REvil Hacker Gets Nearly 14-Year Sentence

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, a REvil hacker was sentenced; researchers saw a possible new Ivanti zero-day; the FBI said to strengthen DMARC policies; Okta saw a surge in credential stuffing attacks; a French hospital refused to pay a ransom; JPMorgan, a debt collection agency and a healthcare company were breached; and an ex-NSA employee was sentenced.

See Also: Ransomware Response Essential: Fixing Initial Access Vector

Ukrainian national Yaroslav Vasinskyi, 24, received a 13-year, seven-month prison sentence Wednesday in a Dallas federal court. Vasinskyi, aka “Rabotnik,” participated in more than 2,500 ransomware attacks as an affiliate of the REvil ransomware-as-a-service operation. The group demanded more than $700 million in extortion for those attacks although actual payments totaled approximately $2.3 million, prosecutors said. The court also ordered Vasinskyi to pay $16 million in restitution.

Vasinskyi has been in U.S. custody since March 2022 following his arrest the previous year in Poland (see: REvil Ransomware Suspects Snared in Global Police Crackdown). He pleaded guilty in August 2022 to an 11-count criminal indictment.

REvil, also known as Sodinokibi, drew the ire of U.S. authorities after affiliates hacked IT management service Kaseya in 2021 and almost two dozen Texas towns in 2019. A multinational law enforcement operations took REvil servers offline in October 2021.

Vasinskyi took part in the Kaseya hack but not the attack against Texas municipalities, according to his guilty plea. “Although the conspirators attempted to cover their tracks by laundering the payments from victims, Vasinskyi could not hide from law enforcement,” said Principal Deputy Assistant Attorney General Nicole Argentieri. Prosecutors also said that in 2023, they clawed back approximately 40 bitcoins and $6.1 million in extortion payments made to REvil.

Newly listed on a running list of “vulnerabilities discovered by Zero Day Initiative researchers that are yet to be publicly disclosed” is a flaw for unnamed Ivanti products. The flaw, tracked as ZDI-CAN-23850 and posted on Wednesday, merits a score of 9.8 out of 10 on the CVSS scale, ZDI said.

Ivanti, the Utah manufacturer of gateway devices, did not immediately respond to a request for comment. Company customers have been in emergency mitigation and patching mode for much of this year after likely Chinese nation-state hackers began a hacking campaign in December (see: Hackers Compromised Ivanti Devices Used by CISA) that started a flurry of research into Ivanti devices and turned up additional flaws. A supply chain security firm that reverse-engineered the company’s Pulse Secure VPN appliance found it operates on an 11-year-old version of Linux and uses many obsolete software packages (see: Ivanti Uses End-of-Life Operating Systems, Software Packages).

Company CEO Jeff Abbott has vowed a turnaround in security practices.

The FBI, the U.S. Department of State and the National Security Agency on Thursday urged organizations to strengthen permissive DMARC policies amid evidence that North Korean hackers are getting smarter about bypassing the anti-spam protection (see: Kimsuky Uses Permissive DMARC Policies to Spoof Emails).

The Pyongyang hacking group popularly known as Kimsuky – it’s also tracked as Emerald Sleet, APT43, Velvet Chollima and Black Banshee – is famous for its social engineering techniques, including spoofed emails purportedly from universities, think tanks and journalists. The group is Hermit Kingdom leader Kim Jong Un’s window into the world – the group that North Korean intelligence uses to gauge the direction of geopolitics.

Email security experts for years have urged organizations to adopt Domain-based Message Authentication, Reporting and Conformance as a counter to spammers manipulating email headers to make them seem to originate from a trusted source. Email domains with DMARC enabled affix a digital signature to emails and specify which IP addresses can legitimately send mail. DMARC also allows domain owners to propose a standard policy for emails that fail the authentication attacks. The options are: reject, quarantine or do nothing.

Email spoofers, including North Korean hackers, like domains that tell receivers to do nothing, since it means that spoofed email will likely land in a recipient’s inbox. “In order for organizations to make their policy stricter and signal to email servers to consider unauthenticated emails as spam, the authoring agencies recommend mitigating this threat by updating your organization’s DMARC policy” to reject or quarantine.

Identity giant Okta warned of a notable rise in credential stuffing attacks originating from residential proxy services and the Tor anonymity network. The warning builds off an earlier advisory from Cisco Talos that says it spotted a “global increase in brute-force attacks” against VPNs, web authentication interfaces and Secure Shell services.

Okta recommends blocking requests from anonymizing services and suspicious IPs, implementing strong password policies, enabling multifactor authentication, adopting passwordless authentication and monitoring for anomalous behavior.

A French hospital refused to pay an extortion demand from hackers using LockBit 3.0 crypto-locking software. Hôpital de Cannes Simone Veil, serving the French Rivera, said Thursday that ransomware hackers published data stolen from the hospital.

The April 16 attack caused operational disruptions, prompting the rescheduling of nonemergency procedures and appointments. Operations are nearly back to normal, the hospital said Thursday.

An international operation infiltrated the Russian-speaking crime group and seized servers earlier this year, but its leaders have sought to regroup and relaunch activities (see: Ransomware Operation LockBit Relaunches Dark Web Leak Site).

Global U.S. financial firm JPMorgan Chase Bank disclosed a data breach affecting more than 451,000 individuals due to a software issue in a vendor-provided system. Three authorized users accessed retirement plan participants’ records between Aug. 26, 2021, and Feb. 23, 2024, downloading 12 reports with sensitive data. The bank corrected the access issue discovery and applied a software update. Despite no evidence of data misuse or cyberattack, JPMorgan is offering affected individuals two years of identity theft protection services through Experian.

Debt collection agency Financial Business and Consumer Solutions revealed a data breach potentially affecting 1,955,385 individuals. The company detected hackers on Feb. 26 and later determined that they gained access more than 10 days earlier, on Feb. 14. Affected data includes names, Social Security numbers and birthdates.

Healthcare accounts receivable management company Designed Receivable Solutions updated the number of individuals affected by a January data breach from 129,000 to 498,686. The breach exposed sensitive information including names, addresses and Social Security numbers.

National Security Agency cyberspecialist Jareh Sebastian Dalke, 32, received a nearly 22-year prison sentence for trying to spy for Russia. Dalke, who spent less than a month at the NSA, used an encrypted email account to transmit excerpts of three documents marked “Top Secret//Sensitive Compartmented Information” to an individual he believed was a Russian agent, unaware he was dealing with an undercover FBI agent. Dalke, an Army veteran, received $16,499 in cryptocurrency and offered to sell the rest of the documents for $85,000. He arranged to meet the purported Russian agent at Union Station in downtown Denver, where he transferred four files containing classified national defense information. Federal agents arrested him moments after he sent the files.

Dalke, from Colorado Springs, pleaded guilty in October to six counts of attempting to transmit classified national defense information to a foreign government’s agent (see: Breach Roundup: Ex-NSA Employee Pleads Guilty to Selling Secrets.

Other Coverage From Last Week

With reporting by Information Security Media Group’s David Perera in Washington, D.C.