A team of vigilante hackers known as One Fist has been recognised by Ukraine's military for their cyber-attacks against Russia. The group that has been involved in stealing data from Russian military firms and hacking cameras to spy on troops has reportedly been sent awards of gratitude for its efforts.

While many nations have official award systems for ethical hacking, this is believed to be the first time a country has awarded hackers for such actions.

<h2>Gratitude for hacking</h2>

As per a BBC report, the certificates of gratitude were sent to the hackers from eight different countries, including the UK, the US, and Poland, for their "significant contribution to the development and maintenance of vital activities of the military".

Also read |&nbsp;<a href="https://www.wionews.com/india-news/russian-deputy-envoy-roman-babushkin-calls-india-a-space-superpower-indicates-support-for-gaganyaan-707451">Russian Deputy Envoy Roman Babushkin calls India a space superpower, indicates support for Gaganyaan</a>

One of the hackers, US man Kristopher Kortright, aka "Voltage," told BBC he was delighted at being officially recognised.

'Voltage' said he has devoted himself to hacking for Ukraine, even at the cost of losing his job and spending all his life's savings.

"I've lost my job doing this and spent all my life savings in pursuit of a victory for Ukraine," he said, adding, "This award is a real morale-booster."

<h2>Concerns around rewarding hacking</h2>

There are concerns about the practice of states encouraging civilian hackers, especially for malicious and possibly criminal hacks.

As per Dr Lukasz Olejnik, author of Philosophy of Cyber-security, such awards can be "dangerous".

Also read |&nbsp;<a href="https://www.wionews.com/world/finland-mass-shooting-finnish-police-say-the-minor-behind-school-shooting-was-target-of-bullying-707425">Finland mass shooting: Finnish police say the minor behind school shooting was target of bullying</a>

"Giving out awards may further blur the lines between combatants and civilians, and even undermine the recent call by the ICRC to limit and end the involvement of civilians in combat operations. In the long run, such an erosion is dangerous," he said.

Emily Taylor, the chief executive of Oxford Information Labs and editor of Chatham House Cyber Policy journal believes that the hacking awards are a landmark moment that might shift thinking about how cyber volunteers are used in conflicts.

"Governments usually discourage non-state actors from taking direct action in the cyber domain, for fear of escalation or unintended consequences, but wartime is often a period of extraordinary technological innovation, and the Ukraine invasion is no exception."

"Sometimes these events force a reconsideration of issues that have previously been taboo," she remarked.

Previously, in October, the International Committee of the Red Cross (ICRC) warned against the use and encouragement of civilian hackers. Emphasising the need to uphold the rules of war, it even published guidelines to reinforce them.

(With inputs from agencies)

A team of vigilante hackers known as One Fist has been recognised by Ukraine's military for their cyber-attacks against Russia. The group that has been involved in stealing data from Russian military firms and hacking cameras to spy on troops has reportedly been sent awards of gratitude for its efforts.

A team of vigilante hackers known as One Fist has been recognised by Ukraine's military for their cyber-attacks against Russia. The group that has been involved in stealing data from Russian military firms and hacking cameras to spy on troops has reportedly been sent awards of gratitude for its efforts. While many nations have official award systems for ethical hacking, this is believed to be the first time a country has awarded hackers for such actions. Gratitude for hacking As per a BBC report, the certificates of gratitude were sent to the hackers from eight different countries, including the UK, the US, and Poland, for their "significant contribution to the development and maintenance of vital activities of the military". Also read | Russian Deputy Envoy Roman Babushkin calls India a space superpower, indicates support for Gaganyaan One of the hackers, US man Kristopher Kortright, aka "Voltage," told BBC he was delighted at being officially recognised. 'Voltage' said he has devoted himself to hacking for Ukraine, even at the cost of losing his job and spending all his life's savings. "I've lost my job doing this and spent all my life savings in pursuit of a victory for Ukraine," he said, adding, "This award is a real morale-booster." Concerns around rewarding hacking There are concerns about the practice of states encouraging civilian hackers, especially for malicious and possibly criminal hacks. As per Dr Lukasz Olejnik, author of Philosophy of Cyber-security, such awards can be "dangerous". Also read | Finland mass shooting: Finnish police say the minor behind school shooting was target of bullying "Giving out awards may further blur the lines between combatants and civilians, and even undermine the recent call by the ICRC to limit and end the involvement of civilians in combat operations. In the long run, such an erosion is dangerous," he said. Emily Taylor, the chief executive of Oxford Information Labs and editor of Chatham House Cyber Policy journal believes that the hacking awards are a landmark moment that might shift thinking about how cyber volunteers are used in conflicts. "Governments usually discourage non-state actors from taking direct action in the cyber domain, for fear of escalation or unintended consequences, but wartime is often a period of extraordinary technological innovation, and the Ukraine invasion is no exception." "Sometimes these events force a reconsideration of issues that have previously been taboo," she remarked. Previously, in October, the International Committee of the Red Cross (ICRC) warned against the use and encouragement of civilian hackers. Emphasising the need to uphold the rules of war, it even published guidelines to reinforce them. (With inputs from agencies)

Ukraine hands out awards to vigilante hackers for cyber-attacks against Russia

Hackers have targeted one of Australia's largest pathology providers and stolen medical data of thousands of patients, the second such breach in the country within two weeks, deepening fears about how companies collect and secure sensitive information of their customers, reported&nbsp;Reuters. 
 
The revelation on Thursday further extends the wave of hackings that have shaken the country's biggest companies and shares of Australian Clinical Labs Ltd tanked to their lowest point since listing last year. A day earlier, Australia’s No. 1 health insurer Medibank Private Ltd had reported that hackers had stolen personal data of its all four million customers. 
 
