SEBI has penalised CDSL after a 2022 malware attack exposed gaps in the depository’s cybersecurity framework. The action highlights growing concerns around data protection, digital security, and the need for stronger safeguards across India's financial infrastructure as cyber threats continue to rise.

SEBI penalises CDSL after 2022 malware attack exposes cybersecurity failures 

According to Yossi Karadi, Director General of Israel's National Cyber Directorate, hostile cyber incidents have skyrocketed from 1,600 per month in June 2025 to a staggering 4,800 incidents in June 2026. While Israel has successfully defended its highly protected critical infrastructure, a new wave of destructive "wiper" malware is wreaking havoc on small to medium-sized businesses.



Iranian Malware Attacks Hit Businesses and Erase Critical Data in Israel 

A new assessment of 100 AI agents reveals serious security weaknesses, showing that most can be manipulated through prompt injection attacks. The study highlights how hidden instructions inside emails or documents can mislead AI systems that have access to sensitive tools and data. Experts warn that as AI agents take on more real-world tasks, security gaps could become a major risk for organisations.


AI Fails Simple Test of Malicious Malware 

Cybersecurity experts are warning that artificial intelligence tools are increasingly being misused by hackers to develop malware and cyber attack systems at a faster and more scalable rate.

Reports suggest cybercriminals are leveraging generative AI platforms to automate coding, improve phishing techniques, and bypass traditional security systems. This shift is lowering the technical barrier for cybercrime and enabling even low-skilled attackers to create more sophisticated threats.

AI Tools Helping Hackers Build Malware

Japan’s media giant Nikkei has fallen victim to a significant cyberattack after an employee’s computer was infected with malware, compromising the company’s Slack platform and exposing the personal data of more than 17,000 employees and business partners. The company confirmed that no journalistic sources were leaked, but cybersecurity experts warn this breach highlights a growing threat — attacks that “live off the land” by using valid credentials to move undetected inside corporate systems.

Nikkei Hit by Major Cyberattack After Employee Error | 17,000 Records Exposed in Slack Breach

A global police operation shut down the servers of one of the world's largest malware platforms that targeted millions of victims, the EU's judicial arm said on Tuesday (Oct 29).

A year-long investigation culminated in "Operation Magnus" with investigators from six countries including the Netherlands, Australia, Britain and the United States working together to smash the criminal scheme.&nbsp;

"The infostealers taken down...targeted millions of victims worldwide, making it one of the largest malware platforms globally," Eurojust said in a statement.

"Authorities discovered that over 1,200 servers in dozens of countries were running the malware," said the agency, which is based in The Hague and coordinated Monday's operation.

Also Read |&nbsp;<a href="https://www.wionews.com/world/oregon-us-presidential-election-2024-voting-candidates-results-and-all-you-need-to-know-771750">Oregon US Presidential Election 2024: Voting, candidates, results and all you need to know</a>

Investigators shut down three servers in the Netherlands, seized two domains, unsealed charges in the United States and took two people into custody in Belgium, Eurojust said.

The criminal platforms, called RedLine and META, stole personal data from infected devices including usernames and passwords, as well as automatically saved data like addresses, email addresses and cryptocurrency wallets.

The victims' devices became infected when downloading software from unreliable sources.

The investigation was triggered when victims came forward and a security company notified authorities about possible servers in the Netherlands linked to the malware.&nbsp;

Also Read |&nbsp;<a href="https://www.wionews.com/us-elections/new-mexico-us-presidential-election-2024-voting-result-info-candidates-and-all-you-need-to-know-771737">New Mexico US Presidential Election 2024: Voting, Result info, Candidates and all you need to know</a>

"After retrieving the personal data, the infostealers sold the information to other criminals through criminal marketplaces," Eurojust said.

"The criminals who purchased the personal data used it to steal money, crypto-currency and to carry out follow-on hacking activities," the agency said.

Authorities have also taken down several Telegram messaging accounts which were used to advertise RedLine and META's services, Dutch police said.

"Until recently, Telegram was a service where criminals felt untouchable and anonymous," they said in a statement.

"This action has shown that this is no longer the case," police added.

In the United States, law officials have slapped fraud and money laundering charges on a suspected RedLine developer and administrator.

If convicted the suspect "faces a maximum penalty of 10 years in prison for access device fraud, five years in prison for conspiracy to commit computer intrusion, and 20 years in prison for money laundering," the US Attorney's Office said in a statement.

Eurojust and Dutch police confirmed that the META name used by the malware platform had no link with Meta, the California-based company that owns Facebook, Instagram and WhatsApp.

Investigations continued and Eurojust said a private security company has set up an online tool for potential victims to check if their data was stolen.

US law authorities added it "did not believe it is in possession of all the stolen data and continues to investigate."

Disclaimer: This story has been published from a news agency feed with minimal edits to adhere to WION's style guide. The headline may have been changed to better reflect the content of the story or to make it more suitable for&nbsp;WION&nbsp;audience.

A global police operation shut down the servers of one of the world's largest malware platforms that targeted millions of victims, the EU's judicial arm said on Tuesday (Oct 29).

A global police operation shut down the servers of one of the world's largest malware platforms that targeted millions of victims, the EU's judicial arm said on Tuesday (Oct 29). A year-long investigation culminated in "Operation Magnus" with investigators from six countries including the Netherlands, Australia, Britain and the United States working together to smash the criminal scheme. "The infostealers taken down...targeted millions of victims worldwide, making it one of the largest malware platforms globally," Eurojust said in a statement. "Authorities discovered that over 1,200 servers in dozens of countries were running the malware," said the agency, which is based in The Hague and coordinated Monday's operation. Also Read | Oregon US Presidential Election 2024: Voting, candidates, results and all you need to know Investigators shut down three servers in the Netherlands, seized two domains, unsealed charges in the United States and took two people into custody in Belgium, Eurojust said. The criminal platforms, called RedLine and META, stole personal data from infected devices including usernames and passwords, as well as automatically saved data like addresses, email addresses and cryptocurrency wallets. The victims' devices became infected when downloading software from unreliable sources. The investigation was triggered when victims came forward and a security company notified authorities about possible servers in the Netherlands linked to the malware. Also Read | New Mexico US Presidential Election 2024: Voting, Result info, Candidates and all you need to know "After retrieving the personal data, the infostealers sold the information to other criminals through criminal marketplaces," Eurojust said. "The criminals who purchased the personal data used it to steal money, crypto-currency and to carry out follow-on hacking activities," the agency said. Authorities have also taken down several Telegram messaging accounts which were used to advertise RedLine and META's services, Dutch police said. "Until recently, Telegram was a service where criminals felt untouchable and anonymous," they said in a statement. "This action has shown that this is no longer the case," police added. In the United States, law officials have slapped fraud and money laundering charges on a suspected RedLine developer and administrator. If convicted the suspect "faces a maximum penalty of 10 years in prison for access device fraud, five years in prison for conspiracy to commit computer intrusion, and 20 years in prison for money laundering," the US Attorney's Office said in a statement. Eurojust and Dutch police confirmed that the META name used by the malware platform had no link with Meta, the California-based company that owns Facebook, Instagram and WhatsApp. Investigations continued and Eurojust said a private security company has set up an online tool for potential victims to check if their data was stolen. US law authorities added it "did not believe it is in possession of all the stolen data and continues to investigate." Disclaimer: This story has been published from a news agency feed with minimal edits to adhere to WION's style guide. The headline may have been changed to better reflect the content of the story or to make it more suitable for WION audience.

Global police shut down largest malware group 'targeting millions': EU judicial arm

Security experts still do not know how the trojan malware got there but say that it has affected 1.3 million Android-based TV boxes across almost 200 countries. Google is trying to distance itself from the 'Android TV' branding, now preferring 'Google TV', and perhaps for good reason.

Report: 1.3 million Android-based TV boxes affected by new 'Vo1d' malware

American software firm Cisco Systems has disclosed that hackers have exploited vulnerabilities in its security devices and this has led to the hackers accessing government networks worldwide. Watch in for more details!

Cyberattack on CISCO: State-backed spies hack CISCO firewall

CISCO's security software compromised by Cyberspies

If you are android user, you might want to hear this - your unique fingerprint might now be enough to keep your personal information safe anymore. A new malware named Chameleon could put your personal information at risk.

Latest android malware alert: New malware Chameleon disables fingerprint unlock to steal pins

A Russian man pleaded guilty on Thursday (Nov 30) to involvement in developing the Trickbot malware which was used to extort American businesses including hospitals during the COVID-19 pandemic, the US justice department said.&nbsp;

The man, identified as 40-year-old Vladimir Dunaev is from Russia’s Far East Amur Oblast and was extradited from South Korea to the US two years ago,&nbsp; according to court documents.&nbsp;&nbsp;

<h2>Charges against the Russian national</h2>

Dunaev was charged with conspiracy to commit computer fraud and identity theft and conspiracy to commit wire fraud and bank fraud. He has pleaded guilty to both charges in a court in the US state of Ohio, said the Department of Justice (DOJ).&nbsp;

According to the US officials, Dunaev provided “specialised services and technical abilities in furtherance of the Trickbot scheme.”

