OODA Analysis and Briefs

Home > OODA Analysis and Briefs

Analysis

Briefs

Hackers Steal Steam Credentials With ‘Browser-in-the-Browser’ Technique

Cybersecurity researchers at Group-IB have warned that hackers are targeting the video game platform Steam to target users with a new phishing technique named broswer-in-browser (BitB). Group-IB released new data earlier this week describing the attack, which uses a fake browser window in the same tab rather than traditional techniques of opening phishing webpages in…
Crypto Exchange Huobi to Delist 7 Privacy Coins, Including Zcash, Monero

Prominent crypto exchange Huobi Global will delist seven privacy tokens next week amid broader regulatory scrutiny of such tokens, it said in a statement on Monday. “Huobi Global strictly complies with the compliance policies of every country and region and always endeavors to safeguard our users’ assets,” the exchange, which is one of the largest…
DeFi Hacks Keep Adding Up as Scammers Exploit Code Ethos

Scammers who ransacked cryptocurrency projects to the tune of hundreds of millions of dollars in recent months have been able to carry out such heists by taking advantage of a central tenet of decentralized financial services. While DeFi projects promise to enable more efficiency in crypto transactions, much of the code undergirding the software is public,…
SEC Chair Stands Firm: ‘Vast Majority’ of Cryptocurrency Tokens Are Securities

In prepared remarks delivered at the Practising Law Institute’s “SEC Speaks” program on September 8, Chair Gensler emphasized and reiterated his long-standing position that the vast majority of cryptocurrency tokens are securities, and he noted that “only a small number of tokens, even though they may represent a significant portion of the crypto market’s aggregate…
The Ethereum Merge Is Set to Take Place This Week. What Investors Should Know About How It Will Influence the Price

It’s a big week for Ethereum: Its big merge is set for Thursday, and investors could see big price movement when it happens. This major network upgrade will see Ethereum transition from proof-of-work to proof-of-stake. The upgrade will address concerns about its environmental impact and dramatically improve its transaction speed, among other improvements, according to…
Coinbase employee mired in first insider trading case involving cryptocurrency

The brother of a former Coinbase Global Inc product manager pleaded guilty on Monday to a wire fraud conspiracy charge, in what US prosecutors have called the first insider trading case involving cryptocurrency. Nikhil Wahi, 26, admitted during a virtual court hearing before US district judge Loretta Preska in Manhattan that he made trades based…
Ports, schools shut as Typhoon Muifa barrels toward eastern China

Chinese authorities have ordered ships to return to port due to projections that the country will suffer from one of the strongest typhoons this year. The typhoon, named Muifa, is set to make landfall in the eastern province of Zhejiang. In addition to the ships returning to port, China has ordered some schools to close…
Famine Threatens East Africa as Drought Persists

In East Africa, thousands are facing a hunger emergency that has occurred as a result of four failed rainy seasons in a row. As the rainy season approaches, another drought could deepen the crisis and tip some areas into famine within weeks. Meteorologists have assessed the current situation and issued warnings over a fifth unsatisfactory…
UN warns of ‘serious threat’ from Syria cholera outbreak

A cholera outbreak has posed a serious threat to people in Syria and the wider area according to the United Nations. UN Resident and Humanitarian Coordinator in Syria Imran Riza said the cholera outbreak is believed to be linked to contaminated irrigation water that has been watering crops, or from people drinking from the Euphrates…
Dozens dead in overnight clashes between Armenia and Azerbaijan

Dozens of soldiers have been killed during fighting between Armenia and Azerbaijan that occurred overnight. Armenia’s Prime Minister said that 49 of its soldiers died in the clashes. These neighboring countries have fought two wars and have seen regular clashes over the past 30 years. Russia claims to have brokered a ceasefire for the latest…
Iranian Hackers Launch Renewed Attack on Albania

Albania has accused Iranian hackers for launching attacks against Albanian authorities. In the latest attacks, Iranian hackers took border control systems offline. Albanian Prime Minister Edi Rama’s office took to Twitter over the weekend to confirm cyberattacks against the Total Information Management System that helps Albania track its border crossings. Albania condemned the cyberattack and…
High Severity Vulnerabilities Found in HP Enterprise Devices

Security researchers at Binarly have reportedly uncovered six high-severity firmware vulnerabilities. The vulnerabilities were detected over the course of the past year and were first revealed at the Black Hat 2022 conference. The flaw affect HP EliteBook devices and range in severity scores from 7.5 to 8.2. The attacker could leverage the vulnerabilities to install…
U-Haul reports data breach, customers’ info exposed

