Sweden’s security service SAPO on Tuesday, Nov. 22 arrested two people suspected of spying for years for an unnamed country, authorities said, with media reporting they were a married couple from Russia.

“The security service conducted an operation on Tuesday morning in the Stockholm area,” the Prosecution Authority said.

Separately, SAPO said, “One of the arrested individuals is suspected of gross unlawful intelligence activities against Sweden and gross unlawful intelligence activities against a foreign power.”

The second individual was a suspected accomplice, it added.

Court documents show that prosecutors believe the intelligence gathering had been going in the Stockholm region since January 2013.

SAPO and the Prosecution Authority declined to give details about the pair but newspaper Aftonbladet reported they were a married couple who emigrated from Russia to Sweden shortly before 2000.

Aftonbladet said the couple, both in their 60s, appeared to live a quiet life in a residential Stockholm neighbourhood, while spying on Sweden and another country for Russia.

“They are just like anybody else. You say hi to them sometimes,” a neighbour interviewed by the paper said.

“In association with the arrests, searches of premises were carried out and a third individual was taken in for questioning,” the security service said.

“Criminal investigation leading up to the arrests has been going on for some time,” SAPO said.

Neither it nor the Prosecution Authority commented on the identity of countries the activities concerned or what type of intelligence had been collected.

Both agencies stressed the case was “not associated with any of the service’s other cases”.

Earlier in November, prosecutors charged two Swedish brothers with “aggravated espionage” for allegedly spying for Russia’s GRU military intelligence service between 2011 and 2021.

Their trial is set to start this week.

The post Sweden Arrests Two Russians for Spying appeared first on Kyiv Post.

Ukrainian investigators have detained a prison official in the recently liberated city of Kherson suspected of committing treason by releasing inmates before the Russian army’s retreat.

The man, who has not been named, was head of one of the departments of the penal colony No. 90, the State Bureau of Investigation (SBI) reported on Nov. 22.

According to the SBI, he collaborated with the Russians from the first days of the occupation of Kherson in March and allowed inmates to flee ahead of Russia’s retreat.

“The SBI detained a traitor from the Kherson colony, who released prisoners before the liberation of the city,” it said in a statement.

“On the day Kherson was liberated from the occupiers, the colony employee pretended not to notice the escape of the prisoners and did not take any action to prevent it.”

However, the official himself did not have the time to escape and was detained, the SBI added.

The former employee is suspected of committing state treason and could face up to life in prison, news site AFP reports.

On Nov. 11, the Russian army pulled forces from the southern city of Kherson in a major setback in a region Russian President Vladimir Putin claimed to have annexed.

At the same time, all prisoners escaped from the Kherson detention center. There were about 600 prisoners. According to witnesses and Ukrainian authorities, Russian troops have left a trail of misery and destruction upon their retreat from Kherson.

The post Ukraine Detains ‘Traitor’ Accused of Releasing Kherson Prisoners appeared first on Kyiv Post.

Good morning from Kyiv where it’s one week since Russia launched the biggest missile strike of the war, the effects of which are still being seen in the capital in the form of rolling blackouts – a very difficult situation for residents as temperatures begin to drop below freezing.

“The Kremlin wants to transform the cold this winter into a weapon of mass destruction,” President Volodymyr Zelensky says.

What’s happening today?

Wednesday sees the launch of the Ukraine government’s “Points of Invincibility” initiative which aims to address some of the issues mentioned above.

In his daily address on Tuesday evening, Zelensky announced 4,000 such places have been prepared across Ukraine that will provide “electricity, mobile communications, Internet, heat, water, and a first-aid kit”.

“Absolutely free and 24/7,” he added.

A website has been set up that shows where these can be accessed. Zelensky added: “It’s important to see now where these points are in your city, in your community, and keep an eye on the map for updates in the coming weeks as new points are added.”

Elsewhere, Russian forces have announced they are on “high alert” after an alleged drone attack in Crimea.

