Tag Archive for: revenge

Ukraine Claims Revenge Hack Against Moscow Internet Provider


Sources reportedly tipped off Ukraine media to a cyberattack launched this week by the Blackjack cyber group, linked to the Security Service of Ukraine (SBU), that they claim was able to “destroy” the servers of Moscow Internet service provider M9 Telecom.

The ISP’s website was operational on Jan. 9.

Unnamed sources told state-run Ukrainian media outlet Ukrinform that the cyber operation was in retaliation for the Russia-backed breach of Kyivstar mobile phone operator Dec. 12, which caused communications blackouts across Ukraine. The source reportedly added the M9 Telecom cyberattack was just a “warm up” for more “serious revenge for Kyivstar.”

The Blackjack cyber group likewise claimed credit for the late December breach of Moscow’s Rosvodokanal water utility, which the group claimed it was able to pull off with the help of the SBU.

Earlier this month, the SBU’s cyber chief, Illia Vitiuk, warned that Russia’s compromise of Kyivstar, a modern, private company should signal to Western countries that nothing is beyond the reach of sophisticated Russian cyber threats.

Source…

More Conti ransomware source code leaked on Twitter out of revenge


Conti ransomware

A Ukrainian security researcher has leaked newer malware source code from the Conti ransomware operation in revenge for the cybercriminals siding with Russia on the invasion of Ukraine.

Conti is an elite ransomware gang run by Russian-based threat actors. With their involvement in developing numerous malware families, it is considered one of the most active cybercrime operations.

However, after the Conti Ransomware operation sided with Russia on the invasion of Ukraine, a Ukrainian researcher named ‘Conti Leaks‘ decided to leak data and source code belonging to the ransomware gang out of revenge.

Conti siding with Russia on the invasion of Ukraine
Conti siding with Russia on the invasion of Ukraine
Source: BleepingComputer

Last month, the researcher published almost 170,000 internal chat conversations between the Conti ransomware gang members, spanning January 21st, 2021, through February 27th, 2022. These chat messages provide detailed insight into the operation’s activities and its member’s involvement

The researcher later leaked old Conti ransomware source code dated September 15th, 2020. While the code was rather old, it allowed researchers and law enforcement to analyze the malware to understand better how it works.

More recent Conti source code released

Today, Conti Leaks uploaded the source code for Conti version 3 to VirusTotal and posted a link on Twitter. While the archive is password-protected, the password should be easily determined from subsequent tweets.

This source code is much newer than the previously released version, with the last modified dates being January 25th, 2021, making it over one year newer than the previously released code.

Conti Locker version 3 source code
Source: BleepingComputer

Like the previous version, the source code leak is a Visual Studio solution that allows anyone with access to compile the ransomware locker and decryptor.

Compiling the Conti source in Visual Studio
Compiling the Conti source in Visual Studio
Source: BleepingComputer

The source code compiles without error and can be easily modified by other threat actors to use their own public keys or add new functionality. 

As you can see below, BleepingComputer compiled the source…

Source…

Smashing Security podcast #240: 3D printer hijacks, crypto fails, and a tech billionaire's revenge – Graham Cluley Security News



Smashing Security podcast #240: 3D printer hijacks, crypto fails, and a tech billionaire’s revenge  Graham Cluley Security News

Source…

Court Says Section 230 Shields Twitter From Revenge Porn Bro’s Stupid Lawsuit

Former revenge porn extortionist and current pro se litigant, Craig Brittain, is one severely-narrowed complaint away from having his lawsuit against Twitter tossed. Brittain sued Twitter over the deletion of several accounts, including those he had whipped up for his Senate run.

The court’s first pass at the lawsuit moved it to California, a venue shift Brittain explicitly agreed to each time he created another alt account. Terms of service say suing Twitter means suing in California, even if you’re an Arizonan Senate hopeful with a closet that contains nothing but skeletons.

Contrary to Brittain’s fervent and litigious belief, there’s nothing illegal about deleting Craig Brittain’s multiple Twitter accounts. Brittain’s lawsuit tried to make it possible by treating Twitter as both a provider and a publisher, depending of which description worked out better for his arguments. The court decides to let Brittain have it both ways — and lose both ways. (h/t Adam Steinbaugh)

As a service provider, Twitter cannot be held liable for third party content. It can also remove accounts without losing this immunity. Since this isn’t about the removal of content, but rather the removal of accounts, Brittain tried to argue Section 230 immunity can’t protect Twitter from this lawsuit because removing accounts (and their content) is an editorial activity. The court points out this has zero effect on Section 230 protections. From the decision [PDF]:

Under the CDA, a publisher’s activity generally “involves reviewing, editing, and deciding whether to publish or to withdraw from publication third-party content.” Id. at 1102. “[R]emoving content is something publishers do, and to impose liability on the basis of such conduct necessarily involves treating the liable party as a publisher of the content it failed to remove.” Id. at 1103. In other words, “any activity that can be boiled down to deciding whether to exclude material that third parties seek to post online is perforce immune under [CDA] section 230.” Fair Hous. Council of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1170–71 (9th Cir. 2008) (en banc).

Publisher or provider, it doesn’t matter. Suing a social media site for deleting accounts is a non-starter.

The Brittain Accounts qualify as “information provided by another information content provider.” Brittain expressly acknowledges that he, not Twitter, created and operated the accounts See Barnes, 570 F.3d at 1102 & n.6 (“The statute also tells us that this term ‘means any person or entity that is responsible, in whole or in part, for the creation or development of information provided through the Internet or any other interactive computer service.’”) (quoting 47 U.S.C. § 230(f)(3)). Accordingly, the Court finds that all but Brittain’s antitrust claim are barred by Section 230(c)(1) of the CDA. Because plaintiff cannot cure this defect, the Court DISMISSES these claims with prejudice.

All Brittain can do now is file a complaint limited to the anti-trust violations he alleges. But the court’s brief analysis of the single surviving claim suggests this will be a waste of everyone’s time. The court says it’s unlikely Brittain can even prove standing, since his claim is pretty much limited to him losing followers when his accounts were suspended or deleted. Brittain’s lawsuit doesn’t actually allege Twitter did anything illegal in terms of competitive practices.

Although Brittain’s complaint does not suggest that plaintiffs could allege an antitrust cause of action, out of an abundance of caution, the Court affords Brittain leave to amend with respect to this claim and DISMISSES Brittain’s antitrust claim without prejudice.

[…]

While the Court can understand the frustration which may occur if a person’s Twitter account is suspended, unless a legal cause of action can be articulated, a lawsuit cannot be sustained. Nor is the person entitled to discovery on the general issues upon which the complaint is based, unless a legal claim can be stated. Here, the complaint is fundamentally flawed.

The court also points out Brittain can’t sue on behalf of his Brittain For Senate campaign committee. This committee of one must seek its own legal representation, which cannot be a pro se litigant named Craig Brittain. This seems unlikely to happen, so this additional will be removed from a lawsuit the only plaintiff remaining (Craig Brittain) is destined to lose.

Yeah, it sucks when a platform decides it no longer wants your free business. But it’s not illegal, no matter how many of your hastily-erected Senate campaign committee Twitter accounts are removed by a private company.

Permalink | Comments | Email This Story

Techdirt.