AXEL.org

Blog

The Empire Strikes Back Against Ransomware

The number of ransomware attacks increased by over 700% year-over-year for 2020[1]. While this may make the situation seem hopeless for businesses, two recent high-profile busts show that law enforcement agencies are taking notice and attempting to keep up with hackers.

Netwalker dark web sites seized

The Netwalker ransomware is one of the more prolific variants today. From March to August 2020, it pulled in over $25 million in ransoms from its victims[2]. The developers employ a Ransomware-as-a-Service (RaaS) model, where other hackers can gain access to the malicious toolset in return for a percentage of their illicit spoils. RaaS widens the net for developer groups, allowing their programs to infect networks they may never have been able to crack or had no time to try.

On January 27th, the U.S. Department of Justice, in league with the FBI and the Bulgarian National Investigation Service, seized Netwalker’s dark web sites[3].  The ‘Dark Web’ allows for anonymous internet browsing, so it is rife with hackers, drug traffickers, and other shady entities. The Netwalker group regularly posted news about ransoms and, starting in March 2020, affiliate requests. This was when the group moved from an in-house to a RaaS model.

The United States DoJ charged one such affiliate, Canadian national Sebastien Vachon-Desjardins, with conspiracy to commit computer and wire fraud[4]. Authorities claim the man has made $27.6 million from the scheme. The fact he is Canadian likely played a significant role in his indictment. Often, the perpetrators of these types of computer fraud reside in countries that do not extradite cybercriminals, such as Russia, making filing charges pointless. So, while this bust is very encouraging, there are undoubtedly other affiliates in the network who will not stop their activities. It will be interesting to see if the Netwalker group starts a new Dark Web site any time soon.

Netwalker’s victims

The University of California, San Francisco. In June 2020, the Netwalker ransomware infected networks at UCSF. While the university claimed it used mitigation techniques to isolate the malware and prevent its spread, it still encrypted ‘important’ academic work. This led to the school paying a $1.14 million ransom, down from the initial $3 million asking price[5]. Still quite an expensive experience!

Toll Group

In late January of 2020, the Australian shipping logistics company, Toll Group, suffered a massive Netwalker attack that affected over 1000 servers[6]. It got so bad that they had to suspend operations for days while they scrambled to assess and contain the issue. This led to unsatisfied customers and a tarnished reputation. In fact, over nine months after the incident, the company was still dealing with the aftermath[7]. It is unclear if the organization paid out anything.

Crozer-Keystone Health System

Sadly, hackers are pretty unscrupulous when it comes to selecting their targets. In June of 2020, a Philadelphia-based health center, the Crozer-Keystone Health System, was attacked. It’s unknown exactly how much data was encrypted, but the healthcare provider publicly announced they would not cooperate with the culprits and no ransom would be paid. This resulted in the Netwalker group offering the data it stole up for auction via the now-defunct Dark Web site mentioned earlier[8]. Details are scarce, but officials from Crozer-Keystone don’t believe the hackers gained access to any patient medical data.

Emotet botnet taken down

The other big news in the world of cybercrime is that a coalition of international government agencies joined forces to take down the dreaded Emotet botnet. Responsible for 30% of malware attacks[9], the Emotet botnet isn’t ransomware itself but lays the foundation for malicious agents to install it.

A botnet is a massive group of computers automated to carry out specific malicious tasks. In the case of Emotet, it sent out hundreds of thousands of phishing emails to unsuspecting people. The emails contained Microsoft Word documents that required the viewer to ‘Enable Macros.’ If the victims complied, a backdoor was installed, leaving their computers susceptible to all sorts of attacks, including dangerous ransomware.

On January 27th, the news broke that law enforcement agencies in the United States, Germany, Canada, France, the U.K., the Netherlands, Lithuania, and Ukraine, brought down the enormous botnet[10]. In even better news, on April 25th, the Emotet malware is scheduled to uninstall itself[11].

So, it’s nice to see some good news after months of successful hacks, ransomware attacks, and COVID-19 phishing. While hackers won’t stop because of these stories, it’s good to know that law enforcement agencies worldwide are stepping up and doing something about the problem.

Protect your data

These developments are heartening, but organizations and individuals can’t rely on the government to protect them from hackers. They must be proactive and use secure solutions whenever possible.

If you need to store and share files online, AXEL Go provides industry-leading privacy features that keep sensitive documents away from malicious agents. AXEL Go utilizes distributed, decentralized servers along with AES-256 bit encryption and file sharding to ensure your files stay safe. Sign up for our full-featured Basic account and receive 2GB of secure online storage and enough fuel for thousands of typical shares. If you are a business or power user, we have different options to fit all needs and budgets. It’s time to get serious about protecting your data before it’s too late.

 

[1] “Mid-Year Threat Landscape Report 2020”, Bitdefender, 2020, https://www.bitdefender.com/files/News/CaseStudies/study/366/Bitdefender-Mid-Year-Threat-Landscape-Report-2020.pdf

[2] Lawrence Abrams, “Netwalker ransomware earned $25 million in just five months”, Bleeping Computer, Aug. 3, 2020, https://www.bleepingcomputer.com/news/security/netwalker-ransomware-earned-25-million-in-just-five-months/

[3] Brian Krebs, “Arrest, Seizures Tied to Netwalker Ransomware”, Krebs on Security, Jan. 27, 2021, https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware/

[4] Kevin Collier, “Justice Department issues rare charges against ransomware operator”, NBC News, Jan. 27, 2021, https://www.nbcnews.com/tech/security/justice-department-issues-rare-charges-against-ransomware-operator-n1255899

[5] Lindsey O’Donnell, “UCSF Pays $1.14M Aftter NetWalker Ransomware Attack”, threatpost, June 30, 2021, https://threatpost.com/ucsf-pays-1-14m-after-netwalker-ransomware-attack/157015/

[6] Ry Crozier, “Toll Group tight-lipped on alleged ransomware attack”, itnews, Feb. 4, 2020, https://www.itnews.com.au/news/toll-group-tight-lipped-on-alleged-ransomware-attack-537437

[7] K&L Gates LLP, “Continuing to take its Toll: Toll Group still feeling impacts nine months after experiencing Ransomware Attack”, Lexology, Nov. 2, 2020, https://www.lexology.com/library/detail.aspx?g=002dc678-4d08-4782-88bb-1e4a9e188a7b

[8] Jackie Drees, “Ransomware group auctions Crozer-Keystone Health System data on darknet”, Beckers Hospital Review, June 22, 2020, https://www.beckershospitalreview.com/cybersecurity/ransomware-group-auctions-crozer-keystone-health-system-data-on-darknet.html

[9] Danny Palmer, “Emotet: The world’s most dangerous malware botnet was just disrupted by a major police operation”, ZDNet, Jan. 27, 2021, https://www.zdnet.com/article/emotet-worlds-most-dangerous-malware-botnet-disrupted-by-international-police-operation/

[10] “Emotet botnet taken down by international police sweoop”, BBC News, Jan. 27, 2021, https://www.bbc.com/news/technology-55826258

[11] Lawrence Abrams, “Europool: Emotet malware will uninstall itself on April 25th”, Bleeping Computer, Jan. 27, 2021, https://www.bleepingcomputer.com/news/security/europol-emotet-malware-will-uninstall-itself-on-april-25th/

Sharing user data with Facebook? WhatsApp with that?

