Google has identified a connection between Russian state hackers and exploits that bear an “identical or strikingly similar” resemblance to those created by spyware companies NSO Group and Intellexa, raising concerns about the spread of commercial spyware into the hands of state-backed threat actors.

Google reveals new exploits targeting Chrome and iOS Webkit

Australia, on Tuesday (Jan 23) sanctioned a Russian man named Aleksandr Ermakov for his role in the country’s worst data breach, which impacted nearly 10 million customers of the insurer Medibank. Canberra announced first-of-its-kind sanctions which include a travel ban and financial penalties.&nbsp;

<h2>About the sanctions</h2>

In late 2022, Medibank, Australia’s largest private health insurer, disclosed that a hacker had stolen the personal information of 9.7 million current and former customers, and released the data on the dark web.&nbsp;

The files published online included sensitive information about millions of Australians, including abortion records and treatment received for mental health or addiction.&nbsp;

WATCH |&nbsp;Australia sanctions Russian hacker for role in 2022 Medibank cyberattack

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/australia-sanctions-russian-hacker-for-role-in-2022-medibank-cyberattack-682809/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

Australia has recently witnessed a spike in the number of cyber attacks, prompting the government to overhaul its cyber security rules last year and set up an agency to help coordinate responses.

This is the first time that Australia has imposed its cyber sanctions following a framework which was legislated in 2021.&nbsp;

The sanctions against Ermakov, 33, also include financial sanctions and a travel ban, said Home Affairs Minister Clare O’Neil during a press briefing, describing the Medibank hack as “the single most devastating cyber-attack we have experienced as a nation”.&nbsp;

“Literally millions of people having personal data about themselves, their family members, taken from them and cruelly placed online for others to see,” said O’Neil.&nbsp;

She added, “These people are cowards and they’re scumbags. They hide behind technology and today, the Australian government is saying that when we put our minds to it, we’ll unveil who you are, and we’ll make sure you are accountable.”&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/world/medibank-data-leak-hackers-now-release-info-related-to-abortion-533115">Medibank data leak: Australian police blame Russian hackers</a>

The sanctions imposed make it a criminal offence, punishable by up to 10 years in jail and fines, to provide Ermakov with any assets, including cryptocurrency wallets or ransomware payments.

O'Neil also said that officials are still investigating the data breach and many more may face penalties. While not much is known about Ermakov, Australian intelligence authorities say he is part of the infamous Russian cyber-crime gang REvil.&nbsp;

<h2>‘Single most devastating cyber-attack’</h2>

A report by the Australian government, in November, showed that state-sponsored cyber groups and hackers had stepped up assaults on Australia's critical infrastructure, businesses and homes.&nbsp;

In the Medibank breach, hackers stole login details which granted them access to all of the insurers’ customer data which included athletes, prominent media figures and even Australian Prime Minister Anthony Albanese.

However, Medibank, with government support, refused to pay a multi-million dollar ransom after which the hackers published the data online.&nbsp;

ALSO READ |&nbsp;<a href="https://www.wionews.com/world/australias-biggest-health-insurer-medibank-reports-huge-data-breach-527061">Australia's biggest health insurer Medibank reports huge data breach</a>

They first released files named “good-list” and “naughty-list” which included records of treatment for mental health, addiction, drug abuse and sexually transmitted infections. These files also contained people’s names, addresses, birthdates, and government ID numbers.&nbsp;

The hacker group which is said to be behind this breach also released a file named “abortions.csv” which comprised information about some customers’ end-of-pregnancy procedures.

(With inputs from agencies) 
&nbsp;

Australia, on Tuesday (Jan 23) sanctioned a Russian man named Aleksandr Ermakov for his role in the country’s worst data breach, which impacted nearly 10 million customers of the insurer Medibank.

