briankrebs

briankrebs


Independent investigative journalist. Writes about cybercrime. Author of 'Spam Nation', a NYT bestseller. Wrote for The Washington Post '95-'09

290171 followers  •  1562 follow  •  Eastern Time (US & Canada)  •   http://krebsonsecurity.com

In 2012 I wrote about an infamous Chinese hacker who was secretly behind a backdoored antivirus product called Anvisoft. He and 6 others were just indicted as APT41, a prolific hacking group that used supply chain attacks & spear phishing to spread malware

Fascinating writeup from Chainanalysis on DOJ civil forfeiture complaint against holders of 280 cryptocurrency addresses involved in laundering ~ $28M worth of cryptocurrency stolen by North Korea-affiliated hackers known as Lazarus Group.

Apropos of Friday's story, looks like Twilio just gave Sendgrid users until Oct. 12, 2020 to enable Authy or some kind of 2FA. h/t @GossiTheDog 

tweet picture

When you own a short email address at a big mail provider, you are bound to get gobs of spam. But there is also a puzzling side to all this noise: Random people tend to use your account as if it were theirs, often for some fairly sensitive services online.

tweet picture

It appears Merrill Lynch is having some connectivity/login issues for the last couple of hours. Not great news for people spooked by the steep market decline today.

US Treasury Dept's Financial Crimes Enforcement Network says we can expect some media reports about the leak or theft of anti-money laundering reports (a.k.a. "suspicious activity reports or SARs). No word yet how extensive the leak or theft may be

@madracer23  Maybe something about how so much identity fraud right now completely bypasses the bureaus, through neobanks and prepaid networks. Or how the bureaus will remain relevant in 5-10 years.

Most of us put our guard up when someone we don't know promises something too good to be true. But when the too-good-to-be-true thing starts as our idea, sometimes that instinct fails to kick in. How companies looking for investors can get snookered:

It's very likely the same guy. Anvisoft was found to be bundled with at least two infostealer trojans that siphoned credentials for computer game accounts, and the DOJ action said they were specifically targeting gaming companies. See this comment:

Loading
Loading

Western Union to forfeit $586M to settle charges with US Govt over alleged money laundering for human trafficking

ICYMI, Equifax forced to pull offline a huge database of consumer data guarded only by credentials "admin/admin"

Fun fact: CIA unit exposed by Wikileaks was tasked w/ crafting cyber response to Russia's alleged election meddling

Sources say Microsoft on Tuesday will fix an extraordinarily scary flaw in all Windows versions, in a core cryptographic component that could be abused to spoof the source of digitally signed software. Apparently DoD & a few others got an advance patch

I never do this, but this is important so please RT if you agree: It's not okay for my mobile provider to sell or give my mobile device location info to a 3rd party without at least a court order/subpoena. Background: and

tweet picture

Bring on the bots and sock puppet accounts. Amazing how a tweet about Putin always engenders defensive responses about Trump.

Who Is Marcus Hutchins, the man credited with stopping WannaCry and charged w/ authoring Kronos banking trojan?

Predictably, the Zoom hearing for the 17-year-old alleged Twitter hacker in Fla. was bombed multiple times, with the final bombing of a pornhub clip ending the zoom portion of the proceedings.

Exclusive: Facebook stored hundreds of millions of user passwords in plain text for years

tweet picture

Loading
Loading