Facebook-owned WhatsApp is receiving backlash for recent changes to its privacy policy. The topic has started an international conversation about the expectation of privacy and consumer data rights. We summarize the situation and how the fallout is pushing the discussion forward.

The application

WhatsApp is the most popular messaging application, with over 2 billion active monthly users[1]. After Facebook purchased it in February 2014, privacy advocates became rightfully concerned. At the time, WhatsApp assured users it would not allow data sharing between the two companies. However, two short years later, in 2016, WhatsApp modified its terms and conditions to enable data sharing[2]. There was a grace period for users to opt-out of the sharing, but that option has long since expired.

This concerning development was partially offset by WhatsApp’s implementation of end-to-end encryption for messages. End-to-end encryption means that only the intended recipient’s device can decrypt messages from the sender. No third party can read or mine your messages. Conceived in 2014, the feature didn’t receive full integration until 2016. Since then, privacy worries mostly dissipated even though their relationship with Facebook never changed. Until they released a privacy policy update in January 2021…

Breakdown of privacy policy changes

So, what nefarious language did WhatsApp include that triggered a backlash? If anything, it was minor updates to already-existing policies. We believe these policies should have drawn ire long before now, but better late than never. According to the policy, WhatsApp could already share the following information with Facebook[3]:

  • Phone numbers of both users and their contacts
  • Profile names and pictures
  • Metadata, including app logs, status messages (i.e., when a user last logged in), and diagnostics information.

The new policy only expands upon this specifically when communicating with businesses. Facebook now stores user chats with companies. They can also access any data within those chats[4]. Certainly not ideal, but perhaps the reaction wouldn’t be so severe had they not required users to accept the changes by February 2021 or face account deletion. The combination of scary words such as “data collection,” “sharing,” and “Facebook” was exacerbated by an equally-frightening ultimatum. It came across as a power play rather than an update. Needless to say, people were not happy.

Harsh backlash

This image has an empty alt attribute; its file name is fastCompanyHeadline-1024x374.pngThe backlash to the update was immediate. It became highly-publicized, with sensational headlines clogging up all of the internet’s many tubes.

 

Then, celebrities took to Twitter to promote privacy-based alternatives such as Signal.

 

This image has an empty alt attribute; its file name is independentHeadline-1024x460.pngThe hysteria around the policy announcement, along with the solicitation of alternatives from people such as Elon Musk, drove people to other encrypted messaging applications in droves. The open-source Signal app received the most significant boost. It is estimated that had at least 40 million new downloads within a week of the WhatsApp update.

Likewise, another private messaging client, Telegram, saw similar gains. In three days, they signed up 25 million new people for their service.

This image has an empty alt attribute; its file name is economicTimesHeadline-1024x374.pngThese substitute solutions are attractive due to their end-to-end encryption capabilities and the fact that Facebook, one of the biggest privacy offenders around, isn’t involved at all. Both companies have more transparent privacy policies and offer compelling products. Time will tell if the poached users migrate back to WhatsApp or if the trend continues.

Signal experiences difficulties

Gaining tens of millions of new users in for a bandwidth-intensive service is going to strain servers. While Telegram already had a massive user base and could withstand a short-term spike in usage, Signal had significant problems.

The Signal Foundation is a nonprofit organization that relies on private funding and donations from users. Interestingly enough, former WhatsApp co-founder, Brian Acton, is on Signal’s Board of Directors and remains one of its biggest funders[7]. Given its more “plucky underdog” status, it makes sense that the enormous increase in traffic caused issues. Within a week of its newfound popularity, the app experienced downtime and lost messages[8].

Consumers tend not to be sympathetic to poor user experiences. For the sake of all privacy apps, we hope that Signal can meet demand and deliver a great experience going forward. If people associate privacy-based alternative applications as “less than,” they’ll migrate back to the services they know.

WhatsApp combats misinformation

Undoubtedly feeling the heat, WhatsApp responded by clarifying the new policy and reassuring that they don’t share most data with Facebook[9]. To informed privacy advocates, this seems more like damage control than anything else. While this update didn’t have a significant amount of new information aside from the Businesses section, it shed light on an ongoing concern about how they share information with Facebook.

A new path forward

The WhatsApp controversy is encouraging. It shows that privacy issues can move the needle, demand mainstream media coverage, and cause tens of millions of people to switch to better solutions. In a time of corporate surveillance, government intrusion, and censorship, it’s nice to see everyday people begin to wake up. We hope this trend continues and the right to privacy becomes a  standard consideration for app developers and service providers.

AXEL believes in the users’ right to privacy and data custody. Our products embody this philosophy. Our blockchain-based, decentralized cloud storage and file-sharing platform, AXEL Go, lets you store or send files confidentially. We don’t sell your information to advertisers or mine your files for data. It offers AES 256-bit encryption to keep your documents away from any would-be spies. Try it out today and receive 2GB of free storage and enough of our AXEL Tokens to fuel thousands of typical shares. The future doesn’t have to be mass surveillance and constant data breaches. We’re providing a different path. Won’t you join us?

