TIKTOK & BYTEDANCE: The Problem with Chinese Social Media in the US

TikTok is a popular social media app for sharing short user-created video clips.  TikTok is a youth-oriented app that is used primarily by those in the 16-24 age demographic. Could the Chinese government exploit TikTok to shape perceptions of China for an audience in the US?

To read the full article in our portal, and find an archive of related reporting, follow this link to - https://redskyalliance.org/finished-analysis/tiktok-and-bytedance-the-problem-of-chinese-social-media-in-the-u

Iranian Protests and Cyber Hacktivism

Wapack Labs analysts have been monitoring the recent demonstrations in Iran involving discontent toward the Islamic Republic seated in the aftermath of the 1979 Revolution. Iranian dissidents and activists took to the streets by the thousands, chanting slogans like “We don’t want an Islamic Republic” and “Death to the dictator”, as they tore down pictures of Supreme Leader Khamenei and set fire to the Governor’s office. Protests began in the second most populous city in Iran, Mashhad, built centered on the Holy Shrine of Imam Reza, which remains a place for religious pilgrimage. By day two, the protests, with the help of the instant messaging service ‘Telegram’, gained momentum reaching the very western city of Kermanshah. As the Iranian government took steps to block media platforms like Instagram, Twitter, and Telegram, the third day of protests had already spread from the northern city of Tabriz to the southern port city of Bandar Abbas...READ MORE

 

Wapack Labs has cataloged and reported on cyber hacktivism in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Dead Russian Social Media Accounts Hacked

Social media accounts originally belonging to the deceased were recently observed promoting pro-Putin messages in Russia. The Russian social network, VK (formerly Vkontakte), reported that accounts were hacked. Social media accounts whose owners are no longer living and other abandoned accounts with weak password security were used in this campaign. Because they were deceased or abandoned accounts, account owners could not react to possible security warnings. Social media networks have different processes for deactivating deceased users. Abandoned accounts may be especially vulnerable to brute force attacks and may later be used in malware or disinformation campaigns. This use of hacked accounts poses a risk of international-level account hijacking on a variety of social media networks...READ MORE

Wapack Labs has cataloged and reported on social media hijacking in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Russian Troll Handlers

TLP AMBER ANNOUNCEMENT:
 

Fake social media accounts controlled by a Russian APT group were focusing on spreading leaks aligned with the Russian agenda. At the same time, another group not only supported candidate Trump, but also spread divisive content from all political affiliations and even organized anti-Trump events in the US. Russian troll operations continued through 2017. It is likely that the group continues its operations in the US and that the associated accounts are dedicated to information warfare. Their cover identities, however, are being changed and the operations are being scaled down compared to the 2016 US presidential campaign...READ MORE 

Wapack Labs has cataloged and reported on Russian social media trolling in the past. An archive of related reporting can be found in the Red Sky Alliance portal. 

WWW.WAPACKLABS.COM 

This TLP AMBER report is available only to Red Sky Alliance members.

Darknet Private Market Selling Hacked Accounts

Wapack Labs is researching an active, darknet actor in a private market. The private market is a multisignature, escrow shopping system based in Europe. The darknet actor is currently advertising breached accounts on their site to include: Paypal, Amazon, Ebay, and Venmo, and has a 97.3% positive feedback rating. Banking information from several U.S. banks having accounts with balances of $10,000+ and $20,000+ are offered. The actor is also selling hacked social media accounts like Instagram and Snapchat. Hacked social media accounts are dangerous as they can be used to hide nefarious activity ranging from pranking to obtaining passwords to compromise banks and online retailers.

Wapack Labs has cataloged and reported extensively on carders in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Fake News and Social Media

The liberation of publishing from traditional media outlets has created opportunities for individuals to practice the art of news reporting, with mixed results. For every legitimate attempt at disseminating factual information, faux reporters traffic in “fake news” in order to increase their popularity rather than report accuracy. Apple executive Tim Cook recently expressed a need for a “massive campaign” to raise awareness of this problem, as fake news has or is influencing elections in the U.S., Russia, the Ukraine, France and other countries. Combatting fake news will require not only the active participation of media outlets, but an emphasis in national education systems on critical thinking skills. 

Wapack Labs has reported on fake news in the past. An archive of related reporting can be found in the Red Sky Alliance Portal.

The following organizations were cited in this report: Apple

TLP: AMBER
ACTOR TYPE: (IV)
SERIAL: TR-036-2017
COUNTRIES: US, RU, UA, FR
INDUSTRIES: ALL
REPORT DATE: 20170214

The Power of Social Media: #DeleteUber

Uber failed to abide with a NYC taxi strike at JFK Airport this past weekend, which was called in response to the Trump Administration’s Executive Order on immigration targeting various Muslim countries. Social media activists staged an online strike of Uber, dubbed: #DeleteUber. The hashtag #UberRideswithHate was also used in conjunction with planned protests in Oakland, New Orleans, Los Angeles, Seattle, Hoboken, and other cities. This on-line protest resulted in Lyft, Uber’s rival, to gain customers despite Uber reducing its rates on basic service (uberX) in New York City by 15 %. In fact the price reduction lead to an Uber driver strike. Negative coverage of these events and public sentiment of Uber employees led to Uber CEO Travis Kalanick resigning from President Trump’s Business Advisory Council. 

