The European Union Agency for Law Enforcement Cooperation, or Europol, 09/10/2019 released its annual Internet Organized Crime Threat Assessment (IOCTA) report for the year. And we weren’t surprised to find that ransomware, despite its palpable decline in volume these past few months—a trend we’ve also seen and documented—remains the most prominent threat in terms of prevalence and financial damage.

While the IOCTA report talks about online threats that both consumers and businesses face on a daily basis, it also puts data at the center of it all. We rely on it—often, all too much—and criminals know this. And yet, most threat actors behind attack campaigns rely on our data to make their attacks more successful, compelling us to take action. After all, nowadays an attack that doesn’t use data against its owners wouldn’t be much of a money-earning scheme.

Threat actors can deprive organizations and individuals’ access to their own files by encrypting and holding them for ransom, such is the case for ransomware. And they can also deny the average user access to an organization’s data (and services) through Distributed Denial of Service (DDoS) attacks. According to Europol, such attacks with an extortion element in them are the most prevalent.

Data also enables other forms of online crime like fraud. Criminals are primarily after financial data, such as credit card information, online banking credentials, and cryptocurrency wallet data. They are also after personally identifiable information (PII) and other login credentials. Such data fuels other profitable, targeted attacks like business email compromise (BEC) scams, spear phishing, and account takeovers.

There is also the challenge of data overload, particularly in the realm of child sexual exploitation (CSE) crimes. The staggering amount of material online detected by law enforcement and private companies continues to increase to the point that it’s putting a strain on law enforcement resources to investigate these crimes. One contributing factor to the increase of availability of CSE material online is that more underage users are accessing and using social media, thus, criminals reach and communicate with them via these platforms.

Other IOCTA findings:

• The IOCTA report also noted that key infection vectors are phishing and remote desktop protocol (RDP) vulnerabilities. Simple patching can address vulnerabilities. As for phishing, did you know that you can be targeted on your desktop and smart phone?
• Organizations are growing more concerned about sabotage performed by malicious insiders.
• Ransomware tactics have shifted, from a scattergun approach of infecting systems to a more focused and refined targeting of profitable victims. This means that ransomware proponents target those with a greater ability to pay a ransom than the average, normal user.
• BEC is evolving. There have been campaigns wherein threat actors used malware and network intrusion.
• Self-generated explicit material (SGEM) is on the uptick. Young children now have access to high-quality smart phones, which enables them to produce and share SGEM, either voluntarily or under coercion. The rising number of SGEM victims will likely to continue. Parents and guardians: Please talk to your kids about this, and other online risks.
• Jackpotting, also known as black-box attacks, against ATMs are becoming more widespread and accessible due to tools like Cutlet Maker being more available on the dark web.
• Card-not-present (CNP) fraud and skimming continue to plague financial institutions. Don’t be a victim of skimming.
• Due to law enforcement activity and extensive DDoS attacks against hidden services, many have grown distrustful of the onion router (Tor) environment. While underground market administrators are currently exploring alternatives, a migration to a new platform will not likely happen yet.

Source: Europol

Source: Malwarebytes Labs

On July 30, the SICP (Security Intelligence Cryptocurrencies Platform) platform announced the launch of the first Russian commercial Center for monitoring cryptocurrency transactions, identifying the risks of cryptocurrency wallets and responding to incidents in the field of cryptocurrency circulation (CryptoCERT).

This service is the first in Russia and the UIS. Today, any citizen or organization can send information about fraud (another threat or risk) related to cryptocurrencies. Additionally, the publicly available interactive map displays profiled crypto wallets by country. The custom menu allows you to display one or more profiles. The legend displays the share and number of wallets associated with the profile. For registered and verified users, a wider visualization functionality is available.

It should be noted that on July 22, the State Duma of the Russian Federation adopted in the 3rd reading the law "On digital financial assets". The new rules will enter into force on January 1, 2021. The law "On digital currency" is expected to be considered in the coming autumn.

Remarkably, today is World Day Against Trafficking in Persons. It is a serious crime and gross violation of human rights. The United Nations Office on Drugs and Crime (UNODC), as the guarantor of the United Nations Convention against Transnational Organized Crime and the Protocols thereto, assists States in their efforts to implement the Trafficking in Persons Protocol.

By the way, this factor is taken into account when assessing the risks of crypto wallets, in the SmartEcho service, and identifying suspicious transactions ...

Source: sicp.ueba.su

Source: k4y0t.ru

Fraudsters are trying to make money amid the coronavirus pandemic and the fight against it. In particular, at the beginning of this week the number of spam mails allegedly on behalf of the World Health Organization (WHO) has increased. The letters speak of fundraising for COVID-19 Funds worldwide.

Specialists of the portal SICP.ueba.su analyzed one of these letters, which was sent from This email address is being protected from spambots. You need JavaScript enabled to view it.. It turned out that the second-level domain is actually used by WHO, but it was this letter that was sent from a mail server located in the state of Colorado in the United States of America and in transit passed through a reference mailer in the German municipality of Mauern.

Experts also learned that a link to a picture with a QR code (the address of a bitcoin wallet for donations) leads the reader directly to the portal of the investment company Five Stand Capital, located in the US city of Atlanta from Georgia. As follows from the official information on the company's website, it is a partner of large US investment funds in the United States. The portal itself is hosted by GoDaddy in Oregon (Portland). Still there are three site mirrors - for various domain zones.

