uTalk

Updates to WhatsApp from Meta now allow for more flexibility in the type of content that can be shared in conversations thanks to the proxy feature.

According to WhatsApp, this includes the ability to send and receive images, voice notes, files, stickers, and GIFs. BBC Persian was the first news source to report on the new features.

The introduction of shareable links and streamlining of setup procedures are a few additional improvements. These changes allow users to more easily and automatically share working and legitimate proxy addresses with their contacts. ".

The messaging service formally introduced support for proxy servers in early January. This has made it possible for users to access WhatsApp indirectly despite government-imposed internet censorship and outages.

A reference implementation for configuring a proxy server with open ports 80, 443 or 5222 and a domain name pointing to the server's IP address has also been made available by the company.

According to WhatsApp, a proxy server serves as a gateway for communication between the app and external servers. Users can look for reputable accounts on social media that frequently post verified proxy addresses, which they can then add to their WhatsApp accounts. ".

Internet blackouts have become more frequent around the globe during crises, conflicts, intergroup violence, and to stop exam cheating. At least 187 internet shutdowns were implemented by authorities in 35 different countries in 2022; 80 have already been implemented in the first five months of 2023.

In 2022, India alone enacted 84 shutdowns, making it the leading democratic nation to do so for the fifth consecutive year.

ThirdEye, a previously unknown Windows-based information thief with the ability to gather private information from infected hosts, has been found in the wild.

The malware was found, according to Fortinet FortiGuard Labs, in an executable that had the ruse name "CMK равила оормлени олнин листов" and appeared to be a PDF file.
pdf.
exe," which is an acronym for "CMK Rules for Issuing Sick Leaves.
pdf.
exe.
".

Although the malware's entry point is currently unknown, the nature of the lure suggests that a phishing campaign may have used it. The first ThirdEye sample, which had comparatively fewer features, was uploaded to VirusTotal on April 4, 2023.

The evolving stealer, like other malware families of its kind, is capable of gathering system metadata, including volume information, the total and free disk space on the C drive, the total and free space used by processes currently running on the system, the usernames registered on the system, the date and vendor of the BIOS, and more. The gathered information is then sent to a command-and-control (C2) server.

The malware's notable characteristic is that it beacons its presence to the C2 server using the string "3rd_eye.".

No evidence has been found that ThirdEye has been used in the wild. Having said that, it's likely that the malicious activity is directed at organizations that speak Russian given that the majority of the stealer artifacts uploaded to VirusTotal originated from that country.

According to Fortinet researchers, the malware is "not particularly sophisticated, but it is designed to steal various information from compromised machines that can be used as stepping-stones for subsequent attacks." They added that the data gathered is "valuable for understanding and narrowing down potential targets.". ".

The development occurs at the same time that cryptocurrency miners and Umbral, an open-source stealer written in C that exfiltrates data of interest using Discord Webhooks, are being spread via trojanized installers for the well-known Super Mario Bros video game franchise that are hosted on dubious torrent sites.

According to Cyble, "the combination of mining and stealing activities results in financial losses, a marked decline in the victim's system performance, and the depletion of valuable system resources.".

Information-stealing malware.

chain of infection from seroXen.
A remote access trojan called SeroXen and Python-based ransomware have also been found to target gamers. SeroXen has been found to use a commercial batch file obfuscation engine called ScrubCrypt (also known as BatCloak) to evade detection. There is proof that actors involved in SeroXen's development also worked on ScrubCrypt.

The malware has also been promoted on Discord, TikTok, Twitter, and YouTube.
It was first advertised for sale on a clearnet website that was registered on March 27, 2023, before it was shut down in late May. SeroXen has since made its way to illicit forums with a cracked version.

"People are strongly advised to adopt a skeptical stance when encountering links and software packages associated with terms such as "cheats," "hacks," "cracks," and other software related to gaining a competitive edge," Trend Micro noted in a recent analysis of SeroXen.

The development of low-barrier-to-entry FUD obfuscators is highlighted by the addition of SeroXen and BatCloak to the malware arsenal of malicious actors. By the standards of advanced threat actors, these developers are amateurs when it comes to using social media for aggressive promotion, especially given how easy it is to track them down. ".

LetMeSpy, an Android-based phone monitoring app, has disclosed a security breech that made it possible for an unauthorized third party to steal private information related to thousands of Android users.

LetMeSpy stated in a statement on its website that the incident happened on June 21, 2023.
"As a result of the attack, the criminals gained access to email addresses, telephone numbers, and the content of messages collected on accounts," the company noted.

LetMeSpy claimed it alerted law enforcement and data protection authorities as soon as the hack was discovered. Additionally, it is taking action to halt all account-related operations until further notice. The threat actor's identity and motivations are currently a mystery.

LetMeSpy, created by the Polish company Radeal, is available as a monthly subscription ($6 for Standard or $12 for Pro), allowing users to spy on others by simply installing the software on their devices. Its description as a tool for employee or parental control is revealed by an Internet Archive snapshot from December 2013.