Australia, on Tuesday (Jan 23) sanctioned a Russian man named Aleksandr Ermakov for his role in the country’s worst data breach, which impacted nearly 10 million customers of the insurer Medibank. Canberra announced first-of-its-kind sanctions which include a travel ban and financial penalties. About the sanctions In late 2022, Medibank, Australia’s largest private health insurer, disclosed that a hacker had stolen the personal information of 9.7 million current and former customers, and released the data on the dark web. The files published online included sensitive information about millions of Australians, including abortion records and treatment received for mental health or addiction. WATCH | Australia sanctions Russian hacker for role in 2022 Medibank cyberattack Australia has recently witnessed a spike in the number of cyber attacks, prompting the government to overhaul its cyber security rules last year and set up an agency to help coordinate responses. This is the first time that Australia has imposed its cyber sanctions following a framework which was legislated in 2021. The sanctions against Ermakov, 33, also include financial sanctions and a travel ban, said Home Affairs Minister Clare O’Neil during a press briefing, describing the Medibank hack as “the single most devastating cyber-attack we have experienced as a nation”. “Literally millions of people having personal data about themselves, their family members, taken from them and cruelly placed online for others to see,” said O’Neil. She added, “These people are cowards and they’re scumbags. They hide behind technology and today, the Australian government is saying that when we put our minds to it, we’ll unveil who you are, and we’ll make sure you are accountable.” ALSO READ | Medibank data leak: Australian police blame Russian hackers The sanctions imposed make it a criminal offence, punishable by up to 10 years in jail and fines, to provide Ermakov with any assets, including cryptocurrency wallets or ransomware payments. O'Neil also said that officials are still investigating the data breach and many more may face penalties. While not much is known about Ermakov, Australian intelligence authorities say he is part of the infamous Russian cyber-crime gang REvil. ‘Single most devastating cyber-attack’ A report by the Australian government, in November, showed that state-sponsored cyber groups and hackers had stepped up assaults on Australia's critical infrastructure, businesses and homes. In the Medibank breach, hackers stole login details which granted them access to all of the insurers’ customer data which included athletes, prominent media figures and even Australian Prime Minister Anthony Albanese. However, Medibank, with government support, refused to pay a multi-million dollar ransom after which the hackers published the data online. ALSO READ | Australia's biggest health insurer Medibank reports huge data breach They first released files named “good-list” and “naughty-list” which included records of treatment for mental health, addiction, drug abuse and sexually transmitted infections. These files also contained people’s names, addresses, birthdates, and government ID numbers. The hacker group which is said to be behind this breach also released a file named “abortions.csv” which comprised information about some customers’ end-of-pregnancy procedures. (With inputs from agencies)

Medibank breach: Russian hacker sanctioned for role in Australia’s biggest data theft

In the United Kingdom, the Royal Mails International Delivery Services suffered a severe disruption on Wednesday and now some reports are suggesting that a ransomware group with links in Russia is behind this attack.

UK: Postal group Royal Mail hit by 'Russia-linked' ransomware attack

The websites of a number of major United States airports were down for some time on Monday after a “coordinated denial-of-service attack” from pro-Russia hackers. While the websites were not active for a few hours, the officials made it clear that no flights were affected by the disruptions.&nbsp;

In the aftermath of the outage, the hacker's group called themselves ‘Killnet’ and claimed responsibility for the disruption and later, it posted a list of their potential targets on the messaging app Telegram.&nbsp;

Also read |&nbsp;<a href="https://www.wionews.com/world/russia-ukraine-conflict-live-updates-three-loud-blasts-rock-kyiv-report-523917" hreflang="en">Ukraine war LIVE | Putin warns of 'severe' attacks as Russia pounds Ukraine</a>

The “Russian hacktivists” are well-known supporters of the Kremlin and according to CNN, they specialise in launching distributed denial of service (DDoS) attacks which can hamper t any website.&nbsp;

Most airports notified the FBI and the Transportation Security Administration immediately after the website issues and the resident Information-technology teams started the recovery process.&nbsp;

“No internal airport systems were compromised and there were no operational disruptions,” spokeswoman Victoria Spilabotte for the Los Angeles International Airport told ABC News.&nbsp;

A similar statement was also released by Atlanta’s Hartsfield-Jackson International Airport.&nbsp;

Also read |&nbsp;<a href="https://www.wionews.com/world/united-kingdom-sanctions-irans-morality-police-over-mahsa-aminis-death-524170">United Kingdom sanctions Iran's morality police over Mahsa Amini’s death</a>

“We noticed this morning that the external website was down, and our IT and security people are in the process of investigating,” said spokesman Andrew Gobeil. “There has been no impact on operations.”&nbsp;

Disruptions also occurred on the official website of Chicago's O'Hare International Airport, but the Chicago Department of Aviation was able to solve the problem within a few hours.&nbsp;

A Transportation Security Administration (TSA) spokesperson told CNN that the authorities are monitoring all the airports on Killnet’s list for any future attacks.&nbsp;

The websites of a number of major United States airports were down for some time on Monday after a “coordinated denial-of-service attack” from pro-Russia hackers.

