The IT Nerd

You might remember earlier this year that I wrote about a group called REvil who hacked their way into one of Apple’s suppliers and stole a bunch of schematics which they then held for ransom.

Fun Fact: Those schematics turned out to be the new MacBook Pros that were recently announced.

In any case, I heard nothing further about REvil’s attack on Apple since then, but it turns out there was a multi-country operation underway to take down the ransomware group. According to Reuters, several government agencies teamed up to hack REvil and take it offline this week:

One person familiar with the events said that a foreign partner of the U.S. government carried out the hacking operation that penetrated REvil’s computer architecture. A former U.S. official, who spoke on condition of anonymity, said the operation is still active.

If you read the rest of the Reuters article, it also indicates that authorities got their hands on the decryption key for REvil’s ransomware., which I wrote about here. At the time, it wasn’t clear how the key was obtained. Now we know. And now we also know that this is still an ongoing effort. Which means that ransomware gangs could now become the ones being pwned. Which as far as I am concerned is a good thing.

UPDATE: I got commentary from Robert Cattanach is a partner at the international law firm Dorsey & Whitney. He advises companies about ransomware attacks. He has previously worked as a trial attorney for the United States Department of Justice and was also special counsel to the Secretary of the Navy. Today he practices in the areas of regulatory litigation, including cybersecurity, privacy and telecommunications, civil and criminal enforcement proceedings and international Regulatory Compliance (EU focus).

“Confirming speculation over the cause of the latest demise of notorious cybergang REvil’s website, Reuter’s reports that a consortium of ‘like-minded countries’ – likely spearheaded by the FBI, Cyber Command, and the Secret Service – took a page from the hacker’s playbook and covertly corrupted backups, which Revil apparently attempted to use to restore its functioning after the FBI took it down earlier. Infecting backups with secret malware is a common strategem used by hackers to deter victims from attempting to restore their systems, and instead pay the ransom rather than going through the time and expense of a clean reboot. But apparently someone at REvil didn’t get their own memo, and attempted to use REvil’s backup files to restore their systems – always a risk if you’ve been hacked, but one which some victims are willing to take to avoid the costly and time-consuming alternative. And it also demonstrates a resolve not previously seen by the US and its allies to pursue cybercriminals with aggressive counterstrikes, which may themselves be of dubious legality under international law. Whether this prompts even more destructive escalations by cybercriminals, or causes the likes of REvil to tap the brakes a bit, remains to be seen,”

Google Threat Analysis Group has released research on APT35, an Iranian hacking group targeting high-value individuals in the US and elsewhere. One of the attackers’ novel techniques is using Telegram for operator notifications. The attacker embedded JavaScript into phishing pages that notify them when the page has been loaded. They use the Telegram API sendMessage function to send the notification, which lets anyone use a Telegram bot to send a message to a public chancel:

“The attackers use this function to relay device-based data to the channel, so they can see details such as the IP, useragent, and locales of visitors to their phishing sites in real-time. We reported the bot to Telegram, and they have taken action to remove it,”

Seeing as Telegram is typically used by people who want to conduct their activities in secret, this isn’t a trivial hack by APT35. Edward Roberts, VP of Marketing, Neosec:

“This attack follows the trend that attacks are typically a sequence of tactics employed by the hacker. Increasingly, with the ubiquitous adoption of APIs by organizations, it is no surprise that APIs are one of the tactics used in these sophisticated attacks. We expect APIs to increasingly become the focus for bad actors.”

Additionally, SmartBear’s annual State of Software Quality API survey has been released, identifying industry benchmarks, methodologies and tools used by software teams to manage API lifecycle. Key findings include:

• A majority of API practitioners operate in a multi-protocol landscape. Of those surveyed, 57% state they use three or more protocols within their organizations.
• Developers are increasingly involved in testing and are taking on more testing responsibilities with close to 60% reporting they are directly involved in API testing.
• “Ease of use” was reported as being the top factor driving API tool choice along with the most important characteristic consumers need in an API.
• The biggest obstacles to ensuring consistent quality of APIs as well as API documentation are “increasing demands for speed of delivery” and “limited time due to workload.”

Telegram has addressed this issue, but other organizations should take steps to make sure that whatever APIs the they use are not vulnerable.