Maj Sumit Sharma

We have published the CostaRicto Campaign cyber analysis under LEX BlackRose Cyber Threat Intelligence Response Team. The CostaRicto campaign is a cyber espionage operation attributed to a mercenary group targeting organizations, primarily in various countries in South Asia. This group uses sophisticated techniques, including custom-built malware and advanced operational security methods. Over time, this campaign has evolved into a structure that integrates multiple threat actors, expanding to include a broader array of criminal activities. The targets typically include organizations in sectors such as finance, information technology, and government institutions, indicating an interest in collecting valuable or sensitive data. The group demonstrates advanced OpSec practices, routing their traffic through Tor, SSH tunnels, and proxies to mask their activities and make attribution more difficult. Some of the domains they use mimic legitimate ones, for example, sbibd[.]net, which resembles a legitimate banking institution, SBI BD. This helps facilitate phishing and other social engineering attacks. It has been observed that CostaRicto exploits known vulnerabilities and misconfigurations in systems to gain initial access and maintain persistence in targeted environments. Initial reports were previously published by BlackBerry security teams. For those conducting research in the field of threat hunting, this case file provides significant research points on cyber espionage. The following report was written by the LEX Program BlackRose Cyber Threat Intelligence Response Team. Thanks to the entire team. Bookmark this for future reference, cyberpunks! ^-^ hashtag #cybersecurity hashtag #informationsecurity hashtag #threatintelligence hashtag #threathunting hashtag #cyberespionage hashtag #dataprivacy hashtag #privacy hashtag #lexprogram

3

My piece in ET. The central message being,” If each phone number and each bank account can be traced and leads the authorities to the culprit, the menace can be checked to quite an extent...” Read more at: https://lnkd.in/gywBUgzw

33

6 Comments

Honoured to participate in a stimulating panel discussion at the NASSCOM - Data Security Council of India Annual Information Security Summit (AISS) 2024 on "Digital Forensics at the Crossroads – The Automation Mandate in the Modern DFIR( Digital Forensics and Incident Response)," held on 5th December 2024 at Hotel Pullman, Aerocity, Delhi. As the complexities of cybercrime evolve, the integration of automation into Digital Forensics and Incident Response (DFIR) is not just an option but a necessity. During the discussion, we explored the transformative power of automation in enhancing the efficiency and accuracy of forensic investigations, while also addressing challenges such as ethical concerns and maintaining the integrity of evidence. I extend my gratitude to Mr. Venkatesh Murthy. K Senior Director, Data Security Council of India for inviting me to such an exciting forum. I am all praise for the deep insight and invaluable knowledge shared by my co-panelists Dr. Gaurav Gupta Scientist, Ministry of Electronics and Information Technology and Niels Renken, Solution Consultant Magnet Forensics on this evolving field. It’s clear that the future of digital forensics lies in striking a right balance between human expertise and automation driven by technological advancements such as AI & ML. Together, we can shape a more efficient, scalable, and secure future for digital investigation. #CyberSecurity #AI #DigitalSafety #ForensicScience #LawEnforcementInnovation #SmartPolicing #PublicSafety #BShankerJaiswalIPS #DelhiPolice #AISS2024

120

8 Comments

SEBI(Securities and Exchange Board of India)🏦⚖️ Cybersecurity and Cyber Resilience Framework (CSCRF) 🖥️🖱️ Dated: 20th August'24 v1.0🗓️ Objective:💡 The key objective of CSCRF is to address evolving cyber threats👾, to align with the🪙industry standards, to encourage efficient audits,🔍 and to ensure compliance by SEBI REs. The CSCRF also sets out stand🎯 📑The framework will be implemented in two phases -- one set of entities has to ensure compliance by January 1, 2025, and another set by April 1, 2025.

2

Sattrix Information Security files draft papers with BSE SME for IPO, targets listing by mid-May | Mint - Mint: Sattrix Information Security files draft papers with BSE SME for IPO, targets listing by mid-May | Mint  Mint #CyberSecurity #InfoSec #SecurityInsights

1

Cybercrooks are no tech geeks, but most are smart storytellers: DCP Cyber Crime. Read more at: https://lnkd.in/dQW5ZbhJ by Deccan Herald. Facing issues with #CyberCrime storytellers? RTIwala can guide you on how to stay protected. Visit https://cc.rti.link/lic for more information. #RTIwala #Legaltech #FraudPrevention #StaySafeOnline #CyberSecurity

1

1 Comment

Securing India's Financial Sector: The SEBI Cybersecurity Framework Explore how SEBI’s comprehensive Cybersecurity and Cyber Resilience Framework (CSCRF) strengthens the defenses of regulated entities against evolving threats. From mandatory WAF and API security deployment to continuous monitoring, this framework is essential for resilience and compliance for all REs. #PageNTRA #SiteWALL #CyberSecurity #SEBI #FinancialSector #Resilience #Compliance #SiteWALL #WebApplicationFirewall #CyberResilience #ThreatPrevention #DigitalSecurity #InfoSec #RiskManagement #CIO #CIOS #CISO #CISOS #VAPT #IncidentResponse