He will be charged on March 20, 2024, and faces a maximum penalty of 35 years in prison on both counts.&nbsp;

ALSO WATCH |<a href="https://www.wionews.com/videos/sanctions-against-key-members-of-russian-hacking-group-trickbot-560806">&nbsp;Sanctions against key members of Russian hacking group 'Trickbot'</a>

Dunaev was among nine with alleged links to Russian intelligence services, and were indicted in the US for involvement in the Trickbot scheme.&nbsp;

According to the DOJ, Dunaev’s participation in the scheme was linked to 10 victims in the Northern District of Ohio, including Avon schools and a North Canton real-estate company, who were “defrauded of more than $3.4 million via ransomware deployed by Trickbot.”

“Dunaev and his codefendants hid behind their keyboards, first to create Trickbot, then using it to infect millions of computers worldwide – including those used by hospitals, schools, and businesses – invading privacy and causing untold disruption and financial damage,” said US Attorney Rebecca Lutzko, in a statement.&nbsp;

<h2>What is Trickbot and how did it affect the US?</h2>

Trickbot is a malicious software which was used to launch cyber-attacks which affected millions of Americans as well as hospitals, schools, and businesses and caused tens of millions of dollars in losses.&nbsp;

The group that Dunaev was said to be a part of particularly targeted hospitals and healthcare services during the Covid pandemic in 2020-21, with the malware and an associated ransomware programme called Conti, said the US officials.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/world/us-uk-sanction-members-of-russia-based-trickbot-cybercrime-gang-for-malicious-activities-560455">US, UK sanction members of Russia-based Trickbot cybercrime gang for malicious activities</a>

The Trickbot group launched cyber attacks against hundreds of targets across nearly the entire US and more than 30 other countries since 2016. The malware was also reportedly used to steal bank account logins and passwords from victims’ computers to steal money from their accounts.&nbsp;

Meanwhile, British officials said the Trickbot gang had extorted at least $180 million from people across the world.

Earlier this year, one of Dunaev’s co-conspirators and a Latvian national Alla Witte, who was also a Trickbot malware developer, pleaded guilty to conspiracy to commit computer fraud and was sentenced to two years and eight months in prison.

(With inputs from agencies) 
&nbsp;

A Russian man pleaded guilty on Thursday (Nov 30) to involvement in developing the Trickbot malware which was used to extort American businesses including hospitals during the COVID-19 pandemic, the US justice department said.

A Russian man pleaded guilty on Thursday (Nov 30) to involvement in developing the Trickbot malware which was used to extort American businesses including hospitals during the COVID-19 pandemic, the US justice department said. The man, identified as 40-year-old Vladimir Dunaev is from Russia’s Far East Amur Oblast and was extradited from South Korea to the US two years ago, according to court documents. Charges against the Russian national Dunaev was charged with conspiracy to commit computer fraud and identity theft and conspiracy to commit wire fraud and bank fraud. He has pleaded guilty to both charges in a court in the US state of Ohio, said the Department of Justice (DOJ). According to the US officials, Dunaev provided “specialised services and technical abilities in furtherance of the Trickbot scheme.” He will be charged on March 20, 2024, and faces a maximum penalty of 35 years in prison on both counts. ALSO WATCH | Sanctions against key members of Russian hacking group 'Trickbot' Dunaev was among nine with alleged links to Russian intelligence services, and were indicted in the US for involvement in the Trickbot scheme. According to the DOJ, Dunaev’s participation in the scheme was linked to 10 victims in the Northern District of Ohio, including Avon schools and a North Canton real-estate company, who were “defrauded of more than $3.4 million via ransomware deployed by Trickbot.” “Dunaev and his codefendants hid behind their keyboards, first to create Trickbot, then using it to infect millions of computers worldwide – including those used by hospitals, schools, and businesses – invading privacy and causing untold disruption and financial damage,” said US Attorney Rebecca Lutzko, in a statement. What is Trickbot and how did it affect the US? Trickbot is a malicious software which was used to launch cyber-attacks which affected millions of Americans as well as hospitals, schools, and businesses and caused tens of millions of dollars in losses. The group that Dunaev was said to be a part of particularly targeted hospitals and healthcare services during the Covid pandemic in 2020-21, with the malware and an associated ransomware programme called Conti, said the US officials. ALSO READ | US, UK sanction members of Russia-based Trickbot cybercrime gang for malicious activities The Trickbot group launched cyber attacks against hundreds of targets across nearly the entire US and more than 30 other countries since 2016. The malware was also reportedly used to steal bank account logins and passwords from victims’ computers to steal money from their accounts. Meanwhile, British officials said the Trickbot gang had extorted at least $180 million from people across the world. Earlier this year, one of Dunaev’s co-conspirators and a Latvian national Alla Witte, who was also a Trickbot malware developer, pleaded guilty to conspiracy to commit computer fraud and was sentenced to two years and eight months in prison. (With inputs from agencies)

US: Russian man pleads guilty to playing role in Trickbot malware scheme

The Biden administration is looking for dangerous computer code that it thinks China may have buried deep within the networks in charge of the power grids, communications networks, and water sources that supply military locations in the United States.

US: Critical American military and civilian infrastructure under threat

Russian government officials have been banned from bringing their iPhones to cabinet meetings and using them for official work purposes amid allegations that the U.S.-made smartphones are equipped with spying technology. 
 
The Russian Federal Security Service (FSB) recently reported the discovery of "anomalies" in certain iPhones used in Russia, including devices used by members of the country's diplomatic missions. The FSB attributed these anomalies to "malicious software" associated with surveillance operations conducted by American intelligence services, reported the Moscow Times.

<h2>FSB claims Apple's privacy policy inaccurate, alleges collaboration with NSA</h2>

The presence of the detected malware has led the FSB to assert that Apple's proclaimed user privacy policy does not align with reality. The agency suggests that the situation indicates close collaboration between Apple and the US&nbsp;National Security Agency (NSA).

Also read |&nbsp;<a href="https://www.wionews.com/business-economy/apple-to-cut-small-number-of-jobs-in-some-corporate-retail-teams-report-578799">Apple is planning to cut small number of jobs in some teams: Report</a>

<h2>30% of Russian presidential administration employees still use iPhones</h2>

Kremlin spokesperson Dmitry Peskov has disclosed that around 30 per cent of employees in the Russian presidential administration continue to use iPhones for personal communication, even as concerns regarding the security of these devices persist.

Earlier this year, fears of potential espionage led to a ban on Kremlin staff involved in President Vladimir Putin's 2024 re-election campaign from using iPhones. The prohibition was reported by the Kommersant daily in March and was implemented following a deliberation at a seminar near Moscow, with the final decision resting in the hands of Sergei Kiriyenko, the Kremlin's first deputy chief of staff.

The Kremlin maintains the belief that iPhones are more susceptible to hacking and espionage by Western specialists when compared to other smartphone brands. This perception has had an impact on the choices made by Russian officials and managers at state-owned enterprises regarding the use of iPhones.

Also watch |&nbsp;iPhones barred in Putin's office

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/iphones-barred-in-putins-office-574045/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

However, despite these concerns and restrictions, a significant number of Russian officials and managers from state-owned enterprises were observed using iPhones during the recent St. Petersburg International Economic Forum. This observation highlights the existence of varying practices and viewpoints on the matter of iPhone security within the Russian establishment.

WATCH WION LIVE HERE:

<iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed" style="width:100%;max-width:560px;" width="560"></iframe>

Russian government officials have been banned from bringing their iPhones to cabinet meetings and using them for official work purposes amid allegations that the U.