 

[1] J. Clement, “Number of monthly active WhatsApp users worldwide from April 2013 to March 2020”, statista, April 30, 2020, https://www.statista.com/statistics/260819/number-of-monthly-active-whatsapp-users/#:~:text=As%20of%20March%202020%2C%20WhatsApp,billion%20MAU%20in%20February%202016

[2] Natasha Lomas, “WhatsApp’s privacy U-turn on sharing data with Facebook draws more heat in Europe”, TechCrunch, Sept. 30, 2016, https://techcrunch.com/2016/09/30/whatsapps-privacy-u-turn-on-sharing-data-with-facebook-draws-more-heat-in-europe/

[3] “WhatsApp Privacy Policy”, WhatsApp.com, July 20, 2020, https://www.whatsapp.com/legal/privacy-policy?eea=0

[4] Andrew Griffin, “WHATSAPP NEW PRIVACY TERMS: WHAT DO NEW RULES REALLY MEAN FOR YOU?”, Independent, Jan. 9, 2021, https://www.independent.co.uk/life-style/gadgets-and-tech/whatsapp-new-privacy-terms-facebook-rules-explained-b1784469.html

[5] Saheli Roy Choudhury, “Indian ministry reportedly asked WhatsApp to drop privacy policy changes that sparked backlash”, CNBC, Jan. 19, 2021, https://www.cnbc.com/2021/01/20/india-has-reportedly-asked-whatsapp-to-withdraw-privacy-policy-update.html

[6] Tugce Ozsoy, Firat Kozok, “WhatsApp Dropped by Erdogan After Facebook Privacy Changes”,

[7] Andy Greenberg, “WhatsApp Co-Founder Puts $50M Into Signal To Supercharge Encrypted Messaging”, Wired, Feb. 2, 2018, https://www.wired.com/story/signal-foundation-whatsapp-brian-acton/

[8] Katie Canales, “Signal appears to be down for some users after the messaging app saw a record spike in downloads”,  Business Insider, Jan. 15, 2021, https://www.businessinsider.com/signal-app-down-users-report-messages-sending-problems-outage-2021-1

[9] “Answering your questions about WhatsApp’s Privacy Policy”, WhatsApp, Jan. 2021, https://faq.whatsapp.com/general/security-and-privacy/answering-your-questions-about-whatsapps-privacy-policy

The SolarWinds Beneath Hackers’ Wings

On December 13th, 2020, cybersecurity firm FireEye disclosed news of one of the most comprehensive cyber-espionage campaigns ever carried out against the United States and other global victims[1]. Since then, a significant amount of information has become public. Here, we summarize the attack, a few notable victims, and look into which hacking group could be responsible.

The infiltration

The attack happened due to an exploit in the Orion software from the company SolarWinds. The Orion Platform is an enterprise monitoring program that can manage and analyze information from traditionally separate IT domains, such as infrastructure, networking, and virtualization.

SUNSPOT

First, the hackers gained access to the SolarWinds Orion build environment. This means they could inject malware directly into the program’s source code before the company sent it to customers in the form of regular updates. It also meant they had to be sophisticated enough to conceal their tracks so that the developers didn’t notice anything out of the ordinary.

The malicious agents then used a new malware called SUNSPOT to install a backdoor into the Orion software[2].  Interestingly, the implantation of this malware required extensive knowledge of both Orion and Microsoft exploits. SUNSPOT works by monitoring the Microsoft operating system and searching for running processes involved with Orion source code compilation. It then injects the backdoor code (codename SUNBURST) into one of the Orion source files before the compiler runs and the software officially updates.

SUNBURST

After implantation, the SUNBURST backdoor has a dormancy period of approximately two weeks[3]. Disguised as a legitimate Orion plugin, the trojan payload connects to a third-party server, retrieves various commands, and executes them. These commands allow the plugin to take over the host computer completely. Now the group can:

  • Transfer files. Allows the hackers to retrieve files from the host computer as well as send more infected payloads.
  • Execute files. Allows hackers to install more malware onto the compromised systems.
  • Profile the system. Searches for more vulnerabilities and maps the network’s layout.
  • Reboot the machine. Hackers can reboot systems after malware installations.
  • Disable system services. This makes it easier to conceal activities since monitoring programs and antivirus software can be shutdown.

Analysts continue to find new malware installed by the SolarWinds hackers as they spend more time studying the breach.

The compromised

SolarWinds had over 300,000 customers. That includes 425 FORTUNE 500 companies and all five branches of the United States government[4]. While it’s unlikely the hackers actively infiltrated every organization using the software, the company believes that up to 18,000 of them using their Orion Platform could have malware installed. Full breaches did occur to many high-profile targets. Here is an abbreviated list of victims:

Microsoft

As we’ve seen, the hackers had a deep understanding of Microsoft cloud software. In fact, Microsoft representatives had to admit that the malicious agents viewed their product’s proprietary source code[5]. Although the intruders could not alter any of the code, even viewing it is a significant incident. Large tech corporations such as Microsoft keep their source code under serious security. Their intellectual property is the lifeblood of their businesses, so it goes to show how deep the hackers were in their systems.

FireEye

FireEye is one of the largest, most-respected cybersecurity firms in the world. They initially found the attack, but only because the company itself fell victim. The hackers accessed FireEye’s internal systems and stole security testing tools, but the company insists no customer data was compromised[6]. Regardless, it’s interesting that an organization whose entire business is protecting others from hackers got hacked.

Administrative Office of the U.S. Courts

Federal agencies seem to be the main targets of the perpetrators behind the hack.  The Administrative Office of the U.S. Courts has publicly confirmed being affected by the incident[7]. This is troubling because officials claim the threat actors compromised an electronic document filing system used by the Federal Judiciary. So, highly-sensitive federal court documents have been accessible to hackers since the Spring of 2020!

Department of Energy

A representative for the department confirmed that the SolarWinds malware infected systems within the Department of Energy and the National Nuclear Security Administration. Now that sounds serious! Fortunately, it does not appear that the hackers accessed networks pertaining to national security. On December 18th, DOE spokesperson Shaylyn Hynes said, “At this point, the investigation has found that the malware has been isolated to business networks only..[8]” and there have not been any updates since.

Department of Justice

The U.S. DOJ didn’t get off as easily as others. Here, the hackers moved through their network and accessed the email accounts of thousands of employees[9]. According to a DOJ spokesman, it “only” amounted to approximately 3% of the workforce, and the culprits did not breach any classified information. However, that still means over 3,000 people had their accounts infiltrated.

This is only 5 of the over 250 organizations listed by Bleeping Computer confirmed to be affected[10]. There are hundreds more, including The United States Treasury, The Department of Homeland Security, the United States Department of State, The Department of Health’s National Institutes of Health, Cisco, VMWare, Intel, and so on. It is undoubtedly the most comprehensive and dangerous hack ever known.

The perpetrators

Immediately after FireEye disclosed the attack to the public, Reuters reported that state-sponsored Russian hackers were thought to be behind it[11].  On December 14th -one day after the initial disclosure- the Washington Post went as far as to attribute it specifically to the Russian Advanced Persistent Threat group (APT), Cozy Bear[12]. Typically, the digital forensics necessary to pinpoint attribution of an attack take weeks or months, and many times it is never certain. Dedicated cybersecurity websites such as FireEye have not given direct attribution, showing the gulf of technical knowledge between the mainstream media and those with more experience. Given the geopolitical implications (U.S. politicians immediately began saber-rattling and calling the intrusion an “act of war”[13]), news outlets should wait for more facts to come out before running with the most inflammatory stories possible.