The Kremlin-appointed governor of the Sevastopol administrative region in Crimea, Mikhail Razvozhayev, said no civilian infrastructure had been damaged and called on residents to “remain calm”.

You can read more on that story here

What else did Zelensky say?

Zelensky’s other big news was financial – another tranche of macro-financial aid from the European Union worth 2.5 billion euros and $4.5 billion in additional funding from the U.S. to directly support Ukraine’s budget.

“The financial frontline for Ukraine is now as important as the frontline on the battlefield,” the president said.

What’s the situation on the front lines?

The British Ministry of Defence (MoD) today focuses on Russia’s use of Iranian-made and supplied Kamikaze drones, noting that “Russian commanders likely also wanted… to prioritise medical facilities as targets of opportunity, and strike them with guided munitions if identified”.

The MoD also notes the drone attacks are likely a symptom of Russia’s “severe shortage of cruise missiles”, adding: “No [kamikaze drone] strikes have been publicly reported since around 17 November 2022.

“Russia has likely very nearly exhausted its current stock, but will probably seek resupply.”

The Institute for the Study of War’s daily assessment covers a multitude of topics, most notably:

• The Kremlin may be setting information conditions for a false-flag attack in Belgorod Oblast.
• The Russian military has significantly depleted its arsenal of high-precision missiles but will likely still threaten Ukrainian infrastructure.
• Crimean occupation officials demonstrated heightened unease—likely over Ukrainian strikes on Russian ground lines of communication (GLOCs) in the peninsula and ongoing military operations on the Kinburn Spit.
• Russian sources continue to tout the forced adoption of Ukrainian children into Russian families.

And that’s it for today’s Morning Memo, Kyiv Post will bring you the latest news throughout the day and we’ll be back with another edition tomorrow.

 

 

 

The post Kyiv Post Morning Memo – Wednesday 23 November appeared first on Kyiv Post.

Source url

The post Ukraine Detains ‘Traitor’ Accused of Releasing Kherson Prisoners – Kyiv Post appeared first on Ukraine Intelligence.

Hundreds of workers joined protests at Foxconn’s (2317.TW) flagship iPhone plant in China, with some men smashing surveillance cameras and windows, footage uploaded on social media showed.

The rare scenes of open dissent in China mark an escalation of unrest at the massive factory in Zhengzhou city that has come to symbolise a dangerous build-up in frustration with the country’s ultra-harsh COVID rules as well as inept handling of the situation by the world’s largest contract manufacturer.

The trigger for the protests, which began early on Wednesday, appeared to be a plan to delay bonus payments, many of the demonstrators said on livestream feeds. The videos could not be immediately verified by Reuters.

“Give us our pay!”, chanted workers who were surrounded by people in full hazmat suits, some carrying batons, according to footage from one video. Other footage showed tear gas being deployed and workers taking down quarantine barriers.

Discontent over strict quarantine rules, the company’s inability to stamp out outbreaks and poor conditions including shortages of food has caused workers to flee the factory campus since the Apple Inc (AAPL.O) supplier imposed a so-called closed loop system at the world’s biggest iPhone plant in late October.

Under closed-loop operations, staff live and work on-site isolated from the wider world.

Former workers have estimated that thousands fled the factory campus. Before the unrest, the Zhengzhou plant employed some 200,000 people. To retain staff and lure more workers Foxconn has had to offer bonuses and higher salaries.

In the videos, workers vented about how they were never sure if they were going get meals while in quarantine or complained that there were inadequate curbs in place to contain an outbreak.

“Foxconn never treats humans as humans,” said one person.

Two sources with knowledge of the matter said there were protests at the Zhengzhou campus but declined to provide more details. They declined to be identified as they were not authorised to speak to media.

Foxconn and Apple did not respond to requests for comment.

“It’s now evident that closed-loop production in Foxconn only helps in preventing COVID from spreading to the city, but does nothing (if not make it even worse) for the workers in the factory,” Aiden Chau of China Labour Bulletin, a Hong Kong-based advocacy group, said in an email.

