ICANN Warns .top Domain About Phishing

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, ICANN warned of phishing, BreachForums data was leaked, police arrested alleged pro-Russian hackers, the U.K shut down a DDoS booter site, the EU gave Meta a deadline, Russia decried U.S. sanctions, Verizon settled on breaches, and Windows 10 security support will end in October 2025.

See Also: Webinar | Everything You Can Do to Fight Social Engineering and Phishing

The Chinese company managing the .top top-level domain has until mid-August to implement systems for handling phishing reports and suspending abusive domains, or it will lose its license, warned the Internet Corporation for Assigned Names and Numbers. The warning follows findings that .top was the second-most-common suffix in phishing websites last year, after .com.

ICANN sent a letter to the .top domain registry – operated by Jiangsu Bangning Science & Technology Co. according to reporting from Brian Krebs – criticizing the registry for not responding to phishing reports.

“Based on gathered information, .TOP Registry lacks a prompt and comprehensive process to investigate and act on DNS Abuse reports,” the letter says.

A Tuesday report from Interisle Consulting Group says that .top domains are heavily used in phishing attacks and that more than 117,000 phishing sites were found between May 2023 and April 2024 among the 2.76 million .top domains.

Details of users from the original BreachForums website, gathered by its now-convicted admin, leaked entirely online on Tuesday, Cybernews reported.

The database originates from a backup allegedly sold by Conor Fitzpatrick, aka Pompompurin, who launched BreachForums v1 in 2022 after RaidForums was seized (see: How BreachForums’ ‘Pompompurin’ Led the FBI to His Home).

Initially shared with Have I Been Pwned, the database was not publicly released until this weekend. The leak began with the threat actor “Emo,” who released a partial tranche of member data after being banned from the current iteration of BreachForums. By Tuesday night, Emo leaked the entire database on Telegram.

The database includes member names, email addresses, IP addresses, private messages, threads, payment logs and detailed IP logs up to Nov. 29, 2022.

The Spanish Civil Guard arrested three suspected members of the pro-Russian hacker group NoName057(16), known for conducting distributed denial-of-service attacks against Ukraine’s allies. The national gendarmerie force announced on Saturday that they searched suspects’ apartments in Huelva, Seville and the Mallorcan city of Manacor, seizing devices and evidence.

Police alleged the suspects participated in DDoS attacks targeting public institutions and strategic sectors in Spain and other NATO countries supporting Ukraine. These attacks overwhelm websites with traffic, rendering them inaccessible.

Formed at the start of Russia’s invasion of Ukraine in 2022, NoName057(16) uses a custom DDoS toolkit called DDoSia that enables even nonprofessionals to participate in cyberwarfare.

Spanish police said NoName is one of the most active groups attacking Ukraine and its allies. NoName denounced the actions as a “witch hunt.”

Kremlin-supported hacktivism has rarely risen beyond the level of nuisance. Security researchers earlier this year reported that the number of self-proclaimed, pro-Kremlin hacktivists appears to be dwindling (see: Down, Not Out: Russian Hacktivists Claiming DDoS Disruptions).

British law enforcement agencies took down DDoS booter site Digitalstress.su, after arresting one of the site’s suspected administrators in Northern Ireland earlier in July. The site facilitated tens of thousands of attacks worldwide, the U.K. National Crime Agency said.

In a joint operation with the Police Service of Northern Ireland and the FBI that began in 2022, the NCA infiltrated the site. Authorities dismantled its infrastructure and disabled the website’s functionalities.

Despite attempts by site administrators to evade capture using the .su Soviet domain, the NCA created a mirror site to redirect users to a fake, police-controlled platform, allowing the agency to access communications covertly and overtly.

The NCA plans to use information from the site to pursue action against users globally. “Booter services are an attractive entry-level cybercrime,” said Paul Foster, head of the NCA’s National Cyber Crime Unit. “Anyone using these services while our mirror site was in place has now made themselves known to law enforcement agencies around the world.”

Social media giant Meta has until Sept. 1 to respond to the European Union’s concerns about its “pay or consent” access model for Facebook and Instagram. Since November, Meta has given users a choice between agreeing to tracking for targeted ads or paying for ad-free access.

A collection of European regulators responsible for enforcing consumer protection laws known as the Consumer Protection Cooperation Network is probing whether this practice involves misleading or aggressive tactics. The pay model has drawn scrutiny from multiple regulators, including the European Commission and the Irish Data Protection Commission, for potential breaches of the Digital Markets Act and the General Data Protection Regulation.

The CPC, led by France’s Directorate General for Competition Policy, Consumer Affairs, and Fraud Control, criticized Meta’s use of ambiguous terms and its pressure on users to make a quick decision.

A Meta spokesperson defended the model, claiming it aligns with European regulations.

If Meta fails to comply, national consumer protection authorities could impose fines of up to 4% of the company’s global annual revenue.

Russia’s embassy in the United States condemned recent U.S. sanctions against two members of the Kremlin-aligned hacktivist group Cyber Army of Russia Reborn, calling them part of a “propaganda campaign” against Russia. The U.S. Department of the Treasury on Friday imposed sanctions on Yuliya Pankratova and Denis Degtyarenko, naming them as members of CARR and the operators of cyber operations targeting critical infrastructure in the U.S. and Europe, as well as minor operations against Ukraine.

In response to the sanctions, CARR celebrated on its Telegram channel, saying it views the sanctions as a form of recognition.

Verizon Communications agreed to a $16 million settlement with the U.S. Federal Communications Commission following three data breaches at its subsidiary, TracFone Wireless. The incidents occurred between 2021 and 2023 and exposed sensitive customer information.

The first breach, reported on Jan 14, 2022, involved unauthorized access to customer data starting in January 2021, was due to vulnerabilities with authentication and APIs. The subsequent breaches in December 2022 and January 2023 involved vulnerabilities on TracFone’s order websites, and attackers used multiple methods to access customer information.

The settlement requires Verizon to enhance its data security by Feb. 28, 2025. This includes developing a robust information security program, implementing protections for SIM changes and port-out requests, conducting annual security assessments and providing yearly employee training on privacy and security.

Guerilla patching service 0patch vowed it will support Windows 10 with low-cost fixes well past Microsoft’s planned October 2025 sunset for security updates and technical support.

That date will mark the beginning of “a slow decline into an increasingly vulnerable state as new vulnerabilities are discovered, published and exploited that remain indefinitely present on these computers,” 0patch said in a June blog post that just came to our attention.

The transition from one Windows version to another always brings annoyances and complaints, but the intensity of the resistance to Windows 11 is growing as awareness spreads of pitfalls such as upgraded hardware requirements, a desktop newly littered with ads and Microsoft’s hard-nosed insistence on users signing into a user account. Microsoft also didn’t do itself any favors by touting Recall, its Windows 11 automatic screenshot feature indexed by artificial intelligence (see: Microsoft Backtracks on Recall Rollout).

0patch, a project of Solvenian cybersecurity company Acros, said it will provide critical Windows 10 security patches for at least five more years after Microsoft’s sunset date – and “even longer if there’s demand on the market.”

Microsoft won’t entirely abandon Windows 10 next year, but its “extended security updates” program for commercial users will double in cost every consecutive year. The company won’t reveal prices for consumer support until around fall 2025.

Other Coverage From Last Week

With reporting from Information Security Media Group’s Akshaya Asokan in Southern England.