ACL said on Thursday that it first learnt of the unauthorised access to the IT system of its pathology unit, Medlab, in February and received advice that no information was compromised, but the government cybersecurity agency notified it in June that its data had been posted on the dark web, a system of websites only accessible through certain browsers. 
 
ALSO READ |&nbsp;&nbsp;<a href="https://www.wionews.com/world/australias-biggest-health-insurer-medibank-reports-huge-data-breach-527061">Australia's biggest health insurer Medibank reports huge data breach</a> 
 
ACL then hired forensic analysts to study the "complex and unstructured" data-set found there and gathered that data of 223,000 patients had been exposed in the breach, and it included the medical and health records of about 18,000 people, said the Reuters report. 
 
“There was no ransom demand or evidence of data misuse, but we recognise the concern and inconvenience this incident may cause to those who have used Medlab's services and have taken steps to identify individuals affected,” ACL Chief Executive Officer Melinda McGrath said in a statement. 
 
Companies in Australia have been bracing since Sept. 22, when the country's second-largest telco, Singapore Telecommunications Ltd-owned Optus, disclosed a security breach and theft of personal data of nearly 10 million customer accounts, equivalent to 40% of the country's population. 
 
ALSO READ |&nbsp;<a href="https://www.wionews.com/world/australia-to-bring-legislation-for-tougher-penalties-on-data-breaches-527711">Australia to bring legislation for tougher penalties on hackers for data breaches</a> 
 
Grocery chain Woolworths Group Ltd also shared that the data of millions of customers using its bargain shopping website had been compromised. Several smaller and unlisted companies also revealed data breaches by hackers, prompting lawyers to question the amount of data that private enterprises should collect, and store for how long.

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

Hackers have targeted one of Australia's largest pathology providers and stolen medical data of thousands of patients, the second such breach in the country within two weeks, deepening fears about how companies collect and secure sensitive information of their customers, reported Reuters.

Hackers have targeted one of Australia's largest pathology providers and stolen medical data of thousands of patients, the second such breach in the country within two weeks, deepening fears about how companies collect and secure sensitive information of their customers, reported Reuters. The revelation on Thursday further extends the wave of hackings that have shaken the country's biggest companies and shares of Australian Clinical Labs Ltd tanked to their lowest point since listing last year. A day earlier, Australia’s No. 1 health insurer Medibank Private Ltd had reported that hackers had stolen personal data of its all four million customers. ACL said on Thursday that it first learnt of the unauthorised access to the IT system of its pathology unit, Medlab, in February and received advice that no information was compromised, but the government cybersecurity agency notified it in June that its data had been posted on the dark web, a system of websites only accessible through certain browsers. ALSO READ | Australia's biggest health insurer Medibank reports huge data breach ACL then hired forensic analysts to study the "complex and unstructured" data-set found there and gathered that data of 223,000 patients had been exposed in the breach, and it included the medical and health records of about 18,000 people, said the Reuters report. “There was no ransom demand or evidence of data misuse, but we recognise the concern and inconvenience this incident may cause to those who have used Medlab's services and have taken steps to identify individuals affected,” ACL Chief Executive Officer Melinda McGrath said in a statement. Companies in Australia have been bracing since Sept. 22, when the country's second-largest telco, Singapore Telecommunications Ltd-owned Optus, disclosed a security breach and theft of personal data of nearly 10 million customer accounts, equivalent to 40% of the country's population. ALSO READ | Australia to bring legislation for tougher penalties on hackers for data breaches Grocery chain Woolworths Group Ltd also shared that the data of millions of customers using its bargain shopping website had been compromised. Several smaller and unlisted companies also revealed data breaches by hackers, prompting lawyers to question the amount of data that private enterprises should collect, and store for how long. You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here. WATCH WION LIVE HERE

Hacking scourge widens in Australia, data of 223,000 patients stolen at pathology providers

When cybersleuths traced the millions of dollars American companies, hospitals and city governments have paid to online extortionists in ransom money, they made a telling discovery: At least some of it passed through one of the most prestigious business addresses in Moscow.

The Biden administration has also zeroed in on the building, Federation Tower East, the tallest skyscraper in the Russian capital. The United States has targeted several companies in the tower as it seeks to penalize Russian ransomware gangs, which encrypt their victims’ digital data and then demand payments to unscramble it.

Those payments are typically made in cryptocurrencies, virtual currencies like Bitcoin, which the gangs then need to convert to standard currencies, like dollars, euros and rubles.

That this high-rise in Moscow’s financial district has emerged as an apparent hub of such money laundering has convinced many security experts that Russian authorities tolerate ransomware operators. The targets are almost exclusively outside Russia, they point out, and in at least one case documented in a U.S. sanctions announcement, the suspect was assisting a Russian espionage agency.

“It says a lot,” said Dmitry Smilyanets, a threat intelligence expert with the Massachusetts-based cybersecurity firm Recorded Future. “Russian law enforcement usually has an answer: ‘There is no case open in Russian jurisdiction. There are no victims. How do you expect us to prosecute these honorable people?’”

Recorded Future has counted about 50 cryptocurrency exchanges in Moscow City, a financial district in the capital, that in its assessment are engaged in illicit activity. Other exchanges in the district are not suspected of accepting cryptocurrencies linked to crime.

Cybercrime is just one of many issues fueling tensions between Russia and the United States, along with the Russian military buildup near Ukraine and a recent migrant crisis on the Belarus-Polish border.

