Thousands of homes and farming land damaged in Ghor province, a week after over 300 people killed in flash floods

At least 60 people have been killed in a fresh bout of heavy rain and flooding in central Afghanistan, according to an official.

Dozens others remained missing, said Abdul Wahid Hamas, spokesperson for Ghor’s provincial governor, on Saturday. He said the province had suffered significant financial losses, with thousands of homes and properties damaged and hundreds of hectares of agricultural land destroyed in the floods on Friday, including in the province’s capital city, Feroz Koh.

Continue reading...

💾

© Photograph: AFP/Getty Images

💾

© Photograph: AFP/Getty Images

Four suspects arrested at the scene of attack in Bamiyan, with four more foreigners and three Afghans reported wounded

Three Spanish tourists and an Afghan civilian have been killed in a shooting attack in Bamiyan province, central Afghanistan.

The Spanish prime minister, Pedro Sánchez, wrote on social messaging platform X that he was “shocked by the news of the murder of Spanish tourists in Afghanistan”.

Continue reading...

💾

© Photograph: Ali Khara/Reuters

💾

© Photograph: Ali Khara/Reuters

Ban Khun Samut Chin, a coastal village in Samut Prakan province, Thailand, has been slowly swallowed by the sea over the past few decades. This has led to the relocation of the school and many homes, resulting in a dwindling population. Currently, there are only four students attending the school, often leaving just one in each classroom. The village has experienced severe coastal erosion, causing 1.1-2km (0.5-1.2 miles) of shoreline to disappear since the mid-1950s

Continue reading...

💾

© Photograph: AFP/Getty Images

💾

© Photograph: AFP/Getty Images

Cyble Research and Intelligence Labs (CRIL) researchers have uncovered a new SideCopy campaign. The threat actor group has previously been observed targeting South Asian nations with a particular focus on government and military targets in India and Afghanistan. Active since May 2023, the campaign targets university students through sophisticated infection chains involving malicious LNK files, HTAs, and loader DLLs disguised as legitimate documents. Ultimately, the campaign deploys malware payloads such as Reverse RAT and Action RAT, granting attackers extensive control over infected devices. The research explores the tactics employed by SideCopy, such as their recent focus on university students, and potential overlap in activities with the Transparent Tribe APT group.

Technical Analysis of the SideCopy Campaign Infection Chain

In early May, CRIL identified a malicious domain employed by the SideCopy group in their operations. The website was discovered hosting a ZIP archive file named "files.zip" that contained sub-directories labeled as "economy," "it," and "survey." The survey directory included files similar to those previously employed by SideCopy in their earlier campaigns. [caption id="attachment_68383" align="alignnone" width="1228"] Source: Cyble[/caption] The campaign likely employs spam emails to distribute the malicious ZIP archive hosted through the compromised website as the initial infection vector. These archives contain malicious LNK files disguised as legitimate documents, such as "IT Trends.docx.lnk." Upon execution, the LNK files trigger a series of commands that proceeds to download and execute a malicious HTA file. The downloaded HTA files contain embedded payloads within additional lure documents and DLL files. The lure documents are typically themed around current affairs or relevant academic topics to appear legitimate to the targeted demographic. [caption id="attachment_68384" align="alignnone" width="604"] Source: Cyble Blog[/caption] [caption id="attachment_68385" align="alignnone" width="894"] Source: Cyble Blog[/caption] The malware is crafted with the functionality to adopt to the presence of different antivirus software such as Avast, Kaspersky and Bitdefender, which further amplifies its ability to evade detection and ensure persistence by placing the LNK shortcut files in the startup folder. The attack process ultimately leads to the deployment of malicious payloads such as Reverse RAT and Action RAT on to the victim system, which then connect to a remote Command-and-Control (C&C) server to commence malicious activities.