US moving company U-Haul has reportedly suffered from a data breach that occurred when an unauthorized individual gained access to an unknown number of rental contracts. U-Haul’s parent company Amerco confirmed the attack last week and stated that consumers’ payment card information was not compromised in the attack. The individual who obtained access to the…
‘This is the jungle’: Law enforcement slowly waking up to the threat of DeFi exploits

At the end of August, the FBI issued a public service announcement on the susceptibility for cybercrime in DeFi (decentralized finance), the growing crypto segment of financial applications backed by blockchain technology. Of the $1.3 billion stolen in cryptocurrencies in the first three months of 2022, 97% came from DeFi platforms. The warning did nothing to…
Ethereum Merge makes network more vulnerable to attack — Security expert

Despite the Ethereum Merge being touted as a major upgrade to the blockchain network, its transition to proof-of-stake theoretically makes it more vulnerable to exploit. Speaking to Cointelegraph, the security researcher explained that unlike proof-of-work (PoW) systems, a proof-of-stake (PoS) system informs node validators in advance what blocks they will validate, thus enabling them to plan…
North Korean Lazarus Group Hacked Energy Providers Worldwide

A malicious campaign conducted by the North Korean threat actor Lazarus Group targeted energy providers around the world between February and July 2022. The campaign was previously partially disclosed by Symantec and AhnLab in April and May, respectively, but Cisco Talos is now providing more details about it. Writing in an advisory on Thursday, the security researchers…
YouTuber with 13 million subscribers hacked by crypto scammers; Here’s how much they stole

Popular YouTuber Scuba Jake has confirmed the hacking of his channel with over 13 million subscribers and 1.75 billion views since the channel’s creation in 2011. The September 9 incident saw crypto scammers take over the channel and attempt to defraud unsuspecting followers in a fake giveaway involving Bitcoin (BTC) and Ethereum (ETH). An analysis…
3 major mistakes to avoid when trading cryptocurrency futures markets

Many traders frequently express some relatively large misconceptions about trading cryptocurrency futures, especially on derivatives exchanges outside the realm of traditional finance. The most common mistakes involve futures markets’ price decoupling, fees and the impact of liquidations on the derivatives instrument. Let’s explore three simple mistakes and misconceptions that traders should avoid when trading crypto…
Investigators Seize $30m in Stolen Crypto from North Korea

Chainalysis has reported that US authorities seized roughly 10% of the cryptocurrency stolen by North Korean state hackers during the Ronin Network heist that occurred last month. Chainalysis also reported that a total of $30 million was seized during the raid, marking the first time ever that cryptocurrency originally stolen by North Korea was taken…
Hackers Compromise Employee Data at PVC-Maker Eurocell

Eurocell, a leading British PVC manufacturer, has suffered from a substantial data breach, according to a law firm that viewed emails to current and former employees. The Derbyshire-based company operates as a distributor of UPVC windows, doors, and roofing products. The data breach reportedly occurred when an unauthorized third party accessed its systems. The company…
The second-biggest school district in the US was hit with ransomware

Los Angeles Unified, the second-largest US school district, allegedly suffered from a ransomware attack that occurred over the weekend. The school district announced the attack on Tuesday as it resumed operations as normal. The attack caused significant disruption to the school district’s IT infrastructure. LA Unified also confirmed that employee healthcare and payroll services were…
Russians ‘outnumbered 8-1’ in counter-attack

Ukraine led a counter-attack in the Kharkiv region against Russia last week and outnumbered Russians by eight to one. Ukraine’s army has retaken villages in the north and has broken through to the Russian border. After the offensive, Ukraine has regained control over 3,000 square kilometers of territory. Ukraine says it will be continuing the…
Tigrayan forces accept immediate ceasefire and AU-led peace talks with Ethiopia govt

The Tigray People’s Liberation Front has said that they are ready to accept an immediate ceasefire and a peace process led by the African Union. These two steps will help end a conflict with the federal military forces in Ethiopia that has lasted almost two years. A committee had been created by the Ethiopian government…
Rethinking Responsible Disclosure for Cryptocurrency Security

The Biden administration has pointed, with alarm, to the national security implications of both cybersecurity and cryptocurrency. It’s just a matter of time before the government begins worrying about their intersection—cryptocurrency security. All of the United States’ international adversaries are in the business of exploiting bad cybersecurity, and many of them monetize their exploits using…
Why quantum computing isn’t a threat to crypto… yet