Russian government officials have been banned from bringing their iPhones to cabinet meetings and using them for official work purposes amid allegations that the U.S.-made smartphones are equipped with spying technology. The Russian Federal Security Service (FSB) recently reported the discovery of "anomalies" in certain iPhones used in Russia, including devices used by members of the country's diplomatic missions. The FSB attributed these anomalies to "malicious software" associated with surveillance operations conducted by American intelligence services, reported the Moscow Times. FSB claims Apple's privacy policy inaccurate, alleges collaboration with NSA The presence of the detected malware has led the FSB to assert that Apple's proclaimed user privacy policy does not align with reality. The agency suggests that the situation indicates close collaboration between Apple and the US National Security Agency (NSA). Also read | Apple is planning to cut small number of jobs in some teams: Report 30% of Russian presidential administration employees still use iPhones Kremlin spokesperson Dmitry Peskov has disclosed that around 30 per cent of employees in the Russian presidential administration continue to use iPhones for personal communication, even as concerns regarding the security of these devices persist. Earlier this year, fears of potential espionage led to a ban on Kremlin staff involved in President Vladimir Putin's 2024 re-election campaign from using iPhones. The prohibition was reported by the Kommersant daily in March and was implemented following a deliberation at a seminar near Moscow, with the final decision resting in the hands of Sergei Kiriyenko, the Kremlin's first deputy chief of staff. The Kremlin maintains the belief that iPhones are more susceptible to hacking and espionage by Western specialists when compared to other smartphone brands. This perception has had an impact on the choices made by Russian officials and managers at state-owned enterprises regarding the use of iPhones. Also watch | iPhones barred in Putin's office However, despite these concerns and restrictions, a significant number of Russian officials and managers from state-owned enterprises were observed using iPhones during the recent St. Petersburg International Economic Forum. This observation highlights the existence of varying practices and viewpoints on the matter of iPhone security within the Russian establishment. WATCH WION LIVE HERE:

Russian officials barred from bringing iPhones to cabinet meetings: Report

India witnessed 1,787 cyber-attacks each week on an average in an organisation over the past six months, compared to the global average of 983, as per an <a href="https://go.checkpoint.com/2023-cyber-security-report/chapter-03.php">analysis </a>by Check Point Software Technologies, an American-Israeli cyber threat intelligence analyst.

The latest cyber-attack on India’s premier&nbsp;medical institution, the All India Institute of Medical Science&nbsp;(AIIMS), New Delhi,&nbsp;the <a href="https://www.wionews.com/india-news/aiims-says-malware-attack-successfully-thwarted-by-cyber-security-systems-601396">second such attack in a row</a> has rekindled discussion over India's&nbsp;preparedness&nbsp;to deal with attacks of the given nature.&nbsp;AIIMS in a statement released on Monday (June 5) said the attempt of malware attack was successfully thwarted and the threat was neutralised in time. But, the bigger questions of India's vulnerability, vigilance and digitalisation still remain unanswered.&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false"><iframe aria-label="Grouped Bars" data-external="1" frameborder="0" height="546" id="datawrapper-chart-7Exvx" scrolling="no" src="https://datawrapper.dwcdn.net/7Exvx/1/" style="border: none;" title="Avg weekly cyber attacks per organisation by sector in 2022 (Globally)" width="600"></iframe></div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

<h2 dir="ltr">Why is India being targetted?</h2>

Cyber-attacks are frequently directed towards India due to its large population and expanding internet user base, resulting in a substantial attack surface, explains Dr Ananth Prabhu G, cyber law and security expert for various Indian law enforcement agencies.

“The country's economic progress and digital modernisation have led to increased digitisation in various sectors, which has caught the attention of cyber-criminals who seek financial benefits and access to sensitive data. Additionally, India's global prominence and intricate political and geopolitical relationships make it a prime target for attacks motivated by politics, espionage, or the disruption of critical infrastructure. Government initiatives and the collection of vast amounts of personal data have made the systems enticing targets,” he told WION.

<h2 dir="ltr">India’s healthcare sector a constant target? Why is health-related data so critical?</h2>

A nationwide initiative to <a href="https://main.mohfw.gov.in/sites/default/files/17739294021483341357.pdf">digitise medical data</a> was launched in September 2021, and as of now, more than 173,000 hospitals have enrolled with it. In accordance with medical records kept by hospitals on their own servers or in cloud storage, the programme allocates patient numbers that are linked to those records.&nbsp;

“Healthcare data is a prime target for <a href="https://www.wionews.com/india-news/delhis-bigest-cyber-fraud-doctor-duped-of-rs-45-crore-548k-via-skype-calls-594502">cyber-criminals</a> due to its immense value and inherent vulnerabilities. Firstly, healthcare data contains a plethora of sensitive information that can be exploited for illicit purposes. Personally identifiable information (PII) like names, addresses, Aadhar, and insurance details can be illicitly traded on the black market for identity theft or used in fraudulent financial activities. Furthermore, medical records and health information hold significant worth as they can be leveraged for fraudulent billing, acquiring prescription drugs, or even extorting individuals with sensitive health conditions. The high value attached to healthcare data makes it an enticing objective for cyber-criminals seeking financial gain or other malicious intentions,” explains Dr Prabhu G.

He further adds that healthcare systems are “particularly appealing” to hackers because they often possess weaker security measures compared to other industries. The healthcare sector traditionally prioritises patient care and operational efficiency over robust cybersecurity, leaving vulnerabilities that cyber-criminals can exploit. Outdated software, legacy systems, and inadequate investments in cyber security infrastructure render healthcare organisations more susceptible to attacks.&nbsp;

Also watch |&nbsp;Second malware attack at AIIMS, New Delhi&nbsp;

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/second-malware-attack-at-aiims-new-delhi-cyber-attack-india-news-601464/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

<h2 dir="ltr">Digitalisation and the risk of cyber-crimes</h2>

As per industry estimates, 2022 was India's worst year to date for cyber-attacks, an issue that has only become worse with rising digitalisation.

“The process of digitalisation heightens the vulnerability to cyber crime as it expands the attack surface through interconnected systems, adds complexity to IT infrastructure, involves the accumulation of valuable data, increases connectivity, and witnesses the continuous evolution of cyber threats. This combination of factors grants cybercriminals numerous avenues to exploit weaknesses, pilfer sensitive information, disrupt operations, and inflict financial and reputational harm,” Dr Prabhu G said.&nbsp;

<h2>Way forward</h2>

Technology usage is accelerating, which will lead to an increase in cyber-attack frequency and intensity. How can organisations curb the risk of a cyber-attack in that case?

“To bridge the gap and address the challenges posed by cyber-crime, it is essential to enhance collaboration between government agencies, private sector organisations, and cyber-security experts, while also prioritising robust cyber-security measures, education and training programmes, adequate resources and investment, legislation and regulation, international cooperation, continuous monitoring and incident response capabilities, and specific cyber-security awareness initiatives in sectors like healthcare. By taking these comprehensive steps, we can work towards a safer digital landscape, mitigate cyber threats, protect sensitive data, and foster a collective defence against cyber-criminals,” Dr Prabhu G explains.&nbsp;

The most significant issue, notwithstanding India's security measures, is the ability of the criminals to penetrate the Indian cyber-security system, regardless of whether or not these attacks result in data or financial loss. Therefore, it is imperative to implement the <a href="https://www.meity.gov.in/writereaddata/files/DIA_Presentation%2009.03.2023%20Final.pdf">digital India Act</a>.

 
WATCH WION LIVE HERE:

<iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed" style="width:100%;max-width:560px;" width="560"></iframe>

India witnessed 1,787 cyber-attacks each week on an average in an organisation over the past six months, compared to the global average of 983, as per an analysis by Check Point Software Technologies, an American-Israeli cyber threat intelligence analyst.