As of Wednesday afternoon, most of the footage on Kuaishou, a social media platform where Reuters reviewed many of the videos, had been taken down. Kuaishou did not respond to a request for comment.

The protest images come at a time when investors are concerned about escalating global supply chain issues due in part to China’s zero-COVID policies that aim to stamp out every outbreak.

The curbs and discontent have hit production. Reuters last month reported that iPhone output at the Zhengzhou factory could slump by as much as 30% in November due to COVID restrictions. read more

Foxconn is Apple’s biggest iPhone maker, accounting for 70% of iPhone shipments globally. It makes most of the phones at the Zhengzhou plant, though it has other smaller production sites in India and southern China.

Shares of Foxconn, formally called Hon Hai Precision Industry Co Ltd, have slipped 2% since the unrest emerged in late October.

Related Galleries:

Source link

The post Russia has killed 438 children in Ukraine appeared first on Ukraine Intelligence.

Chinese authorities imposed more restrictions on Wednesday to rein in a rapid rise in COVID-19 infections, adding to investors’ worries about the economy just as fresh unrest at the world’s largest iPhone factory highlighted the social and financial toll of these curbs.

Across China, cities including the capital Beijing and financial hub Shanghai have closed malls and parks, and imposed limits on the movement of people arriving from elsewhere as infections neared record highs last seen in April.

The measures are darkening the outlook for the world’s second-largest economy and dampening hopes that China would significantly ease its outlier coronavirus policy any time soon.

“While there is little prospect of the authorities opting to step back from the zero-COVID policy during the winter, there is a significant risk that containment efforts fail,” analysts at Capital Economics wrote in a note. Such a failure could result in more lockdowns which would cause unprecedented damage to the economy, the analysts added.

China’s COVID curbs, the tightest in the world, have fuelled discontent across the country and affected production at several manufacturers including Taiwan’s Foxconn (2317.TW), Apple Inc’s biggest iPhone supplier.

On Wednesday, scenes broadcast live on social media showed people describing themselves as Foxconn workers pulling down barriers and fighting with authorities in hazmat suits, chanting “give us our pay”. The unrest follows weeks of turmoil which has seen scores of employees leave the factory over COVID controls.

Even though infection numbers are low by global standards, China has stuck with its zero-COVID approach, a signature policy of President Xi Jinping that officials argue saves lives and prevents the medical system from being overwhelmed. As of Tuesday, there were 28,883 new domestically transmitted cases, official data showed.

Residents are increasingly getting fed up with nearly three years of restrictions, and Wednesday’s protest at the Foxconn factory in Zhengzhou comes weeks after now deleted social media images showed crowds crashing through barriers and clashing with hazmat-suit-clad workers in the southern city of Guangzhou.

The rising case numbers are also testing China’s resolve to avoid one-size-fits-all measures such as mass lockdowns to curb outbreaks, and rely on recently tweaked COVID rules instead.

However, unofficial lockdowns have increased, including in residential buildings and compounds in Beijing, where case numbers hit a new high on Tuesday. Officials there have shut malls, parks and museums, and urged residents of certain neighbourhoods not to leave, turning the usually bustling capital into a ghost town.

In Shanghai, a city of 25 million that was locked down for two months earlier this year, China’s top auto association said on Wednesday it would cancel the second day of the China Automotive Overseas Development Summit being held there over COVID concerns.

Authorities there also announced fresh restrictions on arrivals, while Chengdu, with 428 cases on Tuesday, became the latest city to announce mass testing.

Major manufacturing hubs Chongqing and Guangzhou have seen persistently high infection numbers for days, accounting for most of China’s caseload. Cases in Guangzhou fell slightly on Tuesday to 7,970 and authorities have said infections continue to be concentrated in key areas of Haizhu district.

