TOKYO (TR) – A shadowy web site aimed toward rallying victims of a latest cyber assault concentrating on Japanese tech titan GMO Internet Group was registered earlier than the breach was even made public, a cybersecurity agency has revealed, reviews NHK (Nov. 1).
According to Tokyo-based safety agency S&J, the now-defunct web site referred to as on people impacted by the unauthorized entry to GMO Internet Group to return ahead and “share information.”
Shortly after the safety breach got here to gentle, a flurry of suspicious social media accounts repeatedly blasted hyperlinks directing victims to the portal.
A forensic evaluation carried out by S&J revealed that the rogue area was registered on October 19 — two days earlier than GMO publicly acknowledged the breach on October 21.
Investigators additionally found that the positioning was hosted on the identical U.S.-based server that the hackers had beforehand used to put up extortion threats towards the corporate, sharing obtrusive structural and technical similarities.
The findings strongly recommend that the portal and the social media accounts selling it have been orchestrated instantly by the cyber criminals behind the assault.
Nobuo Miwa, president of S&J, indicated that the positioning was possible a calculated maneuver designed to ratchet up extortion strain.
“A site like this isn’t necessary if you’re only making ransom demands or negotiating,” Miwa mentioned. “The attackers likely launched it to organize the victims and amplify pressure on the company. Examining the digital breadcrumbs and communication logs could lead to the identification of the attackers.”
GMO will maintain a press convention on Monday, with chairman Masatoshi Kumagai offering an replace on the unauthorized entry.