India witnessed 1,787 cyber-attacks each week on an average in an organisation over the past six months, compared to the global average of 983, as per an analysis by Check Point Software Technologies, an American-Israeli cyber threat intelligence analyst. The latest cyber-attack on India’s premier medical institution, the All India Institute of Medical Science (AIIMS), New Delhi, the second such attack in a row has rekindled discussion over India's preparedness to deal with attacks of the given nature. AIIMS in a statement released on Monday (June 5) said the attempt of malware attack was successfully thwarted and the threat was neutralised in time. But, the bigger questions of India's vulnerability, vigilance and digitalisation still remain unanswered. × Why is India being targetted? Cyber-attacks are frequently directed towards India due to its large population and expanding internet user base, resulting in a substantial attack surface, explains Dr Ananth Prabhu G, cyber law and security expert for various Indian law enforcement agencies. “The country's economic progress and digital modernisation have led to increased digitisation in various sectors, which has caught the attention of cyber-criminals who seek financial benefits and access to sensitive data. Additionally, India's global prominence and intricate political and geopolitical relationships make it a prime target for attacks motivated by politics, espionage, or the disruption of critical infrastructure. Government initiatives and the collection of vast amounts of personal data have made the systems enticing targets,” he told WION. India’s healthcare sector a constant target? Why is health-related data so critical? A nationwide initiative to digitise medical data was launched in September 2021, and as of now, more than 173,000 hospitals have enrolled with it. In accordance with medical records kept by hospitals on their own servers or in cloud storage, the programme allocates patient numbers that are linked to those records. “Healthcare data is a prime target for cyber-criminals due to its immense value and inherent vulnerabilities. Firstly, healthcare data contains a plethora of sensitive information that can be exploited for illicit purposes. Personally identifiable information (PII) like names, addresses, Aadhar, and insurance details can be illicitly traded on the black market for identity theft or used in fraudulent financial activities. Furthermore, medical records and health information hold significant worth as they can be leveraged for fraudulent billing, acquiring prescription drugs, or even extorting individuals with sensitive health conditions. The high value attached to healthcare data makes it an enticing objective for cyber-criminals seeking financial gain or other malicious intentions,” explains Dr Prabhu G. He further adds that healthcare systems are “particularly appealing” to hackers because they often possess weaker security measures compared to other industries. The healthcare sector traditionally prioritises patient care and operational efficiency over robust cybersecurity, leaving vulnerabilities that cyber-criminals can exploit. Outdated software, legacy systems, and inadequate investments in cyber security infrastructure render healthcare organisations more susceptible to attacks. Also watch | Second malware attack at AIIMS, New Delhi Digitalisation and the risk of cyber-crimes As per industry estimates, 2022 was India's worst year to date for cyber-attacks, an issue that has only become worse with rising digitalisation. “The process of digitalisation heightens the vulnerability to cyber crime as it expands the attack surface through interconnected systems, adds complexity to IT infrastructure, involves the accumulation of valuable data, increases connectivity, and witnesses the continuous evolution of cyber threats. This combination of factors grants cybercriminals numerous avenues to exploit weaknesses, pilfer sensitive information, disrupt operations, and inflict financial and reputational harm,” Dr Prabhu G said. Way forward Technology usage is accelerating, which will lead to an increase in cyber-attack frequency and intensity. How can organisations curb the risk of a cyber-attack in that case? “To bridge the gap and address the challenges posed by cyber-crime, it is essential to enhance collaboration between government agencies, private sector organisations, and cyber-security experts, while also prioritising robust cyber-security measures, education and training programmes, adequate resources and investment, legislation and regulation, international cooperation, continuous monitoring and incident response capabilities, and specific cyber-security awareness initiatives in sectors like healthcare. By taking these comprehensive steps, we can work towards a safer digital landscape, mitigate cyber threats, protect sensitive data, and foster a collective defence against cyber-criminals,” Dr Prabhu G explains. The most significant issue, notwithstanding India's security measures, is the ability of the criminals to penetrate the Indian cyber-security system, regardless of whether or not these attacks result in data or financial loss. Therefore, it is imperative to implement the digital India Act. WATCH WION LIVE HERE:

Data Lab | Digital India and the need to beef up cyber-security in healthcare

A new report has claimed that hackers are using AI-generated videos on YouTube to spread malware. They can also steal passwords, credit card information, bank account numbers, and other confidential data.

Hackers using YouTube videos to steal user information

Users of Samsung, Huawei, and Google phones have been advised to remove a number of popular apps that may contain spyware which steals money.

Tech experts have cautioned owners of Android smartphones and tablets that a variety of apps could be infected with harmful malware called 'Harly'.

What is Harly?

Harly, named after Harley Quinn the popular Batman villain, who is also the Joker's girlfriend, is a type of trojan known as a "trojan subscriber" signs users up for paid services without their knowledge.&nbsp;

Watch |&nbsp;Tech Talk: Popular apps capable of collecting private information on iPhones

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/tech-talk-popular-apps-capable-of-collecting-private-information-on-iphones-509289/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

Since 2020, more than 190 Harly-infected apps have been discovered on Google Play, according to Kaspersky. The well-known antivirus supplier estimates that 4.8 million people have downloaded these apps, however, the actual number may be far higher.

How does it work?

The Harly family of Trojans imitates trustworthy applications. Scammers download common apps from Google Play, add malicious code to them, and then submit the altered versions to Google Play. Users might not even be aware that the apps are dangerous because they still have the functions that are provided in the description.

Also read |&nbsp;<a href="https://www.wionews.com/technology/google-deletes-50-apps-after-joker-malware-attack-users-should-delete-them-if-they-are-installed-501251">Google deletes 50 apps infected with Joker malware. Recommends users to delete the apps if installed</a>

But don't you need a verification code for paid subscriptions?

Yes, you do. However, according to The Daily Express, Harly can sign up Android users for pricey subscription services without their knowledge by stealthily taking security codes from text messages.

It can also check subscriptions over the phone without the device owner's knowledge, and once this is done, it could empty someone's bank account without being noticed.

Also read |&nbsp;<a href="https://www.wionews.com/world/us-discovers-malware-capable-of-gaining-access-to-industrial-control-systems-issues-alert-471072">US discovers malware capable of gaining access to industrial control systems, issues alert</a>

How do we protect ourselves?

The company advises reading user reviews and viewing an app's rating on Google Play before installing it. But bear in mind that ratings and reviews could be inflated. Another solution it recommends is of course "a reliable security solution."&nbsp;

Which apps have been affected?

Kaspersky, which first flagged the malware has made mention of a number of apps, some of which already have thousands of downloads. Here are a few apps that you need to skirt clear of:

-Pony Camera&nbsp; 
-Live Wallpaper&amp;Themes Launcher 
-Action Launcher &amp; Wallpapers&nbsp; 
-Color Call 
-Good Launcher&nbsp; 
-Mondy Widgets 
-Funcalls-Voice Changer 
-Eva Launcher 
-Newlook Launcher 
-Pixel Screen Wallpaper

(With inputs from agencies)

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" loading="”lazy”" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

Users of Samsung, Huawei, and Google phones have been advised to remove a number of popular apps that may contain spyware which steals money. Tech experts have cautioned owners of Android smartphones and tablets that a variety of apps could be infected with harmful malware called 'Harly'.

Users of Samsung, Huawei, and Google phones have been advised to remove a number of popular apps that may contain spyware which steals money. Tech experts have cautioned owners of Android smartphones and tablets that a variety of apps could be infected with harmful malware called 'Harly'. What is Harly? Harly, named after Harley Quinn the popular Batman villain, who is also the Joker's girlfriend, is a type of trojan known as a "trojan subscriber" signs users up for paid services without their knowledge. Watch | Tech Talk: Popular apps capable of collecting private information on iPhones Since 2020, more than 190 Harly-infected apps have been discovered on Google Play, according to Kaspersky. The well-known antivirus supplier estimates that 4.8 million people have downloaded these apps, however, the actual number may be far higher. How does it work? The Harly family of Trojans imitates trustworthy applications. Scammers download common apps from Google Play, add malicious code to them, and then submit the altered versions to Google Play. Users might not even be aware that the apps are dangerous because they still have the functions that are provided in the description. Also read | Google deletes 50 apps infected with Joker malware. Recommends users to delete the apps if installed But don't you need a verification code for paid subscriptions? Yes, you do. However, according to The Daily Express, Harly can sign up Android users for pricey subscription services without their knowledge by stealthily taking security codes from text messages. It can also check subscriptions over the phone without the device owner's knowledge, and once this is done, it could empty someone's bank account without being noticed. Also read | US discovers malware capable of gaining access to industrial control systems, issues alert How do we protect ourselves? The company advises reading user reviews and viewing an app's rating on Google Play before installing it. But bear in mind that ratings and reviews could be inflated. Another solution it recommends is of course "a reliable security solution." Which apps have been affected? Kaspersky, which first flagged the malware has made mention of a number of apps, some of which already have thousands of downloads. Here are a few apps that you need to skirt clear of: -Pony Camera -Live Wallpaper&Themes Launcher -Action Launcher & Wallpapers -Color Call -Good Launcher -Mondy Widgets -Funcalls-Voice Changer -Eva Launcher -Newlook Launcher -Pixel Screen Wallpaper (With inputs from agencies) WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

Explained: 'Harly' the latest malware in market, that can drain your bank accounts

A Chinese cyberespionage group named Bronze President, which also goes by the name Mustang Panda, has been using a malware named PlugX to target the computers of political leaders across the globe.

