Over 12,000 Google Users Hit by Government Hackers in 3rd Quarter of 2019

guest · Nov 27, 2019

Over 12,000 Google Users Hit by Government Hackers in 3rd Quarter of 2019
November 27, 2019
https://thehackernews.com/2019/11/google-government-hacking.html

As part of its active efforts to protect billions of online users, Google identified and warned over 12,000 of its users who were targeted by a government-backed hacking attempt in the third quarter of this year.

According to a report published by Google's Threat Analysis Group (TAG), more than 90 percent of the targeted users were hit with "credential phishing emails" that tried to trick victims into handing over access to their Google account.
The alerts were sent to targeted users between July and September 2019, which is consistent within a +/-10 percent range of the number of phishing email warnings sent in the same period of 2018 and 2017, the company said.

"We encourage high-risk users—like journalists, human rights activists, and political campaigns—to enroll in our Advanced Protection Program (APP), which utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings. APP is designed specifically for the highest-risk accounts," Google said.
Click to expand...

Google: Protecting users from government-backed hacking and disinformation

guest · Mar 26, 2020

Google sent users 40,000 warnings of nation-state hack attacks in 2019
March 26, 2020
https://arstechnica.com/information...arnings-of-nation-state-hack-attacks-in-2019/

Google’s threat analysis group, which counters targeted and government-backed hacking against the company and its users, sent account holders almost 40,000 warnings in 2019, with government officials, journalists, dissidents, and geopolitical rivals being the most targeted, team members said on Thursday.

The number of warnings declined almost 25 percent from 2018, in part because of new protections designed to curb cyberattacks on Google properties. Attackers have responded by reducing the frequency of their hack attempts and being more deliberate.

“Government-backed attackers regularly target foreign policy experts for their research, access to the organizations they work with, and connection to fellow researchers or policymakers for subsequent attacks,” Toni Gidwani, a security engineering manager in the threat analysis group, wrote in a post.
Click to expand...

Google: Identifying vulnerabilities and protecting you from phishing

Minimalist · Mar 27, 2020

An Elite Spy Group Used 5 Zero-Days to Hack North Koreans

Most North Koreans don't spend much of their lives in front of a computer. But some of the lucky few who do, it seems, have been hit with a remarkable arsenal of hacking techniques over the last year—a sophisticated spying spree that some researchers suspect South Korea may have pulled off.

Cybersecurity researchers at Google's Threat Analysis Group revealed on Thursday that an unnamed group of hackers used no fewer than five zero-day vulnerabilities, or secret hackable flaws in software, to target North Koreans and North Korea-focused professionals in 2019.
Click to expand...

https://www.wired.com/story/north-korea-hacking-zero-days-google/

guest · May 28, 2020

Cyprus among countries hardest hit by wave of hackers
May 28, 2020
https://cyprus-mail.com/2020/05/28/cyprus-among-countries-hardest-hit-by-wave-of-hackers/

Cyprus is among the countries hardest hit by new ‘hack-to-hire’ firms that have created Gmail accounts aimed at hacking corporations, Reuters reported on Thursday.

According to the report, Google said on Wednesday its Threat Analysis Group saw new activity from such firms, many based in India, that have been creating Gmail accounts spoofing the World Health Organisation (WHO).
Following a resurgence in hacking and phishing attempts related to the coronavirus outbreak, security experts at Alphabet Inc’s Google sent 1,755 warnings in April to users whose accounts were targets of attackers.

Cyprus is one of the countries where the accounts targeted business leaders in financial services, consulting and healthcare corporations.
Click to expand...

Google: Updates about government-backed hacking and disinformation

On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.
Hacking and phishing attempts
Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.

Our hope is that this new bulletin helps others who are also working to track these groups, such as researchers studying this issue, and we hope these updates can help confirm findings from security firms and others in the industry.
Click to expand...

Our actions against coordinated influence operations from January, February and March can be found in the Q1 Bulletin.
Click to expand...

guest · Oct 16, 2020

Google warned users of 33,000 state-sponsored attacks in 2020
October 16, 2020
https://www.bleepingcomputer.com/ne...rs-of-33-000-state-sponsored-attacks-in-2020/

Google delivered over 33,000 alerts to its users during the first three quarters of 2020 to warn them of state-sponsored phishing attacks targeting their accounts.

"In these cases, we also shared our findings with the campaigns and the Federal Bureau of Investigation," Shane Huntley, Director at Google's Threat Analysis Group (TAG), said.
The prominent reminders sent to Google users targeted in government-backed attacks were displayed even when the hacking attempts were blocked to inform them of the danger.
Click to expand...

In all, Google sent 33,015 government-backed phishing warnings in 2020 until now, with 11,856 alerts sent during Q1 2020, 11,023 in Q2 2020, and 10,136 in Q3 2020.

