The main problem is that the servers in Ukraine were using a legacy stack instead of full-fledged encryption. As ArsTechnica notes, this could lead to the possibility that the Ukrainian intelligence services might be able (there is no proof of this yet) to access information from the servers or even intercept and decrypt the traffic used by the system.

Server seizure

Windscribe reported that two Ukrainian servers had gone offline on June 24. The company contacted its provider and found out that the servers had been seized by the the Ukrainian authorities investigating activity that occurred one year prior.

“The hosting provider failed to inform us of a preliminary hearing that took place earlier this year, during which a judgement was rendered to seize the two servers in question,” Windscribe says.

The company also noted that there was no reason to believe that the servers were compromised or that anyone was able to gain unauthorized access to them before the seizure. Moreover, Windscribe stressed in the first release that it does not log VPN traffic and that no customer data from these servers are at risk during operation.

The editorial office of AIN.UA has sent a request to the Cyber Police regarding the seizure of the servers. But, at the time of writing, it has not received any response.

Unencrypted VPN

But after the seizure, the company had to admit that those two servers had an OpenVPN server certificate and its private key on the disk and that the servers themselves were not properly encrypted.

“Although we have encrypted servers in high sensitivity regions, the servers in question were running a legacy stack and were not encrypted,” Windscribe confirmed.

Although the company said that the chance of user information falling into the hands of cybercriminals is virtually eliminated, despite the lack of encryption, ArsTechnica says that refusing to encrypt the servers goes against standard industry practice and practically means negating any security guarantees for users.

How the servers might have been used after the seizure

Although the company tried to minimize the impact by outlining the requirements that an attacker would have to satisfy to intercept user data, those conditions are precisely the ones VPNs are designed to protect against. Specifically, according to Windscribe, the conditions for intercepting traffic are as follows:

• The attacker controls your network and can intercept all communications (privileged position for a MITM attack);
• You are using a legacy DNS resolver (legacy DNS traffic is not encrypted and is vulnerable to MITM attacks);
• The attacker can manipulate your unencrypted DNS requests (the DNS entries used to pick an IP address of one of our servers) and will be able to redirect it to a previously seized server;
• You are NOT using Windscribe applications (the applications connect via IP, not DNS entries).

The potential risks to the user if all of the above conditions are met are as follows:

• The attacker will be able to see unencrypted traffic inside your VPN tunnel;
• Encrypted conversations like HTTPS web traffic or encrypted messaging services would not be affected;
• The attacker would be able to see the source and destination of the traffic.

Actions and consequences

One of the steps taken was replacing the current OpenVPN certificate authority with a brand new one that Windscribe says “follows industry best practices” and includes the use of an intermediate certificate authority, not just server certification.

Moreover, the company said it has also decided to move its servers completely to RAM, which means it will no longer have a hard drive backup, and all data will be erased if the server is rebooted or shut down.

However, the company was still unable to encrypt the VPN servers seized in Ukraine, and changes to the certification, which should close the vulnerability that appeared after the loss of the servers, were not completed until July 20, 2021 (the servers had been seized almost a month earlier – June 24).

As ArsTechnica notes, this allowed the current “holders” of the servers to easily impersonate Windscribe servers and capture and decrypt traffic passing through them.

As noted by the Ministry of Internal Affairs, with the help of the ransomware Clop, the hacker group encrypted the data from the Korean and the United States companies and later demanded money to restore access to files.

How the hacker group worked

The Cyber Police found that six defendants carried out attacks of malicious software such as ‘ransomware’ on the servers of American and South Korean companies. They demanded a ransom for decrypting the data, and in case of non-payment, they threatened to disclose the victims’ confidential data.

The hackers sent out emails with a malicious file, after opening which the program carried out a complete infection of the victims’ computers with the remotely controlled program Flawed Ammyy RAT. Using remote access, the hackers activated the Cobalt Strike malicious software, which provided information about the vulnerabilities of the infected servers for further exploitation.

Thus, in 2019, four Korean companies were attacked by the Clop ransomware virus. As a result, 810 internal servers and personal computers of employees were blocked. Also, in 2021, the defendants carried out an attack and encrypted the personal data of employees and financial reports of the Stanford University School of Medicine, the University of Maryland, and the University of California.

Unlike common ransomware attacks, which encrypt large numbers of unidentified personal computers and servers, these attacks targeted a specific victim’s computer network and infected the entire system. The total amount of losses is $500 million.