The Treasury Department has estimated that Americans have paid $1.6 billion in ransoms since 2011. One Russian ransomware strain, Ryuk, made an estimated $162 million last year encrypting the computer systems of American hospitals during the pandemic and demanding fees to release the data, according to Chainalysis, a company tracking cryptocurrency transactions.

The hospital attacks cast a spotlight on the rapidly expanding criminal industry of ransomware, which is based primarily in Russia. Criminal syndicates have become more efficient, and brazen, in what has become a conveyor-belt-like process of hacking, encrypting and then negotiating for ransom in cryptocurrencies, which can be owned anonymously.

At a summit meeting in June, President Joe Biden pressed President Vladimir Putin of Russia to crack down on ransomware after a Russian gang, DarkSide, attacked a major gasoline pipeline on the East Coast, Colonial Pipeline, disrupting supplies and creating lines at gas stations.

U.S. officials point to people like Maksim Yakubets, a skinny 34-year-old with a pompadour haircut whom the United States has identified as a kingpin of a major cybercrime operation calling itself Evil Corp. Cybersecurity analysts have linked his group to a series of ransomware attacks, including one last year targeting the National Rifle Association. A U.S. sanctions announcement accused Yakubets of also assisting Russia’s Federal Security Service, the main successor to the KGB.

But after the State Department announced a $5 million bounty for information leading to his arrest, Yakubets seemed only to flaunt his impunity in Russia: He was photographed driving in Moscow in a Lamborghini partially painted fluorescent yellow.

The cluster of suspected cryptocurrency exchanges in Federation Tower East, first reported last month by Bloomberg News, further illustrates how the Russian ransomware industry hides in plain sight.

The 97-floor, glass-and-steel high-rise resting on a bend in the Moscow River stands within sight of several government ministries in the financial district, including the Russian Ministry of Digital Development, Signals and Mass Communications.

Two of the Biden administration’s most forceful actions to date targeting ransomware are linked to the tower. In September, the Treasury Department imposed sanctions on a cryptocurrency exchange called Suex, which has offices on the 31st floor. It accused the company of laundering $160 million in illicit funds.

In an interview at the time, a founder of Suex, Vasily Zhabykin, denied any illegal activity.

And last month, Russian news media outlets reported that Dutch police, using a U.S. extradition warrant, had detained the owner, Denis Dubnikov, of another firm called EggChange, with an office on the 22nd floor. In a statement issued by one of his companies, Dubnikov denied any wrongdoing.

Ransomware is attractive to criminals, cybersecurity experts say, because the attacks take place mostly anonymously and online, minimizing the chances of getting caught. It has mushroomed into a sprawling, highly compartmentalized industry in Russia known to cybersecurity researchers as “ransomware as a service.”

The organizational structure mimics franchises, like McDonald’s or Hertz, that lower barriers to entry, allowing less sophisticated hackers to use established business practices to get into the business. Several high-level gangs develop software and promote fearsome-sounding brands, such as DarkSide or Maze, to intimidate businesses and other organizations that are targets. Other groups that are only loosely related hack into computer systems using the brand and franchised software.

The industry’s growth has been abetted by the rise of cryptocurrencies. That has made old-school money mules, who sometimes had to smuggle cash across borders, practically obsolete.

Laundering the cryptocurrency through exchanges is the final step, and also the most vulnerable, because criminals must exit the anonymous online world to appear at a physical location, where they trade Bitcoin for cash or deposit it in a bank.

The exchange offices are “the end of the Bitcoin and ransomware rainbow,” said Gurvais Grigg, a former FBI agent who is a researcher with Chainalysis, the cryptocurrency tracking company.

The computer codes in virtual currencies allow transactions to be tracked from one user to another, even if the owners’ identities are anonymous, until the cryptocurrency reaches an exchange. There, in theory, records should link the cryptocurrency with a real person or company.

“They are really one of the key points in the whole ransomware strain,” Grigg said of the exchange offices. Ransomware gangs, he said, “want to make money. And until you cash it out, and you get it through an exchange at a cash-out point, you cannot spend it.”

It is at this point, cybersecurity experts say, that criminals should be identified and apprehended. But the Russian government has allowed the exchanges to flourish, saying that it only investigates cybercrime if Russian laws are violated. Regulations are a gray area in Russia, as elsewhere, in the nascent industry of cryptocurrency trading.

Russian cryptocurrency traders say the United States is imposing an unfair burden of due diligence on their companies, given the quickly evolving nature of regulations.

“The people who are real criminals, who create ransomware, and the people working in Moscow City are completely different people,” Sergei Mendeleyev, a founder of one trader based in Federation Tower East, Garantex, said in an interview. The Russian crypto exchanges, he said, were blamed for crimes they are unaware of.

Mendeleyev, who no longer works at the company, said American cryptocurrency tracking services provide data to non-Russian exchanges to help them avoid illicit transactions but have refused to work with Russian traders — in part because they suspect the traders might use the information to tip off criminals. That complicates the Russian companies’ efforts to root out illegal activity.

He conceded that not all Russian exchanges tried very hard. Some based in Moscow’s financial district were little more than an office, a safe full of cash and a computer, he said.

At least 15 cryptocurrency exchanges are based in Federation Tower East, according to a list of businesses in the building compiled by Yandex, a Russian mapping service.

In addition to Suex and EggChange, the companies targeted by the Biden administration, cyber researchers and an international cryptocurrency exchange company have flagged two other building tenants that they suspect of illegal activity involving Bitcoin.

The building manager, Aeon Corp., did not respond to inquiries about the exchanges in its offices.

Like the banks and insurance companies they share space with, those firms are likely to have chosen the site for its status and its stringent building security, said Smilyanets, the researcher at Recorded Future.