A Chinese cyberespionage group named Bronze President, which also goes by the name Mustang Panda, has been using a malware named PlugX to target the computers of political leaders across the globe. Secureworks Counter Threat Unit (CTU), a company that analyses threat data across the planet, observed a series of attacks in the month of July that used the LuhX malware. Government officials in Europe, West Asia, and South America were reportedly targeted. Read more: China launched cyberattack against Ukraine before Russian invasion: Report According to CTU, the footprint of the attack bore similarities to previous attacks by Bronze President. The Chinese espionage group imitated official diplomatic notices and lured the government officials. “Several characteristics of this campaign indicate that it was conducted by the likely Chinese government-sponsored Bronze President threat group, including the use of PlugX, file paths and naming schemes previously used by the threat group, the presence of shellcode in executable file headers, and politically themed decoy documents that align with regions where China has interests,” the CTU research team wrote in a statement. Explaining that the PlugX malware had capabilities beyond just information gathering, the CTU team further added. "PlugX is modular malware that contacts a command and control (C2) server for tasking and can download additional plugins to enhance its capability beyond basic information gathering," it said. It is pertinent to note that the malware usually arrived in the victim's computer, embedded within RAR archive files. Upon opening the file, the user is shown a Windows shortcut (LNK) file. Once the user clicks on the LNK file, the Plux malware is loaded, decrypted and executed in the system. The group stated that recently a Turkish official was targeted using a similar modus-operandi. The official received a notification letter, supposedly from the UK government, informing about the appointment of a new ambassador. However. the truth is there has been no change in the personnel. Opening the mail could have compromised the official. The cybersecurity firm advised that countries and organisations that China has an interest in could be at the most risk of being targeted and thus they needed to be aware of the group's activities. “Organisations in geographic regions of interest to China should closely monitor this group’s activities, especially organisations associated with or operating as government agencies,” read the statement. (With inputs from agencies) WATCH WION LIVE HERE:

Chinese hackers target foreign government officials using a new malware

In the US, a joint alert has been issued by several government agencies on a malicious cyber tool which has been created by unknown people. &nbsp;&nbsp;

What makes it highly crucial is that it is capable of gaining 'full system access' to multiple industrial control systems. &nbsp;

The public warning was declared by the FBI, the energy and homeland security departments and National Security Agency on Wednesday. &nbsp;

Also Read:&nbsp;<a href="https://www.wionews.com/world/elon-musk-looks-to-solidify-relationship-with-twitter-offers-to-buy-for-4139-billion-470976">Musk looks to 'solidify relationship' with Twitter, offers to buy for $41 bn</a>

They did not give details about how they found out about it. The tools have also been called "exceptionally rare and dangerous”. &nbsp;&nbsp;

"We're actually one step ahead of the adversary. None of us want them to understand where they screwed up," said Robert M Lee of Dragos, who is CEO of another government partner, while telling AP about why the government would not explain how the malware was discovered. &nbsp;&nbsp;

Watch:&nbsp;US officials urge Joe Biden to rebalance ties with Saudi Arabia

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/us-officials-urge-joe-biden-to-rebalance-ties-with-saudi-arabia-471055/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>
</div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

The Cybersecurity and Infrastructure Security Agency had published the alert.&nbsp; &nbsp;

Lee told AP that the malware was "designed to be a framework to go after lots of different types of industries and be leveraged multiple times. Based on the configuration of it, the initial targets would be LNG and electricity in North America." &nbsp;&nbsp;

(With inputs from agencies)

In the US, a joint alert has been issued by several government agencies on a malicious cyber tool which has been created by unknown people. What makes it highly crucial is that it is capable of gaining 'full system access' to multiple industrial control systems.

In the US, a joint alert has been issued by several government agencies on a malicious cyber tool which has been created by unknown people. What makes it highly crucial is that it is capable of gaining 'full system access' to multiple industrial control systems. The public warning was declared by the FBI, the energy and homeland security departments and National Security Agency on Wednesday. Also Read: Musk looks to 'solidify relationship' with Twitter, offers to buy for $41 bn They did not give details about how they found out about it. The tools have also been called "exceptionally rare and dangerous”. "We're actually one step ahead of the adversary. None of us want them to understand where they screwed up," said Robert M Lee of Dragos, who is CEO of another government partner, while telling AP about why the government would not explain how the malware was discovered. Watch: US officials urge Joe Biden to rebalance ties with Saudi Arabia × The Cybersecurity and Infrastructure Security Agency had published the alert. Lee told AP that the malware was "designed to be a framework to go after lots of different types of industries and be leveraged multiple times. Based on the configuration of it, the initial targets would be LNG and electricity in North America." (With inputs from agencies)

US discovers malware capable of gaining access to industrial control systems, issues alert

Ukraine on Tuesday said that websites of the country’s defence ministry, armed forces and two banks came under a cyber attack.

The Ukrainian Centre for Strategic Communications and Information Security, which is part of the culture ministry, issued a statement suggesting that the perpetrator may have Russian origins.

“It is not ruled out that the aggressor used tactics of little dirty tricks because its aggressive plans are not working out on a large scale,” it said.

A message on the home page of the Ukrainian defence ministry website said it was under maintenance. The ministry tweeted that its website was apparently under a cyber attack and it was working on restoring access to it.

Kyiv has blamed Moscow for similar attacks in the past, since Russia began massing more than 100,000 troops near the frontier.

The latest attack came hours after Russia indicated de-escalation of the Ukrainian crisis, with President Vladimir Putin asserting that his country does not seek war.

The Kremlin confirmed the pullback of some forces from Ukraine's borders, but said the move was planned and stressed Russia would continue to move troops across the country as it saw fit.

However, in a strange coincidence, US intelligence had predicted that cyber attacks would precede Russia’s Ukraine invasion on February 16.

According to POLITICO, President Joe Biden is reported to have informed allies over the phone that Russia will start a physical assault on Ukraine as soon as February 16.

He reportedly claimed that the invasion would be preceded by a barrage of missile strikes and cyber attacks

(With inputs from agencies)

Ukraine on Tuesday said that websites of the country’s defence ministry, armed forces and two banks came under a cyber attack. The Ukrainian Centre for Strategic Communications and Information Security, which is part of the culture ministry, issued a statement suggesting that the perpetrator may have Russian origins.

Ukraine on Tuesday said that websites of the country’s defence ministry, armed forces and two banks came under a cyber attack. The Ukrainian Centre for Strategic Communications and Information Security, which is part of the culture ministry, issued a statement suggesting that the perpetrator may have Russian origins. “It is not ruled out that the aggressor used tactics of little dirty tricks because its aggressive plans are not working out on a large scale,” it said. A message on the home page of the Ukrainian defence ministry website said it was under maintenance. The ministry tweeted that its website was apparently under a cyber attack and it was working on restoring access to it. Kyiv has blamed Moscow for similar attacks in the past, since Russia began massing more than 100,000 troops near the frontier. The latest attack came hours after Russia indicated de-escalation of the Ukrainian crisis, with President Vladimir Putin asserting that his country does not seek war. The Kremlin confirmed the pullback of some forces from Ukraine's borders, but said the move was planned and stressed Russia would continue to move troops across the country as it saw fit. However, in a strange coincidence, US intelligence had predicted that cyber attacks would precede Russia’s Ukraine invasion on February 16. According to POLITICO, President Joe Biden is reported to have informed allies over the phone that Russia will start a physical assault on Ukraine as soon as February 16. He reportedly claimed that the invasion would be preceded by a barrage of missile strikes and cyber attacks (With inputs from agencies)

As predicted by US, Ukraine hit by cyber attacks amid Russian invasion fears

Kaspersky recently discovered two new Android malware modifications that are capable of stealing cookies that are stored by the internet browser and social media applications. Consequentially, the attacker can then control the victim's social media accounts without the user ever finding out. 
&nbsp; 
Websites use cookies to primarily deliver a personalised experience to users. This is achieved by tracking the user's activity online. However, if this information lands in the possession of a hacker, it automatically becomes a security risk.

The hackers, once they have the requisite information, can use the unique session ID which is generated by cookies to bypass the need to login into a portal.

If the user ID is compromised, attackers can easily assume the identity of the user and trick websites and applications. Through this, they can take control of the accounts. This is the model that allows sensitive information to be shared by hackers. The two new Trojans responsible for this can then leak any information.

The make-up of one of the Trojans allows it to acquire ''root rights'' which essentially allows the cookies to be transferred from Facebook or any other social media website to the servers of the hackers.

<h6><img alt="p" data-entity-type="file" data-entity-uuid="ec79d5a0-e91d-4d8b-8a53-44b1686377b1" src="//cdn.wionews.com/sites/default/files/inline-images/Untitled%20design%20%281%29_102.jpg" /> 
Image courtesy: AFP 
&nbsp;</h6>

However, it's not that simple to gain control of someone's account, for some websites have measures in place that disallow suspicious log-in attempts.

This can be bypassed through the second Trojan, which runs as an app on the victim's device and circumvents security measures to gain access to personal data without the user finding out. In essence, the attacker then assumes the identity of the user and then may be able to use the personal accounts of people to post whatever they please.

There's no clarity on why attackers want access to the social media accounts of random users. However, as reported by TechRadar, these accounts may be used to launch spam and phishing attacks across social media.

Igor Golovin, a malware analyst at Kaspersky, suggested that this threat is expected to grow.

“By combining two attacks, the cookie thieves discovered a way to gain control over their victims’ accounts without arousing suspicions. While this is a relatively new threat, so far, only about 1000 individuals have been targeted, that number is growing and will most likely continue to do so, particularly since it’s so hard for websites to detect. Even though we typically don’t pay attention to cookies when we’re surfing the web, they’re still another means of processing our personal information, and anytime data about us is collected online, we need to pay attention”, Golovin said.

