This year, we not only challenged Supercon attendees to come up with their own Simple Add-Ons (SAOs) for the badge, but to push the envelope on how the modular bits of flair work. Historically, most SAOs were little more than artistically arranged LEDs, but we wanted to see what folks could do if they embraced the largely unused I2C capability of the spec.

[Squidgeefish] clearly understood the assignment. This first-time attendee arrived in Pasadena with an SAO that was hard to miss…literally. Looking directly at the shockingly bright 128 RGB LED array packed onto the one-inch diameter PCB was an experience that would stay with you for quite some time (ask us how we know). With the “artistically arranged LEDs” aspect of the nominal SAO handled nicely, the extra work was put into the design so that the CPU could control the LED array via simple I2C commands.

Aligning the LED footprints with an imported image of the array.
Now that the dust has settled after Supercon, [Squidgeefish] took the time to write up the experience of designing and producing this gorgeous specimen for our reading pleasure. It’s a fascinating account that starts with a hat tip towards the work of [Jason Coon], specifically the Fibonacci series of densely-packed RGB art pieces. The goal was to recreate the design of the 128 LED model in SAO form, but without the design files for the original hardware, that meant spending some quality time with KiCad’s image import feature.

He designed the LED array for assembly at a board house for obvious reasons, but hand soldering was the order of the day for the SOIC-8 microcontroller, capacitors, and SAO header on the reverse side. Speaking of the MCU, [Squidgeefish] went though a couple of possible suspects before settling on the STM8S001J3, and all the code necessary to drive the LEDs and communicate with the badge over I2C are available should you consider a similar project.

Now technically, the SAO was done at this point, but in testing it out on the Vectorscope badge from Supercon 2023, a problem appeared. It turns out that whatever yahoos came up with that design pulled the power for the SAO port right off of the batteries instead of utilizing the boost converter built-in to the Pi Pico. The end result is that, you never get a true 3.3 V. Also, the voltage that the SAO does get tends to drop quickly — leading to all sorts of unexpected issues.

To solve the problem, [Squidgeefish] came up with a clever boost converter “backpack” PCB that attaches to the rear of the completed SAO. This board intercepts the connection to the badge, and takes whatever voltage is coming across the line and steps it up to the 5 V that the LEDs are actually designed for.

Of course, the irony is that since the 2024 Supercon badge actually did use the boost circuitry of the Pico to provide a true 3.3 V on the SAO connector, this modification wasn’t strictly necessary. But we still love the idea of an add-on for the add-on.

The entire write-up is a fantastic read, and serves as a perfect example of why creating your own Simple Add-On can be so rewarding…and challenging. From adding contingency hardware to deal with badges that don’t obey the spec to figuring out how to produce low-cost packaging on short notice, the production of a decent number of SAOs for the purposes of distribution is a great way to peek out from your comfort zone.

hackaday.com/2024/12/16/buildi…

Researchers have been testing a new type of lithium ion battery that uses single-crystal electrodes. Over several years, they’ve found that the technology could keep 80% of its capacity after 20,000 charge and discharge cycles. For reference, a conventional cell reaches 80% after about 2,400 cycles.

The researchers say that the number of cycles would be equivalent to driving about 8 million kilometers in an electric vehicle. This is within striking distance of having the battery last longer than the other parts of the vehicle. The researchers employed synchrotron x-ray diffraction to study the wear on the electrodes. One interesting result is that after use, the single-crystal electrode showed very little degradation. According to reports, the batteries are already in production and they expect to see them used more often in the near future.

The technology shows promise, too, for other demanding battery applications like grid storage. Of course, better batteries are always welcome, although it is hard to tell which new technologies will catch on and which will be forgotten.

There are many researchers working on making better batteries. Even AI is getting into the act.

hackaday.com/2024/12/16/single…

Review of last year’s predictions

The number of services providing AV evasion for malware (cryptors) will increase

We continuously monitor underground markets for the emergence of new “cryptors,” which are tools specifically designed to obfuscate the code within malware samples. The primary purpose of these tools is to render the code undetectable by security software. In 2024, our expert observations indicate that commercial advertising for these cryptors have indeed gained momentum. Cryptor developers are introducing novel techniques to evade detection by security solutions, incorporating these advances into their malware offerings.

Pricing for these tools has remained consistent, ranging from $100 for a monthly subscription to cryptors available on dark web forums to as much as $20,000 for premium private subscriptions. There has been a shift toward the development and distribution of premium private solutions, which are becoming increasingly prevalent compared to public offerings.