“The Moscow City skyscrapers are very fancy,” he said. “They can post on Instagram with these beautiful sights, beautiful skyscrapers. It boosts their legitimacy.”

When cybersleuths traced the millions of dollars American companies, hospitals and city governments have paid to online extortionists in ransom money, they made a telling discovery: At least some of it passed through one of the most prestigious business addresses in Moscow.

When cybersleuths traced the millions of dollars American companies, hospitals and city governments have paid to online extortionists in ransom money, they made a telling discovery: At least some of it passed through one of the most prestigious business addresses in Moscow. The Biden administration has also zeroed in on the building, Federation Tower East, the tallest skyscraper in the Russian capital. The United States has targeted several companies in the tower as it seeks to penalize Russian ransomware gangs, which encrypt their victims’ digital data and then demand payments to unscramble it. Those payments are typically made in cryptocurrencies, virtual currencies like Bitcoin, which the gangs then need to convert to standard currencies, like dollars, euros and rubles. That this high-rise in Moscow’s financial district has emerged as an apparent hub of such money laundering has convinced many security experts that Russian authorities tolerate ransomware operators. The targets are almost exclusively outside Russia, they point out, and in at least one case documented in a U.S. sanctions announcement, the suspect was assisting a Russian espionage agency. “It says a lot,” said Dmitry Smilyanets, a threat intelligence expert with the Massachusetts-based cybersecurity firm Recorded Future. “Russian law enforcement usually has an answer: ‘There is no case open in Russian jurisdiction. There are no victims. How do you expect us to prosecute these honorable people?’” Recorded Future has counted about 50 cryptocurrency exchanges in Moscow City, a financial district in the capital, that in its assessment are engaged in illicit activity. Other exchanges in the district are not suspected of accepting cryptocurrencies linked to crime. Cybercrime is just one of many issues fueling tensions between Russia and the United States, along with the Russian military buildup near Ukraine and a recent migrant crisis on the Belarus-Polish border. The Treasury Department has estimated that Americans have paid $1.6 billion in ransoms since 2011. One Russian ransomware strain, Ryuk, made an estimated $162 million last year encrypting the computer systems of American hospitals during the pandemic and demanding fees to release the data, according to Chainalysis, a company tracking cryptocurrency transactions. The hospital attacks cast a spotlight on the rapidly expanding criminal industry of ransomware, which is based primarily in Russia. Criminal syndicates have become more efficient, and brazen, in what has become a conveyor-belt-like process of hacking, encrypting and then negotiating for ransom in cryptocurrencies, which can be owned anonymously. At a summit meeting in June, President Joe Biden pressed President Vladimir Putin of Russia to crack down on ransomware after a Russian gang, DarkSide, attacked a major gasoline pipeline on the East Coast, Colonial Pipeline, disrupting supplies and creating lines at gas stations. U.S. officials point to people like Maksim Yakubets, a skinny 34-year-old with a pompadour haircut whom the United States has identified as a kingpin of a major cybercrime operation calling itself Evil Corp. Cybersecurity analysts have linked his group to a series of ransomware attacks, including one last year targeting the National Rifle Association. A U.S. sanctions announcement accused Yakubets of also assisting Russia’s Federal Security Service, the main successor to the KGB. But after the State Department announced a $5 million bounty for information leading to his arrest, Yakubets seemed only to flaunt his impunity in Russia: He was photographed driving in Moscow in a Lamborghini partially painted fluorescent yellow. The cluster of suspected cryptocurrency exchanges in Federation Tower East, first reported last month by Bloomberg News, further illustrates how the Russian ransomware industry hides in plain sight. The 97-floor, glass-and-steel high-rise resting on a bend in the Moscow River stands within sight of several government ministries in the financial district, including the Russian Ministry of Digital Development, Signals and Mass Communications. Two of the Biden administration’s most forceful actions to date targeting ransomware are linked to the tower. In September, the Treasury Department imposed sanctions on a cryptocurrency exchange called Suex, which has offices on the 31st floor. It accused the company of laundering $160 million in illicit funds. In an interview at the time, a founder of Suex, Vasily Zhabykin, denied any illegal activity. And last month, Russian news media outlets reported that Dutch police, using a U.S. extradition warrant, had detained the owner, Denis Dubnikov, of another firm called EggChange, with an office on the 22nd floor. In a statement issued by one of his companies, Dubnikov denied any wrongdoing. Ransomware is attractive to criminals, cybersecurity experts say, because the attacks take place mostly anonymously and online, minimizing the chances of getting caught. It has mushroomed into a sprawling, highly compartmentalized industry in Russia known to cybersecurity researchers as “ransomware as a service.” The organizational structure mimics franchises, like McDonald’s or Hertz, that lower barriers to entry, allowing less sophisticated hackers to use established business practices to get into the business. Several high-level gangs develop software and promote fearsome-sounding brands, such as DarkSide or Maze, to intimidate businesses and other organizations that are targets. Other groups that are only loosely related hack into computer systems using the brand and franchised software. The industry’s growth has been abetted by the rise of cryptocurrencies. That has made old-school money mules, who sometimes had to smuggle cash across borders, practically obsolete. Laundering the cryptocurrency through exchanges is the final step, and also the most vulnerable, because criminals must exit the anonymous online world to appear at a physical location, where they trade Bitcoin for cash or deposit it in a bank. The exchange offices are “the end of the Bitcoin and ransomware rainbow,” said Gurvais Grigg, a former FBI agent who is a researcher with Chainalysis, the cryptocurrency tracking company. The computer codes in virtual currencies allow transactions to be tracked from one user to another, even if the owners’ identities are anonymous, until the cryptocurrency reaches an exchange. There, in theory, records should link the cryptocurrency with a real person or company. “They are really one of the key points in the whole ransomware strain,” Grigg said of the exchange offices. Ransomware gangs, he said, “want to make money. And until you cash it out, and you get it through an exchange at a cash-out point, you cannot spend it.” It is at this point, cybersecurity experts say, that criminals should be identified and apprehended. But the Russian government has allowed the exchanges to flourish, saying that it only investigates cybercrime if Russian laws are violated. Regulations are a gray area in Russia, as elsewhere, in the nascent industry of cryptocurrency trading. Russian cryptocurrency traders say the United States is imposing an unfair burden of due diligence on their companies, given the quickly evolving nature of regulations. “The people who are real criminals, who create ransomware, and the people working in Moscow City are completely different people,” Sergei Mendeleyev, a founder of one trader based in Federation Tower East, Garantex, said in an interview. The Russian crypto exchanges, he said, were blamed for crimes they are unaware of. Mendeleyev, who no longer works at the company, said American cryptocurrency tracking services provide data to non-Russian exchanges to help them avoid illicit transactions but have refused to work with Russian traders — in part because they suspect the traders might use the information to tip off criminals. That complicates the Russian companies’ efforts to root out illegal activity. He conceded that not all Russian exchanges tried very hard. Some based in Moscow’s financial district were little more than an office, a safe full of cash and a computer, he said. At least 15 cryptocurrency exchanges are based in Federation Tower East, according to a list of businesses in the building compiled by Yandex, a Russian mapping service. In addition to Suex and EggChange, the companies targeted by the Biden administration, cyber researchers and an international cryptocurrency exchange company have flagged two other building tenants that they suspect of illegal activity involving Bitcoin. The building manager, Aeon Corp., did not respond to inquiries about the exchanges in its offices. Like the banks and insurance companies they share space with, those firms are likely to have chosen the site for its status and its stringent building security, said Smilyanets, the researcher at Recorded Future. “The Moscow City skyscrapers are very fancy,” he said. “They can post on Instagram with these beautiful sights, beautiful skyscrapers. It boosts their legitimacy.”

