Demo
Spies at No.10, a $540 Million Crypto Heist & a Botnet Takedown - Talion

Drawing upon the latest news from Talion’s Threat Set Radio Episode 166, we’re diving into the details from 3 key cybersecurity events.

  • Pegasus Spyware targeting UK government officials
  • US offering $5 million for any news on North Korean threat actors
  • Microsoft’s Digital Crimes Unit taking legal and technical action against the Zloader botnet

 

Want to listen instead?

Head over to the podcast.

 

Pegasus Spyware Listens in on UK Government Officials

Pegasus spyware has returned to the news – this time ciphering their way into the phones of UK government officials. Confirmed by findings from the Citizen Lab at the University of Toronto, several of the No.10 Downing Street phones were included in 2020 and 2021 compromises by the UAE linked Trojan Spyware, which turned mobile phones into remote listening devices. It has not been confirmed whose devices were compromised this time, only that these individuals work alongside Prime Minister Boris Johnson.

Last year, the NSO group – the company behind the tool – had a lawsuit brought against them by Apple for abusing iPhone users with the technology. The NSO group claim that Pegasus only targets terrorists and criminals and the spyware is developed, marketed and licensed by governments around the world. But politicians, journalists and activists have found this software downloaded unlawfully onto their devices. The Biden administration placed NSO on a US blacklist as a result, stating it had evidence the company had sold surveillance spyware to foreign governments who had used it for transnational regression.

More examples of Pegasus include the purchase of spyware by Israel police to spy on protestors and government employees without court supervision, and the Hungarian government to spy on journalists, businesspeople, and an opposition politician. Even the FBI have admitted to purchasing the spyware but claim not to have used it as part of any investigation.

 

US Offer $5 Million for Information on North Korean Cyber Criminals

The US are calling desperately for any information on North Korean cyber criminals who have retrieved cryptocurrency, or any operative working on behalf of North Korean leader Kim Jong Un – and they’re offering $5 million as a reward. This comes just days after the public attribution of a threat group associated with the Democratic People’s Republic of Korea (DPRK) – Lazarus. The Lazarus operation against finance platform Ronin Network, deemed to be the largest cryptocurrency heist to date, successfully retrieved around $540 million in cryptocurrency, used to support North Korea’s regime and fund its weapons program.

Ronin Network was initially hacked in March 2022 and Lazarus has slowly siphoned off more than $9 million since, sending the funds to Tornado Cash – a cryptocurrency mixer that allows users to hide the origin of the funds. The CISA & FBI have issued a joint advisory, warning blockchain companies that they are at high risk of falling victim to one of these financial heists, from decentralised finance (DeFi) protocols, to cryptocurrency trading companies, or even play-to-earn cryptocurrency video games.

 

 

Microsoft Intercept Zloader Botnet to Shut Down Operations

The notorious Zloader botnet has been intercepted by a global operation headed by Microsoft’s Digital Crimes Unit. 65 domains that the Zloader gang has utilised to build and control its empire have been taken over by Microsoft and now direct to a sinkhole where they can no longer be used by the botnet’s criminal operators.

Embedded within the Zloader malware is a domain generation algorithm (DGA) – a technique used to generate 32 different domains per day, acting as a fallback or backup communication channel for the botnet. In addition to the take down of the hardcoded domains, the court order also allows Microsoft to take control of an additional 319 currently registered DGA domains, enabling the blocking of the future registration of any DGA domains.

Originally, the primary goal of Zloader when it first appeared in 2019 was financial theft, stealing account login IDs and passwords to access money. In recent times, Zloader has aided a number of ransomware groups including RYUK – a strain which has taken down countless healthcare institutions, recklessly putting patients’ lives at risk during their attempts to extort ransom demands.

During Microsoft’s investigation, they identified one of the perpetrators helping ransomware gangs distribute the strain via the botnet – Denis Malikov, operating out of the city of Simferopol on the Crimean Peninsula. Microsoft chose to name him in their blog post, to break the anonymity many of these operatives have been hiding behind.

Microsoft have also stated:

“We expect the defendants to make efforts to revive Zloader’s operations. We referred this case to law enforcement, are tracking this activity closely and will continue to work with our partners to monitor the behaviour of these cybercriminals. We will work with internet service providers (ISPs) to identify and remediate victims. As always, we’re ready to take additional legal and technical action to address Zloader and other botnets.”

 

 

To stay up to date on the latest cybersecurity news from our threat intelligence service, keep an eye out for a new Threat Set Radio podcast episode every Friday, hosted by Talion’s Threat Intelligence Analyst Natalie Page.

In the meantime, feel free to browse our Resources Hub for more security insight.

 
Leave a comment

Filed in Blog, by Talion. 0 comments
Watch demo video
We’re a tight-knit, highly skilled operation, so when a threat arises, we move quickly.
Talion
Watch demo video
We’re a tight-knit, highly skilled operation, so when a threat arises, we move quickly.
Talion
24x7x365 UK-based Security Operations Centre
Talion
Service underpinned by market leading threat intelligence team
Talion
Continually developed threat relevant content, backed by SLAs
Talion
MDR service has featured in the Gartner Magic Quadrant for 6 consecutive years
Talion
Experts in SIEM and SOAR technology
Talion
UK-based Senior Leadership
I'm ready
Request a more in-depth demo.
Discuss your cyber security needs
Fill in the form below and one of our team will be in touch to arrange your demo.

Call us on 0800 048 5775

Call us directly and we’ll put you in touch with the most relevant cyber expert.

Send us a message

Give us a brief description of what you’re looking for and we’ll put you in touch with the best person.