Law enforcement officers seized about UAH 500,000 in cash

As part of the criminal proceedings, law enforcement officers conducted 21 searches in the defendants’ homes and cars in Kyiv and nearby regions. Computer equipment, cars, about UAH 500,000 in cash, and the property were seized from the suspects.

The criminal proceedings have been opened under Part 2 of Art. 361 (Unauthorized interference with computers, automated systems, computer networks or telecommunication networks) and Part 2 of Art. 209 (Legalization (laundering) of property obtained by criminal means) of the Criminal Code of Ukraine. The defendants face up to eight years in prison. Investigation activities are ongoing.

What happened

• It is reported that the suspect has developed a phishing package and a special administration panel for it. They targeted the web resources of over a hundred banking institutions and their clients in Europe and Australia.
• In particular, the admin panel made it possible to control the accounts of users registered on the compromised resources. The banking information that was entered by customers was then used by hacker groups for their purposes.

• The hacker showed and sold his developments through his online store on the darknet.
• In addition to the phishing tools to attack financial institutions, the detainee was developing resources designed to hack mailing services used by over 1.5b people, the Cyber Police mention.
• The suspect has been served with charge papers under Part 2 of Art. 361-1 of the Criminal Code of Ukraine, “Creation for the purpose of use, dissemination and distribution of harmful software or hardware, as well as their dissemination and distribution.” He faces up to five years of imprisonment. The investigation continues.

According to the statement by the Ministry of Internal Affairs’ (MIA) press office, this virus has caused $2.5 billion in damage to American and European banks and financial institutions.

How the scheme worked

As reported by the Attorney General’s Office, since 2014, a group of Ukrainian hackers using a piece of malware, the so-called encryption virus (“banking Trojan”), designed to steal personal data (passwords, logins, and payment details), has carried out massive interferences in the functioning of servers of both private and state-run banking institutions.

EMOTET’s infrastructure included servers around the world and was effectively a botnet. The “virus” was spread via spam mailouts, Word documents, Excel tables, and email messages.

After penetrating the target software, the virus used the “infected” device for further spamming, as well as install additional viruses. Consequently, the malware stole users’ personal data, including passwords, logins, browsing history, payment and banking details, etc. Later on, the perpetrators would transfer the money to their controlled accounts.

Simultaneous searches in eight countries

The Cyber Police, along with local law enforcement agencies, has conducted simultaneous searches in Ukraine, the Netherlands, Germany, France, Lithuania, Canada, the USA, and the UK.

As a result, the enforcers seized server equipment, computer hardware, and data storage media containing information about the companies targeted by the cyber-attacks. Banking cards, money, and secret ledgers with passwords, logins, and keys to services were also seized.

“Criminal proceedings are being conducted under Art. 361 (Unauthorized interference in the functioning of computers, automated systems, computer networks, or telecommunication networks), Art. 361-1 (Creation of malicious software or hardware with the purpose of usage, distribution, or sale), and Art. 190 (Fraud) of the Criminal Code of Ukraine. The attackers face up to 12 years of imprisonment, with confiscation of property,” the MIA comments.

Now, the activity of the EMOTET network, which was distributed across more than 90 servers in many countries, is completely blocked.

The criminal proceedings for violation was initiated under part 2 of Article 361 of the Criminal Code of Ukraine (computers hacking) and part 1 Article 361-1 (creation and distribution of harmful software).

During the investigation, the Cyber Police officers closed in on 42-year-old resident of Lviv region, who installed a Trojan control center on his own computer and modified it. The place of residence of the hacker was searched, and a laptop with a virus and a PC were seized. During the inspection of the devices, they found an admin panel for access to infected computers, installation files of the virus, screenshots of from the controlled computers.

The department reported that DarkComet provides full remote access to controlled computers, in particular, the ability to upload and download files, manage autoloads and services, take screenshots, intercept microphone audio and video from cameras. It also has a keylogger (keystroke monitoring), clipboard monitor, network utilities, and the ability to shut down and restart a remote computer.

The Сyber Police recommends to check your own computers, despite the small number of computers that have been infected (about 2000). To do this on Windows computers, you need to run cmd console and enter the command for monitoring active netstat-nao network connections.

If you see a connection to host 193.53.83.233 and port 1604 or 81 in the list of connections, the computer is infected.