Anyone can fall victim to a cyberattack: attackers break into the devices of individuals and companies and even government websites. The damage from such attacks is often not only financial but reputational. And major breaches inevitably attract a lot of attention.
10. DarkHotel: the tarnished reputation of luxury hotels, 2007–2014
- Goal: blackmailing well-known politicians and wealthy businesspeople.
- Method: planting spyware in open Wi-Fi networks.
- Culprits: unknown.
- Damage: not known exactly; most likely large sums of the victims’ personal money.
The attackers spread the spyware, also known as Tapaoux, through open Wi-Fi networks in a number of luxury hotels. Such networks are very poorly protected, which made it easy for the hackers to install their software on hotel servers.
Computers connecting to the Wi-Fi were prompted to install what looked like an official update for some program, such as Adobe Flash or Google Toolbar. That was how the virus was usually disguised.
The hackers also took an individual approach: on one occasion DarkHotel posed as a torrent file for downloading a Japanese erotic comic.
Once on a device, the malware asked for personal data such as a card number during the “update” and could also log keystrokes. As a result, the attackers gained access to the user’s logins, passwords and accounts.
The hackers deliberately planted the virus on hotel networks before the arrival of high-ranking guests in order to access their devices. They knew exactly where the victim would be staying and configured the program to infect only the device they wanted. After the operation, all data was wiped from the servers.
DarkHotel targeted top managers of large companies, successful entrepreneurs, senior politicians and officials. Most of the breaches took place in Japan, China, Russia and Korea. Having obtained confidential information, the hackers apparently blackmailed their victims, threatening to leak the secret data. The stolen information was also used to find new targets and organise further attacks.
Who was behind these cybercrimes is still unknown.
9. Mirai: the rise of the smart devices, 2016
- Goal: bringing down the domain name provider Dyn.
- Method: a DDoS attack using botnet-infected devices.
- Culprits: hackers from New World Hackers and RedCult.
- Damage: more than 110 million dollars.
The boom in internet-connected devices — routers, smart homes, online cash registers, CCTV systems and game consoles — has created new opportunities for cybercriminals. Such devices are usually poorly protected, so they are easy to infect with a botnet. Hackers use botnets to build networks of hijacked computers and other devices, which they then control without their owners’ knowledge.
Botnet-infected devices can then spread the virus and attack targets chosen by the hackers — for example, flooding a server with so many requests that it can no longer process them and goes offline. This is called a DDoS attack.
One botnet with a catchy name became especially notorious: Mirai (Japanese for “future”). Over several years it infected hundreds of thousands of connected routers, security cameras, TV set-top boxes and other devices whose users had not bothered to change the factory passwords.
The virus got into devices simply by guessing the password.
In October 2016 this whole armada received the signal to flood the domain name provider Dyn with requests. As a result, PayPal, Twitter, Netflix, Spotify, PlayStation online services, SoundCloud, The New York Times, CNN and about 80 other Dyn customers went down.
The hacker groups New World Hackers and RedCult claimed responsibility. They made no demands, but the total damage from the downtime of online services came to about 110 million dollars.
Mirai was repelled by redistributing traffic and restarting individual components of Dyn’s system. But the incident raises questions about the security of smart devices, which may account for almost half of all botnet capacity.
8. Scandalous leaks of celebrities’ personal data from iCloud and Twitter, 2014 and 2020
- Goal: seeing what celebrities photograph — and making money along the way.
- Method: asking victims to fill in a form on a fake website.
- Culprits: ordinary young people from the USA and the UK.
- Damage: reputational, plus more than 110 thousand dollars.
iCloud
Cybercriminals can obtain users’ personal data by sending fraudulent messages — for example, text messages disguised as warnings from a security service. The user is told that someone is trying to break into their profile. Fake tech support suggests following a link, which actually leads to the attackers’ website, and filling in a form with their username and password to protect their data. Having obtained a trusting person’s details, the fraudsters gain access to the account.
In 2014 hackers managed in this way to break into the iCloud accounts of a number of celebrities and make their personal data public. The leak was less extensive than it was high-profile: celebrities’ private photos, including some very racy ones, ended up online. In total, about 500 images were stolen, and it is possible that not all of them were published.
Victims included Kim Kardashian, Avril Lavigne, Kate Upton, Amber Heard, Jennifer Lawrence, Kirsten Dunst, Rihanna, Scarlett Johansson, Winona Ryder and others.
Within four years of the breach, five US hackers involved were found and arrested. Four were sentenced to between eight and 34 months in prison, and one got off with a 5,700-dollar fine.
In July 2020 well-known Twitter users came under attack. One of the hackers convinced a social network employee that he worked in the IT department. That is how the hackers gained access to the accounts they wanted. They then posted messages urging people to support Bitcoin and send money to a specified crypto wallet, from which the funds would supposedly be returned doubled.
Once again the victims were famous people: Bill Gates, Elon Musk, Jeff Bezos, Barack Obama and other American celebrities.
Some corporate accounts, such as Apple’s and Uber’s, were also attacked. In total, about 50 profiles were affected.