Companies linked to Russian ransomware hide in plain sight

A group of hackers have leaked personal information, appointment details and test results of nearly 290,000 patients of Israel's Machon Mor medical institute.<o:p></o:p>

Black Shadow, a hacker group linked to Iran, uploaded the directory of patients of an Israeli hospital on Tuesday night. As per the local reports, the data released in public includes names, personal information, vaccine status, appointments and medical test results of more than 290,000 patients of a specific medical center.<o:p></o:p>

Describing this as "one of the most serious attacks on privacy that Israel has ever seen,"&nbsp;the Head of the Israel Internet Association Yoram Hacohen told the Times of Israel that "Israeli citizens are experiencing cyber terrorism... This is terrorism in every sense and the focus now must be on minimizing the damage and suppressing the distribution of the information as much as possible."

<o:p>Also read |&nbsp;<a href="https://www.wionews.com/world/watch-you-are-the-most-popular-man-in-israel-come-and-join-my-party-israeli-pm-naftali-bennett-tells-modi-426193">Watch: You are the most popular man in Israel, come and join my party, Israeli PM Naftali Bennett tells Modi</a></o:p>

He also blamed Telegram for the increase in hacking activities in the country. The chief said that Telegram has failed to establish boundaries and is partially responsible for this as the social media platform does not limit the spread of private information.<o:p></o:p>

This hack of patients' records comes a few hours after the same hacker group released the whole user database of an LGBTQ dating website of the country.<o:p></o:p>

The Iran-backed group, Black Shadow, uploaded information from the database of Atraf LGBTQ dating website on Telegram, during the early hours of Tuesday. The information released included sensitive details about users such as name, age, location, HIV status and more.

<o:p><a href="https://www.wionews.com/videos/cop26-climate-conference-israel-energy-minister-on-wheelchair-stranded-at-glasgow-426134">WATCH |</a></o:p>

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/cop26-climate-conference-israel-energy-minister-on-wheelchair-stranded-at-glasgow-426134/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

This was done by Black Shadow as a punishment to the dating website as the owners of the dating platform had refused to pay a ransom of $1 million in digital currency that the hackers had demanded, in exchange of giving up the private information safely.<o:p></o:p>

In addition to this, the group had also hacked the systems of Israeli internet hosting company, CyberServe, which had adversely affected the LGBTQ dating website, websites of tourism company Pegasus, public transportation company Dan and children's museum Kavim.<o:p></o:p>

Israel claims they are being targeted with cyber crime more frequently now, especially since Iran’s gas distribution system had suffered a major loss due to a similar hack on October 26 — Iran had blamed the US and Israel for their loss.<o:p></o:p>

A group of hackers have leaked personal information, appointment details and test results of nearly 290,000 patients of Israel's Machon Mor medical institute. Black Shadow, a hacker group linked to Iran, uploaded the directory of patients of an Israeli hospital on Tuesday night.

