Hudson Rock isn't Just in the News, it Makes the News:

Alon Gal, co-founder of Israeli cybercrime monitoring company Hudson Rock, said the claim of a hack "looks legit," citing the publicly circulating screenshots purporting to show 4chan's backend infrastructure.

Cybersecurity researchers at Hudson Rock have identified a new wave of cyber attacks by the HellCat ransomware group, this time targeting four companies across the United States and Europe. The common thread? Stolen Jira credentials, extracted by infostealer malware long before the actual breaches took place.

"In this case, the infected Spectos employee's credentials provided a gateway to Royal Mail Group's systems," Hudson Rock CTO Alon Gal said. "The stolen data sat dormant until recently, when it was weaponized in these high-profile leaks."

The threat actor included a series of screenshots in their listing, to prove their access to Check Point’s systems. According to a post from Hudson Rock co-founder and CTO Alon Gal, the screenshots appear genuine, especially since the hacker has a record of legitimate leaks.

According to Alon Gal, co-founder and chief technology officer at Hudson Rock, writing at the organization’s Infostealers hub, an Infostealer malware attack in 2021 has led to a brand new dump of some 270,000 Samsung customer tickets.

The credentials, Hudson Rock says, were compromised in 2021, after a Spectos GmbH employee’s computer was infected with the Racoon infostealer. The login information was never rotated and, while dormant for four years, it was used this year to access Samsung’s system and dump 270,000 customer tickets on the internet.

Hudson Rock co-founder and CTO Alon Gal reported on Tuesday that he had received confirmation from several customers using Oracle Cloud that the leaked data is genuine and is associated with a production environment. Some customers said the exposed accounts have access to sensitive data.

Hudson Rock believes that stolen credentials gave Arkana a foothold in the WOW infrastructure, from where they were able to move laterally.

“What sets the JLR breach apart is the age of the compromised credentials. Hudson Rock, which has tracked infostealer infections since at least 2018, had previously identified the employee’s stolen login details as part of its vast database of exposed credentials. Despite their age, the credentials remained valid and unchanged,” Hudson Rock notes.

Alon Gal, co-founder and CTO at threat intelligence company Hudson Rock, says the JLR breach follows a pattern specific to HellCat hackers. “At the heart of this latest incident lies a technique that has become HELLCAT’s signature: exploiting Jira credentials harvested from compromised employees that were infected by Infostealers”

Alon Gal, the co-founder of threat intelligence experts Hudson Rock, has warned that employees at major U.S. defense contractors, U.S. Army and Navy personnel and “even the FBI and Government Accountability Office have active infections, exposing investigative and cybersecurity personnel.”

Researchers are continuing to examine the logs and share their findings, with Hudson Rock providing an LLM to query the material.

According to Hudson Rock, employees at key US defence entities, including the Pentagon, major contractors like Lockheed Martin and Honeywell, military branches, and federal agencies like the FBI, have fallen victim to Infostealer malware.

The US Army, Navy, and major defense contractors, including Lockheed Martin, Boeing, and Honeywell have hundreds of computers with active infostealer infections, the Israeli cybersecurity firm Hudson Rock has claimed.

Hudson Rock has been the go-to source for all things cybersecurity and infosec updates. Be it offering dark web intelligence or finding one’s own data on breach forums, Hudson Rock has been a torch bearer, bringing the latest updates to people.

The attackers told Hudson Rock that they used custom infostealer malware to compromise the credentials of more than 15 Telefonica employees and access the company’s Jira platform.

Hudson Rock, a cybersecurity vendor that claims to have spoken with the threat actors, reported that the perpetrators used infostealer malware to compromise roughly 15 Telefonica employees and gain access to the system via their credentials.

Cybercrime intelligence company Hudson Rock referred to the fallout of the bug as one of the most substantial leaks of corporate information last year; and authors of the "Verizon Data Breach Investigation Report (DBIR)" in February noted that breaches attributable to MOVEit were so numerous that they skewed its statistics for the year.

According to a report from Hudson Rock, the threat actor may have leveraged credentials stolen via infostealer malware to steal credentials for an analytics platform used by Hot Topic to access the retailer’s cloud environments.

“The directories contain detailed employee information, including names, email addresses, phone numbers, cost center codes, and, in some cases, entire organizational structures,” Hudson Rock said in a blog post on Monday.

The threat actor, operating under the alias “Nam3L3ss” claims to have published data allegedly stolen from 25 major organizations, cybersecurity firm Hudson Rock reports.

“This structured data reveals not only contact information but also sensitive details about organizational roles and department assignments, potentially opening doors to social engineering and other security threats,” Hudson Rock researchers said in a report.

Hudson Rock researchers, who analyzed the provided data sample, attributed the database to three major retail companies : Hot Topic, Torrid, and Box Lunch. All three companies are founded by the US fast-fashion company Hot Topic.

Alon Gal of Hudson Rock spoke to one of the threat actors behind the attack, who claimed they were responsible for recent Santander and Ticketmaster data breaches and said they stole the data from cloud storage company Snowflake.

Hudson Rock CTO Alon Gal told BleepingComputer that on February 8 the company's threat intelligence platform detected a Change Healthcare employee's Citrix credentials stolen through information-stealing malware.

Alon Gal of cybersecurity intelligence service Hudson Rock told BleepingComputer that this email and an associated password for the RIPE account were found in a list of accounts stolen by information-stealing malware.

According to an investigation by Hudson Rock researchers, Binance uses a third-party service called Kodex, which validates law enforcement requests.

"This will result in a major shift in the cybercrime world, enabling hackers to infiltrate even more accounts and perform significant attacks," Alon Gal, co-founder and CTO at Hudson Rock, said in a set of posts on LinkedIn.

Airbus has apparently confirmed the cybercriminal’s account to the threat intelligence firm Hudson Rock, which determined that the Airbus credentials were stolen after a Turkish airline employee infected their computer with a prevalent and powerful info-stealing trojan called RedLine.

"After analyzing millions of computers infected with info-stealing malware, researchers at cybersecurity firm Hudson Rock said they identified 120,000 that contained credentials used for logging into cybercrime forums."

"Israeli cyber-intelligence firm Hudson Rock appeared to be the first to notice the posting offering the data of 400 million Twitter users, tweeting about the “credible threat” three days ago."

When threat actors are able to extract sensitive information due to neglectful API implementations, the consequence is equivalent to a data breach and should be handled accordingly by the firm [and] examined by regulators,” Gal told TechCrunch.

Alon Gal, the co-founder and CTO of cybersecurity firm Hudson Rock, alerted Motherboard to the listing.

"A database of that size containing the private information such as phone numbers of a lot of Facebook's users would certainly lead to bad actors taking advantage of the data to perform social-engineering attacks [or] hacking attempts," Gal told Insider.

“In the case of the T-Mobile attack, the alleged hacker said they had different motivations. In a screenshot of a text conversation posted online by Alon Gal, co-founder of cybercrime firm Hudson Rock, the hacker appears to tell Gal that the attack was done “to harm US infrastructure.”