Microsoft believes malware used to infect PCs running its Windows operating system was created by an Israeli organisation.

Microsoft is taking a new effort to reduce internet security issues.

The company has also been looking for government-backed hackers, such as the Chinese organisation Hafnium, which it believes is responsible for attacks on its Exchange Server email software.&nbsp;

The problem was only recently rectified by Microsoft, and it took them a long time to resolve, with several people claiming that it was ineffective for their experience.

The threat actors were revealed to be from the private sector, and the company launched an inquiry to learn more about their genuine motives.&nbsp;

Microsoft's investigation into their latest breach and zero-day vulnerability came from an Israeli private sector business called "Sourgum," according to the company's blog post. 
 
Watch: India rolls out new education policy, teams up with Microsoft

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/india-rolls-out-new-education-policy-teams-up-with-microsoft-389629/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

The company in question is a PSOA, or private sector offensive actor, intending to sell "cyberweapons" to its clients to hack them.&nbsp;

Another group discovered in the investigation is known as "Candiru," and they have been related to Sourgum with regards to the recent Microsoft attack.

While the motives of Candiru are unknown, it poses a direct threat to Microsoft and would be subject to an inquiry in the hopes of apprehending the perpetrator.&nbsp;

(With inputs from agencies)

Microsoft believes malware used to infect PCs running its Windows operating system was created by an Israeli organisation. Microsoft is taking a new effort to reduce internet security issues.

Microsoft believes malware used to infect PCs running its Windows operating system was created by an Israeli organisation. Microsoft is taking a new effort to reduce internet security issues. The company has also been looking for government-backed hackers, such as the Chinese organisation Hafnium, which it believes is responsible for attacks on its Exchange Server email software. The problem was only recently rectified by Microsoft, and it took them a long time to resolve, with several people claiming that it was ineffective for their experience. The threat actors were revealed to be from the private sector, and the company launched an inquiry to learn more about their genuine motives. Microsoft's investigation into their latest breach and zero-day vulnerability came from an Israeli private sector business called "Sourgum," according to the company's blog post. Watch: India rolls out new education policy, teams up with Microsoft The company in question is a PSOA, or private sector offensive actor, intending to sell "cyberweapons" to its clients to hack them. Another group discovered in the investigation is known as "Candiru," and they have been related to Sourgum with regards to the recent Microsoft attack. While the motives of Candiru are unknown, it poses a direct threat to Microsoft and would be subject to an inquiry in the hopes of apprehending the perpetrator. (With inputs from agencies)

Israeli company is behind malware that affected Windows PCs: Microsoft

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers. 
 
The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft. 
 
Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May. 
 
"A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions," the warning reads in part. The US&nbsp;government has publicly attributed the earlier attacks to the Russian government, which denies involvement. 
 
When Reuters asked about that warning, Microsoft announced the breach publicly. 
 
After commenting on a broader phishing campaign it said had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers. 
 
The agent could see billing contact information and what services the customers pay for, among other things. 
 
"The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign," Microsoft said. 
 
Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in. 
 
Microsoft said it was aware of three entities that had been compromised in the phishing campaign. 
 
It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign. 
 
Microsoft did not say whether the agent was at a contractor or a direct employee. 
 
A spokesman said the latest breach by the threat actor was not part of Nobelium`s previous successful attack on Microsoft, in which it obtained some source code. 
 
In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine U.S. federal agencies. 
 
At the SolarWinds customers and others, the attackers also took advantage of weaknesses in the way Microsoft programs were configured, according to the Department of Homeland Security. 
 
Microsoft later said the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities. 
 
A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco. 
 
"This appears to be largely unsuccessful, run-of-the-mill espionage," the official said. 
 
Scott McConnell, a spokesman for Homeland Security`s Cybersecurity and Infrastructure Security Agency, said the defensive group “is working with Microsoft and our interagency partners to evaluate the impact. We stand ready to assist any affected entities.” 
 
A SolarWinds spokesperson said, "The latest cyberattack reported by Microsoft does not involve our company or our customers in any way."

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers.

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers. The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft. Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May. "A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions," the warning reads in part. The US government has publicly attributed the earlier attacks to the Russian government, which denies involvement. When Reuters asked about that warning, Microsoft announced the breach publicly. After commenting on a broader phishing campaign it said had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers. The agent could see billing contact information and what services the customers pay for, among other things. "The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign," Microsoft said. Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in. Microsoft said it was aware of three entities that had been compromised in the phishing campaign. It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign. Microsoft did not say whether the agent was at a contractor or a direct employee. A spokesman said the latest breach by the threat actor was not part of Nobelium`s previous successful attack on Microsoft, in which it obtained some source code. In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine U.S. federal agencies. At the SolarWinds customers and others, the attackers also took advantage of weaknesses in the way Microsoft programs were configured, according to the Department of Homeland Security. Microsoft later said the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities. A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco. "This appears to be largely unsuccessful, run-of-the-mill espionage," the official said. Scott McConnell, a spokesman for Homeland Security`s Cybersecurity and Infrastructure Security Agency, said the defensive group “is working with Microsoft and our interagency partners to evaluate the impact. We stand ready to assist any affected entities.” A SolarWinds spokesperson said, "The latest cyberattack reported by Microsoft does not involve our company or our customers in any way."