A group of hackers have leaked personal information, appointment details and test results of nearly 290,000 patients of Israel's Machon Mor medical institute. Black Shadow, a hacker group linked to Iran, uploaded the directory of patients of an Israeli hospital on Tuesday night. As per the local reports, the data released in public includes names, personal information, vaccine status, appointments and medical test results of more than 290,000 patients of a specific medical center. Describing this as "one of the most serious attacks on privacy that Israel has ever seen," the Head of the Israel Internet Association Yoram Hacohen told the Times of Israel that "Israeli citizens are experiencing cyber terrorism... This is terrorism in every sense and the focus now must be on minimizing the damage and suppressing the distribution of the information as much as possible." Also read | Watch: You are the most popular man in Israel, come and join my party, Israeli PM Naftali Bennett tells Modi He also blamed Telegram for the increase in hacking activities in the country. The chief said that Telegram has failed to establish boundaries and is partially responsible for this as the social media platform does not limit the spread of private information. This hack of patients' records comes a few hours after the same hacker group released the whole user database of an LGBTQ dating website of the country. The Iran-backed group, Black Shadow, uploaded information from the database of Atraf LGBTQ dating website on Telegram, during the early hours of Tuesday. The information released included sensitive details about users such as name, age, location, HIV status and more. WATCH | This was done by Black Shadow as a punishment to the dating website as the owners of the dating platform had refused to pay a ransom of $1 million in digital currency that the hackers had demanded, in exchange of giving up the private information safely. In addition to this, the group had also hacked the systems of Israeli internet hosting company, CyberServe, which had adversely affected the LGBTQ dating website, websites of tourism company Pegasus, public transportation company Dan and children's museum Kavim. Israel claims they are being targeted with cyber crime more frequently now, especially since Iran’s gas distribution system had suffered a major loss due to a similar hack on October 26 — Iran had blamed the US and Israel for their loss.

Israel: Iran-based hacker group leaks private information of 290,000 patients

At least 10 different hacking groups are using recently discovered flaws in Microsoft Corp`s mail server software to break in to targets around the world, cybersecurity company ESET said in a blog post on Wednesday.

The breadth of the exploitation adds to the urgency of the warnings being issued by authorities in the United States and Europe about the weaknesses found in Microsoft`s Exchange software.

The security holes in the widely used mail and calendaring solution leave the door open to industrial-scale cyber espionage, allowing malicious actors to steal emails virtually at will from vulnerable servers or move elsewhere in the network. Tens of thousands of organizations have already been compromised, Reuters reported last week, and new victims are being made public daily.

Earlier on Wednesday, for example, Norway`s parliament announced data had been "extracted" in a breach linked to the Microsoft flaws. Germany`s cybersecurity watchdog agency also said on Wednesday two federal authorities had been affected by the hack, although it declined to identify them.

While Microsoft has issued fixes, the sluggish pace of many customers` updates - which experts attribute in part to the complexity of Exchange`s architecture - means the field remains at least partially open to hackers of all stripes. The patches do not remove any back door access that has already been left on the machines.

In addition, some of the back doors left on compromised machines have passwords that are easily guessed, so that newcomers can take them over.

Microsoft declined comment on the pace of customers` updates. In previous announcements pertaining to the flaws, the company has emphasized the importance of "patching all affected systems immediately."

Although the hacking has appeared to be focused on cyber espionage, experts are concerned about the prospect of ransom-seeking cybercriminals taking advantage of the flaws because it could lead to widespread disruption.

ESET`s blog post said there were already signs of cybercriminal exploitation, with one group that specializes in stealing computer resources to mine cryptocurrency breaking in to previously vulnerable Exchange servers to spread its malicious software.

ESET named nine other espionage-focused groups it said were taking advantage of the flaws to break in to targeted networks - several of which other researchers have tied to China. Microsoft has blamed the hack on China. The Chinese government denies any role.

Intriguingly, several of the groups appeared to know about the vulnerability before it was announced by Microsoft on March 2.

Ben Read, a director with cybersecurity company FireEye Inc , said he could not confirm the exact details in the ESET post but said his company had also seen "multiple likely-China groups" using the Microsoft flaws in different waves.

ESET researcher Matthieu Faou said in an email it was "very uncommon" for so many different cyber espionage groups to have access to the same information before it is made public.

He speculated that either the information "somehow leaked" ahead of the Microsoft announcement or it was found by a third party that supplies vulnerability information to cyber spies.

Taiwan-based researchers reported to Microsoft on Jan. 5 that they had found two new flaws which need patching. Those two were among those that began being used by the attackers shortly before or after the friendly report.

They said were investigating whether there had been a theft or leak on their side, since exploitation was discovered in the wild the same week later. So far, the group called Devcore said, they had found no evidence.

Top-flight hackers are also commonly targeted by other hackers. Just this week, Microsoft patched one of the flaws used by suspected North Koreans in attempts to steal information from Western researchers.

But simultaneous discovery happens fairly often, in part because researchers use the same or similar tools to hunt for serious flaws, and many eyes are looking at the same high-value targets.

"It is very likely that some actor groups may have being using these vulnerabilities and led to the result of the attacks being observed by other information security vendors," Devcore member Bowen Hsu told Reuters.

But the security industry has been abuzz with other theories, including a hack of Microsoft`s systems for tracking bugs, which has happened in the past.

At least 10 different hacking groups are using recently discovered flaws in Microsoft Corp`s mail server software to break in to targets around the world, cybersecurity company ESET said in a blog post on Wednesday.