The social network had to temporarily lock the hacked accounts and delete the fraudulent posts. But the attackers still made a tidy sum: in just a few hours, about 300 users sent the hackers more than 110 thousand dollars.
The hackers turned out to be three young men and a young woman aged 17 to 22 from the USA and the UK. The youngest of them, Graham Clark, managed to pose as a Twitter employee. The young people are now awaiting trial.
7. A 15-year-old hacks NASA and the US Department of Defense, 1999
- Goal: finding out what happens if you hack NASA.
- Method: installing spyware on a government server.
- Culprit: a 15-year-old amateur hacker.
- Damage: 1.7 million dollars and three weeks of scientists’ work.
Jonathan James, a teenager from Miami, was fascinated by space and knew the Unix operating system and the C programming language like the back of his hand. For fun, the boy looked for vulnerabilities in US Department of Defense systems — and found them.
The teenager managed to install spyware on the server of one of its divisions to intercept internal correspondence. This gave him free access to the passwords and personal data of staff at various agencies.
Jonathan also managed to steal code used by NASA to run the life-support system on the ISS. As a result, work on the project was delayed by three weeks. The stolen software was valued at 1.7 million dollars.
In 2000 the boy was caught and sentenced to six months of house arrest. Nine years later, Jonathan James was suspected of involvement in a hacking attack on TJX, DSW and OfficeMax. After being questioned, he shot himself, writing in a suicide note that he was innocent but did not believe in justice.
6. BlueLeaks: the largest theft of US law enforcement data, 2020
- Goal: embarrassing the US government.
- Method: hacking a third-party service provider.
- Culprits: hackers from Anonymous.
- Damage: a leak of confidential data and a scandal in US law enforcement.
US security agencies themselves turned out to be vulnerable to cyberattacks, and the criminals showed they too could use cunning schemes. Rather than breaking into government systems, the attackers hacked Netsential, a web development company that provided federal and local agencies with technical tools for sharing information.
As a result, hackers from the Anonymous group managed to steal more than a million files from US law enforcement and intelligence agencies — 269 gigabytes of information in total. They published the data on the DDoSecrets website. Video and audio clips, emails, memos, financial reports, plans and intelligence documents were made public.
Although there was no classified information or evidence of law enforcement officers breaking the law, much of the material was quite scandalous. For example, it emerged that the agencies had been monitoring Black Lives Matter activists. Enthusiasts began sifting through the leaked files and posting them under the hashtag #blueleaks.
Despite the preliminary review carried out by DDoSecrets, the leaked files did contain confidential data, such as information about suspects and crime victims and bank account numbers.
At the request of the USA, the DDoSecrets server in Germany holding the BlueLeaks data was blocked. A criminal case was opened against Anonymous, but there are still no specific suspects or defendants.
5. GhostNet: China versus Google, human rights activists and the Dalai Lama, 2007–2009
- Goal: spying on dissidents and the governments of Asian countries.
- Method: distributing spyware via a Google server.
- Culprits: Chinese intelligence services.
- Damage: theft of confidential information from politicians and companies; collateral — Google’s exit from China.
Cyberattacks and cyber-espionage are carried out not only by hacker groups but by entire states. Google, for one, felt the full force of hackers working for China.
In 2009 the company discovered that spyware had been spreading for two years through its server in China. It infiltrated at least 1,295 computers of government bodies and private companies in 103 countries.
A wide range of targets were affected, from foreign ministries and NATO to the Dalai Lama’s offices. GhostNet also damaged more than 200 American firms.
China used the virus to spy on the governments of South and Southeast Asia, as well as Chinese dissidents and human rights activists. The program could, for example, switch on a computer’s camera and microphone to eavesdrop on nearby conversations. Chinese hackers also used it to steal source code from some companies’ servers, most likely to build similar systems of their own.
The discovery of GhostNet played a major role in Google shutting down its business in China after less than five years there.
4. Stuxnet: Israel and the USA versus Iran, 2009–2010
- Goal: slowing down Iran’s nuclear programme.
- Method: planting a network worm on the servers of Iranian companies.
- Culprits: Israeli and US intelligence services.
- Damage: 20% of Iran’s uranium enrichment centrifuges put out of action.
Cyberattacks usually require the victim to be connected to the internet. But to spread malware even to computers that have no network access, attackers can infect USB flash drives.
This technique was used very effectively by US and Israeli intelligence, which wanted to slow down Iran’s nuclear weapons programme. However, the country’s nuclear facilities were isolated from the internet, which called for an original approach.
The preparation of the operation was unprecedented. The hackers developed Stuxnet, a sophisticated, complex virus with a specific purpose: it attacked only Siemens software for industrial equipment. The virus was then tested on similar equipment in the closed Israeli town of Dimona.
The first five victims (Iranian companies working in the nuclear sector) were carefully selected. Through their servers, the Americans managed to spread Stuxnet, which unsuspecting nuclear engineers themselves carried onto secret equipment on flash drives.
