Impact of the Post Millennial Data Breach
In a significant cybersecurity incident, the conservative Canadian online news magazine, The Post Millennial, and its affiliate, the American news platform Human Events, were compromised earlier this month. Hackers defaced their websites and leaked sensitive data from their mailing lists and subscriber databases. According to Have I Been Pwned, the breach affected approximately 26.8 million individuals, exposing personal details such as full names, email addresses, account passwords, and more. The leaked data, which rapidly disseminated across torrents and hacking forums, includes information on the company’s writers, editors, and subscribers, posing severe privacy and security risks. The breach notification service added this data to alert those potentially affected. It remains unclear where the data originated, and neither The Post Millennial nor Human Events has yet addressed the breach publicly. Subscribers are urged to reset passwords and monitor their accounts closely.
Firstmac Confronts Major Data Breach
Firstmac Limited, a leading non-bank financial institution in Australia, recently alerted its customers to a severe data breach. This notification followed claims by the newly formed Embargo cyber-extortion group, which allegedly leaked over 500GB of data stolen from the company. As one of Australia’s prime mortgage lenders and asset managers, Firstmac manages a substantial portfolio, including $15 billion in mortgages and has issued 100,000 home loans. The compromised data includes sensitive personal information such as full names, residential addresses, email addresses, phone numbers, birth dates, external bank account details, and driver’s license numbers. In response to the breach, Firstmac has enhanced its security measures, including implementing two-factor authentication and biometric verification for all account changes. Additionally, affected customers are being offered free identity theft protection services and are advised to monitor their accounts for any suspicious activity.
Widespread Impact of Black Basta Ransomware
The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have reported significant disruptions caused by the Black Basta ransomware, which has compromised over 500 organizations globally, including sectors of critical infrastructure. This alert follows a concerning pattern of attacks between April 2022 and May 2024, particularly targeting entities in North America, Europe, and Australia. The ransomware has been especially active in the healthcare sector, prompting additional advisories from both Health-ISAC and MS-ISAC due to the potential risks to patient care and data security.
Black Basta, believed to have connections to the now-defunct Conti ransomware group, has demonstrated a high level of sophistication in its operations. The group has amassed at least $100 million in ransom payments from numerous high-profile attacks. In response, CISA and the FBI have issued detailed guidance on defensive strategies to mitigate the risk of further incidents. This includes updating systems, implementing multi-factor authentication, and securing remote access software. The agencies have stressed the importance of these measures to protect against the ongoing threat posed by Black Basta and similar ransomware groups.
Escalation of LockBit Black Ransomware Attacks Via Phorpiex Botnet
Since April 2024, a significant uptick in ransomware dissemination has been observed, driven by the Phorpiex botnet’s massive distribution of phishing emails. The New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) has identified millions of these emails, which carry the LockBit Black ransomware hidden in ZIP file attachments. These attacks, deploying an encryptor likely developed from the LockBit 3.0 builder—leaked online in late 2022—stand out not due to their sophistication but because of the sheer scale and reach across global IP addresses.
The campaign utilizes common phishing tactics with misleading email subjects like “your document” or “photo of you???” sent from various aliases. The initial compromise occurs when recipients execute the malicious executable contained within the downloaded ZIP file, triggering the LockBit Black ransomware that encrypts files and can steal sensitive data. Proofpoint, tracking this campaign, notes the extraordinary volume of these attacks, highlighting the Phorpiex botnet’s capability to execute widespread cyber threats. This resurgence underscores the ongoing risk posed by established cybercrime tools in conducting expansive, disruptive operations.
Apple Extends Critical Security Updates to Older Devices
Apple has recently expanded its March security patches to include older iPhone and iPad models, addressing a critical zero-day vulnerability, CVE-2024-23296, that was previously fixed for newer devices. This flaw, a memory corruption issue in Apple’s RTKit operating system, could allow attackers to bypass kernel memory protections. Although initially patched in newer models, Apple has now made these crucial updates available for devices including iPhone 8, iPhone X, and various iPad models.
The vulnerability, which Apple states may have been actively exploited, emphasizes the risk of targeted attacks potentially orchestrated by state-sponsored entities. These sophisticated attacks often target journalists, activists, and political figures, exploiting such vulnerabilities to compromise personal security. Apple’s proactive step to backport these patches to older devices underscores the ongoing necessity for robust cybersecurity measures across all technology generations. Users of older Apple devices are strongly encouraged to install these updates immediately to safeguard against potential exploitation.
FBI Shuts Down BreachForums in Cybercrime Crackdown
The FBI has successfully seized BreachForums, a prominent hacking forum notorious for leaking and selling stolen corporate and personal data. The action took place on Wednesday morning, following the forum’s role in disseminating data pilfered from a Europol law enforcement portal. Visitors to the site are now met with a seizure notice that highlights the FBI and DOJ’s collaborative efforts, supported by international partners, to take control of the site and its associated data.
This seizure has significant implications, as the FBI now possesses backend data which could include email addresses, IP addresses, and private communications among forum members. This information could prove crucial in ongoing investigations and potential prosecutions. The action extends beyond the website to include the seizure of associated Telegram channels, reinforcing the crackdown’s breadth.
BreachForums had become a central hub for cybercriminals to exchange hacked data and access tools, impacting countless individuals and organizations worldwide. The forum’s shutdown marks a critical moment in the battle against organized cybercrime, reflecting heightened enforcement efforts and the serious consequences for those involved in such illegal activities.
New Lunar Malware Compromises European Diplomatic Agencies
ESET researchers have discovered sophisticated malware, LunarWeb and LunarMail, utilized by Russian hackers to target a European government’s diplomatic missions. Active since at least 2020, these backdoors are suspected to be linked to the state-sponsored group Turla. The attack initiates with spear-phishing emails that install LunarMail through malicious Word documents, enabling persistent access via an Outlook add-in. LunarWeb exploits misconfigured Zabbix tools to mimic legitimate traffic, facilitating unnoticed command execution. These tools, designed for stealth and long-term surveillance, underscore the advanced nature of state-sponsored cyber threats against global diplomatic targets.
Conclusion
In conclusion, the increase in cyberattacks globally highlights the urgent need for robust cybersecurity practices and preparedness. From ransomware spreading through phishing emails to sophisticated malware targeting diplomatic entities, the threat landscape is evolving rapidly, necessitating proactive measures to protect sensitive data and systems.
We specialize in comprehensive cybersecurity solutions, offering services such as Ransomware Recovery Services, Ransomware Negotiation Services, and Ransomware Settlement Services. If your organization is impacted by a ransomware attack or needs to enhance its cyber defenses, our team is ready to assist you.