Microsoft says new breach discovered in probe of suspected SolarWinds hackers

Security threats are not limited to land and sea borders. Now, the biggest threats loom on the digital world. India has no data security law and a big hacking attack just took place.

If you order pizza from Domino's, your credit card details could have been leaked. Reportedly, one million credit card details and a lot of other data has&nbsp;been leaked in India. The hackers are trying to sell all of this on the dark web.

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/gravitas-dominos-india-hack-credit-card-data-of-1-million-customers-stolen-378890/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

The hack was discovered by an Israeli cybercrime specialist who shared the specifics on Sunday. A hacker allegedly stole 13 terabytes of data from Domino's earlier this month. The database includes details of 18 crore (180 million) orders, customer names, phone numbers, email IDs, addresses and payment details including details of at least 10 lakh (1 million)&nbsp;credit cards. The hacker also accessed the internal records of Domino's employees.

Also read:&nbsp;<a href="http://13.235.153.162/technology/hacktivism-adding-to-woes-of-cybersecurity-at-alarming-rate-373454" hreflang="en">'Hacktivism' adding to woes of cybersecurity at alarming rate</a>

Reports say details of 250 employees have been leaked. The hacked data is now up for sale on the dark web - the internet space that remains hidden from the masses and can't be accessed with a simple Google search.

Why was the data stolen?

Reportedly, the hacker wants to sell it. A price has been quoted $550,000, over 4 crore (40 million) rupees . Jubilant Foodworks, the company that operates Domino's Pizza in India has a network of more than 1,000 restaurants in over 200 Indian cities.

It also operates Domino's Pizza in Bangladesh, Nepal and Sri Lanka. It is unclear if customers from these South Asian countries were affected or not. Jubilant Foodworks says it suffered an "information security incident" and financial data of customers wasn't compromised.

Also read:&nbsp;<a href="http://13.235.153.162/technology/mark-zuckerbergs-private-phone-number-goes-online-in-facebook-hack-375395" hreflang="en">Mark Zuckerberg’s private phone number goes online in Facebook hack</a>

Indians have been victims of several large scale data breaches in the recent past. Last month, data of digital wallet company Mobikwik was hacked and private information of nearly 100 million users was exposed. In December last year, Indigo Airlines said its servers had been hacked and that some of the company's internal documents may be leaked.

Last month, the government told the parliament that cyber attacks during the pandemic had risen by almost 300 per cent. As India goes digital and the pandemic accelerates this transition, India's parliament is yet to pass a data security law. Until that happens, we’re all at risk.

Security threats are not limited to land and sea borders. Now, the biggest threats loom on the digital world. India has no data security law and a big hacking attack just took place.

Security threats are not limited to land and sea borders. Now, the biggest threats loom on the digital world. India has no data security law and a big hacking attack just took place. If you order pizza from Domino's, your credit card details could have been leaked. Reportedly, one million credit card details and a lot of other data has been leaked in India. The hackers are trying to sell all of this on the dark web. The hack was discovered by an Israeli cybercrime specialist who shared the specifics on Sunday. A hacker allegedly stole 13 terabytes of data from Domino's earlier this month. The database includes details of 18 crore (180 million) orders, customer names, phone numbers, email IDs, addresses and payment details including details of at least 10 lakh (1 million) credit cards. The hacker also accessed the internal records of Domino's employees. Also read: 'Hacktivism' adding to woes of cybersecurity at alarming rate Reports say details of 250 employees have been leaked. The hacked data is now up for sale on the dark web - the internet space that remains hidden from the masses and can't be accessed with a simple Google search. Why was the data stolen? Reportedly, the hacker wants to sell it. A price has been quoted $550,000, over 4 crore (40 million) rupees . Jubilant Foodworks, the company that operates Domino's Pizza in India has a network of more than 1,000 restaurants in over 200 Indian cities. It also operates Domino's Pizza in Bangladesh, Nepal and Sri Lanka. It is unclear if customers from these South Asian countries were affected or not. Jubilant Foodworks says it suffered an "information security incident" and financial data of customers wasn't compromised. Also read: Mark Zuckerberg’s private phone number goes online in Facebook hack Indians have been victims of several large scale data breaches in the recent past. Last month, data of digital wallet company Mobikwik was hacked and private information of nearly 100 million users was exposed. In December last year, Indigo Airlines said its servers had been hacked and that some of the company's internal documents may be leaked. Last month, the government told the parliament that cyber attacks during the pandemic had risen by almost 300 per cent. As India goes digital and the pandemic accelerates this transition, India's parliament is yet to pass a data security law. Until that happens, we’re all at risk.