Quantum computing has raised concerns about the future of cryptocurrency and blockchain technology in recent years. For example, it is commonly assumed that very sophisticated quantum computers will one day be able to crack present-day encryption, making security a serious concern for users in the blockchain space. The SHA-256 cryptographic protocol used for Bitcoin network security…
Cryptocurrency’s Structural Security Problem

I explore the remarkable number of failures in cryptocurrency security for Lawfare. I argue that security really is worse for cryptocurrency, because the decentralization that proponents treasure makes it hard to safely disclose and fix security holes: Software security flaws … are ubiquitous in digital products. Like writers who can’t see their own typos, most coders…
White House: Bitcoin Mining Must Be Greener—Or US Should Ban It

The White House today suggested that U.S. lawmakers and regulators could soon crack down on cryptocurrency mining because of its large carbon footprint. In a Thursday report, mandated by President Biden in an executive order in March, the White House Office of Science and Technology Policy said crypto miners should reduce greenhouse gas emissions, with…
NFT watchdog Rug Pull Finder gets its own NFT giveaway exploited

In an ironic twist, Rug Pull Finder (RPF), a nonfungible token (NFT) watchdog focused on identifying Web3-based fraud, has fallen victim to a smart contract exploit of its own. According to the NFT investigator’s post on Twitter on Friday, two people exploited a technical flaw in the project during the free mint stage — pilfering…
Google Cloud to Validate Transactions on Axie Infinity’s Ronin Network

As Axie Infinity creator Sky Mavis works to further decentralize its Ronin network—a custom Ethereum sidechain designed for NFT-powered games—the Web3 startup has tapped one of the largest Web2 tech giants to help its cause. Today, Sky Mavis announced that it has reached an agreement with Google Cloud that will see the cloud computing division of…
TikTok Denies Breach After Hacker Claims ‘2 Billion Data Records’ Stolen

Popular social media platform TikTok is denying allegations of a data breach just weeks after security researchers uncovered a serious vulnerability in the app that could have exposed users to a 1-click takeover exploit. The issue affected Android users and has since been patched by TikTok. However, reports began circulating that the platform had been…
UN chief visits flood-hit Pakistan, appeals for ‘massive’ help

The United Nations Secretary-General Antonio Guterres has appealed for global support on behalf of Pakistan due to unprecedented flooding has killed almost 1,400 people and destroyed over a million people’s homes. Guterres landed in the Pakistani capital early on Friday morning and was received by Hina Rabbani Khar, the Pakistani state minister for foreign affairs. …
Ukraine has retaken 1,000 square kilometers in a week – Zelensky

Ukraine claims to have retaken possession of over 1,000 square kilometers of its territory in the south and east of the country from Russia. Ukrainian President Volodymyr Zelensky said the land had been liberated since September 1. Another general report also stated that over 20 villages in the Kharkiv region have been recaptured as well. …
Indian and Chinese troops disengaging from disputed border area, New Delhi says

Chinese and Indian troops have begun to disengage from the Gogra-Hotsprings border area in the western Himalayas, according to the Indian government on Thursday. The disengagement comes 2 years after clashes at the border site strained diplomatic ties between India and China. In the announcement, India said the disengagement is taking place in a coordinated…
North Korea declares itself a nuclear weapons state, in ‘irreversible’ move

North Korea passed a new law declaring itself a nuclear weapons state, a move that leader Kim Jong Un says is irreversible. When he passed the law, he said the country would never give up its nuclear weapons and would not negotiate on denuclearization. The new law also gave Pyongyang the right to use preemptive…
SEC Chair Gary Gensler Backs Giving CFTC Bitcoin Oversight

At an industry conference today, Securities and Exchange Commission (SEC) chief Gary Gensler said that he supports handing the Commodity Futures Trading Commission (CFTC) the power to “oversee and regulate crypto nonsecurity tokens and related intermediaries.” Gensler stressed that should Congress give the CFTC prime oversight over crypto, his own federal agency shouldn’t be overlooked.…
Crypto Scammers Use Fake Websites in Latest Bid to Dupe Customers

Scammers in recent weeks have employed up fake cryptocurrency web pages to attempt to steal money from users, the latest tactic to emerge in what’s already been a costly year for crypto-related hacks. The sham websites – which masquerade as pages for popular services such as Coinbase, Gemini, Kraken and MetaMask – aim to dupe visitors…
North Korea’s Lazarus hackers are exploiting Log4j flaw to hack US energy companies

