Mr. Cooper Recovers From Hacking Incident

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, mortgage lender Mr. Cooper recovered from a cyberattack, ChatGPT struggled with distributed denial-of-service attacks, a cybercrime group’s business model was exposed, hackers stole data of loyalty club members of Marina Bay Sands in Singapore, South Korean and the United States aim to enhance cybersecurity cooperation, and an Iranian-linked threat group has been targeting Israeli higher education and technology organizations since January.

See Also: Live Webinar | Generative AI: Myths, Realities and Practical Use Cases

Texas-based mortgage lender Mr. Cooper restarted operations, including taking payments, on Saturday following a four-day shutdown caused by an Oct. 31 hacking incident at the company. The lender told federal regulators Thursday that it has yet to originate new loans but expects to do so soon, “following reestablishment of connectivity with vendors and agencies.”

“Certain customer data was exposed, however it will require additional analysis to validate this finding and quantify the scope and type of any such exposure,” the company said. It told customers on its website that it won’t assess late fees or penalties for late payments caused by the incident. In an earlier regulatory filing, the company said it had shut down systems “as a precautionary measure” after detecting an intrusion by an unauthorized third party.

The company serves approximately $937 billion in loans and more than 4.3 million customers. It told regulators it does not believe the incident will “be material to our results of operations or financial conditions.” Credit rating agency Moody’s released a statement Tuesday calling the incident “credit-negative.”

“The full impact of the event will depend on duration of the disruptions, ensuing potential reputational damage, and magnitude of the breach,” said Stephen Lynch, a Moody’s vice president.

ChatGPT maker OpenAI confirmed the ongoing system outage experienced by the artificial intelligence-powered chatbot is the result of a distributed denial-of-service attack.

The company’s large language model-powered ChatGPT has been intermittently available since Tuesday following attacks that affected the operations of the software, its application program interface, and OpenAI’s other applications, ChatGPT Labs and Playground.

Although the Francisco-based OpenAI brought the affected systems online on Tuesday morning, in an update on Wednesday, the company said DDoS attacks had caused the outage – and that affected services were continuing to experience system outages.

Hacktivist group Anonymous Sudan on Telegram claimed responsibility for the attacks, citing OpenAI’s alleged ties with the Israeli state government as the reason behind its attack against the company. Cybersecurity researchers say the hackers behind Anonymous Sudan are almost certainly Russian (see: Expensive Proxies Underpin Anonymous Sudan DDoS Attacks).

In a Tuesday message posted to Telegram, the group claimed it will target more American and Israeli organizations in the coming days.

The union representing American Airlines pilots reported a ransomware attack Nov. 2. The Allied Pilots Association tweeted that the incident had begun Oct. 30. A cybersecurity firm hired to investigate the attack confirmed that the union’s systems had been encrypted, and efforts are underway to restore the systems. Pilot-facing products and tools are being given priority.

Cybersecurity researchers from Group-IB identified a ransomware operator they call “Farnetwork.” The operator has deployed five different strains of ransomware including its own strain, Nokoyawa.

Group-IB said it had posed as a potential hire for the criminal gang. In the profit-sharing model, ransomware affiliates receive 65% of the extortion money, the botnet owner receives 20%, and the ransomware owner receives 15%. Group-IB said Farnetwork’s ransomware activities date back to 2019 and include collaborations with other cybercrime groups. Farnetwork announced on June 19 that it would stop recruiting new hires and said its intention is to retire from hacking. The Nokoyawa leak site went offline in October.

“Nonetheless, Group-IB researchers believe that it is only a matter of time before Farnetwork returns to their illicit activities under a different name and with a new RaaS program, as they have done many times in their varied career,” Group-IB wrote.

Luxury resort and casino Marina Bay Sands in Singapore disclosed on Tuesday a data breach affecting the personal information of 665,000 Sands LifeStyle loyalty program members.

Marina Bay Sands discovered the attack on Oct. 20. Hackers gained access to the loyalty program membership data of non-casino rewards program members. The stolen data includes personal identification data such as names, email addresses, phone numbers and membership numbers. The company has reported the incident to authorities and is notifying affected customers individually.

Dutch cybersecurity professional Pepijn Van der Stap, 21, received a prison sentence of three to four years for his involvement in hacking and blackmailing activities targeting over a dozen companies in the Netherlands and globally. The Court of Amsterdam found him guilty of hacking into victims’ computers, extortion and laundering at least 2.5 million euros. Van der Stap and his associates engaged in cybercrimes against domestic and international companies and institutions between August 2020 and January 2023. The investigation into his cybercriminal activities began in March 2021 after they were reported by an Amsterdam-based company. Law officials found malicious tools and stolen personal information on Van der Stap’s computer, and he admitted to assisting other criminals by selling or trading stolen sensitive data, contributing to significant damages to affected organizations.

The United States and South Korea signed memorandum of understanding formalizing areas of cybersecurity cooperation.

The U.S. Cybersecurity and Infrastructure Agency says the MoU means the two countries will regularly consult and collaborate on threat response and critical supply chain resilience. They’ll also participate in joint exercises and training and share best practices on policies governing artificial intelligence.

South Korea is separately talking with the Australian government about increasing cybersecurity mutual aid and formed a working group to discuss cooperation on common threats and responses.

Iranian-linked hacker group Agonizing Serpens has been targeting Israeli higher education and technology organizations since January, according to Palo Alto Networks. The attacks involve exploiting internet-facing web servers and deploying web shells to gain access to the network. The group then steals sensitive data, including personal identifiable information and intellectual property, which is later published on social media or Telegram channels. The stolen information in the recent attacks includes ID numbers, passport scans and email and postal addresses. These attacks are aimed at sowing fear and inflicting reputational damage, the cybersecurity firm said. The hackers also use custom wipers to render endpoints unusable and cover their tracks, and they use stealth and evasive techniques to bypass security solutions such as endpoint detection and response. The attacks have intensified during the Israeli-Palestinian conflict.

With reporting by Information Security Media Group’s Akshaya Asokan in the United Kingdom.