Security Leftovers

posted by Roy Schestowitz on May 01, 2023

• Magniber Ransomware Wants to Infect Only the Right People [iophk: Windows TCO]

  The first reappearance of Magnitude EK on Oct. 15 came as a malvertising redirection from the domain: fastprofit[.]loan. The infection chain is shown in Figure 2.

• Concerns about election IT systems in Latvia: LTV's De Facto

  Politicians agreed months ago that the Central Election Commission (CVK) could no longer secure elections, so it needs reform. The problems swelled last November when the CVK's work was actually paralyzed by a criminal case regarding the procurement of the IT system development. There is currently no solution to the IT issues, so next European Parliament elections could be quite cumbersome for voters, Latvian Television's De Facto reported on April 30.

• Forum Data Breach - Lessons Learned, Actions Taken

  As you may have seen on other posts, we're broadly back on line now, with the forum, Wiki and paste sites all operational. It's been a huge effort by several key team members - I won't name names, but you know who you are - and we're all immensely grateful for their work.

  So, without putting on a hair shirt...in the interests of transparency and minimising the chances of anything like this happening again, we've really had to dig into this to see what we can learn.

• Amnesty International Australia Suffered a Data Breach in December, but Says Everything is Now Fine

• RTM Locker Ransomware Targets Linux Architecture [Ed: More of this (mislabeled) "Linux" fearmongering campaign]