Verdict: prediction fulfilled ✅

“Loader” malware services will continue to evolve

As anticipated, the supply for the “loader” malware family has been constant in 2024. These loaders exhibit a wide range of capabilities, from mass-distributed loaders available at low prices to highly specialized loaders tailored to detailed specifications with prices reaching into the thousands of dollars.

Examples of loader offers

Additionally, threat actors appear to be increasingly using multiple programming languages. For example, the client component of the malware may be developed in C++, while the server-side admin panel is implemented in Go.

Along with the wide variety of loader offerings, we have also seen demands for specific functionality tailored to launch a particular infection chain.

Example of searching for a loader with specific requirements

Verdict: prediction fulfilled ✅

Crypto asset draining services will continue to grow on dark web markets

In 2024, we observed a surge in the activity of “drainers” across dark markets. These are malicious tools designed to steal the victim’s crypto assets, such as tokens or NFTs. New drainers emerged throughout the year and were actively promoted on various dark web platforms. In general, the number of unique threads discussing drainers on underground markets increased from 55 in 2022 to 129 in 2024, which is remarkable. At the same time, these posts frequently served as redirects to Telegram.

The number of unique threads about drainers on the dark web (download)

In fact, in 2024, Telegram channels were a prominent hub for drainer-related activity.

Dark web post containing links directing potential collaborators to Telegram

Drainer developers are increasingly focused on serving their long-term clients, with most activity now conducted in invite-only channels.

In terms of functionality, drainers have remained largely consistent, with a continued emphasis on incorporating support for new crypto-related assets such as emerging coins, tokens, and NFTs. 2024 also saw the discovery of the first mobile drainer.

Verdict: prediction fulfilled ✅

Black traffic schemes will be very popular on underground markets

In 2024, the popularity of black traffic schemes on underground markets remained constant. Black traffic dealers have maintained their operations by promoting malicious landing pages through deceptive ads. Sales activities for these services remain robust on underground markets, with demand holding steady, further highlighting the effectiveness of mainstream ad delivery platforms for malware distribution. This method continues to be a popular choice for cybercriminals looking to reach a wider audience, posing an ongoing threat to online users.

Verdict: Partially fulfilled

Evolution and market dynamics of Bitcoin mixers and cleaning services

In 2024, there was no significant increase in the number of services advertising cryptocurrency “cleaning” solutions. The majority of established and popular services have maintained their presence in the market, with little change in the competitive landscape.

Verdict: prediction not fulfilled ❌

Our predictions for 2025

Data breaches through contractors

When abusing company-contractor relationships (trusted relationship attacks), threat actors first infiltrate a supplier’s systems and then gain access to the target organization’s infrastructure or data. In some cases, these attacks result in significant data breaches, such as the case where attackers allegedly accessed Ticketmaster’s Snowflake cloud account by breaching a third-party contractor. Another prominent threat actor employing this tactic was IntelBroker – the actor and their associated gang reportedly breached companies like Nokia, Ford, a number of Cisco customers including Microsoft, and others through third parties.

Profile of the actor named IntelBroker on a popular dark web forum

We expect to see the number of attacks through contractors leading to data breaches at major end targets to continue to grow in 2025. Cloud platforms and IT services often store and process corporate data from multiple organizations, so a breach at just one company can open the door to many others. It is worth noting that a breach does not necessarily have to affect critical assets to be destructive. Not every data breach advertisement on the dark web is the result of a genuinely serious incident. Some “offers” may simply be well-marketed material; for example, certain databases may combine publicly available or previously leaked data and present it as breaking news, or simply claim to be a breach for a well-known brand. By creating hype around what is actually old – and probably irrelevant – data, cybercriminals can provoke publicity, generate buzz, and damage the reputation of both the supplier and its customers.

IntelBroker’s dark web post claiming a Tesla data breach, later edited to claim to be a breach of a third-party EV charging firm

In general, we have noticed an overall increase in the frequency of corporate database advertisements on the dark web. For example, on one popular forum, the corresponding number of posts in August-November 2024 increased by 40% in comparison with the same period last year, and peaked several times.

Number of dark web posts distributing databases on one popular forum, August 2023-November 2024 (download)

While some of this growth may be attributed to the reposting or combining of older leaks, cybercriminals are clearly interested in distributing leaked data – whether new, old, or even fake. Consequently, in 2025, we are likely to witness not only a rise in company data hacks and leaks through contractors, but also an overall increase in data breaches.