Intersection with Transparent Tribe Activities

The research further suggests a potential overlap or collaboration between SideCopy and Transparent Tribe, another APT group known for targeting Indian military and academic institutions. This intersection hints at a possible collaborative efforts or shared objectives between the two groups with researchers previously noting that SideCopy may function as a sub-division of Transparent Tribe. SideCopy is also known to emulate tactics of the Sidewinder APT group in the distribute of malware files, such as the use of disguised LNK files to initiate a complex chain of infections. CRIL researchers have advised the use of strong email filtering systems, exercise of caution, the deployment of network-level monitoring and the disabling of scripting languages such as PowerShell, MSHTA, cmd.exe to prevent against this potential threat. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

A multi-national police operation cracked opened a massive fraudulent call center network run across Europe. A coordinated effort involving law enforcement agencies from Germany, Albania, Bosnia-Herzegovina, Kosovo and Lebanon has successfully dismantled a criminal network responsible for orchestrating thousands of scam calls targeting individuals worldwide. The crack down, dubbed Operation Pandora, was initiated when a vigilant bank teller in Freiburg, Germany, alerted law enforcement of a customer aged 76-years attempting to withdraw a large sum of money.

"In December 2023 a customer asked to withdraw over EUR 100,000 in cash, the bank teller grew suspicious and quickly learned the customer had fallen victim to a ‘fake police officer scam’. He informed the real police, which prevented the victim from handing the money over to the fraudsters," said Europol, the law enforcement cooperation agency of the European Union.

This initial breakthrough led investigators to uncover a vast network of fraudulent activities spanning multiple countries. Thomas Strobl, interior minister in the southwestern German state of Baden-Württemberg, dubbed the operation as the takedown of "the largest call center fraud scheme in Europe." Strobl said such scams "are particularly perfidious and unscrupulous because they play on peoples' fears and needs." He vowed that authorities would for that reason seek legal recourse "with the utmost severity. Scammers employed various tactics, posing as relatives, bank employees or police officers, to deceive victims into surrendering their savings. The operation revealed call centers operating in different countries, each specializing in different types of telephone fraud, from investment scams to debt collection demands. In response, German authorities established a dedicated call center to monitor and intercept scam calls in real-time, with the aim of preventing further financial losses. More than 100 police personnel were tasked with listening in on the fraudulent call centre calls in real-time, working around the clock and monitoring up to 30 conversations at the same time. Over 1.3 million conversations were tracked, leading to the prevention of over EUR 10 million in potential damages, Europol said. [caption id="attachment_66315" align="aligncenter" width="300"] Assets seized in during police raids. (Credit: Europol)[/caption] During the raids, conducted across multiple countries, law enforcement officers arrested 21 individuals and seized extensive evidence, including cash, assets, and electronic devices. Total assets worth EUR 1 million were recovered in these raids. This operation marks a significant milestone in the fight against telephone fraud and demonstrates the effectiveness of international cooperation in combating transnational criminal networks. Last year, European law enforcement authorities dismantled several call centers across the continent under the control of a criminal syndicate engaged in online investment fraud, commonly referred to as 'pig butchering' cryptocurrency scams. At the time, investigators calculated that victims in Germany alone had suffered losses exceeding EUR 2 million, with individuals from various other countries, including Switzerland, Australia, and Canada, also falling prey to the fraudulent schemes. In March 2022, Europol disclosed the disruption of a large-scale call center operation perpetrating investment scams. The operation, which employed 200 "traders" to bilk victims of a minimum of EUR 3,000,000 monthly, was brought down following the arrest of 108 suspects in Latvia and Lithuania.

U.S. Target of Fraudulent Call Centers from India

The issue of fraudulent call centers is not limited to just Europe but Asian economic power house India too. Since 2022, the Department of Justice (DOJ), the FBI Legal Attaché in New Delhi, the Washington Field Office (WFO), and the Internet Crime Complaint Center (IC3) have been collaborating with Indian law enforcement agencies, including the Central Bureau of Investigation in New Delhi and local authorities in various Indian states, to combat cyber-enabled financial crimes and transnational call center fraud. In 2023, Indian law enforcement agencies conducted multiple raids on fraudulent call centers, leading to disruptions, seizures, and arrests of individuals suspected of involvement in these crimes. Through 13 joint operations with Indian authorities, the FBI facilitated 26 arrests. Additionally, the WFO conducted numerous interviews and continues to provide support to Indian law enforcement in their efforts to prosecute call centers engaged in fraudulent activities. As was seen in the case of Operation Pandora, fraudulent call centers overwhelmingly target older adults, with devastating effects. Almost half the complainants that reported to the IC3 were over 60 (40%), and experience 58% of the losses (over $770 million). Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

REC Silicon says it will soon start shipping polysilicon, which has come mostly from China, reviving a Washington State factory that shut down in 2019.

© Ruth Fremson/The New York Times