Investors who last week were hopeful that China would ease restrictions soon have now grown worried that the latest wave of infections could slow the economic reopening. read more Many analysts say a significant reopening is unlikely before March or April.

“The next few weeks could be the worst in China since the early weeks of the pandemic both for the economy and the healthcare system,” said analysts at Capital Economics.

Related Galleries:

Several people were killed and injured in a shooting at a Walmart in Chesapeake, Virginia, on Tuesday night, including the shooter, police said, just days after a gunman killed at least five people and injured 25 at a Colorado LGBTQ nightclub.

It was not clear whether the shooter died of self-inflicted injuries, public information officer Leo Kosinski said in a media briefing. The police have so far not provided any details about the shooter, but several media outlets have identified him as a manager at the store.

At 10:12 p.m., police responded to a report of a shooting inside a Walmart, Kosinski said, adding that “less than 10” people were dead but declining to give the exact number.

Kosinski also said no shots were fired at police “to his knowledge”.

“We’re only a few hours into the response, so we don’t have all the answers yet,” the City of Chesapeake said. “We do know there are multiple fatalities plus injuries and the shooter is confirmed dead.”

Walmart said in a statement early Wednesday that it was “shocked” at the shootings at its Chesapeake store, and that it was working closely with law enforcement.

A spokesperson for Sentara Norfolk General Hospital, which has the area’s top trauma center, told television station WAVY that five patients were being treated there.

“Sickened by reports of yet another mass shooting, this time at a Walmart in Chesapeake. I’ll be monitoring developments closely,” Virginia senator Mark Warner tweeted on Wednesday.

The police department did not immediately respond to a Reuters request for comment.

Two explosions at bus stops on Jerusalem’s outskirts killed one person and wounded at least 14 others on Wednesday, health officials said, in what Israeli police said appeared to be an attack by Palestinian militants.

They blamed the initial blast, which occurred during rush hour, on an explosive device planted at a bus station near the city exit. The second – about 30 minutes later – hit a bus stop in the vicinity of an urban settlement in the east of the city.

Police spokesman Eli Levi told Army Radio the first blast was caused by a powerful explosive device.

“There has not been such a coordinated attack in Jerusalem for many years,” Levi added.

Israeli army radio said the explosive devices were hidden in bags and at least one of them contained nails to maximise the impact.

Security camera footage aired by N12 news showed the moment of the first explosion with a sudden cloud of smoke billowing from the bus stop. Television showed debris strewn around the site, which was cordoned off by emergency services.

Israel’s ambulance service said 12 people had been taken to hospital from the first blast and three people were wounded in the second explosion. One of the wounded died in hospital, the Shaare Zedek Medical Center said.

The explosions, which carry echoes of the bus bombings that were a hallmark of the Palestinian revolt of 2000-2005, follow months of tension in the occupied West Bank after the Israeli military launched a crackdown in the wake of a series of deadly attacks in Israel.

In Gaza, a spokesman for the Palestinian militant group Hamas praised the Jerusalem explosions but stopped short of claiming responsibility.

Hamas spokesman Abdel-Latif Al-Qanoua linked the blasts to “the crimes conducted by the (Israeli) occupation and the settlers”.

The explosions came as former prime minister Benjamin Netanyahu negotiates with allies to form a new right-wing government including members of religious and far-right parties.

One of his allies, ultra-nationalist lawmaker Itamar Ben-Gvir who heads the Jewish Power party, visited the scene of the first bombing where he demanded tough action against militants.

“Even if it’s in the West Bank, lay siege to them and go from house to house in search of guns and restore our deterrence power,” said Ben-Gvir, who hopes to be appointed police minister in the new government.

In a separate incident, Palestinian militants late on Tuesday abducted the body of an Israeli high-school student who had died in a Palestinian hospital in the West Bank city of Jenin after being injured in a car crash nearby, the teenager’s uncle told Kan Radio.

The Israeli military said it expected the body would be returned soon. It was unclear why the militants had taken the body and there was no immediate indication of any connection between this incident and the bombings.