The evidence

So, what are the facts? At the moment, they’re pretty scarce. A joint statement by the FBI, CISA, NSA, and The Office of the Director of National Intelligence says that is “likely” to blame for the massive attack[14]. President Trump says [15]. Neither offer much evidence to back their claims.

The only evidence made public tying any specific group to the incident was recently published by the cybersecurity firm Kaspersky. Their researchers found code overlap between SUNBURST and the malware Kazuar[16]. The Russian-speaking hacker group Turla (note: NOT Cozy Bear) uses Kazuar. They don’t go so far as to provide any degree of certainty for the link, however. There are other potential explanations for the similarities.

The alternative explanations

The SolarWinds hackers may have purchased the Kazuar malware tools. Or, more insidiously, the perps could have purposefully inserted code to make it appear as if it were a Russian operation to conceal its true origin. That may seem too much like a Hollywood movie, but consider the tremendous technical lengths to which the hackers went to stay hidden. Adding another layer of covertness isn’t so far-fetched.

And, there is recent precedent for such tactics. In 2018, the threat actors behind the PyeongChang Olympics attack planted “false flags” within their code to obfuscate the source[17]. The Turla group itself employed deceitful methods in 2019 to pin their activities on Iran[18]. So, if Turla is capable of this, and the SolarWinds attack itself was so sophisticated and obscured, why would they leave such a calling card in their code?

This is not to claim that this attack is definitely not of Russian origin. Indeed, they have the motive and the capabilities. But, we should acknowledge that it is very uncertain at the moment. Kaspersky, FireEye, Crowdstrike, and others have gone out of their way not to blame any particular threat actor with any confidence. The mainstream media should follow suit. Let the forensic investigations continue and see where the evidence leads. At the moment, it points toward Russia, but not conclusively.

Data protection

If enormous breaches like this teach us anything, it’s that your data needs to be protected. Secure your data at rest and in motion with AXEL Go. AXEL Go is a file-sharing and storage platform that offers industry-leading security features. Utilizing technology such as blockchain, the InterPlanetary File System (IPFS), and AES 256 encryption, you can keep your sensitive documents safe from any would-be data thieves.

Sign up for our Basic, full-featured AXEL Go account and receive 2GB of free online storage and plenty of AXEL Tokens to fuel thousands of typical shares. You don’t have to live in fear of when the next breach will happen. You can secure your files with AXEL Go.

 

[1] “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor”, FireEye, Dec. 13, 2020, https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

[2] “CrowdStrike Intelligence Team”, “SUNSPOT: An Implant in the Build Process”, CrowdStrike, Jan. 11, 2021, https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/

[3] “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor”, FireEye, Dec. 13, 2020, https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

[4] Gopal Ratnam, “SolarWinds Hack Recovery May Cost Upward of $100B”, Government Technology, Jan. 12, 2021, https://www.govtech.com/security/SolarWinds-Hack-Recovery-May-Cost-Upward-of-100B.html

[5] Maggie Miller, “Microsoft says hackers viewed source code as part of SolarWinds attack”, MSN, Dec. 31, 2020, https://www.msn.com/en-us/news/politics/microsoft-says-hackers-viewed-source-code-as-part-of-solarwinds-attack/ar-BB1co3VF

[6] Mike Lennon, “FireEye Says ‘Sophisticated’ Hacker Stole Red Team Tools”, Security Week, Dec. 8, 2020, https://www.securityweek.com/fireeye-says-sophisticated-hacker-stole-red-team-tools

[7] Dustin Volz, Robert McMillan, “Federal Judiciary’s Systems Likely Breached in SolarWinds Hack”, The Wall Street Journal, Jan. 7, 2021, https://www.wsj.com/articles/federal-judiciarys-systems-likely-breached-in-solarwinds-hack-11610040175

[8] “DOE Update on Cyber Incident Related to Solar Winds Compromise”, Energy.gov, Dec. 18, 2020, https://www.energy.gov/articles/doe-update-cyber-incident-related-solar-winds-compromise

[9] Catalin Cimpanu, “SolarWinds fallout: DOJ says ahckers accessed its Microsoft O365 email server”, ZDNet, Jan. 6, 2021, https://www.zdnet.com/article/solarwinds-fallout-doj-says-hackers-accessed-its-microsoft-o365-email-server/

[10] Sergiu Gatlan, “SolarWinds victims revealed after cracking the Sunburst malware DGA”, Bleeping Computer, Dec. 22, 2020, https://www.bleepingcomputer.com/news/security/solarwinds-victims-revealed-after-cracking-the-sunburst-malware-dga/

[11] Raphael Satter, “IT company SolarWinds says it may have been hit in ‘highly sophisticated’ hack”, Reuters, Dec. 13, 2020, https://www.reuters.com/article/us-usa-solarwinds-cyber/it-company-solarwinds-says-it-may-have-been-hit-in-highly-sophisticated-hack-idUSKBN28N0Y7

[12] Ellen Nakashima, Craig Timberg, “Russian government hackers are behind a broad espionage campaign that has compromised U.S. agencies, including Treasury and Commerce”, The Washington Post, Dec. 14, 2020, https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html

[13] Maggie Miller, “Lawmakers ask whether massive hack amounted to act of war”, The Hill, Dec. 18, 2020, https://thehill.com/policy/cybersecurity/530784-lawmakers-ask-whether-massive-hack-amounted-to-act-of-war

[14] “JOINT STATEMENT BY THE FEDERAL BUREAU OF INVESTIGATION (FBI), THE CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY (CISA), THE OFFICE OF THE DIRECTOR OF NATIONAL INTELLIGENCE (ODNI), AND THE NATIONAL SECURITY AGENCY (NSA)”, CISA.gov, Jan. 5, 2021, https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure

[15] Justin Sink, “Faced with massive suspected Russian cyber-attack on the U.S. government, Trump blames China”, Fortune, Dec. 21, 2020, https://fortune.com/2020/12/21/faced-with-massive-suspected-russian-cyber-attack-on-the-u-s-government-trump-blames-china/

[16] Tara Seals, “SolarWinds Hack Potentially Linked to Turla APT”, threat post, Jan. 11, 2021, https://threatpost.com/solarwinds-hack-linked-turla-apt/162918/

[17] Tom Spring, “Olympic Destroyer: A False Flag Confusion Bomb, threat post, March 8, 2018, https://threatpost.com/olympic-destroyer-a-false-flag-confusion-bomb/130262/

[18] Oscar Williams, “Russia’s Turla hackers used Iranian cyber weapons to “mask identity”, says NCSC”, NS Tech, Oct. 21, 2019, https://tech.newstatesman.com/security/russia-turla-iran-ncsc

China Hacks the Planet – Part II

Part I of our series on China’s state-sponsored hackers summarized the motivations, methods, and underlying structure of their cyber divisions. In Part II, we delve into some of China’s well-known Advanced Persistent Threat (APT) groups and their high-profile attacks.

