Misplaced Pages

Revision as of 11:16, 23 September 2024

Group-IB is a privately held cybersecurity company, established in 2003 and headquartered in Singapore. The company creates cybersecurity technologies to investigate, prevent, and fight cybercrime.

Group-IB’s Digital Crime Resistance Centers are located in the Asia-Pacific, Central Asia, Middle East, and Europe.

History

Dmitry Volkov, who serves as the company’s CEO, co-founded Group-IB together with his university classmate, Ilya Sachkov, in 2003. Originally founded in Russia, the company moved its headquarters to Singapore in 2019.

In August 2020, Group-IB became one of the nine cybersecurity firms that received a grant from the Cyber Security Agency of Singapore and the locally based venture capital firm TNB Ventures. In November 2020, Group-IB opened its European Headquarters in Amsterdam, the Netherlands. Seven months later, the company launched its Middle East and Africa operations by setting-up a regional HQ in Dubai, the UAE. In March 2023, Group-IB announced its plans to open a Digital Crime Resistance Center in Thailand.

On April 20, 2023, Group-IB finalized its exit from Russia to focus on expanding the global Digital Crime Resistance network. Dmitry Volkov, co-founder and CEO, sold his stake in Group-IB’s Russia-based business to the company’s local management, while Sachkov had sold his 37.5 percent stake in the Singapore entity to members of top management there.

Products

Group-IB's Unified Risk Platform monitors threat actors at all times in order to detect advanced attacks and techniques. The Unified Risk Platform provides complete coverage of the cyber response chain. Group-IB's products and services consolidated in the Unified Risk Platform include Group-IB's Threat Intelligence, Managed Extended Detection and Response (XDR), Digital Risk Protection, Fraud Protection, Attack Surface Management, Business Email Protection, Audit & Consulting, Education & Training, Digital Forensics & Incident Response, and Cyber Investigations. Group-IB's solutions and services have been recognized by various research agencies such as Gartner, Aite Novarica, Frost & Sullivan, KuppingerCole Analysts AG, and more.

Group-IB's Computer Emergency Response team (CERT-GIB), a private emergency response team that performs threat monitoring across Asia, Europe and the Middle East and Africa region, holds the status of an accredited member of Trusted Introducer. CERT-GIB is a member of the global Forum of Incident Response and Security Teams (FIRST) and a member of the OIC Computer Emergency Response Team. CERT-GIB has been a member of the Anti-Phishing Working Group since October 2020 and a corporate partner of the Asia Pacific Computer Emergency Response Team since February 2023.

Investigations with law enforcement

Group-IB has been a private sector partner of INTERPOL since 2017. In 2015, Europol signed an agreement with Group-IB to cooperate in fighting cybercrime. Since then, the company has been a member of the Europol European Cybercrime Centre's (EC3) Advisory Group on Internet Security, which was created to foster closer cooperation between Europol and its leading non-law enforcement partners. In 2020 and 2021, Group-IB cooperated with Europol, payment companies and law enforcement authorities involved in the framework of the Carding Action - an operation targeting fraudsters selling and purchasing compromised card details on websites selling stolen credit card data, known as card shops.

In line with Group-IB's mission of fighting cybercrime, the company's cyber investigators regularly support global anti-cybercrime operations such as INTERPOL-led "Night Fury", "Falcon", "Lyrebird", "Delilah", as well as the operation "Nervone" which resulted in the arrest of a suspected senior member of the OPERA1ER hacker group. The group is believed to have stolen as estimated USD 11 million in more than 30 attacks across 15 countries in Africa, Asia and Latin America, according to an overview of OPERA1ER's methods published by Group-IB and Orange S.A. in November 2022.

In November 2021, as part of the operation "No-vax free", Group-IB helped Guardia di Finanza (GdF), the Italian law enforcement agency, in the probe into activities of the criminal organization which trafficked fake Green Passes, documents issued for vaccinated Italian citizens and those tested negative or recently recovered from COVID-19 via Telegram messenger. In July 2022, Group-IB assisted the Dutch National Police in the operation to apprehend alleged members of a cybercriminal phishing group named "Fraud Family".