Migration of criminal activity from Telegram to dark web forums

Despite a spike in cybercriminal activity on Telegram in 2024, we expect the shadow community to migrate back to dark web forums. Shadow Telegram channels are increasingly being banned, as noted by their administrators:

Examples of messages from threat actors announcing a ban on their Telegram channels and accounts

The return or influx of cybercriminals to dark web forums is expected to intensify competition among these resources. To stand out and attract new audiences, forum operators are likely to start introducing new features and improving conditions for data trading. These may include automated escrow services, streamlined dispute resolution processes, and improved security and anonymity measures.

Increase in high-profile law enforcement operations against cybercrime groups

2024 was a significant year in the global high-profile fight against cybercrime. The world has seen many successful operations – Cronos against LockBit, the takedown of BreachForums, the arrest of WWH Club members, successful initiatives like Magnus against RedLine and Meta stealers, and Endgame against TrickBot, IcedID, and SmokeLoader, and more. We at Kaspersky also actively contributed to law enforcement efforts to combat cybercrime. For example, we supported INTERPOL-coordinated action to disrupt the Grandoreiro malware operation, helped counter cybercrime during the 2024 Olympics, and contributed to Operation Synergia II, which aimed to disrupt cyberthreats such as targeted phishing, ransomware, and infostealers. We also assisted the joint INTERPOL and AFRIPOL operation combating cybercrime across Africa. These and many other cases highlighted the coordination and collaboration between law enforcement and cybersecurity organizations.

We expect 2025 to bring an increase in arrests and takedowns of high-profile cybercriminal group infrastructures and forums. However, in response to the successful operations of 2024, threat actors will likely switch tactics and retreat to deeper, more anonymous layers of the dark web. We also expect to see the emergence of closed forums and an increase in invitation-only access models.

Stealers and drainers to see a rise in their promotion as services on the dark web

Cryptocurrencies have been a prime target for cybercriminals for years. They lure crypto users to scam sites and Telegram bots under various guises, and add crypto-stealing functionality to infostealers and banking Trojans. With the price of Bitcoin setting record after record, the popularity of drainers specifically designed to steal cryptocurrency tokens from victims’ wallets is likely to persist in the coming year.

Infostealers are another type of malware that harvests sensitive information from users’ devices, including private keys for cryptocurrency wallets, passwords, browser cookies, and autofill data. In recent years, we have witnessed a dramatic rise in credential leaks driven by this malware, and we expect this trend to continue – and in some sense evolve. Most likely, we will see the emergence of new families of stealers, along with an increase in the activity of those that already exist.

Both stealers and drainers are likely to be increasingly promoted as services on the dark web. Malware-as-a-Service (MaaS) – or “subscription” – is a dark web business model that involves leasing software to carry out cyberattacks. Typically, clients of such services are offered a personal account through which they can control the attack, as well as technical support. It lowers the initial threshold of expertise required by would-be cybercriminals.

Example of a stealer offered through the MaaS model

In addition to publications on the dark web featuring stealers or drainers themselves, we also see posts looking for traffers – people who help cybercriminals distribute and promote stealers, drainers, or scam and phishing pages.

Examples of traffer searches for drainers

Example of a traffer search for a cryptoscam (not a drainer)

Fragmentation of ransomware groups

Next year, we may see ransomware groups fragmenting into smaller independent entities, making them more difficult to track and allowing cybercriminals to operate with greater flexibility while staying under the radar. Kaspersky Digital Footprint Intelligence data shows that in 2024 the number of Dedicated Leak Sites (DLS) grew 1.5 times compared to 2023. Despite this growth, the average number of unique posts per month has remained the same compared to the previous year.

Ransomware operators are also likely to continue to leverage leaked malware source codes and builders to create their own customized versions. This approach significantly lowers the barrier to entry for new groups, as they can avoid developing tools from scratch. The same goes for Dedicated Leak Sites (DLSs): low-skilled cybercriminals will likely use the leaked DLS source codes of notorious groups to create almost exact copies of their blogs – something we can already see happening on the dark web.

LockBit’s DLS

DarkVault’s DLS is almost an exact copy of LockBit’s

Escalating cyberthreats in the Middle East: hacktivism and ransomware on the rise

According to Kaspersky Digital Footprint Intelligence (DFI), one of the most concerning cybersecurity threats related to dark web activity in the Middle East in the first half of 2024 was the activity of hacktivists. The region has seen an increase in these threats due to the current geopolitical situation, which is likely to continue to rise if tensions do not ease.