APTs

China employs (or has employed) dozens of APT groups over the past decade. They’re so prolific, to cover them all would be outside the scope of this blog. However, here are a few noteworthy examples:

APT 1

As one could guess from its name, APT 1 was the first Advanced Persistent Threat group ever named. The group began operations in 2006 (a year before Apple released the first iPhone). Part of the People’s Liberation Army (PLA) Unit 61398, they were linked directly to the communist government of China. In fact, according to an in-depth report on APT 1 by the cybersecurity firm Mandiant, they received fiber-optic infrastructure provided by a state-owned corporation under the auspices of national defense[1]. This was no two-Yuan hacking unit. Hundreds of hackers worked in the group from 2006-2014.

The majority of their attacks targeted the United States. They stole sensitive information from the country’s IT, aerospace, and engineering sectors, among many others. Using advanced techniques, they infected networks, pilfered data, and left with only small traces of evidence they were ever there. Specialists in phishing, APT 1 hackers disguised .exe and zip files as common Adobe PDF files to avoid suspicion.

High-profile APT 1 attacks

  • The first known attack attributed to the group was against a Japanese wing of the cybersecurity company Symantec. It was unknown at the time, but in 2012 new outlets reported the hackers stole the source code to the Norton antivirus software[2]. With the source code, APT 1 had what they needed to find all the program’s vulnerabilities and exploit them as necessary.
  • In 2012, APT 1 infiltrated Telvent’s network. Telvent was a multinational energy company with operations in the United States, Canada, and Europe[3]. This fits the group’s modus operandi of targeting infrastructure-related organizations. It served as a great way to spy on other country’s energy grids and allowed China to steal proprietary smart grid technology.
  • One of the most interesting cases is the 2011 hacks by the group Anonymous. Anonymous is a famous hacker gang that rose to prominence by carrying out DDoS attacks against the Church of Scientology in 2008. In 2011, the Guy Fawkes mask-donning hacktivists attacked the cybersecurity firm HBGary Federal in retaliation for its investigations into the group. Strangely, the Mandiant report linked above ties APT 1 to these hacks[4]. Is China a significant part of Anonymous? It seems possible.

APT 1 was extremely prolific, with hundreds if not thousands of victims over its active years. After the aforementioned Mandiant report released, the group slunk back into the cyber shadows. Analysts believe it broke up, and its assets distributed to other, more contemporary hacker groups.

In 2018, malware code associated with APT 1 resurfaced in an attack[5]. Most cybersecurity experts do not believe it was the old hacker gang, however. Most likely, a different Chinese APT group used the old code after APT 1 disbanded.

Mustang Panda

Coincidentally, 2014 wasn’t only the year APT 1 went silent; it’s also when Mustang Panda became active. They weren’t noticed until three years later when the cybersecurity firm, Crowdstrike, observed them targeting a U.S. think tank[6].

At first, they mostly set their sights on international non-governmental organizations and targets within the Mongolian government. They soon moved on to bigger fish, however. Recently cybersecurity professionals deemed them responsible for two major incidents.

Coronavirus-based Phishing

The global COVID-19 pandemic provided hacker groups such as Mustang Panda the opportunity to phish unsuspecting victims. While unfortunate, it has proven to be an effective tactic. By using emails with malware attachments and links related to the coronavirus, people are more likely to open them. Mustang Panda is targeting Taiwan and Vietnam specifically with fake emails intended to lure victims wanting information about the pandemic.

The Vatican gets attacked

Unapproved religions are not looked at kindly by the Chinese government. The Catholic Church cut off diplomatic ties with China in 1951, and only recently are the frosty relations beginning to thaw. While dialogue between the Holy See and Chinese officials has started, Mustang Panda recently hacked Vatican officials to gather intel about the Church’s intentions[7]. Not exactly establishing new relationships built on trust.

APT 41

APT 41 is well-known for targeting video game companies in their attacks. Active since at least 2012, they differ from other Chinese hacking groups in that they use custom malware tools typically reserved for espionage for financially-motivated attacks[8]. For example, in 2014, they hacked the Southeast Asian distributor of video games such as League of Legends, FIFA Online, and Path of Exile. They infiltrated their production environments and inserted malware to accumulate millions of dollars in virtual currency. Then, they used money laundering techniques to cash out. Besides video game companies, they also target healthcare, pharmaceuticals, retail, telecoms, education, and other related sectors.

In September of 2020, the United States Department of Justice charged five Chinese citizens affiliated with APT 41 with multiple felonies[9]. They are still at large and are now and thought to be in China.

The tip of the iceberg

There are many more Chinese APT groups out there worth mentioning. There may even be more hacker codename Panda groups than actual pandas in the wild! It’s got to be close. China has the most resources and money out of any of the big state-sponsored hacking institutions. With the amount of success they’ve had, they probably won’t be stopping their activities any time soon. That’s why companies and government organizations worldwide need to be aware of their systems’ dangers and vulnerabilities. Investment in robust cybersecurity protections needs to be standard, not a secondary priority. Protect your data. Protect your company.

Securing data in motion and at rest

AXEL specializes in providing file transfer and storage solutions that prioritize security. Our platform, AXEL Go, utilizes blockchain technology, the InterPlanetary File System (IPFS), and password encryption to keep your important files safe and out of the reach of hacker groups. You can sign up for a free, full-featured Basic account and try it out with 2GB of storage and enough AXEL Tokens to fuel thousands of ordinary shares. Those needing more storage can pay for one of our reasonably-priced premium plans. Stop putting your organization’s sensitive information at risk and use AXEL Go.