The hack made the centrifuges Iranian engineers used to enrich uranium spin too fast and break down. At the same time, the malware could fake normal operating readings so the specialists would not notice the failures. About a thousand units — a fifth of all such machines in the country — were put out of action, and Iran’s nuclear programme was slowed and set back several years. That is why Stuxnet is considered the largest and most successful act of cyber-sabotage.
The virus not only did the job it was created for but also spread to hundreds of thousands of computers, although it did them no particular harm. Stuxnet’s real origin was established only two years later, after 2,000 infected files had been studied.
3. The attack on the US Democratic Party’s servers, 2016
- Goal: creating a scandal and damaging Hillary Clinton’s reputation.
- Method: installing spyware on the Democratic Party’s servers.
- Culprits: unknown, but the US authorities suspect Russian hackers.
- Damage: Clinton’s defeat in the presidential election.
Because of the rivalry between Hillary Clinton and Donald Trump, the 2016 US presidential election was scandalous from the very start. Its culmination was a cyberattack on the systems of the Democratic Party, one of the country’s two main political forces.
The hackers managed to install software on the Democrats’ servers that let them manage information and spy on users. After stealing the data, they covered their tracks.
The hackers passed the information they obtained — 30 thousand emails — to WikiLeaks. The key part of the leak was 7,500 of Hillary Clinton’s emails. They contained not only personal data of party members and information about donors but also classified documents. It turned out that Clinton, a presidential candidate and long-serving senior politician, had sent and received confidential information through a personal email account.
In the end Clinton was discredited and lost the election to Trump.
Who was behind the attack is still not known for certain, but American politicians persistently blame Russian hackers from the Cozy Bear and Fancy Bear groups, which, according to the US establishment, had previously taken part in hacking foreign politicians’ systems.
2. WannaCry: an epidemic of data encryption, 2017
- Goal: extorting money from random people and companies.
- Method: encrypting Windows users’ files.
- Culprits: hackers from the Lazarus Group.
- Damage: more than four billion dollars.
One of the nastiest types of malware is ransomware. It infects a computer and encrypts its files, changing their type and making them unreadable. Such viruses then display a banner on the desktop demanding a ransom to unlock the device, usually in cryptocurrency.
In 2017 the internet was swept by a real epidemic of .wcry files — hence the ransomware’s name, WannaCry. The virus exploited a Windows vulnerability on devices whose operating system had not yet been updated. Infected devices then became breeding grounds for the virus and spread it across the network.
First detected in Spain, WannaCry infected 200 thousand computers in 150 countries within four days. It also attacked ATMs, ticket, drink and food vending machines, and information displays running Windows and connected to the network. Equipment in some hospitals and factories was also hit.
Some believe WannaCry’s creators originally intended to hit every Windows device in the world but released the virus by accident before they had finished the code.
After infection, the malware’s creators demanded 300 dollars from each device owner at first, and later, as their appetite grew, 600. Users were also threatened that the sum would increase after three days and that after seven days the files could never be decrypted. In reality, the data could not be restored in any case.
WannaCry was defeated by researcher Marcus Hutchins. He noticed that before infecting a device, the program sent a request to a non-existent domain. Once he registered that domain, the virus stopped spreading. Apparently, this was how the creators planned to stop the ransomware if it got out of control.
The attack was one of the largest in history. According to some estimates, it caused four billion dollars’ worth of damage. WannaCry is linked to the Lazarus Group hacker collective, but the specific perpetrators have not been found.
1. NotPetya/ExPetr: the greatest damage ever caused by hackers, 2016–2017
- Goal: blackmailing businesses worldwide.
- Method: encrypting Windows users’ files.
- Culprits: unknown, but the US authorities suspect Russian hackers.
- Damage: more than 10 billion dollars.
A relative of WannaCry is another ransomware known by suspiciously Russian names: Petya, Petya.A, Petya.D, Trojan.Ransom.Petya, PetrWrap, NotPetya, ExPetr. It also spread over the network and encrypted Windows users’ data, and paying the 300-dollar ransom in cryptocurrency did nothing to save the files.
Unlike WannaCry, “Petya” was deliberately aimed at businesses, so the consequences were much greater even though fewer devices were infected. The attackers managed to take control of the server of the MeDoc financial software and began spreading the virus from there disguised as an update. The mass infection apparently started in Ukraine, which suffered the most damage.
In the end, a wide range of companies around the world were hit. In Australia, chocolate production ground to a halt; in Ukraine, cash registers broke down; and in Russia, a tour operator’s work was disrupted. Some large companies, such as Rosneft, Maersk and Mondelez, also suffered losses. The attack could have had more dangerous consequences: ExPetr even hit the infrastructure for monitoring the situation at Chernobyl.
The total damage from the attack exceeded 10 billion dollars — more than from any other cyberattack. The US authorities accused the Sandworm group, also known as Telebots, Voodoo Bear, Iron Viking and BlackEnergy, of creating “Petya”. According to US prosecutors, the group consists of Russian intelligence officers.
Read at the source (in Russian): The 10 most notorious cyberattacks in history — Lifehacker (lifehacker.ru)