20

1 Comment

Message Recieved at date: May 14, 2024, 5:12 PM Letter CPV/2024/05/14-03-Revised        Dated 14.05.2024 To: CTO, Employees, Interns, Volunteers, Cyber Privilege Pvt. Ltd. Subject: Immediate Compliance Required for Status Report Submissions Dear Team, It has come to our attention that there have been significant lapses in the submission of daily and weekly status reports by employees, interns, and volunteers. This is unacceptable and will no longer be tolerated. Effective immediately, all employees, interns, and volunteers are required to submit their Daily Status Reports and Weekly Status Reports without fail. These reports must be ready for review during the weekend meetings. This directive follows the instructions laid out in our CEO's letter and the Board of Resolution Letter CPV/2024/05/14-01 dated 14.05.2024. Furthermore, you must follow up on any client assignments promptly. This applies to tasks assigned by the CEO, CTO, or HR. The CTO will also receive directives from the CEO and HR. Failure to comply with these instructions will have serious consequences. For employees, this could mean the withholding of your salary, which will otherwise be released on time by May 31st. For interns, any instances of poor performance or non-compliance will be reported to the respective Head of Department at your college or university. This could lead to the cancellation of your internship and the withholding of your internship certificate and incentives. Volunteers will face similar consequences, including the withholding of volunteer certificates and perks. We expect all team members to perform their duties diligently. Ensure that your work is thoroughly reviewed before submission. Any instance of poor performance or failure to meet the required standards will be reported directly to the CEO and his instructions to HR hr@cyberprivilege.com and the Accounts Department, Mr. K. Satya accounts@cyberprivilege.com, which could result in severe repercussions. We have high expectations for everyone associated with Cyber Privilege Pvt. Ltd. Do not take this lightly. This is a final warning. Take your responsibilities seriously and ensure compliance immediately. With Warm Regards, Smt. K. Jaya Naidu | श्रीमती के जया नायडू HR Manager | मानव संसाधन प्रबंधक, Cyber Privilege Pvt. Ltd | साइबर प्रिविलेज प्रा. लि. Hyderabad, Telangana, India. हैदराबाद, तेलंगाना, भारत. Email : hr@cyberprivilege.com Website: www.cyberprivilege.com

1

Message Recieved at date: May 14, 2024, 5:12 PM Letter CPV/2024/05/14-03-Revised        Dated 14.05.2024 To: CTO, Employees, Interns, Volunteers, Cyber Privilege Pvt. Ltd. Subject: Immediate Compliance Required for Status Report Submissions Dear Team, It has come to our attention that there have been significant lapses in the submission of daily and weekly status reports by employees, interns, and volunteers. This is unacceptable and will no longer be tolerated. Effective immediately, all employees, interns, and volunteers are required to submit their Daily Status Reports and Weekly Status Reports without fail. These reports must be ready for review during the weekend meetings. This directive follows the instructions laid out in our CEO's letter and the Board of Resolution Letter CPV/2024/05/14-01 dated 14.05.2024. Furthermore, you must follow up on any client assignments promptly. This applies to tasks assigned by the CEO, CTO, or HR. The CTO will also receive directives from the CEO and HR. Failure to comply with these instructions will have serious consequences. For employees, this could mean the withholding of your salary, which will otherwise be released on time by May 31st. For interns, any instances of poor performance or non-compliance will be reported to the respective Head of Department at your college or university. This could lead to the cancellation of your internship and the withholding of your internship certificate and incentives. Volunteers will face similar consequences, including the withholding of volunteer certificates and perks. We expect all team members to perform their duties diligently. Ensure that your work is thoroughly reviewed before submission. Any instance of poor performance or failure to meet the required standards will be reported directly to the CEO and his instructions to HR hr@cyberprivilege.com and the Accounts Department, Mr. K. Satya accounts@cyberprivilege.com, which could result in severe repercussions. We have high expectations for everyone associated with Cyber Privilege Pvt. Ltd. Do not take this lightly. This is a final warning. Take your responsibilities seriously and ensure compliance immediately. With Warm Regards, Smt. K. Jaya Naidu | श्रीमती के जया नायडू HR Manager | मानव संसाधन प्रबंधक, Cyber Privilege Pvt. Ltd | साइबर प्रिविलेज प्रा. लि. Hyderabad, Telangana, India. हैदराबाद, तेलंगाना, भारत. Email : hr@cyberprivilege.com Website: www.cyberprivilege.com

3

#Reporting #cyber fraud to the police is vital, as seen with Mumbai Police's recovery of Rs 100 crore and their resolution of 35,918 complaints. The #helpline #1930 has been instrumental, demonstrating that "prompt reporting empowers authorities to take swift action and protect victims." Read complete article below: https://lnkd.in/gNgYgeiU

