uTalk

In Germany, Italy, and the Netherlands, judicial and law enforcement authorities worked with Eurojust and Europol to dismantle a drug trafficking network that was primarily made up of Albanian citizens. 35 suspects were detained during a joint operation, and 51 locations were searched across the participating nations. In the operation, there were over 600 police officers. A joint investigation team (JIT) was formed and funded by the authorities with assistance from Eurojust.

Large-scale cocaine and cannabis trafficking from South America to Europe and its subsequent distribution throughout the European Union are allegedly the work of the criminal network. The use of violence, such as instances of torture and kidnapping for ransom, is another thing for which they are infamous.

The offenders allegedly benefited from substantial financial resources acquired through prior drug trafficking operations. They had a number of logistical hubs where the drugs and stolen money were kept and where the associates could gather. They also had a sizable fleet of vehicles with sophisticated hidden compartments, as well as cell phones with encryption software for texting.

The investigation shows that between March 2020 and June 2021, the criminal network imported at least 36 tons of marijuana and one ton of cocaine. The distribution market revenue from these substances would have exceeded EUR 1 billion. During the course of the investigation, more than EUR 1 million in cash was also seized.

According to their respective roles, the network's participants split the proceeds of the crime. Certain suspects allegedly used their ownership of a posh restaurant, a bar, and a real estate firm in Germany as a means of money laundering.

In September 2021, at the request of the German authorities, the case was opened at Eurojust. In July 2022, with Eurojust's assistance, a JIT was established between the German and Italian authorities. The Agency held two coordination meetings to promote judicial cooperation and set the stage for the joint action day. To facilitate quick communication between the judicial authorities taking part in the action day, a coordination center was established.

Since the end of 2020, the case has been supported by Europol's Serious Organized Crime Centre, which has communicated with the relevant authorities via more than 250 secure messages. The identification of the main targets and the mapping of their criminal activities around the world were made possible by extensive analytical support. Europol organized a number of operational gatherings, either at its The Hague headquarters or elsewhere. Throughout the action day, two additional Europol agents were also stationed locally in Germany and Italy to assist law enforcement with their investigational efforts. During the action day, Europol also established a secure communication platform to permit the real-time exchange of tactical information among the various involved law enforcement agencies.
The @ON Network, funded by the European Union (Internal Security Funds Project "ISF4@ON") and overseen by the Italian Antimafia Investigation Directorate (DIA), has provided support for the investigation and the organization of the joint action day itself.

Participating in this investigation were the following authorities:.
PPO Frankfurt, PPO Gießen, the Criminal Investigation Office Frankfurt (Department K 62) of the Police Headquarters Frankfurt am Main, the Regional Criminal Investigation Office Friedberg (Narcotics Department / K 34) of the Police Headquarters of Central Hesse, and, supporting the execution of the measures on Action Day, special forces of the Federal State (Bund), the states of Saarland and Hesse, and task forces of the riot police units of Hesse and Rhineland.
Italy: PPO Bologna; Polizia di Stato, Squadra Mobile from Forl and Modena, with operational support from the Central Operational Service (SCO) of the Central Anti-Crime Directorate (DAC).
Netherlands: Landelijk Parket National PPO Team International Cooperation (LIRC - IRC-LE), Dutch National Police, Eenheid Amsterdam, and Landelijke Eenheid.

A UK citizen who participated in the massive Twitter hack in July 2020 was given a five-year prison sentence in the US.

A little more than a month after pleading guilty to the illegal schemes, Joseph James O'Connor (aka PlugwalkJoe), 24, received the sentence on Friday in the Southern District of New York. July 2021 saw his detention in Spain.

The infamous Twitter hack gave the defendant and his accomplices access to Twitter's backend tools without authorization. They took advantage of this access to sabotage 130 well-known accounts and run a crypto-scam that brought them about $120,000 in illegal profits.

In other cases, the conspirators sold access to Twitter accounts to third parties, according to the US.
Apparently, the Department of Justice (DoJ). "O'Connor exchanged messages with others about buying unauthorized access to a variety of Twitter accounts, including accounts linked to well-known people all over the world.
".
Additionally, the defendant is charged with planning SIM-swapping attacks to take over users' Snapchat and TikTok accounts. In one instance, the defendant allegedly targeted a cryptocurrency business in New York in order to steal cryptocurrency valued at $794,000 at the time.

The DoJ stated that "O'Connor and his co-conspirators laundered the Stolen Cryptocurrency through dozens of transfers and transactions and exchanged some of it for Bitcoin using cryptocurrency exchange services after fraudulently diverting and stealing it.".

In the end, some of the stolen cryptocurrency was deposited into an O'Connor-controlled exchange account. ".