Kaspersky DFI researchers observed more than 11 hacktivist movements and various actors across the region. In line with the current geopolitical instability, hacktivist attacks are already shifting from distributed denial of service (DDoS) and website defacement to critical outcomes such as data leaks and the compromise of target organizations.

Another threat that is likely to remain highly active in the region is ransomware. Over the past two years, the Middle East has seen a surge in the number of ransomware attack victims, rising significantly from an average of 28 each six months in 2022-2023 to 45 in the first half of 2024. This trend is likely to persist into 2025.

securelist.com/ksb-dark-web-pr…

Gli scienziati cercano da molti anni di ottenere questo risultato lavorando con gli esseri viventi. Un gruppo di ricercatori della Nanyang Technological University di Singapore ha inventato una macchina per trasformare comuni scarafaggi in cyborg controllati dai computer. La macchina installa sull’insetto apparecchiature elettroniche di stimolazione e comunicazione in soli 68 secondi, 26 volte più velocemente che farlo manualmente.

Innanzitutto, l’animale a sei zampe viene posto in un ambiente con anidride carbonica per immobilizzarlo. Il sistema robotico lo fissa quindi utilizzando aste metalliche e la visione artificiale trova i punti in cui collegare elettrodi in miniatura e altre parti. L’errore medio della tecnologia durante l’installazione dei componenti è di soli 0,3 mm.

La parte principale della modifica è uno zaino elettronico che consente di controllare i movimenti a distanza attraverso la stimolazione delle antenne. Quando un segnale arriva alle antenne sinistra o destra, l’insetto gira nella direzione desiderata. In questo modo l’operatore può guidarlo con precisione in qualsiasi punto. Lo zaino pesa meno di un grammo ed è alimentato da una batteria in miniatura, la cui carica dura sei ore di funzionamento continuo.

I piccoli cyborg funzionano altrettanto bene di quelli “gestiti” manualmente da specialisti esperti. Gli scienziati sottolineano che la procedura è sicura e non danneggia le funzioni biologiche. Dopo aver rimosso l’attrezzatura, gli insetti ritornano completamente alla loro vita normale.

Gli scarafaggi sono perfetti per tali esperimenti grazie alle loro caratteristiche. Sono piccoli, quindi possono passare attraverso strette fessure e macerie dove le persone e i normali robot non possono andare. Queste creature possono anche arrampicarsi sui muri e superare facilmente ostacoli difficili: i robot meccanici hanno ancora problemi in questo. Allo stesso tempo, possono sopportare una pressione pari a 900 volte il loro stesso peso e sono in grado di raggiungere velocità fino a 1,5 metri al secondo.

Questi insetti hanno naturalmente un senso dell’olfatto e del tatto molto acuto. Percepiscono diverse sostanze chimiche, gas e possono persino trovare persone. Le loro antenne rilevano le più piccole fluttuazioni dell’aria e i cambiamenti di temperatura e il loro complesso sistema nervoso consente loro di reagire immediatamente al pericolo.

La nuova tecnologia consente di creare centinaia e persino migliaia di cyborg su ordinazione. A differenza delle macchine intelligenti, gli esseri viventi non spendono quasi alcuna energia e si riproducono: questo è molto più redditizio in termini di tempo e finanze. Secondo i calcoli degli scienziati, mantenere una colonia di mille individui è 100 volte più economico che produrre lo stesso numero di microrobot.

Gli scarafaggi cyborg cercheranno le persone negli edifici distrutti, monitoreranno la qualità dell’aria e rileveranno l’inquinamento. Anche i militari erano interessati all’idea: gli insetti potevano essere usati per la sorveglianza segreta e la raccolta di informazioni. Particolarmente vantaggioso è il fatto che non emettono praticamente alcun suono né attirano l’attenzione e che i loro sistemi elettronici sono troppo piccoli per essere rilevati dai rilevatori convenzionali.

L'articolo Scarafaggi Cyborg in Missione Militare: La Nuova Frontiera della Tecnologia Bio-Robotica proviene da il blog della sicurezza informatica.