<h6><img alt="-" data-entity-type="file" data-entity-uuid="2bb64d9e-2f0d-4704-bfcb-019c89859330" src="//cdn.wionews.com/sites/default/files/inline-images/Untitled%20design%20%282%29_83.jpg" /> 
Image courtesy: AFP 
&nbsp;</h6>

Earlier in January, Kaspersky had also reported the existence of a malware app called Shopper, which was primarily used to improve the ratings of shopping apps across platforms. The app was able to spread advertisements and install apps without requiring the consent of the user. This particular malware affected almost 15 per cent, Indian users.

Golovin highlighted the security gap embedded into the mechanism of cookies, and how it continues to leave millions of users and their data vulnerable.

The Data Security Council of India (DSCI) reported that India registers the second-highest cyberattacks in the world during the period between 2016-18.

Kaspersky recently discovered two new Android malware modifications that are capable of stealing cookies that are stored by the internet browser and social media applications.

Kaspersky recently discovered two new Android malware modifications that are capable of stealing cookies that are stored by the internet browser and social media applications. Consequentially, the attacker can then control the victim's social media accounts without the user ever finding out. Websites use cookies to primarily deliver a personalised experience to users. This is achieved by tracking the user's activity online. However, if this information lands in the possession of a hacker, it automatically becomes a security risk. The hackers, once they have the requisite information, can use the unique session ID which is generated by cookies to bypass the need to login into a portal. If the user ID is compromised, attackers can easily assume the identity of the user and trick websites and applications. Through this, they can take control of the accounts. This is the model that allows sensitive information to be shared by hackers. The two new Trojans responsible for this can then leak any information. The make-up of one of the Trojans allows it to acquire ''root rights'' which essentially allows the cookies to be transferred from Facebook or any other social media website to the servers of the hackers. Image courtesy: AFP However, it's not that simple to gain control of someone's account, for some websites have measures in place that disallow suspicious log-in attempts. This can be bypassed through the second Trojan, which runs as an app on the victim's device and circumvents security measures to gain access to personal data without the user finding out. In essence, the attacker then assumes the identity of the user and then may be able to use the personal accounts of people to post whatever they please. There's no clarity on why attackers want access to the social media accounts of random users. However, as reported by TechRadar, these accounts may be used to launch spam and phishing attacks across social media. Igor Golovin, a malware analyst at Kaspersky, suggested that this threat is expected to grow. “By combining two attacks, the cookie thieves discovered a way to gain control over their victims’ accounts without arousing suspicions. While this is a relatively new threat, so far, only about 1000 individuals have been targeted, that number is growing and will most likely continue to do so, particularly since it’s so hard for websites to detect. Even though we typically don’t pay attention to cookies when we’re surfing the web, they’re still another means of processing our personal information, and anytime data about us is collected online, we need to pay attention”, Golovin said. Image courtesy: AFP Earlier in January, Kaspersky had also reported the existence of a malware app called Shopper, which was primarily used to improve the ratings of shopping apps across platforms. The app was able to spread advertisements and install apps without requiring the consent of the user. This particular malware affected almost 15 per cent, Indian users. Golovin highlighted the security gap embedded into the mechanism of cookies, and how it continues to leave millions of users and their data vulnerable. The Data Security Council of India (DSCI) reported that India registers the second-highest cyberattacks in the world during the period between 2016-18.

Combination of Android malware may compromise user's social media accounts

WION has learnt that the Indian Space Research Organization (ISRO) was also alerted at the same time (around September 4th) when the Kudankulam Nuclear Power Plant was informed about the possible malware/virus attack. Some of its computers (used only for internet surfing purposes) were also affected by the malware.&nbsp;

The Kudankulam Nuclear Power Plant located in Tamil Nadu’s Tirunelveli district has been in the news after social media users claimed that some of the facility’s systems were hit by a computer virus/malware.&nbsp;

The first official statement in this regard came from the information officer of the Kudankulam Nuclear Power Project on October 29.&nbsp;

“Some false information is being propagated on the social media platform electronic and print media with reference to the cyber attack on Kudankulam Nuclear Power Plant. This is to clarify that Kudankulam Nuclear Power Project (KKNPP) and other Indian nuclear power plants control systems are stand-alone and not connected to outside cyber network and internet,” &nbsp;the statement said.&nbsp;

Any cyber-attack on the Nuclear Power Plant Control System is not possible. At present, KKNPP Unit -1 and 2 are operating at 1000MWe and 600MWe respectively without any operational or safety concerns.&nbsp;

However, on the very next day (October 30) the Nuclear Power Corporation of India Limited (NPCIL) issued a press release stating that the identification of malware in NPCIL system is correct.&nbsp;

“The matter was conveyed by CERT-In when it was noticed by them on September 4, 2019. The matter was immediately investigated by DAE specialists. The investigation revealed that the infected PC belonged to a user who was connected to the internet-connected network used for administrative purposes. This is isolated from the critical internal network. The networks are being continuously monitored. The investigation also confirms that the plant systems are not affected,” the release stated.

While there is no official statement from ISRO, WION has learnt that few ISRO computers that were connected to the internet (only for browsing purposes) while being completely isolated from the internal network were only affected. ISRO had taken appropriate action and has been monitoring regularly.&nbsp;

It is also understood that such malware attacks keep happening on all systems that are connected to the internet for web surfing and that cyber-security experts are constantly maintaining a vigil.&nbsp;

WION has learnt that the Indian Space Research Organization (ISRO) was also alerted at the same time (around September 4th) when the Kudankulam Nuclear Power Plant was informed about the possible malware/virus attack.

WION has learnt that the Indian Space Research Organization (ISRO) was also alerted at the same time (around September 4th) when the Kudankulam Nuclear Power Plant was informed about the possible malware/virus attack. Some of its computers (used only for internet surfing purposes) were also affected by the malware. The Kudankulam Nuclear Power Plant located in Tamil Nadu’s Tirunelveli district has been in the news after social media users claimed that some of the facility’s systems were hit by a computer virus/malware. The first official statement in this regard came from the information officer of the Kudankulam Nuclear Power Project on October 29. “Some false information is being propagated on the social media platform electronic and print media with reference to the cyber attack on Kudankulam Nuclear Power Plant. This is to clarify that Kudankulam Nuclear Power Project (KKNPP) and other Indian nuclear power plants control systems are stand-alone and not connected to outside cyber network and internet,” the statement said. Any cyber-attack on the Nuclear Power Plant Control System is not possible. At present, KKNPP Unit -1 and 2 are operating at 1000MWe and 600MWe respectively without any operational or safety concerns. However, on the very next day (October 30) the Nuclear Power Corporation of India Limited (NPCIL) issued a press release stating that the identification of malware in NPCIL system is correct. “The matter was conveyed by CERT-In when it was noticed by them on September 4, 2019. The matter was immediately investigated by DAE specialists. The investigation revealed that the infected PC belonged to a user who was connected to the internet-connected network used for administrative purposes. This is isolated from the critical internal network. The networks are being continuously monitored. The investigation also confirms that the plant systems are not affected,” the release stated. While there is no official statement from ISRO, WION has learnt that few ISRO computers that were connected to the internet (only for browsing purposes) while being completely isolated from the internal network were only affected. ISRO had taken appropriate action and has been monitoring regularly. It is also understood that such malware attacks keep happening on all systems that are connected to the internet for web surfing and that cyber-security experts are constantly maintaining a vigil.

Some of ISRO’s computers used for web surfing were affected by malware 

The US Department of Homeland Security <a href="http://www.wionews.com/world/britain-believes-north-korea-was-behind-ransomware-wannacry-nhs-cyber-attack-23030">issued an alert on Tuesday warning malware developed</a> in North Korea may still be hidden in computer networks worldwide.

US officials told AFP a hacker group called &quot;Hidden Cobra&quot; also known as &quot;Lazarus&quot; has the ability to &quot;maintain a presence on victims&#39; networks&quot; with the aim to &quot;further network exploitation.&quot;

Last month, Britain had blamed North Korea for being behind the WannaCry cyber attack in May which had disrupted the nation&#39;s health services and businesses. The WannaCry virus had infected more than 300,000 computers in 150 countries within a few days.

&nbsp;DHS Computer Emergency Response Team said some networks could be infected with the Volgmer &quot;backdoor Trojan&quot; which gives hackers complete control of a computer system.

The team said FBI suspects Fallchill tool was being used since last year and Volgmer since 2013.&nbsp;

Hackers in the Hidden Cobra or Lazarus group have been active since 2009 and &quot;have leveraged their capabilities to target and compromise a range of victims,&quot; according to a DHS report in June, AFP said.

&quot;Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature,&quot; the report added.

DHS Computer Emergency Response Team said some networks could be infected with the Volgmer "backdoor Trojan" which gives hackers complete control of a computer system.

