Over recent months, Guardicore researchers have identified a cyber crime group they have called “Prowli”, who have been conducting a wide-ranging campaign using an array of techniques to infect more than 40,000 machines at 9,000 companies globally.

They have used various techniques like exploits and password brute-forcing to spread malware and take over devices, such as website content management systems (CMS), web servers, modems, and Internet-of-Things (IoT) devices.

On Saturday, 9 June, Coinrail, a South Korean cryptocurrency exchange, announced that they had been the victim of a data breach, leading to the loss of an estimated $40 million in altcoins.

The attackers are believed to have stolen 1,927 ether, 2.6 billion NPXS, 93 million ATX and 831 million DENT coins, alongside significant amounts from six other tokens, representing 30% of Coinrail’s total coin and reserves. However, Coinrail claim that two thirds of the stolen coins have either been frozen or withdrawn so far, with further recovery action likely to happen.

We have previously reported on the SamSam ransomware attack on the City of Atlanta (initial report and a follow-up report on the costs of recovery). Recent media reporting has revealed that video files containing police dashcam footage were encrypted during the attack and cannot be recovered.

Fraudulent account activity and identity theft are some of the most common threats on the internet. Cyber criminals often use credential-stealing malware to obtain usernames and passwords.

Armed with a victim’s credentials, criminals can access their online accounts, including social media or online banking, most often with the intent of making fraudulent payments.

An NCSC statement following the reported cyber incident involving Ticketmaster.

A spokesperson for the National Cyber Security Centre (NCSC) said:

“We are aware of a cyber incident affecting Ticketmaster.

“The NCSC is working with our partners to better understand the data breach.