O'Connor also admitted to cyberstalking two victims, one of whom was a minor, in June and July 2020 by pretending that the victim was threatening to shoot people in an effort to provoke a police response.

O'Connor will also have to undergo three years of supervised release following his jail sentence.
According to TechCrunch, O'Connor called his crimes "stupid and pointless.".
A $794,00 forfeiture order has also been issued against him.

The US. On Thursday, the National Security Agency (NSA) released guidelines to assist businesses in identifying and guarding against the BlackLotus UEFI bootkit infection.

The organization advises "infrastructure owners take action by hardening user executable policies and monitoring the integrity of the boot partition" in order to achieve this goal. ".

In October 2022, Kaspersky first raised awareness of BlackLotus, an advanced anti-crimeware solution. Samples of the malware have since circulated in the wild and are a UEFI bootkit capable of evading Windows Secure Boot safeguards.

This is done by exploiting a known Windows vulnerability known as Baton Drop (CVE-2022-21894, CVSS score: 4.4), which was found in vulnerable boot loaders not included in the Secure Boot DBX revocation list. In January 2022, Microsoft released a patch to address the vulnerability.

Threat actors may use this flaw to replace fully patched boot loaders with vulnerable versions and launch BlackLotus on infected endpoints.

A threat actor can completely control how the operating system boots up thanks to UEFI bootkits like BlackLotus, which gives them the power to tamper with security features and install additional payloads with elevated privileges.

It's important to note that BlackLotus targets the initial software phase of the boot process rather than the firmware to achieve persistence and evasion. No proof exists that the malware specifically targets Linux systems.

When compared to firmware implants, UEFI bootkits may not be as stealthy. ] as bootkits are located on an easily accessible FAT32 disk partition," ESET researcher Martin Smolár stated in an analysis of BlackLotus in March 2023.

But operating as a bootloader spares them from having to get past multilevel SPI flash defenses like the BWE, BLE, and PRx protection bits or hardware protections like Intel Boot Guard, giving them nearly the same capabilities as firmware implants. ".

GRATIS GUIDE.

The Ultimate Three-Step Guide to Zero Trust Access Implementation Today!
Simply take concrete steps to increase the security and productivity of your company instead of using empty platitudes. Do not overlook this thorough guide!

Guide, download.

Organizations are urged to take the following mitigation measures in addition to installing the Microsoft May 2023 Patch Tuesday updates, which fixed a second Secure Boot bypass vulnerability (CVE-2023-24932, CVSS score: 6.7) exploited by BlackLotus.

reinstall recovery media.

Defensive software should be set up to monitor alterations to the EFI boot partition.
Keep an eye out for strange changes in the EFI boot partition by monitoring device integrity measurements and boot configuration.
In order to prevent older, signed Windows boot loaders, modify UEFI Secure Boot.
On devices that only boot Linux, remove the Microsoft Windows Production CA 2011 certificate.
For its part, Microsoft is closing the attack vector gradually. In the first quarter of 2024, the fixes are anticipated to be generally accessible.

Aria Operations for Networks (previously vRealize Network Insight), which recently received a critical patch for the vulnerability, has been actively exploited in the wild, according to VMware.

The vulnerability, identified as CVE-2023-20887, could enable remote code execution if a malicious actor with access to the product's network conducted a command injection attack.

Version 6 of VMware Aria Operations Networks are affected. Version x was fixed in versions 6.2, 6.3, 6.4, and 6.5. 1, 6.6, 6.7, 6.8, 6.9, and 6.10 on June 7th, 2023.

The vulnerability has reportedly now been weaponized in real-world attacks, according to an update shared by the virtualization services provider on June 20; however, the specifics are still unknown.

According to the business, "VMware has confirmed that CVE-2023-20887 has been exploited in the wild.".

According to information gathered by the threat intelligence company GreyNoise, two different IP addresses in the Netherlands are actively exploiting the vulnerability.

VMware's vulnerability.

This change occurred after researcher Sina Kheirkhah of the Summoning Team, who found and reported the flaws, published a proof-of-concept (PoC) exploit for the vulnerability.

Kheirkhah stated that "this vulnerability comprises a chain of two issues leading to remote code execution (RCE) that can be exploited by unauthenticated attackers.".

If anything, a major threat to organizations all over the world still comes from the speed with which either state actors or financially motivated groups take newly discovered vulnerabilities and use them to their advantage.

The disclosure also comes in response to a Mandiant report that discovered active use of another vulnerability in VMware Tools (CVE-2023-20867) by a fictitious Chinese actor known as UNC3886 to backdoor Windows and Linux hosts.

It is advised that users of Aria Operations for Networks update as soon as possible to the newest version to reduce any risks.