The websites of a number of major United States airports were down for some time on Monday after a “coordinated denial-of-service attack” from pro-Russia hackers. While the websites were not active for a few hours, the officials made it clear that no flights were affected by the disruptions. In the aftermath of the outage, the hacker's group called themselves ‘Killnet’ and claimed responsibility for the disruption and later, it posted a list of their potential targets on the messaging app Telegram. Also read | Ukraine war LIVE | Putin warns of 'severe' attacks as Russia pounds Ukraine The “Russian hacktivists” are well-known supporters of the Kremlin and according to CNN, they specialise in launching distributed denial of service (DDoS) attacks which can hamper t any website. Most airports notified the FBI and the Transportation Security Administration immediately after the website issues and the resident Information-technology teams started the recovery process. “No internal airport systems were compromised and there were no operational disruptions,” spokeswoman Victoria Spilabotte for the Los Angeles International Airport told ABC News. A similar statement was also released by Atlanta’s Hartsfield-Jackson International Airport. Also read | United Kingdom sanctions Iran's morality police over Mahsa Amini’s death “We noticed this morning that the external website was down, and our IT and security people are in the process of investigating,” said spokesman Andrew Gobeil. “There has been no impact on operations.” Disruptions also occurred on the official website of Chicago's O'Hare International Airport, but the Chicago Department of Aviation was able to solve the problem within a few hours. A Transportation Security Administration (TSA) spokesperson told CNN that the authorities are monitoring all the airports on Killnet’s list for any future attacks.

Russian hacker group launches cyberattacks on various United States airports

The US has accused Russia of operating as a refuge for hackers by allowing them to operate as long as their actions are aimed outside of the country.&nbsp;

According to a media report published in the Washington Post, "the number of cyberattacks targeting the United States has recently increased, and the perpetrators all have one thing in common: they are believed to be tied to Russia."

According to the Washington Post, hackers have discovered a safe haven in Russia to carry out their assault. That’s because they function without fear of retaliation from Moscow, which appears to tolerate them as long as they don't target Russia or its friends.&nbsp;

Watch: US faces gas shortage after pipeline cyberattack

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/us-faces-gas-shortage-after-pipeline-cyberattack-385090/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

In a 2016 interview with NBC, when asked why Russia was not arresting hackers believed to have interfered in the U.S. election, Putin hinted at the hands-off approach: “If they did not break Russian law, there is nothing to prosecute them for in Russia.”

The relationship between the Russian government and ransomware criminals allegedly operating from within the country is expected to be a point of tension between President Biden and Russia’s Vladimir Putin at their planned summit in Geneva on Wednesday.&nbsp;

US President Joe Biden and allies have said that the masterminds of DarkSide and REvil, the cybercriminal groups linked to recent high-profile ransomware attacks on Colonial Pipeline and the U.S. operations and other markets of JBS, a Brazil-based company and the world's largest meat supplier, appear to be based in Russia.

(With inputs from agencies)

The US has accused Russia of operating as a refuge for hackers by allowing them to operate as long as their actions are aimed outside of the country. According to a media report published in the Washington Post, "the number of cyberattacks targeting the United States has recently increased, and the perpetrators all have one thing in common: they are believed to be tied to Russia.

The US has accused Russia of operating as a refuge for hackers by allowing them to operate as long as their actions are aimed outside of the country. According to a media report published in the Washington Post, "the number of cyberattacks targeting the United States has recently increased, and the perpetrators all have one thing in common: they are believed to be tied to Russia." According to the Washington Post, hackers have discovered a safe haven in Russia to carry out their assault. That’s because they function without fear of retaliation from Moscow, which appears to tolerate them as long as they don't target Russia or its friends. Watch: US faces gas shortage after pipeline cyberattack In a 2016 interview with NBC, when asked why Russia was not arresting hackers believed to have interfered in the U.S. election, Putin hinted at the hands-off approach: “If they did not break Russian law, there is nothing to prosecute them for in Russia.” The relationship between the Russian government and ransomware criminals allegedly operating from within the country is expected to be a point of tension between President Biden and Russia’s Vladimir Putin at their planned summit in Geneva on Wednesday. US President Joe Biden and allies have said that the masterminds of DarkSide and REvil, the cybercriminal groups linked to recent high-profile ransomware attacks on Colonial Pipeline and the U.S. operations and other markets of JBS, a Brazil-based company and the world's largest meat supplier, appear to be based in Russia. (With inputs from agencies)