 

 

[1] “APT 1 Exposing One of China’s Cyber Espionage Units”, FireEye, 2014, https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf

[2] Jim Finkle, “Symantec Hack: Company Admits Hackers stole Norton Source Code in 2006”, The Huffington Post, Jan. 17, 2020, https://www.huffpost.com/entry/symantec-hack-norton-source-code_n_1211043

[3] Brian Krebs, “Chinese Hackers Blamed for Intrusion at Energy Industry Giant Telvent”, Krebs on Security, Dec. 26, 2012, https://krebsonsecurity.com/2012/09/chinese-hackers-blamed-for-intrusion-at-energy-industry-giant-telvent/

[4] Pierluigi Paganini, “Mandiant report links Anonymous 2011 hacks to APT1 campaign”, Security Affairs, Feb. 22, 2013, https://securityaffairs.co/wordpress/12525/hacking/mandiant-report-links-anonymous-2011-hacks-to-apt1-campaign.html

[5] Brian Barrett, “The Mysterious Return of Years-Old Chinese Malware”, Wired, Oct. 10, 2018, https://webcache.googleusercontent.com/search?q=cache:axHpd0d7GZMJ:https://www.wired.com/story/mysterious-return-of-years-old-chinese-malware-apt1/+&cd=1&hl=en&ct=clnk&gl=us

[6] “Threat Group Cards: A Threat Actor Encyclopedia”, Thailand Computer Emergency Response Team, https://apt.thaicert.or.th/cgi-bin/showcard.cgi?g=Mustang%20Panda%2C%20Bronze%20President&n=1

[7] Shannon Vavra, “Suspected Chinese hackers impersonate Catholic news outlets to gather intel about Vatican diplomacy”, cyberscoop, Nov. 23, 2020, https://www.cyberscoop.com/chinese-hacking-catholic-church-vatican/

[8] “APT41, a dual espionage and cyber crime operation”, FireEye, https://content.fireeye.com/apt-41/rpt-apt41/

[9] Catalin Cimpanu, “US charges five hackers from Chinese state-sponsored group APT41”, ZDNet, Sept. 16, 2020, https://www.zdnet.com/article/us-charges-five-hackers-part-of-chinese-state-sponsored-group-apt41/

China Hacks the Planet – Part I

China has modernized and become extremely competitive on the world stage over the page half-century. As the most populous country continues to dominate many global manufacturing sectors, the Chinese Communist Party grows eager to become a legitimate superpower. Here, we look into the CPP’s aspirations and current cyber activities to see how they intend to achieve such status.

A transition of power?

Historically, up-and-coming nations attained superpower designation through winning wars. However, the proliferation of nuclear weapons and the Mutually Assured Destruction doctrine take this path off the table. So, China must engage in different tactics, such as cyber warfare. Military officials and security experts believe the globe is already at war in cyberspace[1]. As the battlefield expands, China represents the largest threat to the United States and other Western democracies. They operate more known Advanced Persistent Threat groups than the next top three (Russia, Iran, and North Korea) combined[2].

Methods for progress

Although China’s military spending ranks 2nd in the world, it still pales compared to the United States  (as of 2019, $261 billion vs. over $730 billion[3]). Knowing it can’t compete on sheer military might, China employs “asymmetric” warfare tactics that include powerful cyber attacks. To support the IT infrastructure necessary for this, China has implemented strategies to spur greater tech capabilities.

Bridging the tech gap

In 2013, officials enacted the ‘Made in China’ plan. This comprehensive policy set ambitious goals to improve China’s tech manufacturing capacity and foster domestic innovation. According to the program, China wanted to produce 40% of their own mobile phone chips, 70% of the nation’s industrial robots, and 80% of their renewable energy equipment domestically by 2025[4].  A portion of the engineering and production gaps have closed due to legal initiatives such as[5]:

  • Encouraging joint ventures between Chinese and Western companies to facilitate knowledge transfer.
  • Promoting the education of Chinese students abroad at highly-advanced tech research universities.
  • Allowing and partaking in direct foreign investment projects.
  • Recruiting skilled foreign talent for domestic companies.
  • Utilizing open-source information to catalog and analyze global technology innovation.

Unfortunately, China doesn’t use legal means exclusively. Malicious activities also fuel their aggressive agenda.

Espionage and IP theft

China differs from other state actors in that the number one priority is usually espionage and Intellectual Property theft. In fact, over 80% of international cases involving economic espionage involve China[6]. It is a driving force behind the country’s rapid technological evolution.

According to the director of the National Counterintelligence and Security Center, William Evanina, IP theft costs the United States up to $600 billion a year[7]. That’s nearly 3% of the most prosperous nation’s total GDP!

This results in a two-pronged effect that simultaneously strengthens China and weakens the United States. Chinese hackers infiltrate U.S. networks, steal IP and trade secrets, form business operations in China’s domestic market using the IP, then disrupt global markets by undercutting United States’ companies. This brazen activity led to FBI Director Christopher Wray’s assertion that “no country poses a greater threat [to the United States] than Communist China.[8]“

For its part, Beijing continues to claim its commitment to cracking down on IP theft[9]. So far, this purported dedication is questionable at best. According to a 2019 CNBC CFO survey, over 20% of organizations had IP stolen by China within the past year[10].  Seeing as the percentage only increased to 31% in the past decade, you can make the argument that the theft frequency is increasing.

Structure

The scope of China’s cyber Army is rather massive. The most recent report in 2016 estimated China employs over 30,000 military hackers and up to 150,000 “private” cyberspies[11]. Given the communist nature of the country’s government, the term “private” is nebulous and blends confusingly into their official government-backed activities. During Congressional testimony in 2018[12], a senior researcher at The Heritage Foundation, Dean Cheng, defined three distinct categories under which China’s cyber forces fall.

Specialized military units

There are units within the People’s Liberation Army (China’s armed regular armed forces) that deal in cyber warfare. These are highly trained professionals that carry out strategic missions throughout the globe. The most publicized of these groups are Unit 61398 (APT1) and Unit 61486 (APT2). In Part II of our blog series on Chinese threat actors, we’ll go into more detail about these groups and their high-profile attacks.

Specialist units with military permission

These units aren’t permanent fixtures within the Chinese military. The hackers may be local province cybersecurity experts called to duty within a military region or war zone for tactical purposes. Typically, they are put into action by officials from the state intelligence agency (Ministry of State Security) or the state police force (Ministry of Public Security).

Civilians

These are voluntary participants who can be mobilized to conduct network operations that further China’s goals. Examples include corporate espionage or ransomware deployments. Such activities can provide crucial IP information or illicit funding to military groups. Though not affiliated with the military under normal circumstances, the CCP has an official “Military-Civil Fusion” policy[13]. This strategy blurs the lines and renders distinctions between the two classes nearly moot.

When active, these all work within the People’s Liberation Army, under the SSF (Strategic Support Force). The SSF, established in 2015, is China’s overarching military unit that oversees space, cyber, and electronic warfare strategy and implementation.

Just the beginning

Hopefully, our brief overview has provided a better understanding of China’s emphasis on cyberwarfare and its importance to their geopolitical endeavors. It is a serious matter that democratic governments need to address soon. In Part II, we’ll delve into some of the various threat groups operating in the country and detail their known hacking campaigns. You’ll see exactly what kind of damage they can inflict.

