ShinyHunters is selling online 560 million users’ credit card information, allegedly exfiltrated from Live Nation and TicketMaster. The offer was published on BreachForums, a large infamous darkweb marketplace for stolen data, which has now resurfaced only four weeks after being shut down by the FBI. ShinyHunters is an English-speaking cybercrime known for various important hacks, including a 2020 theft of source code from Microsoft’s private Github in 2020 and the 73 million records’ data breach of AT&T in 2021. Among other methods, it is particularly skilled in exploiting vulnerable Github repos and cloud buckets.

‍

‍

‍

A vulnerability in CheckPoint Network Security gateways (CVE-2024-24919) has been exploited in the wild at least since late April and has been used to infiltrate corporate networks. By compromising old accounts with password-only authentication, the attackers were able to access information on Internet-exposed gateways with remote/mobile access VPN. Concretely, they extracted password hashes for local accounts, including accounts used to connect to Active Directory – which they  used to move laterally within victims’ networks.

‍

‍