Hackers have found a safe haven in Russia to attack foreign nations: US media reports

US authorities moved Monday to take down a global computer botnet behind the massive theft of personal data and unwanted spam emails, as Spain arrested the notorious Russian hacker who operated it.

US authorities say the Russian, Piotr or Peter Levashov, had operated the&nbsp;Kelihos&nbsp;network&nbsp;of tens of thousands of infected computers, stealing personal data and renting the&nbsp;network&nbsp;out to others to send spam emails by the millions and extort ransom from computer owners.

Levashov, also known in the hacking world as Peter Severa, was arrested at Barcelona airport on Friday at the US request.

A Spanish judge on Monday ordered him to be remanded in custody as Washington is expected to seek his extradition. The US has 40 days to present evidence.

A US indictment unsealed Monday said Levashov, 36 and a native of St. Petersburg, had operated the&nbsp;Kelihos&nbsp;botnet since around 2010.

Two years earlier he was already in the sights of US investigators running another botnet and managing the spam operations of a major US spammer, Alan Ralsky. Ralsky and others were jailed in that case but Levashov was never caught.

100,000 computers infected

The&nbsp;Kelihos&nbsp;network&nbsp;is made up of private computers around the world running on the Microsoft Window operating system. The computers are infected with malware that gives Levashov the ability to control them remotely, with the owners completely unaware.&nbsp;

According to the Justice Department, at times the number of computers in the&nbsp;network&nbsp;has topped 100,000, with between five and 10 per cent of them in the United States.

Through underground networks,&nbsp;Kelihos&nbsp;sold the&nbsp;network&#39;s services to others, who would use it to send out spam emails advertising counterfeit drugs, work-at-home scams, and other fraud schemes, the indictment said.

They were also used for illegal &quot;pump-and-dump&quot; stock market manipulation schemes, and to spread other malware through which hackers could steal a user&#39;s banking account information including passwords, and lock up a computer&#39;s information to demand huge ransoms.

Levashov was proud of his work. According to Justice Department filings, earlier this year he posted an ad for his work noting he had been in the spam business &quot;since the distant year 1999.&quot;

&quot;During these years there has not been a single day that I keep still, by constantly improving quality of spamming,&quot; he said.

His prices rose with the illegality of the operation. For legal ads, he charged $200 per million spam emails. For scams and phishing attacks, it was $500 per million.

To help someone with a stock manipulation, he wanted a deposit of $5,000-$10,000 to share his list of 25 million traders. He also demanded &nbsp;5 per cent of the gains made on the stock.

The Spamhaus Project, which documents spam, botnets, malware and other abuse, listed Levashov as seventh on its &quot;10 Worst Spammers&quot; list and &quot;one of the longest operating criminal spam-lords on the internet.&quot;

&quot;The ability of botnets like&nbsp;Kelihos&nbsp;to be weaponized quickly for vast and varied types of harms is a dangerous&nbsp;and deep&nbsp;threat to all Americans, driving at the core of how we communicate,&nbsp;network, earn a living, and live our everyday lives,&quot; said Acting US Assistant Attorney General Kenneth Blanco in a statement.

Taking over the&nbsp;network

Levashov&#39;s arrest was unrelated to investigations into Russian interference in last year&#39;s US presidential election, US officials said.&nbsp;

Earlier, the suspect&#39;s wife had earlier told Russia Today that his arrest was connected to the election hacking case.

In parallel with the arrest, US justice authorities announced an extraordinary move to bring down the&nbsp;Kelihos&nbsp;network, obtaining warrants that allows it to take control of the computers in the botnet by changing the malware to intercept its operation.