At least 10 different hacking groups are using recently discovered flaws in Microsoft Corp`s mail server software to break in to targets around the world, cybersecurity company ESET said in a blog post on Wednesday. The breadth of the exploitation adds to the urgency of the warnings being issued by authorities in the United States and Europe about the weaknesses found in Microsoft`s Exchange software. The security holes in the widely used mail and calendaring solution leave the door open to industrial-scale cyber espionage, allowing malicious actors to steal emails virtually at will from vulnerable servers or move elsewhere in the network. Tens of thousands of organizations have already been compromised, Reuters reported last week, and new victims are being made public daily. Earlier on Wednesday, for example, Norway`s parliament announced data had been "extracted" in a breach linked to the Microsoft flaws. Germany`s cybersecurity watchdog agency also said on Wednesday two federal authorities had been affected by the hack, although it declined to identify them. While Microsoft has issued fixes, the sluggish pace of many customers` updates - which experts attribute in part to the complexity of Exchange`s architecture - means the field remains at least partially open to hackers of all stripes. The patches do not remove any back door access that has already been left on the machines. In addition, some of the back doors left on compromised machines have passwords that are easily guessed, so that newcomers can take them over. Microsoft declined comment on the pace of customers` updates. In previous announcements pertaining to the flaws, the company has emphasized the importance of "patching all affected systems immediately." Although the hacking has appeared to be focused on cyber espionage, experts are concerned about the prospect of ransom-seeking cybercriminals taking advantage of the flaws because it could lead to widespread disruption. ESET`s blog post said there were already signs of cybercriminal exploitation, with one group that specializes in stealing computer resources to mine cryptocurrency breaking in to previously vulnerable Exchange servers to spread its malicious software. ESET named nine other espionage-focused groups it said were taking advantage of the flaws to break in to targeted networks - several of which other researchers have tied to China. Microsoft has blamed the hack on China. The Chinese government denies any role. Intriguingly, several of the groups appeared to know about the vulnerability before it was announced by Microsoft on March 2. Ben Read, a director with cybersecurity company FireEye Inc , said he could not confirm the exact details in the ESET post but said his company had also seen "multiple likely-China groups" using the Microsoft flaws in different waves. ESET researcher Matthieu Faou said in an email it was "very uncommon" for so many different cyber espionage groups to have access to the same information before it is made public. He speculated that either the information "somehow leaked" ahead of the Microsoft announcement or it was found by a third party that supplies vulnerability information to cyber spies. Taiwan-based researchers reported to Microsoft on Jan. 5 that they had found two new flaws which need patching. Those two were among those that began being used by the attackers shortly before or after the friendly report. They said were investigating whether there had been a theft or leak on their side, since exploitation was discovered in the wild the same week later. So far, the group called Devcore said, they had found no evidence. Top-flight hackers are also commonly targeted by other hackers. Just this week, Microsoft patched one of the flaws used by suspected North Koreans in attempts to steal information from Western researchers. But simultaneous discovery happens fairly often, in part because researchers use the same or similar tools to hunt for serious flaws, and many eyes are looking at the same high-value targets. "It is very likely that some actor groups may have being using these vulnerabilities and led to the result of the attacks being observed by other information security vendors," Devcore member Bowen Hsu told Reuters. But the security industry has been abuzz with other theories, including a hack of Microsoft`s systems for tracking bugs, which has happened in the past.

At least 10 hacking groups using Microsoft software flaw

Microsoft Corp said it has tracked "significant" cyberattacks coming from a group it calls "Strontium" or "Fancy Bear", targeting anti-doping authorities and global <a href="https://www.wionews.com/world/us-indicts-russian-military-agents-in-hacking-case-169487">sporting organizations</a>.

The group, also called APT28, has been linked to the <a href="https://www.wionews.com/world/hacking-the-hackers-russian-group-hijacked-iranian-spying-operation-officials-say-257200">Russian government</a>, Microsoft said in a blog post.&nbsp;

At least 16 national and international sporting and anti-doping organizations across three continents were targeted in the attacks which began on September&nbsp;16, according to the company.

The company said some of these attacks had been successful, but the majority had not. Microsoft has notified all customers targeted in these attacks.

Strontium, one of the world's oldest cyber espionage groups, has also been called Sofancy and Pawn Storm by a range of security firms and government officials. Security firm CrowdStrike has said the group may be associated with the Russian military intelligence agency GRU.

Microsoft said Strontium reportedly released medical records and emails taken from sporting organizations and anti-doping officials in 2016 and 2018, resulting in an indictment in a federal court in the United States in 2018.

The software giant added that the methods used in the most recent attacks were similar to those used by Strontium to target governments, militaries, think-tanks, law firms, human rights organizations, financial firms and universities around the world.

Strontium's methods include spear-phishing, password spray, exploiting internet-connected devices and the use of both open-source and custom malware, it added.

Microsoft has in the past taken legal steps o prevent Strontium from using fake Microsoft internet domains to execute its attacks.

By August last year, Microsoft had shut down 84 fake websites in 12 court-approved actions over the past two years.&nbsp;

Microsoft said at the time that hackers linked to Russia's government sought to launch cyber attacks on US political groups. 
&nbsp;

Microsoft Corp said it has tracked "significant" cyberattacks coming from a group it calls "Strontium" or "Fancy Bear", targeting anti-doping authorities and global sporting organizations.

Microsoft Corp said it has tracked "significant" cyberattacks coming from a group it calls "Strontium" or "Fancy Bear", targeting anti-doping authorities and global sporting organizations. The group, also called APT28, has been linked to the Russian government, Microsoft said in a blog post. At least 16 national and international sporting and anti-doping organizations across three continents were targeted in the attacks which began on September 16, according to the company. The company said some of these attacks had been successful, but the majority had not. Microsoft has notified all customers targeted in these attacks. Strontium, one of the world's oldest cyber espionage groups, has also been called Sofancy and Pawn Storm by a range of security firms and government officials. Security firm CrowdStrike has said the group may be associated with the Russian military intelligence agency GRU. Microsoft said Strontium reportedly released medical records and emails taken from sporting organizations and anti-doping officials in 2016 and 2018, resulting in an indictment in a federal court in the United States in 2018. The software giant added that the methods used in the most recent attacks were similar to those used by Strontium to target governments, militaries, think-tanks, law firms, human rights organizations, financial firms and universities around the world. Strontium's methods include spear-phishing, password spray, exploiting internet-connected devices and the use of both open-source and custom malware, it added. Microsoft has in the past taken legal steps o prevent Strontium from using fake Microsoft internet domains to execute its attacks. By August last year, Microsoft had shut down 84 fake websites in 12 court-approved actions over the past two years. Microsoft said at the time that hackers linked to Russia's government sought to launch cyber attacks on US political groups.