The US Department of Homeland Security issued an alert on Tuesday warning malware developed in North Korea may still be hidden in computer networks worldwide. US officials told AFP a hacker group called "Hidden Cobra" also known as "Lazarus" has the ability to "maintain a presence on victims' networks" with the aim to "further network exploitation." Last month, Britain had blamed North Korea for being behind the WannaCry cyber attack in May which had disrupted the nation's health services and businesses. The WannaCry virus had infected more than 300,000 computers in 150 countries within a few days. DHS Computer Emergency Response Team said some networks could be infected with the Volgmer "backdoor Trojan" which gives hackers complete control of a computer system. The team said FBI suspects Fallchill tool was being used since last year and Volgmer since 2013. Hackers in the Hidden Cobra or Lazarus group have been active since 2009 and "have leveraged their capabilities to target and compromise a range of victims," according to a DHS report in June, AFP said. "Some intrusions have resulted in the exfiltration of data while others have been disruptive in nature," the report added.

North Korean malware still lurks in computers worldwide: US

A British computer security researcher hailed as a hero for thwarting the &quot;WannaCry&quot; ransomware onslaught was in US custody on Thursday after being indicted on charges of creating malware to attack banks.

Marcus Hutchins, known by the alias &quot;Malwaretech,&quot; was charged in an indictment dated July 12 and unsealed this week by federal authorities in Wisconsin.

The US Justice Department said in a statement Hutchins was arrested Wednesday in Las Vegas, where a major Def Con hacker security conference took place over the weekend.

Twitter postings from other security researchers said he was detained as he prepared to fly back to Britain.

Hutchins faces criminal charges including conspiracy to commit computer fraud, according to the US Department of Justice.

The indictment accuses Hutchins and another individual of making and distributing Kronos &quot;banking Trojan,&quot; a reference to malicious software designed to steal user names and passwords used at online banking sites.

Since it was created, Kronos has been configured to work on banking systems in Britain, Canada, Germany, Poland, France, and other countries, according to the DOJ.

The indictment set the time of the activity by Hutchins as being from July 2014 to July of the following year.

&#39;Dark markets&#39;

Hutchins was part of a conspiracy to distribute the hacking tool on so-called dark markets, according to the indictment signed last month by US Attorney Gregory Haanstad.

Kronos was evidently first made available through certain internet forums in early 2014, and was marketed and distributed through a hidden online AlphaBay marketplace, according to US prosecutors.

AlphaBay was shut down by US and European police in a crackdown on two huge &quot;dark web&quot; marketplaces that allowed the anonymous online trade of drugs, hacking software and guns.

The timing of the indictment of Hutchins raises questions as to whether insights mined from the AlphaBay probe lead to his arrest.

Underground websites AlphaBay and Hansa Market had tens of thousands of sellers of deadly drugs like fentanyl and other illicit goods serving more than 200,000 customers worldwide.

AlphaBay, the largest dark web market, had been run out of Thailand, and filled a gap left behind by the notorious Silk Road online market, shut down by authorities in 2013.

Officials at the time said shutting down the two markets and the arrests of administrators enabled them to collect extensive intelligence on buyers and sellers, including criminal gangs. Their names were being distributed to law enforcement in 37 countries.

From hero to accused

Lawyers at the San Francisco-based online rights group Electronic Frontier Foundation said they were looking to contact Hutchins.

&quot;The EFF is deeply concerned about the arrest of Marcus Hutchins, a security researcher known for shutting down the WannaCry ransomware. We are looking into the matter, and are reaching out to Hutchins,&quot; a statement from the group said.

A spokesperson for the British Embassy in Washington said only that they &quot;are in touch with local authorities in Las Vegas following reports of a British man being arrested.&quot;

Hutchins was hailed as a hero in May for finding and triggering a &quot;kill switch&quot; for a WannaCry ransomware attack that was spreading wildly around the world, locking away data on computers and demanding money for its release.

Andrew Mabbitt, another security researcher who was with Hutchins in Las Vegas, said he did not believe the allegations.

&quot;He spent his career stopping malware, not writing it,&quot; Mabbitt said on Twitter. 
&nbsp;

Marcus Hutchins, known by the alias "Malwaretech," was charged in an indictment dated July 12 and unsealed this week by federal authorities in Wisconsin

A British computer security researcher hailed as a hero for thwarting the "WannaCry" ransomware onslaught was in US custody on Thursday after being indicted on charges of creating malware to attack banks. Marcus Hutchins, known by the alias "Malwaretech," was charged in an indictment dated July 12 and unsealed this week by federal authorities in Wisconsin. The US Justice Department said in a statement Hutchins was arrested Wednesday in Las Vegas, where a major Def Con hacker security conference took place over the weekend. Twitter postings from other security researchers said he was detained as he prepared to fly back to Britain. Hutchins faces criminal charges including conspiracy to commit computer fraud, according to the US Department of Justice. The indictment accuses Hutchins and another individual of making and distributing Kronos "banking Trojan," a reference to malicious software designed to steal user names and passwords used at online banking sites. Since it was created, Kronos has been configured to work on banking systems in Britain, Canada, Germany, Poland, France, and other countries, according to the DOJ. The indictment set the time of the activity by Hutchins as being from July 2014 to July of the following year. 'Dark markets' Hutchins was part of a conspiracy to distribute the hacking tool on so-called dark markets, according to the indictment signed last month by US Attorney Gregory Haanstad. Kronos was evidently first made available through certain internet forums in early 2014, and was marketed and distributed through a hidden online AlphaBay marketplace, according to US prosecutors. AlphaBay was shut down by US and European police in a crackdown on two huge "dark web" marketplaces that allowed the anonymous online trade of drugs, hacking software and guns. The timing of the indictment of Hutchins raises questions as to whether insights mined from the AlphaBay probe lead to his arrest. Underground websites AlphaBay and Hansa Market had tens of thousands of sellers of deadly drugs like fentanyl and other illicit goods serving more than 200,000 customers worldwide. AlphaBay, the largest dark web market, had been run out of Thailand, and filled a gap left behind by the notorious Silk Road online market, shut down by authorities in 2013. Officials at the time said shutting down the two markets and the arrests of administrators enabled them to collect extensive intelligence on buyers and sellers, including criminal gangs. Their names were being distributed to law enforcement in 37 countries. From hero to accused Lawyers at the San Francisco-based online rights group Electronic Frontier Foundation said they were looking to contact Hutchins. "The EFF is deeply concerned about the arrest of Marcus Hutchins, a security researcher known for shutting down the WannaCry ransomware. We are looking into the matter, and are reaching out to Hutchins," a statement from the group said. A spokesperson for the British Embassy in Washington said only that they "are in touch with local authorities in Las Vegas following reports of a British man being arrested." Hutchins was hailed as a hero in May for finding and triggering a "kill switch" for a WannaCry ransomware attack that was spreading wildly around the world, locking away data on computers and demanding money for its release. Andrew Mabbitt, another security researcher who was with Hutchins in Las Vegas, said he did not believe the allegations. "He spent his career stopping malware, not writing it," Mabbitt said on Twitter.

Hero who stopped WannaCry attack arrested in US on separate malware charges

The primary target of a crippling computer virus that spread from Ukraine across the world this week is highly likely to have been that country&#39;s computer infrastructure, according to a top Ukrainian police official.

Cyber security firms are trying to piece together who was behind the computer worm, dubbed NotPetya by some experts, which has paralysed thousands of machines worldwide, shutting down ports, factories, and offices as it spread through internal organisational networks to an estimated 60 countries.

Ukrainian politicians blamed Russia, but a Kremlin spokesman dismissed &quot;unfounded blanket accusations&quot;. Kiev has accused Moscow of two previous cyber strikes on the Ukrainian power grid and other attacks since Russia annexed Crimea in 2014.

A growing consensus among security researchers, armed with technical evidence, suggests the main purpose of the attack was to install new malware on computers at government and commercial organisations in Ukraine. Rather than extortion, the goal may be to plant the seeds of future sabotage, experts said.

International firms appear to have been hit through their operations in the country.

Slovakian security software firm ESET released statistics showing 75 percent of the infections detected among its global customer base were in Ukraine, and that all of the top 10 countries hit were located in central, eastern or southern Europe.

Arne Schoenbohm, president of BSI, Germany&#39;s Federal cyber security agency, told that most of the damage from the attack had hit Ukraine, and Russia to a lesser extent, with only a few dozen German firms affected.

&quot;In all of the known cases, the companies were first infected through a Ukrainian subsidiary,&quot; the German official said.

SMOKESCREEN

Ukraine&#39;s cyber police said that it had received 1,500 requests for help from individuals and companies in connection with the virus.

The malicious code in the new virus encrypted data on computers and demanded victims pay a $300 ransom, similar to the extortion tactic used in a global WannaCry ransomware attack in May.

