The U.S. Department of Justice (DoJ) said it seized two internet domains and searched nearly 1,000 social media accounts that Russian threat actors allegedly used to covertly spread pro-Kremlin disinformation in the country and abroad on a large scale.”The social media bot farm used elements of AI to create fictitious social media profiles — often purporting to belong to individuals in the United States — which the operators then used to promote messages in support of Russian government objectives,” the DoJ said.

The bot network, comprising 968 accounts on X, is said to be part of an elaborate scheme hatched by an employee of Russian state-owned media outlet RT (formerly Russia Today), sponsored by the Kremlin, and aided by an officer of Russia’s Federal Security Service (FSB), who created and led an unnamed private intelligence organization.

The developmental efforts for the bot farm began in April 2022 when the individuals procured online infrastructure while anonymizing their identities and locations. The goal of the organization, per the DoJ, was to further Russian interests by spreading disinformation through fictitious online personas representing various nationalities.

The phony social media accounts were registered using private email servers that relied on two domains – mlrtr[.]com and otanmail[.]com – that were purchased from domain registrar Namecheap. X has since suspended the bot accounts for violating its terms of service.

The information operation — which targeted the U.S., Poland, Germany, the Netherlands, Spain, Ukraine, and Israel — was pulled off using an AI-powered software package dubbed Meliorator that facilitated the “en masse” creation and operation of said social media bot farm.

“Using this tool, RT affiliates disseminated disinformation to and about a number of countries, including the United States, Poland, Germany, the Netherlands, Spain, Ukraine, and Israel,” law enforcement agencies from Canada, the Netherlands, and the U.S. said.

Accessibility be damned, preventing phishing is the priorityAfter around two decades of allowing one-time passwords (OTPs) delivered by text message to assist log ins to bank accounts in Singapore, the city-state will abandon the authentication technique.

The Monetary Authority of Singapore (MAS) and The Association of Banks in Singapore (ABS) announced on Tuesday that “major retail banks in Singapore will progressively phase out the use of One-Time Passwords (OTPs) for bank account login by customers who are digital token users within the next three months.”

The banks hope this will “better protect against phishing” – at least against attacks in which scammers trick customers into disclosing their OTP. Instead, MAS and ABS encourage the use of digital tokens –apps running on smartphones that produce OTPs – as the source of second factors for bank account authentication.

Bryan Tan, partner at tech-centric law firm Reed Smith, told The Reg the move was “not unexpected given that scammers have figured out how to game the current OTP system notwithstanding that it was two factor.”

The Register asked ABS and MAS what measures, if any, will be taken to include those who don’t have or want mobile phones – a situation Singapore recognized in 2020 when it created a device to substitute for its COVID-19 tracking app. It’s therefore unclear how the plan to ditch SMS 2FA will impact groups such as neo-luddites and the elderly, especially as dedicated physical tokens have also been a phased out in Singapore. We will update should a substantial reply materialize.

[more]

Filed: https://www.theregister.com/security/

• Selfie-based authentication raises eyebrows among infosec experts
• China’s Big Tech companies taught Asia to pay by scanning QR codes, but made a mess along the way
• Interpol’s latest cybercrime intervention dismantles ransomware, banking malware servers
• Singapore wants datacenters, clouds, regulated like critical infrastr