Security researchers have linked a new cyber espionage campaign targeting U.S., Canadian and Japanese energy providers to the North Korean state-sponsored Lazarus hacking group. Threat intelligence company Cisco Talos said Thursday that it has observed Lazarus — also known as APT38 — targeting unnamed energy providers in the United States, Canada and Japan between February and…
Investors Sue Treasury Department for Blacklisting Crypto Platform

A group of cryptocurrency investors sued the Treasury Department on Thursday to block government sanctions that bar Americans from Tornado Cash, a popular crypto platform that criminals have used to launder virtual currencies. The lawsuit, filed in federal court in the Western District of Texas, is funded by the cryptocurrency exchange Coinbase, which has clashed with…
U.S. Recovers Over $30 Million in Cryptocurrency Stolen by North Korean Hackers

U.S. authorities have seized more than $30 million in cryptocurrency plundered from an online game this year by hackers linked to North Korea, one of the largest successes clawing back digital revenue from Pyongyang, investigators said. While only a fraction of the hundreds of millions in cryptocurrency purloined, the sum recovered is far higher than previously…
‘DangerousSavanna’ Hackers Targeted Financial Institutions in Africa For Two Years

Check Point research has identified a persistent cyber-attack campaign it calls DangerousSavanna targeting major financial institutions in French-speaking African countries. According to the cybersecurity firm, the campaign has been active for the past two years and focuses on spear phishing techniques to initiate infection chains. The threat actors behind the attacks delivered malicious attachment emails…
US approves $2.6bn in aid for Ukraine and allies

The United States has approved an aid package for Ukraine containing nearly $2.7 billion, including $675 million in weapons. The arms package was announced by Defense Secretary Lloyd Austin at a meeting with dozens of fellow ministers at the US air base in Ramstein, Germany. The arms package contains howitzers, munitions, Humvee vehicles, armored ambulances…
At least 16 dead as heavy rains trigger landslides in Uganda

Heavy rains in the Kasese district of western Uganda caused a landslide early Wednesday, killing at least 16 people. Six additional people were injured and are receiving treatment at a local hospital. Search and rescue workers have been shoveling the mud to find survivors in the region that sits in the foothills of the Rwenzori…
Japan Government Websites Hit By Cyber-Attacks, Killnet Suspected

Japanese websites have reportedly been hit by denial of service (DoS) attacks that resulted in operational issues. Japan’s digital agency confirmed that its e-Gov administrative portal was experiencing difficulties logging onto some services. The Russia-affiliated notorious hacking group Killnet has claimed responsibility for the attack, claiming to have impacted 20 websites across four government ministries.…
New Iranian hacking group APT42 deploys custom Android spyware

Cybersecurity firm Mandiant has released information regarding what is believed to be a new Iranian state-sponsored hacking group referred to as APT42. The group is allegedly using a custom Android malware to spy on targets that fit its interests. Mandiant has reportedly collecting enough evidence to prove that the group is separate from other previously…
Crypto Insiders Edgy over Quantum Computing’s Looming Threat to Blockchain Security

Chatter on the cryptographic side of cryptocurrency has been growing over the past couple of years about the threat posed by quantum computing, an entirely new type of computer that would be many orders of magnitude more powerful than current ones — so powerful that many modern forms of encryption will be crackable.Including the cryptography…
Hacker Steals Bill Murray’s Crypto After $185K NFT Charity Auction

Hours after the closing of Bill Murray’s NFT auction that raised 119.2 ETH (around $185,000) for charity Thursday, a hacker stole the funds. The hacker started to drain Murray’s personal wallet at around 7:00 p.m. ET on Thursday, according to on-chain data from Etherscan and details from Murray’s team. The unknown individual also attempted to…
South Korea Is Gearing Up to Institutionalize Security Tokens

Financial regulators in South Korea want to bring security tokens, which are blockchain-based digital forms of traditional securities, into the scope of the country’s capital markets rules in an effort to formalize the products. The country’s top financial regulators, including the Financial Services Commission (FSC) and Financial Supervisory Service, met with industry representatives like the…
TeslaGun Primed to Blast a New Wave of Backdoor Cyberattacks

A newly discovered cyberattack panel dubbed TeslaGun has been discovered, used by Evil Corp to run ServHelper backdoor campaigns. Data gleaned from an analysis by the Prodraft Threat Intelligence (PTI) team shows the Evil Corp ransomware gang (aka TA505 or UNC2165, along with half a dozen other colorful tracking names) has used TeslaGun to carry out…
Bitcoin hits lowest level since June as cryptocurrency market drops below $1 trillion again