Related Galleries:

The gang behind Quantum Locker used a particular modus operandi to target large enterprises relying on cloud services in the NACE region.

Executive Summary

• Quantum Locker gang demonstrated capabilities to operate ransomware extortion even on cloud environments such as Microsoft Azure.
• Criminal operators of the Quantum gang demonstrated the ability to hunt and delete secondary backup copies stored in cloud buckets and blobs.
• Quantum Locker gang targets IT administration staff to gather sensitive network information and credential access. 
• During their intrusions, Quantum operators steal access to enterprise cloud file storage services such as Dropbox, to gather sensitive credentials.
• Cloud root account takeovers have been observed in q4 2022 during Quantum gang intrusions in North Europe.

Incident Insights

During the latest weeks, the Belgian company Computerland shared insights with the European threat intelligence community about Quantum TTPs adopted in recent attacks. The shared information revealed Quantum gang used a particular modus operandi to target large enterprises relying on cloud services in the NACE region.

The disclosed technical details about recent intrusions confirm the ability of the Quantum Locker gang to conduct sabotage and ransomware attacks even against companies heavily relying on cloud environments.

For instance, TTPs employed in a recent attack include the complete takeover of company Microsoft cloud services through the compromise of the root account (T1531). Such action is particularly harrowing for the victim company: all the Microsoft services and users, including email services and regular users, would remain unusable until the Vendor’s response, which could last even days, depending on the reset request verification process.

In addition, the insights on q4 2022 attacks reported Quantum Locker operators are able to locate and delete all the victim Microsoft Azure’s Blob storages to achieve secondary backup annihilation and business data deletion (T1485). Even if cloud services could theoretically provide support for the restoration of old blobs and buckets, the recovery of “permanently deleted” data often requires days and might not even be available due to the provider’s internal technical restrictions.

The favorite initial targets of Quantum operators during their recent activities in North Europe were IT administrators and networking staff. Through accessing their personal resources and shared Dropbox folders, the threat actors were able to gather sensitive administrative credentials to extend the attack on the cloud surface (T1530).

Incident insights from the Belgian firm also confirm Quantum is coupling these new techniques even with more traditional ransomware delivery techniques, such as the modification of domain Group Policies (T1484.001) to distribute ransomware across the on-prem Windows machines and users’ laptops, along with the abuse of the legitimate Any Desk software as remote access tool (T1219).

Also, during the recent intrusions, Quantum operators extensively altered the configuration of endpoint defense tools such as Microsoft Defender (T1562.001).  In fact, threat actors were able to programmatically insert ad hoc exclusions to blind the onboard endpoint protection system without raising any shutdown warning.

The Belgian firm also reports Quantum Locker’s average encryption speed in real-world cloud hybrid scenario results around 13 MB/s, an amount particularly slower than other ransomware families adopting intermitted encryption, extending the responders’ windows of opportunity for in-time interception and containment. 

Threat Actor Brief

Quantum Locker ransomware was originally born from the hashes of the MountLocker ransomware program operated by Russian-speaking cybercriminals back in 2020. Before its actual name, Quantum Locker has been rebranded many times first with the AstroLocker name, and then with the XingLocker alias.

Quantum Locker was also involved in many high-profile attacks such as the Israelian security company BeeSense, the alleged attack on the local administration of the Sardinia region in Italy, and government agencies in the Dominican Republic.

Indicator of Compromise

• Intrusion and Exfiltration infrastructure
  • 146.70.87,66 M247-LOS-ANGELES US
  • 42.216.183,180 NorthStar CN
• Distribution Infrastructure:
  • hxxp://146.70.87,186/load/powerDEF
  • 146.70.87,186 M247-LOS-ANGELES

About the author : Luca Mella, Cyber Security Expert

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Quantum Locker)

The post Exclusive – Quantum Locker lands in the Cloud appeared first on Security Affairs.