Tag:

victims

FBI Asks SafeMoon Victims for Info Amid Restitution Efforts

by admin September 18, 2025

In brief

A federal jury found Braden John Karony guilty of securities fraud, wire fraud, and money laundering in May.
The FBI has opened a victim questionnaire to identify SafeMoon investors who may qualify for restitution and services.
Observers say enforcement is catching up with DeFi, though restitution remains difficult in decentralized markets.

A federal jury’s conviction of SafeMoon CEO Braden John Karony on fraud and money-laundering charges has heightened U.S. scrutiny of token promoters, as the FBI seeks investors defrauded in the collapsed DeFi project.

Last week, the FBI opened a victim questionnaire, asking SafeMoon investors who lost money to submit information that could support restitution and help identify the full scope of the fraud.

Karony, 29, was found guilty in May after a two-week trial in Brooklyn, where prosecutors showed he and his co-founders siphoned more than $200 million from SafeMoon’s liquidity pools despite public claims the funds were locked and untouchable.

The FBI said responses to the new questionnaire will help agents identify SafeMoon investors as victims of federal crimes, a legal designation that can qualify them for restitution and services. The bureau affirmed that all information will remain confidential.

Observers say the case implies enforcement is catching up with DeFi projects while also showing the difficulty of measuring investor harm across global token markets.

“This conviction sends a clear message that liquidity-pool promises and tokenomics claims are still subject to the same fraud standards as traditional securities,” Lionel Iruk, senior advisor to Nav Markets and managing partner at Empire Legal, told Decrypt.

The SafeMoon case also establishes “that DeFi projects are not immune from enforcement simply because they utilize smart contracts or decentralised technology,” Iruk said.

Regulators will act when there is “clear control over investor funds,” a precedent Iruk notes should make founders more cautious about relying on “opacity or marketing hype” around liquidity pools in the pursuit of attracting investors.

Still, restitution is complicated by shifting token prices, limited records, and the difficulty of tracing diverted funds, Iruk said.

“Restitution in cases like this is complex. Valuation is the first challenge, where victims bought tokens at different prices and times, and in markets that are highly volatile. This situation makes it hard to establish what “fair value” restitution means,” he explained.

Another challenge is tracing misappropriated funds.

“Even if authorities seize funds, redistributing them fairly among thousands of retail holders is a logistical and legal hurdle,” Iruk said, adding that many investors “lack detailed records,” complicating eligibility and compensation.

The conviction sets a “critical precedent,” pushing token creators to use DeFi responsibly and design systems that safeguard investors by default, with “enhanced transparency and clarity” around tokenomics and smart contracts, Wesley Crook, CEO of blockchain engineering firm FP Block, told Decrypt.

Echoing Iruk’s concerns, Crook said achieving full resitution can be “formidable” owing to the “volatile, dispersed, and pseudonymous nature,” of decentralized finance which makes “retrospective solutions largely ineffective.”

Instead, Crook suggests the focus should be on designing systems “inherently resistant to manipulation,” such that these could “trustlessly safeguard investors through their structure, rather than depending on subjective action to uphold integrity.”

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.

Source link

September 18, 2025 0 comments

Gaming Gear

‘Microsoft has become like an arsonist selling firefighting services to their victims’ says US senator, referring it to the FTC for a cybersecurity flaw, though Microsoft says it has a plan

by admin September 12, 2025

US senator Ron Wyden has written a letter to the FTC requesting that the organisation investigate Microsoft for what he calls “gross cybersecurity negligence.” His complaint is primarily related to a form of encryption still supported by the company’s Windows operating system, which the senator’s office believes is vulnerable to ransomware attacks.

In the letter [PDF warning], Senator Wyden reveals that an investigation his office conducted into a ransomware breach of healthcare provide Ascension last year found that support of the RC4 encryption cipher was a direct contributor to the attack (via Ars Technica).

“Because of dangerous software engineering decisions by Microsoft, which the company has largely hidden from its corporate and government customers, a single individual at a hospital or other organization clicking on the wrong link can quickly result in an organization-wide ransomware infection,” said Wyden.

“Microsoft has utterly failed to stop or even slow down the scourge of ransomware enabled by its dangerous software.”

RC4, or Rivest Cipher 4, was developed in 1987 by mathematician and cryptographer Ron Rivest, and was considered a protected method of encryption until 1994, when it was compromised as a result of a leaked technical description. Despite this, RC4 was widely used in common encryption protocols until around a decade ago, and is still used by Microsoft to secure Active Directory, a Windows component used by system administrators to configure user accounts.

(Image credit: Witthaya Prasongsin via Getty Images)

While Windows will use AES encryption by default, the senator’s office discovered that Windows servers will still respond to RC4-based authentication requests, which potentially opens them up to “Kerberoasting.” This is a technique in which administrative privileges are gained via exploiting encryption on one affected machine in order to install ransomware on others.

In the case of Ascension, the senator claims that a contractor clicking on a malicious link led to hackers “moving laterally” within its server network, exploiting the weak encryption in order to push ransomware to thousands of other other computers in the organisation and ultimately stealing the sensitive data of 5.6 million patients.