Research

In 2017, Group-IB's Threat Intelligence team published a report that provided further evidence of the links between the Lazarus hacking group and Bureau 121, a North Korean cyberwarfare agency. In September 2018, Group-IB published a first technical report on a previously unknown Silence hacking group linked to the theft of at least $800,000 from Russian and Eastern European financial institutions. In a follow-up report titled “Silence 2.0: Going Global” from August 2019, Group-IB said the geography of the group’s attacks had shifted and estimated the resulting damage to be $4.2 million.

On August 25, 2022, 18 days after Twilio, a communication solutions provider, claimed it had suffered a data breach following a phishing campaign. Group-IB researchers uncovered that the attack on Twilio was part of a wider campaign by a hacker group they codenamed "0ktapus". According to Group-IB, 0ktapus compromised more than 130 organizations during their hacking spree and stole login credentials belonging to nearly 10,000 individuals, mimicking the popular single sign-on service Okta.

In January 2023, the company's Threat Intelligence team uncovered a newly identified advanced persistent threat actor "Dark Pink". Dark Pink, suspected to be linked to an Asian government, breached seven high-profile targets in Southeast Asia and Europe, including government and military agencies, according to Group-IB. On May 31, 2023, Dark Pink broadened its targets to government agencies in countries including Indonesia and Thailand, carrying out cyber-espionage as recently as April 2023, Group-IB said.

In August 2023, Group-IB discovered the vulnerability, which affected the processing of the ZIP file format by WinRAR. Group-IB said hackers have been exploiting this vulnerability since April 2023 to spread malicious ZIP archives on trading forums. CVE-2023-38831 was assigned a severity score of 7.8.