In March, Google said that it delivered around 40,000 alerts of state-sponsored phishing or malware hacking attempts during 2019, with a 25% drop compared to 2018.
North Korean APTs were also observed by Google while switching targets to focus on "COVID-19 researchers and pharmaceutical companies."
Click to expand...

Google:
TAG Bulletin: Q2 2020
TAG Bulletin: Q3 2020
How we're tackling evolving online threats

In June, we announced that we saw phishing attempts against the personal email accounts of staffers on the Biden and Trump campaigns by Chinese and Iranian APTs (Advanced Persistent Threats) respectively. We haven’t seen any evidence of such attempts being successful.

The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links. As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns.
Click to expand...

When we detect that a user is the target of a government-backed attack, we send them a prominent warning.
Click to expand...

guest · Oct 7, 2021

Google notifies 14,000 Gmail users of targeted APT28 attacks
October 7, 2021
https://therecord.media/google-notifies-14000-gmail-users-of-targeted-apt28-attacks/

Google has sent email notifications to more than 14,000 Gmail users that they’ve been the target of a spear-phishing attack orchestrated by a state-sponsored hacking group.

“In late September, we detected an APT28 phishing campaign targeting a large volume of Gmail users (approx 14,000) across a wide variety of industries,” Shane Huntley, Director of Google’s Threat Analysis Group, told The Record in an email, following an inquiry about the number of users who took to social media to post the message they received from Google.
“Firstly these warnings indicate targeting NOT compromise. If we are warning you there’s a very high chance we blocked,” Huntley said in a separate Twitter thread.

Huntley, who leads the TAG team, a Google security division focused on hunting apex threat actors, said they blocked all the emails sent by the APT28 group in this campaign.
Click to expand...

APT28 has been one of the most active threat actors over the past decade, and the group has often relied on spear-phishing emails to go after targets of interest. Their aim is to breach inboxes, get access to sensitive documents and communications, and then pivot to other individuals or internal networks.

“If you received a warning or are a high-risk user, journalist, politician, celebrity, or CEO, we recommend you enroll in the Advanced Protection Program for work and personal emails,” Huntley said in an email, promoting a Google program meant to add and activate additional security protections to high-risk accounts.
Click to expand...

guest · Oct 14, 2021

Google sent 50,000 warnings of state-sponsored attacks in 2021
October 14, 2021
https://www.bleepingcomputer.com/ne...-warnings-of-state-sponsored-attacks-in-2021/

Google said today that it sent roughly 50,000 alerts of state-sponsored phishing or hacking attempts to customers during 2021, a considerable increase compared to the previous year.

"So far in 2021, we’ve sent over 50,000 warnings, a nearly 33% increase from this time in 2020," said Ajax Bash, a Google security engineer working with the company's Threat Analysis Group (TAG).
"On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries. This means that there is typically more than one threat actor behind the warnings."
Google sends government-backed attack alerts when detecting phishing attempts, brute-force attacks, malware delivery attempts launched from infrastructure linked to known government-sponsored threat groups.
Click to expand...

Russian and Iranian threat actors stand out
This year, the most notable campaigns targeting Google users were coordinated by the Russian-backed APT28 (aka Fancy Bear) hacking group linked to the GRU Russian military intelligence agency and APT35 (aka Charming Kitten), an Iranian threat actor active since at least 2014.

All phishing emails sent in this massive Fancy Bear campaign were blocked by Gmail and didn't make it in the targets' inboxes, as they were automatically classified as spam.
APT35 also had a very active year, hijacking accounts, deploying malware, and coordinating espionage campaigns to collect confidential info for the Iranian government.
Click to expand...

Google: Countering threats from Iran

Google’s Threat Analysis Group tracks actors involved in disinformation campaigns, government backed hacking, and financially motivated abuse. We have a long-standing policy to send you a warning if we detect that your account is a target of government-backed phishing or malware attempts. So far in 2021, we’ve sent over 50,000 warnings, a nearly 33% increase from this time in 2020. This spike is largely due to blocking an unusually large campaign from a Russian actor known as APT28 or Fancy Bear.

In this blog, we explore some of the most notable campaigns we’ve disrupted this year from a different government-backed attacker: APT35, an Iranian group, which regularly conducts phishing campaigns targeting high risk users.
For years, this group has hijacked accounts, deployed malware, and used novel techniques to conduct espionage aligned with the interests of the Iranian government.
Click to expand...

Log in or Sign up

Over 12,000 Google Users Hit by Government Hackers in 3rd Quarter of 2019

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Over 12,000 Google Users Hit by Government Hackers in 3rd Quarter of 2019

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches