Tag FBI

Released ProxyLogon Exploit PoC: A Potential Catalyst for Increased Cyber Attacks

March 11, 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Wednesday, highlighting ongoing exploitation of vulnerabilities in Microsoft Exchange on-premises products by both nation-state actors and cybercriminals. “CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks, steal sensitive information, encrypt data for ransom, or conduct destructive attacks,” the agencies stated. They also noted that compromised networks might be sold on the dark web. Recent attacks have mainly targeted local governments, academic institutions, NGOs, and businesses across various sectors such as agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceuticals—consistent with previous activities linked to Chinese cyber threats. Tens of thousands of entities, including the Eur…

ProxyLogon Exploit Now Public, Heightening Cyber Threats Date: March 11, 2021 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued an urgent advisory concerning the exploitation of serious vulnerabilities within Microsoft Exchange on-premises products. This advisory comes in the wake of confirmed…

Read More

Released ProxyLogon Exploit PoC: A Potential Catalyst for Increased Cyber Attacks

March 11, 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Wednesday, highlighting ongoing exploitation of vulnerabilities in Microsoft Exchange on-premises products by both nation-state actors and cybercriminals. “CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks, steal sensitive information, encrypt data for ransom, or conduct destructive attacks,” the agencies stated. They also noted that compromised networks might be sold on the dark web. Recent attacks have mainly targeted local governments, academic institutions, NGOs, and businesses across various sectors such as agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceuticals—consistent with previous activities linked to Chinese cyber threats. Tens of thousands of entities, including the Eur…

The Ongoing Struggle to Renew Essential US Spy Powers Remains Chaotic

Content Review: Cybersecurity Implications of Legislative Changes Recent legislative discussions surrounding the reauthorization of Section 702 of the Foreign Intelligence Surveillance Act (FISA) have ignited significant concern among cybersecurity experts and advocates for civil liberties. In a revealing critique, a senior Democratic aide described components of the proposed legislation as…

Read MoreThe Ongoing Struggle to Renew Essential US Spy Powers Remains Chaotic

Feds Shut Down $6.4M VerifTools Fake ID Marketplace, Operators Quickly Relaunch on New Domain

Authorities from the Netherlands and the U.S. have successfully dismantled VerifTools, an illegal marketplace supplying counterfeit identity documents to cybercriminals globally. The operation resulted in the seizure of two website domains and a related blog, which now redirect users to a notice about the FBI’s enforcement action under a U.S. District Court warrant. However, just days later, the platform’s operators announced a relaunch at “veriftools.com.” The domain, registered in 2018, now raises questions regarding its administrators’ identities.

Feds Dismantle $6.4M VerifTools Counterfeit ID Marketplace; Operators Quickly Restart on New Domain Authorities from the United States and the Netherlands have successfully shut down VerifTools, a highly illicit marketplace known for selling fake identity documents to cybercriminals worldwide. In a coordinated operation, agents seized two major domains—verif[.]tools and veriftools[.]net—along…

Read More

Feds Shut Down $6.4M VerifTools Fake ID Marketplace, Operators Quickly Relaunch on New Domain

Authorities from the Netherlands and the U.S. have successfully dismantled VerifTools, an illegal marketplace supplying counterfeit identity documents to cybercriminals globally. The operation resulted in the seizure of two website domains and a related blog, which now redirect users to a notice about the FBI’s enforcement action under a U.S. District Court warrant. However, just days later, the platform’s operators announced a relaunch at “veriftools.com.” The domain, registered in 2018, now raises questions regarding its administrators’ identities.

Republican Revolt Derails Trump’s Efforts to Extend Warrantless Surveillance

Late-Night Legislative Maneuver Leads to Surveillance Program Setback In a dramatic turn of events, House Speaker Mike Johnson called a late-night vote on Friday focused on the contentious reauthorization of a surveillance program that has raised privacy concerns. This program, part of Section 702 of the Foreign Intelligence Surveillance Act,…

Read MoreRepublican Revolt Derails Trump’s Efforts to Extend Warrantless Surveillance

FBI Collaborated with Anonymous and LulzSec Hackers to Target Foreign Governments

August 28, 2013

Sentencing for former LulzSec leader Hector Xavier Monsegur, also known as “Sabu,” has been postponed again. Monsegur, who pleaded guilty to multiple criminal charges two years ago, faces a maximum sentence exceeding 124 years. Additionally, fellow LulzSec hacker Jeremy Hammond has alleged that the FBI utilized Sabu to orchestrate attacks against foreign governments, leveraging the efforts of Anonymous and other hackers.

The ongoing delays suggest that the FBI may not be fully extracting information from Monsegur, hinting at the possibility that he is assisting with other covert operations as claimed by Hammond. In a recent statement, Hammond accused the U.S. government of directing Monsegur to motivate fellow hacktivists to breach foreign government entities. “What many don’t realize is that Sabu was also used by his handlers to orchestrate hacking activities targeting government-selected entities, including multiple foreign government websites,” Hammond stated.