LetMeSpy has a variety of features that can be accessed from the website to gather call logs, SMS messages, and geolocations. The app's icon can be hidden from the device's home screen launcher in an effort to avoid being noticed and removed.

The stalkerware app has been used to track 236,322 phones globally as of January 2023, harvesting more than 63,5 million text messages, 39,7 million call logs, and 43,2 million locations.

About 26,000 email addresses, 16,000 SMS messages, and a database of victims' locations, according to the Polish security research blog Niebezpiecznik, which broke the news of the breach and examined a dump of the stolen data.

The data originates from 2013, the year LetMeSpy started taking operations, according to a subsequent review of the TechCrunch information that was leaked. Additionally, data from at least 13,000 compromised devices is included in the records. Most of the victims are in the United States. S. India, as well as some of Africa.

International glass eel trafficking organizations have suffered yet another devastating blow thanks to a global joint operation coordinated by Europol and involving law enforcement agencies from all over the world. Operation Lake this year, which took place from October 2022 to June 2023, resulted in the capture of 256 people in connection with the trafficking of 25 tonnes of live glass eels, which were sold for about EUR 13 million. 8 tonnes of these baby eels were already leaving the EU for Asia, where they would be raised in fish farms and sold all over the world once they reached adulthood.

The most recent season of Operation LAKE set a new benchmark as its most productive one yet, with an increase of over 50% in arrests and seizures. Chinese, Malaysian, French, Spanish, Portuguese, and nationals of two high-value targets and fifty of their closest associates were among the 256 people detained. The organized criminal networks involved in this multi-billion euro activity are severely disrupted by these successes. Authorities also seized bank accounts with over EUR two million in funds and criminal assets worth over EUR one million.

As a last resort, law enforcement is used for eels.
One of the world's worst crimes against wildlife, the protected European glass eel is the target of Operation LAKE. The population of the European eel (Anguilla anguilla) has dropped by 90% recently; however, ongoing law enforcement efforts against eel trafficking may have helped to keep the species from going extinct.

Glass eel trafficking is one of the largest and most profitable illegal trades of protected species worldwide, with peak years' illegal profits estimated to reach up to EUR 3 billion. A significant portion of the marked decline in illegal activity can be attributed to effective law enforcement efforts to combat this threat to European wildlife. According to estimates, since 2016, the year Operation LAKE was put into action, the number of eel trafficking incidents has decreased by 50%. Since then, more than 750 people have been detained, and 26 tonnes of glass eels have been kept from being smuggled and may now be returned to their natural habitats.

environmental crime with sophistication.
These fish are being smuggled from Europe to Asia by numerous criminal organizations. EU nationals are primarily in charge of the illegal fishing of young eels in European waters within these criminal organizations, while nationals from the Asian destinations organize further logistics and transportation. Glass eels are occasionally purchased from poachers, and on occasion, legally caught glass eels are diverted to black markets. Local fishermen typically catch eels in rivers using prohibited and illegal techniques, which frequently severely harm the river's wildlife. Fish can be transported legally throughout Europe for farming or restocking. Glass eels have a legal market in the EU. As a result, criminals depend on and abuse legally operating EU companies that are under their control.

The eels are caught and then shipped to Europe, where they are kept in homes, apartments, and warehouses. Typically, the live fish are prepared for shipment in luggage or cargo shipments by Asian members of the criminal organization. Eels may be transported in vehicles, concealed in passengers' luggage, or disguised as commodities and shipped in packages on commercial aircraft. These delicate fish must travel to Asia in airtight containers or plastic bags with a set water temperature and oxygen level in order to survive.

Once the eels are in Asia, they are raised in fish farms before being sold in various markets around the world. One of the most serious types of wildlife trafficking worldwide is the trade in glass eels, which are prized in many Asian nations as a delicacy. Glass eels are thought to be smuggled out of member countries of the European Union at a rate of about 100 tons per year, with prices per kilogram reaching mind-boggling heights of up to several thousand euros.

role of Europol.
Across continents, Europol supported national law enforcement agencies with forensic and analytical support, hosted a virtual command post, and coordinated operational activities. Europol sent experts to the hot spots during the action days to instantly cross-check operational data against its databases and give leads to on-the-ground investigators.

Operation LAKE seeks to break up violent organized crime organizations that engage in illegal activities like environmental crime, smuggling, money laundering, tax evasion, and document forgery. It also targets the trafficking of endangered species within the European Union.

In dismantling a sizable criminal organization of so-called "Thieves in Law" (Vory V. Zakone), who were engaged in aggravated property crime, racketeering, extortion, and money laundering, Europol assisted the French National Police (Police Nationale) and the Spanish National Police (Polica Nacional). The investigation revealed that the criminal network was engaged in the theft, sale, and smuggling of goods, including tobacco, as well as the laundering of illicit funds.

The French Criminal Police has been looking into people who may be associated with the criminal organization known as "Thieves in Law" since November 2020. An extensive Armenian criminal organization with bases in France and Spain and a Thief in Law in Spain at its helm was discovered during the investigation, which was overseen by specialized magistrates from the Court of Paris.

