The IT Nerd

Flashpoint has released its H1 Cyber Threat Intelligence Index. Here are just a few of the points in the report:  

Flashpoint digs into the activity from ransomware groups over the past 12 months. Regarding ransomware, Flashpoint found:

• The most headline-grabbing cyber extortion event in the first half of 2023 was (and continues to be) the impact of the Clop ransomware group, which began exploiting the MOVEit zero-day vulnerability in May to gain illegal access to a wide range of victims.
• As of August 9, the total number of victims—those posted on Clop’s ransomware blog combined with data from Flashpoint’s Cyber Risk Analytics (CRA) platform—totaled more than 650. This number includes companies that were directly attacked by Clop as well as third-party victims.  

Regarding Vulnerabilities over the past 6 months:

• 14,201 new vulnerabilities were reported in H1 2023, and 2,189 of them were missed by the Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD). 
• Over 36 percent of H1’s disclosed vulnerabilities have a working proof-of-concept or a known public exploit, giving low-level attackers an opportunity to compromise vulnerable systems.  

Regarding Data Breaches over the past 6 months, Flashpoint found:

• In H1 2023, Flashpoint analysts identified 2,893 data breach events, resulting in the loss of 5.94B records.
• The highest number of breaches were recorded in the US.  

Flashpoint’s H1 2023 report also digs into Malware IOCs and Insider Threats. 

You can read the report here.

Flashpoint has published its July 2023 Cyber Threat Intelligence Index.  Here are some numbers from July:

• There were 515 ransomware attacks
• 1994 new vulnerabilities with 312 of them being missed by the Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD)
• 529 Data Breach events

The Index also deals with Insider Threats and the state of malware. You can read it here.

Here’s a couple of topics that Flashpoint’s research team has been keep tabs on this week. 

1. Malicious Telegram-Based AI Chatbot “FraudGPT” Could Simplify Cybercrime

KEY TAKEAWAYS

• “FraudGPT,” likely also referred to as “ChatGPT Fraud Bot,” is a bot targeting online actors who want to commit illicit activity. 
• This and similar tools, such as “WormGPT,” emulate ChatGPT, but without ChatGPT’s safeguards, which generally prevent the tool from providing responses that may lead to unethical or illegal activity. 
• Flashpoint procured access to this bot and determined that it appears to have similar functionality to WormGPT. FraudGPT provides answers to questions that could enable cybercrime and that other bots, such as ChatGPT, refuse to answer.
• For example, unlike ChatGPT, FraudGPT is willing to provide malware samples. However, the malware sample it provided was not highly effective.
• It also provided a list of Dark Web markets upon request, though the list was outdated.      
• Ultimately, the threat posed by FraudGPT and other similar tools likely depends on how their operators use them.
• The dual-edged nature of technology is evident; while advancements like ChatGPT can be created with ethical intentions, their underlying technology can easily be repurposed for malicious activities.

BACKGROUND: Threat actors are advertising AI chatbots that have allegedly been trained on illicit content from the cyber underground and can be leveraged to commit fraud and enable illegal activity. Sellers are advertising an increasing number of fraud-related chatbots. Observed subscription prices include US$100 a month or several hundred dollars a year.

Several of these tools emulate ChatGPT, but without ChatGPT’s safeguards, which generally prevent the tool from providing responses that may lead to unethical or illegal activity. However, researchers and malicious actors have found ways to work around some of ChatGPT’s restrictions, such as by using prompt injection attacks.

“FraudGPT,” also known as “Chat GPT Fraud Bot,” is a malicious Telegram-based chatbot that purportedly provides AI-generated content that can be used for a variety of fraud and cybercrime purposes. FraudGPT is similar to the malicious AI bot “WormGPT,” which Flashpoint profiled in July 2023. FraudGPT emerged on Dread shortly after WormGPT began making headlines. FraudGPT’s answers are often similar to those of WormGPT, but when asked identical prompts, it offers its own answers. While WormGPT uses a fingerprint login via a URL, FraudGPT is accessed via Telegram. FraudGPT’s responses incorporate rude commentary as well as disclaimers regarding the illegality of the advice.

Additional available tools, such as “WolfGPT” and “XXXGPT,” also advertise similar capabilities. However, it is unclear how effective these tools are in enabling malicious online actors. The proliferation of these types of tools will likely continue as members of illicit communities seek to use them to enhance their capabilities. However, as researchers test these bots, it appears that their answers have some limitations. In some cases, the malicious chatbots decline to answer questions, do not answer them in detail, or warn the user not to engage in illegal activity. The severity of the risks posed by these tools thus likely depends on the actors using them.

