Lawrence Abrams

Ransomware, Online Security, and Malware. Owner, Editor in Chief of @bleepincomputer.

DM on Signal: LawrenceA.11 *

[JSKitty @JSKitteh]

I regret to inform the community that all that the source code for Vector has been leaked.

This has been tough on the team, most likely, it's being auctioned on the dark web.

🧵 Whoever purchases it will regret it for the reasons in this thread.

[Austin Larsen @AustinLarsen_]

⚠️ Our team at Google is releasing more details on the recent NPM #axios supply chain attack. Notably, we now attribute this activity to #UNC1069, a financially motivated North Korean 🇰🇵 nexus threat actor active since at least 2018.

[Lawrence Abrams @LawrenceAbrams]

New data theft campaign is targeting Okta SSO-connected platforms.

Extortion demands signed by ShinyHunters.
https://t.co/T2ieyZVKUT

[BleepingComputer @BleepinComputer]

Okta SSO accounts targeted in vishing-based data theft attacks - @LawrenceAbrams
https://t.co/16uPzf7elf

https://t.co/16uPzf7elf

[Lawrence Abrams @LawrenceAbrams]

My scoop: PornHub extorted by ShinyHunters for the theft of over 200 million activity data records for Premium members.

The data is detailed linking member's emails to what videos they watched, downloaded, and searched for.

https://t.co/EwiVHyCvO1

[BleepingComputer @BleepinComputer]

🚨PornHub is being extorted by the ShinyHunters extortion group over the theft of over 200 million Premum member activity data records.

Both PornHub and ShinyHunters claim the data was stolen in the recent Mixpanel breach.
https://t.co/M1mrL20jYd

[𝕯𝖒𝖎𝖙𝖗𝖞 𝕾𝖒𝖎𝖑𝖞𝖆𝖓𝖊𝖙𝖘 @ddd1ms]

The rise and fall of LockBit Gang.

It’s clear that FBI Newark and their partners have a solution even to the most prolific ransomware operation.

[Lawrence Abrams @LawrenceAbrams]

The security incident at University of Pennsylvania appears to be a more extensive breach than originally stated.

My scoop: https://t.co/STXDQujTxx

[BleepingComputer @BleepinComputer]

The Clop ransomware gang confirmed to BleepingComputer they are behind the emails, claiming they exploited an Oracle bug to steal the data.

“We not prepared to discuss details at this time. Soon all will become
obvious that Oracle bugged up their core product and once again, the task is on clop to save the day. We do not damage to systems and only expect payment for services we provide to protect hundreds of biggest companies in world.”

[Lawrence Abrams @LawrenceAbrams]

My scoop from earlier today.

A sample shared with me had a full PDF customer engagement report.

[BleepingComputer @BleepinComputer]

Red Hat confirms security incident after hackers claim GitHub breach - @LawrenceAbrams
https://t.co/kEx58sDjIg

https://t.co/kEx58sDjIg

[Lawrence Abrams @LawrenceAbrams]

@DarkWebInformer Where did you get that email ?

[Lawrence Abrams @LawrenceAbrams]

@GhostyTongue @BleepinComputer No this is different from what I understand.

[3xp0rt @3xp0rtblog]

The XSS forum community is actively discussing the situation. However, it appears that moderators are removing all content where the admin (LARVA-27) is being discussed. This was confirmed in a Telegram chat by moderator LARVA-466 (Rehub). The goal is to suppress any narrative that could turn the situation into a newsworthy event and to "troll" Westerners in the process. However, while the xss[.]is domain displays a seizure notice, the backup domain xss[.]as, the .onion site, and the Jabber service at thesecure[.]biz are still online and functioning.

[BleepingComputer @BleepinComputer]

Microsoft releases emergency patches for SharePoint RCE flaws exploited in attacks - @LawrenceAbrams
https://t.co/R4kPiB7HVb

https://t.co/R4kPiB7HVb

[Lawrence Abrams @LawrenceAbrams]

🚨 Don’t miss our upcoming BleepingComputer webinar with @specopssoftware and @SCMagazine!

We'll discuss how stolen credentials and identity-based attacks have become a favorite way to break into networks.

🗓️July 9th at 2 PM ET

➡️Register here: https://t.co/AIuQIqoZLc

[Lawrence Abrams @LawrenceAbrams]

@grepnap @BleepinComputer @serghei 🤔

[Lawrence Abrams @LawrenceAbrams]

Original leak of stolen 2021 AT&T data had three files, a MASTER file containing encrypted SSNs and date of births, and two other files mapping the encrypted data to the plain text SSNs and DOBs. The new repackaged leak adds the unencrypted SSNs and DOBs to each customer record.

[Lawrence Abrams @LawrenceAbrams]

FYI, the repackaged AT&T data breach leak on XSS is from the 2021 breach, not the April 2024 Snowflake data theft attacks.

Data matches the 2021 data leaked in March 2024.
https://t.co/UuvgaxzyIb

[Lawrence Abrams @LawrenceAbrams]

ShinyHunters is the threat cluster to track this year.

They, or threat actors claiming to be, are behind a lot of the attacks we are seeing.
https://t.co/80tJLcdWs8

[Lawrence Abrams @LawrenceAbrams]

Looks like RansomEXX ransomware op is still around. 👋
https://t.co/IPN3o3oVPv

[Oleg @Cyber_0leg]

🚨 How was Black Basta structured? What were its members’ roles? How did its infrastructure operate?

Leaked chats reveal a highly organized ransomware group with defined leadership, internal teams, and external affiliates.

More in my article ⬇️

https://t.co/YJHXxf5H4n

[Troy Hunt @troyhunt]

I’ve had a few people flag this with me as a “data breach”. It’s not, it’s authorised access. Not liking that authorisation does not make it a data breach. If one of these guys then accidentally leaks it all over the place to unauthorised parties, *then* it’s a data breach!