A Russian citizen, Alexander Ermakov, who goes by various online aliases, has been sanctioned by the governments of Australia, the U.K., and the U.S. for his involvement in a major cyberattack on Medibank, an Australian health insurance provider, in 2022.

Ermakov is accused of hacking into the Medibank network and stealing and leaking the personal and medical data of about 9.7 million current and former customers of the company. The data breach was carried out by the REvil ransomware gang, which has since ceased operations.

The sanctions prohibit anyone from dealing with Ermakov’s assets, including cryptocurrency wallets or ransomware payments, and impose a travel ban on him. Anyone who violates the sanctions could face up to 10 years in prison.

The U.K. government said the sanctions are part of their efforts to combat the malicious cyber activities of Russia, which threaten the security and prosperity of the U.K. and its allies.

The U.S. Treasury Department also criticized Russia for harboring and supporting cyber criminals who launch ransomware attacks against the U.S. and other countries, targeting their businesses and critical infrastructure. The Treasury Department urged Russia to take action to stop cyber criminals from operating freely in its territory.

“Russian cyber actors continue to launch disruptive ransomware attacks against the United States and allied countries, targeting our businesses, including critical infrastructure, to steal sensitive data,” said Under Secretary of the Treasury Brian E. Nelson.

“This action demonstrates that the United States stands with our partners to disrupt ransomware actors who victimize the backbone of our economies and critical infrastructure,” the Treasury Department said.

A cyberattack on Reddit in February, in which the threat actors claimed to have stolen 80GB of data from the company, was carried out by the BlackCat (ALPHV) ransomware gang.

Reddit revealed on February 9 that a phishing attack on an employee on February 5 resulted in the hacking of its systems.

The threat actors were able to access Reddit’s systems through a phishing attack, stealing internal documents, source code, employee data, and limited information about the company’s advertisers.

In a post, Reddit CTO Christopher Slowe, aka KeyserSosa, explained, “After successfully obtaining the credentials of a single employee, the attacker gained access to some internal documents, code, as well as some internal dashboards and business systems.”

“We don’t show any signs of a breach in our primary production systems,” which are the parts of our stack that run Reddit and store most of our data.

However, Reddit stated that neither user passwords nor credit card information nor production systems were compromised.

Reddit did not provide many details about the phishing attack, but they did say that it was similar to a Riot Games phishing attack that allowed hackers to gain access to systems and steal source code for League of Legends (LoL), Teamfight Tactics (TFT), and the Packman legacy anti-cheat platform of the company.

The threat actors demanded $10 million from Riot during the attack to prevent the leak of the stolen data. However, the threat actors attempted to sell the data on a hacking forum for $1 million if a ransom was not paid.

The ALPHV ransomware operation, more commonly referred to as BlackCat, now asserts that it was behind the February 5th cyberattack on Reddit. This information was first discovered by Dominic Alvieri and shared with BleepingComputer.

The threat actors claim to have stolen 80 GB of compressed data from the company during the attack and now plan to leak the data in a “Reddit Files” post on the gang’s data leak site.

The perpetrators of the threat claim that they attempted to get in touch with Reddit twice, on April 13 and June 16, and demanded $4.5 million in exchange for the deletion of the data.
“In my first email, I told them that I would wait for their IPO.” However, this seems like the ideal occasion! We are exceptionally sure that Reddit won’t pay any cash for their information,” compromised the ransomware activity.

“However, I am overjoyed to learn that the public will be able to read about all of the statistics they track about their users as well as all of the fascinating confidential data we collected. Did you know that they also censor users in secret? together with items from their GitHub!”

BleepingComputer has been able to confirm that this is the same attack that was disclosed by Reddit in February, despite the fact that Reddit declined to make any comments regarding BlackCat’s post.

Despite the fact that BlackCat is a group responsible for ransomware, they did not encrypt any devices during this attack.

A similar attack on Western Digital in March 2023, which resulted in a significant outage of the company’s My Cloud cloud service, is thought to have been carried out by the same hacking group.

The Western Digital attack’s perpetrators initially denied having a name, but screenshots of the stolen data were leaked on the ALPHV data leak website, where the perpetrators taunted the company about the attack.

In May, Western Digital sent notifications about data breaches to customers of its online stores, advising them that their data had been stolen during the attack.

In order to carry out sextortion attacks, the Federal Bureau of Investigation (FBI) is warning of a growing trend of malicious actors creating deepfake content.

Sextortion is a form of online blackmail in which nefarious individuals threaten their victims by publicly leaking explicit images and videos that they have obtained through coercion or hacking, typically in exchange for financial compensation.

The threat actors only pretend to have access in many instances of sextortion in order to frighten victims into paying an extortion demand.

The FBI warns that sextortionists are now scraping innocent images and videos posted on social media platforms of their targets. After that, these images are fed into deepfake content creation tools, which transform them into sexually explicit content that is generated by AI.

Even though the produced images or videos are not real, they appear very real, allowing the threat actor to use them for extortion by sending them to the target’s family, coworkers, etc. could still cause victims significant harm to their personal and public image.

The alert that was made available on the IC3 portal of the FBI states, “As of April 2023, the FBI has observed an uptick in sextortion victims reporting the use of fake images or videos created from content posted on their social media sites or web postings, provided to the malicious actor upon request, or captured during video chats.”

“In light of ongoing casualty announcing, the pernicious entertainers regularly requested: 1. Threats to share the images or videos with family members or friends on social media if funds were not received in the form of payment (such as cash or gift cards); or 2. The victim sends real videos or images with a sexual theme.”

According to the FBI, explicit content creators sometimes post their videos directly to pornographic websites without first extorting the victims, exposing them to a large audience without their consent.

Sextortionists sometimes make use of these now-public uploads to exert even more pressure on the victim by requesting payment to remove the uploaded photos and videos from the websites.

Unfortunately, the FBI reports that this media manipulation activity has also affected minors.

How to stay safe All internet users, especially those in sensitive categories, face a hostile environment as capable AI-enabled content creation tools become more widely available.
On GitHub, there are a number of free content creation tool projects that can create realistic videos from a single image of the target’s face without the need for additional training or data.

Many of these tools have safeguards built in to prevent misuse, but those sold on dark web markets and underground forums do not.
Parents should keep an eye on their children’s online activities and talk to them about the dangers of sharing personal media online, according to the FBI.

Additionally, parents should conduct online searches to ascertain their children’s online exposure and take any necessary action to remove content.

To reduce exposure, adults who post images or videos online should restrict access to a small private group of friends. In addition, children’s faces ought to always be masked or blurred.

Last but not least, if you find deepfake content about you on pornographic websites, report it to the authorities and get in touch with the hosting platform to ask for the media to be taken down.

The non-consensual sharing of deepfakes has recently been made a crime in the United Kingdom thanks to an amendment to the Online Safety Bill.