That will direct the&nbsp;Kelihos&nbsp;traffic to &quot;sinkhole&quot; servers set up by authorities, overtime eliminating traffic through Levashov&#39;s server&nbsp;network.

Such a move appeared to be the first ever application of controversial new investigative powers for US authorities which took effect late last year.

While the move will give them access to private computers, investigators pledged to guard the privacy of computer owners.

&quot;This operation will not capture content from the target computers or modify them in any other capacity except limiting the target computers&#39; ability to interact with the&nbsp;Kelihos&nbsp;botnet,&quot; the warrant said.

(AFP)

US authorities say the Russian had operated the Kelihos network of tens of thousands of infected computers, stealing personal data

US authorities moved Monday to take down a global computer botnet behind the massive theft of personal data and unwanted spam emails, as Spain arrested the notorious Russian hacker who operated it. US authorities say the Russian, Piotr or Peter Levashov, had operated the Kelihos network of tens of thousands of infected computers, stealing personal data and renting the network out to others to send spam emails by the millions and extort ransom from computer owners. Levashov, also known in the hacking world as Peter Severa, was arrested at Barcelona airport on Friday at the US request. A Spanish judge on Monday ordered him to be remanded in custody as Washington is expected to seek his extradition. The US has 40 days to present evidence. A US indictment unsealed Monday said Levashov, 36 and a native of St. Petersburg, had operated the Kelihos botnet since around 2010. Two years earlier he was already in the sights of US investigators running another botnet and managing the spam operations of a major US spammer, Alan Ralsky. Ralsky and others were jailed in that case but Levashov was never caught. 100,000 computers infected The Kelihos network is made up of private computers around the world running on the Microsoft Window operating system. The computers are infected with malware that gives Levashov the ability to control them remotely, with the owners completely unaware. According to the Justice Department, at times the number of computers in the network has topped 100,000, with between five and 10 per cent of them in the United States. Through underground networks, Kelihos sold the network's services to others, who would use it to send out spam emails advertising counterfeit drugs, work-at-home scams, and other fraud schemes, the indictment said. They were also used for illegal "pump-and-dump" stock market manipulation schemes, and to spread other malware through which hackers could steal a user's banking account information including passwords, and lock up a computer's information to demand huge ransoms. Levashov was proud of his work. According to Justice Department filings, earlier this year he posted an ad for his work noting he had been in the spam business "since the distant year 1999." "During these years there has not been a single day that I keep still, by constantly improving quality of spamming," he said. His prices rose with the illegality of the operation. For legal ads, he charged $200 per million spam emails. For scams and phishing attacks, it was $500 per million. To help someone with a stock manipulation, he wanted a deposit of $5,000-$10,000 to share his list of 25 million traders. He also demanded 5 per cent of the gains made on the stock. The Spamhaus Project, which documents spam, botnets, malware and other abuse, listed Levashov as seventh on its "10 Worst Spammers" list and "one of the longest operating criminal spam-lords on the internet." "The ability of botnets like Kelihos to be weaponized quickly for vast and varied types of harms is a dangerous and deep threat to all Americans, driving at the core of how we communicate, network, earn a living, and live our everyday lives," said Acting US Assistant Attorney General Kenneth Blanco in a statement. Taking over the network Levashov's arrest was unrelated to investigations into Russian interference in last year's US presidential election, US officials said. Earlier, the suspect's wife had earlier told Russia Today that his arrest was connected to the election hacking case. In parallel with the arrest, US justice authorities announced an extraordinary move to bring down the Kelihos network, obtaining warrants that allows it to take control of the computers in the botnet by changing the malware to intercept its operation. That will direct the Kelihos traffic to "sinkhole" servers set up by authorities, overtime eliminating traffic through Levashov's server network. Such a move appeared to be the first ever application of controversial new investigative powers for US authorities which took effect late last year. While the move will give them access to private computers, investigators pledged to guard the privacy of computer owners. "This operation will not capture content from the target computers or modify them in any other capacity except limiting the target computers' ability to interact with the Kelihos botnet," the warrant said. (AFP)

US targets huge botnet as Spain arrests Russian hacker

russian-hacker

Russian Hacker, News on Russian Hacker, stories on Russian Hacker, articles on Russian Hacker, Russian Hacker stories at Wion, Russian Hacker news, Russian Hacker latest news