Domino's Pizza hack in India: What details were stolen and what happens next

A hacking group from China is suspected of attacking the airline industry over the last few years to obtain data of passengers. Reportedly, this was done to track the movement of people of interest to China. Zdnet reported that the hackers have been attacking the data under the name of Chimera.

Additionally, the group operates for the Chinese state. Initially, the activities of the group were reported in a Black Hat presentation from CyCraft in 2020.

In its initial findings, they found that a series of coordinated attacks took place against Taiwan's superconductor industry.

Last week, NCC Group published a new report claiming that intrusions into its data are broader than previously thought. Its subsidiary Fox-IT also reported the same. Even in this case, the airline industry was targetted.

"NCC Group and Fox-IT observed this threat actor during various incident response engagements performed between October 2019 until April 2020," Zdnet quotes the companies as saying.

Also read:&nbsp;<a href="http://13.235.153.162/world/us-intel-agencies-say-russia-likely-behind-hacking-of-govt-agencies-354752" hreflang="en">US intel agencies say Russia likely behind hacking of govt agencies</a> 
 
Both the companies said that these attacks were targetting airline and semiconductor companies across different parts of the world, and not just in Asia. 
 
In many cases, hackers hid inside networks for over three years before they were discovered.

Reportedly, the attack on semiconductor industry aimed to steal intellectual property, while in the case of the airline industry, the goal was different.

Also read:&nbsp;<a href="http://13.235.153.162/world/european-medicines-agency-hacking-pfizer-biontech-confirm-vaccine-documents-unlawfully-accessed-348845" hreflang="en">European Medicines Agency hacking: Pfizer-BioNTech confirm vaccine documents 'unlawfully accessed'</a>

The companies claimed that the hackers were targeting victims to obtain Passenger Name Records or what is commonly known as PNR. 
 
The report by NCC and Fox-IT mentions how Chimera operates, saying that it begins by collecting login credentials that became part of the public domain after other companies suffered data breaches. 
 
Once the data was accessed and collected, the information was uploaded to OneDrive, Dropbox, or Google Drive, for traffic flowing into these services is barely inspected.

A hacking group from China is suspected of attacking the airline industry over the last few years to obtain data of passengers. Reportedly, this was done to track the movement of people of interest to China.

A hacking group from China is suspected of attacking the airline industry over the last few years to obtain data of passengers. Reportedly, this was done to track the movement of people of interest to China. Zdnet reported that the hackers have been attacking the data under the name of Chimera. Additionally, the group operates for the Chinese state. Initially, the activities of the group were reported in a Black Hat presentation from CyCraft in 2020. In its initial findings, they found that a series of coordinated attacks took place against Taiwan's superconductor industry. Last week, NCC Group published a new report claiming that intrusions into its data are broader than previously thought. Its subsidiary Fox-IT also reported the same. Even in this case, the airline industry was targetted. "NCC Group and Fox-IT observed this threat actor during various incident response engagements performed between October 2019 until April 2020," Zdnet quotes the companies as saying. Also read: US intel agencies say Russia likely behind hacking of govt agencies Both the companies said that these attacks were targetting airline and semiconductor companies across different parts of the world, and not just in Asia. In many cases, hackers hid inside networks for over three years before they were discovered. Reportedly, the attack on semiconductor industry aimed to steal intellectual property, while in the case of the airline industry, the goal was different. Also read: European Medicines Agency hacking: Pfizer-BioNTech confirm vaccine documents 'unlawfully accessed' The companies claimed that the hackers were targeting victims to obtain Passenger Name Records or what is commonly known as PNR. The report by NCC and Fox-IT mentions how Chimera operates, saying that it begins by collecting login credentials that became part of the public domain after other companies suffered data breaches. Once the data was accessed and collected, the information was uploaded to OneDrive, Dropbox, or Google Drive, for traffic flowing into these services is barely inspected.

A Chinese hacker group is stealing global airline passenger data

hacking-groups

Hacking Groups, News on Hacking Groups, stories on Hacking Groups, articles on Hacking Groups, Hacking Groups stories at Wion, Hacking Groups news, Hacking Groups latest news

hacking groups

Israeli company is behind malware that affected Windows PCs: Microsoft

Microsoft says new breach discovered in probe of suspected SolarWinds hackers

Domino's Pizza hack in India: What details were stolen and what happens next

A Chinese hacker group is stealing global airline passenger data