While the senator says that his office contacted Microsoft about the vulnerability, and that the company eventually posted a blog post with actions that organisations could take to protect against it, a promised security update to fix the issue is yet to arrive.

(Image credit: Future)

“The Ascension hack illustrates how it is Microsoft’s customers, and, ultimately, the public, who bear the cost of Microsoft’s dangerous software engineering practices and the company’s refusal to inform its customers about the pressing need to adopt important cybersecurity safeguards,” the senator continues.

“There is one company benefiting from this status quo: Microsoft itself. Instead of delivering secure software to its customers, Microsoft has built a multibillion dollar secondary business selling cybersecurity add-on services to those organizations that can afford it. At this point, Microsoft has become like an arsonist selling firefighting services to their victims”

The senator ends his letter by urging the FTC to investigate Microsoft, and hold the company responsible for what the senator claims is the “serious harm it has caused by delivering dangerous, insecure software to the U.S. government and to critical infrastructure entities, such as those in the U.S. health care sector.”

(Image credit: Maciej Toporowicz, NYC via Getty Images)

Microsoft has since released a statement to multiple outlets, including Ars Technica, directly addressing the senator’s claims:

“RC4 is an old standard, and we discourage its use both in how we engineer our software and in our documentation to customers – which is why it makes up less than .1% of our traffic. However, disabling its use completely would break many customer systems,” the company said.

“For this reason, we’re on a path to gradually reduce the extent to which customers can use it, while providing strong warnings against it and advice for using it in the safest ways possible. We have it on our roadmap to ultimately disable its use. We’ve engaged with The Senator’s office on this issue and will continue to listen and answer questions from them or others in government.”

Microsoft also says that in the first quarter of 2026, “Any new installations of Active Directory Domains using Windows Server 2025 will have RC4 disabled by default, meaning any new domain will inherently be protected against attacks relying on RC4 weaknesses. We plan to include additional mitigations for existing in-market deployments with considerations for compatibility and continuity of critical customer services.”

Best gaming PC 2025

All our current recommendations

Source link

September 12, 2025 0 comments

Product Reviews

Automated Sextortion Spyware Takes Webcam Pics of Victims Watching Porn

by admin September 3, 2025

Sextortion-based hacking, which hijacks a victim’s webcam or blackmails them with nudes they’re tricked or coerced into sharing, has long represented one of the most disturbing forms of cybercrime. Now one specimen of widely available spyware has turned that relatively manual crime into an automated feature, detecting when the user is browsing pornography on their PC, screenshotting it, and taking a candid photo of the victim through their webcam.

On Wednesday, researchers at security firm Proofpoint published their analysis of an open-source variant of “infostealer” malware known as Stealerium that the company has seen used in multiple cybercriminal campaigns since May of this year. The malware, like all infostealers, is designed to infect a target’s computer and automatically send a hacker a wide variety of stolen sensitive data, including banking information, usernames and passwords, and keys to victims’ crypto wallets. Stealerium, however, adds another, more humiliating form of espionage: It also monitors the victim’s browser for web addresses that include certain NSFW keywords, screenshots browser tabs that include those words, photographs the victim via their webcam while they’re watching those porn pages, and sends all the images to a hacker—who can then blackmail the victim with the threat of releasing them.

“When it comes to infostealers, they typically are looking for whatever they can grab,” says Selena Larson, one of the Proofpoint researchers who worked on the company’s analysis. “This adds another layer of privacy invasion and sensitive information that you definitely wouldn’t want in the hands of a particular hacker.”

“It’s gross,” Larson adds. “I hate it.”

Proofpoint dug into the features of Stealerium after finding the malware in tens of thousands of emails sent by two different hacker groups it tracks (both relatively small-scale cybercriminal operations), as well as a number of other email-based hacking campaigns. Stealerium, strangely, is distributed as a free, open source tool available on Github. The malware’s developer, who goes by the named witchfindertr and describes themselves as a “malware analyst” based in London, notes on the page that the program is for “educational purposes only.”

“How you use this program is your responsibility,” the page reads. “I will not be held accountable for any illegal activities. Nor do i give a shit how u use it.”

In the hacking campaigns Proofpoint analyzed, cybercriminals attempted to trick users into downloading and installing Stealerium as an attachment or a web link, luring victims with typical bait like a fake payment or invoice. The emails targeted victims inside companies in the hospitality industry, as well as in education and finance, though Proofpoint notes that users outside of companies were also likely targeted but wouldn’t be seen by its monitoring tools.

Once it’s installed, Stealerium is designed to steal a wide variety of data and send it to the hacker via services like Telegram, Discord, or the SMTP protocol in some variants of the spyware, all of which is relatively standard in infostealers. The researchers were more surprised to see the automated sextortion feature, which monitors browser URLs a list of pornography-related terms such as “sex” and “porn,” which can be customized by the hacker and trigger simultaneous image captures from the user’s webcam and browser. Proofpoint notes that it hasn’t identified any specific victims of that sextortion function, but the existence of the feature suggests it was likely used.

Source link

September 3, 2025 0 comments