Bored Ape Yacht Club hacked again / U.S. citizens lost $1B in crypto scams / Russia's government website hacked

Plus: State-backed hackers are exploiting a Microsoft Office bug to hack targets in Europe and U.S.

Inside.com Part of   Network June 06, 2022

Presented by

Bored Ape Yacht Club's Discord server was hacked, resulting in $360,000 being stolen. BAYC's community manager Boris Vagner had his account compromised. More: The news of the hack was first reported by Twitter user NFTherder, who traced the stolen funds back to four separate wallets. Yuga Labs, the creator of Bored Ape Yacht Club, confirmed the hack in a tweet 11 hours after NFTHerder, saying it is still actively investigating the incident. The threat actor also posted a phishing link on the Discord channel of Spoiled Banana Society, an NFT fantasy football club run by Boris Vagner's brother, Richard. In response to the incident, one BAYC founder blamed Discord for the lapse in security. "Discord isn't working for Web 3 communities," Gordon Goner said in a tweet. "We need a better platform that puts security first." However, another founder blamed the users themselves for compromising their wallets. "You lost your NFT because you signed a malicious transaction with your key," Steve Fink tweeted. "Stop blaming Discord, another client won't save you from repeating the same mistakes." Zoom Out: This is the third time a threat actor has been able to hack a Yuga Labs-run account/user to steal users' funds. The first was on April 1, when Mutant Ape Yacht Club #8662 was stolen through a phishing link posted on the project's Discord, with the second coming on April 25, after Bored Ape Yacht Club Instagram and Discord accounts posted a fake link to an Otherside minting. Seth Rogen had his BAYC NFT stolen after being scammed on a Discord server.

The U.S. Federal Trade Commission said over 46,000 Americans have reported losing more than $1B worth of cryptocurrency to scams. The losses occurred between Jan. 2021 and March 2022. More: The figure is a significant increase compared with the previous year when U.S. citizens reported $80M in losses from cryptocurrency scams. This number matches the report that the FBI released called the Internet Crime Report. The U.S. law enforcement agency said tens of thousands of reports pointed to over $1.6B in cryptocurrency losses. In 2021, the IC3 received 34,202 complaints involving the use of some type of cryptocurrencies, such as Bitcoin, Ethereum, Litecoin, or Ripple. While that number showed a decrease from 2020's victim count (35,229), the loss amount reported in IC3 complaints increased nearly seven-fold, from 2020's reported amount of $246M to a total reported loss in 2021 of more than $1.6B. The FTC also added that one in four dollars paid to scammers within the last year had been paid using cryptocurrency. Based on FTC's analysis, almost half of all consumers said they were led to hacker campaigns via ads, posts, or messages on social media platforms.

A message from SECURITY COMPASS Have you given up on making your development team more productive? Figuring out the best approach to mature application security programs can be difficult, especially with increasing internal demands for a faster time to market. That’s why Security Compass commissioned Forrester Consulting to conduct a Total Economic Impact™ study to examine the quantifiable ROI enterprises can realize by deploying SD Elements. According to this study, SD Elements enabled its users to decrease the time needed to develop security requirements for products by up to 90% with an ROI as high as 332%. If that sounds interesting, you can watch this recorded webinar with experts from Forrester and Security Compass to learn how organizations use SD Elements to: Reduce vulnerability remediation costs Improve productivity Reduce costs through automation Experience The Study

The website for Russia's Ministry of Construction, Housing, and Utilities was reportedly hacked. The page showed a "Glory to Ukraine" message. More: Russia's state news agency, RIA, was informed by a representative from the ministry who revealed that the site was down. Users' personal data was unaffected. According to the RIA, the hackers were demanding a ransom to prevent the disclosure of sensitive data to the public. This was the first time that Russia's Ministry of Construction, Housing, and Utilities has been targeted by hackers since the invasion of Ukraine. Zoom Out: St. Petersburg-based news outlet Fontanka's content was replaced with a message aimed at Russian citizens reading, "This is not our war, let's stop it!" earlier in 2022. Last month on Victory Day, Russia's television listings system was hacked. The hack affected many major networks, including Rossiya-1, NTV-Plus, and Channel One. Anonymous claimed it breached the database of the Russian federal agency responsible for the supervision of information technology, communications, and mass media.

