Pricefield | Lemmy
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
Queue to [email protected]English •
edit-2
11 months ago

Ukraine says hackers abuse SyncThing tool to steal data

www.bleepingcomputer.com

external-link
message-square
27
fedilink
  • cross-posted to:
  • [email protected]
158
external-link

Ukraine says hackers abuse SyncThing tool to steal data

www.bleepingcomputer.com

Queue to [email protected]English •
edit-2
11 months ago
message-square
27
fedilink
  • cross-posted to:
  • [email protected]
The Computer Emergency Response Team of Ukraine (CERT-UA) reports about a new campaign dubbed "SickSync," launched by the UAC-0020 (Vermin) hacking group in attacks on the Ukrainian defense forces.
alert-triangle
You must log in or register to comment.
  • @[email protected]
    link
    fedilink
    English
    65•11 months ago

    Please dont link with a Google Amp link.

    • QueueOP
      link
      fedilink
      English
      10•11 months ago

      Sorry about that, on my mobile firefox it looked fine. Fucking google.

    • m-p{3}
      link
      fedilink
      English
      58•11 months ago

      Non-shit link: https://www.bleepingcomputer.com/news/security/ukraine-says-hackers-abuse-syncthing-tool-to-steal-data/

    • @[email protected]
      link
      fedilink
      English
      23•11 months ago

      Non-amp link.

      OP, edit this in.

      • @[email protected]
        link
        fedilink
        English
        8•11 months ago

        Please

        • QueueOP
          link
          fedilink
          English
          9•11 months ago

          Fixed!

          • @[email protected]
            link
            fedilink
            English
            2•11 months ago

            Thanks!

      • QueueOP
        link
        fedilink
        English
        6•11 months ago

        Done.

  • sapient [they/them]
    link
    fedilink
    English
    5•
    edit-2
    11 months ago

    It’s a convenient file transfer/sync tool. Copying data has to happen somehow, I’m not surprised someone thought to use syncthing for that purpose >.<, since it can do that. But its not really different than any other tool here.

  • @[email protected]
    link
    fedilink
    English
    2•11 months ago

    This is upsetting

  • @[email protected]
    link
    fedilink
    English
    81•11 months ago

    The attack begins with a phishing email sent to the target

    Okay bro im not reading past this its 2024

    • @[email protected]
      link
      fedilink
      English
      20•11 months ago

      Just click this link bro. Just one more link man. Just click it I need it.

      • t҉̠̙ǵ̣̞̄ͪ͜x̸̱͚̳ͫ͐̑̈ͯͣ̚n̒͌҉͉̦̜̝ͅ
        link
        fedilink
        English
        6•11 months ago

        Your links do nothing! I’m invincible!

        • @[email protected]
          link
          fedilink
          English
          7•11 months ago

          Gets drenched in liquid nitrogen

          • @[email protected]
            link
            fedilink
            English
            2•11 months ago

            deleted by creator

        • @[email protected]
          link
          fedilink
          English
          8•
          edit-2
          11 months ago

          1000016170

          Best i can do is chineese bootleg subway surfers riddled with malware and ads.

      • Todd Bonzalez
        link
        fedilink
        English
        4•11 months ago

        Wow, that second one… 🤣

  • Autonomous User
    link
    fedilink
    English
    13•11 months ago

    They can’t even type Syncthing right.

  • @[email protected]
    link
    fedilink
    English
    102•11 months ago

    Correct me if I’m wrong, but this doesn’t look like this has anything to do with Syncthing vulnerabilities. Instead it looks like a hack that uses a preconfigured Syncthing installation to transfer sensitive data. Disturbing nonetheless.

    • @[email protected]
      link
      fedilink
      English
      2•11 months ago

      Indeed.

    • @[email protected]
      link
      fedilink
      English
      6•11 months ago

      Looks like a specially modified SyncThing was just used for exfil.

      • Deebster
        link
        fedilink
        English
        18•11 months ago

        The article uses the word modified, but it sounds like it’s just talking about configuring it and using it as normal.

    • @[email protected]
      link
      fedilink
      English
      75•11 months ago

      It’s a Phishing scam using a tool. It’s no more exploiting SyncThing than TCP/IP.

      • @[email protected]
        link
        fedilink
        English
        12•11 months ago

        Bet they also utilize electricity these bastards! What’s next? Physics? Oh the humanity!

        • Laurel Raven
          link
          fedilink
          English
          3•11 months ago

          Its physics all the way down

          • @[email protected]
            link
            fedilink
            English
            3•11 months ago

            Relevant xkcd

            • @[email protected]
              link
              fedilink
              English
              1•
              edit-2
              11 months ago

              Relevant edited xkcd

      • @[email protected]
        link
        fedilink
        English
        10•11 months ago

        Just like using a remote desktop tool in a scam I suppose

[email protected]

[email protected]
Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


  • @[email protected]
  • @[email protected]
  • @[email protected]
  • @[email protected]
  • 1 user / day
  • 1.08K users / week
  • 4.56K users / month
  • 12.5K users / 6 months
  • 5 subscribers
  • 15.5K Posts
  • 642K Comments
  • Modlog
  • mods:
  • @[email protected]
  • enu
  • Technopagan
  • L4sBot
  • L3s
  • @[email protected]
  • UI: 0.18.4
  • BE: 0.18.2
  • Modlog
  • Instances
  • Docs
  • Code
  • join-lemmy.org