18

Arrests in digital arrest case This proves that when someone wants such scams can be investigated & concluded. It’s a good news, look forward to mow such action in scam cases. #digitalarrest #fraud #police https://lnkd.in/dKegWEtu

13

SEBI Circular No. CIR/MRD/DoG/11/2023, issued on November 21, 2023, highlights the critical role of cybersecurity for Market Infrastructure Institutions (MIIs). MIIs should perform business continuity drills on a regular basis to assess the organization's resilience and the effectiveness of existing ground-level security policies in dealing with attacks by ransomware. MIIs are also required to check for and fix vulnerabilities, especially those on internet-facing devices, in order to reduce the attack surface. MIIs should conduct cybersecurity user education and training, including regulations on identifying and reporting unusual behaviour. MIIs must take the steps required to put in place processes for implementing the circular, including any modifications that are required to the applicable bye-laws, rules, and regulations, by 120 days of the circular's date. Get customized #VAPT and #SOC solutions from Breachseal right away. The activities performed by Breachseal personnel within the SOC are:  https://lnkd.in/g8WwkfGr Learn our VAPT services: https://lnkd.in/gSMsbkys You can also check Continuous risk assessment process here. You can reach us at contact@breachseal.com #Cybersecurity #RBICircular #Banks #US #Canada #Singapore #India #Australia #CyberThreat #SOC

2

RBI warns banks to strengthen security amid potential cyberattacks, with 69% of such incidents reported by scheduled commercial banks. Banks are urged to closely monitor systems like SWIFT, card networks, RTGS, NEFT, and UPI to ensure robust defense against threats. Banks must implement standard controls to guard against DDoS attacks, restrict remote logins to critical systems, and conduct thorough scans for viruses and malware. Ensuring the latest patches are installed and maintaining robust offline backup and recovery strategies are also essential. Connect with Netrika for routine network security assessments to fortify your financial institution against cyber attacks. For more information, read the article below: https://bit.ly/3zpUQYw #netrika #netrikasolutionindia #netrikaconsultingindia #cyberattacks #cybersecurity #bankfrauds #bankfraud #bankingindustry #banking #indianbanks #rbi #cyberhygiene

14

Concluding on a high note, Bharat National Cyber Exercise (NCX) 2024 has emerged as a cornerstone in shaping India’s cybersecurity preparedness and resilience. Under the esteemed guidance of the National Security Council Secretariat (NSCS), this flagship initiative brought together over 600 cybersecurity practitioners, policymakers, defense personnel, industry experts, and academicians to address the evolving landscape of cyber. The hands-on scenarios, strategic workshops, and cross-sector collaborations reaffirmed the importance of teamwork, innovation, and proactive action in securing our nation’s digital infrastructure. NCX 2024 not only highlighted current challenges but also inspired futuristic solutions to safeguard India’s digital sovereignty. It was a proud moment to see the collective commitment to Nation First, Always First, driving every discussion and initiative during the exercise. Grateful to NSCS, the organizing teams, mentors, and participants for their unwavering dedication and invaluable contributions. Together, we have taken another bold step towards building a cyber-aware, secure, and resilient India. #NationFirstAlwaysFirst #BharatNCX2024 #BharatNCX #NCX #CyberSecurity #CyberSecurityAwareness #CyberSecurityThreats #CyberSecurityExperts #DigitalIndia #Innovation

98

5 Comments

🚨 Tata Informasi Asia (TIA) Data Breach Alert 🚨 A threat actor has claimed to expose a database containing 68,235 user records on a dark web forum. The incident involves Tata Informasi Asia (TIA)—a company recognized for delivering dynamic business solutions across HR, training, and digital transformation. 📊 Key Breach Details: Total Records Leaked: 68,235 Users File Size: 87,793 Lines Leak Date: Today 🔍 Why This Matters: Sensitive User Data: Personal information can be exploited for identity theft, fraud, and phishing attacks. Reputation Damage: Such breaches undermine trust and can trigger legal or regulatory consequences. Cyber Threat Escalation: Exposed data can fuel further targeted cyberattacks. 🚨 Action Required: Protect Your Data! 🚨 At DMonitor,we specialize in real-time data breach monitoring and exposure prevention. With tools like dMonitor, we help businesses and individuals proactively track compromised data, ensuring you're alerted before threats escalate. 👉 Visit dmonitor.io for 24/7 monitoring and protection! #CyberSecurity #DataBreach #DarkWeb #PrivacyProtection #TIABreach #InfoSec

2

One cyber incident or data breach can lead to data loss of millions of data and people records. And, also have a strong impact on organisations financial and reputation loss. Cyber Security plays a very important part in the current threat landscape to protect the business and people from hackers. Understanding the importance of cyber security and business resilience, I have penned down some thoughts on "Why Cyber Recovery is Important"! #dataprotection #cyberresilience #datadriven #Privacymatters

16

1 Comment