2. Clop Claims To Post Victim Names on August 15

Clop posted the following message on their ransomware leak site, indicating that they will start publishing data from companies that are infected but have not contacted Clop: 

Now we post many company name and proof we have their secrets and data. Some company do not speed to us and decide to stay quiet. We are very reasonable operators and when right situation we offer deep discount to block you data from being sold and publish. Advice you to contact us and begin discussion on how to block publicate of data. On 15 August we start publishing of every company on list that do not contact. You data is going to publishing on clearweb and Tor and for large company we also create clearweb URL to help google index you data. Also all data go on torrent and speed of download is very quick. YOU NOT HIDING MORE.

As of August 9, 2023, analysts have observed 659 victims that have appeared on the ransomware blog, or publicly disclosed or reported on the incident. For context, they have identified approximately 260 victims on Clop’s ransomware blog, and 486 on CRA through responsible disclosure or reporting. Several of these victims result from third-party compromise and may not be directly affected. They cannot accurately assess the total number of additional victims that may appear on the ransomware blog beginning on August 15. 

The analyst team at Flashpoint just released a blog post outlining the Lockbit Ransomware group.

LockBit was responsible for nearly 28 percent of known ransomware activity in the past year, and remains a major threat to organizations in the ransomware landscape.

According to the research, Lockbit has accounted for 28% percent of all known ransomware attacks from July 2022 to June 2023. Flashpoint uses OSINT and other collections to hone its research.

You can read the blog post here:  https://flashpoint.io/blog/lockbit/.

Flashpoint has put up a post on LinkedIn about the 10 Takeaways from Clop ransomware including the details we feel are key when dealing with the fallout of a major cyber extortion or ransomware event, either directly or via a third-party provider. It’s a very interesting read and well worth your time.

You can find the post here: https://www.linkedin.com/pulse/10-takeaways-from-clop-practical-advice-navigating-high-profile/

The security research team at Flashpoint have posted a new blog entry that is worth reading.  

In the blog, Flashpoint explores the intricacies of ransomware attacks, breaking down the attack lifecycle. Understanding this anatomy empowers security teams to strengthen defenses, reduce the risk of successful attacks, and protect organizations from the dire consequences of a ransomware incident.

Seeing as I am writing about ransomware attacks every day, this is worth your time to read. You can read the blog post here: https://flashpoint.io/blog/the-anatomy-of-a-ransomware-attack/. 

A new blog post is up from Flashpoint analysts that goes in depth on the role that social media and messaging platforms like Telegram continue to play and help us to understand events, rumors, and ideas as they unfold. The blog post is called Russia-Ukraine war: Days of Chaos: How OSINT Helps Us Understand the Putin-Prigozhin Schism.

You can read it here: https://flashpoint.io/blog/putin-prigozhin-osint/. 

The Flashpoint research team has posted a blog post this morning about the latest Google Chrome zero-day vulnerability. You can read it here: 

https://flashpoint.io/blog/google-addresses-latest-zero-day-vulnerability-affecting-chrome/. 

Yesterday, Google addressed another zero-day vulnerability affecting Google Chrome. The Flashpoint Intel Team quickly published an alert to VulnDB customers and have been closely tracking the vulnerability since.

This is the third zero-day vulnerability reported in the popular browser so far this year. Exploitation of the vulnerability was noticed by Google’s own Threat Analysis Group (TAG), but details about active exploitation are currently limited.

While the vulnerability is reported in Google Chrome, the root cause lies within the bundled V8 JavaScript engine that is responsible for executing JavaScript when browsing websites. As a result, the vulnerability may affect other products bundling V8.

According to a survey conducted in 2022, the use of detected deepfakes rose by 13 percent between 2021 and 2022. According to a blog posted by researchers at Flashpoint, threat actors posted about deepfakes on illicit forums and marketplaces approximately 133,000 times within the past three years. While not all discussions are malicious, threat actors are actively discussing and learning about the emerging technology. That suggests that maybe those who defend against attacks should be learning about deepfakes as well.

The Flashpoint blog can be found here.

Flashpoint has published a blog today entitled: For Money and Attention: Killnet Apparently Reorganizes Again. 

The past months have seen Killnet trying to make money in various ways, although it appears that these attempts to attract funding were mostly unsuccessful, or at the very least insufficient. They include:

• Publicly applying for sponsorship from the Russian state and from Russian businesspeople several times over the past months
• Selling access to various documents exfiltrated from NATO countries
• Selling the “Infinity” forum, which the group created in December 2022
• Promoting its paid “hacking school” ($249 for a course) which is apparently yet to launch
• Advertising its paid DDoS services 
• Soliciting money from its followers

Killnet remains widely ridiculed on top-tier Russian-speaking forums. On Exploit, for example, a thread in which the group’s leader, Killmilk, was advertising the sale of Infinity, drew widespread mockery, with users offering a couple hundred dollars for what many of them saw as a lost cause. 

You can read the blog post here.