Researchers discovered a new state-sponsored attack that exploits the "Follina" vulnerability in Microsoft Office. The flaw is used to target governments in Europe and the U.S. More: Enterprise security firm Proofpoint sted that it blocked attempts at exploiting the remote code execution flaw, which is tracked CVE-2022-30190 with a CVSS score of 7.8. There were more than 1,000 phishing messages containing a lure document sent to the targets. The phishing message is presented as a salary increase but contains a payload. This payload comes in the form of a PowerShell script, is Base64-encoded, and functions as a downloader to retrieve a second PowerShell script from a remote server named "seller-notification[.]live." This script checks for virtualization, steals information from local browsers, mail clients, and file services, conducts machine recon, and then zips it for exfiltration. The campaign's origin is not known yet, but authorities believe the attack is state-backed.

A message from AXONIUS On July 14, 2021, the world welcomed a newborn. Named Cyber Asset Attack Surface Management (CAASM), Gartner announced its arrival in the Hype Cycle for Network Security 2021. New acronyms and repackaged tools aimed at IT and security professionals pop up every year, though. So what makes CAASM different? What’s driving its adoption? And how can we expect it to impact cybersecurity initiatives? We’re here to answer these important questions and help you navigate the new world of CAASM. Download “From Asset Management to Asset Intelligence: Crossing the CAASM” now to learn: The history behind CAASM Why CAASM is a relevant category for IT and Security professionals How organizations can realize CAASM’s value — immediately Read Now

Apple announced that in 2021, it prevented over 1.6 million risky and untrustworthy apps and app updates from reaching the App Store. The company stopped $1.5B in fraudulent transactions. More: In 2021, Apple also rejected 118 million attempted fraudulent account creations, deactivated 170 million fraudulent customer accounts, and terminated 802,000 fraudulent developer accounts.  In 2020, the first year Apple released the statistics, these numbers were 424 million, 244 million, and 470 million, respectively. Apple stated that it uses proprietary tools that leverage machine learning, heuristics, and data accumulated since the App Store first launched to detect any potential violations or issues with an app.

Quick Hits: Everything you need to successfully create and launch an influencer campaign. Get the influencer program starter kit.* Israeli company Perimeter 81 raised $100M at a $1B valuation. AppOmni raised $80M in a Series C funding round led by Thoma Bravo. CybSafe has raised a $28M Series B round, taking its total funding raised to $40M. HackNotice announced it has raised a $7M Series A funding. *This is a sponsored post.

Upcoming events at Inside: June 07 - June 08 - Cloud Innovation Summit: See what high-performance cloud app dev looks like. (Register Here) * June 09 - Empowering Content Creators with No Code (Register Here) June 15 - Need To Know NoCoder - Artem Harutyunyan (bardeen.ai) (Register Here) June 16 - Future of the Art Market (Register Here) June 29 - June 30 - Polkadot Decoded: The Biggest Polkadot Event of the Year (Register Here) * June 30 - HR Strategies to Retain Remote Employees (Register Here) July 20 - Need To Know NoCoder - Yassine Tahi (Kinetix) (Register Here) July 21 - The Rise of Metaverse Gaming (Register Here) *This is a sponsored listing.

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime. Editor Aaron Crutchfield is based in the high desert of California. Over the last two decades, he has spent time writing and editing at various local newspapers and defense contractors in California. When he's not working, he can often be found looking at the latest memes with his kids or working on his 1962 Ford.

Security Compass is on a mission to accelerate software time-to-market while managing risk.

CAASM is on the rise - but what exactly does it mean? Read this ebook to find out why it’s relevant. Read Now.

767 Bryant St. #203, San Francisco, CA 94107 Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription! You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.