The majority of the money laundering was done in Spain, mostly through auto mechanics and a caviar import shop in Barcelona. With the help of operational analysis, Europol supported the operation by facilitating information sharing and organizing operational meetings. This allowed the national authorities to identify connections between the suspects and their criminal activity. To aid investigators in the field with technical know-how and real-time analytical support, Europol also sent experts there.

The result of the protest days on June 19 and 20 was.
38 house searches in France (Clermont-Ferrand, Metz, Lyon, Marseille, Paris) and Spain (Alcasser, Barcelona, Lloret de Mar and Valencia)
28 arrests in France and Spain
Arrest of the chief ‘Thief in Law’
Seizures include 16 luxury watches (one of them valued at EUR 39 000), 8 vehicles, 6 weapons with ammunition, 1 bullet-proof vest, 2 GPS detection devices, over EUR 60 000 cash, numerous mobile phones and electronic devices, as well as various pieces of ‘Thieves in Law’ paraphernalia.

In November 2020, the police in France and Spain began working together to investigate this criminal organization. The links between the suspects were revealed, as well as the extensive spread of the network, during earlier independent investigations by French and Spanish police into a number of members of the criminal organization, many of whom were of Armenian and Georgian nationality. The investigation was advanced through later international cooperation between law enforcement and judicial authorities, with help from Europol's analysis, which revealed the members of the criminal organization's leadership's previously well-kept connections.

A prior assassination attempt by a criminal leader was investigated.
This network adhered to the "Thieves in Law" code of conduct, a particularly well-organized form of a criminal organization that emerged from the criminal underworld of former Soviet countries. In this particular network, there were strict codes of conduct that protected the leader and were designed to ensure the network's survival. The leader's position of authority over the other criminal organization members was guaranteed by the title he holds.

In connection with an attempted assassination of a rival "crowned" thief, the Spanish national police conducted an investigation and detained this person in 2018. In order to avoid police action against the organization's leader, the criminal network responded by stepping up its security measures. This included the use of various vehicles registered in the names of organization members and a house that was also rented out under a different name. The leader's vehicles would be routinely inspected at the organization's workshops to look for electronic tracking devices that may have been put in place by the police. Financial investigators focused on the criminal actors' assets thanks to the close cooperation between French and Spanish authorities and the assistance of Europol in identifying criminal activities and links between them. The network's boss is currently being held in Spain while France's European arrest warrant for him is being processed.

Since April 2018, users of French-speaking people in France, Belgium, and Luxembourg have been the target of a scam network known as CryptosLabs, whose operations have been revealed by cybersecurity researchers. It is estimated that since April 2018, CryptosLabs has generated illegal profits of €480 million by preying on these users.

Group-IB said in a deep-dive report that the syndicate's massive fake investment schemes primarily involve posing as 40 reputable banks, fin-techs, asset management companies, and cryptocurrency platforms while establishing a scam infrastructure spanning over 350 domains hosted on more than 80 servers.

The business with its headquarters in Singapore claimed that the criminal organization is "operated by a hierarchy of kingpins, sales agents, developers, and call center operators" who are hired to lure potential victims in by promising them large returns on their investments.

"CryptoLabs made their scam schemes more convincing through region-focused tactics, such as hiring French-speaking callers as'managers' and creating fake landing pages, social media ads, documents, and investment platforms in the French language," said Anton Ushakov, deputy head of Group-IB's high-tech crime investigation department in Amsterdam.

"To better connect with and successfully exploit their target audience, they even impersonated French-dominant businesses. ".

It all begins with luring targets through advertisements on social media, search engines, and forums devoted to online investments, pretending to be an "investment division" of the impersonated organization and offering them alluring investment plans in an effort to obtain their contact information.

Swindle Network CryptosLabs.

Next, call center representatives approach them and give them more information about the fraudulent platform and the credentials needed to conduct trading.

After logging in, the victims add money to a virtual balance, according to Ushakov. "They are then shown fictitious performance charts, which encourage them to invest more money in order to make more money, until they realize they cannot withdraw any money even after paying the "release fees. '".

While the initial deposits range from $200 to $300, the scam is designed to persuade victims to deposit more money by creating the appearance that their investments are doing well.

The large-scale scam-as-a-service operation was first brought to light by Group-IB in December 2022, and it claims to have been able to trace the first indications of the group's activity back to 2015, when it was discovered experimenting with various landing pages. After a two-month preparation period, CryptosLabs would begin its tryst with investment fraud in June 2018.

The use of a unique scam kit, which enables the threat actors to run, manage, and scale their operations at different stages, from bogus social media advertisements to the website templates used to pull off the heist, is a key selling point of the campaign.

Additional tools for creating landing pages, a CRM service that enables the addition of new managers to each domain, a leads control panel that fraudsters could use to onboard new clients to the trading platform, and a VoIP tool to communicate with victims in real-time are also included in the kit.

According to Ushakov's analysis of CryptosLabs, "the threat group has given its operations a well-established structure in terms of headcount and operations, and is likely to expand the scope and scale of its illicit business in the coming years.".