A top Ukrainian police official told that the extortion demands were likely a smokescreen, echoing working hypotheses from top cyber security firms, who consider NotPetya a &quot;wiper&quot;, or tool for destroying data and wiping hard disks clean, that is disguised as ransomware.

&quot;Since the virus was modified to encrypt all data and make decryption impossible, the likelihood of it being done to install new malware is high,&quot; the official, who declined to be identified said.

Information Systems Security Partners (ISSP), a Kiev-based cyber research firm that has investigated previous cyber attacks against Ukraine, is pursuing the same line of inquiry.

ISSP said that given that few people actually paid the $300 demanded for removing the virus, money was unlikely to be the primary object of the attack.

&quot;It&#39;s highly likely that during this attack new attacks were set up,&quot; said ISSP chairman Oleg Derevianko. &quot;At almost all organisations whose network domains were infected, not all computers went offline,&quot; he said by phone. &quot;Why didn&#39;t they all go offline? We are trying to understand what they might have left on those machines that weren&#39;t hit.&quot;

Ukraine&#39;s National Security and Defence Council Secretary Oleksandr Turchynov said the virus was first and foremost spread through an update issued by an accounting service and business management software. &quot;Also involved was the hosting service of an internet provider, which the SBU (Ukraine&#39;s state security service) has already questioned about cooperation with Russian intelligence agencies,&quot; he said.

DESTRUCTIVE INTENT

Technical experts familiar with the recent history of the cyber escalation between Russia and Ukraine, say these latest attacks are part of the wider political and military conflict, although no &quot;smoking gun&quot; has been found to identify the culprits.

John Hultquist, a cyber intelligence analyst with FireEye, said the failed ransomware attack disguises an as yet unseen destructive motive. &quot;If it were an attack masquerading as crime, that would not be unprecedented at all,&quot; Hultquist said.

Some cyber security researchers have said the fact that the Kremlin&#39;s two flagship energy companies are victims of the attack could suggest Moscow was not behind it.

Russian oil major Rosneft was one of the first companies to reveal it had been compromised by the virus and sources told computers at state gas giant Gazprom had also been infected.

For technical reasons, NotPetya appears to be more targeted than last month&#39;s global ransomware attack, known as WannaCry. When first infected by WannaCry, computers scanned the internet globally for other vulnerable machines.

By contrast, NotPetya does not randomly scan the Internet to find new computers to infect. It only spreads itself inside organizational networks, taking advantage of a variety of legitimate network administration tools.

This makes it far harder for anti-virus software or network security technicians to detect. It also gives it the capacity to infect other Windows computers, even those with the latest security patches, several security firms warned.

&quot;Petya is proving to be more sophisticated than WannaCry in terms of scope, ability to be neutralized, and apparently, the motivation behind its launch,&quot; corporate security consulting firm Kroll has advised its clients.

So far, NotPetya appears only to have been distributed inside Ukraine via a handful of so-called &quot;watering hole attacks&quot; - by piggy-backing on the software updating feature of a popular national tax accounting program known as MEDoc.

Kaspersky, a global cyber security firm based in Russia, also said they found a second distribution point on a local news site in the city of Bakhmut, Ukraine, which infected visitors who clicked on the site with the ransomware-like attack.

&quot;Our analysis indicates the main purpose of the attack was not financial gain, but widespread destruction,&quot; said Costin Raiu, Kaspersky&rsquo;s global head of research. &quot;NotPetya ..combined elements of a targeted watering hole attack we&rsquo;ve traditionally seen used by nation states with traditional software exploitation to devastate a specific user base,&quot; Lesley Carhart, a Chicago-based security researcher, wrote in a blog widely shared online by top security experts.

Cyber security firms are trying to piece together who was behind the computer worm, which has paralysed thousands of machines worldwide

The primary target of a crippling computer virus that spread from Ukraine across the world this week is highly likely to have been that country's computer infrastructure, according to a top Ukrainian police official. Cyber security firms are trying to piece together who was behind the computer worm, dubbed NotPetya by some experts, which has paralysed thousands of machines worldwide, shutting down ports, factories, and offices as it spread through internal organisational networks to an estimated 60 countries. Ukrainian politicians blamed Russia, but a Kremlin spokesman dismissed "unfounded blanket accusations". Kiev has accused Moscow of two previous cyber strikes on the Ukrainian power grid and other attacks since Russia annexed Crimea in 2014. A growing consensus among security researchers, armed with technical evidence, suggests the main purpose of the attack was to install new malware on computers at government and commercial organisations in Ukraine. Rather than extortion, the goal may be to plant the seeds of future sabotage, experts said. International firms appear to have been hit through their operations in the country. Slovakian security software firm ESET released statistics showing 75 percent of the infections detected among its global customer base were in Ukraine, and that all of the top 10 countries hit were located in central, eastern or southern Europe. Arne Schoenbohm, president of BSI, Germany's Federal cyber security agency, told that most of the damage from the attack had hit Ukraine, and Russia to a lesser extent, with only a few dozen German firms affected. "In all of the known cases, the companies were first infected through a Ukrainian subsidiary," the German official said. SMOKESCREEN Ukraine's cyber police said that it had received 1,500 requests for help from individuals and companies in connection with the virus. The malicious code in the new virus encrypted data on computers and demanded victims pay a $300 ransom, similar to the extortion tactic used in a global WannaCry ransomware attack in May. A top Ukrainian police official told that the extortion demands were likely a smokescreen, echoing working hypotheses from top cyber security firms, who consider NotPetya a "wiper", or tool for destroying data and wiping hard disks clean, that is disguised as ransomware. "Since the virus was modified to encrypt all data and make decryption impossible, the likelihood of it being done to install new malware is high," the official, who declined to be identified said. Information Systems Security Partners (ISSP), a Kiev-based cyber research firm that has investigated previous cyber attacks against Ukraine, is pursuing the same line of inquiry. ISSP said that given that few people actually paid the $300 demanded for removing the virus, money was unlikely to be the primary object of the attack. "It's highly likely that during this attack new attacks were set up," said ISSP chairman Oleg Derevianko. "At almost all organisations whose network domains were infected, not all computers went offline," he said by phone. "Why didn't they all go offline? We are trying to understand what they might have left on those machines that weren't hit." Ukraine's National Security and Defence Council Secretary Oleksandr Turchynov said the virus was first and foremost spread through an update issued by an accounting service and business management software. "Also involved was the hosting service of an internet provider, which the SBU (Ukraine's state security service) has already questioned about cooperation with Russian intelligence agencies," he said. DESTRUCTIVE INTENT Technical experts familiar with the recent history of the cyber escalation between Russia and Ukraine, say these latest attacks are part of the wider political and military conflict, although no "smoking gun" has been found to identify the culprits. John Hultquist, a cyber intelligence analyst with FireEye, said the failed ransomware attack disguises an as yet unseen destructive motive. "If it were an attack masquerading as crime, that would not be unprecedented at all," Hultquist said. Some cyber security researchers have said the fact that the Kremlin's two flagship energy companies are victims of the attack could suggest Moscow was not behind it. Russian oil major Rosneft was one of the first companies to reveal it had been compromised by the virus and sources told computers at state gas giant Gazprom had also been infected. For technical reasons, NotPetya appears to be more targeted than last month's global ransomware attack, known as WannaCry. When first infected by WannaCry, computers scanned the internet globally for other vulnerable machines. By contrast, NotPetya does not randomly scan the Internet to find new computers to infect. It only spreads itself inside organizational networks, taking advantage of a variety of legitimate network administration tools. This makes it far harder for anti-virus software or network security technicians to detect. It also gives it the capacity to infect other Windows computers, even those with the latest security patches, several security firms warned. "Petya is proving to be more sophisticated than WannaCry in terms of scope, ability to be neutralized, and apparently, the motivation behind its launch," corporate security consulting firm Kroll has advised its clients. So far, NotPetya appears only to have been distributed inside Ukraine via a handful of so-called "watering hole attacks" - by piggy-backing on the software updating feature of a popular national tax accounting program known as MEDoc. Kaspersky, a global cyber security firm based in Russia, also said they found a second distribution point on a local news site in the city of Bakhmut, Ukraine, which infected visitors who clicked on the site with the ransomware-like attack. "Our analysis indicates the main purpose of the attack was not financial gain, but widespread destruction," said Costin Raiu, Kaspersky’s global head of research. "NotPetya ..combined elements of a targeted watering hole attack we’ve traditionally seen used by nation states with traditional software exploitation to devastate a specific user base," Lesley Carhart, a Chicago-based security researcher, wrote in a blog widely shared online by top security experts.

Global cyber attack likely cover for malware installation in Ukraine: Police official

malware

Malware, News on Malware, stories on Malware, articles on Malware, Malware stories at Wion, Malware news, Malware latest news