Russian government-linked hackers targeting anti-doping authorities, sports organizations: Microsoft

The US Treasury on Friday placed sanctions on three <a href="https://www.wionews.com/world/trump-south-koreas-moon-expected-to-meet-at-un-amid-hopes-for-new-north-korea-talks-249328">North Korea government</a>-sponsored hacking operations which it said were behind the theft of possibly hundreds of millions of dollars and destructive cyber-attacks on infrastructure.

The Treasury said the three groups -- dubbed Lazarus Group, Bluenoroff and Andariel -- were behind major thefts from financial institutions and cryptocurrency exchanges, as well as the 2018 WannaCry hack that crippled Britain's National Health Service.

All three are tied to the Reconnaissance General Bureau, Pyongyang's main intelligence bureau, and are behind numerous malicious computer viruses as well as attempts to steal billions of dollars online to fund the North Korean government, the Treasury said.

"Treasury is taking action against North Korean hacking groups that have been perpetrating cyberattacks to support illicit weapon and missile programs," said Sigal Mandelker, Treasury Under Secretary for Terrorism and Financial Intelligence.

"We will continue to enforce existing US and UN sanctions against North Korea and work with the international community to improve the cybersecurity of financial networks," she said in a statement.

Created in 2007, the Lazarus group has been known for years. It was behind the malicious hack of Sony Pictures in 2014, as well as the WannaCry ransomware that spread to at least 150 countries in 2017.

The most heaviest hit was Britain's public health system, with hospitals virtually shut down and thousands of patients turned away, costing the government ultimately more than $112 million.

Bluenoroff was formed specifically to obtain revenue for the North Korean government, the Treasury said.

By hijacking the global banking transfer system SWIFT, by 2018 it had made attempts online to steal more that $1.1 billion from financial institutions.

Its biggest success, together with Lazarus, was the $80 million heist from Bangladesh's central bank.

Andariel specialises in targeting businesses, government agencies and individuals. It has been known to steal bank card information and hack into ATMs, and to steal bank customer information to sell on the black market.

The Treasury said Andariel created unique malware to hack online gambling and poker sites.

The Treasury also cited online accounts to say the three groups "likely" stole $571 million in cryptocurrency from five Asian exchanges in 2017 and 2018.

The sanctions aim to lock anyone involved with the groups out of the global financial system and empower the US government to freeze any assets held under US jurisdiction.

In September 2018 the FBI charged North Korean Park Jin Hyok, allegedly a member of the Lazarus group, with conspiracy for multiple cyberattacks including the Sony Pictures attacks and the theft from the Central Bank of Bangladesh. 
&nbsp;

The US Treasury on Friday placed sanctions on three North Korea government-sponsored hacking operations which it said were behind the theft of possibly hundreds of millions of dollars and destructive cyber-attacks on infrastructure.

The US Treasury on Friday placed sanctions on three North Korea government-sponsored hacking operations which it said were behind the theft of possibly hundreds of millions of dollars and destructive cyber-attacks on infrastructure. The Treasury said the three groups -- dubbed Lazarus Group, Bluenoroff and Andariel -- were behind major thefts from financial institutions and cryptocurrency exchanges, as well as the 2018 WannaCry hack that crippled Britain's National Health Service. All three are tied to the Reconnaissance General Bureau, Pyongyang's main intelligence bureau, and are behind numerous malicious computer viruses as well as attempts to steal billions of dollars online to fund the North Korean government, the Treasury said. "Treasury is taking action against North Korean hacking groups that have been perpetrating cyberattacks to support illicit weapon and missile programs," said Sigal Mandelker, Treasury Under Secretary for Terrorism and Financial Intelligence. "We will continue to enforce existing US and UN sanctions against North Korea and work with the international community to improve the cybersecurity of financial networks," she said in a statement. Created in 2007, the Lazarus group has been known for years. It was behind the malicious hack of Sony Pictures in 2014, as well as the WannaCry ransomware that spread to at least 150 countries in 2017. The most heaviest hit was Britain's public health system, with hospitals virtually shut down and thousands of patients turned away, costing the government ultimately more than $112 million. Bluenoroff was formed specifically to obtain revenue for the North Korean government, the Treasury said. By hijacking the global banking transfer system SWIFT, by 2018 it had made attempts online to steal more that $1.1 billion from financial institutions. Its biggest success, together with Lazarus, was the $80 million heist from Bangladesh's central bank. Andariel specialises in targeting businesses, government agencies and individuals. It has been known to steal bank card information and hack into ATMs, and to steal bank customer information to sell on the black market. The Treasury said Andariel created unique malware to hack online gambling and poker sites. The Treasury also cited online accounts to say the three groups "likely" stole $571 million in cryptocurrency from five Asian exchanges in 2017 and 2018. The sanctions aim to lock anyone involved with the groups out of the global financial system and empower the US government to freeze any assets held under US jurisdiction. In September 2018 the FBI charged North Korean Park Jin Hyok, allegedly a member of the Lazarus group, with conspiracy for multiple cyberattacks including the Sony Pictures attacks and the theft from the Central Bank of Bangladesh.

US puts sanctions on North Korea hacking groups behind major thefts

hacking-group-0

Hacking Group, News on Hacking Group, stories on Hacking Group, articles on Hacking Group, Hacking Group stories at Wion, Hacking Group news, Hacking Group latest news

hacking group-0