw&q=https%3A%2F%2Fwww.x.com%2FGroupIB_TI&v=wYcEakee-gs] * Group-IB on X:  https://www.x.com/GroupIB [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXdYS3R0TkpQSTIyNVFQd0NseDlDcTZiRDZPUXxBQ3Jtc0ttX3lSb0FrVjhBVFg0WDZyVDdRSlpmdUZaUHhkUmNaaWZKV2c1YWQ3ZUd6N2JHMk5JMDBucTJqdzhUOGc4SGtRa2VQTGtPUVd0ZGZpMUp0VW1LeWhXYWw5NS1acXpwNHRpV3YzSDNpSWNPQ3RKNnZOSQ&q=https%3A%2F%2Fwww.x.com%2FGroupIB&v=wYcEakee-gs] * Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib [https://www.linkedin.com/company/group-ib] * Group-IB on Facebook: https://www.facebook.com/groupibHQ/  [https://www.facebook.com/groupibHQ/] * Group-IB on Instagram: ... [https://www.instagram.com/groupibhq/]

Ajina: Can you really trust that app?

Send us Fan Mail [https://www.buzzsprout.com/2489886/fan_mail/new] Cyber criminals are masters at exploiting human vulnerability and trust. In Uzbek folklore, there's a creature known for causing chaos, preying on humans, lurking in the dark and changing its face to trick its victims before it pounces.   In December 2023, it lent its name to a sophisticated Android malware campaign using the same tactics that emerged in the digital underworld. The banking malware masqueraded as legitimate applications, leaving users confused – like its folklorish namesake – and surfaced from the dark to steal everything they had. Its codename: Ajina.  Join Group-IB’s Gary Ruddell and Nick Palmer as they speak with Amy Grieveson, Director of Security and Behaviours at Monzo Bank, revealing the tricks used by financial fraudsters to get victims to hand over their most sensitive information. They discuss sophisticated social engineering deployed by cyber criminals, as well as how to flip the narrative around cyber defence from fear, to empowering consumers with the awareness and routines needed to maintain vigilance in a landscape rife with scams.  Episode links: Group-IB's Top 10 Masked Actors [https://www.group-ib.com/masked-actors/] Ajina attacks Central Asia: Story of an Uzbek Android Pandemic [https://www.group-ib.com/blog/ajina-malware/] By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world. Subscribe to learn more about Group-IB's top 10 Masked Actors [https://www.group-ib.com/masked-actors/]  - and stay one step ahead in the fight against cybercrime. FOLLOW GROUP-IB * Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFRjd1VxMGswcjk1MmtfdXI5SzVDZUNkcmRXd3xBQ3Jtc0trREZaYXZrNG9WTm14bFpOM0c4a2FjS1ZkRkJyZl9sODlWNUd4S2ROcW5MR1p3ZXZtSnhTMjIzRUgzT1gxMkdjaG1kMl9SaldBSUlxLThMd3o0TTQwdnlYZDluYU1iVUZaMW05WFZSNlhta1hVNGdpZw&q=https%3A%2F%2Fwww.x.com%2FGroupIB_TI&v=wYcEakee-gs] * Group-IB on X:  https://www.x.com/GroupIB [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXdYS3R0TkpQSTIyNVFQd0NseDlDcTZiRDZPUXxBQ3Jtc0ttX3lSb0FrVjhBVFg0WDZyVDdRSlpmdUZaUHhkUmNaaWZKV2c1YWQ3ZUd6N2JHMk5JMDBucTJqdzhUOGc4SGtRa2VQTGtPUVd0ZGZpMUp0VW1LeWhXYWw5NS1acXpwNHRpV3YzSDNpSWNPQ3RKNnZOSQ&q=https%3A%2F%2Fwww.x.com%2FGroupIB&v=wYcEakee-gs] * Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib [https://www.linkedin.com/company/group-ib] * Group-IB on Facebook: https://www.facebook.com/groupibHQ/  [https://www.facebook.com/groupibHQ/] * Group-IB on Instagram: ... [https://www.instagram.com/groupibhq/]

MuddyWater & OilRig: The cyber espionage playbook

Send us Fan Mail [https://www.buzzsprout.com/2489886/fan_mail/new] As digital infrastructure becomes the backbone of global economies, cyber espionage has quietly evolved into one of the most powerful tools in modern statecraft.  Behind the scenes, nation-backed threat groups like MuddyWater and OilRig operate sophisticated campaigns that blend malware, phishing, and social engineering to infiltrate governments, defence contractors, and critical industries. But these Advanced Persistent Threat groups aren’t motivated by fame or by fortune. They’re after insights on matters of national security, looking for long-term access to strategic intelligence, and preparing tactical disruption of their adversaries.   In this episode, Group-IB’s Gary Ruddell and Nick Palmer speak with Mansour Alhmoud, a cyber threat intelligence analyst at Group-IB responsible for tracking APT groups, to unearth how these groups operate and what organizations and governments should be doing to protect themselves against state-sponsored threats. Episode links: Group-IB's Top 10 Masked Actors [https://www.group-ib.com/masked-actors/] Catching fish in muddy waters [https://www.group-ib.com/blog/muddywater/] ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims [https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/] SimpleHarm: Tracking MuddyWater’s infrastructure "We find many things that others do not even see" [https://www.group-ib.com/blog/rostovtsev/]Mapping the Infrastructure and Malware Ecosystem of MuddyWater [https://www.group-ib.com/blog/muddywater-infrastructure-malware/] By understanding who these actors are and how they operate, you can better anticipate threats and protect yourself in an increasingly hostile digital world. Subscribe to learn more about Group-IB's top 10 Masked Actors [https://www.group-ib.com/masked-actors/]  - and stay one step ahead in the fight against cybercrime. FOLLOW GROUP-IB * Group-IB Threat Intelligence on X:   https://www.x.com/GroupIB_TI [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbFRjd1VxMGswcjk1MmtfdXI5SzVDZUNkcmRXd3xBQ3Jtc0trREZaYXZrNG9WTm14bFpOM0c4a2FjS1ZkRkJyZl9sODlWNUd4S2ROcW5MR1p3ZXZtSnhTMjIzRUgzT1gxMkdjaG1kMl9SaldBSUlxLThMd3o0TTQwdnlYZDluYU1iVUZaMW05WFZSNlhta1hVNGdpZw&q=https%3A%2F%2Fwww.x.com%2FGroupIB_TI&v=wYcEakee-gs] * Group-IB on X:  https://www.x.com/GroupIB [https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqbXdYS3R0TkpQSTIyNVFQd0NseDlDcTZiRDZPUXxBQ3Jtc0ttX3lSb0FrVjhBVFg0WDZyVDdRSlpmdUZaUHhkUmNaaWZKV2c1YWQ3ZUd6N2JHMk5JMDBucTJqdzhUOGc4SGtRa2VQTGtPUVd0ZGZpMUp0VW1LeWhXYWw5NS1acXpwNHRpV3YzSDNpSWNPQ3RKNnZOSQ&q=https%3A%2F%2Fwww.x.com%2FGroupIB&v=wYcEakee-gs] * Group-IB on LinkedIn:  https://www.linkedin.com/company/group-ib [https://www.linkedin.com/company/group-ib] * Group-IB on Facebook: https://www.facebook.com/groupibHQ/  [https://www.facebook.com/groupibHQ/] * Group-IB on Instagram: ... [https://www.instagram.com/groupibhq/]