Bitcoin traded below $19,000 on Wednesday morning, hitting its lowest level since June following a drop in stock markets globally and the continued strength of the U.S. dollar. The value of the entire cryptocurrency market also fell below $1 trillion as digital coins across the board saw a sell-off. Bitcoin was last trading slightly lower…
TeslaGun Primed to Blast a New Wave of Backdoor Cyberattacks

New data from an analysis released by Prodraft Threat Intelligence demonstrates how the Evil Corp ransomware gang, also known as TA505 and UNC2165, has expanded its cyber weapon arsenal to include TeslaGun. The cyberattack panel referred to as TeslaGun has been leveraged by the group to help conduct phishing campaigns and ServHelper backdoor campaigns. The…
Meta Fined $400m in Ireland For Children’s Privacy Breach

Ireland’s Data Protection Commission (DPC) has announced that it plans to fine social media platform Instagram $402 million due to mistreatment and mishandling of children’s data. The DPC found that Instagram allowed children to run business accounts that displayed the account holder’s phone number and email address. Therefore, Instagram was effectively exposing the minors’ data.…
FBI K-12 Ransomware Warning as LAUSD is Hit

The FBI has warned that there may be a possible surge in ransomware attacks targeting US schools as they resume classes following the summer break. Over the holiday weekend, the FBI reported that the country’s second largest school district, the Los Angeles Unified School District (LAUSD) was compromised by threat actors. The county serves 600,000…
BlackCat Ransomware Linked to Italy’s Energy Services Firm Hack

Hacking group BlackCat has been linked to recent attacks on Italy’s energy services firm GSE. According to Reuters, the notorious hacking group was behind the attack and threatened to publish if their ransom demands were not met. GSE is a state-owned energy services firm that operates critical infrastructure, making it an attractive target. According to…
Authorities Take Down Prolific WT1SHOP Cybercrime Marketplace

American and Portuguese authorities have reportedly taken down a notorious cybercrime marketplace on which sellers posted troves of stolen personal information that amassed millions of dollars over the years it was active. According to the US Department of Justice, the platform was one of the largest of its kind and offered roughly six million records…
UK forces crypto exchanges to report suspected sanction breaches

Crypto exchanges must report suspected sanctions breaches to UK authorities under new rules brought in amid concerns that bitcoin and other cryptoassets are being used to dodge restrictions imposed in response to Russia’s invasion of Ukraine. Official guidance was updated on 30 August to explicitly include “cryptoassets” among those that must be frozen if sanctions are…
Brazilian SEC is looking to change crypto regulation with new bill

According to reports, the Brazilian Securities and Exchange Commission is looking to switch up the country’s legal framework for cryptocurrencies. The main concern is that the bill in question does not consider tokens as digital assets or securities, which means that it does not fall under SEC regulation. Subsequently, the updated position of the Brazilian…
Top 4 Biggest Exploits in August and How They Got Access

According to one of the most recent reports by a data analysis platform Chainanalysis, vulnerabilities in cross-chain bridge protocols have posed the biggest security threat in the crypto industry; they now represent two-thirds of all hacks. According to a blockchain security firm SlowMist Hacked, users lost around $263 million worth of cryptocurrency to hacks in…
Crypto: Stablecoins scramble for safe havens as sanctions threat escalates

A major stablecoin issuer is formulating an intricate plan to ensure it always remains beyond the reach of centralised authority after US regulators froze USDC (USDC-USD) funds without warning. The US Treasury’s Office of Foreign Assets Control, (OFAC) strong-armed USDC issuer Circle into freezing over 75,000 USDC in the wake of the Tornado Cash affair.…
Understanding The ‘Ethereum Merge’

After many delays, the long-hyped ‘Ethereum Merge’ is about to happen. The first stage of the process – Bellatrix – happens today, 6 September. The second stage – Paris – completes at some point next week. At that point, the way Ethereum – the world’s second largest cryptocurrency behind Bitcoin – fundamentally works will change,…
EvilProxy Phishing Toolkit Spotted on Dark Web Forums

EvilProxy, a new phishing-as-a-service has been identified for sale on dark web forums. The phishing tool is also known as Moloch. Security researchers at Resecurity were the first to identify the malicious tool for sale online. EvilProxy threat actors are reportedly using reverse proxy and cookie injection methods to effectively bypass two factor authentication, according…