FBI Collaborated with Anonymous and LulzSec Hackers for Foreign Government Cyber Operations On August 28, 2013, developments emerged regarding Hector Xavier Monsegur, infamously known as “Sabu,” the former leader of the hacking group LulzSec. His sentencing, initially slated for last year after he pleaded guilty to multiple criminal charges, has…

Read More

FBI Collaborated with Anonymous and LulzSec Hackers to Target Foreign Governments

August 28, 2013

Sentencing for former LulzSec leader Hector Xavier Monsegur, also known as “Sabu,” has been postponed again. Monsegur, who pleaded guilty to multiple criminal charges two years ago, faces a maximum sentence exceeding 124 years. Additionally, fellow LulzSec hacker Jeremy Hammond has alleged that the FBI utilized Sabu to orchestrate attacks against foreign governments, leveraging the efforts of Anonymous and other hackers.

The ongoing delays suggest that the FBI may not be fully extracting information from Monsegur, hinting at the possibility that he is assisting with other covert operations as claimed by Hammond. In a recent statement, Hammond accused the U.S. government of directing Monsegur to motivate fellow hacktivists to breach foreign government entities. “What many don’t realize is that Sabu was also used by his handlers to orchestrate hacking activities targeting government-selected entities, including multiple foreign government websites,” Hammond stated.

FBI Alerts: Anonymous Hackers Have Compromised US Government Networks for Nearly a Year

November 17, 2013

The FBI has issued a warning that members of the hacktivist group Anonymous have been covertly infiltrating US government computers and stealing sensitive information in a campaign that started nearly a year ago. The group has exploited vulnerabilities in Adobe software to breach targeted systems and install backdoors, allowing ongoing access to compromised computers, with activities dating back to last December, according to a Reuters report.

This hacking campaign has affected various government entities, including the U.S. Army, Department of Energy, and the Department of Health and Human Services. The FBI described the intrusion as “a widespread problem that warrants immediate attention” and has provided guidance to system administrators on identifying potential compromises in their networks. Investigators are currently assessing the extent of the breaches, with concerns that the hackers’ activities are ongoing.

FBI Alerts on Anonymous Hackers Compromising U.S. Government Systems for Nearly a Year November 17, 2013 The FBI has issued a significant alert regarding the hacktivist collective known as Anonymous, revealing that its members have clandestinely infiltrated U.S. government computer systems, leading to the theft of sensitive data over the…

Read More

FBI Alerts: Anonymous Hackers Have Compromised US Government Networks for Nearly a Year

November 17, 2013

The FBI has issued a warning that members of the hacktivist group Anonymous have been covertly infiltrating US government computers and stealing sensitive information in a campaign that started nearly a year ago. The group has exploited vulnerabilities in Adobe software to breach targeted systems and install backdoors, allowing ongoing access to compromised computers, with activities dating back to last December, according to a Reuters report.

This hacking campaign has affected various government entities, including the U.S. Army, Department of Energy, and the Department of Health and Human Services. The FBI described the intrusion as “a widespread problem that warrants immediate attention” and has provided guidance to system administrators on identifying potential compromises in their networks. Investigators are currently assessing the extent of the breaches, with concerns that the hackers’ activities are ongoing.

FBI Alerts on UNC6040 and UNC6395 Targeting Salesforce for Data Theft

September 13, 2025
Cyber Attack / Data Breach

The FBI has released a flash alert highlighting indicators of compromise linked to two cybercriminal groups, UNC6040 and UNC6395, known for their recent data theft and extortion campaigns. Both groups have been reported to target organizations’ Salesforce platforms using various initial access methods.

UNC6395 has been notably associated with a significant data theft operation in August 2025, where compromised OAuth tokens from the Salesloft Drift application were exploited. This vulnerability stemmed from a breach of Salesloft’s GitHub account between March and June 2025. In response, Salesloft has isolated the Drift infrastructure and temporarily disabled the AI chatbot application while implementing enhanced multi-factor authentication measures.

FBI Issues Alert on Cybercriminal Groups Targeting Salesforce Platforms September 13, 2025 In a concerning development, the Federal Bureau of Investigation (FBI) has issued a flash alert regarding two cybercriminal factions, referred to as UNC6040 and UNC6395, who are orchestrating a series of data theft and extortion attacks. This alert…

Read More

FBI Alerts on UNC6040 and UNC6395 Targeting Salesforce for Data Theft

September 13, 2025
Cyber Attack / Data Breach

The FBI has released a flash alert highlighting indicators of compromise linked to two cybercriminal groups, UNC6040 and UNC6395, known for their recent data theft and extortion campaigns. Both groups have been reported to target organizations’ Salesforce platforms using various initial access methods.

UNC6395 has been notably associated with a significant data theft operation in August 2025, where compromised OAuth tokens from the Salesloft Drift application were exploited. This vulnerability stemmed from a breach of Salesloft’s GitHub account between March and June 2025. In response, Salesloft has isolated the Drift infrastructure and temporarily disabled the AI chatbot application while implementing enhanced multi-factor authentication measures.

Nigeria Apprehends Developer Behind RaccoonO365 Phishing Scheme Linked to Microsoft 365 Attacks

Nigeria Police Crack Down on High-Profile Internet Fraud Syndicate Authorities in Nigeria have apprehended three individuals connected to a sophisticated internet fraud operation, potentially linked to phishing attacks targeting major corporations, including the prominent RaccoonO365 phishing-as-a-service (PhaaS) scheme. The arrests were made by the Nigeria Police Force National Cybercrime Centre…

Read MoreNigeria Apprehends Developer Behind RaccoonO365 Phishing Scheme Linked to Microsoft 365 Attacks