References

1. Asia, Times of Central (2023-12-27). "Group-IB Opens First Digital Crime Resistance Center in Central Asia - The Times Of Central Asia". Retrieved 2024-09-20.
2. Page, Carly (2023-11-01). "With its exit from Russia complete, Group-IB plans its US expansion". TechCrunch. Retrieved 2024-09-20.
3. Knowles, Catherine (14 December 2023). "Cybersecurity firm Group-IB tracks major new threat actor GambleForce". Security Brief Asia. Retrieved 20 September 2024.
4. "Russian cybersecurity firm Group-IB to move global HQ to Singapore". The Business Times. 2018-10-10. Retrieved 2024-09-20.
5. Tham, Irene (2020-07-30). "9 cyber security firms to receive funding to defend Singapore's critical systems, smart nation projects". The Straits Times. ISSN 0585-3923. Retrieved 2024-09-20.
6. Koerkamp, Geert Groot (2020-11-13). "Russische cybercrimebestrijder gaat Nederlandse bedrijven helpen bij het opsporen van computercriminelen". Trouw (in Dutch). Retrieved 2024-09-20.
7. Sharma, Alkesh. "Singapore's Group-IB plans to produce local cyber technologies from Dubai". The National. Retrieved 2024-09-20.
8. "Group-IB to open Digital Crime Resistance Center in Thailand - ET CIO SEA". ETCIO.com. Retrieved 2024-09-20.
9. Marrow, Alexander (April 20, 2023). "Cyber firm Group-IB finalises Russia split to spur global ambitions". Reuters. Retrieved 20 September 2024.
10. "Group-IB exits Russia to focus exclusively on expanding global Digital Crime Resistance network". www.zawya.com. Retrieved 2024-09-20.
11. "Ilya Sachkov withdraws from Group-IB international business, maintains stake in Russian legal entity with changed brand". interfax.com. Retrieved 2024-09-20.
12. Security, Help Net (2022-07-01). "Product showcase: Group-IB Unified Risk Platform". Help Net Security. Retrieved 2024-09-20.
13. "Group-IB joins APAC Computer Emergency Response Team". Channel Asia. Retrieved 2024-09-20.
14. "Trusted Introducer : Home". www.trusted-introducer.org. Retrieved 2024-09-20.
15. "FIRST - Improving Security Together". FIRST — Forum of Incident Response and Security Teams. Retrieved 2024-09-20.
16. "OIC-CERT | Organisation of The Islamic Cooperation - Computer Emergency Response Team". www.oic-cert.org. Retrieved 2024-09-20.
17. "APWG | Group-IB enhances data exchange operations by joining Anti-Phishing Working Group". Retrieved 2024-09-20.
18. "Member Teams : About APCERT / APCERT". www.apcert.org. Retrieved 2024-09-20.
19. Olenick, Doug (2017-11-02). "Group IB, INTERPOL sign data exchange agreement". SC Media. Retrieved 2024-09-20.
20. "Europol signs agreement with Group-IB to cooperate in fighting cybercrime". Europol. Retrieved 2024-09-20.
21. "EC3 Partners". Europol. Retrieved 2024-09-20.
22. "12 online fraudsters arrested in global operation against counterfeiters". Europol. Retrieved 2024-09-20.
23. Ropek, Lucas (2022-08-26). "A Massive Hacking Campaign Stole 10,000 Login Credentials From 130 Different Organisations". Gizmodo Australia. Retrieved 2024-09-20.
24. "INTERPOL supports arrest of cybercriminals targeting online shopping websites". www.interpol.int. Retrieved 2024-09-20.
25. "Three arrested as INTERPOL, Group-IB and the Nigeria Police Force disrupt prolific cybercrime group". www.interpol.int. Retrieved 2024-09-20.
26. "Moroccan police arrest suspected cybercriminal after INTERPOL probe". www.interpol.int. Retrieved 2024-09-20.
27. "Suspected head of cybercrime gang arrested in Nigeria". www.interpol.int. Retrieved 2024-09-20.
28. "Suspected key figure of notorious cybercrime group arrested in joint operation". www.interpol.int. Retrieved 2024-09-20.
29. "Cybercrime Group OPERA1ER Stole $11M From 16 African Businesses". www.darkreading.com. Retrieved 2024-09-20.
30. "https://www.gdf.gov.it/it/gdf-comunica/notizie-ed-eventi/comunicati-stampa/anno-2021/novembre/operazione-oo-vax-free-sgominata-la-banda-dei-green-pass". www.gdf.gov.it. Retrieved 2024-09-20. {{cite web}}: External link in |title= (help)
31. "Telegram channel admins who sold fake vaccine cards arrested". BleepingComputer. Retrieved 2024-09-20.
32. Starks, Tim (2021-07-23). "Dutch police bust alleged 'Fraud Family' phishing service members". CyberScoop. Retrieved 2024-09-20.
33. Leyden, John (30 May 2017). "NORK spy agency blamed for Bangladesh cyberheist, Sony Pictures hack". The Register. Retrieved 20 September 2024.
34. Leyden, John (5 September 2018). "Silence! Cybercrime's Pinky and the Brain have nicked $800k off banks". The Register. Retrieved 20 September 2024.
35. "New Silence hacking group suspected of having ties to cyber-security industry". ZDNET. Retrieved 2024-09-20.
36. "Silence Advanced Hackers Attack Banks All Over the World". BleepingComputer. Retrieved 2024-09-20.
37. Page, Carly (2022-08-08). "Twilio hacked by phishing campaign". TechCrunch. Retrieved 2024-09-20.
38. Roth, Emma (2022-08-08). "Twilio suffers data breach after its employees were targeted by a phishing campaign". The Verge. Retrieved 2024-09-20.
39. Page, Carly (2022-08-25). "Twilio hackers breached more than 130 organizations". TechCrunch. Retrieved 2024-09-20.
40. Weatherbed, Jess (2022-08-26). "A huge phishing campaign has targeted over 130 companies, affecting Twilio and Signal". The Verge. Retrieved 2024-09-20.
41. "Suspected State Hackers Stole Military Data From Asian Countries". Bloomberg.com. 2023-01-11. Retrieved 2024-09-20.
42. "Suspected State-Backed Hackers Hit More Nations as Threat Grows". Bloomberg.com. 2023-05-31. Retrieved 2024-09-20.
43. Page, Carly (2023-08-23). "Hackers exploit WinRAR zero-day bug to steal funds from broker accounts". TechCrunch. Retrieved 2024-09-20.
44. "Threat Actor Exploits Zero-Day in WinRAR to Target Crypto Accounts". www.darkreading.com. Retrieved 2024-09-20.
45. "CVE Website". www.cve.org. Retrieved 2024-09-20.

• Computer security companies
• Computer security software companies
• Technology companies established in 2003
• Technology companies of Singapore