Wapack Labs extensively reported on social media protests in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

The following organizations were cited in this report: Uber, Lyft

TLP: AMBER
ACTOR TYPE: (II)
SERIAL: TR-025-2017
COUNTRIES: US
INDUSTRIES: Transportation, Financial
REPORT DATE: 20170203

Counterterrorism in West Africa

The use of cyber communication tools has fueled recent terrorist and criminal activities in West Africa.  This represents the power of cyber and social media platforms to address and expand both developing nation homegrown and controlled terrorist activities; to include the seditious social engineering of susceptible targets.   This malicious cyber activity affects both government operations and business development in Africa and other emerging international societies and their economies.  This information is being supplied for your situational awareness.

• The use of cyber networks in homegrown extremism is on the rise in Africa.
• Recent arrests in West Africa have proven this phenomenon true.
• Developing nations such as Senegal, are realizing this menace and tackling basic cyber security related challenges.

Publication date:                           1 November 2016

Handling requirements:               Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:          #OpAfrica and regional social media bad actors

Actor Type:                                    Adversary capabilities have been assessed as Tier II*

Potential Targets:                          African government and business networks

Past Reporting:                             DOC-3811

*Practitioners with a greater depth of experience, with the ability to develop their own tools from publicly known vulnerabilities.

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

The New Normal – Negative Social Media Sentiment

In recent months, Wapack Labs has been closely tracking social media sentiment.  Our research has supported both law enforcement and our client base.  We have discovered that negative social media sentiment has been instrumental in both public crowd manipulation and used as pointers to promote cyber-attacks on corporations.  Our research has revealed that malicious use of social media has been escalating in both surface and underground forums.  The current manifestation of urban rioting after police shootings is a stark reminder of the use of social media to exact a predicted outcome.   In the Charlotte NC incident, it appears from open source, that social media was the impetus in creating the suggestion to protest, which resulted in subsequent rioting.  In short order, the police attempted to clarify that the suspect possessed a hand gun and thus conveyed the police shooting was legally justified.  But once the original negative sentiment was posted, it held more significance and thus promoted a second day of rioting.  This information is being supplied for your situational awareness.

 

Publication date:                           22 September 2016

Handling requirements:                Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:            Protest Organizers

Actor Type:                                   Tier I  

Potential Targets:                          USA

Past Reporting:                              Red Sky Alliance: DOC-4022, 4120 and 4250

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Neo-Nazis v. ISIS - Social Media Phenomenon

www.cdn.com / www.jpost.com

On 4 September 2016, Wapack Labs revealed an .edu study regarding social media vendor statistical information which commented: Neo-Nazi social media activity has over taken ISIS related post surge.  This may be due to Twitter closely scrutinizing ISIS sites, but also indicates a rise in Neo-Nazi type rhetoric.  This presents a new phenomenon which can be attributed to many factors. Current immigration issues in Western Europe and U.S. equivalent concerns has forged a path in dredging past white supremacy ideology.  This once more proves the seriousness of negative social media tool uses shaping sentiment; concerning both public safety and corporate business alike.  We are providing this information for your situational awareness.

Publication date:                        4 September 2016

Handling requirements:              Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:          Social media  

Actor Type:                                 Tier I or II              

Potential Targets:                       USA / Western Europe

Past Reporting:                           DOC-4215; DOC-4189; DOC-4198, DOC-3688

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Social Media and Hacker Communication

On 23 August 2016, Wapack Labs identified a Twitter post that exposed the black hat Hacker, Revolver, who claims to possess the current, alleged, NSA/Equation Group downloaded files.  The hacker initially posted them for sale and subsequently posted the downloaded files for free.  We are providing this information for your situational awareness.

Publication date:                            23 August 2016

Handling requirements:                  Traffic light protocol (TLP) AMBER

Attribution/Threat Actors:              OSINT –  Hacker information

Actor Type:                                     Tier II     

Potential Targets:                           USA / International

Past Reporting:                               Red Sky Alliance: DOC-4133

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Social Media and Terrorist Communication

On 18 August 2016, Wapack Labs identified a Twitter post that reported Twitter’s suspension of more than 250,000 accounts for suspected terrorist promotion.  This is a continuing and cooperative effort to curtail violent extremism and terroristic messaging/recruitment.  Social media providers often work with law enforcement in an attempt to identify bad actors.  We are providing this information for your situational awareness.

Publication date:  19 August 2016

Handling requirements:  Traffic light protocol (TLP) GREEN 

Attribution/Threat Actors:  OSINT –  Social Media

Actor Type:  Tier II

Potential Targets:  USA / International

Past Reporting:  DOC-3298, DOC-2702 & DOC-4079

This report was published in its entirety to the Financial Services ISAC and Red Sky Alliance portal on August 1, 2016.  For more information, contact Wapack Labs at 844-4-WAPACK.