 

 

[1] Zak Doffman. “Cyber Warfare: U.S. Military Admits Immediate Danger Is ‘Keeping Us Up At Night’, Forbes, Jul. 21, 2019, https://www.forbes.com/sites/zakdoffman/2019/07/21/cyber-warfare-u-s-military-admits-immediate-danger-is-keeping-us-up-at-night/?sh=7dc846411061

[2] Naushad K. Cherrayil, “Chinese-speaking hackers increase activity and diversify cyberattack methods”, Tech Radar, Aug. 5, 2020, https://www.techradar.com/news/chinese-speaking-hackers-increase-activity-and-diversify-cyberattack-methods

[3] The 15 countries with the highest military spending worldwide in 2019, Statista, Dec. 1, 2020, https://www.statista.com/statistics/262742/countries-with-the-highest-military-spending/

[4] Jost Wubbeke, Mirjam Meissner, Max J. Zenglein, Jacqueline Ives, Bjorn Conrad, “Made In China 2025: The making of a high-tech superpower and consequences for industrial countries”, Merics, Dec. 2016, https://merics.org/sites/default/files/2020-04/Made%20in%20China%202025.pdf

[5] Michael Brown, Pavneet Singh, “China’s Technology Transfer Strategy: How Chinese Investments in Emerging Technology Enable A Strategic Competitor to Access the Crown Jewels of U.S. Innovation”, Defense Innovation Unit Experimental, Jan. 2018, https://admin.govexec.com/media/diux_chinatechnologytransferstudy_jan_2018_(1).pdf

[6] David H. Laufman, Joseph M. Casino, Michael J. Kasdan, “The Department of Justice’s National Security Division Chief Addresses China’s Campaign to Steal US. Intellectual Property”, The National Law Review, Aug. 24, 2020, https://www.natlawreview.com/article/department-justice-s-national-security-division-chief-addresses-china-s-campaign-to

[7] “China theft of technology is biggest law enforcement threat to US, FBI says”, The Guardian, Feb. 2020, https://www.theguardian.com/world/2020/feb/06/china-technology-theft-fbi-biggest-threat

[8] “China theft of technology is biggest law enforcement threat to US, FBI says”, The Guardian, Feb. 2020, https://www.theguardian.com/world/2020/feb/06/china-technology-theft-fbi-biggest-threat

[9] Joe McDonald, “China announces trade secrets crackdown to assure investors”, AP News, Sept. 20, 2017, https://apnews.com/article/e7e6d8cf62d94542b2554c1f6c56f8f6

[10] Eric Rosenbaum, “1 in 5 corporations say China has stolen their IP within the last year: CNBC CFO survey”, CNBC, Mar. 1, 2019, https://www.cnbc.com/2019/02/28/1-in-5-companies-say-china-stole-their-ip-within-the-last-year-cnbc.html#:~:text=01%2C%202018.&text=There%20are%20no%20exact%20statistics,U.S.%20economy%20from%20these%20actions.

[11] Michelle Van Cleave, “Chinese Intelligence Operations and Implications for U.S. National Security”, U.S.-China Economic and Security Review Commission, June 9, 2020, https://www.uscc.gov/sites/default/files/Michelle%20Van%20Cleave_Written%20Testimony060916.pdf

[12] Dean Cheng, “China’s S&T and Innovation Efforts”, Congressional testimony, Jan. 9, 2020, https://docs.house.gov/meetings/AS/AS26/20180109/106756/HHRG-115-AS26-Wstate-ChengD-20180109.pdf

[13] “The Chinese Communist Party’s Military-Civil Fusion Policy”, The U.S. Department of State,

Iran’s State-Sponsored Hackers Continue to Wage Cyber War

Iran’s government-affiliated hacking groups are among the most prolific in the world. While not considered the most sophisticated attackers, they are still a formidable foe for enemies in the Middle East, Europe, and North America.

Backed by the despotic regime

Intelligence indicates many of Iran’s hacker divisions are part of the Islamic Revolutionary Guard Corps (IRGC). The IRGC is responsible for quelling internal political strife and has an unsavory reputation for violently suppressing protests against the current regime[1]. The Corps initially introduced hacker groups to spy on citizen dissidents, but their responsibilities soon grew. Today, they still perform domestic monitoring activities but also engage in global cybercrime efforts, including international espionage and ransomware deployment.

Subfactions galore

Most state-sanctioned hacking enterprises form subgroups within the overarching military or political hierarchy. Iran is no different, employing at least half a dozen Advanced Persistent Threat (APT) groups. Analysts believe some APTs are independent entities with sworn allegiance to Ali Khamenei, the Supreme Leader, while the state directly operates other units.

Known APTs

Fox Kitten

Fox Kitten, aka Pioneer Kitten, aka Parisite, is a well-known APT thought to be under government contract rather than explicit control.  Actors associated with the group recently put hacked corporate intelligence data for sale on the dark web[2]. This suggests Iran isn’t officially operating Fox Kitten, as the government would likely prioritize keeping the intelligence secret over a relatively small payment.

Fox Kitten uses freely-available open-source tools to exploit vulnerabilities in Virtual Private Network (VPN) and Remote Desktop Protocol (RDP) software. Once they gain access to a system, they utilize SSH Tunnelling procedures to encrypt communication with implanted programs and prevent detection. Thus, Fox Kitten can control infected computers remotely to steal vast amounts of sensitive data.

They typically focus on high-value targets in the tech, defense, healthcare, engineering, government, and financial sectors. The bulk of attacks is against organizations in North America and Israel, which offers another clue as to their origins.

Charming Kitten

Charming Kitten, aka Phosphorus, aka Newscaster, is an APT that has been active since 2014[3]. The group is most known for two highly-publicized events.

  • They are the group linked to United States defector Monica Witt. Witt is a former U.S. Air Force intelligence agent who renounced the United States, defected to Iran in 2013, and provided their government with classified intel[4]. She is now working with Charming Kitten to target susceptible military personnel for further espionage.
  • A hacker now understood to be affiliated with Charming Kitten was responsible for the 2017 HBO hack[5]. This was a famous incident where the script for a future’ Game of Thrones’ episode leaked, spoiling it for fans everywhere. Not exactly state secrets, but an embarrassing situation nonetheless. In a strange turn, the United States Department of Justice contends that both Witt and the HBO hacker work closely together at the moment.

Charming Kitten uses phishing techniques to impersonate trustworthy entities. They mainly target journalists, activists, academics, and government institutions with their deceptive campaigns. The hackers steal their victims’ account information while analyzing their contacts.

Rocket Kitten

Rocket Kitten (what’s with these cute codenames?), aka TEMP.Beanie, aka Timberworm, is a state-operated APT that focuses on espionage against Iran’s Middle Eastern enemies and internal opposition.  According to research by the cybersecurity firm Checkpoint, nearly 50% of its activity centers around Saudi Arabia[6].