La direttiva NIS2: adeguarsi per garantire la sicurezza informatica delle aziende italiane

Con l’adozione della direttiva NIS2 (Network and Information System) da parte dell’Unione Europea, le aziende italiane si trovano di fronte a una nuova sfida normativa che non può essere ignorata. L’obiettivo principale della direttiva è rafforzare la sicurezza informatica nei settori essenziali e garantire la resilienza delle infrastrutture critiche contro le crescenti minacce cyber. Per le aziende italiane, in particolare le piccole e medie imprese (PMI), questa è un’occasione per migliorare la propria protezione digitale e adeguarsi agli standard europei per evitare sanzioni.

Che cos’è la direttiva NIS2?

La direttiva NIS2 rappresenta un’evoluzione della precedente direttiva NIS, ampliando il numero di settori coinvolti e introducendo obblighi più severi in termini di gestione dei rischi informatici e comunicazione delle violazioni. Tra i settori interessati rientrano l’energia, i trasporti, la sanità e le telecomunicazioni, ma anche realtà come i fornitori di servizi digitali e le aziende che gestiscono infrastrutture critiche.

Come evidenziato nel webinar organizzato da Sacchi Associati, il rispetto della direttiva richiede non solo l’adozione di misure tecnologiche, ma anche un ripensamento della governance aziendale per integrare la sicurezza informatica in tutti i processi organizzativi.

Un’opportunità per le aziende italiane

In Italia, la direttiva NIS2 rappresenta un’opportunità per rafforzare la sicurezza informatica in un contesto dove le PMI spesso mancano di risorse adeguate per difendersi dai rischi cyber. Gli obblighi imposti dalla direttiva, sebbene stringenti, spingono le aziende a implementare misure di prevenzione più efficaci e a dotarsi di strumenti e competenze adeguate.

Per le PMI, la sfida maggiore sarà quella di adeguarsi in tempi brevi, investendo in formazione e tecnologie. Tuttavia, il vantaggio competitivo di un’azienda che dimostra di essere conforme è significativo: oltre a ridurre i rischi, può guadagnare maggiore fiducia da parte di clienti e partner, rafforzando la propria reputazione sul mercato.

Preparati con il nostro corso online sulla direttiva NIS2 di Red Hot Cyber

Per aiutare le aziende italiane ad affrontare questa transizione, la nostra Academy propone un corso sulla NIS2 online in modalità e-learning, progettato dall’avvocato Andrea Capelli, consulente esperto in informatica giuridica, protezione dei dati personali e sicurezza informatica. Il corso offre un approccio pratico per comprendere gli obblighi della direttiva e implementare strategie di cybersecurity.

Il corso in modalità e-learning sulla Direttiva NIS2 offre un’esplorazione approfondita delle principali aree di applicazione della normativa, con un focus particolare su temi cruciali per la sicurezza informatica e la gestione del rischio. Verranno affrontati aspetti quali l’organizzazione istituzionale e il ruolo degli enti preposti, la gestione del rischio e dei soggetti coinvolti, la protezione della supply chain, le procedure di notifica e certificazione, nonché le questioni legate alla giurisdizione e alle sanzioni. Il corso si propone di fornire strumenti pratici e conoscenze essenziali per garantire la compliance e rafforzare la resilienza delle organizzazioni nell’ambiente digitale europeo.

Fino al 31 dicembre 2024, è possibile iscriversi con uno sconto del 25% tramite questo link al corso. Questa è un’occasione unica per accedere a competenze specializzate che possono fare la differenza nella protezione della tua azienda.

Perché è importante agire ora

L’adeguamento alla NIS2 non deve essere visto come un costo, ma come un investimento strategico per il futuro della tua azienda. Le minacce informatiche continuano a evolversi, e il rispetto della direttiva può garantire una protezione più efficace contro incidenti che potrebbero compromettere la continuità operativa.

Agire ora significa evitare sanzioni, proteggere i dati aziendali e consolidare la fiducia nel proprio business. Non aspettare l’ultimo momento: inizia subito il percorso di conformità e garantisci alla tua azienda un futuro sicuro e competitivo.

Iscriviti oggi stesso al nostro corso sulla direttiva NIS2

Preparati a guidare la tua azienda verso la compliance con il supporto dei nostri esperti.

Visita il nostro corso online e approfitta dello sconto del 25% fino al 31 dicembre 2024.

La sicurezza informatica inizia dalla formazione!

L'articolo La direttiva NIS2: un passo fondamentale per la sicurezza informatica aziendale proviene da il blog della sicurezza informatica.