This email was first sent from the SendGrid.net mail server, which is also located on GoDaddy’s resources in Colorado, Denver. And, judging by the information bases, another 13 resources are located on this IP address, nevertheless, only one of them is displayed - a web-based mail gateway.

It is important to consider that on the official website of the WHO there is no way to donate funds in the form of cryptocurrency - bitcoin. The same is true of their dedicated donation collection site. And there is even a warning that they do not send any letters.

Apparently, fraudsters are trying to cunningly take advantage of the global crisis situation, possessing a good knowledge of modern technology. Or maybe the owners of WHO decided to use all available tools to raise funds. And experts are wondering, where is the hosting site for WHO?

Interestingly, so far, no funds have been received to the cryptocurrency wallet, which is indicated in the letter of the scammers. The wallet is constantly monitored by SICP platform experts, however, like other malicious purses known to them.

Source: CryptoRussia.ru

On April 24, 2020, Russian President Vladimir Putin signed the Law “On an experiment to establish special regulation in order to create the necessary conditions for the development and implementation of artificial intelligence technologies in the subject of the Russian Federation - the city of federal significance Moscow and amending Articles 6 and 10 of the Federal Law” About personal data.

Essentially brief:

- from July 1, 2020, over 5 years, an experiment will be conducted in Moscow to establish special regulation in order to create the necessary conditions for the development and implementation of artificial intelligence technologies in Moscow, as well as the subsequent possible use of the results of the application of artificial intelligence in other regions. At the end of the term, regulatory documents issued for the purpose of the experiment are canceled;

- in the Law for the realization of its goals the concept of “artificial intelligence”, as well as “artificial intelligence technology” is given;

- in order to establish an experimental legal regime (hereinafter referred to as the ELR), the Moscow Government will determine, inter alia, cases of mandatory application and (or) consideration of the results of the use of artificial intelligence in the activities of the Moscow Government, as well as the procedure and cases of transfer by owners of funds and photo and video surveillance of images obtained in accordance with the conditions provided for in subparagraphs 1 and 2 of paragraph 1 of Article 1521 of the Civil Code of the Russian Federation, as well as providing access to such media cameras and photo and video surveillance systems to state authorities and organizations performing public functions in accordance with regulatory legal acts of the Russian Federation. The list of organizations performing public functions is established by the Moscow Government;

- when making transactions and other legally significant actions, an ELR participant will be obliged to notify persons who are not participants in the experimental legal regime of his status as an ELR participant and indicate the application of the Moscow Government adopted in accordance with the Law in relation to his regulatory acts. if the legally significant actions specified in this part are committed using the Internet information and telecommunication network, the participant in the experimental legal regime inform the user (party to the transaction) of all applicable provisions of regulatory legal acts of the Government of Moscow adopted in accordance with the Law in question

- requirements for agreements between ELR participants and the authorized body (it is appointed by the Moscow Government), should provide mechanisms to ensure the confidentiality of the transmitted data and the security of their storage.

- (!) Personal data obtained as a result of depersonalization and processed in accordance with paragraph 6 of part 1 of Article 4 of the relevant Law cannot be transferred to persons who are not parties to the ELR. In the event that the ELR participant status is lost or the experiment is terminated after its expiration, the person who is the ELR participant loses the right to receive personal data obtained as a result of depersonalization and personal data stored in the form The result of such depersonalization is subject to destruction in the manner established by the authorized body by agreement with the authorized federal executive body, carrying out functions for the development and implementation of state policy and regulatory regulation in the field of information technology.

- for the destruction of personal data obtained as a result of depersonalization, in the prescribed manner, the procedure for assessing the conformity of information protection means, which include the function of information destruction, is carried out. The participants of the ELR are responsible for observing the rights of the subjects of personal data in accordance with the Federal Law of July 27, 2006 No. 152-FZ “On Personal Data” for the entire duration of the experiment and after the termination of their participation in the experiment.

- during the experiment, it is not allowed to store personal data obtained as a result of depersonalization and processed on the basis of an agreement with the authorized body specified in paragraph 6 of part 1 of this article, outside the subject of the Russian Federation - the city of federal significance of Moscow.

- the status of an ELR participant is acquired from the moment it is included in the corresponding public register;

- the decision on inclusion or rejection is made by the authorized body (appointed by the Moscow Government) within a period of not more than thirty calendar days from the date of receipt of the application;

- The law provides requirements for the applicant, which, which can only be a legal entity or individual entrepreneur, registered in the territory of Moscow, as well as for the type of activity. The IP and the governing bodies of a legal entity have a requirement for the absence of an unexpunged or outstanding criminal record for crimes in the economic sphere, as well as for crimes of medium gravity, serious and especially serious crimes.

- the reasons for the refusal to be included in the register are prescribed in the Law (it seems to me quite common); in case of refusal to include in the register of ELR participants, the authorized body shall notify the applicant of this with a motivated justification for such a refusal.

- the reasons for the exclusion of the ELR participant from the register are also indicated, the exclusion is carried out within 10 working days.

- the formation of strategic directions and monitoring the activities of participants is planned to be entrusted to the ELR Coordination Council, which, on the proposal of the Government of the Russian Federation, includes representatives of federal executive bodies.

- Amendments to Article 6 and Article 10 of the Federal Law of 07.27.2006 No. 152-FZ "On Personal Data" in terms of processing conditions and in the processing of special personal data, respectively.