The group favors spear phishing and social engineering to compromise their victims. They are noted to be unrelenting in their attacks once they set an objective. This means that even though their methods aren’t very advanced, their overall success rate is high. It only takes one employee off their game for a day to open up a vulnerability in a network.

Rocket Kitten’s most recognized achievement came in 2016 when they successfully hacked Telegram, the popular private messaging client[7]. Private communication is something very valuable in countries without free speech like Iran. Rocket Kitten exploited an account activation policy to gain access to over 20 million Iranian Telegram accounts. It undoubtedly led to a crackdown on anti-government speech.

Needless to say, these kittens have claws! There are even more APTs from Iran, and you can read a brief overview of them here.

2020 incidents

If you only read about the most publicized Iranian cyberattacks, you might think they’ve slowed down recently. In reality, 2020 was a banner year for them! Even if they didn’t grab the world’s attention at large, there were still plenty of interesting developments.

August 2020:

In August, the FBI released a statement claiming Fox Kitten uses known exploits to breach networks worldwide before the organizations can patch the vulnerabilities[8]. This means the hackers don’t even have to probe for unknown (or 0-day) exploits. They simply wait until cybersecurity professionals disclose weaknesses and move quickly to strike high-priority targets. According to the FBI, Iran breached two major companies in 2020 by using these methods. Unfortunately, the agency was not able to disclose the names of the organizations.

September 2020:

 The United States Department of Justice officially indicted three state-sponsored Iranian hackers for a series of attacks on American satellite companies[9]. It is uncertain which APT the alleged culprits belonged to, but they know at least one of them is a member of the IRGC. Posing as employees of the organization they wished to attack, they bombarded legitimate employees with emails and deceived them into clicking on infected attachments. Again, the U.S. government didn’t disclose any specific breached organizations but did say the hackers made off with intellectual property from multiple companies located in the U.S. and abroad.

October 2020:

In late October, Charming Kitten showed that Iran’s cyberwarfare division has a strong sense of irony (Iran-y?)  by attacking attendees of the upcoming Munich Security Conference[10]. They used fake emails and websites made to look like official communications from conference representatives to steal credentials and personal information. Many diplomats and attendees fell for the ruse and exposed their information to Iran’s government. Who needs a security conference when Iran is educating officials for free?

Data protection

It may not be something you think about daily, but it’s an undeniable fact we’re in a global war. It’s just a cyberwar rather than traditional aggression. The participants have replaced tanks and aircraft with computers and cellphones. This seemingly unending conflict plays out just beneath the surface of society. Civilians rarely notice, but those enlightened with the truth can see the consequences everywhere.

Malicious, state-sponsored actors battle against each other to steal secrets and confidential data from their enemies. In the case of Iran, their APTs don’t even use sophisticated techniques[11].

Most of their operations utilize open-source or publically-available software. They crack VPN and RDP programs with brute force password guessing. Their ransomware deployments are non-proprietary Ransomware-as-a-Service (RaaS) frameworks purchased from more competent groups.

In comparison to hackers in China or Russia, Iran is downright second-rate. Yet, they’re still thriving. This fact alone should be eye-opening to people and organizations around the world. It’s time to get serious about securing your data.

AXEL’s commitment

AXEL is dedicated to providing industry-leading data sharing and storage solutions. Our platform, AXEL Go, combines three state-of-the-art technologies to ensure your files are stored and shared securely. Utilizing blockchain technology, the InterPlanetary File System (IPFS), and encryption, you can finally have peace of mind that your files are private and safe. We have options for all types of users, whether for personal or enterprise roles. Download AXEL Go today for free. Our basic tier has 2GB of online storage and enough network fuel for thousands of typical shares. In the age of cyberwarfare, you need the best tools possible to protect yourself and your organization. Don’t settle for less.

 

[1] Yaghoub Fazeli, “Soleimani directly involved in suppressing Iran protests: Former IRGC General”, Al Arabiya English, Feb. 10, 2020, https://english.alarabiya.net/en/News/middle-east/2020/02/10/Soleimani-directly-involved-in-suppressing-Iran-protests-Former-IRGC-General

[2] Catalin Cimpanu, “Iranian hackers are selling access to compromised companies on an underground forum”, ZDNet, Sept. 1, 2020, https://www.zdnet.com/article/iranian-hackers-are-selling-access-to-compromised-companies-on-an-underground-forum/

[3] “Charming Kitten”, Mitre, Jan. 16, 2018 , https://attack.mitre.org/groups/G0058/

[4] “Former U.S. Counterintelligence Agent Charged With Espionage on Behalf of Iran; Four Iranians Charged with a Cyber Campaign Targeting Her Former Colleagues”, The United States Department of Justice, Feb. 13, 2019, https://www.justice.gov/opa/pr/former-us-counterintelligence-agent-charged-espionage-behalf-iran-four-iranians-charged-cyber

[5] Daniel Victor and Sheera Frenkel,  “Iranian Hacker Charged in HBO Hacking That Included ‘Game of Thrones’ Script”, The New York Times, Nov. 21, 2017, https://www.nytimes.com/2017/11/21/business/hbo-hack-charges.html

[6] “Rocket Kitten: A Campaign With 9 Lives”, Check Point Software Technologies, https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf

[7] Joseph Menn and Yeganeh Torbati, “Exclusive: Hackers accessed Telegram messaging account in Iran – researchers”, Reuters, July 27, 2016, https://webcache.googleusercontent.com/search?q=cache:DE8XABScILkJ:https://ar.reuters.com/article/us-iran-cyber-telegram-exclusive-idUSKCN10D1AM+&cd=5&hl=en&ct=clnk&gl=us

[8] Catalin Cimpanu, “FBI says an Iranian hacking group is attacking F5 networking devices”, ZDNet, Aug. 10, 2020, https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices/

[9] Department of Justice, “State-Sponored Iranian Hackers Indicted for Computer Intrusions at U.S. Satellite Companies”, U.S. DOJ, Sept. 17, 2020, https://www.justice.gov/opa/pr/state-sponsored-iranian-hackers-indicted-computer-intrusions-us-satellite-companies

[10] Laurens Cerulus, “Iranian hackers target top diplomats and security officials”, Politico, Oct. 28, 2020, https://www.politico.eu/article/iranian-hackers-target-munich-security-conference-crowd/

[11] Brooke Crothers, “Unsophisticated Iranian hackers armed with ransomware are targeting companies worldwide”, Fox News, Aug. 26, 2020, https://www.foxnews.com/tech/unsophisticated-iranian-hackers-armed-with-ransomware-are-targeting-companies-worldwide